xref: /illumos-gate/usr/src/lib/libbsm/common/adt.xml (revision 3893cb7fe5bfa1c9a4f7954517a917367f6cf081)
1<?xml version="1.0" standalone="yes"?>
2<!DOCTYPE specification SYSTEM "audit.dtd">
3<!--
4 CDDL HEADER START
5
6 The contents of this file are subject to the terms of the
7 Common Development and Distribution License (the "License").
8 You may not use this file except in compliance with the License.
9
10 You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
11 or http://www.opensolaris.org/os/licensing.
12 See the License for the specific language governing permissions
13 and limitations under the License.
14
15 When distributing Covered Code, include this CDDL HEADER in each
16 file and include the License file at usr/src/OPENSOLARIS.LICENSE.
17 If applicable, add the following below this CDDL HEADER, with the
18 fields enclosed by brackets "[]" replaced with your own identifying
19 information: Portions Copyright [yyyy] [name of copyright owner]
20
21 CDDL HEADER END
22
23Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
24Use is subject to license terms.
25
26  ident	"%Z%%M%	%I%	%E% SMI"
27-->
28
29<specification>
30
31<!-- comments are displayed to stderr if debug is on -->
32<debug set="off"/>
33
34    <!-- The order of events is arbitrary EXCEPT generic events must
35	 precede their instances -->
36       <!-- The order of entries within an event determine the order
37            data is defined in the external API -->
38	    <!-- The order of internal / external is arbitrary -->
39
40<!--
41	tags:
42			The following top level tags are defined:
43			<event> <token> <msg_list> <debug>
44
45	event		defines an audit record
46			- id is the record id from audit_uevents.h
47			- reorder="yes" or "no".  (default is "no").
48			  if "yes" then the order of the tokens to be
49			  output does not match the order of the data
50			  input.  (see order attribute of <entry>)
51			- header defines the header file to contain the external
52			  definitions for this event type.  The header file
53			  name is adt_event_N.h, where N is the value supplied
54			  header="0" is for "stable" events, > 0 for new ones.
55			  with this attribute. (header="1").
56			- idNo is the number associated with the external
57			  name of this event. (For AUE_login, ADT_login is
58			  the external name and idNo is the value for
59			  ADT_login.)
60			- omit is by default 'no' (i.e., don't omit) and can be
61			  'always' or 'JNI'.  In the latter case, C interface
62			  code is generated but neither Java nor JNI code is.
63			- included text is just a comment
64			Within an event block, the following tags are defined:
65			<entry>, <debug>, <altname>
66
67	altname		defines the internal name of an audit record; if
68			omitted, the internal name is the same as the
69			external name.
70
71	entry		defines the correspondence between the data
72			supplied by the caller and the token to be
73			output.
74			- id is the data name that shows up in the structures
75			  of adt_event.h  If it is a comma separated list,
76			  it is the list of names of data to be associated
77			  with one output token.  (See <external>, below)
78			Within an entry block, the following tags are defined:
79			<internal>, <external>, <debug>
80
81	internal	defines the token to be generated.
82			- token is a name that must also be defined with
83			  a <token> tag elsewhere in this file.  (order is
84			  not important).
85			- order="some number" determines the order of the
86			  tokens to be output, starting with 1.  The subject
87			  token is normally order="1".  The use is to insure
88			  that the order of fields listed in adt_event.h does
89			  not change when we arbitrarily change the order of
90			  tokens.  If the <event reorder="yes"> is not set,
91			  order is ignored.
92			- format is a printf-like string that will be used
93			  in to format the data supplied by the user.
94
95	external	defines the data to be supplied for creating the
96			token defined via <internal>
97			- opt is one of four values:  "required", "optional",
98			  "obsolete", or "none".  The first two values
99			  indicate that this token's data must or may
100			  be supplied by the user; the third value is
101			  equivalent to "optional" but shows in the
102			  comment that this field is no longer used;
103			  the forth value indicates that this token
104			  does not require any user-supplied data.  If
105			  data is required, then a token is always
106			  output, while optional data is output only
107			  if data is supplied.
108			- type describes the C data type to be associated
109			  with the <entry id="dataName">.  The following
110			  data types are representative:
111
112				au_asid_t (uint32_t)
113				char
114				char * (blank is optional)
115				char ** (blank is optional)
116				uint_t, int, int32_t, uid_t, gid_t
117				uid_t *, gid_t *
118				long, ulong_t
119				m_label_t *
120				pid_t
121				priv_set_t *
122				uint16_t, unit32_t, uint64_t
123				uint32_t *, uint32_t[], uint64_t *
124				msg  (not a C type, see below)
125
126			Below is what Tony said.  Above seems to be
127			what is implemented
128				char
129				char * (blank is optional)
130				char ** (blank is optional)
131				int, uid_t, gid_t
132				int *, uid_t *, gid_t *
133				msg  (not a C type, see below)
134				time_t
135				uint, uint *
136
137			  The msg type refers to an enumerated type
138			  that must be defined via a <msg> description
139			  else where in this file. The syntax is
140			  special.  Example: <external opt="optional"
141			  type="msg login_text"/> "login_text" is the
142			  id of a <msg_list> descriptor given
143			  elsewhere in this file.
144
145			If the <entry> id is a list, the type must also
146			be a comma-separated list, where the types are
147			in the same order as the id's.
148			If the type is an array, its length must be given
149			explicitly.
150
151	token		Define allowed token names.
152			- id is the name of token; this name is used
153			as an <internal> id.
154			- usage is an optional value.  At present, only
155			  "TSOL" is defined; it means that this data is
156			  to be used only in Trusted Solaris implementations.
