xref: /titanic_44/usr/src/lib/libbsm/common/adt.xml (revision 2cbed7292737821015ab481353eb10e8346b2c05)
1<?xml version="1.0" standalone="yes"?>
2<!DOCTYPE specification SYSTEM "audit.dtd">
3<!--
4 CDDL HEADER START
5
6 The contents of this file are subject to the terms of the
7 Common Development and Distribution License (the "License").
8 You may not use this file except in compliance with the License.
9
10 You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
11 or http://www.opensolaris.org/os/licensing.
12 See the License for the specific language governing permissions
13 and limitations under the License.
14
15 When distributing Covered Code, include this CDDL HEADER in each
16 file and include the License file at usr/src/OPENSOLARIS.LICENSE.
17 If applicable, add the following below this CDDL HEADER, with the
18 fields enclosed by brackets "[]" replaced with your own identifying
19 information: Portions Copyright [yyyy] [name of copyright owner]
20
21 CDDL HEADER END
22
23Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
24Use is subject to license terms.
25
26  ident	"%Z%%M%	%I%	%E% SMI"
27-->
28
29<specification>
30
31<!-- comments are displayed to stderr if debug is on -->
32<debug set="off"/>
33
34    <!-- The order of events is arbitrary EXCEPT generic events must
35	 precede their instances -->
36       <!-- The order of entries within an event determine the order
37            data is defined in the external API -->
38	    <!-- The order of internal / external is arbitrary -->
39
40<!--
41	tags:
42			The following top level tags are defined:
43			<event> <token> <msg_list> <debug>
44
45	event		defines an audit record
46			- id is the record id from audit_uevents.h
47			- reorder="yes" or "no".  (default is "no").
48			  if "yes" then the order of the tokens to be
49			  output does not match the order of the data
50			  input.  (see order attribute of <entry>)
51			- header defines the header file to contain the external
52			  definitions for this event type.  The header file
53			  name is adt_event_N.h, where N is the value supplied
54			  header="0" is for "stable" events, > 0 for new ones.
55			  with this attribute. (header="1").
56			- idNo is the number associated with the external
57			  name of this event. (For AUE_login, ADT_login is
58			  the external name and idNo is the value for
59			  ADT_login.)
60			- omit is by default 'no' (i.e., don't omit) and can be
61			  'always' or 'JNI'.  In the latter case, C interface
62			  code is generated but neither Java nor JNI code is.
63			- included text is just a comment
64			Within an event block, the following tags are defined:
65			<entry>, <debug>, <altname>, <title>, <program>, <see>
66
67	altname		defines the internal name of an audit record; if
68			omitted, the internal name is the same as the
69			external name.
70
71	title,		these tags are used by bsmrecord build to create
72	program,	audit_record_attr database from adt events.
73	see		Following example demonstrates their semantics:
74
75			bsmrecord -p passwd
76			passwd		<-   <title>
77			  program     various              See passwd(1)
78			  		^-   <program>		^-   <see>
79			  event ID    6163                 AUE_passwd
80			  class       lo                   (0x00001000)
81			      header
82			      subject
83			      [text]                       username...
84			      					^-   <comment>
85			      return
86
87	entry		defines the correspondence between the data
88			supplied by the caller and the token to be
89			output.
90			- id is the data name that shows up in the structures
91			  of adt_event.h  If it is a comma separated list,
92			  it is the list of names of data to be associated
93			  with one output token.  (See <external>, below)
94			Within an entry block, the following tags are defined:
95			<internal>, <external>, <debug>, <comment>
96
97	internal	defines the token to be generated.
98			- token is a name that must also be defined with
99			  a <token> tag elsewhere in this file.  (order is
100			  not important).
101			- order="some number" determines the order of the
102			  tokens to be output, starting with 1.  The subject
103			  token is normally order="1".  The use is to insure
104			  that the order of fields listed in adt_event.h does
105			  not change when we arbitrarily change the order of
106			  tokens.  If the <event reorder="yes"> is not set,
107			  order is ignored.
108			- format is a printf-like string that will be used
109			  in to format the data supplied by the user.
110
111	external	defines the data to be supplied for creating the
112			token defined via <internal>
113			- opt is one of four values:  "required", "optional",
114			  "obsolete", or "none".  The first two values
115			  indicate that this token's data must or may
116			  be supplied by the user; the third value is
117			  equivalent to "optional" but shows in the
118			  comment that this field is no longer used;
119			  the forth value indicates that this token
120			  does not require any user-supplied data.  If
121			  data is required, then a token is always
122			  output, while optional data is output only
123			  if data is supplied.
124			- type describes the C data type to be associated
125			  with the <entry id="dataName">.  The following
126			  data types are representative:
127
128				au_asid_t (uint32_t)
129				char
130				char * (blank is optional)
131				char ** (blank is optional)
132				uint_t, int, int32_t, uid_t, gid_t
133				uid_t *, gid_t *
134				long, ulong_t
135				m_label_t *
136				pid_t
137				priv_set_t *
138				uint16_t, unit32_t, uint64_t
139				uint32_t *, uint32_t[], uint64_t *
140				msg  (not a C type, see below)
141
142			Below is what Tony said.  Above seems to be
143			what is implemented
144				char
145				char * (blank is optional)
146				char ** (blank is optional)
147				int, uid_t, gid_t
148				int *, uid_t *, gid_t *
149				msg  (not a C type, see below)
150				time_t
151				uint, uint *
152
153			  The msg type refers to an enumerated type
154			  that must be defined via a <msg> description
155			  else where in this file. The syntax is
156			  special.  Example: <external opt="optional"
157			  type="msg login_text"/> "login_text" is the
158			  id of a <msg_list> descriptor given
159			  elsewhere in this file.
