From 93536b495d8a728baeccbfd5a6d0ed1b405c9018 Mon Sep 17 00:00:00 2001 From: Robert Watson Date: Tue, 22 Jul 2008 17:54:32 +0000 Subject: [PATCH] If an AUE_SYSCTL_NONADMIN audit event is selected, generate a record with equivilent content to AUE_SYSCTL. Obtained from: Apple Inc. MFC after: 3 days --- sys/security/audit/audit_bsm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sys/security/audit/audit_bsm.c b/sys/security/audit/audit_bsm.c index 5b4d9ed5a0a..a7fbb210994 100644 --- a/sys/security/audit/audit_bsm.c +++ b/sys/security/audit/audit_bsm.c @@ -1382,6 +1382,7 @@ kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau) break; case AUE_SYSCTL: + case AUE_SYSCTL_NONADMIN: if (ARG_IS_VALID(kar, ARG_CTLNAME | ARG_LEN)) { for (ctr = 0; ctr < ar->ar_arg_len; ctr++) { tok = au_to_arg32(1, "name",