'\" te
.\" Copyright (c) 2008, Sun Microsystems, Inc.
.\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
.\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
.\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
.TH AUDIT_CLASS 5 "Mar 6, 2017"
.SH NAME
audit_class \- audit class definitions
.SH SYNOPSIS
.LP
.nf
\fB/etc/security/audit_class\fR
.fi

.SH DESCRIPTION
.LP
\fB/etc/security/audit_class\fR is a user-configurable ASCII system file that
stores class definitions used in the audit system. Audit events in
\fBaudit_event\fR(5) are mapped to one or more of the defined audit classes.
\fBaudit_event\fR can be updated in conjunction with changes to
\fBaudit_class\fR.
Programs can use the \fBgetauclassent\fR(3BSM) routines to access audit
class information.
.sp
.LP
The fields for each class entry are separated by colons. Each class entry is a
bitmap and is separated from each other by a newline.
.sp
.LP
Each entry in the \fBaudit_class\fR file has the form:
.sp
.in +2
.nf
\fImask\fR:\fIname\fR:\fIdescription\fR
.fi
.in -2

.sp
.LP
The fields are defined as follows:
.sp
.ne 2
.na
\fB\fImask\fR\fR
.ad
.RS 15n
class mask
.RE

.sp
.ne 2
.na
\fB\fIname\fR\fR
.ad
.RS 15n
class name
.RE

.sp
.ne 2
.na
\fB\fIdescription\fR\fR
.ad
.RS 15n
class description
.RE

.sp
.LP
Each class is represented as a bit in the class mask which is an unsigned
integer. Thus, there are 32 different classes available. Meta-classes can also
be defined. These are supersets composed of multiple base classes, and thus
will have more than 1 bit in its mask. See Examples. Two special meta-classes
are also pre-defined: \fBall\fR, and \fBno\fR.
.sp
.ne 2
.na
\fB\fBall\fR\fR
.ad
.RS 7n
Represents a conjunction of all allowed classes, and is provided as a shorthand
method of specifying all classes.
.RE

.sp
.ne 2
.na
\fB\fBno\fR\fR
.ad
.RS 7n
Is the invalid class, and any event mapped solely to this class will not be
audited. Turning auditing on to the \fBall\fR meta class will not cause events
mapped solely to the \fBno\fR class to be written to the audit trail. This
class is also used to map obsolete events which are no longer generated.
Obsolete events are retained to process old audit trails files.
.RE

.SH EXAMPLES
.LP
\fBExample 1 \fRUsing an \fBaudit_class\fR File
.sp
.LP
The following is an example of an \fBaudit_class\fR file:

.sp
.in +2
.nf
0x00000000:no:invalid class
0x00000001:fr:file read
0x00000002:fw:file write
0x00000004:fa:file attribute access
0x00000008:fm:file attribute modify
0x00000010:fc:file create
0x00000020:fd:file delete
0x00000040:cl:file close
0x00000100:nt:network
0x00000200:ip:ipc
0x00000400:na:non-attribute
0x00001000:lo:login or logout
0x00004000:ap:application
0x000f0000:ad:old administrative (meta-class)
0x00070000:am:administrative (meta-class)
0x00010000:ss:change system state
0x00020000:as:system-wide administration
0x00040000:ua:user administration
0x00080000:aa:audit utilization
0x00300000:pc:process (meta-class)
0x00100000:ps:process start/stop
0x00200000:pm:process modify
0x20000000:io:ioctl
0x40000000:ex:exec
0x80000000:ot:other
0xffffffff:all:all classes (meta-class)
.fi
.in -2
.sp

.SH FILES
.ne 2
.na
\fB\fB/etc/security/audit_class\fR\fR
.ad
.RS 29n

.RE

.SH ATTRIBUTES
.LP
See \fBattributes\fR(7) for descriptions of the following attributes:
.sp

.sp
.TS
box;
c | c
l | l .
ATTRIBUTE TYPE	ATTRIBUTE VALUE
_
Interface Stability 	 See below.
.TE

.sp
.LP
The file format stability is Committed. The file content is Uncommitted.
.SH SEE ALSO
.LP
.BR au_preselect (3BSM),
.BR getauclassent (3BSM),
.BR audit_event (5),
.BR attributes (7)
.SH NOTES
.LP
It is possible to deliberately turn on the \fBno\fR class in the kernel, in
which case the audit trail will be flooded with records for the audit event
\fBAUE_NULL\fR.