PERFORCE change 106294 for review

[Robert Watson]

http://perforce.freebsd.org/chv.cgi?CH=106294

Change 106294 by rwatson at rwatson_zoo on 2006/09/18 14:59:12

	Integrate from TrustedBSD OpenBSM branch to TrustedBSD audit3 sys
	tree.  This changes the integration base from the contrib tree to
	to the OpenBSM tree, in order to avoid merging base tree changes
	to contrib layout into the kernel (such as the deletion of
	audit_record.h).

Affected files ...

.. //depot/projects/trustedbsd/audit3/sys/bsm/audit.h#33 integrate
.. //depot/projects/trustedbsd/audit3/sys/bsm/audit_internal.h#14 integrate
.. //depot/projects/trustedbsd/audit3/sys/bsm/audit_kevents.h#28 integrate

Differences ...

==== //depot/projects/trustedbsd/audit3/sys/bsm/audit.h#33 (text+ko) ====

@@ -30,7 +30,7 @@
  *
  * @APPLE_BSD_LICENSE_HEADER_END@
  *
- * $P4: //depot/projects/trustedbsd/audit3/sys/bsm/audit.h#32 $
+ * $P4: //depot/projects/trustedbsd/audit3/sys/bsm/audit.h#33 $
  * $FreeBSD: src/sys/bsm/audit.h,v 1.5 2006/08/26 08:17:58 rwatson Exp $
  */
 
@@ -59,12 +59,13 @@
  * Triggers for the audit daemon.
  */
 #define	AUDIT_TRIGGER_MIN		1
-#define	AUDIT_TRIGGER_LOW_SPACE		1
-#define	AUDIT_TRIGGER_OPEN_NEW		2
-#define	AUDIT_TRIGGER_READ_FILE		3
-#define	AUDIT_TRIGGER_CLOSE_AND_DIE	4
-#define	AUDIT_TRIGGER_NO_SPACE		5
-#define	AUDIT_TRIGGER_MAX		5
+#define	AUDIT_TRIGGER_LOW_SPACE		1	/* Below low watermark. */
+#define	AUDIT_TRIGGER_ROTATE_KERNEL	2	/* Kernel requests rotate. */
+#define	AUDIT_TRIGGER_READ_FILE		3	/* Re-read config file. */
+#define	AUDIT_TRIGGER_CLOSE_AND_DIE	4	/* Terminate audit. */
+#define	AUDIT_TRIGGER_NO_SPACE		5	/* Below min free space. */
+#define	AUDIT_TRIGGER_ROTATE_USER	6	/* User requests roate. */
+#define	AUDIT_TRIGGER_MAX		6
 
 /*
  * Special file that will be read for trigger events from the kernel
@@ -182,12 +183,12 @@
 #define	AUDIT_PERZONE	0x2000
 
 /*
- * Audit queue control parameters.
+ * Default audit queue control parameters.
  */
 #define	AQ_HIWATER	100
 #define	AQ_MAXHIGH	10000
 #define	AQ_LOWATER	10
-#define	AQ_BUFSZ	1024
+#define	AQ_BUFSZ	MAXAUDITDATA
 #define	AQ_MAXBUFSZ	1048576
 
 /*

==== //depot/projects/trustedbsd/audit3/sys/bsm/audit_internal.h#14 (text+ko) ====

@@ -34,7 +34,7 @@
  *
  * @APPLE_BSD_LICENSE_HEADER_END@
  *
- * $P4: //depot/projects/trustedbsd/audit3/sys/bsm/audit_internal.h#13 $
+ * $P4: //depot/projects/trustedbsd/audit3/sys/bsm/audit_internal.h#14 $
  * $FreeBSD: src/sys/bsm/audit_internal.h,v 1.4 2006/09/02 10:49:44 rwatson Exp $
  */
 

==== //depot/projects/trustedbsd/audit3/sys/bsm/audit_kevents.h#28 (text+ko) ====

@@ -30,7 +30,7 @@
  *
  * @APPLE_BSD_LICENSE_HEADER_END@
  *
- * $P4: //depot/projects/trustedbsd/audit3/sys/bsm/audit_kevents.h#27 $
+ * $P4: //depot/projects/trustedbsd/audit3/sys/bsm/audit_kevents.h#28 $
  * $FreeBSD: src/sys/bsm/audit_kevents.h,v 1.7 2006/08/26 08:17:58 rwatson Exp $
  */
 
@@ -468,6 +468,9 @@
 #define	AUE_EXTATTR_SET_LINK	43111	/* FreeBSD. */
 #define	AUE_EXTATTR_LIST_LINK	43112	/* FreeBSD. */
 #define	AUE_EXTATTR_DELETE_LINK	43113	/* FreeBSD. */
+#define	AUE_KENV		43114	/* FreeBSD. */
+#define	AUE_JAIL_ATTACH		43115	/* FreeBSD. */
+#define	AUE_SYSCTL_WRITE	43116	/* FreeBSD. */
 
 /*
  * Darwin BSM uses a number of AUE_O_* definitions, which are aliased to the