From owner-freebsd-current@FreeBSD.ORG Mon Jun 5 22:43:39 2006 Return-Path: X-Original-To: current@FreeBSD.org Delivered-To: freebsd-current@FreeBSD.ORG Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 97BDC16CE9C for ; Mon, 5 Jun 2006 22:13:27 +0000 (UTC) (envelope-from rwatson@FreeBSD.org) Received: from Gate5-sandiego.nmci.navy.mil (gate5-sandiego.nmci.navy.mil [138.163.0.37]) by mx1.FreeBSD.org (Postfix) with ESMTP id 5320C43D62 for ; Mon, 5 Jun 2006 22:12:47 +0000 (GMT) (envelope-from rwatson@FreeBSD.org) Received: from nawesdnims03.nmci.navy.mil by Gate5-sandiego.nmci.navy.mil via smtpd (for mx1.freebsd.org [216.136.204.125]) with ESMTP; Mon, 5 Jun 2006 22:12:47 +0000 Received: (private information removed) Received: (private information removed) Received: (private information removed) Received: from mail pickup service by nawesdnieb01.nadsuswe.nads.navy.mil with Microsoft SMTPSVC; Mon, 5 Jun 2006 15:11:52 -0700 Received: from nawesdnieg04.nadsuswe.nads.navy.mil ([10.0.10.59]) by nawesdnieb01.nadsuswe.nads.navy.mil with Microsoft SMTPSVC(5.0.2195.6713); Mon, 5 Jun 2006 09:17:33 -0700 Received: from nawesdnifw06.nmci.navy.mil ([10.0.0.38]) by nawesdnieg04.nadsuswe.nads.navy.mil with Microsoft SMTPSVC(5.0.2195.6713); Mon, 5 Jun 2006 09:17:31 -0700 Received: from Nawesdnims02.nmci.navy.mil by nawesdnifw06.nmci.navy.mil via smtpd (for Insidesmtp.navy.mil [10.0.10.59]) with ESMTP; Mon, 5 Jun 2006 16:17:31 +0000 Received: from nawesdnifw02c.nmci.navy.mil (nawesdnifw02c.nmci.navy.mil [10.0.0.162] (may be forged)) by nawesdnims02.nadsuswe.nads.navy.mil (Switch-3.1.8/Switch-3.1.7) with ESMTP id k55FrUN7021925 for ; Mon, 5 Jun 2006 15:54:39 GMT Received: from [138.163.0.138] by nawesdnifw02c.nmci.navy.mil via smtpd (for [10.0.0.166]) with ESMTP; Mon, 5 Jun 2006 16:17:31 +0000 Received: from mx1.spawar.navy.mil (128.49.251.6) by navysdniio02.nmci.navy.mil with ESMTP; 05 Jun 2006 09:06:18 -0700 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== Received: from mx2.freebsd.org (mx2.freebsd.org [216.136.204.119]) by mx1.spawar.navy.mil (8.13.1/8.13.1) with ESMTP id k55G2ZHA028997 for ; Mon, 5 Jun 2006 09:02:41 -0700 Received: from hub.freebsd.org (hub.freebsd.org [216.136.204.18]) by mx2.freebsd.org (Postfix) with ESMTP id 95C9963E9C; Mon, 5 Jun 2006 16:01:44 +0000 (GMT) (envelope-from owner-trustedbsd-audit@FreeBSD.org) Received: from hub.freebsd.org (localhost [127.0.0.1]) by hub.freebsd.org (Postfix) with ESMTP id 8931E16A990; Mon, 5 Jun 2006 16:01:39 +0000 (UTC) (envelope-from owner-trustedbsd-audit@FreeBSD.org) X-Original-To: trustedbsd-audit@freebsd.org Delivered-To: trustedbsd-audit@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 311B016A551; Mon, 5 Jun 2006 16:01:05 +0000 (UTC) (envelope-from rwatson@FreeBSD.org) Received: from cyrus.watson.org (cyrus.watson.org [209.31.154.42]) by mx1.FreeBSD.org (Postfix) with ESMTP id A7BB143D53; Mon, 5 Jun 2006 16:01:04 +0000 (GMT) (envelope-from rwatson@FreeBSD.org) Received: from fledge.watson.org (fledge.watson.org [209.31.154.41]) by cyrus.watson.org (Postfix) with ESMTP id D1C8646C4D; Mon, 5 Jun 2006 12:01:03 -0400 (EDT) Date: Mon, 5 Jun 2006 17:01:04 +0100 (BST) From: Robert Watson X-X-Sender: robert@fledge.watson.org To: current@FreeBSD.org Message-ID: <20060605165946.L61202@fledge.watson.org> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-BeenThere: trustedbsd-audit@FreeBSD.org X-Mailman-Version: 2.1.5 Precedence: list Sender: owner-trustedbsd-audit@FreeBSD.org Errors-To: owner-trustedbsd-audit@FreeBSD.org X-SPAWAR-MailScanner: Found to be clean X-SPAWAR-MailScanner-SpamCheck: not spam, SpamAssassin (score=0, required 3.5, autolearn=disabled) X-SPAWAR-MailScanner-From: owner-trustedbsd-audit@freebsd.org X-Spam-Status: No X-OriginalArrivalTime: 05 Jun 2006 