157
158	msg_list	Define a set of text strings.
159			- id is the name to be used for this group of text
160			  strings in adt_event.h
161			- header is as defined for <event>
162			Within a msg_list block, <msg> and <debug> are defined.
163			The order of <msg> tags in a msg_list is reflected
164			directly in adt_event.h
165
166	msg		Define one string.
167			- id is the name to be used in the enum describing
168			  this set of strings.  Convention:  use upper case.
169			The content (text between <msg> and </msg>) is the
170			actual string.  Extra white space, including line
171			feeds, is ignored.  If empty, no output token
172			is generated unless the <external> opt attribute is
173			set to "required", in which case a blank text token
174			is generated.
175			Within a msg block, <debug> is defined, but has not been
176			tested and may have no effect.
177
178	debug		This turns on/off debug messages during the processing
179			of the xml data.  It affects the block within which it
180			is defined.
181			- set may have one of two values:  "on" or "off".  If
182			  set is omitted, the debug state for the current block
183			  is toggled.
184			The use of the <debug> tag does not affect the output
185			of data to the various files created, but does generate
186			potentially large amounts of output to stderr.
187
188-->
189<!--        template for an event record definition
190
191    <event id="" header="0" idNo="">
192	<entry id="subject">
193	    <internal token="subject"/>
194	    <external opt="none"/>
195	</entry>
196	<entry id="">
197	    <internal token=""/>
198	    <external opt="" type="" />
199	</entry>
200	<entry id="return">
201	    <internal token="return"/>
202	    <external opt="none"/>
203	</entry>
204    </event>
205
206    Generic events must precede Instance events; within each
207    group, please group the AUE_* by area and event idNo-s in order,
208    gaps in idNo-s are OK.
209    N.B. Renumbering idNo-s requires recompilation of consumers.  See
210    the contracts for whom to notify if/when this happens.
211-->
212
213<!-- generic events  -->
214
215    <!--
216	'omit="always"' means that this record type is not reflected
217	in the generated header and table files.
218     -->
219
220    <event id="AUE_generic_basic" type="generic" omit="always">
221	<!--
222
223	This is a template for the event types that have no tokens
224	other than the header and return. There is no allowed_type
225	list because the template is not externally visible due to the
226	omit="always".
227
228	-->
229	<entry id="subject">
230	    <internal token="subject"/>
231	    <external opt="none"/>
232	</entry>
233	<entry id="return">
234	    <internal token="return"/>
235	    <external opt="none"/>
236	</entry>
237    </event>
238
239    <event id="AUE_generic_login" type="generic" omit="always">
240	<!--
241
242	This is a template for the various login event types
243	AUE_login, AUE_ftp, etc which match this template.  There is
244	no allowed_type list because the template is not externally
245	visible due to the omit="always".
246
247	-->
248	<entry id="subject">
249	    <internal token="subject"/>
250	    <external opt="none"/>
251	</entry>
252
253	<!--	This field is still in use for SMC until it is cleaned up,
254		it must remain, see login_text msg list at the end of the
255		file.
256	-->
257	<entry id="message">
258	    <internal token="text"/>
259	    <external opt="optional" type="msg login_text"/>
260	    <comment>error message</comment>
261	</entry>
262	<entry id="return">
263	    <internal token="return"/>
264	    <external opt="none"/>
265	</entry>
266    </event>
267
268<!-- generic SMC events  -->
269
270    <event id="AUE_generic_SMC_add" type="generic" omit="always">
271	<entry id="subject">
272	    <internal token="subject"/>
273	    <external opt="none"/>
274	</entry>
275	<entry id="object_name">
276	    <internal token="text"/>
277	    <external opt="required" type="char *"/>
278	    <comment>object name</comment>
279	</entry>
280	<entry id="domain">
281	    <internal token="text"/>
282	    <external opt="optional" type="char *"/>
283	    <comment>domain</comment>
284	</entry>
285	<entry id="name_service">
286	    <internal token="text"/>
287	    <external opt="required" type="char *"/>
288	    <comment>name_service</comment>
289	</entry>
290	<entry id="auth_used">
291	    <internal token="uauth"/>
292	    <external opt="optional" type="char *"/>
293	    <comment>authorization used</comment>
294	</entry>
295	<!--
296	  This should really be its own token type, not "text"
297	-->
298	<entry id="initial_values">
299	    <internal token="text"/>
300	    <external opt="required" type="char *"/>
301	    <comment>initial values</comment>
302	</entry>
303	<entry id="return">
304	    <internal token="return"/>
305	    <external opt="none"/>
306	</entry>
307    </event>
308
309    <event id="AUE_generic_SMC_delete" type="generic" omit="always">
310	<entry id="subject">
311	    <internal token="subject"/>
312	    <external opt="none"/>
313	</entry>
314	<entry id="object_name">
315	    <internal token="text"/>
316	    <external opt="required" type="char *"/>
317	    <comment>object name</comment>
318	</entry>
319	<entry id="domain">
320	    <internal token="text"/>
321	    <external opt="optional" type="char *"/>
322	    <comment>domain</comment>
323	</entry>
324	<entry id="name_service">
325	    <internal token="text"/>
326	    <external opt="required" type="char *"/>
327	    <comment>name_service</comment>
328	</entry>
329	<entry id="auth_used">
330	    <internal token="uauth"/>
331	    <external opt="optional" type="char *"/>
332	    <comment>authorization used</comment>
333	</entry>
334	<entry id="delete_values">
335	    <internal token="text"/>
336	    <external opt="required" type="char *"/>
337	    <comment>deleted values</comment>
338	</entry>
339	<entry id="return">
340	    <internal token="return"/>
341	    <external opt="none"/>
342	</entry>
343    </event>
344
345    <event id="AUE_generic_SMC_modify" type="generic" omit="always">
346	<entry id="subject">
347	    <internal token="subject"/>
348	    <external opt="none"/>
349	</entry>
350	<entry id="object_name">
351	    <internal token="text"/>
352	    <external opt="required" type="char *"/>
353	    <comment>object name</comment>
354	</entry>
355	<entry id="domain">
356	    <internal token="text"/>
357	    <external opt="optional" type="char *"/>
358	    <comment>domain</comment>
359	</entry>
360	<entry id="name_service">
361	    <internal token="text"/>
362	    <external opt="required" type="char *"/>
363	    <comment>name_service</comment>
364	</entry>
365	<entry id="auth_used">
366	    <internal token="uauth"/>
367	    <external opt="optional" type="char *"/>
368	    <comment>authorization used</comment>
369	</entry>
370	<entry id="changed_values">
371	    <internal token="text"/>
372	    <external opt="required" type="char *"/>
373	    <comment>changed values</comment>
374	</entry>
375	<entry id="return">
376	    <internal token="return"/>
377	    <external opt="none"/>
378	</entry>
379    </event>
380
381<!-- instances -->
382
383<!--
384	Java needed for SMC events.  Since the SMC events grow less
385	often than the C related events.  They come first.  It
386	would be nice to reorder the idNo-s, but that's an ABI
387	change and should rev libbsm version no.  If reordered
388	start with 1 and eliminate the comment at the end about
389	the highest idNo.
