1<?xml version="1.0" standalone="yes"?> 2<!DOCTYPE specification SYSTEM "audit.dtd"> 3<!-- 4 CDDL HEADER START 5 6 The contents of this file are subject to the terms of the 7 Common Development and Distribution License (the "License"). 8 You may not use this file except in compliance with the License. 9 10 You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 11 or http://www.opensolaris.org/os/licensing. 12 See the License for the specific language governing permissions 13 and limitations under the License. 14 15 When distributing Covered Code, include this CDDL HEADER in each 16 file and include the License file at usr/src/OPENSOLARIS.LICENSE. 17 If applicable, add the following below this CDDL HEADER, with the 18 fields enclosed by brackets "[]" replaced with your own identifying 19 information: Portions Copyright [yyyy] [name of copyright owner] 20 21 CDDL HEADER END 22 23Copyright 2008 Sun Microsystems, Inc. All rights reserved. 24Use is subject to license terms. 25 26--> 27 28<specification> 29 30<!-- comments are displayed to stderr if debug is on --> 31<debug set="off"/> 32 33 <!-- The order of events is arbitrary EXCEPT generic events must 34 precede their instances --> 35 <!-- The order of entries within an event determine the order 36 data is defined in the external API --> 37 <!-- The order of internal / external is arbitrary --> 38 39<!-- 40 tags: 41 The following top level tags are defined: 42 <event> <token> <msg_list> <debug> 43 44 event defines an audit record 45 - id is the record id from audit_uevents.h 46 - reorder="yes" or "no". (default is "no"). 47 if "yes" then the order of the tokens to be 48 output does not match the order of the data 49 input. (see order attribute of <entry>) 50 - header defines the header file to contain the external 51 definitions for this event type. The header file 52 name is adt_event_N.h, where N is the value supplied 53 header="0" is for "stable" events, > 0 for new ones. 54 with this attribute. (header="1"). 55 - idNo is the number associated with the external 56 name of this event. (For AUE_login, ADT_login is 57 the external name and idNo is the value for 58 ADT_login.) 59 - omit is by default 'no' (i.e., don't omit) and can be 60 'always' or 'JNI'. In the latter case, C interface 61 code is generated but neither Java nor JNI code is. 62 - included text is just a comment 63 Within an event block, the following tags are defined: 64 <entry>, <debug>, <altname>, <title>, <program>, <see> 65 66 altname defines the internal name of an audit record; if 67 omitted, the internal name is the same as the 68 external name. 69 70 title, these tags are used by bsmrecord build to create 71 program, audit_record_attr database from adt events. 72 see Following example demonstrates their semantics: 73 74 bsmrecord -p passwd 75 passwd <- <title> 76 program various See passwd(1) 77 ^- <program> ^- <see> 78 event ID 6163 AUE_passwd 79 class lo (0x00001000) 80 header 81 subject 82 [text] username... 83 ^- <comment> 84 return 85 86 entry defines the correspondence between the data 87 supplied by the caller and the token to be 88 output. 89 - id is the data name that shows up in the structures 90 of adt_event.h If it is a comma separated list, 91 it is the list of names of data to be associated 92 with one output token. (See <external>, below) 93 Within an entry block, the following tags are defined: 94 <internal>, <external>, <debug>, <comment> 95 96 internal defines the token to be generated. 97 - token is a name that must also be defined with 98 a <token> tag elsewhere in this file. (order is 99 not important). 100 - order="some number" determines the order of the 101 tokens to be output, starting with 1. The subject 102 token is normally order="1". The use is to insure 103 that the order of fields listed in adt_event.h does 104 not change when we arbitrarily change the order of 105 tokens. If the <event reorder="yes"> is not set, 106 order is ignored. 107 - format is a printf-like string that will be used 108 in to format the data supplied by the user. 109 110 external defines the data to be supplied for creating the 111 token defined via <internal> 112 - opt is one of four values: "required", "optional", 113 "obsolete", or "none". The first two values 114 indicate that this token's data must or may 115 be supplied by the user; the third value is 116 equivalent to "optional" but shows in the 117 comment that this field is no longer used; 118 the forth value indicates that this token 119 does not require any user-supplied data. If 120 data is required, then a token is always 121 output, while optional data is output only 122 if data is supplied. 