Warning: MFC of security event audit support RELENG_6 in the next 2-3 weeks

[Robert Watson]

On Sat, 2 Sep 2006, Robert Watson wrote:

> After a couple of weeks of settling, polishing, etc, the MFC of audit 
> support is about to begin.  Over the next couple of days, the 6-STABLE build 
> may be briefly broken as inter-dependent components are merged.  I do not 
> anticipate any serious disruption, but some caution is called for.  In 
> principle, all the potentially tricky kernel ABI dependencies, etc, were 
> dealt with before 6.0-RELEASE, such as changes in the size of the kernel 
> system call data structures.  The approximate merge plan, run by re@ a few 
> days ago, is as follows:

Just as a status update -- the vast majority of audit code has now been MFC'd 
to -STABLE.  There are a few areas where the merge is not yet complete -- 
primarily as relates to non-native/emulated/compatibility system calls, and 
non-i386/amd64 system calls.  I anticipate these being merged in the near 
future.  We've also seen a number of problem reports relating to starting the 
auditd daemon, a problem not seen during testing on -CURRENT, so we're working 
on debugging that, and we've found some bugs in audit log rotation.  I'm 
currently travelling for a few days, but will follow up when I get back to the 
UK on Tuesday on where things stand, and what (if any) further changes are in 
the pipeline.  Once these problems are fixed, it sounds like we're well on 
track to ship with audit as a 6.2 (experimental) feature.

thanks,

Robert N M Watson
Computer Laboratory
University of Cambridge