OpenBSM

OpenBSM is an open source implementation of Sun's Basic Security Module (BSM) Audit API and file format. BSM, which is a system used for auditing, describes a set of system call and library interfaces for managing audit records as well as a token stream file format that permits extensible and generalized audit trail processing.

OpenBSM includes system include files appropriate for inclusion in an operating system implementation of Audit, libbsm, an implementation of the BSM library interfaces for generating, parsing, and managing audit records, auditreduce and praudit, audit reduction and printing tools, API documentation, and sample /etc configuration files. Works in progress include extensions to the libbsm API to support easier audit trail analysis, including a pattern matching library.

OpenBSM is derived from the BSM audit implementation found in Apple's open source Darwin operating system, which upon request, Apple relicensed under a BSD licence to allow for integration into FreeBSD and other systems. The Darwin BSM implementation was created by McAfee Research under contract to Apple, and has since been extensively extended by the volunteer TrustedBSD team. OpenBSM is included in FreeBSD as of version 6.2 and later, and has been announced as a Mac OS X Snow Leopard feature.

External links

• TrustedBSD: OpenBSM
• FreeBSD Handbook: Security Event Auditing
• Apple Computer: Common Criteria