Audit patch

Robert Watson rwatson at FreeBSD.org
Wed Aug 16 17:53:23 UTC 2006


The attached, uncompiled and untested patch adds audit points to the PowerPC 
system call path.  The chances it works are good, the chances of it compiling 
are moderate.  Since I don't have any FreeBSD/ppc boxes set up, a hand in 
testing and committing would be appreciated.

Thanks,

Robert N M Watson
Computer Laboratory
University of Cambridge

--- //depot/projects/trustedbsd/base/sys/powerpc/powerpc/trap.c	2006/08/05 14:21:26
+++ //depot/projects/trustedbsd/audit3/sys/powerpc/powerpc/trap.c	2006/08/06 13:22:21
@@ -55,6 +55,8 @@
  #endif
  #include <sys/vmmeter.h>

+#include <security/audit/audit.h>
+
  #include <vm/vm.h>
  #include <vm/pmap.h>
  #include <vm/vm_extern.h>
@@ -418,7 +420,9 @@

  		PTRACESTOP_SC(p, td, S_PT_SCE);

+		AUDIT_SYSCALL_ENTER(code, td);
  		error = (*callp->sy_call)(td, params);
+		AUDIT_SYSCALL_EXIT(error, td);

  		CTR3(KTR_SYSC, "syscall: p=%s %s ret=%x", p->p_comm,
  		     syscallnames[code], td->td_retval[0]);


More information about the freebsd-ppc mailing list