1<?xml version="1.0" standalone="yes"?> 2<!DOCTYPE specification SYSTEM "audit.dtd"> 3<!-- 4 CDDL HEADER START 5 6 The contents of this file are subject to the terms of the 7 Common Development and Distribution License (the "License"). 8 You may not use this file except in compliance with the License. 9 10 You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 11 or http://www.opensolaris.org/os/licensing. 12 See the License for the specific language governing permissions 13 and limitations under the License. 14 15 When distributing Covered Code, include this CDDL HEADER in each 16 file and include the License file at usr/src/OPENSOLARIS.LICENSE. 17 If applicable, add the following below this CDDL HEADER, with the 18 fields enclosed by brackets "[]" replaced with your own identifying 19 information: Portions Copyright [yyyy] [name of copyright owner] 20 21 CDDL HEADER END 22 23Copyright 2009 Sun Microsystems, Inc. All rights reserved. 24Use is subject to license terms. 25 26--> 27 28<specification> 29 30<!-- comments are displayed to stderr if debug is on --> 31<debug set="off"/> 32 33 <!-- The order of events is arbitrary EXCEPT generic events must 34 precede their instances --> 35 <!-- The order of entries within an event determine the order 36 data is defined in the external API --> 37 <!-- The order of internal / external is arbitrary --> 38 39<!-- 40 tags: 41 The following top level tags are defined: 42 <event> <token> <msg_list> <debug> 43 44 event defines an audit record 45 - id is the record id from audit_uevents.h 46 - reorder="yes" or "no". (default is "no"). 47 if "yes" then the order of the tokens to be 48 output does not match the order of the data 49 input. (see order attribute of <entry>) 50 - header defines the header file to contain the external 51 definitions for this event type. The header file 52 name is adt_event_N.h, where N is the value supplied 53 header="0" is for "stable" events, > 0 for new ones. 54 with this attribute. (header="1"). 55 - idNo is the number associated with the external 56 name of this event. (For AUE_login, ADT_login is 57 the external name and idNo is the value for 58 ADT_login.) 59 - omit is by default 'no' (i.e., don't omit) and can be 60 'always' or 'JNI'. In the latter case, C interface 61 code is generated but neither Java nor JNI code is. 62 - included text is just a comment 63 Within an event block, the following tags are defined: 64 <entry>, <debug>, <altname>, <title>, <program>, <see> 65 66 altname defines the internal name of an audit record; if 67 omitted, the internal name is the same as the 68 external name. 69 70 title, these tags are used by auditrecord(1M) build to create 71 program, audit_record_attr database from adt events. 72 see Following example demonstrates their semantics: 73 74 auditrecord -p passwd 75 passwd <- <title> 76 program various See passwd(1) 77 ^- <program> ^- <see> 78 event ID 6163 AUE_passwd 79 class lo (0x00001000) 80 header 81 subject 82 [text] username... 83 ^- <comment> 84 return 85 86 If the length of string in any of the given 87 elements is longer than defined, the string is 88 silently truncated to the defined length in the 89 auditrecord(1M) runtime: 90 91 element <= max (non-truncated) string length 92 title <= 46 93 program <= 20 94 see <= 39 95 comment <= unlimited 96 token <= 28 97 98 entry defines the correspondence between the data 99 supplied by the caller and the token to be 100 output. 101 - id is the data name that shows up in the structures 102 of adt_event.h If it is a comma separated list, 103 it is the list of names of data to be associated 104 with one output token. (See <external>, below) 105 Within an entry block, the following tags are defined: 106 <internal>, <external>, <debug>, <comment> 107 108 internal defines the token to be generated. 109 - token is a name that must also be defined with 110 a <token> tag elsewhere in this file. (order is 111 not important). 112 - order="some number" determines the order of the 113 tokens to be output, starting with 1. The subject 114 token is normally order="1". The use is to insure 115 that the order of fields listed in adt_event.h does 116 not change when we arbitrarily change the order of 117 tokens. If the <event reorder="yes"> is not set, 118 order is ignored. 119 - format is a printf-like string that will be used 120 in to format the data supplied by the user. 121 122 external defines the data to be supplied for creating the 123 token defined via <internal> 124 - opt is one of four values: "required", "optional", 125 "obsolete", or "none". The first two values 126 indicate that this token's data must or may 127 be supplied by the user; the third value is 128 equivalent to "optional" but shows in the 129 comment that this field is no longer used; 130 the forth value indicates that this token 131 does not require any user-supplied data. If 132 data is required, then a token is always 133 output, while optional data is output only 134 if data is supplied. 135 - type describes the C data type to be associated 136 with the <entry id="dataName">. The following 137 data types are representative: 138 139 au_asid_t (uint32_t) 140 char 141 char * (blank is optional) 142 char ** (blank is optional) 143 fd_t (int, a file descriptor) 144 uint_t, int, int32_t, uid_t, gid_t 145 uid_t *, gid_t * 146 long, ulong_t 147 m_label_t * 148 pid_t 149 priv_set_t * 150 uint16_t, unit32_t, uint64_t 151 uint32_t *, uint32_t[], uint64_t * 152 msg (not a C type, see below) 153 154 Below is what Tony said. Above seems to be 155 what is implemented 156 char 157 char * (blank is optional) 158 char ** (blank is optional) 159 int, uid_t, gid_t 160 int *, uid_t *, gid_t * 161 msg (not a C type, see below) 162 time_t 163 uint, uint * 164 165 The msg type refers to an enumerated type 166 that must be defined via a <msg> description 167 else where in this file. The syntax is 168 special. Example: <external opt="optional" 169 type="msg login_text"/> "login_text" is the 170 id of a <msg_list> descriptor given 171 elsewhere in this file. 172 173 If the <entry> id is a list, the type must also 174 be a comma-separated list, where the types are 175 in the same order as the id's. 176 If the type is an array, its length must be given 177 explicitly. 178 179 comment Used by auditrecord(1M) build to generate 180 audit_record_attr. Comment is explanation note 181 printed with token type. Colon (':') may not be 182 used in a comment. See example above for other 183 tags related to auditrecord(1M). 184 185 token Define allowed token names. 186 - id is the name of token; this name is used 187 as an <internal> id. 188 - a token id name may not end in digits. 189 - usage is an optional value. At present, only 190 "TSOL" is defined; it means that this data is 191 to be used only in Trusted Solaris implementations. 192 See also example above for "token" tag relation to 193 the auditrecord(1M) output. 194 195 msg_list Define a set of text strings. 196 - id is the name to be used for this group of text 197 strings in adt_event.h 198 - header is as defined for <event> 199 - start is a number where produced enum type begins; 200 ensure msg lists do not overlap 201 Within a msg_list block, <msg> and <debug> are defined. 202 The order of <msg> tags in a msg_list is reflected 203 directly in adt_event.h. Also add ADT_LIST_<<id>> to 204 enum adt_msg_list in adt_xlate.h. 205 206 msg Define one string. 207 - id is the name to be used in the enum describing 208 this set of strings. Convention: use upper case. 209 The content (text between <msg> and </msg>) is the 210 actual string. Extra white space, including line 211 feeds, is ignored. If empty, no output token 212 is generated unless the <external> opt attribute is 213 set to "required", in which case a blank text token 214 is generated. 215 Within a msg block, <debug> is defined, but has not been 216 tested and may have no effect. 217 218 debug This turns on/off debug messages during the processing 219 of the xml data. It affects the block within which it 220 is defined. 221 - set may have one of two values: "on" or "off". If 222 set is omitted, the debug state for the current block 223 is toggled. 224 The use of the <debug> tag does not affect the output 225 of data to the various files created, but does generate 226 potentially large amounts of output to stderr. 227 228--> 229<!-- template for an event record definition 230 231 <event id="" header="0" idNo=""> 232 <entry id="subject"> 233 <internal token="subject"/> 234 <external opt="none"/> 235 </entry> 236 <entry id=""> 237 <internal token=""/> 238 <external opt="" type="" /> 239 </entry> 240 <entry id="return"> 241 <internal token="return"/> 242 <external opt="none"/> 243 </entry> 244 </event> 245 246 Generic events must precede Instance events; within each 247 group, please group the AUE_* by area and event idNo-s in order, 248 gaps in idNo-s are OK. 249 N.B. Renumbering idNo-s requires recompilation of consumers. See 250 the contracts for whom to notify if/when this happens. 251--> 252 253<!-- generic events --> 254 255 <!-- 256 'omit="always"' means that this record type is not reflected 257 in the generated header and table files. 258 --> 259 260 <event id="AUE_generic_basic" type="generic" omit="always"> 261 <!-- 262 263 This is a template for the event types that have no tokens 264 other than the header and return. There is no allowed_type 265 list because the template is not externally visible due to the 266 omit="always". 267 268 --> 269 <entry id="subject"> 270 <internal token="subject"/> 271 <external opt="none"/> 272 </entry> 273 <entry id="return"> 274 <internal token="return"/> 275 <external opt="none"/> 276 </entry> 277 </event> 278 279 <event id="AUE_generic_login" type="generic" omit="always"> 280 <!