audit(4): Syscalls dealing with file access via file-handles

[aniketp]

Summary

The following change introduces 3 system calls dealing with retrieving file information
with the help of file handles. The system calls are categorized as audit events
within file-attribute-access audit class

List of system calls:

• fhopen(2)
• fhstat(2)
• fhstatfs(2)

Test Plan

Execute make && make install from test/sys/audit.
Execute kyua test from /usr/tests/sys/audit. All testcases should succeed.

[asomers]

tests/sys/audit/file-attribute-access.c

389 ↗

(On Diff #43743)

Do you have a test for getfh itself anywhere?

417 ↗

(On Diff #43743)

This is a read from uninitialized memory, and isn't guaranteed to fail. Better would be to deliberately construct an invalid fhandle_t. However, I don't see any obvious way to do that. So a better test might be to call fhopen with a valid fhandle_t, but make it fail for some other reason. For example, the man page says it will fail if O_CREAT is set.

468 ↗

(On Diff #43743)

Another read from uninitialized memory here.

519 ↗

(On Diff #43743)

And here.

[aniketp]

tests/sys/audit/file-attribute-access.c

389 ↗

(On Diff #43743)

Yes @asomers, I have tested getfh(2) which is weirdly audited as nfs_getfh(2), and that too in administrative audit class.
Here is the test for nfs_getfh(2) : https://github.com/aniketp/AuditTestSuite/blob/master/audit/administrative.c#L157

[aniketp]

Replace uninitialized buffers with NULL for the failure cases

[asomers]

You also need to update Makefile.

[aniketp]

@asomers, I'm adding these tests on top of already existing tests in file-attribute-access. Why would updating the Makefile be necessary here?

[asomers]

In D15798#334130, @aniketp wrote:

@asomers, I'm adding these tests on top of already existing tests in file-attribute-access. Why would updating the Makefile be necessary here?

Oh, I see the real problem now. Your last submission accidentally disabled these tests: https://reviews.freebsd.org/D15795#inline-96266 .