160
161			If the <entry> id is a list, the type must also
162			be a comma-separated list, where the types are
163			in the same order as the id's.
164			If the type is an array, its length must be given
165			explicitly.
166
167	comment		Used by bsmrecord build to generate audit_record_attr.
168			Comment is explanation note printed with token type.
169			See example above for other tags related to bsmrecord.
170
171	token		Define allowed token names.
172			- id is the name of token; this name is used
173			as an <internal> id.
174			- usage is an optional value.  At present, only
175			  "TSOL" is defined; it means that this data is
176			  to be used only in Trusted Solaris implementations.
177
178	msg_list	Define a set of text strings.
179			- id is the name to be used for this group of text
180			  strings in adt_event.h
181			- header is as defined for <event>
182			Within a msg_list block, <msg> and <debug> are defined.
183			The order of <msg> tags in a msg_list is reflected
184			directly in adt_event.h
185
186	msg		Define one string.
187			- id is the name to be used in the enum describing
188			  this set of strings.  Convention:  use upper case.
189			The content (text between <msg> and </msg>) is the
190			actual string.  Extra white space, including line
191			feeds, is ignored.  If empty, no output token
192			is generated unless the <external> opt attribute is
193			set to "required", in which case a blank text token
194			is generated.
195			Within a msg block, <debug> is defined, but has not been
196			tested and may have no effect.
197
198	debug		This turns on/off debug messages during the processing
199			of the xml data.  It affects the block within which it
200			is defined.
201			- set may have one of two values:  "on" or "off".  If
202			  set is omitted, the debug state for the current block
203			  is toggled.
204			The use of the <debug> tag does not affect the output
205			of data to the various files created, but does generate
206			potentially large amounts of output to stderr.
207
208-->
209<!--        template for an event record definition
210
211    <event id="" header="0" idNo="">
212	<entry id="subject">
213	    <internal token="subject"/>
214	    <external opt="none"/>
215	</entry>
216	<entry id="">
217	    <internal token=""/>
218	    <external opt="" type="" />
219	</entry>
220	<entry id="return">
221	    <internal token="return"/>
222	    <external opt="none"/>
223	</entry>
224    </event>
225
226    Generic events must precede Instance events; within each
227    group, please group the AUE_* by area and event idNo-s in order,
228    gaps in idNo-s are OK.
229    N.B. Renumbering idNo-s requires recompilation of consumers.  See
230    the contracts for whom to notify if/when this happens.
231-->
232
233<!-- generic events  -->
234
235    <!--
236	'omit="always"' means that this record type is not reflected
237	in the generated header and table files.
238     -->
239
240    <event id="AUE_generic_basic" type="generic" omit="always">
241	<!--
242
243	This is a template for the event types that have no tokens
244	other than the header and return. There is no allowed_type
245	list because the template is not externally visible due to the
246	omit="always".
247
248	-->
249	<entry id="subject">
250	    <internal token="subject"/>
251	    <external opt="none"/>
252	</entry>
253	<entry id="return">
254	    <internal token="return"/>
255	    <external opt="none"/>
256	</entry>
257    </event>
258
259    <event id="AUE_generic_login" type="generic" omit="always">
260	<!--
261
262	This is a template for the various login event types
263	AUE_login, AUE_ftp, etc which match this template.  There is
264	no allowed_type list because the template is not externally
265	visible due to the omit="always".
266
267	-->
268	<entry id="subject">
269	    <internal token="subject"/>
270	    <external opt="none"/>
271	</entry>
272
273	<!--	This field is still in use for SMC until it is cleaned up,
274		it must remain, see login_text msg list at the end of the
275		file.
276	-->
277	<entry id="message">
278	    <internal token="text"/>
279	    <external opt="optional" type="msg login_text"/>
280	    <comment>error message</comment>
281	</entry>
282	<entry id="return">
283	    <internal token="return"/>
284	    <external opt="none"/>
285	</entry>
286    </event>
287
288<!-- generic SMC events  -->
289
290    <event id="AUE_generic_SMC_add" type="generic" omit="always">
291	<entry id="subject">
292	    <internal token="subject"/>
293	    <external opt="none"/>
294	</entry>
295	<entry id="object_name">
296	    <internal token="text"/>
297	    <external opt="required" type="char *"/>
298	    <comment>object name</comment>
299	</entry>
300	<entry id="domain">
301	    <internal token="text"/>
302	    <external opt="optional" type="char *"/>
303	    <comment>domain</comment>
304	</entry>
305	<entry id="name_service">
306	    <internal token="text"/>
307	    <external opt="required" type="char *"/>
308	    <comment>name_service</comment>
309	</entry>
310	<entry id="auth_used">
311	    <internal token="uauth"/>
312	    <external opt="optional" type="char *"/>
