PERFORCE change 91049 for review

[Robert Watson]

On Sat, 4 Feb 2006, Tom Rhodes wrote:

> On Sat, 4 Feb 2006 12:53:40 GMT
> Robert Watson <rwatson at FreeBSD.org> wrote:
>
>> http://perforce.freebsd.org/chv.cgi?CH=91049
>>
>> Change 91049 by rwatson at rwatson_peppercorn on 2006/02/04 12:53:12
>>
>> 	When GC'ing a thread, assert that it has no active audit record.
>> 	This should not happen, but with this assert, brueffer and I would
>> 	not have spent 45 minutes trying to figure out why he wasn't
>> 	seeing audit records with the audit version in CVS.
>
> Good catch!  I had just booted the new CURRENT and was wondering about this. 
> Thanks!

In principle, Wayne committed support for the generation of system call based 
records for i386 and amd64 early this afternoon, which should turn up if you 
do a CVS update.  Chris and I have now tested it on i386 and amd64 to good 
effect.  Ollivier has also now tested it on arm, although that requires 
importing a bugfix from auditd regarding return types from getopt(), which 
I'll merge as part of OpenBSM 1.0 alpha 3 in a couple of days.  Still looking 
for people to test on alpha, sparc64, and powerpc.  Also, it would be useful 
to test the auditing of i386 binaries running on amd64, which in principle 
works, but is as yet untested.

Robert N M Watson
To Unsubscribe: send mail to majordomo at trustedbsd.org
with "unsubscribe trustedbsd-audit" in the body of the message