Date: Fri, 22 Sep 2006 11:31:15 GMT From: Robert Watson <rwatson@FreeBSD.org> To: Perforce Change Reviews <perforce@freebsd.org> Subject: PERFORCE change 106498 for review Message-ID: <200609221131.k8MBVFV6086967@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
http://perforce.freebsd.org/chv.cgi?CH=106498 Change 106498 by rwatson@rwatson_peppercorn on 2006/09/22 11:30:25 Add getacfilesz(3) and audit_control(5) filesz setting, which allows the administrator to specify the desired maximum audit trail size before the audit trail file is rotated. Affected files ... .. //depot/projects/trustedbsd/openbsm/bin/auditd/auditd.c#22 edit .. //depot/projects/trustedbsd/openbsm/bsm/libbsm.h#30 edit .. //depot/projects/trustedbsd/openbsm/etc/audit_control#5 edit .. //depot/projects/trustedbsd/openbsm/libbsm/au_control.3#5 edit .. //depot/projects/trustedbsd/openbsm/libbsm/bsm_control.c#16 edit .. //depot/projects/trustedbsd/openbsm/libbsm/libbsm.3#8 edit .. //depot/projects/trustedbsd/openbsm/man/audit_control.5#12 edit Differences ... ==== //depot/projects/trustedbsd/openbsm/bin/auditd/auditd.c#22 (text+ko) ==== @@ -30,7 +30,7 @@ * * @APPLE_BSD_LICENSE_HEADER_END@ * - * $P4: //depot/projects/trustedbsd/openbsm/bin/auditd/auditd.c#21 $ + * $P4: //depot/projects/trustedbsd/openbsm/bin/auditd/auditd.c#22 $ */ #include <sys/types.h> @@ -727,6 +727,8 @@ char naeventstr[NA_EVENT_STR_SIZE]; char polstr[POL_STR_SIZE]; long policy; + au_fstat_t au_fstat; + size_t filesz; /* * Process the audit event file, obtaining a class mapping for each @@ -806,6 +808,17 @@ "Failed to set default audit policy: %m"); } + /* + * Set trail rotation size. + */ + if (getacfilesz(&filesz) == 0) { + bzero(&au_fstat, sizeof(au_fstat)); + au_fstat.af_filesz = filesz; + if (auditon(A_SETFSIZE, &au_fstat, sizeof(au_fstat)) < 0) + syslog(LOG_ERR, "Failed to set filesz: %m"); + } else + syslog(LOG_ERR, "Failed to obtain filesz: %m"); + return (0); } ==== //depot/projects/trustedbsd/openbsm/bsm/libbsm.h#30 (text+ko) ==== @@ -26,7 +26,7 @@ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE * POSSIBILITY OF SUCH DAMAGE. * - * $P4: //depot/projects/trustedbsd/openbsm/bsm/libbsm.h#29 $ + * $P4: //depot/projects/trustedbsd/openbsm/bsm/libbsm.h#30 $ */ #ifndef _LIBBSM_H_ @@ -78,6 +78,7 @@ #define DIR_CONTROL_ENTRY "dir" #define MINFREE_CONTROL_ENTRY "minfree" +#define FILESZ_CONTROL_ENTRY "filesz" #define FLAGS_CONTROL_ENTRY "flags" #define NA_CONTROL_ENTRY "naflags" #define POLICY_CONTROL_ENTRY "policy" @@ -719,6 +720,7 @@ void endac(void); int getacdir(char *name, int len); int getacmin(int *min_val); +int getacfilesz(size_t *size_val); int getacflg(char *auditstr, int len); int getacna(char *auditstr, int len); int getacpol(char *auditstr, size_t len); ==== //depot/projects/trustedbsd/openbsm/etc/audit_control#5 (text+ko) ==== @@ -1,8 +1,9 @@ # -# $P4: //depot/projects/trustedbsd/openbsm/etc/audit_control#4 $ +# $P4: //depot/projects/trustedbsd/openbsm/etc/audit_control#5 $ # dir:/var/audit flags:lo minfree:20 naflags:lo policy:cnt +filesz:0 ==== //depot/projects/trustedbsd/openbsm/libbsm/au_control.3#5 (text+ko) ==== @@ -1,5 +1,5 @@ .\"- -.\" Copyright (c) 2005 Robert N. M. Watson +.\" Copyright (c) 2005-2006 Robert N. M. Watson .\" All rights reserved. .\" .\" Redistribution and use in source and binary forms, with or without @@ -23,7 +23,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.\" $P4: //depot/projects/trustedbsd/openbsm/libbsm/au_control.3#4 $ +.\" $P4: //depot/projects/trustedbsd/openbsm/libbsm/au_control.3#5 $ .