313	    <comment>authorization used</comment>
314	</entry>
315	<!--
316	  This should really be its own token type, not "text"
317	-->
318	<entry id="initial_values">
319	    <internal token="text"/>
320	    <external opt="required" type="char *"/>
321	    <comment>initial values</comment>
322	</entry>
323	<entry id="return">
324	    <internal token="return"/>
325	    <external opt="none"/>
326	</entry>
327    </event>
328
329    <event id="AUE_generic_SMC_delete" type="generic" omit="always">
330	<entry id="subject">
331	    <internal token="subject"/>
332	    <external opt="none"/>
333	</entry>
334	<entry id="object_name">
335	    <internal token="text"/>
336	    <external opt="required" type="char *"/>
337	    <comment>object name</comment>
338	</entry>
339	<entry id="domain">
340	    <internal token="text"/>
341	    <external opt="optional" type="char *"/>
342	    <comment>domain</comment>
343	</entry>
344	<entry id="name_service">
345	    <internal token="text"/>
346	    <external opt="required" type="char *"/>
347	    <comment>name_service</comment>
348	</entry>
349	<entry id="auth_used">
350	    <internal token="uauth"/>
351	    <external opt="optional" type="char *"/>
352	    <comment>authorization used</comment>
353	</entry>
354	<entry id="delete_values">
355	    <internal token="text"/>
356	    <external opt="required" type="char *"/>
357	    <comment>deleted values</comment>
358	</entry>
359	<entry id="return">
360	    <internal token="return"/>
361	    <external opt="none"/>
362	</entry>
363    </event>
364
365    <event id="AUE_generic_SMC_modify" type="generic" omit="always">
366	<entry id="subject">
367	    <internal token="subject"/>
368	    <external opt="none"/>
369	</entry>
370	<entry id="object_name">
371	    <internal token="text"/>
372	    <external opt="required" type="char *"/>
373	    <comment>object name</comment>
374	</entry>
375	<entry id="domain">
376	    <internal token="text"/>
377	    <external opt="optional" type="char *"/>
378	    <comment>domain</comment>
379	</entry>
380	<entry id="name_service">
381	    <internal token="text"/>
382	    <external opt="required" type="char *"/>
383	    <comment>name_service</comment>
384	</entry>
385	<entry id="auth_used">
386	    <internal token="uauth"/>
387	    <external opt="optional" type="char *"/>
388	    <comment>authorization used</comment>
389	</entry>
390	<entry id="changed_values">
391	    <internal token="text"/>
392	    <external opt="required" type="char *"/>
393	    <comment>changed values</comment>
394	</entry>
395	<entry id="return">
396	    <internal token="return"/>
397	    <external opt="none"/>
398	</entry>
399    </event>
400
401<!-- instances -->
402
403<!--
404	Java needed for SMC events.  Since the SMC events grow less
405	often than the C related events.  They come first.  It
406	would be nice to reorder the idNo-s, but that's an ABI
407	change and should rev libbsm version no.  If reordered
408	start with 1 and eliminate the comment at the end about
409	the highest idNo.
410-->
411    <event id="AUE_admin_authenticate" instance_of="AUE_generic_login"
412	header="0" idNo="3">
413	<title>Admin Server Authentication</title>
414	<program>admin (various)</program>
415	<see>SMC, WBEM, or AdminSuite</see>
416    </event>
417
418    <event id="AUE_filesystem_add" instance_of="AUE_generic_SMC_add"
419	header="0" idNo="4">
420	<title>SMC: filesystem add</title>
421	<program>SMC server</program>
422    </event>
423    <event id="AUE_filesystem_delete" instance_of="AUE_generic_SMC_delete"
424	header="0" idNo="5">
425	<title>SMC: filesystem delete</title>
426	<program>SMC server</program>
427    </event>
428    <event id="AUE_filesystem_modify" instance_of="AUE_generic_SMC_modify"
429	header="0" idNo="6">
430	<title>SMC: filesystem modify</title>
431	<program>SMC server</program>
432    </event>
433
434    <event id="AUE_network_add" instance_of="AUE_generic_SMC_add"
435	header="0" idNo="7">
436	<title>SMC: network add</title>
437	<program>SMC server</program>
438    </event>
439    <event id="AUE_network_delete" instance_of="AUE_generic_SMC_delete"
440	header="0" idNo="8">
441	<title>SMC: network delete</title>
442	<program>SMC server</program>
443    </event>
444    <event id="AUE_network_modify" instance_of="AUE_generic_SMC_modify"
445	header="0" idNo="9">
446	<title>SMC: network modify</title>
447	<program>SMC server</program>
448    </event>
449
450    <event id="AUE_printer_add" instance_of="AUE_generic_SMC_add"
451	header="0" idNo="10">
452	<title>SMC: printer add</title>
453	<program>SMC server</program>
454    </event>
455    <event id="AUE_printer_delete" instance_of="AUE_generic_SMC_delete"
456	header="0" idNo="11">
457	<title>SMC: printer delete</title>
458	<program>SMC server</program>
459    </event>
460    <event id="AUE_printer_modify" instance_of="AUE_generic_SMC_modify"
461	header="0" idNo="12">
462	<title>SMC: printer modify</title>
463	<program>SMC server</program>
464    </event>
465
466<!--
467	This is SMC; it's also used in su and should probably be used in
468	desktop role login.  If we fix the SMC to not record NO_MSG here,
469	we can fix to record failed user.  See su.c and AUE_su.
