17c478bd9Sstevel@tonic-gate<?xml version="1.0"?> 27c478bd9Sstevel@tonic-gate<!DOCTYPE service_bundle SYSTEM "/usr/share/lib/xml/dtd/service_bundle.dtd.1"> 37c478bd9Sstevel@tonic-gate<!-- 4f8994074SJan Friedel Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved. 57c478bd9Sstevel@tonic-gate 67c478bd9Sstevel@tonic-gate CDDL HEADER START 77c478bd9Sstevel@tonic-gate 87c478bd9Sstevel@tonic-gate The contents of this file are subject to the terms of the 9d670ce0bSMarek Pospisil Common Development and Distribution License (the "License"). 10d670ce0bSMarek Pospisil You may not use this file except in compliance with the License. 117c478bd9Sstevel@tonic-gate 127c478bd9Sstevel@tonic-gate You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 137c478bd9Sstevel@tonic-gate or http://www.opensolaris.org/os/licensing. 147c478bd9Sstevel@tonic-gate See the License for the specific language governing permissions 157c478bd9Sstevel@tonic-gate and limitations under the License. 167c478bd9Sstevel@tonic-gate 177c478bd9Sstevel@tonic-gate When distributing Covered Code, include this CDDL HEADER in each 187c478bd9Sstevel@tonic-gate file and include the License file at usr/src/OPENSOLARIS.LICENSE. 197c478bd9Sstevel@tonic-gate If applicable, add the following below this CDDL HEADER, with the 207c478bd9Sstevel@tonic-gate fields enclosed by brackets "[]" replaced with your own identifying 217c478bd9Sstevel@tonic-gate information: Portions Copyright [yyyy] [name of copyright owner] 227c478bd9Sstevel@tonic-gate 237c478bd9Sstevel@tonic-gate CDDL HEADER END 247c478bd9Sstevel@tonic-gate 257c478bd9Sstevel@tonic-gate NOTE: This service manifest is not editable; its contents will 267c478bd9Sstevel@tonic-gate be overwritten by package or patch operations, including 277c478bd9Sstevel@tonic-gate operating system upgrade. Make customizations in a different 287c478bd9Sstevel@tonic-gate file. 297c478bd9Sstevel@tonic-gate--> 307c478bd9Sstevel@tonic-gate 317c478bd9Sstevel@tonic-gate<service_bundle type='manifest' name='SUNWcsr:auditd'> 327c478bd9Sstevel@tonic-gate 337c478bd9Sstevel@tonic-gate<service 347c478bd9Sstevel@tonic-gate name='system/auditd' 357c478bd9Sstevel@tonic-gate type='service' 367c478bd9Sstevel@tonic-gate version='1'> 377c478bd9Sstevel@tonic-gate 387c478bd9Sstevel@tonic-gate <single_instance /> 397c478bd9Sstevel@tonic-gate 407c478bd9Sstevel@tonic-gate <dependency 417c478bd9Sstevel@tonic-gate name='usr' 427c478bd9Sstevel@tonic-gate type='service' 437c478bd9Sstevel@tonic-gate grouping='require_all' 447c478bd9Sstevel@tonic-gate restart_on='none'> 457c478bd9Sstevel@tonic-gate <service_fmri value='svc:/system/filesystem/local' /> 467c478bd9Sstevel@tonic-gate </dependency> 477c478bd9Sstevel@tonic-gate 487c478bd9Sstevel@tonic-gate <dependency 497c478bd9Sstevel@tonic-gate name='ns' 507c478bd9Sstevel@tonic-gate type='service' 517c478bd9Sstevel@tonic-gate grouping='require_all' 527c478bd9Sstevel@tonic-gate restart_on='none'> 537c478bd9Sstevel@tonic-gate <service_fmri value='svc:/milestone/name-services' /> 547c478bd9Sstevel@tonic-gate </dependency> 557c478bd9Sstevel@tonic-gate 567c478bd9Sstevel@tonic-gate <dependency 577c478bd9Sstevel@tonic-gate name='syslog' 587c478bd9Sstevel@tonic-gate type='service' 59d670ce0bSMarek Pospisil grouping='optional_all' 607c478bd9Sstevel@tonic-gate restart_on='none'> 617c478bd9Sstevel@tonic-gate <service_fmri value='svc:/system/system-log' /> 627c478bd9Sstevel@tonic-gate </dependency> 637c478bd9Sstevel@tonic-gate 648523fda3SJan Friedel 657c478bd9Sstevel@tonic-gate <dependent 668523fda3SJan Friedel name='multi-user' 677c478bd9Sstevel@tonic-gate