Subject: auditon(2) clarification [PSARC/2009/613 Self Review]
To:      psarc-extsun.com
Cc:      audit-core@sun.com
Bcc:     one-pager-list@sac.sfbay one-pager-log@sac.sfbay sac-bar@sac.sfbay

I'm sponsoring this case for Marek Pospisil.  It requests a Patch
Release Binding and no change in the Commitment level.  The project
team has no plans to backport.

I believe it qualifies for self-review and have marked it "closed approved
automatic."  I'm happy to turn it into a fast track and set the timer if
anyone believes I've misjudged.

A diff marked man page is in the case directory.

Gary..

Problem:
=======
auditon(2) functions A_GETPOLICY and A_SETPOLICY retrieve and store
bitmask of audit policies.  The kernel the audit policy variable is
presently declared an int.  Over the years, various parts of the ON
code have declare an "int," an "unsigned," and a "long."  The code
has always treated the value as a 32 bit bitmask.

Proposal:
========
CR 6884238 The audit_policy variable should be a uint32_t.
proposes to change all the references in ON from whatever
the variable declaration is to uint32_t.  The auditon(2) man
is to be modified as well.

auditon(2):
System Calls                                           auditon(2)

NAME
     auditon - manipulate auditing

SYNOPSIS
     cc [ flag... ] file... -lbsm  -lsocket   -lnsl  [ library... ]
     #include <sys/param.h>
     #include <bsm/libbsm.h>

     int auditon(int cmd, caddr_t data, int length);

DESCRIPTION
     The auditon() function performs various audit subsystem con-
     trol  operations. The cmd argument designates the particular
     audit control command. The data argument  is  a  pointer  to
     command-specific  data. The length argument is the length in
     bytes of the command-specific data.

     The following commands are supported:

. . .


     A_GETPOLICY
-        Return the audit policy flags in the integer pointed  to
+        Return the audit policy flags in the uint32_t pointed  to
         by data.

     A_SETPOLICY
-        Set the audit policy flags to the values in the  integer
+        Set the audit policy flags to the values in the  uint32_t
         pointed  to  by  data.  The  following  policy flags are
         recognized:

         AUDIT_CNT
             Do not suspend processes when audit storage is  full
             or  inaccessible.  The  default action is to suspend
             processes until storage becomes available.

         AUDIT_AHLT
             Halt  the  machine  when  a  non-attributable  audit
             record  can  not be delivered. The default action is
             to count the number of  events  that  could  not  be
             recorded.
. . .

Issues:
======
None are expected.  caddr_t is opaque relative to type of the pointer
it contains.  Since day one, the implementation ignored length and
copied out/in 4 bytes.