470-->
471    <event id="AUE_role_login" instance_of="AUE_generic_login"
472	header="0" idNo="13">
473	<title>RBAC: role login</title>
474	<program>SMC server</program>
475	<program>/usr/bin/su</program>
476    </event>
477
478    <event id="AUE_scheduledjob_add" instance_of="AUE_generic_SMC_add"
479	header="0" idNo="14">
480	<title>SMC: scheduled job add</title>
481	<program>SMC server</program>
482    </event>
483    <event id="AUE_scheduledjob_delete" instance_of="AUE_generic_SMC_delete"
484	header="0" idNo="15">
485	<title>SMC: scheduled job delete</title>
486	<program>SMC server</program>
487    </event>
488    <event id="AUE_scheduledjob_modify" instance_of="AUE_generic_SMC_modify"
489	header="0" idNo="16">
490	<title>SMC: scheduled job modify</title>
491	<program>SMC server</program>
492    </event>
493
494    <event id="AUE_serialport_add" instance_of="AUE_generic_SMC_add"
495	header="0" idNo="17">
496	<title>SMC: serial port add</title>
497	<program>SMC server</program>
498    </event>
499    <event id="AUE_serialport_delete" instance_of="AUE_generic_SMC_delete"
500	header="0" idNo="18">
501	<title>SMC: serial port delete</title>
502	<program>SMC server</program>
503    </event>
504    <event id="AUE_serialport_modify" instance_of="AUE_generic_SMC_modify"
505	header="0" idNo="19">
506	<title>SMC: serial port modify</title>
507	<program>SMC server</program>
508    </event>
509
510<!-- This is SMC; should this also be used elsewhere? -->
511    <event id="AUE_uauth" header="0" idNo="20">
512    	<title>SMC: Use of Authorization</title>
513	<program>SMC server</program>
514	<entry id="subject">
515	    <internal token="subject"/>
516	    <external opt="none"/>
517	</entry>
518	<entry id="auth_used">
519	    <internal token="uauth"/>
520	    <external opt="required" type="char *"/>
521	    <comment>authorization used</comment>
522	</entry>
523	<entry id="objectname">
524	    <internal token="text"/>
525	    <external opt="required" type="char *"/>
526	    <comment>object name</comment>
527	</entry>
528	<entry id="return">
529	    <internal token="return"/>
530	    <external opt="none"/>
531	</entry>
532    </event>
533
534    <event id="AUE_usermgr_add" instance_of="AUE_generic_SMC_add"
535	header="0" idNo="21">
536	<title>SMC: User Manager add</title>
537	<program>SMC server</program>
538    </event>
539    <event id="AUE_usermgr_delete" instance_of="AUE_generic_SMC_delete"
540	header="0" idNo="22">
541	<title>SMC: User Manager delete</title>
542	<program>SMC server</program>
543    </event>
544    <event id="AUE_usermgr_modify" instance_of="AUE_generic_SMC_modify"
545	header="0" idNo="23">
546	<title>SMC: User Manager modify</title>
547	<program>SMC server</program>
548    </event>
549<!-- end of Java needed for SMC events -->
550<!--
551    while not used by SMC logout is used by Lockhart
552-->
553    <event id="AUE_logout" header="0" idNo="1">
554    	<title>login: logout</title>
555	<program>various</program>
556	<see>login(1)</see>
557	<entry id="subject">
558	    <internal token="subject"/>
559	    <external opt="none"/>
560	</entry>
561<!--
562    not used by C code, used by Lockhart,
563    get them to change and remove
564    event.user_name("logout " + session.getUserName());
565    from /ws/lockhart-nv-gate/src/bundled/app/webmgt/lib/services/
566    com/sun/management/services/audit/SolarisAuditEvent_Logout.java
567-->
568	<entry id="user_name">
569	    <internal token="text" format="logout %s"/>
570	    <external opt="optional" type="char *"/>
571	    <comment>"logout" username</comment>
572	</entry>
573	<entry id="return">
574	    <internal token="return"/>
575	    <external opt="none"/>
576	</entry>
577    </event>
578
579
580<!-- C Only events -->
581    <event id="AUE_init_solaris" header="0" idNo="32" omit="JNI">
582    	<title>init</title>
583	<program>/sbin/init</program>
584	<program>/usr/sbin/init</program>
585	<program>/usr/sbin/shutdown</program>
586	<entry id="subject">
587	    <internal token="subject"/>
588	    <external opt="none"/>
589	</entry>
590	<entry id="info">
591	    <internal token="text"/>
592	    <external opt="optional" type="char *"/>
593	    <comment>init level or zone name</comment>
594	</entry>
595	<entry id="return">
596	    <internal token="return"/>
597	    <external opt="none"/>
598	</entry>
599    </event>
600
601    <event id="AUE_login" instance_of="AUE_generic_login" header="0"
602	idNo="25" omit="JNI">
603	<title>terminal login</title>
604	<program>/usr/sbin/login</program>
605	<program>/usr/dt/bin/dtlogin</program>
606	<see>login(1)</see>
607	<see>dtlogin</see>
608    </event>
609    <event id="AUE_rlogin" instance_of="AUE_generic_login" header="0"
610	idNo="28" omit="JNI">
611	<title>rlogin</title>
612	<program>/usr/sbin/login</program>
613	<see>login(1) - rlogin</see>
614    </event>
615    <event id="AUE_telnet" instance_of="AUE_generic_login" header="0"
616	idNo="29" omit="JNI">
617	<title>telnet login</title>
618	<program>/usr/sbin/login</program>
619	<see>login(1) - telnet</see>
620    </event>
621    <event id="AUE_ssh" instance_of="AUE_generic_login" header="0"
622	idNo="2" omit="JNI">
623	<program>/usr/lib/ssh/sshd</program>
624    </event>
625
626    <event id="AUE_zlogin" header="0" idNo="38" omit="JNI">
627    	<title>zone login</title>
628	<program>/usr/sbin/login</program>
629	<see>zlogin(1)</see>
630	<entry id="subject">
631	    <internal token="subject"/>
632	    <external opt="none"/>
633	</entry>
634	<entry id="message">
635	    <internal token="text"/>
636	    <external opt="optional" type="char *"/>
637	    <comment>error message</comment>
638	</entry>
639	<entry id="return">
640	    <internal token="return"/>
641	    <external opt="none"/>
642	</entry>
643    </event>
644
645    <event id="AUE_su" header="0" idNo="30" omit="JNI">
646    	<title>su</title>
647	<program>/usr/bin/su</program>
648	<see>su(1M)</see>
649	<entry id="subject">
650	    <internal token="subject"/>
651	    <external opt="none"/>
652	</entry>
653<!--
654	should be changed to "fail_user" and su.c updated
655	However, the jni stuff is broken, so for now it's "message"
656-->
657	<entry id="message">
658	    <internal token="text"/>
659	    <external opt="optional" type="char *"/>
660	    <comment>"user name" of failed new user/role</comment>
661	</entry>
662	<entry id="return">
663	    <internal token="return"/>
664	    <external opt="none"/>
665	</entry>
666    </event>
667
668    <event id="AUE_passwd" header="0" idNo="27" omit="JNI">
669    	<title>passwd</title>
670	<program>various</program>
671	<see>passwd(1)</see>
672	<entry id="subject">
673	    <internal token="subject"/>
674	    <external opt="none"/>
675	</entry>
676	<entry id="username">
677	    <internal token="text"/>
678	    <external opt="optional" type="char *"/>
679	    <comment>username if different than caller</comment>
680	</entry>
681	<entry id="return">
682	    <internal token="return"/>
683	    <external opt="none"/>
684	</entry>
685    </event>
686
687    <event id="AUE_screenlock" instance_of="AUE_generic_basic" header="0"
688	idNo="26" omit="JNI">
689	<program>desktop screen lock</program>
690    </event>
691    <event id="AUE_screenunlock" instance_of="AUE_generic_basic" header="0"