-- 281 282 This is a template for the various login event types 283 AUE_login, AUE_ftp, etc which match this template. There is 284 no allowed_type list because the template is not externally 285 visible due to the omit="always". 286 287 --> 288 <entry id="subject"> 289 <internal token="subject"/> 290 <external opt="none"/> 291 </entry> 292 293 <!-- This field is still in use for SMC until it is cleaned up, 294 it must remain, see login_text msg list at the end of the 295 file. 296 --> 297 <entry id="message"> 298 <internal token="text"/> 299 <external opt="optional" type="msg login_text"/> 300 <comment>error message</comment> 301 </entry> 302 <entry id="return"> 303 <internal token="return"/> 304 <external opt="none"/> 305 </entry> 306 </event> 307 308<!-- generic SMC events --> 309 310 <event id="AUE_generic_SMC_add" type="generic" omit="always"> 311 <entry id="subject"> 312 <internal token="subject"/> 313 <external opt="none"/> 314 </entry> 315 <entry id="object_name"> 316 <internal token="text"/> 317 <external opt="required" type="char *"/> 318 <comment>object name</comment> 319 </entry> 320 <entry id="domain"> 321 <internal token="text"/> 322 <external opt="optional" type="char *"/> 323 <comment>domain</comment> 324 </entry> 325 <entry id="name_service"> 326 <internal token="text"/> 327 <external opt="required" type="char *"/> 328 <comment>name_service</comment> 329 </entry> 330 <entry id="auth_used"> 331 <internal token="uauth"/> 332 <external opt="optional" type="char *"/> 333 <comment>authorization used</comment> 334 </entry> 335 <!-- 336 This should really be its own token type, not "text" 337 --> 338 <entry id="initial_values"> 339 <internal token="text"/> 340 <external opt="required" type="char *"/> 341 <comment>initial values</comment> 342 </entry> 343 <entry id="return"> 344 <internal token="return"/> 345 <external opt="none"/> 346 </entry> 347 </event> 348 349 <event id="AUE_generic_SMC_delete" type="generic" omit="always"> 350 <entry id="subject"> 351 <internal token="subject"/> 352 <external opt="none"/> 353 </entry> 354 <entry id="object_name"> 355 <internal token="text"/> 356 <external opt="required" type="char *"/> 357 <comment>object name</comment> 358 </entry> 359 <entry id="domain"> 360 <internal token="text"/> 361 <external opt="optional" type="char *"/> 362 <comment>domain</comment> 363 </entry> 364 <entry id="name_service"> 365 <internal token="text"/> 366 <external opt="required" type="char *"/> 367 <comment>name_service</comment> 368 </entry> 369 <entry id="auth_used"> 370 <internal token="uauth"/> 371 <external opt="optional" type="char *"/> 372 <comment>authorization used</comment> 373 </entry> 374 <entry id="delete_values"> 375 <internal token="text"/> 376 <external opt="required" type="char *"/> 377 <comment>deleted values</comment> 378 </entry> 379 <entry id="return"> 380 <internal token="return"/> 381 <external opt="none"/> 382 </entry> 383 </event> 384 385 <event id="AUE_generic_SMC_modify" type="generic" omit="always"> 386 <entry id="subject"> 387 <internal token="subject"/> 388 <external opt="none"/> 389 </entry> 390 <entry id="object_name"> 391 <internal token="text"/> 392 <external opt="required" type="char *"/> 393 <comment>object name</comment> 394 </entry> 395 <entry id="domain"> 396 <internal token="text"/> 397 <external opt="optional" type="char *"/> 398 <comment>domain</comment> 399 </entry> 400 <entry id="name_service"> 401 <internal token="text"/> 402 <external opt="required" type="char *"/> 403 <comment>name_service</comment> 404 </entry> 405 <entry id="auth_used"> 406 <internal token="uauth"/> 407 <external opt="optional" type="char *"/> 408 <comment>authorization used</comment> 409 </entry> 410 <entry id="changed_values"> 411 <internal token="text"/> 412 <external opt="required" type="char *"/> 413 <comment>changed values</comment> 414 </entry> 415 <entry id="return"> 416 <internal token="return"/> 417 <external opt="none"/> 418 </entry> 419 </event> 420 421<!-- instances --> 422 423<!-- 424 Java needed for SMC events. Since the SMC events grow less 425 often than the C related events. They come first. It 426 would be nice to reorder the idNo-s, but that's an ABI 427 change and should rev libbsm version no. If reordered 428 start with 1 and eliminate the comment at the end about 429 the highest idNo. 430--> 431 <event id="AUE_admin_authenticate" instance_of="AUE_generic_login" 432 header="0" idNo="3"> 433 <title>Admin Server Authentication</title> 434 <program>admin (various)</program> 435 <see>SMC, WBEM, or AdminSuite</see> 436 </event> 437 438 <event id="AUE_filesystem_add" instance_of="AUE_generic_SMC_add" 439 header="0" idNo="4"> 440 <title>SMC: filesystem add</title> 441 <program>SMC server</program> 442 </event> 443 <event id="AUE_filesystem_delete" instance_of="AUE_generic_SMC_delete" 444 header="0" idNo="5"> 445 <title>SMC: filesystem delete</title> 446 <program>SMC server</program> 447 </event> 448 <event id="AUE_filesystem_modify" instance_of="AUE_generic_SMC_modify" 449 header="0" idNo="6"> 450 <title>SMC: filesystem modify</title> 451 <program>SMC server</program> 452 </event> 453 454 <event id="AUE_network_add" instance_of="AUE_generic_SMC_add" 455 header="0" idNo="7"> 456 <title>SMC: network add</title> 457 <program>SMC server</program> 458 </event> 459 <event id="AUE_network_delete" instance_of="AUE_generic_SMC_delete" 460 header="0" idNo="8"> 461 <title>SMC: network delete</title> 462 <program>SMC server</program> 463 </event> 464 <event id="AUE_network_modify" instance_of="AUE_generic_SMC_modify" 465 header="0" idNo="9"> 466 <title>SMC: network modify</title> 467 <program>SMC server</program> 468 </event> 469 470 <event id="AUE_printer_add" instance_of="AUE_generic_SMC_add" 471 header="0" idNo="10"> 472 <title>SMC: printer add</title> 473 <program>SMC server</program> 474 </event> 475 <event id="AUE_printer_delete" instance_of="AUE_generic_SMC_delete" 476 header="0" idNo="11"> 477 <title>SMC: printer delete</title> 478 <program>SMC server</program> 479 </event> 480 <event id="AUE_printer_modify" instance_of="AUE_generic_SMC_modify" 481 header="0" idNo="12"> 482 <title>SMC: printer modify</title> 483 <program>SMC server</program> 484 </event> 485 486<!-- 487 This is SMC; it's also used in su and should probably be used in 488 desktop role login. If we fix the SMC to not record NO_MSG here, 489 we can fix to record failed user. See su.c and AUE_su. 490--> 491 <event id="AUE_role_login" instance_of="AUE_generic_login" 492 header="0" idNo="13"> 493 <title>RBAC: role login</title> 494 <program>SMC server</program> 495 <program>/usr/bin/su</program> 496 </event> 497 498 <event id="AUE_scheduledjob_add" instance_of="AUE_generic_SMC_add" 499 header="0" idNo="14"> 500 <title>SMC: scheduled job add</title> 501 <program>SMC server</program> 502 </event> 503 <event id="AUE_scheduledjob_delete" instance_of="AUE_generic_SMC_delete" 504 header="0" idNo="15"> 505 <title>SMC: scheduled job delete</title> 506 <program>SMC server</program> 507 </event> 508 <event id="AUE_scheduledjob_modify" instance_of="AUE_generic_SMC_modify" 509 header="0" idNo="16"> 510 <title>SMC: scheduled job modify</title> 511 <program>SMC server</program> 512 </event> 513 514 <event id="AUE_serialport_add" instance_of="AUE_generic_SMC_add" 515 header="0" idNo="17"> 516 <title>SMC: serial port add</title> 517 <program>SMC server</program> 518 </event> 519 <event id="AUE_serialport_delete" instance_of="AUE_generic_SMC_delete" 520 header="0" idNo="18"> 521 <title>SMC: serial port delete</title> 522 <program>SMC server</program> 523 </event> 524 <event id="AUE_serialport_modify" instance_of="AUE_generic_SMC_modify" 525 header="0" idNo="19"> 526 <title>SMC: serial port modify</title> 527 <program>SMC server</program> 528 </event> 529 530<!-- This is SMC; should this also be used elsewhere? --> 531 <event id="AUE_uauth" header="0" idNo="20"> 532 <title>SMC: Use of Authorization</title> 533 <program>SMC server</program> 534 <entry id="subject"> 535 <internal token="subject"/> 536 <external opt="none"/> 537 </entry> 538 <entry id="auth_used"> 539 <internal token="uauth"/> 540 <external opt="required" type="char *"/> 541 <comment>authorization used</comment> 542 </entry> 543 <entry id="objectname"> 544 <internal token="text"/> 545 <external opt="required" type="char *"/> 546 <comment>object name</comment> 547 </entry> 548 <entry id="return"> 549 <internal token="return"/> 550 <external opt="none"/> 551 </entry> 552 </event> 553 554 <event id="AUE_usermgr_add" instance_of="AUE_generic_SMC_add" 555 header="0" idNo="21"> 556 <title>SMC: User Manager add</title> 557 <program>SMC server</program> 558 </event> 559 <event id="AUE_usermgr_delete" instance_of="AUE_generic_SMC_delete" 560 header="0" idNo="22"> 561 <title>SMC: User Manager delete</title> 562 <program>SMC server</program> 563 </event> 564 <event id="AUE_usermgr_modify" instance_of="AUE_generic_SMC_modify" 565 header="0" idNo="23"> 566 <title>SMC: User Manager modify</title> 567 <program>SMC server</program> 568 </event> 569<!-- end of Java needed for SMC events --> 570<!-- 571 while not used by SMC logout is used by Lockhart 572--> 573 <event id="AUE_logout" header="0" idNo="1"> 574 <title>login: logout</title> 575 <program>various</program> 576 <see>login(1)</see> 577 <entry id="subject"> 578 <internal token="subject"/> 579 <external opt="none"/> 580 </entry> 581<!-- 582 not used by C code, used by Lockhart, 583 get them to change and remove 584 event.user_name("logout " + session.getUserName()); 585 from /ws/lockhart-nv-gate/src/bundled/app/webmgt/lib/services/ 586 com/sun/management/services/audit/SolarisAuditEvent_Logout.java 587--> 588 <entry id="user_name"> 589 <internal token="text" format="logout %s"/> 590 <external opt="optional" type="char *"/> 591 <comment>"logout" username</comment> 592 </entry> 593 <entry id="return"> 594 <internal token="return"/> 595 <external opt="none"/> 596 </entry> 597 </event> 598 599 600<!