1<?xml version="1.0" standalone="yes"?> 2<!DOCTYPE specification SYSTEM "audit.dtd"> 3<!-- 4 CDDL HEADER START 5 6 The contents of this file are subject to the terms of the 7 Common Development and Distribution License (the "License"). 8 You may not use this file except in compliance with the License. 9 10 You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 11 or http://www.opensolaris.org/os/licensing. 12 See the License for the specific language governing permissions 13 and limitations under the License. 14 15 When distributing Covered Code, include this CDDL HEADER in each 16 file and include the License file at usr/src/OPENSOLARIS.LICENSE. 17 If applicable, add the following below this CDDL HEADER, with the 18 fields enclosed by brackets "[]" replaced with your own identifying 19 information: Portions Copyright [yyyy] [name of copyright owner] 20 21 CDDL HEADER END 22 23Copyright 2007 Sun Microsystems, Inc. All rights reserved. 24Use is subject to license terms. 25 26 ident "%Z%%M% %I% %E% SMI" 27--> 28 29<specification> 30 31<!-- comments are displayed to stderr if debug is on --> 32<debug set="off"/> 33 34 <!-- The order of events is arbitrary EXCEPT generic events must 35 precede their instances --> 36 <!-- The order of entries within an event determine the order 37 data is defined in the external API --> 38 <!-- The order of internal / external is arbitrary --> 39 40<!-- 41 tags: 42 The following top level tags are defined: 43 <event> <token> <msg_list> <debug> 44 45 event defines an audit record 46 - id is the record id from audit_uevents.h 47 - reorder="yes" or "no". (default is "no"). 48 if "yes" then the order of the tokens to be 49 output does not match the order of the data 50 input. (see order attribute of <entry>) 51 - header defines the header file to contain the external 52 definitions for this event type. The header file 53 name is adt_event_N.h, where N is the value supplied 54 header="0" is for "stable" events, > 0 for new ones. 55 with this attribute. (header="1"). 56 - idNo is the number associated with the external 57 name of this event. (For AUE_login, ADT_login is 58 the external name and idNo is the value for 59 ADT_login.) 60 - omit is by default 'no' (i.e., don't omit) and can be 61 'always' or 'JNI'. In the latter case, C interface 62 code is generated but neither Java nor JNI code is. 63 - included text is just a comment 64 Within an event block, the following tags are defined: 65 <entry>, <debug>, <altname> 66 67 altname defines the internal name of an audit record; if 68 omitted, the internal name is the same as the 69 external name. 70 71 entry defines the correspondence between the data 72 supplied by the caller and the token to be 73 output. 74 - id is the data name that shows up in the structures 75 of adt_event.h If it is a comma separated list, 76 it is the list of names of data to be associated 77 with one output token. (See <external>, below) 78 Within an entry block, the following tags are defined: 79 <internal>, <external>, <debug> 80 81 internal defines the token to be generated. 82 - token is a name that must also be defined with 83 a <token> tag elsewhere in this file. (order is 84 not important). 85 - order="some number" determines the order of the 86 tokens to be output, starting with 1. The subject 87 token is normally order="1". The use is to insure 88 that the order of fields listed in adt_event.h does 89 not change when we arbitrarily change the order of 90 tokens. If the <event reorder="yes"> is not set, 91 order is ignored. 92 - format is a printf-like string that will be used 93 in to format the data supplied by the user. 94 95 external defines the data to be supplied for creating the 96 token defined via <internal> 97 - opt is one of four values: "required", "optional", 98 "obsolete", or "none". The first two values 99 indicate that this token's data must or may 100 be supplied by the user; the third value is 101 equivalent to "optional" but shows in the 102 comment that this field is no longer used; 103 the forth value indicates that this token 104 does not require any user-supplied data. If 105 data is required, then a token is always 106 output, while optional data is output only 107 if data is supplied. 108 - type describes the C data type to be associated 109 with the <entry id="dataName">. The following 110 data types are representative: 111 112 au_asid_t (uint32_t) 113 char 114 char * (blank is optional) 115 char ** (blank is optional) 116 uint_t, int, int32_t, uid_t, gid_t 117 uid_t *, gid_t * 118 long, ulong_t 119 m_label_t * 120 pid_t 121 priv_set_t * 122 uint16_t, unit32_t, uint64_t 123 uint32_t *, uint32_t[], uint64_t * 124 msg (not a C type, see below) 125 126 Below is what Tony said. Above seems to be 127 what is implemented 128 char 129 char * (blank is optional) 130 char ** (blank is optional) 131 int, uid_t, gid_t 132 int *, uid_t *, gid_t * 133 msg (not a C type, see below) 134 time_t 135 uint, uint * 136 137 The msg type refers to an enumerated type 138 that must be defined via a <msg> description 139 else where in this file. The syntax is 140 special. Example: <external opt="optional" 141 type="msg login_text"/> "login_text" is the 142 id of a <msg_list> descriptor given 143 elsewhere in this file. 144 145 If the <entry> id is a list, the type must also 146 be a comma-separated list, where the types are 147 in the same order as the id's. 148 If the type is an array, its length must be given 149 explicitly. 