Vendor import of OpenBSM 1.1 beta1, which incorporates the followingvendor/openbsm/1.1-BETA-1

changes since the last imported OpenBSM release:

OpenBSM 1.1 beta 1

- The filesz parameter in audit_control(5) now accepts suffixes: 'B' for
  Bytes, 'K' for Kilobytes, 'M' for Megabytes, and 'G' for Gigabytes.
  For legacy support no suffix defaults to bytes.
- Audit trail log expiration support added.  It is configured in
  audit_control(5) with the expire-after parameter.  If there is no
  expire-after parameter in audit_control(5), the default, then the audit
  trail files are not expired and removed.  See audit_control(5) for
  more information.
- Change defaults in audit_control: warn at 5% rather than 20% free for audit
  partitions, rotate automatically at 2mb, and set the default policy to
  cnt,argv rather than cnt so that execve(2) arguments are captured if
  AUE_EXECVE events are audited.  These may provide more usable defaults for
  many users.
- Use au_domain_to_bsm(3) and au_socket_type_to_bsm(3) to convert
  au_to_socket_ex(3) arguments to BSM format.
- Fix error encoding AUT_IPC_PERM tokens.

Obtained from:    TrustedBSD Project
Sponsored by:     Apple Inc.

2 files changed, 10 insertions, 19 deletions

diff --git a/sys/bsm/audit.h b/sys/bsm/audit.h
index 3b22b033635e..b39de0a6a6d4 100644
--- a/sys/bsm/audit.h
+++ b/sys/bsm/audit.h
@@ -26,7 +26,7 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
- * $P4: //depot/projects/trustedbsd/openbsm/sys/bsm/audit.h#4 $
+ * $P4: //depot/projects/trustedbsd/openbsm/sys/bsm/audit.h#5 $
  */
 
 #ifndef _BSM_AUDIT_H
@@ -65,8 +65,9 @@
 #define	AUDIT_TRIGGER_CLOSE_AND_DIE	4	/* Terminate audit. */
 #define	AUDIT_TRIGGER_NO_SPACE		5	/* Below min free space. */
 #define	AUDIT_TRIGGER_ROTATE_USER	6	/* User requests rotate. */
-#define	AUDIT_TRIGGER_INITIALIZE	7	/* Initialize audit. */
-#define	AUDIT_TRIGGER_MAX		7
+#define	AUDIT_TRIGGER_INITIALIZE	7	/* User initialize of auditd. */
+#define	AUDIT_TRIGGER_EXPIRE_TRAILS	8	/* User expiration of trails. */
+#define	AUDIT_TRIGGER_MAX		8
 
 /*
  * The special device filename (FreeBSD).
diff --git a/sys/bsm/audit_kevents.h b/sys/bsm/audit_kevents.h
index 57351b5ea7b9..a86621cdb8ae 100644
--- a/sys/bsm/audit_kevents.h
+++ b/sys/bsm/audit_kevents.h
@@ -26,7 +26,7 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
- * $P4: //depot/projects/trustedbsd/openbsm/sys/bsm/audit_kevents.h#4 $
+ * $P4: //depot/projects/trustedbsd/openbsm/sys/bsm/audit_kevents.h#5 $
  */
 
 #ifndef _BSM_AUDIT_KEVENTS_H_
@@ -586,6 +586,8 @@
 #define	AUE_CAP_GETMODE		43189	/* TrustedBSD. */
 #define	AUE_POSIX_SPAWN		43190	/* Darwin. */
 #define	AUE_FSGETPATH		43191	/* Darwin. */
+#define	AUE_PREAD		43192	/* Darwin/FreeBSD. */
+#define	AUE_PWRITE		43193	/* Darwin/FreeBSD. */
 