-- C Only events --> 601 <event id="AUE_init_solaris" header="0" idNo="32" omit="JNI"> 602 <title>init</title> 603 <program>/sbin/init</program> 604 <program>/usr/sbin/init</program> 605 <program>/usr/sbin/shutdown</program> 606 <entry id="subject"> 607 <internal token="subject"/> 608 <external opt="none"/> 609 </entry> 610 <entry id="info"> 611 <internal token="text"/> 612 <external opt="optional" type="char *"/> 613 <comment>init level or zone name</comment> 614 </entry> 615 <entry id="return"> 616 <internal token="return"/> 617 <external opt="none"/> 618 </entry> 619 </event> 620 621 <event id="AUE_login" instance_of="AUE_generic_login" header="0" 622 idNo="25" omit="JNI"> 623 <title>terminal login</title> 624 <program>/usr/sbin/login</program> 625 <program>/usr/dt/bin/dtlogin</program> 626 <see>login(1)</see> 627 <see>dtlogin</see> 628 </event> 629 <event id="AUE_rlogin" instance_of="AUE_generic_login" header="0" 630 idNo="28" omit="JNI"> 631 <title>rlogin</title> 632 <program>/usr/sbin/login</program> 633 <see>login(1) - rlogin</see> 634 </event> 635 <event id="AUE_telnet" instance_of="AUE_generic_login" header="0" 636 idNo="29" omit="JNI"> 637 <title>telnet login</title> 638 <program>/usr/sbin/login</program> 639 <see>login(1) - telnet</see> 640 </event> 641 <event id="AUE_ssh" instance_of="AUE_generic_login" header="0" 642 idNo="2" omit="JNI"> 643 <program>/usr/lib/ssh/sshd</program> 644 </event> 645 646 <event id="AUE_zlogin" header="0" idNo="38" omit="JNI"> 647 <title>zone login</title> 648 <program>/usr/sbin/login</program> 649 <see>zlogin(1)</see> 650 <entry id="subject"> 651 <internal token="subject"/> 652 <external opt="none"/> 653 </entry> 654 <entry id="message"> 655 <internal token="text"/> 656 <external opt="optional" type="char *"/> 657 <comment>error message</comment> 658 </entry> 659 <entry id="return"> 660 <internal token="return"/> 661 <external opt="none"/> 662 </entry> 663 </event> 664 665 <event id="AUE_su" header="0" idNo="30" omit="JNI"> 666 <title>su</title> 667 <program>/usr/bin/su</program> 668 <see>su(1M)</see> 669 <entry id="subject"> 670 <internal token="subject"/> 671 <external opt="none"/> 672 </entry> 673<!-- 674 should be changed to "fail_user" and su.c updated 675 However, the jni stuff is broken, so for now it's "message" 676--> 677 <entry id="message"> 678 <internal token="text"/> 679 <external opt="optional" type="char *"/> 680 <comment>"user name" of failed new user/role</comment> 681 </entry> 682 <entry id="return"> 683 <internal token="return"/> 684 <external opt="none"/> 685 </entry> 686 </event> 687 688 <event id="AUE_passwd" header="0" idNo="27" omit="JNI"> 689 <title>passwd</title> 690 <program>various</program> 691 <see>passwd(1)</see> 692 <entry id="subject"> 693 <internal token="subject"/> 694 <external opt="none"/> 695 </entry> 696 <entry id="username"> 697 <internal token="text"/> 698 <external opt="optional" type="char *"/> 699 <comment>username if different than caller</comment> 700 </entry> 701 <entry id="return"> 702 <internal token="return"/> 703 <external opt="none"/> 704 </entry> 705 </event> 706 707 <event id="AUE_screenlock" instance_of="AUE_generic_basic" header="0" 708 idNo="26" omit="JNI"> 709 <program>desktop screen lock</program> 710 </event> 711 <event id="AUE_screenunlock" instance_of="AUE_generic_basic" header="0" 712 idNo="31" omit="JNI"> 713 <program>desktop screen unlock</program> 714 </event> 715 716 <!-- 717 AUE_prof_cmd is not supportable for Java due to the structure of 718 the priv token. When and if a Java program needs to generate 719 a priv token, we'll need to look at the data format in the 720 Java code and provide an appropriate java and jni implementation. 721 --> 722 723 <event id="AUE_prof_cmd" header="0" idNo="24" omit="JNI"> 724 <title>pfexec</title> 725 <program>/usr/bin/pfexec</program> 726 <see>pfexec(1)</see> 727 <entry id="subject"> 728 <internal token="subject"/> 729 <external opt="none"/> 730 </entry> 731 <entry id="cwdpath"> 732 <internal token="path"/> 733 <external opt="required" type="char*"/> 734 <comment>working directory</comment> 735 </entry> 736 <entry id="cmdpath"> 737 <internal token="path"/> 738 <external opt="required" type="char*"/> 739 <comment>command pathname</comment> 740 </entry> 741 <entry id="argc,argv,envp"> 742 <internal token="command"/> 743 <external opt="required" type="int,char**,char**"/> 744 </entry> 745 <entry id="proc_auid,proc_euid,proc_egid,proc_ruid,proc_rgid,proc_pid,proc_sid,proc_termid"> 746 <internal token="process"/> 747 <external opt="required" 748 type="uid_t,uid_t,gid_t,uid_t,gid_t,pid_t,au_asid_t,termid*"/> 749 </entry> 750 <entry id="limit_set"> 751 <internal token="priv_limit"/> 752 <external opt="optional" type="priv_set_t*"/> 753 </entry> 754 <entry id="inherit_set"> 755 <internal token="priv_inherit"/> 756 <external opt="optional" type="priv_set_t*"/> 757 </entry> 758 <entry id="return"> 759 <internal token="return"/> 760 <external opt="none"/> 761 </entry> 762 </event> 763 764 <event id="AUE_inetd_connect" header="0" idNo="34" omit="JNI"> 765 <title>inetd</title> 766 <program>/usr/sbin/inetd</program> 767 <entry id="subject"> 768 <internal token="subject"/> 769 <external opt="none"/> 770 </entry> 771 <entry id="service_name"> 772 <internal token="text"/> 773 <external opt="optional" type="char *"/> 774 <comment>service name</comment> 775 </entry> 776 <entry id="ip_type,ip_remote_port,ip_local_port,ip_adr"> 777 <internal token="tid"/> 778 <external opt="required" 779 type="uint32_t,uint16_t,uint16_t,uint32_t[4]"/> 780 <comment>client address</comment> 781 </entry> 782 <entry id="cmd"> 783 <internal token="command_alt"/> 784 <external opt="required" type="char *"/> 785 <comment>inetd command</comment> 786 </entry> 787 <entry id="privileges"> 788 <internal token="priv_effective"/> 789 <external opt="required" type="priv_set_t *"/> 790 </entry> 791 <entry id="return"> 792 <internal token="return"/> 793 <external opt="none"/> 794 </entry> 795 </event> 796 797 <event id="AUE_inetd_ratelimit" header="0" idNo="35" omit="JNI"> 798 <title>inetd</title> 799 <program>/usr/sbin/inetd</program> 800 <entry id="subject"> 801 <internal token="subject"/> 802 <external opt="none"/> 803 </entry> 804 <entry id="service_name"> 805 <internal token="text"/> 806 <external opt="optional" type="char *"/> 807 <comment>service name</comment> 808 </entry> 809 <entry id="limit"> 810 <internal token="text"/> 811 <external opt="required" type="char *"/> 812 <comment>limit value</comment> 813 </entry> 814 <entry id="return"> 815 <internal token="return"/> 816 <external opt="none"/> 817 </entry> 818 </event> 819 820 <event id="AUE_inetd_copylimit" header="0" idNo="36" omit="JNI"> 821 <title>inetd</title> 822 <program>/usr/sbin/inetd</program> 823 <entry id="subject"> 824 <internal token="subject"/> 825 <external opt="none"/> 826 </entry> 827 <entry id="service_name"> 828 <internal token="text"/> 829 <external opt="optional" type="char *"/> 830 <comment>service name</comment> 831 </entry> 832 <entry id="limit"> 833 <internal token="text"/> 834 <external opt="required" type="char *"/> 835 <comment>limit value</comment> 836 </entry> 837 <entry id="return"> 838 <internal token="return"/> 839 <external opt="none"/> 840 </entry> 841 </event> 842 843 <event id="AUE_inetd_failrate" header="0" idNo="37" omit="JNI"> 844 <title>inetd</title> 845 <program>/usr/sbin/inetd</program> 846 <entry id="subject"> 847 <internal token="subject"/> 848 <external opt="none"/> 849 </entry> 850 <entry id="service_name"> 851 <internal token="text"/> 852 <external opt="optional" type="char *"/> 853 <comment>service name</comment> 854 </entry> 855 <entry id="values"> 856 <internal token="text"/> 857 <external opt="required" type="char *"/> 858 <comment>limit value, interval</comment> 859 </entry> 860 <entry id="return"> 861 <internal token="return"/> 862 <external opt="none"/> 863 </entry> 864 </event> 865 866 <event id="AUE_zone_state" header="0" idNo="33" omit="JNI"> 867 <entry id="subject"> 868 <internal token="subject"/> 869 <external opt="none"/> 870 </entry> 871 <entry id="new_state"> 872 <internal token="text"/> 873 <external opt="required" type="char *"/> 874 <comment>New zone state</comment> 875 </entry> 876 <entry id="zonename"> 877 <internal token="zonename"/> 878 <external opt="required" type="char *"/> 879 <comment>zone name</comment> 880 </entry> 881 <entry id="return"> 882 <internal token="return"/> 883 <external opt="none"/> 884 </entry> 885 </event> 886 887 <event id="AUE_su_logout" instance_of="AUE_generic_basic" 888 header="0" idNo="39" omit="JNI"> 889 <title>su</title> 890 <program>/usr/bin/su</program> 891 <see>su(1M)</see> 892 </event> 893 894 <event id="AUE_role_logout" instance_of="AUE_generic_basic" 895 header="0" idNo="40" omit="JNI"> 896 <title>su</title> 897 <program>/usr/bin/su</program> 898 <see>su(1M)</see> 899 </event> 900 901 <event id="AUE_newgrp_login" header="0" idNo="41" omit="JNI"> 902 <program>newgrp</program> 903 <entry id="subject"> 904 <internal token="subject"/> 905 <external opt="none"/> 906 </entry> 907 <entry id="groupname"> 908 <internal token="text"/> 909 <external opt="required" type="char *"/> 910 <comment>group name</comment> 911 </entry> 912 <entry id="return"> 913 <internal token="return"/> 914 <external opt="none"/> 915 </entry> 916 </event> 917 918 <event id="AUE_generic_mountable" type="generic" omit="always"> 919 <!