123 - type describes the C data type to be associated 124 with the <entry id="dataName">. The following 125 data types are representative: 126 127 au_asid_t (uint32_t) 128 char 129 char * (blank is optional) 130 char ** (blank is optional) 131 fd_t (int, a file descriptor) 132 uint_t, int, int32_t, uid_t, gid_t 133 uid_t *, gid_t * 134 long, ulong_t 135 m_label_t * 136 pid_t 137 priv_set_t * 138 uint16_t, unit32_t, uint64_t 139 uint32_t *, uint32_t[], uint64_t * 140 msg (not a C type, see below) 141 142 Below is what Tony said. Above seems to be 143 what is implemented 144 char 145 char * (blank is optional) 146 char ** (blank is optional) 147 int, uid_t, gid_t 148 int *, uid_t *, gid_t * 149 msg (not a C type, see below) 150 time_t 151 uint, uint * 152 153 The msg type refers to an enumerated type 154 that must be defined via a <msg> description 155 else where in this file. The syntax is 156 special. Example: <external opt="optional" 157 type="msg login_text"/> "login_text" is the 158 id of a <msg_list> descriptor given 159 elsewhere in this file. 160 161 If the <entry> id is a list, the type must also 162 be a comma-separated list, where the types are 163 in the same order as the id's. 164 If the type is an array, its length must be given 165 explicitly. 166 167 comment Used by bsmrecord build to generate audit_record_attr. 168 Comment is explanation note printed with token type. 169 Colon (':') may not be used in a comment. 170 See example above for other tags related to bsmrecord. 171 172 token Define allowed token names. 173 - id is the name of token; this name is used 174 as an <internal> id. 175 - a token id name may not end in digits. 176 - usage is an optional value. At present, only 177 "TSOL" is defined; it means that this data is 178 to be used only in Trusted Solaris implementations. 179 180 msg_list Define a set of text strings. 181 - id is the name to be used for this group of text 182 strings in adt_event.h 183 - header is as defined for <event> 184 - start is a number where produced enum type begins; 185 ensure msg lists do not overlap 186 Within a msg_list block, <msg> and <debug> are defined. 187 The order of <msg> tags in a msg_list is reflected 188 directly in adt_event.h. Also add ADT_LIST_<<id>> to 189 enum adt_msg_list in adt_xlate.h. 190 191 msg Define one string. 192 - id is the name to be used in the enum describing 193 this set of strings. Convention: use upper case. 194 The content (text between <msg> and </msg>) is the 195 actual string. Extra white space, including line 196 feeds, is ignored. If empty, no output token 197 is generated unless the <external> opt attribute is 198 set to "required", in which case a blank text token 199 is generated. 200 Within a msg block, <debug> is defined, but has not been 201 tested and may have no effect. 202 203 debug This turns on/off debug messages during the processing 204 of the xml data. It affects the block within which it 205 is defined. 206 - set may have one of two values: "on" or "off". If 207 set is omitted, the debug state for the current block 208 is toggled. 209 The use of the <debug> tag does not affect the output 210 of data to the various files created, but does generate 211 potentially large amounts of output to stderr. 212 213--> 214<!-- template for an event record definition 215 216 <event id="" header="0" idNo=""> 217 <entry id="subject"> 218 <internal token="subject"/> 219 <external opt="none"/> 220 </entry> 221 <entry id=""> 222 <internal token=""/> 223 <external opt="" type="" /> 224 </entry> 225 <entry id="return"> 226 <internal token="return"/> 227 <external opt="none"/> 228 </entry> 229 </event> 230 231 Generic events must precede Instance events; within each 232 group, please group the AUE_* by area and event idNo-s in order, 233 gaps in idNo-s are OK. 234 N.B. Renumbering idNo-s requires recompilation of consumers. See 235 the contracts for whom to notify if/when this happens. 236--> 237 238<!-- generic events --> 239 240 <!-- 241 'omit="always"' means that this record type is not reflected 242 in the generated header and table files. 243 --> 244 245 <event id="AUE_generic_basic" type="generic" omit="always"> 246 <!-- 247 248 This is a template for the event types that have no tokens 249 other than the header and return. There is no allowed_type 250 list because the template is not externally visible due to the 251 omit="always". 252 253 --> 254 <entry id="subject"> 255 <internal token="subject"/> 256 <external opt="none"/> 257 </entry> 258 <entry id="return"> 259 <internal token="return"/> 260 <external opt="none"/> 261 </entry> 262 </event> 263 264 <event id="AUE_generic_login" type="generic" omit="always"> 265 <!-- 266 267 This is a template for the various login event types 268 AUE_login, AUE_ftp, etc which match this template. There is 269 no allowed_type list because the template is not externally 270 visible due to the omit="always". 271 272 --> 273 <entry id="subject"> 274 <internal token="subject"/> 275 <external opt="none"/> 276 </entry> 277 278 <!