Patch-ID# 108875-07
Keywords: security umount2 audit c2audit audit_event TPI M_PROTO T_DISCON_IND
Synopsis: SunOS 5.8: c2audit patch
Date: 19/Jun/00

Solaris Release: 8

SunOS release: 5.8

Unbundled Product: 

Unbundled Release: 

Topic: SunOS 5.8: c2audit patch

	***********************************************************
	NOTE: This patch may contain one or more OEM-specific platform ports.
	      See the appropriate OEM_NOTES file within the patch for
	      information specific to these platforms.
 
	      DO NOT INSTALL this patch on an OEM system if a corresponding
	      OEM_NOTES file is not present (or is present, but instructs not
	      to install the patch), unless the OEM vendor directs otherwise.
	***********************************************************
	NOTE:  Refer to Special Install Instructions section for 
               IMPORTANT specific information on this patch.

BugId's fixed with this patch: 4224166 4290575 4307306 4308525 4322741 4325997 4336689 4336959 4339611 4344275 

Changes incorporated in this version: 4339611 4344275

Relevant Architectures: sparc

Patches accumulated and obsoleted by this patch:  

Patches which conflict with this patch: 

Patches required with this patch: 

Obsoleted by: 

Files included with this patch:

/etc/security/audit_event
/kernel/sys/c2audit
/kernel/sys/sparcv9/c2audit
/usr/include/bsm/audit_kevents.h
/usr/lib/libbsm.a
/usr/lib/libbsm.so.1
/usr/lib/sparcv9/libbsm.so.1
/usr/lib/abi/abi_libbsm.so.1
/usr/lib/abi/sparcv9/abi_libbsm.so.1
/usr/sbin/auditd

Problem Description:

4339611 BSM does not work with some of the option. Problem ONLY with Solaris 8.
4344275 64 bit problem with libbsm audit_class.c

(from 108875-06)

4336689 typo's in /etc/security/audit_event
4336959 audit record ID's incorrect for xmknod, xstat, lxstat

(from 108875-05)

4325997 BSM lacks hooks to support administrator authentication

(from 108875-04)

4307306 stopping c2 auditing does not always stop auditing in the kernel

(from 108875-03)

4322741 Recent change to sonode structure needlessly breaks lsof

(from 108875-02)

4224166 TPI messages get flushed if 3rd party module processes M_PROTO in service proced
4290575 2nd connect() to determine status of non-blocking connect sends extra Syn

(from 108875-01)

4308525 The umount2 system call is not audited

Patch Installation Instructions:
--------------------------------

For Solaris 2.0-2.6 releases, refer to the Install.info file and/or
the README within the patch for instructions on using the generic
'installpatch' and 'backoutpatch' scripts provided with each patch.

For Solaris 7-8 releases, refer to the man pages for instructions
on using 'patchadd' and 'patchrm' scripts provided with Solaris.
Any other special or non-generic installation instructions should be
described below as special instructions.  The following example
installs a patch to a standalone machine:

       example# patchadd /var/spool/patch/104945-02

The following example removes a patch from a standalone system:

       example# patchrm 104945-02

For additional examples please see the appropriate man pages.

Special Install Instructions: 
----------------------------- 

	NOTE:	To get the complete fix for 4224166 (TPI messages get 
		flushed if 3rd party module processes), one needs to
		install the following patches:

		109043-01 (or newer)	sonode adb macro patch	
		109041-01 (or newer)	sockfs patch
		109045-01 (or newer)	/usr/sbin/sparcv7/crash and
					/usr/sbin/sparcv9/crash patch