390-->
391    <event id="AUE_admin_authenticate" instance_of="AUE_generic_login"
392	header="0" idNo="3">
393	<title>Admin Server Authentication</title>
394	<program>admin (various)</program>
395	<see>SMC, WBEM, or AdminSuite</see>
396    </event>
397
398    <event id="AUE_filesystem_add" instance_of="AUE_generic_SMC_add"
399	header="0" idNo="4">
400	<title>SMC: filesystem add</title>
401	<program>SMC server</program>
402    </event>
403    <event id="AUE_filesystem_delete" instance_of="AUE_generic_SMC_delete"
404	header="0" idNo="5">
405	<title>SMC: filesystem delete</title>
406	<program>SMC server</program>
407    </event>
408    <event id="AUE_filesystem_modify" instance_of="AUE_generic_SMC_modify"
409	header="0" idNo="6">
410	<title>SMC: filesystem modify</title>
411	<program>SMC server</program>
412    </event>
413
414    <event id="AUE_network_add" instance_of="AUE_generic_SMC_add"
415	header="0" idNo="7">
416	<title>SMC: network add</title>
417	<program>SMC server</program>
418    </event>
419    <event id="AUE_network_delete" instance_of="AUE_generic_SMC_delete"
420	header="0" idNo="8">
421	<title>SMC: network delete</title>
422	<program>SMC server</program>
423    </event>
424    <event id="AUE_network_modify" instance_of="AUE_generic_SMC_modify"
425	header="0" idNo="9">
426	<title>SMC: network modify</title>
427	<program>SMC server</program>
428    </event>
429
430    <event id="AUE_printer_add" instance_of="AUE_generic_SMC_add"
431	header="0" idNo="10">
432	<title>SMC: printer add</title>
433	<program>SMC server</program>
434    </event>
435    <event id="AUE_printer_delete" instance_of="AUE_generic_SMC_delete"
436	header="0" idNo="11">
437	<title>SMC: printer delete</title>
438	<program>SMC server</program>
439    </event>
440    <event id="AUE_printer_modify" instance_of="AUE_generic_SMC_modify"
441	header="0" idNo="12">
442	<title>SMC: printer modify</title>
443	<program>SMC server</program>
444    </event>
445
446<!--
447	This is SMC; it's also used in su and should probably be used in
448	desktop role login.  If we fix the SMC to not record NO_MSG here,
449	we can fix to record failed user.  See su.c and AUE_su.