150 151 token Define allowed token names. 152 - id is the name of token; this name is used 153 as an <internal> id. 154 - usage is an optional value. At present, only 155 "TSOL" is defined; it means that this data is 156 to be used only in Trusted Solaris implementations. 157 158 msg_list Define a set of text strings. 159 - id is the name to be used for this group of text 160 strings in adt_event.h 161 - header is as defined for <event> 162 Within a msg_list block, <msg> and <debug> are defined. 163 The order of <msg> tags in a msg_list is reflected 164 directly in adt_event.h 165 166 msg Define one string. 167 - id is the name to be used in the enum describing 168 this set of strings. Convention: use upper case. 169 The content (text between <msg> and </msg>) is the 170 actual string. Extra white space, including line 171 feeds, is ignored. If empty, no output token 172 is generated unless the <external> opt attribute is 173 set to "required", in which case a blank text token 174 is generated. 175 Within a msg block, <debug> is defined, but has not been 176 tested and may have no effect. 177 178 debug This turns on/off debug messages during the processing 179 of the xml data. It affects the block within which it 180 is defined. 181 - set may have one of two values: "on" or "off". If 182 set is omitted, the debug state for the current block 183 is toggled. 184 The use of the <debug> tag does not affect the output 185 of data to the various files created, but does generate 186 potentially large amounts of output to stderr. 187 188--> 189<!-- template for an event record definition 190 191 <event id="" header="0" idNo=""> 192 <entry id="subject"> 193 <internal token="subject"/> 194 <external opt="none"/> 195 </entry> 196 <entry id=""> 197 <internal token=""/> 198 <external opt="" type="" /> 199 </entry> 200 <entry id="return"> 201 <internal token="return"/> 202 <external opt="none"/> 203 </entry> 204 </event> 205 206 Generic events must precede Instance events; within each 207 group, please group the AUE_* by area and event idNo-s in order, 208 gaps in idNo-s are OK. 209 N.B. Renumbering idNo-s requires recompilation of consumers. See 210 the contracts for whom to notify if/when this happens. 211--> 212 213<!-- generic events --> 214 215 <!-- 216 'omit="always"' means that this record type is not reflected 217 in the generated header and table files. 218 --> 219 220 <event id="AUE_generic_basic" type="generic" omit="always"> 221 <!-- 222 223 This is a template for the event types that have no tokens 224 other than the header and return. There is no allowed_type 225 list because the template is not externally visible due to the 226 omit="always". 227 228 --> 229 <entry id="subject"> 230 <internal token="subject"/> 231 <external opt="none"/> 232 </entry> 233 <entry id="return"> 234 <internal token="return"/> 235 <external opt="none"/> 236 </entry> 237 </event> 238 239 <event id="AUE_generic_login" type="generic" omit="always"> 240 <!-- 241 242 This is a template for the various login event types 243 AUE_login, AUE_ftp, etc which match this template. There is 244 no allowed_type list because the template is not externally 245 visible due to the omit="always". 246 247 --> 248 <entry id="subject"> 249 <internal token="subject"/> 250 <external opt="none"/> 251 </entry> 252 253 <!-- This field is still in use for SMC until it is cleaned up, 254 it must remain, see login_text msg list at the end of the 255 file. 256 --> 257 <entry id="message"> 258 <internal token="text"/> 259 <external opt="optional" type="msg login_text"/> 260 <comment>error message</comment> 261 </entry> 262 <entry id="return"> 263 <internal token="return"/> 264 <external opt="none"/> 265 </entry> 266 </event> 267 268<!-- generic SMC events --> 269 270 <event id="AUE_generic_SMC_add" type="generic" omit="always"> 271 <entry id="subject"> 272 <internal token="subject"/> 273 <external opt="none"/> 274 </entry> 275 <entry id="object_name"> 276 <internal token="text"/> 277 <external opt="required" type="char *"/> 278 <comment>object name</comment> 279 </entry> 280 <entry id="domain"> 281 <internal token="text"/> 282 <external opt="optional" type="char *"/> 283 <comment>domain</comment> 284 </entry> 285 <entry id="name_service"> 286 <internal token="text"/> 287 <external opt="required" type="char *"/> 288 <comment>name_service</comment> 289 </entry> 290 <entry id="auth_used"> 291 <internal token="uauth"/> 292 <external opt="optional" type="char *"/> 293 <comment>authorization used</comment> 294 </entry> 295 <!