src-test2/sys/security, branch release/11.0.0

Implement AUE_PREAD and AUE_PWRITE BSM conversion support, eliminating

2016-06-13T09:22:20Z

console warnings when pread(2) and pwrite(2) are used with full system-call auditing enabled. We audit the same file-descriptor data for these calls as we do read(2) and write(2). Approved by: re (kib) MFC after: 3 days Sponsored by: DARPA, AFRL

sys/security: minor spelling fixes.

2016-05-06T16:59:04Z

No functional change.

sys: use our nitems() macro when param.h is available.

2016-04-21T19:40:10Z

This should cover all the remaining cases in the kernel. Discussed in: freebsd-current

Remove slightly used const values that can be replaced with nitems().

2016-04-21T15:38:28Z

Suggested by: jhb

audit(8): leave unsigned comparison for last.

2016-04-08T03:26:21Z

aq64_minfree is unsigned so comparing to find out if it is less than zero is a nonsense. Move the comparison to the last position as we don't want to spend time if any of the others triggers first. hile it would be tempting to just remove it, it may be important to keep it for portability with platforms where may be signed(?) or in case we may want to change it in the future.

Busy the mount point which is the owner of the audit vnode, around

2016-01-16T10:06:33Z

audit_record_write(). This is important so that VFS_STATFS() is not done on the NULL or freed mp and the check for free space is consistent with the vnode used for write. Add vn_start_write() braces around VOP_FSYNC() calls on the audit vnode. Move repeated code to fsync vnode and panic to the helper audit_worker_sync_vp(). Reviewed by: rwatson Tested by: pho Sponsored by: The FreeBSD Foundation MFC after: 1 week

Move the funsetown(9) call from audit_pipe_close() to cdevpriv

2016-01-13T14:02:07Z

destructor. As result, close method becomes trivial and removed. Final cdevsw close method might be called without file context (e.g. in vn_open_vnode() if the vnode is reclaimed meantime), which leaves ap_sigio registered for notification, despite cdevpriv destructor frees the memory later. Call destructor instead of doing a cleanup inline, for devfs_set_cdevpriv() failure in open. This adds missed funsetown(9) call and locks ap to satisfy audit_pipe_free() invariants. Reported and tested by: pho (previous version) Sponsored by: The FreeBSD Foundation MFC after: 1 week

Merge from contrib/openbsm to bring the kernel audit bits up to date with OpenBSM 1.2 alpha 4:

2015-12-20T23:22:04Z

- remove $P4$ - fix a comment

Fix style issues around existing SDT probes.

2015-12-16T23:39:27Z

- Use SDT_PROBE() instead of SDT_PROBE(). This has no functional effect at the moment, but will be needed for some future changes. - Don't hardcode the module component of the probe identifier. This is set automatically by the SDT framework. MFC after: 1 week

fd: make 'rights' a manadatory argument to fget* functions

2015-07-05T19:05:16Z