-- 920 921 User device mounting related functions 922 923 --> 924 <entry id="subject"> 925 <internal token="subject"/> 926 <external opt="none"/> 927 </entry> 928 <entry id="auth_used"> 929 <internal token="uauth"/> 930 <external opt="required" type="char *"/> 931 <comment>authorization used</comment> 932 </entry> 933 <entry id="mount_point"> 934 <internal token="path"/> 935 <external opt="required" type="char *"/> 936 <comment>mount point</comment> 937 </entry> 938 <entry id="device"> 939 <internal token="path"/> 940 <external opt="required" type="char *"/> 941 <comment>device</comment> 942 </entry> 943 <entry id="options"> 944 <internal token="text"/> 945 <external opt="optional" type="char *"/> 946 <comment>options</comment> 947 </entry> 948 <entry id="return"> 949 <internal token="return"/> 950 <external opt="none"/> 951 </entry> 952 </event> 953 954 <event id="AUE_attach" instance_of="AUE_generic_mountable" 955 header="0" idNo="42" omit="JNI"> 956 <program>hald</program> 957 </event> 958 <event id="AUE_detach" instance_of="AUE_generic_mountable" 959 header="0" idNo="43" omit="JNI"> 960 <program>hald</program> 961 </event> 962 <event id="AUE_remove" header="0" idNo="44" omit="JNI"> 963 <program>hald</program> 964 <entry id="subject"> 965 <internal token="subject"/> 966 <external opt="none"/> 967 </entry> 968 <entry id="auth_used"> 969 <internal token="uauth"/> 970 <external opt="required" type="char *"/> 971 <comment>authorization used</comment> 972 </entry> 973 <entry id="mount_point"> 974 <internal token="path"/> 975 <external opt="optional" type="char *"/> 976 <comment>mount point</comment> 977 </entry> 978 <entry id="device"> 979 <internal token="path"/> 980 <external opt="required" type="char *"/> 981 <comment>device</comment> 982 </entry> 983 <entry id="return"> 984 <internal token="return"/> 985 <external opt="none"/> 986 </entry> 987 </event> 988 989 <event id="AUE_pool_import" header="0" idNo="45" omit="JNI"> 990 <program>hald</program> 991 <entry id="subject"> 992 <internal token="subject"/> 993 <external opt="none"/> 994 </entry> 995 <entry id="auth_used"> 996 <internal token="uauth"/> 997 <external opt="required" type="char *"/> 998 <comment>authorization used</comment> 999 </entry> 1000 <entry id="pool"> 1001 <internal token="text"/> 1002 <external opt="required" type="char *"/> 1003 <comment>pool</comment> 1004 </entry> 1005 <entry id="device"> 1006 <internal token="path"/> 1007 <external opt="required" type="char *"/> 1008 <comment>device</comment> 1009 </entry> 1010 <entry id="return"> 1011 <internal token="return"/> 1012 <external opt="none"/> 1013 </entry> 1014 </event> 1015 <event id="AUE_pool_export" header="0" idNo="46" omit="JNI"> 1016 <program>hald</program> 1017 <entry id="subject"> 1018 <internal token="subject"/> 1019 <external opt="none"/> 1020 </entry> 1021 <entry id="auth_used"> 1022 <internal token="uauth"/> 1023 <external opt="required" type="char *"/> 1024 <comment>authorization used</comment> 1025 </entry> 1026 <entry id="pool"> 1027 <internal token="text"/> 1028 <external opt="required" type="char *"/> 1029 <comment>pool</comment> 1030 </entry> 1031 <entry id="device"> 1032 <internal token="path"/> 1033 <external opt="required" type="char *"/> 1034 <comment>device</comment> 1035 </entry> 1036 <entry id="return"> 1037 <internal token="return"/> 1038 <external opt="none"/> 1039 </entry> 1040 </event> 1041 1042<!-- dladm security objected events --> 1043 <event id="AUE_dladm_generic" type="generic" omit="always"> 1044 <entry id="subject"> 1045 <internal token="subject"/> 1046 <external opt="none"/> 1047 </entry> 1048 <entry id="auth_used"> 1049 <internal token="uauth"/> 1050 <external opt="required" type="char *"/> 1051 <comment>authorization used</comment> 1052 </entry> 1053 <entry id="obj_class"> 1054 <internal token="text"/> 1055 <external opt="required" type="char *"/> 1056 <comment>object class name</comment> 1057 </entry> 1058 <entry id="obj_name"> 1059 <internal token="text"/> 1060 <external opt="required" type="char *"/> 1061 <comment>object name</comment> 1062 </entry> 1063 <entry id="return"> 1064 <internal token="return"/> 1065 <external opt="none"/> 1066 </entry> 1067 </event> 1068 1069 <event id="AUE_dladm_create_secobj" instance_of="AUE_dladm_generic" 1070 header="0" idNo="47" omit="JNI"> 1071 <title>create wifi security object</title> 1072 <program>/usr/sbin/dladm</program> 1073 <see>dladm(1M)</see> 1074 </event> 1075 <event id="AUE_dladm_delete_secobj" instance_of="AUE_dladm_generic" 1076 header="0" idNo="48" omit="JNI"> 1077 <title>delete wifi security object</title> 1078 <program>/usr/sbin/dladm</program> 1079 <see>dladm(1M)</see> 1080 </event> 1081 1082<!-- Trusted eXtensions (TX) events --> 1083 1084 <!-- labeld events --> 1085 <event id="AUE_file_relabel" header="0" idNo="49" omit="JNI"> 1086 <title>relabel file from one zone to another</title> 1087 <program>setlabel(1)</program> 1088 <see>setflabel(3TSOL)</see> 1089 <entry id="subject"> 1090 <internal token="subject"/> 1091 <external opt="none"/> 1092 </entry> 1093 <entry id="auth_used"> 1094 <internal token="uauth"/> 1095 <external opt="required" type="char *"/> 1096 <comment>authorization used</comment> 1097 </entry> 1098 <entry id="file"> 1099 <internal token="path"/> 1100 <external opt="required" type="char *"/> 1101 <comment>file relabeled</comment> 1102 </entry> 1103 <entry id="src_label"> 1104 <internal token="label"/> 1105 <external opt="required" type="m_label_t *"/> 1106 <comment>original label</comment> 1107 </entry> 1108 <entry id="dst_label"> 1109 <internal token="label"/> 1110 <external opt="required" type="m_label_t *"/> 1111 <comment>new label</comment> 1112 </entry> 1113 <entry id="return"> 1114 <internal token="return"/> 1115 <external opt="none"/> 1116 </entry> 1117 </event> 1118 1119 <event id="AUE_file_copy" header="0" idNo="50" omit="JNI"> 1120 <title>copy file to another zone</title> 1121 <program>dtfile(1X)</program> 1122 <entry id="subject"> 1123 <internal token="subject"/> 1124 <external opt="none"/> 1125 </entry> 1126 <entry id="auth_used"> 1127 <internal token="uauth"/> 1128 <external opt="required" type="char *"/> 1129 <comment>authorization used</comment> 1130 </entry> 1131 <entry id="src_file"> 1132 <internal token="path"/> 1133 <external opt="required" type="char *"/> 1134 <comment>source file</comment> 1135 </entry> 1136 <entry id="src_label"> 1137 <internal token="label"/> 1138 <external opt="required" type="m_label_t *"/> 1139 <comment>source label</comment> 1140 </entry> 1141 <entry id="dst_file"> 1142 <internal token="path"/> 1143 <external opt="required" type="char *"/> 1144 <comment>destination directory</comment> 1145 </entry> 1146 <entry id="dst_label"> 1147 <internal token="label"/> 1148 <external opt="required" type="m_label_t *"/> 1149 <comment>destination label</comment> 1150 </entry> 1151 <entry id="return"> 1152 <internal token="return"/> 1153 <external opt="none"/> 1154 </entry> 1155 </event> 1156 1157 <!-- uadmin(1m) events --> 1158 <event id="AUE_uadmin_generic" type="generic" omit="always"> 1159 <entry id="subject"> 1160 <internal token="subject"/> 1161 <external opt="none"/> 1162 </entry> 1163 <entry id="fcn"> 1164 <internal token="text"/> 1165 <external opt="required" type="msg uadmin_fcn"/> 1166 <comment>next action</comment> 1167 </entry> 1168 <entry id="mdep"> 1169 <internal token="text"/> 1170 <external opt="optional" type="char *"/> 1171 <comment>machine dependent argument</comment> 1172 </entry> 1173 <entry id="return"> 1174 <internal token="return"/> 1175 <external opt="none"/> 1176 </entry> 1177 </event> 1178 <event id="AUE_uadmin_generic_fcn" type="generic" omit="always"> 1179 <entry id="subject"> 1180 <internal token="subject"/> 1181 <external opt="none"/> 1182 </entry> 1183 <entry id="fcn"> 1184 <internal token="text"/> 1185 <external opt="required" type="msg uadmin_fcn"/> 1186 <comment>next action</comment> 1187 </entry> 1188 <entry id="return"> 1189 <internal token="return"/> 1190 <external opt="none"/> 1191 </entry> 1192 </event> 1193 <event id="AUE_uadmin_shutdown" instance_of="AUE_uadmin_generic" 1194 header="0" idNo="51" omit="JNI"> 1195 <title>uadmin shutdown</title> 1196 <program>/sbin/uadmin</program> 1197 <program>/usr/sbin/uadmin</program> 1198 <see>uadmin(1M)</see> 1199 </event> 1200 <event id="AUE_uadmin_reboot" instance_of="AUE_uadmin_generic" 1201 header="0" idNo="52" omit="JNI"> 1202 <title>uadmin reboot</title> 1203 <program>/sbin/uadmin</program> 1204 <program>/usr/sbin/uadmin</program> 1205 <see>uadmin(1M)</see> 1206 </event> 1207 <event id="AUE_uadmin_dump" instance_of="AUE_uadmin_generic" 1208 header="0" idNo="53" omit="JNI"> 1209 <title>uadmin dump</title> 1210 <program>/sbin/uadmin</program> 1211 <program>/usr/sbin/uadmin</program> 1212 <see>uadmin(1M)</see> 1213 </event> 1214 <event id="AUE_uadmin_freeze" instance_of="AUE_uadmin_generic" 1215 header="0" idNo="54" omit="JNI"> 1216 <title>uadmin freeze</title> 1217 <program>/sbin/uadmin</program> 1218 <program>/usr/sbin/uadmin</program> 1219 <see>uadmin(1M)</see> 1220 </event> 1221 <event id="AUE_uadmin_remount" header="0" idNo="55" omit="JNI"> 1222 <title>uadmin remount</title> 1223 <program>/sbin/uadmin</program> 1224 <program>/usr/sbin/uadmin</program> 1225 <see>uadmin(1M)</see> 1226 <entry id="subject"> 1227 <internal token="subject"/> 1228 <external opt="none"/> 1229 </entry> 1230 <entry id="return"> 1231 <internal token="return"/> 1232 <external opt="none"/> 1233 </entry> 1234 </event> 1235 <!-- uadmin ftrace and swapctl are not documented in uadmin(2) --> 1236 <event id="AUE_uadmin_ftrace" instance_of="AUE_uadmin_generic" 1237 header="0" idNo="56" omit="JNI"> 1238 <title>uadmin ftrace</title> 1239 <program>/sbin/uadmin</program> 1240 <program>/usr/sbin/uadmin</program> 1241 <see>uadmin(1M)</see> 1242 </event> 1243 <event id="AUE_uadmin_swapctl" instance_of="AUE_uadmin_generic_fcn" 1244 header="0" idNo="57" omit="JNI"> 1245 <title>uadmin swapctl</title> 1246 <program>/sbin/uadmin</program> 1247 <program>/usr/sbin/uadmin</program> 1248 <see>uadmin(1M)</see> 1249 </event> 1250 <event id="AUE_uadmin_thaw" header="0" idNo="96" omit="JNI"> 1251 <title>thaw after freeze</title> 1252 <program>/sbin/uadmin</program> 1253 <program>/usr/sbin/uadmin</program> 1254 <see>uadmin(1M)</see> 1255 <entry id="subject"> 1256 <internal token="subject"/> 1257 <external opt="none"/> 1258 </entry> 1259 <entry id="fcn"> 1260 <internal token="text"/> 1261 <external opt="required" type="msg uadmin_fcn"/> 1262 <comment>freeze action type</comment> 1263 </entry> 1264 <entry id="return"> 1265 <internal token="return"/> 1266 <external opt="none"/> 1267 </entry> 1268 </event> 1269 <!