-- 296 This should really be its own token type, not "text" 297 --> 298 <entry id="initial_values"> 299 <internal token="text"/> 300 <external opt="required" type="char *"/> 301 <comment>initial values</comment> 302 </entry> 303 <entry id="return"> 304 <internal token="return"/> 305 <external opt="none"/> 306 </entry> 307 </event> 308 309 <event id="AUE_generic_SMC_delete" type="generic" omit="always"> 310 <entry id="subject"> 311 <internal token="subject"/> 312 <external opt="none"/> 313 </entry> 314 <entry id="object_name"> 315 <internal token="text"/> 316 <external opt="required" type="char *"/> 317 <comment>object name</comment> 318 </entry> 319 <entry id="domain"> 320 <internal token="text"/> 321 <external opt="optional" type="char *"/> 322 <comment>domain</comment> 323 </entry> 324 <entry id="name_service"> 325 <internal token="text"/> 326 <external opt="required" type="char *"/> 327 <comment>name_service</comment> 328 </entry> 329 <entry id="auth_used"> 330 <internal token="uauth"/> 331 <external opt="optional" type="char *"/> 332 <comment>authorization used</comment> 333 </entry> 334 <entry id="delete_values"> 335 <internal token="text"/> 336 <external opt="required" type="char *"/> 337 <comment>deleted values</comment> 338 </entry> 339 <entry id="return"> 340 <internal token="return"/> 341 <external opt="none"/> 342 </entry> 343 </event> 344 345 <event id="AUE_generic_SMC_modify" type="generic" omit="always"> 346 <entry id="subject"> 347 <internal token="subject"/> 348 <external opt="none"/> 349 </entry> 350 <entry id="object_name"> 351 <internal token="text"/> 352 <external opt="required" type="char *"/> 353 <comment>object name</comment> 354 </entry> 355 <entry id="domain"> 356 <internal token="text"/> 357 <external opt="optional" type="char *"/> 358 <comment>domain</comment> 359 </entry> 360 <entry id="name_service"> 361 <internal token="text"/> 362 <external opt="required" type="char *"/> 363 <comment>name_service</comment> 364 </entry> 365 <entry id="auth_used"> 366 <internal token="uauth"/> 367 <external opt="optional" type="char *"/> 368 <comment>authorization used</comment> 369 </entry> 370 <entry id="changed_values"> 371 <internal token="text"/> 372 <external opt="required" type="char *"/> 373 <comment>changed values</comment> 374 </entry> 375 <entry id="return"> 376 <internal token="return"/> 377 <external opt="none"/> 378 </entry> 379 </event> 380 381<!-- instances --> 382 383<!-- 384 Java needed for SMC events. Since the SMC events grow less 385 often than the C related events. They come first. It 386 would be nice to reorder the idNo-s, but that's an ABI 387 change and should rev libbsm version no. If reordered 388 start with 1 and eliminate the comment at the end about 389 the highest idNo. 390--> 391 <event id="AUE_admin_authenticate" instance_of="AUE_generic_login" 392 header="0" idNo="3"> 393 <title>Admin Server Authentication</title> 394 <program>admin (various)</program> 395 <see>SMC, WBEM, or AdminSuite</see> 396 </event> 397 398 <event id="AUE_filesystem_add" instance_of="AUE_generic_SMC_add" 399 header="0" idNo="4"> 400 <title>SMC: filesystem add</title> 401 <program>SMC server</program> 402 </event> 403 <event id="AUE_filesystem_delete" instance_of="AUE_generic_SMC_delete" 404 header="0" idNo="5"> 405 <title>SMC: filesystem delete</title> 406 <program>SMC server</program> 407 </event> 408 <event id="AUE_filesystem_modify" instance_of="AUE_generic_SMC_modify" 409 header="0" idNo="6"> 410 <title>SMC: filesystem modify</title> 411 <program>SMC server</program> 412 </event> 413 414 <event id="AUE_network_add" instance_of="AUE_generic_SMC_add" 415 header="0" idNo="7"> 416 <title>SMC: network add</title> 417 <program>SMC server</program> 418 </event> 419 <event id="AUE_network_delete" instance_of="AUE_generic_SMC_delete" 420 header="0" idNo="8"> 421 <title>SMC: network delete</title> 422 <program>SMC server</program> 423 </event> 424 <event id="AUE_network_modify" instance_of="AUE_generic_SMC_modify" 425 header="0" idNo="9"> 426 <title>SMC: network modify</title> 427 <program>SMC server</program> 428 </event> 429 430 <event id="AUE_printer_add" instance_of="AUE_generic_SMC_add" 431 header="0" idNo="10"> 432 <title>SMC: printer add</title> 433 <program>SMC server</program> 434 </event> 435 <event id="AUE_printer_delete" instance_of="AUE_generic_SMC_delete" 436 header="0" idNo="11"> 437 <title>SMC: printer delete</title> 438 <program>SMC server</program> 439 </event> 440 <event id="AUE_printer_modify" instance_of="AUE_generic_SMC_modify" 441 header="0" idNo="12"> 442 <title>SMC: printer modify</title> 443 <program>SMC server</program> 444 </event> 445 446<!