692	idNo="31" omit="JNI">
693	<program>desktop screen unlock</program>
694    </event>
695
696    <!--
697	AUE_prof_cmd is not supportable for Java due to the structure of
698	the priv token.  When and if a Java program needs to generate
699	a priv token, we'll need to look at the data format in the
700	Java code and provide an appropriate java and jni implementation.
701    -->
702
703    <event id="AUE_prof_cmd" header="0" idNo="24" omit="JNI">
704    	<title>pfexec</title>
705	<program>/usr/bin/pfexec</program>
706	<see>pfexec(1)</see>
707	<entry id="subject">
708	    <internal token="subject"/>
709	    <external opt="none"/>
710	</entry>
711	<entry id="cwdpath">
712	    <internal token="path"/>
713	    <external opt="required" type="char*"/>
714	    <comment>working directory</comment>
715	</entry>
716	<entry id="cmdpath">
717	    <internal token="path"/>
718	    <external opt="required" type="char*"/>
719	    <comment>command pathname</comment>
720	</entry>
721	<entry id="argc,argv,envp">
722	    <internal token="command"/>
723	    <external opt="required" type="int,char**,char**"/>
724	</entry>
725	<entry id="proc_auid,proc_euid,proc_egid,proc_ruid,proc_rgid,proc_pid,proc_sid,proc_termid">
726	    <internal token="process"/>
727	    <external opt="required"
728		type="uid_t,uid_t,gid_t,uid_t,gid_t,pid_t,au_asid_t,termid*"/>
729	</entry>
730	<entry id="limit_set">
731	    <internal token="priv_limit"/>
732	    <external opt="optional" type="priv_set_t*"/>
733 	</entry>
734	<entry id="inherit_set">
735	    <internal token="priv_inherit"/>
736	    <external opt="optional" type="priv_set_t*"/>
737	</entry>
738	<entry id="return">
739	    <internal token="return"/>
740	    <external opt="none"/>
741	</entry>
742    </event>
743
744    <event id="AUE_inetd_connect" header="0" idNo="34" omit="JNI">
745    	<title>inetd</title>
746	<program>/usr/sbin/inetd</program>
747	<entry id="subject">
748	    <internal token="subject"/>
749	    <external opt="none"/>
750	</entry>
751	<entry id="service_name">
752	    <internal token="text"/>
753	    <external opt="optional" type="char *"/>
754	    <comment>service name</comment>
755	</entry>
756	<entry id="ip_type,ip_remote_port,ip_local_port,ip_adr">
757	    <internal token="tid"/>
758	    <external opt="required"
759		type="uint32_t,uint16_t,uint16_t,uint32_t[4]"/>
760	    <comment>client address</comment>
761	</entry>
762	<entry id="cmd">
763	    <internal token="command_1"/>
764	    <external opt="required" type="char *"/>
765	    <comment>inetd command</comment>
766	</entry>
767	<entry id="privileges">
768	    <internal token="priv_effective"/>
769	    <external opt="required" type="priv_set_t *"/>
770	</entry>
771	<entry id="return">
772	    <internal token="return"/>
773	    <external opt="none"/>
774	</entry>
775    </event>
776
777    <event id="AUE_inetd_ratelimit" header="0" idNo="35" omit="JNI">
778    	<title>inetd</title>
779	<program>/usr/sbin/inetd</program>
780	<entry id="subject">
781	    <internal token="subject"/>
782	    <external opt="none"/>
783	</entry>
784	<entry id="service_name">
785	    <internal token="text"/>
786	    <external opt="optional" type="char *"/>
787	    <comment>service name</comment>
788	</entry>
789	<entry id="limit">
790	    <internal token="text"/>
791	    <external opt="required" type="char *"/>
792	    <comment>limit value</comment>
793	</entry>
794	<entry id="return">
795	    <internal token="return"/>
796	    <external opt="none"/>
797	</entry>
798    </event>
799
800    <event id="AUE_inetd_copylimit" header="0" idNo="36" omit="JNI">
801    	<title>inetd</title>
802	<program>/usr/sbin/inetd</program>
803	<entry id="subject">
804	    <internal token="subject"/>
805	    <external opt="none"/>
806	</entry>
807	<entry id="service_name">
808	    <internal token="text"/>
809	    <external opt="optional" type="char *"/>
810	    <comment>service name</comment>
811	</entry>
812	<entry id="limit">
813	    <internal token="text"/>
814	    <external opt="required" type="char *"/>
815	    <comment>limit value</comment>
816	</entry>
817	<entry id="return">
818	    <internal token="return"/>
819	    <external opt="none"/>
820	</entry>
821    </event>
822
823    <event id="AUE_inetd_failrate" header="0" idNo="37" omit="JNI">
824    	<title>inetd</title>
825	<program>/usr/sbin/inetd</program>
826	<entry id="subject">
827	    <internal token="subject"/>
828	    <external opt="none"/>
829	</entry>
830	<entry id="service_name">
831	    <internal token="text"/>
832	    <external opt="optional" type="char *"/>
833	    <comment>service name</comment>
834	</entry>
835	<entry id="values">
836	    <internal token="text"/>
837	    <external opt="required" type="char *"/>
838	    <comment>limit value, interval</comment>
839	</entry>
