From owner-cvs-all@FreeBSD.ORG Fri Feb 3 00:36:35 2006 Return-Path: X-Original-To: cvs-all@FreeBSD.org Delivered-To: cvs-all@FreeBSD.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 9BB8716A429; Fri, 3 Feb 2006 00:36:35 +0000 (GMT) (envelope-from brdavis@odin.ac.hmc.edu) Received: from odin.ac.hmc.edu (Odin.AC.HMC.Edu [134.173.32.75]) by mx1.FreeBSD.org (Postfix) with ESMTP id 344ED43D58; Fri, 3 Feb 2006 00:36:35 +0000 (GMT) (envelope-from brdavis@odin.ac.hmc.edu) Received: from odin.ac.hmc.edu (localhost.localdomain [127.0.0.1]) by odin.ac.hmc.edu (8.13.0/8.13.0) with ESMTP id k130aYHq014067; Thu, 2 Feb 2006 16:36:34 -0800 Received: (from brdavis@localhost) by odin.ac.hmc.edu (8.13.0/8.13.0/Submit) id k130aYST014066; Thu, 2 Feb 2006 16:36:34 -0800 Date: Thu, 2 Feb 2006 16:36:34 -0800 From: Brooks Davis To: Doug Barton Message-ID: <20060203003634.GA10492@odin.ac.hmc.edu> References: <200602021002.k12A2u0u067172@repoman.freebsd.org> <43E2A089.7020202@FreeBSD.org> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="OXfL5xGRrasGEqWY" Content-Disposition: inline In-Reply-To: <43E2A089.7020202@FreeBSD.org> User-Agent: Mutt/1.4.1i X-Virus-Scanned: by amavisd-new X-Spam-Status: No, hits=0.0 required=8.0 tests=none autolearn=no version=2.63 X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on odin.ac.hmc.edu Cc: cvs-src@FreeBSD.org, src-committers@FreeBSD.org, Robert Watson , cvs-all@FreeBSD.org, trhodes@FreeBSD.org Subject: Re: cvs commit: src/etc/rc.d Makefile auditd X-BeenThere: cvs-all@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: CVS commit messages for the entire tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Feb 2006 00:36:35 -0000 --OXfL5xGRrasGEqWY Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, Feb 02, 2006 at 04:15:05PM -0800, Doug Barton wrote: > Robert Watson wrote: > > rwatson 2006-02-02 10:02:56 UTC > >=20 > > FreeBSD src repository > >=20 > > Modified files: > > etc/rc.d Makefile=20 > > Added files: > > etc/rc.d auditd=20 > > Log: > > Add auditd rc.d script. > > =20 > > Submitted by: trhodes > > Obtained from: TrustedBSD Project > > =20 > > Revision Changes Path > > 1.64 +1 -1 src/etc/rc.d/Makefile > > 1.1 +34 -0 src/etc/rc.d/auditd (new) > >=20 > > http://www.FreeBSD.org/cgi/cvsweb.cgi/src/etc/rc.d/Makefile.diff?&r1=3D= 1.63&r2=3D1.64&f=3Dh > > http://www.FreeBSD.org/cgi/cvsweb.cgi/src/etc/rc.d/auditd >=20 > I have a couple concerns about this. First the more general, I'm not sure > that /etc/security is a reasonable place for your config files. That's a > very general name, and the audit stuff is a very specific project. That > said, I'm not sure that we need yet another directory under /etc, but I'm > curious about what others think about this issue. >=20 > My more specific concern is about some aspects of the rc.d script. First, > it's not clear why you need BEFORE: DAEMON, generally services like this > would REQUIRE: DAEMON instead. Is there a good reason that this has to st= art > earlier than that? It's also generally a bad thing to use BEFORE when it's > not absolutely necessary. Is there something else that could REQUIRE audi= td > that would get you the same or similar ordering? Next, I'm pretty sure you > don't need the test for the pid file in auditd_stop, rc.subr should handle > that for you. Please test that, and if it doesn't work properly let > freebsd-rc@ know about it. You should probably also add the shutdown KEYW= ORD > so that this gets killed off properly on system shutdown. Finally, I'm > pretty sure that command_args=3D"${auditd_flags}" is not needed. If you f= ind > that it is, that's worth mentioning on freebsd-rc@ as well. In this case, I believe the placement of the script is correct. auditd is on the order of syslog. If you're going to run it, you want it early so you know what your daemons did. -- Brooks --=20 Any statement of the form "X is the one, true Y" is FALSE. PGP fingerprint 655D 519C 26A7 82E7 2529 9BF0 5D8E 8BE9 F238 1AD4 --OXfL5xGRrasGEqWY Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQFD4qWQXY6L6fI4GtQRAhSBAJ0TtD3ajgEBZYpkHi8l7YCnhUZh0ACg0odJ 9ssdRt45JrwYSUMvNP7OAS0= =aFEd -----END PGP SIGNATURE----- --OXfL5xGRrasGEqWY--