OpenBSM

OpenBSM: Open Source Basic Security Module (BSM) Audit Implementation

Perforce: //depot/projects/trustedbsd/openbsm/...

OpenBSM is an open source implementation of Sun's Basic Security Module (BSM) Audit API and file format. BSM, the de facto standard for Audit, describes a set of system call and library interfaces for managing audit records, as well as a token stream file format that permits extensible and generalized audit trail processing.

OpenBSM includes system include files appropriate for inclusion in an operating system implementation of Audit, libbsm, an implementation of the BSM library interfaces for generating, parsing, and managing audit records, auditreduce and praudit, audit reduction and printing tools, API documentation, and sample /etc configuration files. Works in progress include extensions to the libbsm API to support easier audit trail analysis, including a pattern matching library.

OpenBSM is an important component of the TrustedBSD Audit Implementation for FreeBSD, providing tools, libraries, and include files. The first official release of OpenBSM will be made shortly before the TrustedBSD audit presentation at BSDCan, where members of the TrustedBSD team will describe the operation of Audit on Darwin and FreeBSD, the components of OpenBSM, and how to develop with the BSM APIs and file format.

OpenBSM is derived from the BSM audit implementation found in Apple's open source Darwin operating system, generously released by Apple under a BSD license. The Darwin BSM implementation was created by McAfee Research under contract to Apple Computer, and has since been extended by the volunteer TrustedBSD team.