840	<entry id="return">
841	    <internal token="return"/>
842	    <external opt="none"/>
843	</entry>
844    </event>
845
846    <event id="AUE_zone_state" header="0" idNo="33" omit="JNI">
847	<entry id="subject">
848	    <internal token="subject"/>
849	    <external opt="none"/>
850	</entry>
851	<entry id="new_state">
852	    <internal token="text"/>
853	    <external opt="required" type="char *"/>
854	    <comment>New zone state</comment>
855	</entry>
856	<entry id="zonename">
857	    <internal token="zonename"/>
858	    <external opt="required" type="char *"/>
859	    <comment>zone name</comment>
860	</entry>
861	<entry id="return">
862	    <internal token="return"/>
863	    <external opt="none"/>
864	</entry>
865    </event>
866
867    <event id="AUE_su_logout" instance_of="AUE_generic_basic"
868	header="0" idNo="39" omit="JNI">
869	<title>su</title>
870	<program>/usr/bin/su</program>
871	<see>su(1M)</see>
872    </event>
873
874    <event id="AUE_role_logout" instance_of="AUE_generic_basic"
875	header="0" idNo="40" omit="JNI">
876	<title>su</title>
877	<program>/usr/bin/su</program>
878	<see>su(1M)</see>
879    </event>
880
881    <event id="AUE_newgrp_login" header="0" idNo="41" omit="JNI">
882    	<program>newgrp</program>
883	<entry id="subject">
884	    <internal token="subject"/>
885	    <external opt="none"/>
886	</entry>
887	<entry id="groupname">
888	    <internal  token="text"/>
889	    <external opt="required"  type="char *"/>
890	    <comment>group name</comment>
891	</entry>
892	<entry id="return">
893	    <internal token="return"/>
894	    <external opt="none"/>
895	</entry>
896    </event>
897
898    <event id="AUE_generic_mountable" type="generic" omit="always">
899	<!--
900
901	User device mounting related functions
902
903	-->
904	<entry id="subject">
905	    <internal token="subject"/>
906	    <external opt="none"/>
907	</entry>
908	<entry id="auth_used">
909	    <internal token="uauth"/>
910	    <external opt="required" type="char *"/>
911	    <comment>authorization used</comment>
912	</entry>
913	<entry id="mount_point">
914	    <internal token="path"/>
915	    <external opt="required" type="char *"/>
916	    <comment>mount point</comment>
917	</entry>
918	<entry id="device">
919	    <internal token="path"/>
920	    <external opt="required" type="char *"/>
921	    <comment>device</comment>
922	</entry>
923	<entry id="options">
924	    <internal token="text"/>
925	    <external opt="optional" type="char *"/>
926	    <comment>options</comment>
927	</entry>
928	<entry id="return">
929	    <internal token="return"/>
930	    <external opt="none"/>
931	</entry>
932    </event>
933
934    <event id="AUE_attach" instance_of="AUE_generic_mountable"
935	header="0" idNo="42" omit="JNI">
936	<program>hald</program>
937    </event>
938    <event id="AUE_detach" instance_of="AUE_generic_mountable"
939	header="0" idNo="43" omit="JNI">
940	<program>hald</program>
941    </event>
942    <event id="AUE_remove" header="0" idNo="44" omit="JNI">
943	<program>hald</program>
944	<entry id="subject">
945	    <internal token="subject"/>
946	    <external opt="none"/>
947	</entry>
948	<entry id="auth_used">
949	    <internal token="uauth"/>
950	    <external opt="required" type="char *"/>
951	    <comment>authorization used</comment>
952	</entry>
953	<entry id="mount_point">
954	    <internal token="path"/>
955	    <external opt="optional" type="char *"/>
956	    <comment>mount point</comment>
957	</entry>
958	<entry id="device">
959	    <internal token="path"/>
960	    <external opt="required" type="char *"/>
961	    <comment>device</comment>
962	</entry>
963	<entry id="return">
964	    <internal token="return"/>
965	    <external opt="none"/>
966	</entry>
967    </event>
968
969    <event id="AUE_pool_import" header="0" idNo="45" omit="JNI">
970    	<program>hald</program>
971	<entry id="subject">
972	    <internal token="subject"/>
973	    <external opt="none"/>
974	</entry>
975	<entry id="auth_used">
976	    <internal token="uauth"/>
977	    <external opt="required" type="char *"/>
978	    <comment>authorization used</comment>
979	</entry>
980	<entry id="pool">
981	    <internal token="text"/>
982	    <external opt="required" type="char *"/>
983	    <comment>pool</comment>
984	</entry>
985	<entry id="device">
986	    <internal token="path"/>
987	    <external opt="required" type="char *"/>
988	    <comment>device</comment>
989	</entry>
990	<entry id="return">
991	    <internal token="return"/>
992	    <external opt="none"/>
993	</entry>
994    </event>
995    <event id="AUE_pool_export" header="0" idNo="46" omit="JNI">
996    	<program>hald</program>
997	<entry id="subject">
998	    <internal token="subject"/>
999	    <external opt="none"/>
1000	</entry>
1001	<entry id="auth_used">
