PERFORCE change 107125 for review

[Robert Watson]

On Mon, 2 Oct 2006, John Baldwin wrote:

> On Monday 02 October 2006 17:20, Robert Watson wrote:
>> http://perforce.freebsd.org/chv.cgi?CH=107125
>>
>> Change 107125 by rwatson at rwatson_peppercorn on 2006/10/02 21:19:13
>>
>> 	Audit events for getpath system calls, POSIX message kqueues.
>> 	(Query: FreeBSD system calls are kmq*, but library interfaces are
>> 	mq_* -- should the audit identifiers be MQ_*?).
>
> I would use MQ_* to stick with the userland API.  Don't the audit events 
> typically reflect the userland API?

Yes.  The tricky distinction is that we're auditing the kernel events (as they 
are on the right side of the trust boundary), but we're typically interested 
in them as seen in user space, and with respect to documented APIs.  I think 
you're right, they probably should be with respect to the published mq*(2) 
APIs.

Robert N M Watson
Computer Laboratory
University of Cambridge