grouping='optional_all' 687c478bd9Sstevel@tonic-gate restart_on='none'> 697c478bd9Sstevel@tonic-gate <service_fmri value='svc:/milestone/multi-user'/> 707c478bd9Sstevel@tonic-gate </dependent> 717c478bd9Sstevel@tonic-gate 727c478bd9Sstevel@tonic-gate <dependent 737c478bd9Sstevel@tonic-gate name='console-login' 747c478bd9Sstevel@tonic-gate grouping='optional_all' 757c478bd9Sstevel@tonic-gate restart_on='none'> 767c478bd9Sstevel@tonic-gate <service_fmri value='svc:/system/console-login'/> 777c478bd9Sstevel@tonic-gate </dependent> 787c478bd9Sstevel@tonic-gate 797c478bd9Sstevel@tonic-gate <exec_method 807c478bd9Sstevel@tonic-gate type='method' 817c478bd9Sstevel@tonic-gate name='start' 827c478bd9Sstevel@tonic-gate exec='/lib/svc/method/svc-auditd' 8397a81520SMarek Pospisil timeout_seconds='60'> 847c478bd9Sstevel@tonic-gate <method_context> 857c478bd9Sstevel@tonic-gate <method_credential user='root' group='root' /> 867c478bd9Sstevel@tonic-gate </method_context> 877c478bd9Sstevel@tonic-gate </exec_method> 887c478bd9Sstevel@tonic-gate 897c478bd9Sstevel@tonic-gate <exec_method 907c478bd9Sstevel@tonic-gate type='method' 917c478bd9Sstevel@tonic-gate name='refresh' 928523fda3SJan Friedel exec='/lib/svc/method/svc-auditd' 937c478bd9Sstevel@tonic-gate timeout_seconds='30'> 947c478bd9Sstevel@tonic-gate <method_context> 957c478bd9Sstevel@tonic-gate <method_credential user='root' group='root' /> 967c478bd9Sstevel@tonic-gate </method_context> 977c478bd9Sstevel@tonic-gate </exec_method> 987c478bd9Sstevel@tonic-gate 997c478bd9Sstevel@tonic-gate <!-- 1008523fda3SJan Friedel auditd waits for c2audit to quiet down after catching a -TERM 1018523fda3SJan Friedel before exiting; auditd's timeout is 20 seconds 1027c478bd9Sstevel@tonic-gate --> 1037c478bd9Sstevel@tonic-gate 1047c478bd9Sstevel@tonic-gate <exec_method 1057c478bd9Sstevel@tonic-gate type='method' 1067c478bd9Sstevel@tonic-gate name='stop' 1077c478bd9Sstevel@tonic-gate exec=':kill -TERM' 1087c478bd9Sstevel@tonic-gate timeout_seconds='30'> 1097c478bd9Sstevel@tonic-gate <method_context> 1107c478bd9Sstevel@tonic-gate <method_credential user='root' group='root' /> 1117c478bd9Sstevel@tonic-gate </method_context> 1127c478bd9Sstevel@tonic-gate </exec_method> 1137c478bd9Sstevel@tonic-gate 1147c478bd9Sstevel@tonic-gate <!-- SIGs HUP, TERM, and USR1 are all expected by auditd --> 1157c478bd9Sstevel@tonic-gate <property_group name='startd' type='framework'> 1167c478bd9Sstevel@tonic-gate <propval name='ignore_error' type='astring' 1177c478bd9Sstevel@tonic-gate value='core,signal' /> 1187c478bd9Sstevel@tonic-gate </property_group> 1197c478bd9Sstevel@tonic-gate 1207c478bd9Sstevel@tonic-gate <property_group name='general' type='framework'> 1218523fda3SJan Friedel <!-- to start/stop auditd --> 1227c478bd9Sstevel@tonic-gate <propval name='action_authorization' type='astring' 123f8994074SJan Friedel value='solaris.smf.manage.audit' /> 12416f0fd39SJan Friedel <propval name='value_authorization' type='astring' 125f8994074SJan Friedel value='solaris.smf.manage.audit' /> 1267c478bd9Sstevel@tonic-gate </property_group> 1277c478bd9Sstevel@tonic-gate 1288523fda3SJan Friedel <instance name='default' enabled='false'> 1298523fda3SJan Friedel 1308523fda3SJan Friedel <!-- 131f8994074SJan Friedel System-wide audit preselection flags - see auditconfig(1M) 132f8994074SJan Friedel and audit_flags(5). 