-- This field is still in use for SMC until it is cleaned up, 279 it must remain, see login_text msg list at the end of the 280 file. 281 --> 282 <entry id="message"> 283 <internal token="text"/> 284 <external opt="optional" type="msg login_text"/> 285 <comment>error message</comment> 286 </entry> 287 <entry id="return"> 288 <internal token="return"/> 289 <external opt="none"/> 290 </entry> 291 </event> 292 293<!-- generic SMC events --> 294 295 <event id="AUE_generic_SMC_add" type="generic" omit="always"> 296 <entry id="subject"> 297 <internal token="subject"/> 298 <external opt="none"/> 299 </entry> 300 <entry id="object_name"> 301 <internal token="text"/> 302 <external opt="required" type="char *"/> 303 <comment>object name</comment> 304 </entry> 305 <entry id="domain"> 306 <internal token="text"/> 307 <external opt="optional" type="char *"/> 308 <comment>domain</comment> 309 </entry> 310 <entry id="name_service"> 311 <internal token="text"/> 312 <external opt="required" type="char *"/> 313 <comment>name_service</comment> 314 </entry> 315 <entry id="auth_used"> 316 <internal token="uauth"/> 317 <external opt="optional" type="char *"/> 318 <comment>authorization used</comment> 319 </entry> 320 <!-- 321 This should really be its own token type, not "text" 322 --> 323 <entry id="initial_values"> 324 <internal token="text"/> 325 <external opt="required" type="char *"/> 326 <comment>initial values</comment> 327 </entry> 328 <entry id="return"> 329 <internal token="return"/> 330 <external opt="none"/> 331 </entry> 332 </event> 333 334 <event id="AUE_generic_SMC_delete" type="generic" omit="always"> 335 <entry id="subject"> 336 <internal token="subject"/> 337 <external opt="none"/> 338 </entry> 339 <entry id="object_name"> 340 <internal token="text"/> 341 <external opt="required" type="char *"/> 342 <comment>object name</comment> 343 </entry> 344 <entry id="domain"> 345 <internal token="text"/> 346 <external opt="optional" type="char *"/> 347 <comment>domain</comment> 348 </entry> 349 <entry id="name_service"> 350 <internal token="text"/> 351 <external opt="required" type="char *"/> 352 <comment>name_service</comment> 353 </entry> 354 <entry id="auth_used"> 355 <internal token="uauth"/> 356 <external opt="optional" type="char *"/> 357 <comment>authorization used</comment> 358 </entry> 359 <entry id="delete_values"> 360 <internal token="text"/> 361 <external opt="required" type="char *"/> 362 <comment>deleted values</comment> 363 </entry> 364 <entry id="return"> 365 <internal token="return"/> 366 <external opt="none"/> 367 </entry> 368 </event> 369 370 <event id="AUE_generic_SMC_modify" type="generic" omit="always"> 371 <entry id="subject"> 372 <internal token="subject"/> 373 <external opt="none"/> 374 </entry> 375 <entry id="object_name"> 376 <internal token="text"/> 377 <external opt="required" type="char *"/> 378 <comment>object name</comment> 379 </entry> 380 <entry id="domain"> 381 <internal token="text"/> 382 <external opt="optional" type="char *"/> 383 <comment>domain</comment> 384 </entry> 385 <entry id="name_service"> 386 <internal token="text"/> 387 <external opt="required" type="char *"/> 388 <comment>name_service</comment> 389 </entry> 390 <entry id="auth_used"> 391 <internal token="uauth"/> 392 <external opt="optional" type="char *"/> 393 <comment>authorization used</comment> 394 </entry> 395 <entry id="changed_values"> 396 <internal token="text"/> 397 <external opt="required" type="char *"/> 398 <comment>changed values</comment> 399 </entry> 400 <entry id="return"> 401 <internal token="return"/> 402 <external opt="none"/> 403 </entry> 404 </event> 405 406<!-- instances --> 407 408<!-- 409 Java needed for SMC events. Since the SMC events grow less 410 often than the C related events. They come first. It 411 would be nice to reorder the idNo-s, but that's an ABI 412 change and should rev libbsm version no. If reordered 413 start with 1 and eliminate the comment at the end about 414 the highest idNo. 415--> 416 <event id="AUE_admin_authenticate" instance_of="AUE_generic_login" 417 header="0" idNo="3"> 418 <title>Admin Server Authentication</title> 419 <program>admin (various)</program> 420 <see>SMC, WBEM, or AdminSuite</see> 421 </event> 422 423 <event id="AUE_filesystem_add" instance_of="AUE_generic_SMC_add" 424 header="0" idNo="4"> 425 <title>SMC: filesystem add</title> 426 <program>SMC server</program> 427 </event> 428 <event id="AUE_filesystem_delete" instance_of="AUE_generic_SMC_delete" 429 header="0" idNo="5"> 430 <title>SMC: filesystem delete</title> 431 <program>SMC server</program> 432 </event> 433 <event id="AUE_filesystem_modify" instance_of="AUE_generic_SMC_modify" 434 header="0" idNo="6"> 435 <title>SMC: filesystem modify</title> 436 <program>SMC server</program> 437 </event> 438 439 <event id="AUE_network_add" instance_of="AUE_generic_SMC_add" 440 header="0" idNo="7"> 441 <title>SMC: network add</title> 442 <program>SMC server</program> 443 </event> 444 <event id="AUE_network_delete" instance_of="AUE_generic_SMC_delete" 445 header="0" idNo="8"> 446 <title>SMC: network delete</title> 447 <program>SMC server</program> 448 </event> 449 <event id="AUE_network_modify" instance_of="AUE_generic_SMC_modify" 450 header="0" idNo="9"> 451 <title>SMC: network modify</title> 452 <program>SMC server</program> 453 </event> 454 455 <event id="AUE_printer_add" instance_of="AUE_generic_SMC_add" 456 header="0" idNo="10"> 457 <title>SMC: printer add</title> 458 <program>SMC server</program> 459 </event> 460 <event id="AUE_printer_delete" instance_of="AUE_generic_SMC_delete" 461 header="0" idNo="11"> 462 <title>SMC: printer delete</title> 463 <program>SMC server</program> 464 </event> 465 <event id="AUE_printer_modify" instance_of="AUE_generic_SMC_modify" 466 header="0" idNo="12"> 467 <title>SMC: printer modify</title> 468 <program>SMC server</program> 469 </event> 470 471<!