Date: Sat, 2 Sep 2006 11:42:20 +0100 (BST) From: Robert Watson <rwatson@FreeBSD.org> To: stable@FreeBSD.org Cc: trustedbsd-audit@TrustedBSD.org, freebsd-security@FreeBSD.org Subject: Re: Warning: MFC of security event audit support RELENG_6 in the next 2-3 weeks Message-ID: <20060902113521.P84468@fledge.watson.org> In-Reply-To: <20060816120709.N45647@fledge.watson.org> References: <20060816120709.N45647@fledge.watson.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, 16 Aug 2006, Robert Watson wrote: > Dear 6-STABLE users, > > In the next 2-3 weeks, I plan to MFC support for CAPP security eventing > auditing from 7-CURRENT to 6-STABLE. The implementation has been running > quite nicely in -CURRENT for several months. Right now, I'm just waiting on > a confirmation from Sun regarding formal allocation of a BSM header version > number so as to avoid accidental version number conflicts in the future, > which I hope to get this week, as well as a bug fix in the handling of > per-pipe preselection, which Christian Peron is currently working on. The > audit implementation will be considered an experimental feature in > 6.2-RELEASE, but in practice runs quite well, so is ready for more > wide-spread deployment. Dear 6-STABLE users, After a couple of weeks of settling, polishing, etc, the MFC of audit support is about to begin. Over the next couple of days, the 6-STABLE build may be briefly broken as inter-dependent components are merged. I do not anticipate any serious disruption, but some caution is called for. In principle, all the potentially tricky kernel ABI dependencies, etc, were dealt with before 6.0-RELEASE, such as changes in the size of the kernel system call data structures. The approximate merge plan, run by re@ a few days ago, is as follows: - Merge OpenBSM contrib subtree detached from build. - Merge kernel trees (src/sys/bsm, src/sys/security/audit), attach to build. - Merge kernel audit event hooks across the kernel. In principle, we've reserved space in the syscall table, etc, so that there is no disruptive kernel ABI change for critical data structures. - Merge OpenBSM library and command line tools build, as well as install of /etc/security, /etc/rc.d files. - Merge kernel man pages (src/share/man/man4/audit*). - Merge user space tool changes, such as to login, sshd, su, etc, so that events are audited. - Loose ends, such as make.conf man page, etc. - Update Handbook to indicate that Audit applies to 6.x and 7.x. I will send out a status e-mail once the merge is completed, and send out a notice if any problems are encountered. If you experience any problems, especially problems not related to the build (which will likely get picked up and fixed quickly, if they occur), please let me know. I'm especially interested in any issues relating to changes in ability to log in, programs exiting due to using unrecognized system calls (SIGSYS), etc. As I said above, these sorts of problems are unlikely to occur, but if they do occur, I'd like to fix them as quickly as possible. I would like to have the merge largely done by 4 September 2006, although it's possible a few straggling tweaks will come in after that. Thanks, Robert N M Watson Computer Laboratory University of Cambridge
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20060902113521.P84468>