-- 447 This is SMC; it's also used in su and should probably be used in 448 desktop role login. If we fix the SMC to not record NO_MSG here, 449 we can fix to record failed user. See su.c and AUE_su. 450--> 451 <event id="AUE_role_login" instance_of="AUE_generic_login" 452 header="0" idNo="13"> 453 <title>RBAC: role login</title> 454 <program>SMC server</program> 455 <program>/usr/bin/su</program> 456 </event> 457 458 <event id="AUE_scheduledjob_add" instance_of="AUE_generic_SMC_add" 459 header="0" idNo="14"> 460 <title>SMC: scheduled job add</title> 461 <program>SMC server</program> 462 </event> 463 <event id="AUE_scheduledjob_delete" instance_of="AUE_generic_SMC_delete" 464 header="0" idNo="15"> 465 <title>SMC: scheduled job delete</title> 466 <program>SMC server</program> 467 </event> 468 <event id="AUE_scheduledjob_modify" instance_of="AUE_generic_SMC_modify" 469 header="0" idNo="16"> 470 <title>SMC: scheduled job modify</title> 471 <program>SMC server</program> 472 </event> 473 474 <event id="AUE_serialport_add" instance_of="AUE_generic_SMC_add" 475 header="0" idNo="17"> 476 <title>SMC: serial port add</title> 477 <program>SMC server</program> 478 </event> 479 <event id="AUE_serialport_delete" instance_of="AUE_generic_SMC_delete" 480 header="0" idNo="18"> 481 <title>SMC: serial port delete</title> 482 <program>SMC server</program> 483 </event> 484 <event id="AUE_serialport_modify" instance_of="AUE_generic_SMC_modify" 485 header="0" idNo="19"> 486 <title>SMC: serial port modify</title> 487 <program>SMC server</program> 488 </event> 489 490<!-- This is SMC; should this also be used elsewhere? --> 491 <event id="AUE_uauth" header="0" idNo="20"> 492 <title>SMC: Use of Authorization</title> 493 <program>SMC server</program> 494 <entry id="subject"> 495 <internal token="subject"/> 496 <external opt="none"/> 497 </entry> 498 <entry id="auth_used"> 499 <internal token="uauth"/> 500 <external opt="required" type="char *"/> 501 <comment>authorization used</comment> 502 </entry> 503 <entry id="objectname"> 504 <internal token="text"/> 505 <external opt="required" type="char *"/> 506 <comment>object name</comment> 507 </entry> 508 <entry id="return"> 509 <internal token="return"/> 510 <external opt="none"/> 511 </entry> 512 </event> 513 514 <event id="AUE_usermgr_add" instance_of="AUE_generic_SMC_add" 515 header="0" idNo="21"> 516 <title>SMC: User Manager add</title> 517 <program>SMC server</program> 518 </event> 519 <event id="AUE_usermgr_delete" instance_of="AUE_generic_SMC_delete" 520 header="0" idNo="22"> 521 <title>SMC: User Manager delete</title> 522 <program>SMC server</program> 523 </event> 524 <event id="AUE_usermgr_modify" instance_of="AUE_generic_SMC_modify" 525 header="0" idNo="23"> 526 <title>SMC: User Manager modify</title> 527 <program>SMC server</program> 528 </event> 529<!-- end of Java needed for SMC events --> 530<!-- 531 while not used by SMC logout is used by Lockhart 532--> 533 <event id="AUE_logout" header="0" idNo="1"> 534 <title>login: logout</title> 535 <program>various</program> 536 <see>login(1)</see> 537 <entry id="subject"> 538 <internal token="subject"/> 539 <external opt="none"/> 540 </entry> 541<!-- 542 not used by C code, used by Lockhart, 543 get them to change and remove 544 event.user_name("logout " + session.getUserName()); 545 from /ws/lockhart-nv-gate/src/bundled/app/webmgt/lib/services/ 546 com/sun/management/services/audit/SolarisAuditEvent_Logout.java 547--> 548 <entry id="user_name"> 549 <internal token="text" format="logout %s"/> 550 <external opt="optional" type="char *"/> 551 <comment>"logout" username</comment> 552 </entry> 553 <entry id="return"> 554 <internal token="return"/> 555 <external opt="none"/> 556 </entry> 557 </event> 558 559 560<!-- C Only events --> 561 <event id="AUE_init_solaris" header="0" idNo="32" omit="JNI"> 562 <title>init</title> 563 <program>/sbin/init</program> 564 <program>/usr/sbin/init</program> 565 <program>/usr/sbin/shutdown</program> 566 <entry id="subject"> 567 <internal token="subject"/> 568 <external opt="none"/> 569 </entry> 570 <entry id="info"> 571 <internal token="text"/> 572 <external opt="optional" type="char *"/> 573 <comment>init level or zone name</comment> 574 </entry> 575 <entry id="return"> 576 <internal token="return"/> 577 <external opt="none"/> 578 </entry> 579 </event> 580 581 <event id="AUE_login" instance_of="AUE_generic_login" header="0" 582 idNo="25" omit="JNI"> 583 <title>terminal login</title> 584 <program>/usr/sbin/login</program> 585 <program>/usr/dt/bin/dtlogin</program> 586 <see>login(1)</see> 587 <see>dtlogin</see> 588 </event> 589 <event id="AUE_rlogin" instance_of="AUE_generic_login" header="0" 590 idNo="28" omit="JNI"> 591 <title>rlogin</title> 592 <program>/usr/sbin/login</program> 593 <see>login(1) - rlogin</see> 594 </event> 595 <event id="AUE_telnet" instance_of="AUE_generic_login" header="0" 596 idNo="29" omit="JNI"> 597 <title>telnet login</title> 598 <program>/usr/sbin/login</program> 599 <see>login(1) - telnet</see> 600 </event> 601 <event id="AUE_ssh" instance_of="AUE_generic_login" header="0" 602 idNo="2" omit="JNI"> 603 <program>/usr/lib/ssh/sshd</program> 604 </event> 605 606 <event id="AUE_zlogin" header="0" idNo="38" omit="JNI"> 607 <title>zone login</title> 608 <program>/usr/sbin/login</program> 609 <see>zlogin(1)</see> 610 <entry id="subject"> 611 <internal token="subject"/> 612 <external opt="none"/> 613 </entry> 614 <entry id="message"> 615 <internal token="text"/> 616 <external opt="optional" type="char *"/> 617 <comment>error message</comment> 618 </entry> 619 <entry id="return"> 620 <internal token="return"/> 621 <external opt="none"/> 622 </entry> 623 </event> 624 625 <event id="AUE_su" header="0" idNo="30" omit="JNI"> 626 <title>su</title> 627 <program>/usr/bin/su</program> 628 <see>su(1M)</see> 629 <entry id="subject"> 630 <internal token="subject"/> 631 <external opt="none"/> 632 </entry> 633<!