PERFORCE change 123295 for review

[Robert Watson]

http://perforce.freebsd.org/chv.cgi?CH=123295

Change 123295 by rwatson at rwatson_peppercorn on 2007/07/10 22:32:14

	Add closefrom(2) event for proposed closefrom(2) system call on
	FreeBSD.  Solaris implements closefrom(3) in user space using a
	loop around close(2), so generates separate audit records for
	each close.

Affected files ...

.. //depot/projects/trustedbsd/openbsm/bsm/audit_kevents.h#50 edit
.. //depot/projects/trustedbsd/openbsm/etc/audit_event#23 edit

Differences ...

==== //depot/projects/trustedbsd/openbsm/bsm/audit_kevents.h#50 (text+ko) ====

@@ -26,7 +26,7 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
- * $P4: //depot/projects/trustedbsd/openbsm/bsm/audit_kevents.h#49 $
+ * $P4: //depot/projects/trustedbsd/openbsm/bsm/audit_kevents.h#50 $
  */
 
 #ifndef _BSM_AUDIT_KEVENTS_H_
@@ -537,6 +537,7 @@
 #define	AUE_LISTEN		43140	/* FreeBSD/Darwin/Linux. */
 #define	AUE_MLOCKALL		43141	/* FreeBSD. */
 #define	AUE_MUNLOCKALL		43142	/* FreeBSD. */
+#define	AUE_CLOSEFROM		43143	/* FreeBSD. */
 
 /*
  * Darwin BSM uses a number of AUE_O_* definitions, which are aliased to the

==== //depot/projects/trustedbsd/openbsm/etc/audit_event#23 (text+ko) ====

@@ -1,5 +1,5 @@
 #
-# $P4: //depot/projects/trustedbsd/openbsm/etc/audit_event#22 $
+# $P4: //depot/projects/trustedbsd/openbsm/etc/audit_event#23 $
 #
 0:AUE_NULL:indir system call:no
 1:AUE_EXIT:exit(2):pc
@@ -480,6 +480,7 @@
 43140:AUE_LISTEN:listen(2):nt
 43141:AUE_MLOCKALL:mlockall(2):pc
 43142:AUE_MUNLOCKALL:munlockall(2):pc
+43143:AUE_CLOSEFROM:closefrom(2):cl
 #
 # User space system events.
 #