450-->
451    <event id="AUE_role_login" instance_of="AUE_generic_login"
452	header="0" idNo="13">
453	<title>RBAC: role login</title>
454	<program>SMC server</program>
455	<program>/usr/bin/su</program>
456    </event>
457
458    <event id="AUE_scheduledjob_add" instance_of="AUE_generic_SMC_add"
459	header="0" idNo="14">
460	<title>SMC: scheduled job add</title>
461	<program>SMC server</program>
462    </event>
463    <event id="AUE_scheduledjob_delete" instance_of="AUE_generic_SMC_delete"
464	header="0" idNo="15">
465	<title>SMC: scheduled job delete</title>
466	<program>SMC server</program>
467    </event>
468    <event id="AUE_scheduledjob_modify" instance_of="AUE_generic_SMC_modify"
469	header="0" idNo="16">
470	<title>SMC: scheduled job modify</title>
471	<program>SMC server</program>
472    </event>
473
474    <event id="AUE_serialport_add" instance_of="AUE_generic_SMC_add"
475	header="0" idNo="17">
476	<title>SMC: serial port add</title>
477	<program>SMC server</program>
478    </event>
479    <event id="AUE_serialport_delete" instance_of="AUE_generic_SMC_delete"
480	header="0" idNo="18">
481	<title>SMC: serial port delete</title>
482	<program>SMC server</program>
483    </event>
484    <event id="AUE_serialport_modify" instance_of="AUE_generic_SMC_modify"
485	header="0" idNo="19">
486	<title>SMC: serial port modify</title>
487	<program>SMC server</program>
488    </event>
489
490<!-- This is SMC; should this also be used elsewhere? -->
491    <event id="AUE_uauth" header="0" idNo="20">
492    	<title>SMC: Use of Authorization</title>
493	<program>SMC server</program>
494	<entry id="subject">
495	    <internal token="subject"/>
496	    <external opt="none"/>
497	</entry>
498	<entry id="auth_used">
499	    <internal token="uauth"/>
500	    <external opt="required" type="char *"/>
501	    <comment>authorization used</comment>
502	</entry>
503	<entry id="objectname">
504	    <internal token="text"/>
505	    <external opt="required" type="char *"/>
506	    <comment>object name</comment>
507	</entry>
508	<entry id="return">
509	    <internal token="return"/>
510	    <external opt="none"/>
511	</entry>
512    </event>
513
514    <event id="AUE_usermgr_add" instance_of="AUE_generic_SMC_add"
515	header="0" idNo="21">
516	<title>SMC: User Manager add</title>
517	<program>SMC server</program>
518    </event>
519    <event id="AUE_usermgr_delete" instance_of="AUE_generic_SMC_delete"
520	header="0" idNo="22">
521	<title>SMC: User Manager delete</title>
522	<program>SMC server</program>
523    </event>
524    <event id="AUE_usermgr_modify" instance_of="AUE_generic_SMC_modify"
525	header="0" idNo="23">
526	<title>SMC: User Manager modify</title>
527	<program>SMC server</program>
528    </event>
529<!-- end of Java needed for SMC events -->
530<!--
531    while not used by SMC logout is used by Lockhart
532-->
533    <event id="AUE_logout" header="0" idNo="1">
534    	<title>login: logout</title>
535	<program>various</program>
536	<see>login(1)</see>
537	<entry id="subject">
538	    <internal token="subject"/>
539	    <external opt="none"/>
540	</entry>
541<!--
542    not used by C code, used by Lockhart,
543    get them to change and remove
544    event.user_name("logout " + session.getUserName());
545    from /ws/lockhart-nv-gate/src/bundled/app/webmgt/lib/services/
546    com/sun/management/services/audit/SolarisAuditEvent_Logout.java
547-->
548	<entry id="user_name">
549	    <internal token="text" format="logout %s"/>
550	    <external opt="optional" type="char *"/>
551	    <comment>"logout" username</comment>
552	</entry>
553	<entry id="return">
554	    <internal token="return"/>
555	    <external opt="none"/>
556	</entry>
557    </event>
558
559
560<!-- C Only events -->
561    <event id="AUE_init_solaris" header="0" idNo="32" omit="JNI">
562    	<title>init</title>
563	<program>/sbin/init</program>
564	<program>/usr/sbin/init</program>
565	<program>/usr/sbin/shutdown</program>
566	<entry id="subject">
567	    <internal token="subject"/>
568	    <external opt="none"/>
569	</entry>
570	<entry id="info">
571	    <internal token="text"/>
572	    <external opt="optional" type="char *"/>
573	    <comment>init level or zone name</comment>
574	</entry>
575	<entry id="return">
576	    <internal token="return"/>
577	    <external opt="none"/>
578	</entry>
579    </event>
580
581    <event id="AUE_login" instance_of="AUE_generic_login" header="0"
582	idNo="25" omit="JNI">
583	<title>terminal login</title>
584	<program>/usr/sbin/login</program>
585	<program>/usr/dt/bin/dtlogin</program>
586	<see>login(1)</see>
587	<see>dtlogin</see>
588    </event>
589    <event id="AUE_rlogin" instance_of="AUE_generic_login" header="0"
590	idNo="28" omit="JNI">
591	<title>rlogin</title>
592	<program>/usr/sbin/login</program>
593	<see>login(1) - rlogin</see>
594    </event>
595    <event id="AUE_telnet" instance_of="AUE_generic_login" header="0"
596	idNo="29" omit="JNI">
597	<title>telnet login</title>
598	<program>/usr/sbin/login</program>
599	<see>login(1) - telnet</see>
600    </event>
601    <event id="AUE_ssh" instance_of="AUE_generic_login" header="0"
602	idNo="2" omit="JNI">
603	<program>/usr/lib/ssh/sshd</program>
604    </event>
605
606    <event id="AUE_zlogin" header="0" idNo="38" omit="JNI">
607    	<title>zone login</title>
608	<program>/usr/sbin/login</program>
609	<see>zlogin(1)</see>
610	<entry id="subject">
611	    <internal token="subject"/>
612	    <external opt="none"/>
613	</entry>
614	<entry id="message">
615	    <internal token="text"/>
616	    <external opt="optional" type="char *"/>
617	    <comment>error message</comment>
618	</entry>
619	<entry id="return">
620	    <internal token="return"/>
621	    <external opt="none"/>
622	</entry>
623    </event>
624
625    <event id="AUE_su" header="0" idNo="30" omit="JNI">
626    	<title>su</title>
627	<program>/usr/bin/su</program>
628	<see>su(1M)</see>
629	<entry id="subject">
630	    <internal token="subject"/>
631	    <external opt="none"/>
632	</entry>
633<!--
634	should be changed to "fail_user" and su.c updated
635	However, the jni stuff is broken, so for now it's "message"
636-->
637	<entry id="message">
638	    <internal token="text"/>
639	    <external opt="optional" type="char *"/>
640	    <comment>"user name" of failed new user/role</comment>
641	</entry>
642	<entry id="return">
643	    <internal token="return"/>
644	    <external opt="none"/>
645	</entry>
646    </event>
647
648    <event id="AUE_passwd" header="0" idNo="27" omit="JNI">
649    	<title>passwd</title>
650	<program>various</program>
651	<see>passwd(1)</see>
652	<entry id="subject">
653	    <internal token="subject"/>
654	    <external opt="none"/>
655	</entry>
656	<entry id="username">
657	    <internal token="text"/>
658	    <external opt="optional" type="char *"/>
659	    <comment>success/fail message</comment>
660	</entry>
661	<entry id="return">
662	    <internal token="return"/>
663	    <external opt="none"/>
664	</entry>
665    </event>
666
667    <event id="AUE_screenlock" instance_of="AUE_generic_basic" header="0"
668	idNo="26" omit="JNI">
669	<program>desktop screen lock</program>
670    </event>
671    <event id="AUE_screenunlock" instance_of="AUE_generic_basic" header="0"