 /*
  * Darwin BSM uses a number of AUE_O_* definitions, which are aliased to the
@@ -657,7 +659,6 @@
 /*
  * Possible desired future values based on review of BSD/Darwin system calls.
  */
-#define	AUE_ACCESSEXTENDED	AUE_NULL
 #define	AUE_ATGETMSG		AUE_NULL
 #define	AUE_ATPUTMSG		AUE_NULL
 #define	AUE_ATSOCKET		AUE_NULL
@@ -668,11 +669,9 @@
 #define	AUE_BSDTHREADCREATE	AUE_NULL
 #define	AUE_BSDTHREADTERMINATE	AUE_NULL
 #define	AUE_BSDTHREADREGISTER	AUE_NULL
-#define	AUE_CHMODEXTENDED	AUE_NULL
 #define	AUE_CHUD		AUE_NULL
 #define	AUE_CSOPS		AUE_NULL
 #define	AUE_DUP			AUE_NULL
-#define	AUE_FCHMODEXTENDED	AUE_NULL
 #define	AUE_FDATASYNC		AUE_NULL
 #define	AUE_FFSCTL		AUE_NULL
 #define	AUE_FGETATTRLIST	AUE_NULL
@@ -682,11 +681,10 @@
 #define	AUE_FSCTL		AUE_NULL
 #define	AUE_FSETATTRLIST	AUE_NULL
 #define	AUE_FSETXATTR		AUE_NULL
-#define	AUE_FSTATEXTENDED	AUE_NULL
 #define	AUE_FSTATFS64		AUE_NULL
 #define	AUE_FSTATV		AUE_NULL
 #define	AUE_FSTAT64		AUE_NULL
-#define	AUE_FSTAT64EXTENDED	AUE_NULL
+#define	AUE_FSTAT64_EXTENDED	AUE_NULL
 #define	AUE_GCCONTROL		AUE_NULL
 #define	AUE_GETDIRENTRIES64	AUE_NULL
 #define	AUE_GETDTABLESIZE	AUE_NULL
@@ -720,21 +718,15 @@
 #define	AUE_ISSETUGID		AUE_NULL
 #define	AUE_LIOLISTIO		AUE_NULL
 #define	AUE_LISTXATTR		AUE_NULL
-#define	AUE_LSTATEXTENDED	AUE_NULL
 #define	AUE_LSTATV		AUE_NULL
 #define	AUE_LSTAT64		AUE_NULL
-#define	AUE_LSTAT64EXTENDED	AUE_NULL
+#define	AUE_LSTAT64_EXTENDED	AUE_NULL
 #define	AUE_MADVISE		AUE_NULL
 #define	AUE_MINCORE		AUE_NULL
 #define	AUE_MKCOMPLEX		AUE_NULL
-#define	AUE_MKDIREXTENDED	AUE_NULL
-#define	AUE_MKFIFOEXTENDED	AUE_NULL
 #define	AUE_MODWATCH		AUE_NULL
 #define	AUE_MSGCL		AUE_NULL
 #define	AUE_MSYNC		AUE_NULL
-#define	AUE_OPENEXTENDED	AUE_NULL
-#define	AUE_PREAD		AUE_NULL
-#define	AUE_PWRITE		AUE_NULL
 #define	AUE_PREADV		AUE_NULL
 #define	AUE_PROCINFO		AUE_NULL
 #define	AUE_PTHREADCANCELED	AUE_NULL
@@ -778,15 +770,13 @@
 #define	AUE_SIGWAIT		AUE_NULL
 #define	AUE_SSTK		AUE_NULL
 #define	AUE_STACKSNAPSHOT	AUE_NULL
-#define	AUE_STATEXTENDED	AUE_NULL
 #define	AUE_STATFS64		AUE_NULL
 #define	AUE_STATV		AUE_NULL
 #define	AUE_STAT64		AUE_NULL
-#define	AUE_STAT64EXTENDED	AUE_NULL
+#define	AUE_STAT64_EXTENDED	AUE_NULL
 #define	AUE_SYNC		AUE_NULL
 #define	AUE_SYSCALL		AUE_NULL
 #define	AUE_TABLE		AUE_NULL
-#define	AUE_UMASKEXTENDED	AUE_NULL
 #define	AUE_VMPRESSUREMONITOR	AUE_NULL
 #define	AUE_WAITEVENT		AUE_NULL
 #define	AUE_WAITID		AUE_NULL