-- 472 This is SMC; it's also used in su and should probably be used in 473 desktop role login. If we fix the SMC to not record NO_MSG here, 474 we can fix to record failed user. See su.c and AUE_su. 475--> 476 <event id="AUE_role_login" instance_of="AUE_generic_login" 477 header="0" idNo="13"> 478 <title>RBAC: role login</title> 479 <program>SMC server</program> 480 <program>/usr/bin/su</program> 481 </event> 482 483 <event id="AUE_scheduledjob_add" instance_of="AUE_generic_SMC_add" 484 header="0" idNo="14"> 485 <title>SMC: scheduled job add</title> 486 <program>SMC server</program> 487 </event> 488 <event id="AUE_scheduledjob_delete" instance_of="AUE_generic_SMC_delete" 489 header="0" idNo="15"> 490 <title>SMC: scheduled job delete</title> 491 <program>SMC server</program> 492 </event> 493 <event id="AUE_scheduledjob_modify" instance_of="AUE_generic_SMC_modify" 494 header="0" idNo="16"> 495 <title>SMC: scheduled job modify</title> 496 <program>SMC server</program> 497 </event> 498 499 <event id="AUE_serialport_add" instance_of="AUE_generic_SMC_add" 500 header="0" idNo="17"> 501 <title>SMC: serial port add</title> 502 <program>SMC server</program> 503 </event> 504 <event id="AUE_serialport_delete" instance_of="AUE_generic_SMC_delete" 505 header="0" idNo="18"> 506 <title>SMC: serial port delete</title> 507 <program>SMC server</program> 508 </event> 509 <event id="AUE_serialport_modify" instance_of="AUE_generic_SMC_modify" 510 header="0" idNo="19"> 511 <title>SMC: serial port modify</title> 512 <program>SMC server</program> 513 </event> 514 515<!-- This is SMC; should this also be used elsewhere? --> 516 <event id="AUE_uauth" header="0" idNo="20"> 517 <title>SMC: Use of Authorization</title> 518 <program>SMC server</program> 519 <entry id="subject"> 520 <internal token="subject"/> 521 <external opt="none"/> 522 </entry> 523 <entry id="auth_used"> 524 <internal token="uauth"/> 525 <external opt="required" type="char *"/> 526 <comment>authorization used</comment> 527 </entry> 528 <entry id="objectname"> 529 <internal token="text"/> 530 <external opt="required" type="char *"/> 531 <comment>object name</comment> 532 </entry> 533 <entry id="return"> 534 <internal token="return"/> 535 <external opt="none"/> 536 </entry> 537 </event> 538 539 <event id="AUE_usermgr_add" instance_of="AUE_generic_SMC_add" 540 header="0" idNo="21"> 541 <title>SMC: User Manager add</title> 542 <program>SMC server</program> 543 </event> 544 <event id="AUE_usermgr_delete" instance_of="AUE_generic_SMC_delete" 545 header="0" idNo="22"> 546 <title>SMC: User Manager delete</title> 547 <program>SMC server</program> 548 </event> 549 <event id="AUE_usermgr_modify" instance_of="AUE_generic_SMC_modify" 550 header="0" idNo="23"> 551 <title>SMC: User Manager modify</title> 552 <program>SMC server</program> 553 </event> 554<!-- end of Java needed for SMC events --> 555<!-- 556 while not used by SMC logout is used by Lockhart 557--> 558 <event id="AUE_logout" header="0" idNo="1"> 559 <title>login: logout</title> 560 <program>various</program> 561 <see>login(1)</see> 562 <entry id="subject"> 563 <internal token="subject"/> 564 <external opt="none"/> 565 </entry> 566<!-- 567 not used by C code, used by Lockhart, 568 get them to change and remove 569 event.user_name("logout " + session.getUserName()); 570 from /ws/lockhart-nv-gate/src/bundled/app/webmgt/lib/services/ 571 com/sun/management/services/audit/SolarisAuditEvent_Logout.java 572--> 573 <entry id="user_name"> 574 <internal token="text" format="logout %s"/> 575 <external opt="optional" type="char *"/> 576 <comment>"logout" username</comment> 577 </entry> 578 <entry id="return"> 579 <internal token="return"/> 580 <external opt="none"/> 581 </entry> 582 </event> 583 584 585<!