OpenBSM 1.1p2 is a minor patch release of the OpenBSM code base. There are no significant changes from OpenBSM 1.1p1, but there are several bug fixes relating to /etc/security/audit_event entries for the openat(2) system call, build fixes for Linux, and the printing of class masks by the audump tool.

OpenBSM 1.1p1 is a minor patch release of the OpenBSM code base. There are no significant changes from OpenBSM 1.1, but there are a number of bug fixes in token parsing and generation, and tolerance for whitespace variation in OpenBSM configuration files is improved.

OpenBSM 1.1 is the second production release of the OpenBSM code base. Major changes since OpenBSM 1.0 include:

• Trail files now include the host where the trail is generated. Crash recovery has been improved. Trail expiration based on size and date is now supported; by default trail files will be expired after 10MB of trails. The default individual trail limit is now 2MB.
• Mac OS X Snow Leopard is now a fully supported platform; launchd(8) can now be used to launchd auditd(8). Command line tools and libraries are now supported on Mac OS X Leopard.
• Extended header tokens are now supported, allowing audit trails to be tagged with a host identifier. IPv6 addresses are now supported in subject tokens.
• BSM token and record types have been further synchronized to OpenSolaris; support for many new system calls has been added. Local errors and socket types are mapped to and from BSM values.

Since the last test release, OpenBSM 1.1 beta 1, 32/64-bit compatibility has been fixed for the auditon(2) system call. A default "expire-after" of 10MB is now set in audit_control(5). Local fcntl(2) arguments are now mapped to wire BSM versions using new APIs. The audit_submit(3) man page has been fixed. A new audit event class has been added for post-login authentication and access control events.

OpenBSM 1.0 is the first production release of the OpenBSM code base. Since the last test release, OpenBSM 1.0 alpha 15, a bug leading to a crash in auditreduce(8) has been resolved, and all AU_ constants have been removed. The versions of autoconf and automake used to build OpenBSM have been updated.

In this revision, OpenBSM's auditd(8) grows support for audit trail expiration based on age and trail size, various defaults in audit_control(5) are modernized (such as smaller percent free default, and enabling execve(2)argument auditing by default), socket types and domains are converted to BSM format when written out, and bugs are fixed in IPC permission token encoding.

In this revision, OpenBSM is modified to map local protocol family constants and socket types to wire versions, as the specific constant values vary by OS; a stub libauditd(3) man page is added, errno constants are renamed, full error string text is not compiled into kernels when OpenBSM code is used there, warnings are fixed on many platforms, and the launchd label for audit is changed on Mac OS X.

In this revision, most functional components of auditd(8) are moved to a new libauditd(3), so that they can be shared by auditd(8) on FreeBSD and launchd(8) on Mac OS X. In addition, audit_submit(3) is taught to accept local errno values (as it did before the additional of a BSM error number space), further cleanup of the user audit event ID space is performed in order to avoid collisions with other systems, au_strerror(3) is added to allow printing of error numbers without converting to local numbers (which may lose fidelity), and audit crash recovery is improved as auditd now maintains a current trail link and cleans up if it discovers auditd failed during the last rotation. In Mac OS X, ASL(3) is used instead of syslog(3) for system logging.

In this revision, OpenBSM maps between local and wire values for the errno error space, bugs are fixed in the encoding of execve arguments and environmental variables, support for the portable AUT_SOCKET_EX token type is added, and the BSM header version is bumped to give OpenBSM 1.1 its own file format version due to non-trivial changes in tokens.

In this revision, BSM include files required by OS vendors for use in kernels are broken out into a separate include directory, a configure option is added to force use of native rather than OpenBSM sys includes if desired, strlcpy() and strlcat() are used in preference to less robust APIs, compatibility defines for old Darwin event identifiers are removed, support for exended header tokens (containing host information) is added to the BSM library and auditd(8), and can be set in audit_control(5).

In this revision, support for Mac OS X 10.5 is introduced, including new events specific to Leopard, and support for the Mach IPC audit trigger method. auditreduce(1) grows an invert flag, and allows selecting of more than one event. A number of bugs are fixed, including in XML trail conversion, BSM record writing, and audit_control file access.

Bugs fixed in the handling of IPv6 addresses, auditreduce, and additional audit event identifiers added for new system calls.

Support for the zonename token type added, a variety of endian-related bugs in IPv6 addresses fixed, OpenBSM becomes warning clean for gcc1, and various man page updated.

Man page documentation substantially imrpved, XML printing support added to praudit(8), and support for more 64-bit token types.

audit_control(5) filesz configuration added in order to support automated rotation of audit trails based on file size, regular expression matching for paths added to auditreduce, an audit_warn event is generated on rotation, and a number of other bugs fixed and documentation improved.

audit_control(5) control of audit policy is introduced, and and significant number of bugs relating to execve(2) argument auditing and trail rotation are fixed.

auditd(8) now submits complete audit records, including full return information, as part of its operation.

Many BSM_/bsm_ constants are renamed to AUDIT_/audit_, the audit filter module API has been refined, and a number of bugs have been fixed..

Non-Solaris audit events have been renumbered to avoid future collisions, and a unique OpenBSM header token version number has been adopted. A variety of other bugs have been fixed, and cleanups made.

Improvements in the creation of subject tokens and in code portability.

An experimental audit filter API is introduced, APIs for application-submitted audit records are improved, and bugs are fixed.

OpenBSM now uses autoconf/automake, allowing it to build on Mac OS X and Linux.

This is the first version of OpenBSM and incorporates the OpenBSM code as present on FreeBSD CVS at this date.