16:17:32.0102 (UTC) FILETIME=[8C510660:01C688BB] Cc: trustedbsd-audit@TrustedBSD.org Subject: Heads up: OpenBSM 1.0a6, per-auditpipe preselection imported to CVS X-BeenThere: freebsd-current@freebsd.org List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Jun 2006 22:43:40 -0000 This is a heads up to current@ users regarding two moderate sized sets of changes that entered FreeBSD CVS today: (1) I imported OpenBSM 1.0 alpha 6. (2) I imported support for per-auditpipe preselection. Detailed commit messages are below. Robert N M Watson ---------- Forwarded message ---------- Date: Mon, 5 Jun 2006 10:52:14 +0000 (UTC) From: Robert Watson To: src-committers@FreeBSD.org, cvs-src@FreeBSD.org, cvs-all@FreeBSD.org Subject: cvs commit: src/contrib/openbsm - Imported sources rwatson 2006-06-05 10:52:14 UTC FreeBSD src repository src/contrib/openbsm - Imported sources Update of /home/ncvs/src/contrib/openbsm In directory repoman.freebsd.org:/tmp/cvs-serv59860 Log Message: Vendor branch import of TrustedBSD OpenBSM 1.0 alpha 6: - Use AU_TO_WRITE and AU_NO_TO_WRITE for the 'keep' argument to au_close(); previously we used hard-coded 0 and 1 values. - Add man page for au_open(), au_write(), au_close(), and au_close_buffer(). - Support a more complete range of data types for the arbitrary data token: add AUR_CHAR (alias to AUR_BYTE), remove AUR_LONG, add AUR_INT32 (alias to AUR_INT), add AUR_INT64. - Add au_close_token(), which allows writing a single token_t to a memory buffer. Not likely to be used much by applications, but useful for writing test tools. - Modify au_to_file() so that it accepts a timeval in user space, not just kernel -- this is not a Solaris BSM API so can be modified without causing compatibility issues. - Define a new API, au_to_header32_tm(), which adds a struct timeval argument to the ordinary au_to_header32(), which is now implemented by wrapping au_to_header32_tm() and calling gettimeofday(). #ifndef KERNEL the APIs that invoke gettimeofday(), rather than having a variable definition. Don't try to retrieve time zone information using gettimeofday(), as it's not needed, and introduces possible failure modes. - Don't perform byte order transformations on the addr/machine fields of the terminal ID that appears in the process32/subject32 tokens. These are assumed to be IP addresses, and as such, to be in network byte order. - Universally, APIs now assume that IP addresses and ports are provided in network byte order. APIs now generally provide these types in network byte order when decoding. - Beginnings of an OpenBSM test framework can now be found in openbsm/test. This code is not built or installed by default. - auditd now assigns more appropriate syslog levels to its debugging and error information. - Support for audit filters introduced: audit filters are dynamically loaded shared objects that run in the context of a new daemon, auditfilterd. The daemon reads from an audit pipe and feeds both BSM and parsed versions of records to shared objects using a module API. This will provide a framework for the writing of intrusion detection services. - New utility API, audit_submit(), added to capture common elements of audit record submission for many applications. Obtained from: TrustedBSD Project Status: Vendor Tag: TrustedBSD Release Tags: OPENBSM_1_0_ALPHA_6 U src/contrib/openbsm/HISTORY U src/contrib/openbsm/LICENSE U src/contrib/openbsm/Makefile.am U src/contrib/openbsm/Makefile.in U src/contrib/openbsm/README U src/contrib/openbsm/TODO U src/contrib/openbsm/VERSION U src/contrib/openbsm/aclocal.m4 U src/contrib/openbsm/autogen.sh U src/contrib/openbsm/configure U src/contrib/openbsm/configure.ac U src/contrib/openbsm/bin/Makefile.am U src/contrib/openbsm/bin/Makefile.in U src/contrib/openbsm/bin/audit/Makefile.am U