As Wayne and I are in the process of merging the TrustedBSD audit3 branch contents into the FreeBSD CVS HEAD (7-CURRENT), there may be periods where the tree is (hopefully briefly) unbuildable. This integration process will take a couple of days to complete, due to the scope of the changes. So far, the kernel audit framework has been committed (src/sys/security/audit), as has an initial vendor import of OpenBSM for user space (src/contrib/openbsm). What remains to be committed are the substantial changes to gather audit data in system calls, the mappings of system calls to audit events, and integration into the user space build and user space applications (such as login). These bits are the trickier bits as the patches are large and touch a lot of parts of the tree.

I'll send out follow-up e-mail once the worst is past, along with information on what it all means, and how to try it out (for those not already on trustedbsd-audit, who have been hearing about this for a while).

Robert N M Watson