1002	    <internal token="uauth"/>
1003	    <external opt="required" type="char *"/>
1004	    <comment>authorization used</comment>
1005	</entry>
1006	<entry id="pool">
1007	    <internal token="text"/>
1008	    <external opt="required" type="char *"/>
1009	    <comment>pool</comment>
1010	</entry>
1011	<entry id="device">
1012	    <internal token="path"/>
1013	    <external opt="required" type="char *"/>
1014	    <comment>device</comment>
1015	</entry>
1016	<entry id="return">
1017	    <internal token="return"/>
1018	    <external opt="none"/>
1019	</entry>
1020    </event>
1021
1022<!-- dladm security objected events -->
1023    <event id="AUE_dladm_generic" type="generic" omit="always">
1024	<entry id="subject">
1025	    <internal token="subject"/>
1026	    <external opt="none"/>
1027	</entry>
1028	<entry id="auth_used">
1029	    <internal token="uauth"/>
1030	    <external opt="required" type="char *"/>
1031	    <comment>authorization used</comment>
1032	</entry>
1033	<entry id="obj_class">
1034	    <internal token="text"/>
1035	    <external opt="required" type="char *"/>
1036	    <comment>object class name</comment>
1037	</entry>
1038	<entry id="obj_name">
1039	    <internal token="text"/>
1040	    <external opt="required" type="char *"/>
1041	    <comment>object name</comment>
1042	</entry>
1043	<entry id="return">
1044	    <internal token="return"/>
1045	    <external opt="none"/>
1046	</entry>
1047    </event>
1048
1049    <event id="AUE_dladm_create_secobj" instance_of="AUE_dladm_generic"
1050	header="0" idNo="47" omit="JNI">
1051	<title>create wifi security object</title>
1052	<program>/usr/sbin/dladm</program>
1053	<see>dladm(1M)</see>
1054    </event>
1055    <event id="AUE_dladm_delete_secobj" instance_of="AUE_dladm_generic"
1056	header="0" idNo="48" omit="JNI">
1057	<title>delete wifi security object</title>
1058	<program>/usr/sbin/dladm</program>
1059	<see>dladm(1M)</see>
1060    </event>
1061
1062<!-- Trusted eXtensions (TX) events -->
1063
1064    <!-- labeld events -->
1065    <event id="AUE_file_relabel" header="0" idNo="49" omit="JNI">
1066    	<title>relabel file from one zone to another</title>
1067	<program>setlabel(1)</program>
1068	<see>setflabel(3TSOL)</see>
1069	<entry id="subject">
1070	    <internal token="subject"/>
1071	    <external opt="none"/>
1072	</entry>
1073	<entry id="auth_used">
1074	    <internal token="uauth"/>
1075	    <external opt="required" type="char *"/>
1076	    <comment>authorization used</comment>
1077	</entry>
1078	<entry id="file">
1079	    <internal token="path"/>
1080	    <external opt="required" type="char *"/>
1081	    <comment>file relabeled</comment>
1082	</entry>
1083	<entry id="src_label">
1084	    <internal token="label"/>
1085	    <external opt="required" type="m_label_t *"/>
1086	    <comment>original label</comment>
1087	</entry>
1088	<entry id="dst_label">
1089	    <internal token="label"/>
1090	    <external opt="required" type="m_label_t *"/>
1091	    <comment>new label</comment>
1092	</entry>
1093	<entry id="return">
1094	    <internal token="return"/>
1095	    <external opt="none"/>
1096	</entry>
1097    </event>
1098
1099    <event id="AUE_file_copy" header="0" idNo="50" omit="JNI">
1100    	<title>copy file to another zone</title>
1101	<program>dtfile(1X)</program>
1102	<entry id="subject">
1103	    <internal token="subject"/>
1104	    <external opt="none"/>
1105	</entry>
1106	<entry id="auth_used">
1107	    <internal token="uauth"/>
1108	    <external opt="required" type="char *"/>
1109	    <comment>authorization used</comment>
1110	</entry>
1111	<entry id="src_file">
1112	    <internal token="path"/>
1113	    <external opt="required" type="char *"/>
1114	    <comment>source file</comment>
1115	</entry>
1116	<entry id="src_label">
1117	    <internal token="label"/>
1118	    <external opt="required" type="m_label_t *"/>
1119	    <comment>source label</comment>
1120	</entry>
1121	<entry id="dst_file">
1122	    <internal token="path"/>
1123	    <external opt="required" type="char *"/>
1124	    <comment>destination directory</comment>
1125	</entry>
1126	<entry id="dst_label">
1127	    <internal token="label"/>
1128	    <external opt="required" type="m_label_t *"/>
1129	    <comment>destination label</comment>
1130	</entry>
1131	<entry id="return">
1132	    <internal token="return"/>
1133	    <external opt="none"/>
1134	</entry>
1135    </event>
1136
1137<!-- add new events here with the next higher idNo -->
1138<!-- Highest idNo is 50, so next is 51, then fix this comment -->
1139<!-- end of C Only events -->
1140
1141
1142<!--
1143     token definitions are partially implemented.  All they do for now
1144     is create a list of defined token names.  In the future they may
1145     become a way of describing token structure.
