'\" te
.\" Copyright (c) 2008, Sun Microsystems, Inc. All Rights Reserved
.\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
.\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
.\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
.TH AUDIT_USER 4 "Jun 26, 2008"
.SH NAME
audit_user \- per-user auditing data file
.SH SYNOPSIS
.LP
.nf
\fB/etc/security/audit_user\fR
.fi

.SH DESCRIPTION
.sp
.LP
\fBaudit_user\fR is a database that stores per-user auditing preselection data.
You can use the \fBaudit_user\fR file with other authorization sources,
including the \fBNIS\fR map \fBaudit_user.byname\fR and the \fBNIS+\fR table
\fBaudit_user\fR. Programs use the \fBgetauusernam\fR(3BSM) routines to access
this information.
.sp
.LP
The search order for multiple user audit information sources is specified in
the \fB/etc/nsswitch.conf\fR file. See \fBnsswitch.conf\fR(4). The lookup
follows the search order for \fBpasswd\fR(4).
.sp
.LP
The fields for each user entry are separated by colons (\fB:\fR). Each user is
separated from the next by a newline. \fBaudit_user\fR does not have general
read permission. Each entry in the \fBaudit_user\fR file has the form:
.sp
.in +2
.nf
\fIusername\fR:\fIalways-audit-flags\fR:\fInever-audit-flags\fR
.fi
.in -2
.sp

.sp
.LP
The fields are defined as follows:
.sp
.ne 2
.na
\fB\fIusername\fR\fR
.ad
.RS 22n
User's login name.
.RE

.sp
.ne 2
.na
\fB\fIalways-audit-flags\fR\fR
.ad
.RS 22n
Flags specifying event classes to \fIalways\fR audit.
.RE

.sp
.ne 2
.na
\fB\fInever-audit-flags\fR\fR
.ad
.RS 22n
Flags specifying event classes to \fInever\fR audit.
.RE

.sp
.LP
For a complete description of the audit flags and how to combine them, see
\fBaudit_control\fR(4).
.SH EXAMPLES
.LP
\fBExample 1 \fRUsing the \fBaudit_user\fR File
.sp
.in +2
.nf
other:lo,am:io,cl
fred:lo,ex,+fc,-fr,-fa:io,cl
ethyl:lo,ex,nt:io,cl
.fi
.in -2
.sp

.SH FILES
.sp
.LP
\fB/etc/nsswitch.conf\fR
.sp
.LP
\fB/etc/passwd\fR
.sp
.LP
\fB/etc/security/audit_user\fR
.SH ATTRIBUTES
.sp
.LP
See \fBattributes\fR(5) for descriptions of the following attributes:
.sp

.sp
.TS
box;
c | c
l | l .
ATTRIBUTE TYPE	ATTRIBUTE VALUE
_
Interface Stability 	 See below.
.TE

.sp
.LP
The file format stability is Committed. The file content is Uncommitted.
.SH SEE ALSO
.sp
.LP
\fBbsmconv\fR(1M), \fBgetauusernam\fR(3BSM), \fBaudit_control\fR(4),
\fBnsswitch.conf\fR(4), \fBpasswd\fR(4)
.sp
.LP
Part\ VII, \fISolaris Auditing,\fR in \fISystem Administration Guide: Security
Services\fR
.SH NOTES
.sp
.LP
This functionality is available only if the Basic Security Module (\fBBSM\fR)
has been enabled. See \fBbsmconv\fR(1M) for more information.
.sp
.LP
Configuration changes do not affect audit sessions that are currently running,
as the changes do not modify a process's preselection mask. To change the
preselection mask on a running process, use the \fB-setpmask\fR option of the
\fBauditconfig\fR command (see \fBauditconfig\fR(1M)). If the user logs out and
logs back in, the new configuration changes will be reflected in the next audit
session.