-- uadmin config is not documented in uadmin(2) --> 1270 <event id="AUE_uadmin_config" instance_of="AUE_uadmin_generic" 1271 header="0" idNo="119" omit="JNI"> 1272 <title>uadmin config</title> 1273 <program>/sbin/uadmin</program> 1274 <program>/usr/sbin/uadmin</program> 1275 <see>uadmin(1M)</see> 1276 </event> 1277 1278<!-- smbd service event; smbd session setup --> 1279 <event id="AUE_smbd_session" header="0" idNo="58" omit="JNI"> 1280 <title>smbd</title> 1281 <program>/usr/lib/smbsrv/smbd</program> 1282 <entry id="subject"> 1283 <internal token="subject"/> 1284 <external opt="none"/> 1285 </entry> 1286 <entry id="domain"> 1287 <internal token="text"/> 1288 <external opt="required" type="char*"/> 1289 <comment>domain</comment> 1290 </entry> 1291 <entry id="username"> 1292 <internal token="text"/> 1293 <external opt="required" type="char*"/> 1294 <comment>username</comment> 1295 </entry> 1296 <entry id="sid"> 1297 <internal token="text"/> 1298 <external opt="optional" type="char*"/> 1299 <comment>sid</comment> 1300 </entry> 1301 <entry id="return"> 1302 <internal token="return"/> 1303 <external opt="none"/> 1304 </entry> 1305 </event> 1306 1307<!-- smbd service event; smbd session logoff --> 1308 <event id="AUE_smbd_logoff" header="0" idNo="59" omit="JNI"> 1309 <title>smbd</title> 1310 <program>/usr/lib/smbsrv/smbd</program> 1311 <entry id="subject"> 1312 <internal token="subject"/> 1313 <external opt="none"/> 1314 </entry> 1315 <entry id="domain"> 1316 <internal token="text"/> 1317 <external opt="required" type="char*"/> 1318 <comment>domain</comment> 1319 </entry> 1320 <entry id="username"> 1321 <internal token="text"/> 1322 <external opt="required" type="char*"/> 1323 <comment>username</comment> 1324 </entry> 1325 <entry id="return"> 1326 <internal token="return"/> 1327 <external opt="none"/> 1328 </entry> 1329 </event> 1330 1331<!-- vscan service event; infected file detected --> 1332 <event id="AUE_vscan_quarantine" header="0" idNo="60" omit="JNI"> 1333 <title>VSCAN: quarantine infected file</title> 1334 <program>/usr/lib/vscan/vscand</program> 1335 <see>vscand(1M), ICAP RFC 3507 (Extensions)</see> 1336 <entry id="subject"> 1337 <internal token="subject"/> 1338 <external opt="none"/> 1339 </entry> 1340 <entry id="file"> 1341 <internal token="path"/> 1342 <external opt="required" type="char*"/> 1343 <comment>infected file</comment> 1344 </entry> 1345 <entry id="violations,nviolations"> 1346 <internal token="text"/> 1347 <external opt="optional" type="char**,int"/> 1348 <comment>ID - threat description</comment> 1349 </entry> 1350 <entry id="return"> 1351 <internal token="return"/> 1352 <external opt="none"/> 1353 </entry> 1354 </event> 1355 1356<!-- ndmp service event; ndmp client connect --> 1357 <event id="AUE_ndmp_connect" instance_of="AUE_generic_basic" header="0" 1358 idNo="61" omit="JNI"> 1359 <title>NDMP Connect</title> 1360 <program>/usr/lib/ndmp/ndmpd</program> 1361 <see>ndmpd(1M)</see> 1362 </event> 1363 1364<!-- ndmp service event; ndmp client disconnect --> 1365 <event id="AUE_ndmp_disconnect" instance_of="AUE_generic_basic" header="0" 1366 idNo="62" omit="JNI"> 1367 <title>NDMP Disconnect</title> 1368 <program>/usr/lib/ndmp/ndmpd</program> 1369 <see>ndmpd(1M)</see> 1370 </event> 1371 1372<!-- ndmp service event; ndmp backup --> 1373 <event id="AUE_ndmp_backup" header="0" idNo="63" omit="JNI"> 1374 <title>NDMP Backup</title> 1375 <program>/usr/lib/ndmp/ndmpd</program> 1376 <see>ndmpd(1M)</see> 1377 <entry id="subject"> 1378 <internal token="subject"/> 1379 <external opt="none"/> 1380 </entry> 1381 <entry id="source"> 1382 <internal token="path"/> 1383 <external opt="required" type="char *"/> 1384 <comment>path to be backed up</comment> 1385 </entry> 1386 <entry id="local_dest"> 1387 <internal token="path"/> 1388 <external opt="optional" type="char *"/> 1389 <comment>local path of backup destination</comment> 1390 </entry> 1391 <entry id="remote_dest"> 1392 <internal token="in_peer"/> 1393 <external opt="optional" type="fd_t"/> 1394 <comment>remote ip address and port of backup destination</comment> 1395 </entry> 1396 <entry id="return"> 1397 <internal token="return"/> 1398 <external opt="none"/> 1399 </entry> 1400 </event> 1401 1402<!-- ndmp service event; ndmp restore --> 1403 <event id="AUE_ndmp_restore" header="0" idNo="64" omit="JNI"> 1404 <title>NDMP Restore</title> 1405 <program>/usr/lib/ndmp/ndmpd</program> 1406 <see>ndmpd(1M)</see> 1407 <entry id="subject"> 1408 <internal token="subject"/> 1409 <external opt="none"/> 1410 </entry> 1411 <entry id="destination"> 1412 <internal token="path"/> 1413 <external opt="required" type="char *"/> 1414 <comment>path to restore to</comment> 1415 </entry> 1416 <entry id="local_source"> 1417 <internal token="path"/> 1418 <external opt="optional" type="char *"/> 1419 <comment>local path to restore from</comment> 1420 </entry> 1421 <entry id="remote_source"> 1422 <internal token="in_peer"/> 1423 <external opt="optional" type="fd_t"/> 1424 <comment>remote ip address and port to restore from</comment> 1425 </entry> 1426 <entry id="return"> 1427 <internal token="return"/> 1428 <external opt="none"/> 1429 </entry> 1430 </event> 1431 1432<!-- SMF related events --> 1433 <event id="AUE_smf_generic" type="generic" omit="always"> 1434 <!-- 1435 This is a template for the event types that have no tokens 1436 other than the header and return. There is no allowed_type 1437 list because the template is not externally visible due to the 1438 omit="always". 1439 --> 1440 <entry id="subject"> 1441 <internal token="subject"/> 1442 <external opt="none"/> 1443 </entry> 1444 <entry id="auth_used"> 1445 <internal token="uauth"/> 1446 <external opt="required" type="char *"/> 1447 <comment>authorization used</comment> 1448 </entry> 1449 <entry id="fmri"> 1450 <internal token="fmri"/> 1451 <external opt="required" type="char *"/> 1452 <comment>name</comment> 1453 </entry> 1454 <entry id="return"> 1455 <internal token="return"/> 1456 <external opt="none"/> 1457 </entry> 1458 </event> 1459 1460 <event id="AUE_smf_generic_pg" type="generic" omit="always"> 1461 <!-- 1462 This is a template for the event types related to property groups. 1463 There is no allowed_type list because the template is not externally 1464 visible due to the omit="always". 1465 --> 1466 <entry id="subject"> 1467 <internal token="subject"/> 1468 <external opt="none"/> 1469 </entry> 1470 <entry id="auth_used"> 1471 <internal token="uauth"/> 1472 <external opt="required" type="char *"/> 1473 <comment>authorization used</comment> 1474 </entry> 1475 <entry id="fmri"> 1476 <internal token="fmri"/> 1477 <external opt="required" type="char *"/> 1478 </entry> 1479 <entry id="type"> 1480 <internal token="text"/> 1481 <external opt="required" type="char *"/> 1482 <comment>property group type</comment> 1483 </entry> 1484 <entry id="return"> 1485 <internal token="return"/> 1486 <external opt="none"/> 1487 </entry> 1488 </event> 1489 1490 <event id="AUE_smf_enable" instance_of="AUE_smf_generic" header="0" 1491 idNo="65" omit="JNI"> 1492 <program>svc.configd(1M)</program> 1493 <see>svcadm(1M)</see> 1494 </event> 1495 <event id="AUE_smf_tmp_enable" instance_of="AUE_smf_generic" header="0" 1496 idNo="66" omit="JNI"> 1497 <program>svc.configd(1M)</program> 1498 <see>svcadm(1M)</see> 1499 </event> 1500 <event id="AUE_smf_disable" instance_of="AUE_smf_generic" header="0" 1501 idNo="67" omit="JNI"> 1502 <program>svc.configd(1M)</program> 1503 <see>svcadm(1M)</see> 1504 </event> 1505 <event id="AUE_smf_tmp_disable" instance_of="AUE_smf_generic" header="0" 1506 idNo="68" omit="JNI"> 1507 <program>svc.configd(1M)</program> 1508 <see>svcadm(1M)</see> 1509 </event> 1510 <event id="AUE_smf_restart" instance_of="AUE_smf_generic" header="0" 1511 idNo="69" omit="JNI"> 1512 <program>svc.configd(1M)</program> 1513 <see>svcadm(1M)</see> 1514 </event> 1515 <event id="AUE_smf_refresh" instance_of="AUE_smf_generic" header="0" 1516 idNo="70" omit="JNI"> 1517 <program>svc.configd(1M)</program> 1518 <see>svcadm(1M)</see> 1519 </event> 1520 <event id="AUE_smf_clear" instance_of="AUE_smf_generic" header="0" 1521 idNo="71" omit="JNI"> 1522 <program>svc.configd(1M)</program> 1523 <see>svcadm(1M)</see> 1524 </event> 1525 <event id="AUE_smf_degrade" instance_of="AUE_smf_generic" header="0" 1526 idNo="72" omit="JNI"> 1527 <program>svc.configd(1M)</program> 1528 <see>svcadm(1M)</see> 1529 </event> 1530 <event id="AUE_smf_immediate_degrade" instance_of="AUE_smf_generic" 1531 header="0" idNo="73" omit="JNI"> 1532 <program>svc.configd(1M)</program> 1533 <see>svcadm(1M)</see> 1534 </event> 1535 <event id="AUE_smf_maintenance" instance_of="AUE_smf_generic" header="0" 1536 idNo="74" omit="JNI"> 1537 <program>svc.configd(1M)</program> 1538 <see>svcadm(1M)</see> 1539 </event> 1540 <event id="AUE_smf_immediate_maintenance" instance_of="AUE_smf_generic" 1541 header="0" idNo="75" omit="JNI"> 1542 <program>svc.configd(1M)</program> 1543 <see>svcadm(1M)</see> 1544 </event> 1545 <event id="AUE_smf_immtmp_maintenance" instance_of="AUE_smf_generic" 1546 header="0" idNo="76" omit="JNI"> 1547 <program>svc.configd(1M)</program> 1548 <see>svcadm(1M)</see> 1549 </event> 1550 <event id="AUE_smf_tmp_maintenance" instance_of="AUE_smf_generic" header="0" 1551 idNo="77" omit="JNI"> 1552 <program>svc.configd(1M)</program> 1553 <see>svcadm(1M)</see> 1554 </event> 1555 <event id="AUE_smf_milestone" instance_of="AUE_smf_generic" header="0" 1556 idNo="78" omit="JNI"> 1557 <program>svc.configd(1M)</program> 1558 <see>svcadm(1M)</see> 1559 </event> 1560 1561 <event id="AUE_smf_create" instance_of="AUE_smf_generic" header="0" 1562 idNo="79" omit="JNI"> 1563 <program>svc.configd(1M)</program> 1564 <see>svccfg(1M)</see> 1565 </event> 1566 <event id="AUE_smf_delete" instance_of="AUE_smf_generic" header="0" 1567 idNo="80" omit="JNI"> 1568 <program>svc.configd(1M)</program> 1569 <see>svccfg(1M)</see> 1570 </event> 1571 1572 <event id="AUE_smf_create_pg" instance_of="AUE_smf_generic_pg" header="0" 1573 idNo="81" omit="JNI"> 1574 <program>svc.configd(1M)</program> 1575 <see>svccfg(1M)</see> 1576 </event> 1577 <event id="AUE_smf_create_npg" instance_of="AUE_smf_generic_pg" header="0" 1578 idNo="82" omit="JNI"> 1579 <program>svc.configd(1M)</program> 1580 <see>svccfg(1M)</see> 1581 </event> 1582 <event id="AUE_smf_delete_pg" instance_of="AUE_smf_generic_pg" header="0" 1583 idNo="83" omit="JNI"> 1584 <program>svc.configd(1M)</program> 1585 <see>svccfg(1M)</see> 1586 </event> 1587 <event id="AUE_smf_delete_npg" instance_of="AUE_smf_generic_pg" header="0" 1588 idNo="84" omit="JNI"> 1589 <program>svc.configd(1M)</program> 1590 <see>svccfg(1M)</see> 1591 </event> 1592 1593 <event id="AUE_smf_create_snap" header="0" idNo="85" omit="JNI"> 1594 <program>svc.configd(1M)</program> 1595 <see>svccfg(1M)</see> 1596 <entry id="subject"> 1597 <internal token="subject"/> 1598 <external opt="none"/> 1599 </entry> 1600 <entry id="auth_used"> 1601 <internal token="uauth"/> 1602 <external opt="required" type="char *"/> 1603 <comment>authorization used</comment> 1604 </entry> 1605 <entry id="fmri"> 1606 <internal token="fmri"/> 1607 <external opt="required" type="char *"/> 1608 <comment>name</comment> 1609 </entry> 1610 <entry id="name"> 1611 <internal token="text"/> 1612 <external opt="required" type="char *"/> 1613 <comment>snapshot name</comment> 1614 </entry> 1615 <entry id="return"> 1616 <internal token="return"/> 1617 <external opt="none"/> 1618 </entry> 1619 </event> 1620 <event id="AUE_smf_delete_snap" header="0" idNo="86" omit="JNI"> 1621 <program>svc.configd(1M)</program> 1622 <see>svccfg(1M)</see> 1623 <entry id="subject"> 1624 <internal token="subject"/> 1625 <external opt="none"/> 1626 </entry> 1627 <entry id="auth_used"> 1628 <internal token="uauth"/> 1629 <external opt="required" type="char *"/> 1630 <comment>authorization used</comment> 1631 </entry> 1632 <entry id="fmri"> 1633 <internal token="fmri"/> 1634 <external opt="required" type="char *"/> 1635 <comment>name</comment> 1636 </entry> 1637 <entry id="name"> 1638 <internal token="text"/> 1639 <external opt="required" type="char *"/> 1640 <comment>snapshot name</comment> 1641 </entry> 1642 <entry id="return"> 1643 <internal token="return"/> 1644 <external opt="none"/> 1645 </entry> 1646 </event> 1647 <event id="AUE_smf_attach_snap" header="0" idNo="87" omit="JNI"> 1648 <program>svc.configd(1M)</program> 1649 <see>svccfg(1M)</see> 1650 <entry id="subject"> 1651 <internal token="subject"/> 1652 <external opt="none"/> 1653 </entry> 1654 <entry id="auth_used"> 1655 <internal token="uauth"/> 1656 <external opt="required" type="char *"/> 1657 <comment>authorization used</comment> 1658 </entry> 1659 <entry id="old_fmri"> 1660 <internal token="fmri"/> 1661 <external opt="required" type="char *"/> 1662 <comment>old name</comment> 1663 </entry> 1664 <entry id="old_name"> 1665 <internal token="text"/> 1666 <external opt="required" type="char *"/> 1667 <comment>old snapshot</comment> 1668 </entry> 1669 <entry id="new_fmri"> 1670 <internal token="fmri"/> 1671 <external opt="required" type="char *"/> 1672 <comment>new name</comment> 1673 </entry> 1674 <entry id="new_name"> 1675 <internal token="text"/> 1676 <external opt="required" type="char *"/> 1677 <comment>new snapshot</comment> 1678 </entry> 1679 <entry id="return"> 1680 <internal token="return"/> 1681 <external opt="none"/> 1682 </entry> 1683 </event> 1684 1685 <event id="AUE_smf_annotation" header="0" idNo="88" omit="JNI"> 1686 <program>svc.configd(1M)</program> 1687 <see>svccfg(1M)</see> 1688 <entry id="subject"> 1689 <internal token="subject"/> 1690 <external opt="none"/> 1691 </entry> 1692 <entry id="operation"> 1693 <internal token="text"/> 1694 <external opt="required" type="char *"/> 1695 <comment>operation</comment> 1696 </entry> 1697 <entry id="file"> 1698 <internal token="path"/> 1699 <external opt="required" type="char *"/> 1700 <comment>imported file</comment> 1701 </entry> 1702 <entry id="return"> 1703 <internal token="return"/> 1704 <external opt="none"/> 1705 </entry> 1706 </event> 1707 1708 <event id="AUE_smf_create_prop" header="0" idNo="89" omit="JNI"> 1709 <program>svc.configd(1M)</program> 1710 <see>svccfg(1M)</see> 1711 <entry id="subject"> 1712 <internal token="subject"/> 1713 <external opt="none"/> 1714 </entry> 1715 <entry id="auth_used"> 1716 <internal token="uauth"/> 1717 <external opt="required" type="char *"/> 1718 <comment>authorization used</comment> 1719 </entry> 1720 <entry id="fmri"> 1721 <internal token="fmri"/> 1722 <external opt="required" type="char *"/> 1723 <comment>name</comment> 1724 </entry> 1725 <entry id="type"> 1726 <internal token="text"/> 1727 <external opt="required" type="char *"/> 1728 <comment>type</comment> 1729 </entry> 1730 <entry id="value"> 1731 <internal token="text"/> 1732 <external opt="optional" type="char *"/> 1733 <comment>value</comment> 1734 </entry> 1735 <entry id="return"> 1736 <internal token="return"/> 1737 <external opt="none"/> 1738 </entry> 1739 </event> 1740 1741 <event id="AUE_smf_change_prop" header="0" idNo="90" omit="JNI"> 1742 <program>svc.configd(1M)</program> 1743 <see>svccfg(1M)</see> 1744 <entry id="subject"> 1745 <internal token="subject"/> 1746 <external opt="none"/> 1747 </entry> 1748 <entry id="auth_used"> 1749 <internal token="uauth"/> 1750 <external opt="required" type="char *"/> 1751 <comment>authorization used</comment> 1752 </entry> 1753 <entry id="fmri"> 1754 <internal token="fmri"/> 1755 <external opt="required" type="char *"/> 1756 <comment>name</comment> 1757 </entry> 1758 <entry id="type"> 1759 <internal token="text"/> 1760 <external opt="required" type="char *"/> 1761 <comment>type</comment> 1762 </entry> 1763 <entry id="value"> 1764 <internal token="text"/> 1765 <external opt="optional" type="char *"/> 1766 <comment>value</comment> 1767 </entry> 1768 <entry id="return"> 1769 <internal token="return"/> 1770 <external opt="none"/> 1771 </entry> 1772 </event> 1773 <event id="AUE_smf_delete_prop" header="0" idNo="91" omit="JNI"> 1774 <program>svc.configd(1M)</program> 1775 <see>svccfg(1M)</see> 1776 <entry id="subject"> 1777 <internal token="subject"/> 1778 <external opt="none"/> 1779 </entry> 1780 <entry id="auth_used"> 1781 <internal token="uauth"/> 1782 <external opt="required" type="char *"/> 1783 <comment>authorization used</comment> 1784 </entry> 1785 <entry id="fmri"> 1786 <internal token="fmri"/> 1787 <external opt="required" type="char *"/> 1788 <comment>name</comment> 1789 </entry> 1790 <entry id="return"> 1791 <internal token="return"/> 1792 <external opt="none"/> 1793 </entry> 1794 </event> 1795 1796 <event id="AUE_smf_read_prop" instance_of="AUE_smf_generic" header="0" 1797 idNo="92" omit="JNI"> 1798 <program>svc.configd(1M)</program> 1799 <see>svccfg(1M)</see> 1800 </event> 1801 1802<!-- CPUFreq related events --> 1803 1804 <event id="AUE_cpu_ondemand" header="0" idNo="93" omit="JNI"> 1805 <title>set CPU freq to minimal unless load increases</title> 1806 <program>/usr/lib/hal/hald-addon-cpufreq</program> 1807 <see>hald(1M)</see> 1808 <entry id="subject"> 1809 <internal token="subject"/> 1810 <external opt="none"/> 1811 </entry> 1812 <entry id="auth_used"> 1813 <internal token="uauth"/> 1814 <external opt="required" type="char *"/> 1815 <comment>authorization used</comment> 1816 </entry> 1817 <entry id="return"> 1818 <internal token="return"/> 1819 <external opt="none"/> 1820 </entry> 1821 </event> 1822 <event id="AUE_cpu_performance" header="0" idNo="94" omit="JNI"> 1823 <title>set CPU freq to Max</title> 1824 <program>/usr/lib/hal/hald-addon-cpufreq</program> 1825 <see>hald(1M)</see> 1826 <entry id="subject"> 1827 <internal token="subject"/> 1828 <external opt="none"/> 1829 </entry> 1830 <entry id="auth_used"> 1831 <internal token="uauth"/> 1832 <external opt="required" type="char *"/> 1833 <comment>authorization used</comment> 1834 </entry> 1835 <entry id="return"> 1836 <internal token="return"/> 1837 <external opt="none"/> 1838 </entry> 1839 </event> 1840 <event id="AUE_cpu_threshold" header="0" idNo="95" omit="JNI"> 1841 <title>set CPU frequency threshold percentage</title> 1842 <program>/usr/lib/hal/hald-addon-cpufreq</program> 1843 <see>hald(1M)</see> 1844 <entry id="subject"> 1845 <internal token="subject"/> 1846 <external opt="none"/> 1847 </entry> 1848 <entry id="auth_used"> 1849 <internal token="uauth"/> 1850 <external opt="required" type="char *"/> 1851 <comment>authorization used</comment> 1852 </entry> 1853 <entry id="threshold"> 1854 <internal token="text"/> 1855 <external opt="required" type="int"/> 1856 <comment>threshold percent 1-100</comment> 1857 </entry> 1858 <entry id="return"> 1859 <internal token="return"/> 1860 <external opt="none"/> 1861 </entry> 1862 </event> 1863 1864<!