src/contrib/openbsm/bin/audit/Makefile.in U src/contrib/openbsm/bin/audit/audit.8 U src/contrib/openbsm/bin/audit/audit.c U src/contrib/openbsm/bin/auditd/Makefile.am U src/contrib/openbsm/bin/auditd/Makefile.in U src/contrib/openbsm/bin/auditd/audit_warn.c U src/contrib/openbsm/bin/auditd/auditd.8 U src/contrib/openbsm/bin/auditd/auditd.c U src/contrib/openbsm/bin/auditd/auditd.h N src/contrib/openbsm/bin/auditfilterd/Makefile.am N src/contrib/openbsm/bin/auditfilterd/Makefile.in N src/contrib/openbsm/bin/auditfilterd/auditfilterd.8 N src/contrib/openbsm/bin/auditfilterd/auditfilterd.c N src/contrib/openbsm/bin/auditfilterd/auditfilterd.h N src/contrib/openbsm/bin/auditfilterd/auditfilterd_conf.c U src/contrib/openbsm/bin/auditreduce/Makefile.am U src/contrib/openbsm/bin/auditreduce/Makefile.in U src/contrib/openbsm/bin/auditreduce/auditreduce.1 U src/contrib/openbsm/bin/auditreduce/auditreduce.c U src/contrib/openbsm/bin/auditreduce/auditreduce.h U src/contrib/openbsm/bin/praudit/Makefile.am U src/contrib/openbsm/bin/praudit/Makefile.in U src/contrib/openbsm/bin/praudit/praudit.1 U src/contrib/openbsm/bin/praudit/praudit.c U src/contrib/openbsm/bsm/Makefile.am U src/contrib/openbsm/bsm/Makefile.in U src/contrib/openbsm/bsm/audit.h N src/contrib/openbsm/bsm/audit_filter.h U src/contrib/openbsm/bsm/audit_internal.h U src/contrib/openbsm/bsm/audit_kevents.h U src/contrib/openbsm/bsm/audit_record.h U src/contrib/openbsm/bsm/audit_uevents.h U src/contrib/openbsm/bsm/libbsm.h U src/contrib/openbsm/compat/endian.h U src/contrib/openbsm/compat/queue.h U src/contrib/openbsm/config/config.guess U src/contrib/openbsm/config/config.h.in U src/contrib/openbsm/config/config.sub U src/contrib/openbsm/config/depcomp U src/contrib/openbsm/config/install-sh U src/contrib/openbsm/config/ltmain.sh U src/contrib/openbsm/config/missing U src/contrib/openbsm/etc/audit_class U src/contrib/openbsm/etc/audit_control U src/contrib/openbsm/etc/audit_event N src/contrib/openbsm/etc/audit_filter U src/contrib/openbsm/etc/audit_user U src/contrib/openbsm/etc/audit_warn U src/contrib/openbsm/libbsm/Makefile.am U src/contrib/openbsm/libbsm/Makefile.in U src/contrib/openbsm/libbsm/au_class.3 U src/contrib/openbsm/libbsm/au_control.3 U src/contrib/openbsm/libbsm/au_event.3 U src/contrib/openbsm/libbsm/au_free_token.3 U src/contrib/openbsm/libbsm/au_io.3 U src/contrib/openbsm/libbsm/au_mask.3 N src/contrib/openbsm/libbsm/au_open.3 U src/contrib/openbsm/libbsm/au_token.3 U src/contrib/openbsm/libbsm/au_user.3 N src/contrib/openbsm/libbsm/audit_submit.3 U src/contrib/openbsm/libbsm/bsm_audit.c U src/contrib/openbsm/libbsm/bsm_class.c U src/contrib/openbsm/libbsm/bsm_control.c U src/contrib/openbsm/libbsm/bsm_event.c U src/contrib/openbsm/libbsm/bsm_flags.c U src/contrib/openbsm/libbsm/bsm_io.c U src/contrib/openbsm/libbsm/bsm_mask.c U src/contrib/openbsm/libbsm/bsm_notify.c U src/contrib/openbsm/libbsm/bsm_token.c U src/contrib/openbsm/libbsm/bsm_user.c U src/contrib/openbsm/libbsm/libbsm.3 U src/contrib/openbsm/libbsm/bsm_wrappers.c U src/contrib/openbsm/man/Makefile.am U src/contrib/openbsm/man/Makefile.in U src/contrib/openbsm/man/audit.2 U src/contrib/openbsm/man/audit.log.5 U src/contrib/openbsm/man/audit_class.5 U src/contrib/openbsm/man/audit_control.5 U src/contrib/openbsm/man/audit_event.5 U src/contrib/openbsm/man/audit_user.5 U src/contrib/openbsm/man/audit_warn.5 U src/contrib/openbsm/man/auditctl.2 U src/contrib/openbsm/man/auditon.2 U src/contrib/openbsm/man/getaudit.2 U src/contrib/openbsm/man/getauid.2 U src/contrib/openbsm/man/setaudit.2 U src/contrib/openbsm/man/setauid.2 N src/contrib/openbsm/modules/Makefile.am N src/contrib/openbsm/modules/Makefile.in N src/contrib/openbsm/modules/auditfilter_noop/Makefile.am N src/contrib/openbsm/modules/auditfilter_noop/Makefile.in