-- C Only events --> 586 <event id="AUE_init_solaris" header="0" idNo="32" omit="JNI"> 587 <title>init</title> 588 <program>/sbin/init</program> 589 <program>/usr/sbin/init</program> 590 <program>/usr/sbin/shutdown</program> 591 <entry id="subject"> 592 <internal token="subject"/> 593 <external opt="none"/> 594 </entry> 595 <entry id="info"> 596 <internal token="text"/> 597 <external opt="optional" type="char *"/> 598 <comment>init level or zone name</comment> 599 </entry> 600 <entry id="return"> 601 <internal token="return"/> 602 <external opt="none"/> 603 </entry> 604 </event> 605 606 <event id="AUE_login" instance_of="AUE_generic_login" header="0" 607 idNo="25" omit="JNI"> 608 <title>terminal login</title> 609 <program>/usr/sbin/login</program> 610 <program>/usr/dt/bin/dtlogin</program> 611 <see>login(1)</see> 612 <see>dtlogin</see> 613 </event> 614 <event id="AUE_rlogin" instance_of="AUE_generic_login" header="0" 615 idNo="28" omit="JNI"> 616 <title>rlogin</title> 617 <program>/usr/sbin/login</program> 618 <see>login(1) - rlogin</see> 619 </event> 620 <event id="AUE_telnet" instance_of="AUE_generic_login" header="0" 621 idNo="29" omit="JNI"> 622 <title>telnet login</title> 623 <program>/usr/sbin/login</program> 624 <see>login(1) - telnet</see> 625 </event> 626 <event id="AUE_ssh" instance_of="AUE_generic_login" header="0" 627 idNo="2" omit="JNI"> 628 <program>/usr/lib/ssh/sshd</program> 629 </event> 630 631 <event id="AUE_zlogin" header="0" idNo="38" omit="JNI"> 632 <title>zone login</title> 633 <program>/usr/sbin/login</program> 634 <see>zlogin(1)</see> 635 <entry id="subject"> 636 <internal token="subject"/> 637 <external opt="none"/> 638 </entry> 639 <entry id="message"> 640 <internal token="text"/> 641 <external opt="optional" type="char *"/> 642 <comment>error message</comment> 643 </entry> 644 <entry id="return"> 645 <internal token="return"/> 646 <external opt="none"/> 647 </entry> 648 </event> 649 650 <event id="AUE_su" header="0" idNo="30" omit="JNI"> 651 <title>su</title> 652 <program>/usr/bin/su</program> 653 <see>su(1M)</see> 654 <entry id="subject"> 655 <internal token="subject"/> 656 <external opt="none"/> 657 </entry> 658<!-- 659 should be changed to "fail_user" and su.c updated 660 However, the jni stuff is broken, so for now it's "message" 661--> 662 <entry id="message"> 663 <internal token="text"/> 664 <external opt="optional" type="char *"/> 665 <comment>"user name" of failed new user/role</comment> 666 </entry> 667 <entry id="return"> 668 <internal token="return"/> 669 <external opt="none"/> 670 </entry> 671 </event> 672 673 <event id="AUE_passwd" header="0" idNo="27" omit="JNI"> 674 <title>passwd</title> 675 <program>various</program> 676 <see>passwd(1)</see> 677 <entry id="subject"> 678 <internal token="subject"/> 679 <external opt="none"/> 680 </entry> 681 <entry id="username"> 682 <internal token="text"/> 683 <external opt="optional" type="char *"/> 684 <comment>username if different than caller</comment> 685 </entry> 686 <entry id="return"> 687 <internal token="return"/> 688 <external opt="none"/> 689 </entry> 690 </event> 691 692 <event id="AUE_screenlock" instance_of="AUE_generic_basic" header="0" 693 idNo="26" omit="JNI"> 694 <program>desktop screen lock</program> 695 </event> 696 <event id="AUE_screenunlock" instance_of="AUE_generic_basic" header="0" 697 idNo="31" omit="JNI"> 698 <program>desktop screen unlock</program> 699 </event> 700 701 <!-- 702 AUE_prof_cmd is not supportable for Java due to the structure of 703 the priv token. When and if a Java program needs to generate 704 a priv token, we'll need to look at the data format in the 705 Java code and provide an appropriate java and jni implementation. 706 --> 707 708 <event id="AUE_prof_cmd" header="0" idNo="24" omit="JNI"> 709 <title>pfexec</title> 710 <program>/usr/bin/pfexec</program> 711 <see>pfexec(1)</see> 712 <entry id="subject"> 713 <internal token="subject"/> 714 <external opt="none"/> 715 </entry> 716 <entry id="cwdpath"> 717 <internal token="path"/> 718 <external opt="required" type="char*"/> 719 <comment>working directory</comment> 720 </entry> 721 <entry id="cmdpath"> 722 <internal token="path"/> 723 <external opt="required" type="char*"/> 724 <comment>command pathname</comment> 725 </entry> 726 <entry id="argc,argv,envp"> 727 <internal token="command"/> 728 <external opt="required" type="int,char**,char**"/> 729 </entry> 730 <entry id="proc_auid,proc_euid,proc_egid,proc_ruid,proc_rgid,proc_pid,proc_sid,proc_termid"> 731 <internal token="process"/> 732 <external opt="required" 733 type="uid_t,uid_t,gid_t,uid_t,gid_t,pid_t,au_asid_t,termid*"/> 734 </entry> 735 <entry id="limit_set"> 736 <internal token="priv_limit"/> 737 <external opt="optional" type="priv_set_t*"/> 738 </entry> 739 <entry id="inherit_set"> 740 <internal token="priv_inherit"/> 741 <external opt="optional" type="priv_set_t*"/> 742 </entry> 743 <entry id="return"> 744 <internal token="return"/> 745 <external opt="none"/> 746 </entry> 747 </event> 748 749 <event id="AUE_inetd_connect" header="0" idNo="34" omit="JNI"> 750 <title>inetd</title> 751 <program>/usr/sbin/inetd</program> 752 <entry id="subject"> 753 <internal token="subject"/> 754 <external opt="none"/> 755 </entry> 756 <entry id="service_name"> 757 <internal token="text"/> 758 <external opt="optional" type="char *"/> 759 <comment>service name</comment> 760 </entry> 761 <entry id="ip_type,ip_remote_port,ip_local_port,ip_adr"> 