• Add auditable startup and closeup events if auditd(8) was not already running

• Move auditon code before starting calling AUDITPIPE_FLUSH

• Check if auditing was enabled before AUDITPIPE_FLUSH test

• Move cleanup part of auditpipe_set_qlimit to test case cleanup section

Woah! This was easy. Though I guess later on, we can add these lines to eliminate false positives from lgetfh(2)

pid = getpid();
snprintf(extregex, sizeof(extregex), "lgetfh.*%d.*return,success", pid);

Also, many more such tests can be improved similarly.

• Include PR number with the expected failure message

• Rename auditon_{success/failure} to auditon_default_{success/failure}

• Comment describing the latest change in auditon_setcond_success

• Fix the above described bug in auditon_setcond_success

• Fix 'pointer from integer without a cast' build failure on sparc64

• Fix build for ARM and Sparc64 architectures

• Replace ARM_SYNC_ICACHE with ARM_DRAIN_WRITEBUF as the syscall argument

ARM_SYNC_ICACHE for some reason breaks build on arm as pointed out by @asomers. It can't find the declaration of the corresponding struct and hence, assumes that the test-program is declaring the struct instead of defining it.

• Changes as suggested in the previous review

• Grammatical corrections in the same comment

• Improvements in setvbuf's comments

• Remove redundant header includes that were added for ioctl operations which are not required anymore

• Disable I/O buffering for the whole test-suite

• Use respective args instead of a common void *sysarg

• Some more updates to the recent comments

• Forgot a comma in _exit(2) test case comments

• Disable I/O buffering from /dev/auditpipe for read operations for cap_enter(2) and _exit(2)

• Same change as above for the missed mallocs

• Add the missed sysnum for sparc64 tests

Add the missed \#endif statement

Include Sparc64 in the possible architectures for sysarch(2)

Create a single success mode test case for sysarch(2) with sysnum being dependent on the system architecture

Store auditinfo in stack instead of allocating heap memory

I guess in one of the later tests, I'll have to fix this too: tests/sys/audit/administrative.c#L389

Oh, no. _exit(2) wasn't failing previously. In fact, I hadn't even created its test. I apparently overlooked it just because process-control has a _lot_ of syscalls.

Other than the (possible?) repetition of AUDIT_SYSCALL_EXIT in kern_exit.c. The issue with exa(1) seems to have gone away. Also, the regression tests for audit of _exit(2) in D16099 don't fail on introducing this change.

• Updates in _exit(2) test case comment

• Add tests for _exit(2) using the AUDITPIPE_FLUSH approach (for now)

• Add the AUDITPIPE_FLUSH ioctl after calling cap_enter() to eliminate the buffering issue

• Add test for audit(2) in failure case

• Updates in Copyright

• Initialize ec_class to 0

• Update comment explaining why we are ignoring the output of first setsid()

Initialize evclass to get the event-class mapping for auditon(2)

• Call setsid() prematurely to intentionally fail the tests

• Remove placeholder comment about not testing mount(2), nmount(2) in success case

These will be dealt later on

• Add tests for clock_settime(2)

• Add tests for auditon(2), swapon(2) and swapoff(2)

Note: swapon(2) and swapoff(2) require block device, hence can't be tested
in success case since block devices are gone (from FreeBSD)

Remove 80 bytes hardcoded initialization from buff array

Declare buff as an array instead of a pointer, to be able to correctly pass the value to nbytes argument for extattr_set_*

Add test for setpgrp_success

Update ngroups for setgroups_success as 5 instead of 100

Changes according to the inline comments

Remove -1 from strlcat() in shm_inlink_success test case

Changes as suggested in the inline comments

Add test for successful invocation of setlogin(2)

Define _WANT_SEMUN instead of declaring union semun in the test program

Shift the location of close(filedesc2) to right after opening it

Update the test case for acct_success

• Add test for acct_success. Use sysctlbyname(3) to retrieve the accounting status
• Minor changes in auditctl_success test case cleanup

• Remove semarg from GETVAL, GETPID, GETZCNT, GETNCNT
• Initialize semvals in SETALL by first calling GETALL

Replace arg with semarg; And some minor changes

Use bzero from within the function init_msghdr()

Lots of changes

• Typecast changes to socklen_t
• bzeroed struct msghdrs
• Some tweaks in hex format identifiers and variable namings

Use PROT_NONE instead of 0 for mprotect_success