1146-->
1147
1148    <token id="acl">
1149    </token>
1150    <token id="arbitrary">
1151    </token>
1152    <token id="arg">
1153    </token>
1154    <token id="attr">
1155    </token>
1156    <token id="command">
1157    </token>
1158    <token id="command_1">
1159    </token>
1160    <token id="date">
1161    </token>
1162    <token id="exec_args">
1163    </token>
1164    <token id="exec_env">
1165    </token>
1166    <token id="exit">
1167    </token>
1168    <token id="file">
1169    </token>
1170    <token id="fmri">
1171    </token>
1172    <token id="groups">
1173    </token>
1174    <token id="in_addr">
1175    </token>
1176    <token id="ipc">
1177    </token>
1178    <token id="ipc_perm">
1179    </token>
1180    <token id="label">
1181    </token>
1182    <token id="newgroups">
1183    </token>
1184    <token id="opaque">
1185    </token>
1186    <token id="path">
1187    </token>
1188    <!-- pseudo token; path list generates 0 or more path tokens -->
1189    <token id="path_list">
1190    </token>
1191    <token id="tid">
1192    </token>
1193
1194    <!--
1195	privilege token is implemented as one of the pseudo tokens
1196	priv_limit, priv_effective, or priv_inherit
1197
1198    <token id="privilege">
1199    </token>
1200    -->
1201    <token id="priv_effective">
1202    </token>
1203    <token id="priv_inherit">
1204    </token>
1205    <token id="priv_limit">
1206    </token>
1207    <token id="process">
1208    </token>
1209    <token id="return">
1210    </token>
1211    <token id="seq">
1212    </token>
1213    <token id="socket">
1214    </token>
1215    <token id="socket-inet">
1216    </token>
1217    <token id="subject">
1218    </token>
1219    <token id="text">
1220    </token>
1221    <token id="uauth">
1222    </token>
1223    <token id="zonename">
1224    </token>
1225
1226<!--
1227    error value list for return values with success/fail code of fail.
1228    These values start at 1000 so praudit can tell the difference
1229    between the libbsm/common/audit_*.c broken error values and
1230    the new adt_ error value list.  It is public so that praudit
1231    can find it.
1232
1233    praudit outputs "failure" %s" for these strings, so there is
1234    no need to use words such as "failed" in the message.
1235
1236    ** Add to the end only to maintain validity across versions of
1237    the audit log. **
1238-->
1239
1240    <msg_list id="fail_value" header="0" start="1000" public="true">
1241	<msg id="PW_ATTR">Attribute update</msg>
1242	<msg id="PW">Password update</msg>
1243	<msg id="USERNAME">bad username</msg>
1244	<msg id="AUTH">authorization failed</msg>
1245	<msg id="UID">bad uid</msg>
1246	<msg id="UNKNOWN">unknown failure</msg>
1247	<msg id="EXPIRED">password expired</msg>
1248	<msg id="ACCOUNT_LOCKED">Account is locked</msg>
1249	<msg id="BAD_DIALUP">Bad dial up</msg>
1250	<msg id="BAD_ID">Invalid ID</msg>
1251	<msg id="BAD_PW">Invalid password</msg>
1252	<msg id="CONSOLE">Not on console</msg>
1253	<msg id="MAX_TRIES">Too many failed attempts</msg>
1254	<msg id="PROTOCOL_FAILURE">Protocol failure</msg>
1255	<msg id="EXCLUDED_USER">Excluded user</msg>
1256	<msg id="ANON_USER">No anonymous</msg>
1257	<msg id="BAD_CMD">Invalid command</msg>
1258	<msg id="BAD_TTY">Standard input not a tty line</msg>
1259	<msg id="PROGRAM">Program failure</msg>
1260	<msg id="CHDIR_FAILED">chdir to home directory</msg>
1261	<msg id="INPUT_OVERFLOW">Input line too long.</msg>
1262	<msg id="DEVICE_PERM">login device override</msg>
1263	<msg id="AUTH_BYPASS">authorization bypass</msg>
1264	<msg id="LOGIN_DISABLED">login disabled</msg>
1265    </msg_list>
1266
1267<!--
1268	The following empty list is used for PAM errors; the "start"
1269	value is used by praudit to know to use the PAM infrastructure
1270	for generating error strings
1271-->
1272    <msg_list id="fail_pam" header="0" start="2000" public="true">
1273    </msg_list>
1274
1275<!--
1276     This is still in use by SMC.  See AUE_generic_login.  When
1277     either SMC is fixed to stop using this, or SMC goes away.
1278     REMOVE this stuff and the corresponding AUE_generic_login
1279     message field.
1280
1281     Message list for the various authentication events, such
1282     as AUE_login and AUE_admin_authenticate.  Add new entries
1283     at the end.  The order of msg_list entries and the order
1284     of msg entries both affect the names in adt.h and the value
1285     of the associated enumerated types.
1286
1287     Each of these messages except NO_MSG is also in the failure_attribute
1288     list; the difference is that the messages below use a text token
1289     in the audit record, while the failure_attribute messages are
1290     associated with the return value of the return token.
1291
1292     This list is deprecated; please don't use text tokens for error
1293     messages.
1294-->
1295
1296    <msg_list id="login_text" header="0" deprecated="true">
1297	<msg id="NO_MSG"></msg>
1298	<msg id="ACCOUNT_LOCKED">Account is locked</msg>
1299	<msg id="BAD_DIALUP">Bad dial up</msg>
1300	<msg id="BAD_ID">Invalid ID</msg>
1301	<msg id="BAD_PW">Invalid password</msg>
1302	<msg id="CONSOLE">Not on console</msg>
1303	<msg id="MAX_TRIES">Too many failed attempts</msg>
1304	<msg id="PROTOCOL_FAILURE">Protocol failure</msg>
1305	<msg id="EXCLUDED_USER">Excluded user</msg>
1306	<msg id="ANON_USER">No anonymous</msg>
1307    </msg_list>
1308
1309</specification>
1310