-- 634 should be changed to "fail_user" and su.c updated 635 However, the jni stuff is broken, so for now it's "message" 636--> 637 <entry id="message"> 638 <internal token="text"/> 639 <external opt="optional" type="char *"/> 640 <comment>"user name" of failed new user/role</comment> 641 </entry> 642 <entry id="return"> 643 <internal token="return"/> 644 <external opt="none"/> 645 </entry> 646 </event> 647 648 <event id="AUE_passwd" header="0" idNo="27" omit="JNI"> 649 <title>passwd</title> 650 <program>various</program> 651 <see>passwd(1)</see> 652 <entry id="subject"> 653 <internal token="subject"/> 654 <external opt="none"/> 655 </entry> 656 <entry id="username"> 657 <internal token="text"/> 658 <external opt="optional" type="char *"/> 659 <comment>success/fail message</comment> 660 </entry> 661 <entry id="return"> 662 <internal token="return"/> 663 <external opt="none"/> 664 </entry> 665 </event> 666 667 <event id="AUE_screenlock" instance_of="AUE_generic_basic" header="0" 668 idNo="26" omit="JNI"> 669 <program>desktop screen lock</program> 670 </event> 671 <event id="AUE_screenunlock" instance_of="AUE_generic_basic" header="0" 672 idNo="31" omit="JNI"> 673 <program>desktop screen unlock</program> 674 </event> 675 676 <!-- 677 AUE_prof_cmd is not supportable for Java due to the structure of 678 the priv token. When and if a Java program needs to generate 679 a priv token, we'll need to look at the data format in the 680 Java code and provide an appropriate java and jni implementation. 681 --> 682 683 <event id="AUE_prof_cmd" header="0" idNo="24" omit="JNI"> 684 <title>pfexec</title> 685 <program>/usr/bin/pfexec</program> 686 <see>pfexec(1)</see> 687 <entry id="subject"> 688 <internal token="subject"/> 689 <external opt="none"/> 690 </entry> 691 <entry id="cwdpath"> 692 <internal token="path"/> 693 <external opt="required" type="char*"/> 694 <comment>working directory</comment> 695 </entry> 696 <entry id="cmdpath"> 697 <internal token="path"/> 698 <external opt="required" type="char*"/> 699 <comment>command pathname</comment> 700 </entry> 701 <entry id="argc,argv,envp"> 702 <internal token="command"/> 703 <external opt="required" type="int,char**,char**"/> 704 </entry> 705 <entry id="proc_auid,proc_euid,proc_egid,proc_ruid,proc_rgid,proc_pid,proc_sid,proc_termid"> 706 <internal token="process"/> 707 <external opt="required" 708 type="uid_t,uid_t,gid_t,uid_t,gid_t,pid_t,au_asid_t,termid*"/> 709 </entry> 710 <entry id="limit_set"> 711 <internal token="priv_limit"/> 712 <external opt="optional" type="priv_set_t*"/> 713 </entry> 714 <entry id="inherit_set"> 715 <internal token="priv_inherit"/> 716 <external opt="optional" type="priv_set_t*"/> 717 </entry> 718 <entry id="return"> 719 <internal token="return"/> 720 <external opt="none"/> 721 </entry> 722 </event> 723 724 <event id="AUE_inetd_connect" header="0" idNo="34" omit="JNI"> 725 <title>inetd</title> 726 <program>/usr/sbin/inetd</program> 727 <entry id="subject"> 728 <internal token="subject"/> 729 <external opt="none"/> 730 </entry> 731 <entry id="service_name"> 732 <internal token="text"/> 733 <external opt="optional" type="char *"/> 734 <comment>service name</comment> 735 </entry> 736 <entry id="ip_type,ip_remote_port,ip_local_port,ip_adr"> 737 <internal token="tid"/> 738 <external opt="required" 739 type="uint32_t,uint16_t,uint16_t,uint32_t[4]"/> 740 <comment>client address</comment> 741 </entry> 742 <entry id="cmd"> 743 <internal token="command_1"/> 744 <external opt="required" type="char *"/> 745 <comment>inetd command</comment> 746 </entry> 747 <entry id="privileges"> 748 <internal token="priv_effective"/> 749 <external opt="required" type="priv_set_t *"/> 750 </entry> 751 <entry id="return"> 752 <internal token="return"/> 753 <external opt="none"/> 754 </entry> 755 </event> 756 757 <event id="AUE_inetd_ratelimit" header="0" idNo="35" omit="JNI"> 758 <title>inetd</title> 759 <program>/usr/sbin/inetd</program> 760 <entry id="subject"> 761 <internal token="subject"/> 762 <external opt="none"/> 763 </entry> 764 <entry id="service_name"> 765 <internal token="text"/> 766 <external opt="optional" type="char *"/> 767 <comment>service name</comment> 768 </entry> 769 <entry id="limit"> 770 <internal token="text"/> 771 <external opt="required" type="char *"/> 772 <comment>limit value</comment> 773 </entry> 774 <entry id="return"> 775 <internal token="return"/> 776 <external opt="none"/> 777 </entry> 778 </event> 779 780 <event id="AUE_inetd_copylimit" header="0" idNo="36" omit="JNI"> 781 <title>inetd</title> 782 <program>/usr/sbin/inetd</program> 783 <entry id="subject"> 784 <internal token="subject"/> 785 <external opt="none"/> 786 </entry> 787 <entry id="service_name"> 788 <internal token="text"/> 789 <external opt="optional" type="char *"/> 790 <comment>service name</comment> 791 </entry> 792 <entry id="limit"> 793 <internal token="text"/> 794 <external opt="required" type="char *"/> 795 <comment>limit value</comment> 796 </entry> 797 <entry id="return"> 798 <internal token="return"/> 799 <external opt="none"/> 800 </entry> 801 </event> 802 803 <event id="AUE_inetd_failrate" header="0" idNo="37" omit="JNI"> 804 <title>inetd</title> 805 <program>/usr/sbin/inetd</program> 806 <entry id="subject"> 807 <internal token="subject"/> 808 <external opt="none"/> 809 </entry> 810 <entry id="service_name"> 811 <internal token="text"/> 812 <external opt="optional" type="char *"/> 813 <comment>service name</comment> 814 </entry> 815 <entry id="values"> 816 <internal token="text"/> 817 <external opt="required" type="char *"/> 818 <comment>limit value, interval</comment> 819 </entry> 820 <entry id="return"> 821 <internal token="return"/> 822 <external opt="none"/> 823 </entry> 824 </event> 825 826 <event id="AUE_zone_state" header="0" idNo="33" omit="JNI"> 827 <entry id="subject"> 828 <internal token="subject"/> 829 <external opt="none"/> 830 </entry> 831 <entry id="new_state"> 832 <internal token="text"/> 833 <external opt="required" type="char *"/> 834 <comment>New zone state</comment> 835 </entry> 836 <entry id="zonename"> 837 <internal token="zonename"/> 838 <external opt="required" type="char *"/> 839 <comment>zone name</comment> 840 </entry> 841 <entry id="return"> 842 <internal token="return"/> 843 <external opt="none"/> 844 </entry> 845 </event> 846 847 <event id="AUE_su_logout" instance_of="AUE_generic_basic" 848 header="0" idNo="39" omit="JNI"> 849 <title>su</title> 850 <program>/usr/bin/su</program> 851 <see>su(1M)</see> 852 </event> 853 854 <event id="AUE_role_logout" instance_of="AUE_generic_basic" 855 header="0" idNo="40" omit="JNI"> 856 <title>su</title> 857 <program>/usr/bin/su</program> 858 <see>su(1M)</see> 859 </event> 860 861 <event id="AUE_newgrp_login" header="0" idNo="41" omit="JNI"> 862 <program>newgrp</program> 863 <entry id="subject"> 864 <internal token="subject"/> 865 <external opt="none"/> 866 </entry> 867 <entry id="groupname"> 868 <internal token="text"/> 869 <external opt="required" type="char *"/> 870 <comment>group name</comment> 871 </entry> 872 <entry id="return"> 873 <internal token="return"/> 874 <external opt="none"/> 875 </entry> 876 </event> 877 878 <event id="AUE_generic_mountable" type="generic" omit="always"> 879 <!-- 880 881 User device mounting related functions 882 883 --> 884 <entry id="subject"> 885 <internal token="subject"/> 886 <external opt="none"/> 887 </entry> 888 <entry id="auth_used"> 889 <internal token="uauth"/> 890 <external opt="required" type="char *"/> 891 <comment>authorization used</comment> 892 </entry> 893 <entry id="mount_point"> 894 <internal token="path"/> 895 <external opt="required" type="char *"/> 896 <comment>mount point</comment> 897 </entry> 898 <entry id="device"> 899 <internal token="path"/> 900 <external opt="required" type="char *"/> 901 <comment>device</comment> 902 </entry> 903 <entry id="options"> 904 <internal token="text"/> 905 <external opt="optional" type="char *"/> 906 <comment>options</comment> 907 </entry> 908 <entry id="return"> 909 <internal token="return"/> 910 <external opt="none"/> 911 </entry> 912 </event> 913 914 <event id="AUE_attach" instance_of="AUE_generic_mountable" 915 header="0" idNo="42" omit="JNI"> 916 <program>hald</program> 917 </event> 918 <event id="AUE_detach" instance_of="AUE_generic_mountable" 919 header="0" idNo="43" omit="JNI"> 920 <program>hald</program> 921 </event> 922 <event id="AUE_remove" header="0" idNo="44" omit="JNI"> 923 <program>hald</program> 924 <entry id="subject"> 925 <internal token="subject"/> 926 <external opt="none"/> 927 </entry> 928 <entry id="auth_used"> 929 <internal token="uauth"/> 930 <external opt="required" type="char *"/> 931 <comment>authorization used</comment> 932 </entry> 933 <entry id="mount_point"> 934 <internal token="path"/> 935 <external opt="optional" type="char *"/> 936 <comment>mount point</comment> 937 </entry> 938 <entry id="device"> 939 <internal token="path"/> 940 <external opt="required" type="char *"/> 941 <comment>device</comment> 942 </entry> 943 <entry id="return"> 944 <internal token="return"/> 945 <external opt="none"/> 946 </entry> 947 </event> 948 949 <event id="AUE_pool_import" header="0" idNo="45" omit="JNI"> 950 <program>hald</program> 951 <entry id="subject"> 952 <internal token="subject"/> 953 <external opt="none"/> 954 </entry> 955 <entry id="auth_used"> 956 <internal token="uauth"/> 957 <external opt="required" type="char *"/> 958 <comment>authorization used</comment> 959 </entry> 960 <entry id="pool"> 961 <internal token="text"/> 962 <external opt="required" type="char *"/> 963 <comment>pool</comment> 