672	idNo="31" omit="JNI">
673	<program>desktop screen unlock</program>
674    </event>
675
676    <!--
677	AUE_prof_cmd is not supportable for Java due to the structure of
678	the priv token.  When and if a Java program needs to generate
679	a priv token, we'll need to look at the data format in the
680	Java code and provide an appropriate java and jni implementation.
681    -->
682
683    <event id="AUE_prof_cmd" header="0" idNo="24" omit="JNI">
684    	<title>pfexec</title>
685	<program>/usr/bin/pfexec</program>
686	<see>pfexec(1)</see>
687	<entry id="subject">
688	    <internal token="subject"/>
689	    <external opt="none"/>
690	</entry>
691	<entry id="cwdpath">
692	    <internal token="path"/>
693	    <external opt="required" type="char*"/>
694	    <comment>working directory</comment>
695	</entry>
696	<entry id="cmdpath">
697	    <internal token="path"/>
698	    <external opt="required" type="char*"/>
699	    <comment>command pathname</comment>
700	</entry>
701	<entry id="argc,argv,envp">
702	    <internal token="command"/>
703	    <external opt="required" type="int,char**,char**"/>
704	</entry>
705	<entry id="proc_auid,proc_euid,proc_egid,proc_ruid,proc_rgid,proc_pid,proc_sid,proc_termid">
706	    <internal token="process"/>
707	    <external opt="required"
708		type="uid_t,uid_t,gid_t,uid_t,gid_t,pid_t,au_asid_t,termid*"/>
709	</entry>
710	<entry id="limit_set">
711	    <internal token="priv_limit"/>
712	    <external opt="optional" type="priv_set_t*"/>
713 	</entry>
714	<entry id="inherit_set">
715	    <internal token="priv_inherit"/>
716	    <external opt="optional" type="priv_set_t*"/>
717	</entry>
718	<entry id="return">
719	    <internal token="return"/>
720	    <external opt="none"/>
721	</entry>
722    </event>
723
724    <event id="AUE_inetd_connect" header="0" idNo="34" omit="JNI">
725    	<title>inetd</title>
726	<program>/usr/sbin/inetd</program>
727	<entry id="subject">
728	    <internal token="subject"/>
729	    <external opt="none"/>
730	</entry>
731	<entry id="service_name">
732	    <internal token="text"/>
733	    <external opt="optional" type="char *"/>
734	    <comment>service name</comment>
735	</entry>
736	<entry id="ip_type,ip_remote_port,ip_local_port,ip_adr">
737	    <internal token="tid"/>
738	    <external opt="required"
739		type="uint32_t,uint16_t,uint16_t,uint32_t[4]"/>
740	    <comment>client address</comment>
741	</entry>
742	<entry id="cmd">
743	    <internal token="command_1"/>
744	    <external opt="required" type="char *"/>
745	    <comment>inetd command</comment>
746	</entry>
747	<entry id="privileges">
748	    <internal token="priv_effective"/>
749	    <external opt="required" type="priv_set_t *"/>
750	</entry>
751	<entry id="return">
752	    <internal token="return"/>
753	    <external opt="none"/>
754	</entry>
755    </event>
756
757    <event id="AUE_inetd_ratelimit" header="0" idNo="35" omit="JNI">
758    	<title>inetd</title>
759	<program>/usr/sbin/inetd</program>
760	<entry id="subject">
761	    <internal token="subject"/>
762	    <external opt="none"/>
763	</entry>
764	<entry id="service_name">
765	    <internal token="text"/>
766	    <external opt="optional" type="char *"/>
767	    <comment>service name</comment>
768	</entry>
769	<entry id="limit">
770	    <internal token="text"/>
771	    <external opt="required" type="char *"/>
772	    <comment>limit value</comment>
773	</entry>
774	<entry id="return">
775	    <internal token="return"/>
776	    <external opt="none"/>
777	</entry>
778    </event>
779
780    <event id="AUE_inetd_copylimit" header="0" idNo="36" omit="JNI">
781    	<title>inetd</title>
782	<program>/usr/sbin/inetd</program>
783	<entry id="subject">
784	    <internal token="subject"/>
785	    <external opt="none"/>
786	</entry>
787	<entry id="service_name">
788	    <internal token="text"/>
789	    <external opt="optional" type="char *"/>
790	    <comment>service name</comment>
791	</entry>
792	<entry id="limit">
793	    <internal token="text"/>
794	    <external opt="required" type="char *"/>
795	    <comment>limit value</comment>
796	</entry>
797	<entry id="return">
798	    <internal token="return"/>
799	    <external opt="none"/>
800	</entry>
801    </event>
802
803    <event id="AUE_inetd_failrate" header="0" idNo="37" omit="JNI">
804    	<title>inetd</title>
805	<program>/usr/sbin/inetd</program>
806	<entry id="subject">
807	    <internal token="subject"/>
808	    <external opt="none"/>
809	</entry>
810	<entry id="service_name">
811	    <internal token="text"/>
812	    <external opt="optional" type="char *"/>
813	    <comment>service name</comment>
814	</entry>
815	<entry id="values">
816	    <internal token="text"/>
817	    <external opt="required" type="char *"/>
818	    <comment>limit value, interval</comment>
