PERFORCE change 105888 for review

[Robert Watson]

http://perforce.freebsd.org/chv.cgi?CH=105888

Change 105888 by rwatson at rwatson_sesame on 2006/09/09 10:25:42

	Add AUE_SYSCTL_WRITE event to represent a write to a sysctl.  This
	is slightly different than the Darwin admin/non-admin split, but
	likewise will allow us to categorize AUE_SYSCTL as an other event
	rather than an admin event, reducing its occurrence in trails
	for simple things like querying address space layout, etc, which
	otherwise litter trails of admin events.

Affected files ...

.. //depot/projects/trustedbsd/openbsm/bsm/audit_kevents.h#42 edit
.. //depot/projects/trustedbsd/openbsm/etc/audit_event#14 edit

Differences ...

==== //depot/projects/trustedbsd/openbsm/bsm/audit_kevents.h#42 (text+ko) ====

@@ -30,7 +30,7 @@
  *
  * @APPLE_BSD_LICENSE_HEADER_END@
  *
- * $P4: //depot/projects/trustedbsd/openbsm/bsm/audit_kevents.h#41 $
+ * $P4: //depot/projects/trustedbsd/openbsm/bsm/audit_kevents.h#42 $
  */
 
 #ifndef _BSM_AUDIT_KEVENTS_H_
@@ -469,6 +469,7 @@
 #define	AUE_EXTATTR_DELETE_LINK	43113	/* FreeBSD. */
 #define	AUE_KENV		43114	/* FreeBSD. */
 #define	AUE_JAIL_ATTACH		43115	/* FreeBSD. */
+#define	AUE_SYSCTL_WRITE	43116	/* FreeBSD. */
 
 /*
  * Darwin BSM uses a number of AUE_O_* definitions, which are aliased to the

==== //depot/projects/trustedbsd/openbsm/etc/audit_event#14 (text+ko) ====

@@ -1,5 +1,5 @@
 #
-# $P4: //depot/projects/trustedbsd/openbsm/etc/audit_event#13 $
+# $P4: //depot/projects/trustedbsd/openbsm/etc/audit_event#14 $
 #
 0:AUE_NULL:indir system call:no
 1:AUE_EXIT:exit(2):pc
@@ -322,7 +322,7 @@
 43018:AUE_FSTAT:fstat(2):fa
 43019:AUE_FPATHCONF:fpathconf(2):fa
 43020:AUE_GETDIRENTRIES:getdirentries(2):fr
-43021:AUE_SYSCTL:sysctl(3):ad
+43021:AUE_SYSCTL:sysctl(3):ot
 43022:AUE_MLOCK:mlock(2):pc
 43023:AUE_MUNLOCK:munlock(2):pc
 43024:AUE_UNDELETE:undelete(2):fm
@@ -417,6 +417,7 @@
 43113:AUE_EXTATTR_DELETE_LINK:extattr_delete_link(2):fm
 43114:AUE_KENV:kenv(8):ad
 43115:AUE_JAIL_ATTACH:jail_attach(2):ad
+43116:AUE_SYSCTL_WRITE:sysctl(3):ad
 #
 # User space system events.
 #