133f8994074SJan Friedel 134f8994074SJan Friedel The 'flags' property is the system-wide default set of 135f8994074SJan Friedel audit classes that is combined with the per-user audit 136f8994074SJan Friedel flags to configure the process audit at login and role 137f8994074SJan Friedel assumption time. 138f8994074SJan Friedel 139f8994074SJan Friedel The 'naflags' property is the set of audit classes for 140f8994074SJan Friedel audit event selection when an event cannot be attributed 141f8994074SJan Friedel to an authenticated user. 142f8994074SJan Friedel --> 143f8994074SJan Friedel <property_group name='preselection' type='application'> 144f8994074SJan Friedel <propval name='flags' type='astring' 145f8994074SJan Friedel value='lo' /> 146f8994074SJan Friedel <propval name='naflags' type='astring' 147f8994074SJan Friedel value='lo' /> 148f8994074SJan Friedel <propval name='read_authorization' type='astring' 149f8994074SJan Friedel value='solaris.smf.value.audit' /> 150f8994074SJan Friedel <propval name='value_authorization' type='astring' 151f8994074SJan Friedel value='solaris.smf.value.audit' /> 152f8994074SJan Friedel </property_group> 153f8994074SJan Friedel 154f8994074SJan Friedel <!-- 1558523fda3SJan Friedel Audit Queue Control Properties - see auditconfig(1M) 1568523fda3SJan Friedel 1578523fda3SJan Friedel Note, that the default value for all the queue control 1588523fda3SJan Friedel configuration parameters is 0, which makes auditd(1M) to 1598523fda3SJan Friedel use current active system parameters. 1608523fda3SJan Friedel --> 1618523fda3SJan Friedel <property_group name='queuectrl' type='application' > 1628523fda3SJan Friedel <propval name='qbufsz' type='count' 1638523fda3SJan Friedel value='0' /> 1648523fda3SJan Friedel <propval name='qdelay' type='count' 1658523fda3SJan Friedel value='0' /> 1668523fda3SJan Friedel <propval name='qhiwater' type='count' 1678523fda3SJan Friedel value='0' /> 1688523fda3SJan Friedel <propval name='qlowater' type='count' 1698523fda3SJan Friedel value='0' /> 1708523fda3SJan Friedel <propval name='read_authorization' type='astring' 171f8994074SJan Friedel value='solaris.smf.value.audit' /> 172f8994074SJan Friedel <propval name='value_authorization' type='astring' 173f8994074SJan Friedel value='solaris.smf.value.audit' /> 1748523fda3SJan Friedel </property_group> 1758523fda3SJan Friedel 1768523fda3SJan Friedel <!-- 1778523fda3SJan Friedel Audit Policies - see auditconfig(1M) 1788523fda3SJan Friedel 1798523fda3SJan Friedel Note, that "all" and "none" policies available as a 1808523fda3SJan Friedel auditconfig(1M) policy flags actually means a full/empty set 1818523fda3SJan Friedel of other policy flags. Thus they are not configurable in the 1828523fda3SJan Friedel auditd service manifest, but set all the policies to true 1838523fda3SJan Friedel (all) or false (none). 1848523fda3SJan Friedel --> 1858523fda3SJan Friedel <property_group name='policy' type='application' > 1868523fda3SJan Friedel <propval name='ahlt' type='boolean' 1878523fda3SJan Friedel value='false' /> 1888523fda3SJan Friedel <propval name='arge' type='boolean' 1898523fda3SJan Friedel value='false' /> 1908523fda3SJan Friedel <propval name='argv' type='boolean' 1918523fda3SJan Friedel value='false' /> 1928523fda3SJan Friedel <propval name='cnt' type='boolean' 1938523fda3SJan Friedel value='true' /> 1948523fda3SJan Friedel <propval name='group' type='boolean' 1958523fda3SJan Friedel value='false' /> 1968523fda3SJan Friedel <propval name='path' type='boolean' 1978523fda3SJan Friedel value='false' /> 1988523fda3SJan Friedel <propval name='perzone' type='boolean' 1998523fda3SJan Friedel value='false' /> 2008523fda3SJan Friedel <propval name='public' type='boolean' 2018523fda3SJan Friedel value='false' /> 2028523fda3SJan Friedel <propval name='seq' type='boolean' 