src-test/contrib/openbsm, branch a

Fixup some incorrect information and some comments. These changes

2020-07-28T20:06:16Z

were cherry picked up the upstream OpenBSD repository. At some point we will look at doing another import, but the diffs are substantial and will require some careful testing. Differential Revision: https://reviews.freebsd.org/D25021 MFC after: 2 weeks Submitted by: gbe Reviewed by: myself, bcr

libauditd: make it a PRIVATELIB

2020-04-19T02:20:39Z

According to the upstream man page (which we don't install), none of libauditd's symbols are intended to be public. Also, I can't find any evidence for a port that uses libauditd. Therefore, we should treat it like other such libraries and use PRIVATELIB. Reported by: phk Reviewed by: cem, emaste MFC after: 2 weeks

MFV r359401: OpenBSM: import ee79d73e8df5: auditreduce: add a zone filter

2020-03-28T17:36:39Z

This allows one to select audit records that match a -z zone glob. MFC after: 1 week Sponsored by: Modirum MDPay, Klara Systems

auditd(8): fix long-standing uninitialized memory use bug

2019-11-28T00:46:03Z

The bogus use could lead to an infinite loop depending on how fast the audit_warn script to execute. By fixing read(2) interruptibility, d060887 (r335899) revealed another bug in auditd_wait_for_events. When read is interrupted by SIGCHLD, auditd_reap_children will always return with errno set to ECHILD. But auditd_wait_for_events checks errno after that point, expecting it to be unchanged since read. As a result, it calls auditd_handle_trigger with bogus stack garbage. The result is the error message "Got unknown trigger 48." Fix by simply ignoring errno at that point; there's only one value it could've possibly had, thanks to the check up above. The best part is we've had a fix for this for like 18 months and just never merged it. Merge it now. PR: 234209 Reported by: Marie Helene Kvello-Aune (2018-12) Submitted by: asomers (2018-07) Reviewed by: me (in OpenBSM) Obtained from: OpenBSM X-MFC-With: r335899 Security: ¯\_(ツ)_/¯ Differential Revision: https://github.com/openbsm/openbsm/pull/45

Jail and capability mode for shm_rename; add audit support for shm_rename

2019-11-18T13:31:16Z

Co-mingling two things here: * Addressing some feedback from Konstantin and Kyle re: jail, capability mode, and a few other things * Adding audit support as promised. The audit support change includes a partial refresh of OpenBSM from upstream, where the change to add shm_rename has already been accepted. Matthew doesn't plan to work on refreshing anything else to support audit for those new event types. Submitted by: Matthew Bryan Reviewed by: kib Relnotes: Yes Sponsored by: Dell EMC Isilon Differential Revision: https://reviews.freebsd.org/D22083

Create new EINTEGRITY error with message "Integrity check failed".

2019-01-17T06:35:45Z

An integrity check such as a check-hash or a cross-correlation failed. The integrity error falls between EINVAL that identifies errors in parameters to a system call and EIO that identifies errors with the underlying storage media. EINTEGRITY is typically raised by intermediate kernel layers such as a filesystem or an in-kernel GEOM subsystem when they detect inconsistencies. Uses include allowing the mount(8) command to return a different exit value to automate the running of fsck(8) during a system boot. These changes make no use of the new error, they just add it. Later commits will be made for the use of the new error number and it will be added to additional manual pages as appropriate. Reviewed by: gnn, dim, brueffer, imp Discussed with: kib, cem, emaste, ed, jilles Differential Revision: https://reviews.freebsd.org/D18765

In r316006 the getstrfromtype_locked() function was modified to return

2019-01-09T01:16:35Z

an empty string, instead of NULL, if an entry is missing in the audit_control file. Because of that change the getachost() function started to return success even if the host name was not defined in the audit_control. This in turn led to auditd_hostlen always being set (for an empty host it was set to 0). If auditd_hostlen was not equal to -1 we were trying to append the host name to trail file name. All this led to situation where when host name is not defined in audit_control, auditd will create trail files with a leading '.', which breaks auditdistd as it doesn't work with longer audit trail file names. Fix this by appending host name to the trail file name only if the host name is not empty.

Consider the following situation:

2018-12-07T03:13:36Z

The sender has .not_terminated file. It gets disconnected. The last trail file is then terminated without adding new data (this can happen for example when auditd is being stopped on the sender). After reconnect the .not_terminated was not renamed on the receiver as it should. We were already handling similar situation where the sender crashed and the .not_terminated trail file was renamed to .crash_recovery. Extend this case to handle the situation above.

MFH r338661 through r339200.

2018-10-05T17:53:47Z

Remove invalid comments and correct some typos.

2018-10-04T05:57:27Z

Approved by: re (kib)