N src/contrib/openbsm/modules/auditfilter_noop/auditfilter_noop.c N src/contrib/openbsm/test/Makefile.am N src/contrib/openbsm/test/Makefile.in N src/contrib/openbsm/test/bsm/Makefile.am N src/contrib/openbsm/test/bsm/Makefile.in N src/contrib/openbsm/test/bsm/generate.c U src/contrib/openbsm/tools/Makefile.am U src/contrib/openbsm/tools/Makefile.in U src/contrib/openbsm/tools/audump.c No conflicts created by this import ---------- Forwarded message ---------- Date: Mon, 5 Jun 2006 14:48:17 +0000 (UTC) From: Robert Watson To: src-committers@FreeBSD.org, cvs-src@FreeBSD.org, cvs-all@FreeBSD.org Subject: cvs commit: src/sys/security/audit audit.c audit_bsm_klib.c audit_ioctl.h audit_pipe.c audit_private.h audit_worker.c rwatson 2006-06-05 14:48:17 UTC FreeBSD src repository Modified files: sys/security/audit audit.c audit_bsm_klib.c audit_ioctl.h audit_pipe.c audit_private.h audit_worker.c Log: Introduce support for per-audit pipe preselection independent from the global audit trail configuration. This allows applications consuming audit trails to specify parameters for which audit records are of interest, including selecting records not required by the global trail. Allowing application interest specification without changing the global configuration allows intrusion detection systems to run without interfering with global auditing or each other (if multiple are present). To implement this: - Kernel audit records now carry a flag to indicate whether they have been selected by the global trail or by the audit pipe subsystem, set during record commit, so that this information is available after BSM conversion when delivering the BSM to the trail and audit pipes in the audit worker thread asynchronously. Preselection by either record target will cause the record to be kept. - Similar changes to preselection when the audit record is created when the system call is entering: consult both the global trail and pipes. - au_preselect() now accepts the class in order to avoid repeatedly looking up the mask for each preselection test. - Define a series of ioctls that allow applications to specify whether they want to track the global trail, or program their own preselection parameters: they may specify their own flags and naflags masks, similar to the global masks of the same name, as well as a set of per-auid masks. They also set a per-pipe mode specifying whether they track the global trail, or user their own -- the door is left open for future additional modes. A new ioctl is defined to allow a user process to flush the current audit pipe queue, which can be used after reprogramming pre-selection to make sure that only records of interest are received in future reads. - Audit pipe data structures are extended to hold the additional fields necessary to support preselection. By default, audit pipes track the global trail, so "praudit /dev/auditpipe" will track the global audit trail even though praudit doesn't program the audit pipe selection model. - Comment about the complexities of potentially adding partial read support to audit pipes. By using a set of ioctls, applications can select which records are of interest, and toggle the preselection mode. Obtained from: TrustedBSD Project Revision Changes Path 1.15 +28 -16 src/sys/security/audit/audit.c 1.4 +3 -6 src/sys/security/audit/audit_bsm_klib.c 1.3 +32 -0 src/sys/security/audit/audit_ioctl.h 1.7 +393 -13 src/sys/security/audit/audit_pipe.c 1.9 +13 -3 src/sys/security/audit/audit_private.h 1.8 +49 -27 src/sys/security/audit/audit_worker.c _______________________________________________ trustedbsd-audit@FreeBSD.org mailing list http://lists.freebsd.org/mailman/listinfo/trustedbsd-audit To unsubscribe, send any mail to "trustedbsd-audit-unsubscribe@FreeBSD.org"