-- NWAM events --> 1865 1866 <event id="AUE_nwam_attach" header="0" idNo="97" omit="JNI"> 1867 <title>Network Autoconfig Client</title> 1868 <program>nwamd</program> 1869 <see>nwamd(1M)</see> 1870 <entry id="subject"> 1871 <internal token="subject"/> 1872 <external opt="none"/> 1873 </entry> 1874 <entry id="auth_used"> 1875 <internal token="uauth"/> 1876 <external opt="required" type="char *"/> 1877 <comment>authorization used</comment> 1878 </entry> 1879 <entry id="return"> 1880 <internal token="return"/> 1881 <external opt="none"/> 1882 </entry> 1883 </event> 1884 1885 <event id="AUE_nwam_detach" instance_of="AUE_generic_basic" header="0" 1886 idNo="98" omit="JNI"> 1887 <title>Network Autoconfig Client</title> 1888 <program>nwamd</program> 1889 <see>nwamd(1M)</see> 1890 </event> 1891 1892<!-- TPM events recorded by tcsd(8) --> 1893 1894 <event id="AUE_tpm_takeownership" instance_of="AUE_generic_basic" 1895 header="0" idNo="99" omit="JNI"> 1896 <title>TPM_TakeOwnership</title> 1897 <program>/usr/lib/tcsd</program> 1898 <see>tcsd(8)</see> 1899 </event> 1900 <event id="AUE_tpm_setoperatorauth" instance_of="AUE_generic_basic" 1901 header="0" idNo="100" omit="JNI"> 1902 <title>TPM_SetOperatorAuth</title> 1903 <program>/usr/lib/tcsd</program> 1904 <see>tcsd(8)</see> 1905 </event> 1906 <event id="AUE_tpm_setownerinstall" instance_of="AUE_generic_basic" 1907 header="0" idNo="101" omit="JNI"> 1908 <title>TPM_SetOwnerInstall</title> 1909 <program>/usr/lib/tcsd</program> 1910 <see>tcsd(8)</see> 1911 </event> 1912 <event id="AUE_tpm_selftestfull" instance_of="AUE_generic_basic" 1913 header="0" idNo="102" omit="JNI"> 1914 <title>TPM_SelfTestFull</title> 1915 <program>/usr/lib/tcsd</program> 1916 <see>tcsd(8)</see> 1917 </event> 1918 <event id="AUE_tpm_certifyselftest" instance_of="AUE_generic_basic" 1919 header="0" idNo="103" omit="JNI"> 1920 <title>TPM_CertifySelfTest</title> 1921 <program>/usr/lib/tcsd</program> 1922 <see>tcsd(8)</see> 1923 </event> 1924 <event id="AUE_tpm_continueselftest" instance_of="AUE_generic_basic" 1925 header="0" idNo="104" omit="JNI"> 1926 <title>TPM_ContinueSelfTest</title> 1927 <program>/usr/lib/tcsd</program> 1928 <see>tcsd(8)</see> 1929 </event> 1930 <event id="AUE_tpm_ownersetdisable" instance_of="AUE_generic_basic" 1931 header="0" idNo="105" omit="JNI"> 1932 <title>TPM_OwnerSetDisable</title> 1933 <program>/usr/lib/tcsd</program> 1934 <see>tcsd(8)</see> 1935 </event> 1936 <event id="AUE_tpm_ownerclear" instance_of="AUE_generic_basic" 1937 header="0" idNo="106" omit="JNI"> 1938 <title>TPM_OwnerClear</title> 1939 <program>/usr/lib/tcsd</program> 1940 <see>tcsd(8)</see> 1941 </event> 1942 <event id="AUE_tpm_disableownerclear" instance_of="AUE_generic_basic" 1943 header="0" idNo="107" omit="JNI"> 1944 <title>TPM_DisableOwnerClear</title> 1945 <program>/usr/lib/tcsd</program> 1946 <see>tcsd(8)</see> 1947 </event> 1948 <event id="AUE_tpm_forceclear" instance_of="AUE_generic_basic" 1949 header="0" idNo="108" omit="JNI"> 1950 <title>TPM_ForceClear</title> 1951 <program>/usr/lib/tcsd</program> 1952 <see>tcsd(8)</see> 1953 </event> 1954 <event id="AUE_tpm_disableforceclear" instance_of="AUE_generic_basic" 1955 header="0" idNo="109" omit="JNI"> 1956 <title>TPM_DisableForceClear</title> 1957 <program>/usr/lib/tcsd</program> 1958 <see>tcsd(8)</see> 1959 </event> 1960 <event id="AUE_tpm_physicaldisable" instance_of="AUE_generic_basic" 1961 header="0" idNo="110" omit="JNI"> 1962 <title>TPM_PhysicalDisable</title> 1963 <program>/usr/lib/tcsd</program> 1964 <see>tcsd(8)</see> 1965 </event> 1966 <event id="AUE_tpm_physicalenable" instance_of="AUE_generic_basic" 1967 header="0" idNo="111" omit="JNI"> 1968 <title>TPM_PhysicalEnsable</title> 1969 <program>/usr/lib/tcsd</program> 1970 <see>tcsd(8)</see> 1971 </event> 1972 <event id="AUE_tpm_physicaldeactivate" instance_of="AUE_generic_basic" 1973 header="0" idNo="112" omit="JNI"> 1974 <title>TPM_PhysicalSetDeactivated</title> 1975 <program>/usr/lib/tcsd</program> 1976 <see>tcsd(8)</see> 1977 </event> 1978 <event id="AUE_tpm_settempdeactivated" instance_of="AUE_generic_basic" 1979 header="0" idNo="113" omit="JNI"> 1980 <title>TPM_SetTempDeactivated</title> 1981 <program>/usr/lib/tcsd</program> 1982 <see>tcsd(8)</see> 1983 </event> 1984 <event id="AUE_tpm_physicalpresence" instance_of="AUE_generic_basic" 1985 header="0" idNo="114" omit="JNI"> 1986 <title>TPM_PhysicalPresence</title> 1987 <program>/usr/lib/tcsd</program> 1988 <see>tcsd(8)</see> 1989 </event> 1990 <event id="AUE_tpm_fieldupgrade" instance_of="AUE_generic_basic" 1991 header="0" idNo="115" omit="JNI"> 1992 <title>TPM_FieldUpgrade</title> 1993 <program>/usr/lib/tcsd</program> 1994 <see>tcsd(8)</see> 1995 </event> 1996 <event id="AUE_tpm_resetlockvalue" instance_of="AUE_generic_basic" 1997 header="0" idNo="116" omit="JNI"> 1998 <title>TPM_ResetLockValue</title> 1999 <program>/usr/lib/tcsd</program> 2000 <see>tcsd(8)</see> 2001 </event> 2002 2003<!-- add new events here with the next higher idNo --> 2004<!-- Highest idNo is 116, so next is 117, then fix this comment --> 2005<!-- end of C Only events --> 2006 2007<!-- 2008 token definitions are partially implemented. All they do for now 2009 is create a list of defined token names. In the future they may 2010 become a way of describing token structure. 2011--> 2012 2013 <token id="acl"> 2014 </token> 2015 <token id="arbitrary"> 2016 </token> 2017 <token id="arg"> 2018 </token> 2019 <token id="attr"> 2020 </token> 2021 <token id="command"> 2022 </token> 2023 <token id="command_alt"> 2024 </token> 2025 <token id="date"> 2026 </token> 2027 <token id="exec_args"> 2028 </token> 2029 <token id="exec_env"> 2030 </token> 2031 <token id="exit"> 2032 </token> 2033 <token id="file"> 2034 </token> 2035 <token id="fmri"> 2036 </token> 2037 <token id="groups"> 2038 </token> 2039 <!-- pseudo token; in_addr and in_port of peer --> 2040 <token id="in_peer"> 2041 </token> 2042 <token id="ipc"> 2043 </token> 2044 <token id="ipc_perm"> 2045 </token> 2046 <token id="label"> 2047 </token> 2048 <token id="newgroups"> 2049 </token> 2050 <token id="opaque"> 2051 </token> 2052 <token id="path"> 2053 </token> 2054 <!-- pseudo token; path list generates 0 or more path tokens --> 2055 <token id="path_list"> 2056 </token> 2057 <token id="tid"> 2058 </token> 2059 2060 <!-- 2061 privilege token is implemented as one of the pseudo tokens 2062 priv_limit, priv_effective, or priv_inherit 2063 2064 <token id="privilege"> 2065 </token> 2066 --> 2067 <token id="priv_effective"> 2068 </token> 2069 <token id="priv_inherit"> 2070 </token> 2071 <token id="priv_limit"> 2072 </token> 2073 <token id="process"> 2074 </token> 2075 <token id="return"> 2076 </token> 2077 <token id="seq"> 2078 </token> 2079 <token id="socket"> 2080 </token> 2081 <token id="socket-inet"> 2082 </token> 2083 <token id="subject"> 2084 </token> 2085 <token id="text"> 2086 </token> 2087 <token id="uauth"> 2088 </token> 2089 <token id="zonename"> 2090 </token> 2091 2092<!-- 2093 error value list for return values with success/fail code of fail. 2094 These values start at 1000 so praudit can tell the difference 2095 between the libbsm/common/audit_*.c broken error values and 2096 the new adt_ error value list. It is public so that praudit 2097 can find it. 2098 2099 praudit outputs "failure" %s" for these strings, so there is 2100 no need to use words such as "failed" in the message. 2101 2102 ** Add to the end only to maintain validity across versions of 2103 the audit log. ** 2104--> 2105 2106 <msg_list id="fail_value" header="0" start="1000" public="true"> 2107 <msg id="PW_ATTR">Attribute update</msg> 2108 <msg id="PW">Password update</msg> 2109 <msg id="USERNAME">bad username</msg> 2110 <msg id="AUTH">authorization failed</msg> 2111 <msg id="UID">bad uid</msg> 2112 <msg id="UNKNOWN">unknown failure</msg> 2113 <msg id="EXPIRED">password expired</msg> 2114 <msg id="ACCOUNT_LOCKED">Account is locked</msg> 2115 <msg id="BAD_DIALUP">Bad dial up</msg> 2116 <msg id="BAD_ID">Invalid ID</msg> 2117 <msg id="BAD_PW">Invalid password</msg> 2118 <msg id="CONSOLE">Not on console</msg> 2119 <msg id="MAX_TRIES">Too many failed attempts</msg> 2120 <msg id="PROTOCOL_FAILURE">Protocol failure</msg> 2121 <msg id="EXCLUDED_USER">Excluded user</msg> 2122 <msg id="ANON_USER">No anonymous</msg> 2123 <msg id="BAD_CMD">Invalid command</msg> 2124 <msg id="BAD_TTY">Standard input not a tty line</msg> 2125 <msg id="PROGRAM">Program failure</msg> 2126 <msg id="CHDIR_FAILED">chdir to home directory</msg> 2127 <msg id="INPUT_OVERFLOW">Input line too long.</msg> 2128 <msg id="DEVICE_PERM">login device override</msg> 2129 <msg id="AUTH_BYPASS">authorization bypass</msg> 2130 <msg id="LOGIN_DISABLED">login disabled</msg> 2131 </msg_list> 2132 2133<!-- 2134 The following empty list is used for PAM errors; the "start" 2135 value is used by praudit to know to use the PAM infrastructure 2136 for generating error strings 2137--> 2138 <msg_list id="fail_pam" header="0" start="2000" public="true"> 2139 </msg_list> 2140 2141<!-- 2142 This is still in use by SMC. See AUE_generic_login. When 2143 either SMC is fixed to stop using this, or SMC goes away. 2144 REMOVE this stuff and the corresponding AUE_generic_login 2145 message field. 2146 2147 Message list for the various authentication events, such 2148 as AUE_login and AUE_admin_authenticate. Add new entries 2149 at the end. The order of msg_list entries and the order 2150 of msg entries both affect the names in adt.h and the value 2151 of the associated enumerated types. 2152 2153 Each of these messages except NO_MSG is also in the failure_attribute 2154 list; the difference is that the messages below use a text token 2155 in the audit record, while the failure_attribute messages are 2156 associated with the return value of the return token. 2157 2158 This list is deprecated; please don't use text tokens for error 2159 messages. 2160--> 2161 2162 <msg_list id="login_text" header="0" deprecated="true"> 2163 <msg id="NO_MSG"></msg> 2164 <msg id="ACCOUNT_LOCKED">Account is locked</msg> 2165 <msg id="BAD_DIALUP">Bad dial up</msg> 2166 <msg id="BAD_ID">Invalid ID</msg> 2167 <msg id="BAD_PW">Invalid password</msg> 2168 <msg id="CONSOLE">Not on console</msg> 2169 <msg id="MAX_TRIES">Too many failed attempts</msg> 2170 <msg id="PROTOCOL_FAILURE">Protocol failure</msg> 2171 <msg id="EXCLUDED_USER">Excluded user</msg> 2172 <msg id="ANON_USER">No anonymous</msg> 2173 </msg_list> 2174 2175<!