Robert Watson announced the release of OpenBSM 1.1 alpha 2, a test snapshot of OpenBSM 1.1.
OpenBSM is a portable, open source implementation of Sun’s Basic Security Module (BSM) security audit API and file format. BSM, the de facto industry standard for audit, describes a set of system call and library interfaces for managing audit records, as well as a token stream file format that permits extensible and generalized audit trail processing. Records may describe both kernel events, such as system calls, as well as application events, such as login, password changes, etc. – source
The following are the change notes from the OpenBSM news file included with this release:
- Include files in OpenBSM are now broken out into two parts: library builds required solely for user space, and system includes, which may also be required for use in the kernels of systems integrating OpenBSM.
- Configure option –with-native-includes allows forcing the use of native include for system includes, rather than the versions bundled with OpenBSM. This is intended specifically for platforms that ship OpenBSM, have adapted versions of the system includes in a kernel source tree, and will use the OpenBSM build infrastructure with an unmodified OpenBSM distribution, allowing the customized system includes to be used with the OpenBSM build.
- Various strcpy()’s/strcat()’s have been changed to strlcpy()’s/strlcat()’s or asprintf(). Added compat/strlcpy.h for Linux.
- Remove compatibility defines for old Darwin token constant names; now only BSM token names are provided and used.
- Add support for extended header tokens, which contain space for information on the host generating the record.
- Add support for setting extended host information in the kernel, which is used for setting host information in extended header tokens. The audit_control file now supports a “host” parameter which can be used by auditd to set the information; if not present, the kernel parameters won’t be set and auditd uses unextended headers for records that it generates.
OpenBSM releases and snapshots can be downloaded from the OpenBSM project web page.
This test release is known to build and run (to varying degrees) on FreeBSD 6.x, 7.x, 8.x, Mac OS X Leopard, and OpenSuse Linux.