Date: Sun, 30 Nov 2008 21:29:58 GMT From: "Christian S.J. Peron" <csjp@FreeBSD.org> To: Perforce Change Reviews <perforce@freebsd.org> Subject: PERFORCE change 153855 for review Message-ID: <200811302129.mAULTwhV012602@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
http://perforce.freebsd.org/chv.cgi?CH=153855 Change 153855 by csjp@hvm02 on 2008/11/30 21:29:16 Add an event for fstat(2). Previously, this syscall was not being audited. It should be noted that Solaris disables this by default (i.e. audit class of no) but we have added it for class "fa" which is file attribute access. Affected files ... .. //depot/projects/trustedbsd/openbsm/etc/audit_event#31 edit Differences ... ==== //depot/projects/trustedbsd/openbsm/etc/audit_event#31 (text+ko) ==== @@ -1,5 +1,5 @@ # -# $P4: //depot/projects/trustedbsd/openbsm/etc/audit_event#30 $ +# $P4: //depot/projects/trustedbsd/openbsm/etc/audit_event#31 $ # # The mapping between event identifiers and values is also hard-coded in # audit_kevents.h and audit_uevents.h, so changes must occur in both places, @@ -185,6 +185,7 @@ 205:AUE_SETGID:setgid(2):pc 206:AUE_READL:readl(2):no 207:AUE_READVL:readvl(2):no +208:AUE_FSTAT:fstat(2):fa 209:AUE_DUP2:dup2(2):no 210:AUE_MMAP:mmap(2):no 211:AUE_AUDIT:audit(2):ot
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200811302129.mAULTwhV012602>