-- msg list for uadmin(1m) fcn argument (next action, see uadmin(2)) --> 2176 <msg_list id="uadmin_fcn" header="0" start="3000" public="true"> 2177 <msg id="AD_HALT">Halt the processor(s)</msg> 2178 <msg id="AD_POWEROFF">Halt the processor(s) and turn off the power</msg> 2179 <msg id="AD_BOOT">Reboot the system using the kernel file</msg> 2180 <msg id="AD_IBOOT">Interactive reboot</msg> 2181 <msg id="AD_SUSPEND_TO_DISK">Save the system state to the state file</msg> 2182 <msg id="AD_CHECK_SUSPEND_TO_DISK">Check if system supports suspend to disk</msg> 2183 <msg id="AD_FORCE">Force suspend to disk even when threads of user 2184 applications are not suspendable</msg> 2185 <msg id="AD_SUSPEND_TO_RAM">Save the system state to memory</msg> 2186 <msg id="AD_CHECK_SUSPEND_TO_RAM">Check if system supports suspend to memory</msg> 2187 <msg id="AD_SBOOT">Single-user reboot</msg> 2188 <msg id="AD_SIBOOT">Single-user interactive reboot</msg> 2189 <msg id="AD_NOSYNC">Do not sync filesystems on next A_DUMP</msg> 2190 <msg id="AD_FASTREBOOT">Reboot bypassing BIOS and boot loader</msg> 2191 <msg id="AD_FASTREBOOT_DRYRUN">Check if system supports reboot bypassing BIOS and boot loader</msg> 2192 <msg id="AD_UPDATE_BOOT_CONFIG">Update boot configuration parameters</msg> 2193 <msg id="AD_REUSEINIT">Prepare for AD_REUSABLE</msg> 2194 <msg id="AD_REUSABLE">Create reusable statefile</msg> 2195 <msg id="AD_REUSEFINI">Revert to normal CPR mode (not reusable)</msg> 2196 <msg id="AD_FTRACE_START">ftrace start</msg> 2197 <msg id="AD_FTRACE_STOP">ftrace stop</msg> 2198 </msg_list> 2199 2200 <msg_list id="tpm_e" header="0" start="4000" public="true"> 2201 <msg id="AUTHFAIL">Authentication failed</msg> 2202 <msg id="BADINDEX">The index to a PCR, DIR or other register is incorrect</msg> 2203 <msg id="BAD_PARAMETER">One or more parameter is bad</msg> 2204 <msg id="AUDITFAILURE">auditing of the operation failed.</msg> 2205 <msg id="CLEAR_DISABLED">clear operations now physical access</msg> 2206 <msg id="DEACTIVATED">The TPM is deactivated</msg> 2207 <msg id="DISABLED">The TPM is disabled</msg> 2208 <msg id="DISABLED_CMD">The target command has been disabled</msg> 2209 <msg id="FAIL">The operation failed</msg> 2210 <msg id="BAD_ORDINAL">The ordinal was unknown or inconsistent</msg> 2211 <msg id="INSTALL_DISABLED">The ability to install an owner is disabled</msg> 2212 <msg id="INVALID_KEYHANDLE">The key handle can not be interpreted</msg> 2213 <msg id="KEYNOTFOUND">The key handle points to an invalid key</msg> 2214 <msg id="INAPPROPRIATE_ENC">Unacceptable encryption scheme</msg> 2215 <msg id="MIGRATEFAIL">Migration authorization failed</msg> 2216 <msg id="INVALID_PCR_INFO">PCR information could not be interpreted</msg> 2217 <msg id="NOSPACE">No room to load key.</msg> 2218 <msg id="NOSRK">There is no SRK set</msg> 2219 <msg id="NOTSEALED_BLOB">An encrypted blob is invalid or was 2220 not created by this TPM</msg> 2221 <msg id="OWNER_SET">There is already an Owner </msg> 2222 <msg id="RESOURCES">The TPM has insufficient internal resources</msg> 2223 <msg id="SHORTRANDOM">A random string was too short</msg> 2224 <msg id="SIZE">The TPM does not have the space to perform the operation.</msg> 2225 <msg id="WRONGPCRVAL">The named PCR value does not match the current PCR value.</msg> 2226 <msg id="BAD_PARAM_SIZE">The paramSize argument has the incorrect value </msg> 2227 <msg id="SHA_THREAD">There is no existing SHA-1 thread.</msg> 2228 <msg id="SHA_ERROR">SHA-1 thread encountered an error.</msg> 2229 <msg id="FAILEDSELFTEST">Self-test has failed and the TPM has shutdown.</msg> 2230 <msg id="AUTH2FAIL">The auth for the second key failed authorization</msg> 2231 <msg id="BADTAG">The tag value sent to for a command is invalid</msg> 2232 <msg id="IOERROR">An IO error occurred transmitting information to the TPM</msg> 2233 <msg id="ENCRYPT_ERROR">The encryption process had a problem.</msg> 2234 <msg id="DECRYPT_ERROR">The decryption process did not complete.</msg> 2235 <msg id="INVALID_AUTHHANDLE">An invalid handle was used.</msg> 2236 <msg id="NO_ENDORSEMENT">The TPM does not a EK installed</msg> 2237 <msg id="INVALID_KEYUSAGE">The usage of a key is not allowed</msg> 2238 <msg id="WRONG_ENTITYTYPE">The submitted entity type is not allowed</msg> 2239 <msg id="INVALID_POSTINIT">The command was received in the wrong sequence</msg> 2240 <msg id="INAPPROPRIATE_SIG">Signed data cannot include additional DER information</msg> 2241 <msg id="BAD_KEY_PROPERTY">The key properties are not supported by this TPM</msg> 2242 <msg id="BAD_MIGRATION">The migration properties of this key are incorrect.</msg> 2243 <msg id="BAD_SCHEME">Incorrect signature or encryption scheme</msg> 2244 <msg id="BAD_DATASIZE">The size of the data parameter is bad</msg> 2245 <msg id="BAD_MODE">A mode parameter is bad</msg> 2246 <msg id="BAD_PRESENCE">physicalPresence or physicalPresenceLock bits have wrong value</msg> 2247 <msg id="BAD_VERSION">The TPM cannot perform this version of the capability</msg> 2248 <msg id="NO_WRAP_TRANSPORT">The TPM does not allow for wrapped transport sessions</msg> 2249 <msg id="AUDITFAIL_UNSUCCESSFUL">TPM audit construction failed for failed command</msg> 2250 <msg id="AUDITFAIL_SUCCESSFUL">TPM audit construction failed for successful command</msg> 2251 <msg id="NOTRESETABLE">PCR register does not have the resettable attribute</msg> 2252 <msg id="NOTLOCAL">PCR register requires locality</msg> 2253 <msg id="BAD_TYPE">Make identity blob not properly typed</msg> 2254 <msg id="INVALID_RESOURCE">Resource type does not match actual resource</msg> 2255 <msg id="NOTFIPS">Command only available when TPM is in FIPS mode</msg> 2256 <msg id="INVALID_FAMILY">The command is attempting to use an invalid family ID</msg> 2257 <msg id="NO_NV_PERMISSION">The permission to manipulate the NV storage is not available</msg> 2258 <msg id="REQUIRES_SIGN">The operation requires a signed command</msg> 2259 <msg id="KEY_NOTSUPPORTED">Wrong operation to load an NV key</msg> 2260 <msg id="AUTH_CONFLICT">NV_LoadKey blob requires both owner and blob authorization</msg> 2261 <msg id="AREA_LOCKED">The NV area is locked and not writable</msg> 2262 <msg id="BAD_LOCALITY">The locality is incorrect for the attempted operation</msg> 2263 <msg id="READ_ONLY">The NV area is read only and can't be written to</msg> 2264 <msg id="PER_NOWRITE">There is no protection on the write to the NV area</msg> 2265 <msg id="FAMILYCOUNT">The family count value does not match</msg> 2266 <msg id="WRITE_LOCKED">The NV area has already been written to</msg> 2267 <msg id="BAD_ATTRIBUTES">The NV area attributes conflict</msg> 2268 <msg id="INVALID_STRUCTURE">The tag and version are invalid or inconsistent</msg> 2269 <msg id="KEY_OWNER_CONTROL">The key evicted by the TPM Owner.</msg> 2270 <msg id="BAD_COUNTER">The counter handle is incorrect</msg> 2271 <msg id="NOT_FULLWRITE">The write is not a complete write of the area</msg> 2272 <msg id="CONTEXT_GAP">The gap between saved context counts is too large</msg> 2273 <msg id="MAXNVWRITES">Max number of NV writes without owner has been exceeded</msg> 2274 <msg id="NOOPERATOR">No operator AuthData value is set</msg> 2275 <msg id="RESOURCEMISSING">The resource pointed to by context is not loaded</msg> 2276 <msg id="DELEGATE_LOCK">The delegate administration is locked</msg> 2277 <msg id="DELEGATE_FAMILY">Attempt to manage a family other then the delegated family</msg> 2278 <msg id="DELEGATE_ADMIN">Delegation table management not enabled</msg> 2279 <msg id="TRANSPORT_NOTEXCLUSIVE">Command executed outside of exclusive transport session</msg> 2280 <msg id="OWNER_CONTROL">Attempt to context save a owner evict controlled key</msg> 2281 <msg id="DAA_RESOURCES">DAA command has no resources available to execute the command</msg> 2282 <msg id="DAA_INPUT_DATA0">The consistency check on DAA parameter inputData0 has failed.</msg> 2283 <msg id="DAA_INPUT_DATA1">The consistency check on DAA parameter inputData1 has failed.</msg> 2284 <msg id="DAA_ISSUER_SETTINGS">The consistency check on DAA_issuerSettings has failed.</msg> 2285 <msg id="DAA_TPM_SETTINGS">The consistency check on DAA_tpmSpecific has failed.</msg> 2286 <msg id="DAA_STAGE">Atomic process indicated by DAA command is not the expected process.</msg> 2287 <msg id="DAA_ISSUER_VALIDITY">Inconsistent issuer validity</msg> 2288 <msg id="DAA_WRONG_W">The consistency check on w has failed.</msg> 2289 <msg id="BAD_HANDLE">The handle is incorrect</msg> 2290 <msg id="BAD_DELEGATE">Delegation is not correct</msg> 2291 <msg id="BADCONTEXT">The context blob is invalid</msg> 2292 <msg id="TOOMANYCONTEXTS">Too many contexts held by the TPM</msg> 2293 <msg id="MA_TICKET_SIGNATURE">Migration authority signature validation failure</msg> 2294 <msg id="MA_DESTINATION">Migration destination not authenticated</msg> 2295 <msg id="MA_SOURCE">Migration source incorrect</msg> 2296 <msg id="MA_AUTHORITY">Incorrect migration authority</msg> 2297 <msg id="PERMANENTEK">Attempt to revoke the EK and the EK is not revocable</msg> 2298 <msg id="BAD_SIGNATURE">Bad signature of CMK ticket</msg> 2299 <msg id="NOCONTEXTSPACE">There is no room in the context list for additional contexts</msg> 2300 <msg id="RETRY">The TPM is too busy to respond to the command immediately</msg> 2301 <msg id="NEEDS_SELFTEST">SelfTestFull has not been run</msg> 2302 <msg id="DOING_SELFTEST">The TPM is currently executing a full selftest</msg> 2303 <msg id="DEFEND_LOCK_RUNNING">TPM is defending against dictionary attacks</msg> 2304 <!-- End TPM failure codes --> 2305 </msg_list> 2306</specification> 2307