762 <internal token="tid"/> 763 <external opt="required" 764 type="uint32_t,uint16_t,uint16_t,uint32_t[4]"/> 765 <comment>client address</comment> 766 </entry> 767 <entry id="cmd"> 768 <internal token="command_alt"/> 769 <external opt="required" type="char *"/> 770 <comment>inetd command</comment> 771 </entry> 772 <entry id="privileges"> 773 <internal token="priv_effective"/> 774 <external opt="required" type="priv_set_t *"/> 775 </entry> 776 <entry id="return"> 777 <internal token="return"/> 778 <external opt="none"/> 779 </entry> 780 </event> 781 782 <event id="AUE_inetd_ratelimit" header="0" idNo="35" omit="JNI"> 783 <title>inetd</title> 784 <program>/usr/sbin/inetd</program> 785 <entry id="subject"> 786 <internal token="subject"/> 787 <external opt="none"/> 788 </entry> 789 <entry id="service_name"> 790 <internal token="text"/> 791 <external opt="optional" type="char *"/> 792 <comment>service name</comment> 793 </entry> 794 <entry id="limit"> 795 <internal token="text"/> 796 <external opt="required" type="char *"/> 797 <comment>limit value</comment> 798 </entry> 799 <entry id="return"> 800 <internal token="return"/> 801 <external opt="none"/> 802 </entry> 803 </event> 804 805 <event id="AUE_inetd_copylimit" header="0" idNo="36" omit="JNI"> 806 <title>inetd</title> 807 <program>/usr/sbin/inetd</program> 808 <entry id="subject"> 809 <internal token="subject"/> 810 <external opt="none"/> 811 </entry> 812 <entry id="service_name"> 813 <internal token="text"/> 814 <external opt="optional" type="char *"/> 815 <comment>service name</comment> 816 </entry> 817 <entry id="limit"> 818 <internal token="text"/> 819 <external opt="required" type="char *"/> 820 <comment>limit value</comment> 821 </entry> 822 <entry id="return"> 823 <internal token="return"/> 824 <external opt="none"/> 825 </entry> 826 </event> 827 828 <event id="AUE_inetd_failrate" header="0" idNo="37" omit="JNI"> 829 <title>inetd</title> 830 <program>/usr/sbin/inetd</program> 831 <entry id="subject"> 832 <internal token="subject"/> 833 <external opt="none"/> 834 </entry> 835 <entry id="service_name"> 836 <internal token="text"/> 837 <external opt="optional" type="char *"/> 838 <comment>service name</comment> 839 </entry> 840 <entry id="values"> 841 <internal token="text"/> 842 <external opt="required" type="char *"/> 843 <comment>limit value, interval</comment> 844 </entry> 845 <entry id="return"> 846 <internal token="return"/> 847 <external opt="none"/> 848 </entry> 849 </event> 850 851 <event id="AUE_zone_state" header="0" idNo="33" omit="JNI"> 852 <entry id="subject"> 853 <internal token="subject"/> 854 <external opt="none"/> 855 </entry> 856 <entry id="new_state"> 857 <internal token="text"/> 858 <external opt="required" type="char *"/> 859 <comment>New zone state</comment> 860 </entry> 861 <entry id="zonename"> 862 <internal token="zonename"/> 863 <external opt="required" type="char *"/> 864 <comment>zone name</comment> 865 </entry> 866 <entry id="return"> 867 <internal token="return"/> 868 <external opt="none"/> 869 </entry> 870 </event> 871 872 <event id="AUE_su_logout" instance_of="AUE_generic_basic" 873 header="0" idNo="39" omit="JNI"> 874 <title>su</title> 875 <program>/usr/bin/su</program> 876 <see>su(1M)</see> 877 </event> 878 879 <event id="AUE_role_logout" instance_of="AUE_generic_basic" 880 header="0" idNo="40" omit="JNI"> 881 <title>su</title> 882 <program>/usr/bin/su</program> 883 <see>su(1M)</see> 884 </event> 885 886 <event id="AUE_newgrp_login" header="0" idNo="41" omit="JNI"> 887 <program>newgrp</program> 888 <entry id="subject"> 889 <internal token="subject"/> 890 <external opt="none"/> 891 </entry> 892 <entry id="groupname"> 893 <internal token="text"/> 894 <external opt="required" type="char *"/> 895 <comment>group name</comment> 896 </entry> 897 <entry id="return"> 898 <internal token="return"/> 899 <external opt="none"/> 900 </entry> 901 </event> 902 903 <event id="AUE_generic_mountable" type="generic" omit="always"> 904 <!-- 905 906 User device mounting related functions 907 908 --> 909 <entry id="subject"> 910 <internal token="subject"/> 911 <external opt="none"/> 912 </entry> 913 <entry id="auth_used"> 914 <internal token="uauth"/> 915 <external opt="required" type="char *"/> 916 <comment>authorization used</comment> 917 </entry> 918 <entry id="mount_point"> 919 <internal token="path"/> 920 <external opt="required" type="char *"/> 921 <comment>mount point</comment> 922 </entry> 923 <entry id="device"> 924 <internal token="path"/> 925 <external opt="required" type="char *"/> 926 <comment>device</comment> 927 </entry> 928 <entry id="options"> 929 <internal token="text"/> 930 <external opt="optional" type="char *"/> 931 <comment>options</comment> 932 </entry> 933 <entry id="return"> 934 <internal token="return"/> 935 <external opt="none"/> 936 </entry> 937 </event> 938 939 <event id="AUE_attach" instance_of="AUE_generic_mountable" 940 header="0" idNo="42" omit="JNI"> 