964 </entry> 965 <entry id="device"> 966 <internal token="path"/> 967 <external opt="required" type="char *"/> 968 <comment>device</comment> 969 </entry> 970 <entry id="return"> 971 <internal token="return"/> 972 <external opt="none"/> 973 </entry> 974 </event> 975 <event id="AUE_pool_export" header="0" idNo="46" omit="JNI"> 976 <program>hald</program> 977 <entry id="subject"> 978 <internal token="subject"/> 979 <external opt="none"/> 980 </entry> 981 <entry id="auth_used"> 982 <internal token="uauth"/> 983 <external opt="required" type="char *"/> 984 <comment>authorization used</comment> 985 </entry> 986 <entry id="pool"> 987 <internal token="text"/> 988 <external opt="required" type="char *"/> 989 <comment>pool</comment> 990 </entry> 991 <entry id="device"> 992 <internal token="path"/> 993 <external opt="required" type="char *"/> 994 <comment>device</comment> 995 </entry> 996 <entry id="return"> 997 <internal token="return"/> 998 <external opt="none"/> 999 </entry> 1000 </event> 1001 1002<!-- dladm security objected events --> 1003 <event id="AUE_dladm_generic" type="generic" omit="always"> 1004 <entry id="subject"> 1005 <internal token="subject"/> 1006 <external opt="none"/> 1007 </entry> 1008 <entry id="auth_used"> 1009 <internal token="uauth"/> 1010 <external opt="required" type="char *"/> 1011 <comment>authorization used</comment> 1012 </entry> 1013 <entry id="obj_class"> 1014 <internal token="text"/> 1015 <external opt="required" type="char *"/> 1016 <comment>object class name</comment> 1017 </entry> 1018 <entry id="obj_name"> 1019 <internal token="text"/> 1020 <external opt="required" type="char *"/> 1021 <comment>object name</comment> 1022 </entry> 1023 <entry id="return"> 1024 <internal token="return"/> 1025 <external opt="none"/> 1026 </entry> 1027 </event> 1028 1029 <event id="AUE_dladm_create_secobj" instance_of="AUE_dladm_generic" 1030 header="0" idNo="47" omit="JNI"> 1031 <title>create wifi security object</title> 1032 <program>/usr/sbin/dladm</program> 1033 <see>dladm(1M)</see> 1034 </event> 1035 <event id="AUE_dladm_delete_secobj" instance_of="AUE_dladm_generic" 1036 header="0" idNo="48" omit="JNI"> 1037 <title>delete wifi security object</title> 1038 <program>/usr/sbin/dladm</program> 1039 <see>dladm(1M)</see> 1040 </event> 1041 1042<!-- Trusted eXtensions (TX) events --> 1043 1044 <!-- labeld events --> 1045 <event id="AUE_file_relabel" header="0" idNo="49" omit="JNI"> 1046 <title>relabel file from one zone to another</title> 1047 <program>setlabel(1)</program> 1048 <see>setflabel(3TSOL)</see> 1049 <entry id="subject"> 1050 <internal token="subject"/> 1051 <external opt="none"/> 1052 </entry> 1053 <entry id="auth_used"> 1054 <internal token="uauth"/> 1055 <external opt="required" type="char *"/> 1056 <comment>authorization used</comment> 1057 </entry> 1058 <entry id="file"> 1059 <internal token="path"/> 1060 <external opt="required" type="char *"/> 1061 <comment>file relabeled</comment> 1062 </entry> 1063 <entry id="src_label"> 1064 <internal token="label"/> 1065 <external opt="required" type="m_label_t *"/> 1066 <comment>original label</comment> 1067 </entry> 1068 <entry id="dst_label"> 1069 <internal token="label"/> 1070 <external opt="required" type="m_label_t *"/> 1071 <comment>new label</comment> 1072 </entry> 1073 <entry id="return"> 1074 <internal token="return"/> 1075 <external opt="none"/> 1076 </entry> 1077 </event> 1078 1079 <event id="AUE_file_copy" header="0" idNo="50" omit="JNI"> 1080 <title>copy file to another zone</title> 1081 <program>dtfile(1X)</program> 1082 <entry id="subject"> 1083 <internal token="subject"/> 1084 <external opt="none"/> 1085 </entry> 1086 <entry id="auth_used"> 1087 <internal token="uauth"/> 1088 <external opt="required" type="char *"/> 1089 <comment>authorization used</comment> 1090 </entry> 1091 <entry id="src_file"> 1092 <internal token="path"/> 1093 <external opt="required" type="char *"/> 1094 <comment>source file</comment> 1095 </entry> 1096 <entry id="src_label"> 1097 <internal token="label"/> 1098 <external opt="required" type="m_label_t *"/> 1099 <comment>source label</comment> 1100 </entry> 1101 <entry id="dst_file"> 1102 <internal token="path"/> 1103 <external opt="required" type="char *"/> 1104 <comment>destination directory</comment> 1105 </entry> 1106 <entry id="dst_label"> 1107 <internal token="label"/> 1108 <external opt="required" type="m_label_t *"/> 1109 <comment>destination label</comment> 1110 </entry> 1111 <entry id="return"> 1112 <internal token="return"/> 1113 <external opt="none"/> 1114 </entry> 1115 </event> 1116 1117<!-- add new events here with the next higher idNo --> 1118<!-- Highest idNo is 50, so next is 51, then fix this comment --> 1119<!-- end of C Only events --> 1120 1121 1122<!-- 1123 token definitions are partially implemented. All they do for now 1124 is create a list of defined token names. In the future they may 1125 become a way of describing token structure. 