1.\" Copyright (c) 2006, 2019 Robert N. M. Watson 2.\" All rights reserved. 3.\" 4.\" This software was developed in part by BAE Systems, the University of 5.\" Cambridge Computer Laboratory, and Memorial University under DARPA/AFRL 6.\" contract FA8650-15-C-7558 ("CADETS"), as part of the DARPA Transparent 7.\" Computing (TC) research program. 8.\" 9.\" Redistribution and use in source and binary forms, with or without 10.\" modification, are permitted provided that the following conditions 11.\" are met: 12.\" 1. Redistributions of source code must retain the above copyright 13.\" notice, this list of conditions and the following disclaimer. 14.\" 2. Redistributions in binary form must reproduce the above copyright 15.\" notice, this list of conditions and the following disclaimer in the 16.\" documentation and/or other materials provided with the distribution. 17.\" 18.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND 19.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE 22.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 26.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 27.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 28.\" SUCH DAMAGE. 29.\" 30.Dd April 28, 2019 31.Dt AUDIT 4 32.Os 33.Sh NAME 34.Nm audit 35.Nd Security Event Audit 36.Sh SYNOPSIS 37.Cd "options AUDIT" 38.Sh DESCRIPTION 39Security Event Audit is a facility to provide fine-grained, configurable 40logging of security-relevant events, and is intended to meet the requirements 41of the Common Criteria (CC) Common Access Protection Profile (CAPP) 42evaluation. 43The 44.Fx 45.Nm 46facility implements the de facto industry standard BSM API, file 47formats, and command line interface, first found in the Solaris operating 48system. 49Information on the user space implementation can be found in 50.Xr libbsm 3 . 51.Pp 52Audit support is enabled at boot, if present in the kernel, using an 53.Xr rc.conf 5 54flag. 55The audit daemon, 56.Xr auditd 8 , 57is responsible for configuring the kernel to perform 58.Nm , 59pushing 60configuration data from the various audit configuration files into the 61kernel. 62.Ss Audit Special Device 63The kernel 64.Nm 65facility provides a special device, 66.Pa /dev/audit , 67which is used by 68.Xr auditd 8 69to monitor for 70.Nm 71events, such as requests to cycle the log, low disk 72space conditions, and requests to terminate auditing. 73This device is not intended for use by applications. 74.Ss Audit Pipe Special Devices 75Audit pipe special devices, discussed in 76.Xr auditpipe 4 , 77provide a configurable live tracking mechanism to allow applications to 78tee the audit trail, as well as to configure custom preselection parameters 79to track users and events in a fine-grained manner. 80.Ss DTrace Audit Provider 81The DTrace Audit Provider, 82.Xr dtaudit 4 , 83allows D scripts to enable capture of in-kernel audit records for kernel audit 84event types, and then process their contents during audit commit or BSM 85generation. 86.Sh SEE ALSO 87.Xr auditreduce 1 , 88.Xr praudit 1 , 89.Xr audit 2 , 90.Xr auditctl 2 , 91.Xr auditon 2 , 92.Xr getaudit 2 , 93.Xr getauid 2 , 94.Xr poll 2 , 95.Xr select 2 , 96.Xr setaudit 2 , 97.Xr setauid 2 , 98.Xr libbsm 3 , 99.Xr auditpipe 4 , 100.Xr dtaudit 4 , 101.Xr audit.log 5 , 102.Xr audit_class 5 , 103.Xr audit_control 5 , 104.Xr audit_event 5 , 105.Xr audit_user 5 , 106.Xr audit_warn 5 , 107.Xr rc.conf 5 , 108.Xr audit 8 , 109.Xr auditd 8 , 110.Xr auditdistd 8 111.Sh HISTORY 112The 113.Tn OpenBSM 114implementation was created by McAfee Research, the security 115division of McAfee Inc., under contract to Apple Computer Inc.\& in 2004. 116It was subsequently adopted by the TrustedBSD Project as the foundation for 117the OpenBSM distribution. 118.Pp 119Support for kernel 120.Nm 121first appeared in 122.Fx 6.2 . 123.Sh AUTHORS 124.An -nosplit 125This software was created by McAfee Research, the security research division 126of McAfee, Inc., under contract to Apple Computer Inc. 127Additional authors include 128.An Wayne Salamon , 129.An Robert Watson , 130and SPARTA Inc. 131.Pp 132The Basic Security Module (BSM) interface to audit records and audit event 133stream format were defined by Sun Microsystems. 134.Pp 135This manual page was written by 136.An Robert Watson Aq Mt rwatson@FreeBSD.org . 137.Sh BUGS 138The 139.Fx 140kernel does not fully validate that audit records submitted by user 141applications are syntactically valid BSM; as submission of records is limited 142to privileged processes, this is not a critical bug. 143.Pp 144Instrumentation of auditable events in the kernel is not complete, as some 145system calls do not generate audit records, or generate audit records with 146incomplete argument information. 147.Pp 148Mandatory Access Control (MAC) labels, as provided by the 149.Xr mac 4 150facility, are not audited as part of records involving MAC decisions. 151.Pp 152Currently the 153.Nm 154syscalls are not supported for jailed processes. 155However, if a process has 156.Nm 157session state associated with it, audit records will still be produced and a zonename token 158containing the jail's ID or name will be present in the audit records. 159