819	</entry>
820	<entry id="return">
821	    <internal token="return"/>
822	    <external opt="none"/>
823	</entry>
824    </event>
825
826    <event id="AUE_zone_state" header="0" idNo="33" omit="JNI">
827	<entry id="subject">
828	    <internal token="subject"/>
829	    <external opt="none"/>
830	</entry>
831	<entry id="new_state">
832	    <internal token="text"/>
833	    <external opt="required" type="char *"/>
834	    <comment>New zone state</comment>
835	</entry>
836	<entry id="zonename">
837	    <internal token="zonename"/>
838	    <external opt="required" type="char *"/>
839	    <comment>zone name</comment>
840	</entry>
841	<entry id="return">
842	    <internal token="return"/>
843	    <external opt="none"/>
844	</entry>
845    </event>
846
847    <event id="AUE_su_logout" instance_of="AUE_generic_basic"
848	header="0" idNo="39" omit="JNI">
849	<title>su</title>
850	<program>/usr/bin/su</program>
851	<see>su(1M)</see>
852    </event>
853
854    <event id="AUE_role_logout" instance_of="AUE_generic_basic"
855	header="0" idNo="40" omit="JNI">
856	<title>su</title>
857	<program>/usr/bin/su</program>
858	<see>su(1M)</see>
859    </event>
860
861    <event id="AUE_newgrp_login" header="0" idNo="41" omit="JNI">
862    	<program>newgrp</program>
863	<entry id="subject">
864	    <internal token="subject"/>
865	    <external opt="none"/>
866	</entry>
867	<entry id="groupname">
868	    <internal  token="text"/>
869	    <external opt="required"  type="char *"/>
870	    <comment>group name</comment>
871	</entry>
872	<entry id="return">
873	    <internal token="return"/>
874	    <external opt="none"/>
875	</entry>
876    </event>
877
878    <event id="AUE_generic_mountable" type="generic" omit="always">
879	<!--
880
881	User device mounting related functions
882
883	-->
884	<entry id="subject">
885	    <internal token="subject"/>
886	    <external opt="none"/>
887	</entry>
888	<entry id="auth_used">
889	    <internal token="uauth"/>
890	    <external opt="required" type="char *"/>
891	    <comment>authorization used</comment>
892	</entry>
893	<entry id="mount_point">
894	    <internal token="path"/>
895	    <external opt="required" type="char *"/>
896	    <comment>mount point</comment>
897	</entry>
898	<entry id="device">
899	    <internal token="path"/>
900	    <external opt="required" type="char *"/>
901	    <comment>device</comment>
902	</entry>
903	<entry id="options">
904	    <internal token="text"/>
905	    <external opt="optional" type="char *"/>
906	    <comment>options</comment>
907	</entry>
908	<entry id="return">
909	    <internal token="return"/>
910	    <external opt="none"/>
911	</entry>
912    </event>
913
914    <event id="AUE_attach" instance_of="AUE_generic_mountable"
915	header="0" idNo="42" omit="JNI">
916	<program>hald</program>
917    </event>
918    <event id="AUE_detach" instance_of="AUE_generic_mountable"
919	header="0" idNo="43" omit="JNI">
920	<program>hald</program>
921    </event>
922    <event id="AUE_remove" header="0" idNo="44" omit="JNI">
923	<program>hald</program>
924	<entry id="subject">
925	    <internal token="subject"/>
926	    <external opt="none"/>
927	</entry>
928	<entry id="auth_used">
929	    <internal token="uauth"/>
930	    <external opt="required" type="char *"/>
931	    <comment>authorization used</comment>
932	</entry>
933	<entry id="mount_point">
934	    <internal token="path"/>
935	    <external opt="optional" type="char *"/>
936	    <comment>mount point</comment>
937	</entry>
938	<entry id="device">
939	    <internal token="path"/>
940	    <external opt="required" type="char *"/>
941	    <comment>device</comment>
942	</entry>
943	<entry id="return">
944	    <internal token="return"/>
945	    <external opt="none"/>
946	</entry>
947    </event>
948
949    <event id="AUE_pool_import" header="0" idNo="45" omit="JNI">
950    	<program>hald</program>
951	<entry id="subject">
952	    <internal token="subject"/>
953	    <external opt="none"/>
954	</entry>
955	<entry id="auth_used">
956	    <internal token="uauth"/>
957	    <external opt="required" type="char *"/>
958	    <comment>authorization used</comment>
959	</entry>
960	<entry id="pool">
961	    <internal token="text"/>
962	    <external opt="required" type="char *"/>
963	    <comment>pool</comment>
964	</entry>
965	<entry id="device">
966	    <internal token="path"/>
967	    <external opt="required" type="char *"/>
968	    <comment>device</comment>
969	</entry>
970	<entry id="return">
971	    <internal token="return"/>
972	    <external opt="none"/>
973	</entry>
974    </event>
975    <event id="AUE_pool_export" header="0" idNo="46" omit="JNI">
976    	<program>hald</program>
977	<entry id="subject">
978	    <internal token="subject"/>
979	    <external opt="none"/>
980	</entry>
981	<entry id="auth_used">