941 <program>hald</program> 942 </event> 943 <event id="AUE_detach" instance_of="AUE_generic_mountable" 944 header="0" idNo="43" omit="JNI"> 945 <program>hald</program> 946 </event> 947 <event id="AUE_remove" header="0" idNo="44" omit="JNI"> 948 <program>hald</program> 949 <entry id="subject"> 950 <internal token="subject"/> 951 <external opt="none"/> 952 </entry> 953 <entry id="auth_used"> 954 <internal token="uauth"/> 955 <external opt="required" type="char *"/> 956 <comment>authorization used</comment> 957 </entry> 958 <entry id="mount_point"> 959 <internal token="path"/> 960 <external opt="optional" type="char *"/> 961 <comment>mount point</comment> 962 </entry> 963 <entry id="device"> 964 <internal token="path"/> 965 <external opt="required" type="char *"/> 966 <comment>device</comment> 967 </entry> 968 <entry id="return"> 969 <internal token="return"/> 970 <external opt="none"/> 971 </entry> 972 </event> 973 974 <event id="AUE_pool_import" header="0" idNo="45" omit="JNI"> 975 <program>hald</program> 976 <entry id="subject"> 977 <internal token="subject"/> 978 <external opt="none"/> 979 </entry> 980 <entry id="auth_used"> 981 <internal token="uauth"/> 982 <external opt="required" type="char *"/> 983 <comment>authorization used</comment> 984 </entry> 985 <entry id="pool"> 986 <internal token="text"/> 987 <external opt="required" type="char *"/> 988 <comment>pool</comment> 989 </entry> 990 <entry id="device"> 991 <internal token="path"/> 992 <external opt="required" type="char *"/> 993 <comment>device</comment> 994 </entry> 995 <entry id="return"> 996 <internal token="return"/> 997 <external opt="none"/> 998 </entry> 999 </event> 1000 <event id="AUE_pool_export" header="0" idNo="46" omit="JNI"> 1001 <program>hald</program> 1002 <entry id="subject"> 1003 <internal token="subject"/> 1004 <external opt="none"/> 1005 </entry> 1006 <entry id="auth_used"> 1007 <internal token="uauth"/> 1008 <external opt="required" type="char *"/> 1009 <comment>authorization used</comment> 1010 </entry> 1011 <entry id="pool"> 1012 <internal token="text"/> 1013 <external opt="required" type="char *"/> 1014 <comment>pool</comment> 1015 </entry> 1016 <entry id="device"> 1017 <internal token="path"/> 1018 <external opt="required" type="char *"/> 1019 <comment>device</comment> 1020 </entry> 1021 <entry id="return"> 1022 <internal token="return"/> 1023 <external opt="none"/> 1024 </entry> 1025 </event> 1026 1027<!-- dladm security objected events --> 1028 <event id="AUE_dladm_generic" type="generic" omit="always"> 1029 <entry id="subject"> 1030 <internal token="subject"/> 1031 <external opt="none"/> 1032 </entry> 1033 <entry id="auth_used"> 1034 <internal token="uauth"/> 1035 <external opt="required" type="char *"/> 1036 <comment>authorization used</comment> 1037 </entry> 1038 <entry id="obj_class"> 1039 <internal token="text"/> 1040 <external opt="required" type="char *"/> 1041 <comment>object class name</comment> 1042 </entry> 1043 <entry id="obj_name"> 1044 <internal token="text"/> 1045 <external opt="required" type="char *"/> 1046 <comment>object name</comment> 1047 </entry> 1048 <entry id="return"> 1049 <internal token="return"/> 1050 <external opt="none"/> 1051 </entry> 1052 </event> 1053 1054 <event id="AUE_dladm_create_secobj" instance_of="AUE_dladm_generic" 1055 header="0" idNo="47" omit="JNI"> 1056 <title>create wifi security object</title> 1057 <program>/usr/sbin/dladm</program> 1058 <see>dladm(1M)</see> 1059 </event> 1060 <event id="AUE_dladm_delete_secobj" instance_of="AUE_dladm_generic" 1061 header="0" idNo="48" omit="JNI"> 1062 <title>delete wifi security object</title> 1063 <program>/usr/sbin/dladm</program> 1064 <see>dladm(1M)</see> 1065 </event> 1066 1067<!-- Trusted eXtensions (TX) events --> 1068 1069 <!-- labeld events --> 1070 <event id="AUE_file_relabel" header="0" idNo="49" omit="JNI"> 1071 <title>relabel file from one zone to another</title> 1072 <program>setlabel(1)</program> 1073 <see>setflabel(3TSOL)</see> 1074 <entry id="subject"> 1075 <internal token="subject"/> 1076 <external opt="none"/> 1077 </entry> 1078 <entry id="auth_used"> 1079 <internal token="uauth"/> 1080 <external opt="required" type="char *"/> 1081 <comment>authorization used</comment> 1082 </entry> 1083 <entry id="file"> 1084 <internal token="path"/> 1085 <external opt="required" type="char *"/> 1086 <comment>file relabeled</comment> 1087 </entry> 1088 <entry id="src_label"> 1089 <internal token="label"/> 1090 <external opt="required" type="m_label_t *"/> 1091 <comment>original label</comment> 1092 </entry> 1093 <entry id="dst_label"> 1094 <internal token="label"/> 1095 <external opt="required" type="m_label_t *"/> 1096 <comment>new label</comment> 1097 </entry> 1098 <entry id="return"> 1099 <internal token="return"/> 1100 <external opt="none"/> 1101 </entry> 1102 </event> 1103 1104 <event id="AUE_file_copy" header="0" idNo="50" omit="JNI"> 1105 <title>copy file to another zone</title> 