\" .Dd April 19, 2005 .Dt AU_CONTROL 3 @@ -33,6 +33,7 @@ .Nm endac , .Nm getacdir , .Nm getacmin , +.Nm getacfilesz , .Nm getacflg , .Nm getacna , .Nm getacpol , @@ -52,6 +53,8 @@ .Ft int .Fn getacmin "int *min_val" .Ft int +.Fn getacfilesz "size_t *size_val" +.Ft int .Fn getacflg "char *auditstr" "int len" .Ft int .Fn getacna "char *auditstr" "int len" @@ -88,6 +91,10 @@ .Va min_val variable. .Pp +.Fn getacfilesz +returns the audit trail rotation size in the passed size_t buffer +.Fa size_val . +.Pp .Fn getacflg returns the audit system flags via the the passed character buffer .Va auditstr ==== //depot/projects/trustedbsd/openbsm/libbsm/bsm_control.c#16 (text+ko) ==== @@ -27,7 +27,7 @@ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE * POSSIBILITY OF SUCH DAMAGE. * - * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_control.c#15 $ + * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_control.c#16 $ */ #include <bsm/libbsm.h> @@ -396,6 +396,46 @@ } /* + * Return the desired trail rotation size from the audit control file. + */ +int +getacfilesz(size_t *filesz_val) +{ + char *filesz, *dummy; + long long ll; + + pthread_mutex_lock(&mutex); + setac_locked(); + if (getstrfromtype_locked(FILESZ_CONTROL_ENTRY, &filesz) < 0) { + pthread_mutex_unlock(&mutex); + return (-2); + } + if (filesz == NULL) { + pthread_mutex_unlock(&mutex); + errno = EINVAL; + return (1); + } + ll = strtoll(filesz, &dummy, 10); + if (*dummy != '\0') { + pthread_mutex_unlock(&mutex); + errno = EINVAL; + return (-1); + } + /* + * The file size must either be 0 or >= MIN_AUDIT_FILE_SIZE. 0 + * indicates no rotation size. + */ + if (ll < 0 || (ll > 0 && ll < MIN_AUDIT_FILE_SIZE)) { + pthread_mutex_unlock(&mutex); + errno = EINVAL; + return (-1); + } + *filesz_val = ll; + pthread_mutex_unlock(&mutex); + return (0); +} + +/* * Return the system audit value from the audit contol file. */ int ==== //depot/projects/trustedbsd/openbsm/libbsm/libbsm.3#8 (text+ko) ==== @@ -23,7 +23,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.\" $P4: //depot/projects/trustedbsd/openbsm/libbsm/libbsm.3#7 $ +.\" $P4: //depot/projects/trustedbsd/openbsm/libbsm/libbsm.3#8 $ .\" .Dd April 19, 2005 .Dt LIBBSM 3 @@ -84,6 +84,7 @@ .Xr endac 3 , .Xr setac 3 , .Xr getacdir 3 , +.Xr getacfilesz 3 , .Xr getacflg 3 , .Xr getacmin 3 , .Xr getacna 3 , ==== //depot/projects/trustedbsd/openbsm/man/audit_control.5#12 (text+ko) ==== @@ -1,4 +1,5 @@ .\" Copyright (c) 2004 Apple Computer, Inc. +.\" Copyright (c) 2006 Robert N. M. Watson .\" All rights reserved. .\" .\" Redistribution and use in source and binary forms, with or without @@ -25,7 +26,7 @@ .\" IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE .\" POSSIBILITY OF SUCH DAMAGE. .\" -.\" $P4: //depot/projects/trustedbsd/openbsm/man/audit_control.5#11 $ +.\" $P4: //depot/projects/trustedbsd/openbsm/man/audit_control.5#12 $ .\" .Dd January 4, 2006 .Dt AUDIT_CONTROL 5 @@ -66,6 +67,12 @@ .It Va policy A list of global audit policy flags specifying various behaviors, such as fail stop, auditing of paths and arguments, etc. +.It Va filesz +Maximum trail size in bytes; if set to a non-0 value, the audit daemon will +rotate the audit trail file at around this size. +Sizes less than the minimum trail size (default of 512K) will be rejected as +invalid. +If 0, trail files will not be automatically rotated based on file size. .El .Sh AUDIT FLAGS Audit flags are a comma-delimited list of audit classes as defined in the @@ -146,6 +153,7 @@ minfree:20 naflags:lo policy:cnt +filesz:0 .Ed .Pp The @@ -156,7 +164,8 @@ .Va policy parameter specifies that the system should neither fail stop nor suspend processes when the audit store fills. -will be audited. +The trail file will not be automatically rotated by the audit daemon based on +file size. .Sh FILES .Bl -tag -width "/etc/security/audit_control" -compact .It Pa /etc/security/audit_control
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200609221131.k8MBVFV6086967>