982	    <internal token="uauth"/>
983	    <external opt="required" type="char *"/>
984	    <comment>authorization used</comment>
985	</entry>
986	<entry id="pool">
987	    <internal token="text"/>
988	    <external opt="required" type="char *"/>
989	    <comment>pool</comment>
990	</entry>
991	<entry id="device">
992	    <internal token="path"/>
993	    <external opt="required" type="char *"/>
994	    <comment>device</comment>
995	</entry>
996	<entry id="return">
997	    <internal token="return"/>
998	    <external opt="none"/>
999	</entry>
1000    </event>
1001
1002<!-- dladm security objected events -->
1003    <event id="AUE_dladm_generic" type="generic" omit="always">
1004	<entry id="subject">
1005	    <internal token="subject"/>
1006	    <external opt="none"/>
1007	</entry>
1008	<entry id="auth_used">
1009	    <internal token="uauth"/>
1010	    <external opt="required" type="char *"/>
1011	    <comment>authorization used</comment>
1012	</entry>
1013	<entry id="obj_class">
1014	    <internal token="text"/>
1015	    <external opt="required" type="char *"/>
1016	    <comment>object class name</comment>
1017	</entry>
1018	<entry id="obj_name">
1019	    <internal token="text"/>
1020	    <external opt="required" type="char *"/>
1021	    <comment>object name</comment>
1022	</entry>
1023	<entry id="return">
1024	    <internal token="return"/>
1025	    <external opt="none"/>
1026	</entry>
1027    </event>
1028
1029    <event id="AUE_dladm_create_secobj" instance_of="AUE_dladm_generic"
1030	header="0" idNo="47" omit="JNI">
1031	<title>create wifi security object</title>
1032	<program>/usr/sbin/dladm</program>
1033	<see>dladm(1M)</see>
1034    </event>
1035    <event id="AUE_dladm_delete_secobj" instance_of="AUE_dladm_generic"
1036	header="0" idNo="48" omit="JNI">
1037	<title>delete wifi security object</title>
1038	<program>/usr/sbin/dladm</program>
1039	<see>dladm(1M)</see>
1040    </event>
1041
1042<!-- Trusted eXtensions (TX) events -->
1043
1044    <!-- labeld events -->
1045    <event id="AUE_file_relabel" header="0" idNo="49" omit="JNI">
1046    	<title>relabel file from one zone to another</title>
1047	<program>setlabel(1)</program>
1048	<see>setflabel(3TSOL)</see>
1049	<entry id="subject">
1050	    <internal token="subject"/>
1051	    <external opt="none"/>
1052	</entry>
1053	<entry id="auth_used">
1054	    <internal token="uauth"/>
1055	    <external opt="required" type="char *"/>
1056	    <comment>authorization used</comment>
1057	</entry>
1058	<entry id="file">
1059	    <internal token="path"/>
1060	    <external opt="required" type="char *"/>
1061	    <comment>file relabeled</comment>
1062	</entry>
1063	<entry id="src_label">
1064	    <internal token="label"/>
1065	    <external opt="required" type="m_label_t *"/>
1066	    <comment>original label</comment>
1067	</entry>
1068	<entry id="dst_label">
1069	    <internal token="label"/>
1070	    <external opt="required" type="m_label_t *"/>
1071	    <comment>new label</comment>
1072	</entry>
1073	<entry id="return">
1074	    <internal token="return"/>
1075	    <external opt="none"/>
1076	</entry>
1077    </event>
1078
1079    <event id="AUE_file_copy" header="0" idNo="50" omit="JNI">
1080    	<title>copy file to another zone</title>
1081	<program>dtfile(1X)</program>
1082	<entry id="subject">
1083	    <internal token="subject"/>
1084	    <external opt="none"/>
1085	</entry>
1086	<entry id="auth_used">
1087	    <internal token="uauth"/>
1088	    <external opt="required" type="char *"/>
1089	    <comment>authorization used</comment>
1090	</entry>
1091	<entry id="src_file">
1092	    <internal token="path"/>
1093	    <external opt="required" type="char *"/>
1094	    <comment>source file</comment>
1095	</entry>
1096	<entry id="src_label">
1097	    <internal token="label"/>
1098	    <external opt="required" type="m_label_t *"/>
1099	    <comment>source label</comment>
1100	</entry>
1101	<entry id="dst_file">
1102	    <internal token="path"/>
1103	    <external opt="required" type="char *"/>
1104	    <comment>destination directory</comment>
1105	</entry>
1106	<entry id="dst_label">
1107	    <internal token="label"/>
1108	    <external opt="required" type="m_label_t *"/>
1109	    <comment>destination label</comment>
1110	</entry>
1111	<entry id="return">
1112	    <internal token="return"/>
1113	    <external opt="none"/>
1114	</entry>
1115    </event>
1116
1117<!-- add new events here with the next higher idNo -->
1118<!-- Highest idNo is 50, so next is 51, then fix this comment -->
1119<!-- end of C Only events -->
1120
1121
1122<!--
1123     token definitions are partially implemented.  All they do for now
1124     is create a list of defined token names.  In the future they may
1125     become a way of describing token structure.