2038523fda3SJan Friedel value='false' /> 2048523fda3SJan Friedel <propval name='trail' type='boolean' 2058523fda3SJan Friedel value='false' /> 2068523fda3SJan Friedel <propval name='windata_down' type='boolean' 2078523fda3SJan Friedel value='false' /> 2088523fda3SJan Friedel <propval name='windata_up' type='boolean' 2098523fda3SJan Friedel value='false' /> 2108523fda3SJan Friedel <propval name='zonename' type='boolean' 2118523fda3SJan Friedel value='false' /> 2128523fda3SJan Friedel <propval name='read_authorization' type='astring' 213f8994074SJan Friedel value='solaris.smf.value.audit' /> 214f8994074SJan Friedel <propval name='value_authorization' type='astring' 215f8994074SJan Friedel value='solaris.smf.value.audit' /> 216f8994074SJan Friedel </property_group> 217f8994074SJan Friedel 218f8994074SJan Friedel <!-- 219f8994074SJan Friedel Plugins to configure where to send the audit trail - see 220f8994074SJan Friedel auditconfig(1M), audit_binfile(5), audit_remote(5), 221f8994074SJan Friedel audit_syslog(5) 222f8994074SJan Friedel 223f8994074SJan Friedel Each plugin type property group has properties: 224f8994074SJan Friedel 225f8994074SJan Friedel 'active' is a boolean which defines whether or not 226f8994074SJan Friedel to load the plugin. 227f8994074SJan Friedel 228f8994074SJan Friedel 'path' is a string which defines name of the 229f8994074SJan Friedel plugin's shared object in the file system. 230f8994074SJan Friedel Relative paths assume a prefix of 231f8994074SJan Friedel "/usr/lib/security/$ISA" 232f8994074SJan Friedel 233f8994074SJan Friedel 'qsize' is an integer which defines a plugin specific 234f8994074SJan Friedel maximum number of records that auditd will queue 235f8994074SJan Friedel for it. A zero (0) value indicates not defined. 236f8994074SJan Friedel This overrides the system's active queue control 237f8994074SJan Friedel hiwater mark. 238f8994074SJan Friedel 239f8994074SJan Friedel and various attributes as defined on the plugin's man page 240f8994074SJan Friedel --> 241f8994074SJan Friedel <property_group name='audit_binfile' type='plugin' > 242f8994074SJan Friedel <propval name='active' type='boolean' 243f8994074SJan Friedel value='true' /> 244f8994074SJan Friedel <propval name='path' type='astring' 245f8994074SJan Friedel value='audit_binfile.so' /> 246f8994074SJan Friedel <propval name='qsize' type='count' 247f8994074SJan Friedel value='0' /> 248f8994074SJan Friedel <propval name='p_dir' type='astring' 249f8994074SJan Friedel value='/var/audit' /> 250f8994074SJan Friedel <propval name='p_minfree' type='count' 251f8994074SJan Friedel value='0' /> 252f8994074SJan Friedel <propval name='p_fsize' type='count' 253f8994074SJan Friedel value='0' /> 254f8994074SJan Friedel <property name='read_authorization' type='astring'> 255f8994074SJan Friedel <astring_list> 256f8994074SJan Friedel <value_node value='solaris.smf.manage.audit' /> 257f8994074SJan Friedel <value_node value='solaris.smf.value.audit' /> 258f8994074SJan Friedel </astring_list> 259f8994074SJan Friedel </property> 260f8994074SJan Friedel <propval name='value_authorization' type='astring' 261f8994074SJan Friedel value='solaris.smf.value.audit' /> 262f8994074SJan Friedel </property_group> 263f8994074SJan Friedel 264f8994074SJan Friedel <property_group name='audit_syslog' type='plugin' > 265f8994074SJan Friedel <propval name='active' type='boolean' 266f8994074SJan Friedel value='false' /> 267f8994074SJan Friedel <propval name='path' type='astring' 268f8994074SJan Friedel value='audit_syslog.so' /> 269f8994074SJan Friedel <propval name='qsize' type='count' 