1126--> 1127 1128 <token id="acl"> 1129 </token> 1130 <token id="arbitrary"> 1131 </token> 1132 <token id="arg"> 1133 </token> 1134 <token id="attr"> 1135 </token> 1136 <token id="command"> 1137 </token> 1138 <token id="command_1"> 1139 </token> 1140 <token id="date"> 1141 </token> 1142 <token id="exec_args"> 1143 </token> 1144 <token id="exec_env"> 1145 </token> 1146 <token id="exit"> 1147 </token> 1148 <token id="file"> 1149 </token> 1150 <token id="fmri"> 1151 </token> 1152 <token id="groups"> 1153 </token> 1154 <token id="in_addr"> 1155 </token> 1156 <token id="ipc"> 1157 </token> 1158 <token id="ipc_perm"> 1159 </token> 1160 <token id="label"> 1161 </token> 1162 <token id="newgroups"> 1163 </token> 1164 <token id="opaque"> 1165 </token> 1166 <token id="path"> 1167 </token> 1168 <!-- pseudo token; path list generates 0 or more path tokens --> 1169 <token id="path_list"> 1170 </token> 1171 <token id="tid"> 1172 </token> 1173 1174 <!-- 1175 privilege token is implemented as one of the pseudo tokens 1176 priv_limit, priv_effective, or priv_inherit 1177 1178 <token id="privilege"> 1179 </token> 1180 --> 1181 <token id="priv_effective"> 1182 </token> 1183 <token id="priv_inherit"> 1184 </token> 1185 <token id="priv_limit"> 1186 </token> 1187 <token id="process"> 1188 </token> 1189 <token id="return"> 1190 </token> 1191 <token id="seq"> 1192 </token> 1193 <token id="socket"> 1194 </token> 1195 <token id="socket-inet"> 1196 </token> 1197 <token id="subject"> 1198 </token> 1199 <token id="text"> 1200 </token> 1201 <token id="uauth"> 1202 </token> 1203 <token id="zonename"> 1204 </token> 1205 1206<!-- 1207 error value list for return values with success/fail code of fail. 1208 These values start at 1000 so praudit can tell the difference 1209 between the libbsm/common/audit_*.c broken error values and 1210 the new adt_ error value list. It is public so that praudit 1211 can find it. 1212 1213 praudit outputs "failure" %s" for these strings, so there is 1214 no need to use words such as "failed" in the message. 1215 1216 ** Add to the end only to maintain validity across versions of 1217 the audit log. ** 1218--> 1219 1220 <msg_list id="fail_value" header="0" start="1000" public="true"> 1221 <msg id="PW_ATTR">Attribute update</msg> 1222 <msg id="PW">Password update</msg> 1223 <msg id="USERNAME">bad username</msg> 1224 <msg id="AUTH">authorization failed</msg> 1225 <msg id="UID">bad uid</msg> 1226 <msg id="UNKNOWN">unknown failure</msg> 1227 <msg id="EXPIRED">password expired</msg> 1228 <msg id="ACCOUNT_LOCKED">Account is locked</msg> 1229 <msg id="BAD_DIALUP">Bad dial up</msg> 1230 <msg id="BAD_ID">Invalid ID</msg> 1231 <msg id="BAD_PW">Invalid password</msg> 1232 <msg id="CONSOLE">Not on console</msg> 1233 <msg id="MAX_TRIES">Too many failed attempts</msg> 1234 <msg id="PROTOCOL_FAILURE">Protocol failure</msg> 1235 <msg id="EXCLUDED_USER">Excluded user</msg> 1236 <msg id="ANON_USER">No anonymous</msg> 1237 <msg id="BAD_CMD">Invalid command</msg> 1238 <msg id="BAD_TTY">Standard input not a tty line</msg> 1239 <msg id="PROGRAM">Program failure</msg> 1240 <msg id="CHDIR_FAILED">chdir to home directory</msg> 1241 <msg id="INPUT_OVERFLOW">Input line too long.</msg> 1242 <msg id="DEVICE_PERM">login device override</msg> 1243 <msg id="AUTH_BYPASS">authorization bypass</msg> 1244 <msg id="LOGIN_DISABLED">login disabled</msg> 1245 </msg_list> 1246 1247<!-- 1248 The following empty list is used for PAM errors; the "start" 1249 value is used by praudit to know to use the PAM infrastructure 1250 for generating error strings 1251--> 1252 <msg_list id="fail_pam" header="0" start="2000" public="true"> 1253 </msg_list> 1254 1255<!-- 1256 This is still in use by SMC. See AUE_generic_login. When 1257 either SMC is fixed to stop using this, or SMC goes away. 1258 REMOVE this stuff and the corresponding AUE_generic_login 1259 message field. 1260 1261 Message list for the various authentication events, such 1262 as AUE_login and AUE_admin_authenticate. Add new entries 1263 at the end. The order of msg_list entries and the order 1264 of msg entries both affect the names in adt.h and the value 1265 of the associated enumerated types. 1266 1267 Each of these messages except NO_MSG is also in the failure_attribute 1268 list; the difference is that the messages below use a text token 1269 in the audit record, while the failure_attribute messages are 1270 associated with the return value of the return token. 1271 1272 This list is deprecated; please don't use text tokens for error 1273 messages. 1274--> 1275 1276 <msg_list id="login_text" header="0" deprecated="true"> 1277 <msg id="NO_MSG"></msg> 1278 <msg id="ACCOUNT_LOCKED">Account is locked</msg> 1279 <msg id="BAD_DIALUP">Bad dial up</msg> 1280 <msg id="BAD_ID">Invalid ID</msg> 1281 <msg id="BAD_PW">Invalid password</msg> 1282 <msg id="CONSOLE">Not on console</msg> 1283 <msg id="MAX_TRIES">Too many failed attempts</msg> 1284 <msg id="PROTOCOL_FAILURE">Protocol failure</msg> 1285 <msg id="EXCLUDED_USER">Excluded user</msg> 1286 <msg id="ANON_USER">No anonymous</msg> 1287 </msg_list> 1288 1289</specification> 1290