1126-->
1127
1128    <token id="acl">
1129    </token>
1130    <token id="arbitrary">
1131    </token>
1132    <token id="arg">
1133    </token>
1134    <token id="attr">
1135    </token>
1136    <token id="command">
1137    </token>
1138    <token id="command_1">
1139    </token>
1140    <token id="date">
1141    </token>
1142    <token id="exec_args">
1143    </token>
1144    <token id="exec_env">
1145    </token>
1146    <token id="exit">
1147    </token>
1148    <token id="file">
1149    </token>
1150    <token id="fmri">
1151    </token>
1152    <token id="groups">
1153    </token>
1154    <token id="in_addr">
1155    </token>
1156    <token id="ipc">
1157    </token>
1158    <token id="ipc_perm">
1159    </token>
1160    <token id="label">
1161    </token>
1162    <token id="newgroups">
1163    </token>
1164    <token id="opaque">
1165    </token>
1166    <token id="path">
1167    </token>
1168    <!-- pseudo token; path list generates 0 or more path tokens -->
1169    <token id="path_list">
1170    </token>
1171    <token id="tid">
1172    </token>
1173
1174    <!--
1175	privilege token is implemented as one of the pseudo tokens
1176	priv_limit, priv_effective, or priv_inherit
1177
1178    <token id="privilege">
1179    </token>
1180    -->
1181    <token id="priv_effective">
1182    </token>
1183    <token id="priv_inherit">
1184    </token>
1185    <token id="priv_limit">
1186    </token>
1187    <token id="process">
1188    </token>
1189    <token id="return">
1190    </token>
1191    <token id="seq">
1192    </token>
1193    <token id="socket">
1194    </token>
1195    <token id="socket-inet">
1196    </token>
1197    <token id="subject">
1198    </token>
1199    <token id="text">
1200    </token>
1201    <token id="uauth">
1202    </token>
1203    <token id="zonename">
1204    </token>
1205
1206<!--
1207    error value list for return values with success/fail code of fail.
1208    These values start at 1000 so praudit can tell the difference
1209    between the libbsm/common/audit_*.c broken error values and
1210    the new adt_ error value list.  It is public so that praudit
1211    can find it.
1212
1213    praudit outputs "failure" %s" for these strings, so there is
1214    no need to use words such as "failed" in the message.
1215
1216    ** Add to the end only to maintain validity across versions of
1217    the audit log. **
1218-->
1219
1220    <msg_list id="fail_value" header="0" start="1000" public="true">
1221	<msg id="PW_ATTR">Attribute update</msg>
1222	<msg id="PW">Password update</msg>
1223	<msg id="USERNAME">bad username</msg>
1224	<msg id="AUTH">authorization failed</msg>
1225	<msg id="UID">bad uid</msg>
1226	<msg id="UNKNOWN">unknown failure</msg>
1227	<msg id="EXPIRED">password expired</msg>
1228	<msg id="ACCOUNT_LOCKED">Account is locked</msg>
1229	<msg id="BAD_DIALUP">Bad dial up</msg>
1230	<msg id="BAD_ID">Invalid ID</msg>
1231	<msg id="BAD_PW">Invalid password</msg>
1232	<msg id="CONSOLE">Not on console</msg>
1233	<msg id="MAX_TRIES">Too many failed attempts</msg>
1234	<msg id="PROTOCOL_FAILURE">Protocol failure</msg>
1235	<msg id="EXCLUDED_USER">Excluded user</msg>
1236	<msg id="ANON_USER">No anonymous</msg>
1237	<msg id="BAD_CMD">Invalid command</msg>
1238	<msg id="BAD_TTY">Standard input not a tty line</msg>
1239	<msg id="PROGRAM">Program failure</msg>
1240	<msg id="CHDIR_FAILED">chdir to home directory</msg>
1241	<msg id="INPUT_OVERFLOW">Input line too long.</msg>
1242	<msg id="DEVICE_PERM">login device override</msg>
1243	<msg id="AUTH_BYPASS">authorization bypass</msg>
1244	<msg id="LOGIN_DISABLED">login disabled</msg>
1245    </msg_list>
1246
1247<!--
1248	The following empty list is used for PAM errors; the "start"
1249	value is used by praudit to know to use the PAM infrastructure
1250	for generating error strings
1251-->
1252    <msg_list id="fail_pam" header="0" start="2000" public="true">
1253    </msg_list>
1254
1255<!--
1256     This is still in use by SMC.  See AUE_generic_login.  When
1257     either SMC is fixed to stop using this, or SMC goes away.
1258     REMOVE this stuff and the corresponding AUE_generic_login
1259     message field.
1260
1261     Message list for the various authentication events, such
1262     as AUE_login and AUE_admin_authenticate.  Add new entries
1263     at the end.  The order of msg_list entries and the order
1264     of msg entries both affect the names in adt.h and the value
1265     of the associated enumerated types.
1266
1267     Each of these messages except NO_MSG is also in the failure_attribute
1268     list; the difference is that the messages below use a text token
1269     in the audit record, while the failure_attribute messages are
1270     associated with the return value of the return token.
1271
1272     This list is deprecated; please don't use text tokens for error
1273     messages.
1274-->
1275
1276    <msg_list id="login_text" header="0" deprecated="true">
1277	<msg id="NO_MSG"></msg>
1278	<msg id="ACCOUNT_LOCKED">Account is locked</msg>
1279	<msg id="BAD_DIALUP">Bad dial up</msg>
1280	<msg id="BAD_ID">Invalid ID</msg>
1281	<msg id="BAD_PW">Invalid password</msg>
1282	<msg id="CONSOLE">Not on console</msg>
1283	<msg id="MAX_TRIES">Too many failed attempts</msg>
1284	<msg id="PROTOCOL_FAILURE">Protocol failure</msg>
1285	<msg id="EXCLUDED_USER">Excluded user</msg>
1286	<msg id="ANON_USER">No anonymous</msg>
1287    </msg_list>
1288
1289</specification>
1290