270f8994074SJan Friedel value='0' /> 271f8994074SJan Friedel <propval name='p_flags' type='astring' 272f8994074SJan Friedel value='' /> 273f8994074SJan Friedel <property name='read_authorization' type='astring'> 274f8994074SJan Friedel <astring_list> 275f8994074SJan Friedel <value_node value='solaris.smf.manage.audit' /> 276f8994074SJan Friedel <value_node value='solaris.smf.value.audit' /> 277f8994074SJan Friedel </astring_list> 278f8994074SJan Friedel </property> 279f8994074SJan Friedel <propval name='value_authorization' type='astring' 280f8994074SJan Friedel value='solaris.smf.value.audit' /> 281f8994074SJan Friedel </property_group> 282f8994074SJan Friedel 283f8994074SJan Friedel <property_group name='audit_remote' type='plugin' > 284f8994074SJan Friedel <propval name='active' type='boolean' 285f8994074SJan Friedel value='false' /> 286f8994074SJan Friedel <propval name='path' type='astring' 287f8994074SJan Friedel value='audit_remote.so' /> 288f8994074SJan Friedel <propval name='qsize' type='count' 289f8994074SJan Friedel value='0' /> 290f8994074SJan Friedel <propval name='p_hosts' type='astring' 291f8994074SJan Friedel value='' /> 292f8994074SJan Friedel <propval name='p_retries' type='count' 293f8994074SJan Friedel value='3' /> 294f8994074SJan Friedel <propval name='p_timeout' type='count' 295f8994074SJan Friedel value='5' /> 296f8994074SJan Friedel <property name='read_authorization' type='astring'> 297f8994074SJan Friedel <astring_list> 298f8994074SJan Friedel <value_node value='solaris.smf.manage.audit' /> 299f8994074SJan Friedel <value_node value='solaris.smf.value.audit' /> 300f8994074SJan Friedel </astring_list> 301f8994074SJan Friedel </property> 302f8994074SJan Friedel <propval name='value_authorization' type='astring' 303f8994074SJan Friedel value='solaris.smf.value.audit' /> 3048523fda3SJan Friedel </property_group> 3058523fda3SJan Friedel 3068523fda3SJan Friedel </instance> 3077c478bd9Sstevel@tonic-gate 3087c478bd9Sstevel@tonic-gate <stability value='Evolving' /> 3097c478bd9Sstevel@tonic-gate 3107c478bd9Sstevel@tonic-gate <template> 3117c478bd9Sstevel@tonic-gate <common_name> 3127c478bd9Sstevel@tonic-gate <loctext xml:lang='C'> 313*772eca33SJason King audit daemon 3147c478bd9Sstevel@tonic-gate </loctext> 3157c478bd9Sstevel@tonic-gate </common_name> 3167c478bd9Sstevel@tonic-gate <documentation> 3177c478bd9Sstevel@tonic-gate <manpage title='auditd' 3187c478bd9Sstevel@tonic-gate section='1M' 3197c478bd9Sstevel@tonic-gate manpath='/usr/share/man'/> 3207c478bd9Sstevel@tonic-gate <manpage title='audit' 3217c478bd9Sstevel@tonic-gate section='1M' 3227c478bd9Sstevel@tonic-gate manpath='/usr/share/man'/> 3238523fda3SJan Friedel <manpage title='auditconfig' 3248523fda3SJan Friedel section='1M' 3258523fda3SJan Friedel manpath='/usr/share/man'/> 326f8994074SJan Friedel <manpage title='audit_flags' 327f8994074SJan Friedel section='5' 328f8994074SJan Friedel manpath='/usr/share/man'/> 329f8994074SJan Friedel <manpage title='audit_binfile' 330f8994074SJan Friedel section='5' 331f8994074SJan Friedel manpath='/usr/share/man'/> 332f8994074SJan Friedel <manpage title='audit_syslog' 333f8994074SJan Friedel section='5' 334f8994074SJan Friedel manpath='/usr/share/man'/> 335f8994074SJan Friedel <manpage title='audit_remote' 336f8994074SJan Friedel section='5' 337f8994074SJan Friedel manpath='/usr/share/man'/> 3387c478bd9Sstevel@tonic-gate </documentation> 3397c478bd9Sstevel@tonic-gate </template> 3407c478bd9Sstevel@tonic-gate 3417c478bd9Sstevel@tonic-gate</service> 3427c478bd9Sstevel@tonic-gate 3437c478bd9Sstevel@tonic-gate</service_bundle> 344