1106 <program>dtfile(1X)</program> 1107 <entry id="subject"> 1108 <internal token="subject"/> 1109 <external opt="none"/> 1110 </entry> 1111 <entry id="auth_used"> 1112 <internal token="uauth"/> 1113 <external opt="required" type="char *"/> 1114 <comment>authorization used</comment> 1115 </entry> 1116 <entry id="src_file"> 1117 <internal token="path"/> 1118 <external opt="required" type="char *"/> 1119 <comment>source file</comment> 1120 </entry> 1121 <entry id="src_label"> 1122 <internal token="label"/> 1123 <external opt="required" type="m_label_t *"/> 1124 <comment>source label</comment> 1125 </entry> 1126 <entry id="dst_file"> 1127 <internal token="path"/> 1128 <external opt="required" type="char *"/> 1129 <comment>destination directory</comment> 1130 </entry> 1131 <entry id="dst_label"> 1132 <internal token="label"/> 1133 <external opt="required" type="m_label_t *"/> 1134 <comment>destination label</comment> 1135 </entry> 1136 <entry id="return"> 1137 <internal token="return"/> 1138 <external opt="none"/> 1139 </entry> 1140 </event> 1141 1142 <!-- uadmin(1m) events --> 1143 <event id="AUE_uadmin_generic" type="generic" omit="always"> 1144 <entry id="subject"> 1145 <internal token="subject"/> 1146 <external opt="none"/> 1147 </entry> 1148 <entry id="fcn"> 1149 <internal token="text"/> 1150 <external opt="required" type="msg uadmin_fcn"/> 1151 <comment>next action</comment> 1152 </entry> 1153 <entry id="mdep"> 1154 <internal token="text"/> 1155 <external opt="optional" type="char *"/> 1156 <comment>machine dependent argument</comment> 1157 </entry> 1158 <entry id="return"> 1159 <internal token="return"/> 1160 <external opt="none"/> 1161 </entry> 1162 </event> 1163 <event id="AUE_uadmin_generic_fcn" type="generic" omit="always"> 1164 <entry id="subject"> 1165 <internal token="subject"/> 1166 <external opt="none"/> 1167 </entry> 1168 <entry id="fcn"> 1169 <internal token="text"/> 1170 <external opt="required" type="msg uadmin_fcn"/> 1171 <comment>next action</comment> 1172 </entry> 1173 <entry id="return"> 1174 <internal token="return"/> 1175 <external opt="none"/> 1176 </entry> 1177 </event> 1178 <event id="AUE_uadmin_shutdown" instance_of="AUE_uadmin_generic" 1179 header="0" idNo="51" omit="JNI"> 1180 <title>uadmin shutdown</title> 1181 <program>/sbin/uadmin</program> 1182 <program>/usr/sbin/uadmin</program> 1183 <see>uadmin(1M)</see> 1184 </event> 1185 <event id="AUE_uadmin_reboot" instance_of="AUE_uadmin_generic" 1186 header="0" idNo="52" omit="JNI"> 1187 <title>uadmin reboot</title> 1188 <program>/sbin/uadmin</program> 1189 <program>/usr/sbin/uadmin</program> 1190 <see>uadmin(1M)</see> 1191 </event> 1192 <event id="AUE_uadmin_dump" instance_of="AUE_uadmin_generic" 1193 header="0" idNo="53" omit="JNI"> 1194 <title>uadmin dump</title> 1195 <program>/sbin/uadmin</program> 1196 <program>/usr/sbin/uadmin</program> 1197 <see>uadmin(1M)</see> 1198 </event> 1199 <event id="AUE_uadmin_freeze" instance_of="AUE_uadmin_generic" 1200 header="0" idNo="54" omit="JNI"> 1201 <title>uadmin freeze</title> 1202 <program>/sbin/uadmin</program> 1203 <program>/usr/sbin/uadmin</program> 1204 <see>uadmin(1M)</see> 1205 </event> 1206 <event id="AUE_uadmin_remount" header="0" idNo="55" omit="JNI"> 1207 <title>uadmin remount</title> 1208 <program>/sbin/uadmin</program> 1209 <program>/usr/sbin/uadmin</program> 1210 <see>uadmin(1M)</see> 1211 <entry id="subject"> 1212 <internal token="subject"/> 1213 <external opt="none"/> 1214 </entry> 1215 <entry id="return"> 1216 <internal token="return"/> 1217 <external opt="none"/> 1218 </entry> 1219 </event> 1220 <!-- uadmin ftrace and swapctl are not documented in uadmin(2) --> 1221 <event id="AUE_uadmin_ftrace" instance_of="AUE_uadmin_generic_fcn" 1222 header="0" idNo="56" omit="JNI"> 1223 <title>uadmin ftrace</title> 1224 <program>/sbin/uadmin</program> 1225 <program>/usr/sbin/uadmin</program> 1226 <see>uadmin(1M)</see> 1227 </event> 1228 <event id="AUE_uadmin_swapctl" instance_of="AUE_uadmin_generic_fcn" 1229 header="0" idNo="57" omit="JNI"> 1230 <title>uadmin swapctl</title> 1231 <program>/sbin/uadmin</program> 1232 <program>/usr/sbin/uadmin</program> 1233 <see>uadmin(1M)</see> 1234 </event> 1235 <event id="AUE_uadmin_thaw" header="0" idNo="96" omit="JNI"> 1236 <title>thaw after freeze</title> 1237 <program>/sbin/uadmin</program> 1238 <program>/usr/sbin/uadmin</program> 1239 <see>uadmin(1M)</see> 1240 <entry id="subject"> 1241 <internal token="subject"/> 1242 <external opt="none"/> 1243 </entry> 1244 <entry id="fcn"> 1245 <internal token="text"/> 1246 <external opt="required" type="msg uadmin_fcn"/> 1247 <comment>freeze action type</comment> 1248 </entry> 1249 <entry id="return"> 1250 <internal token="return"/> 1251 <external opt="none"/> 1252 </entry> 1253 </event> 1254 1255<!-- smbd service event; smbd session setup --> 1256 <event id="AUE_smbd_session" header="0" idNo="58" omit="JNI"> 1257 <title>smbd</title> 1258 <program>/usr/lib/smbsrv/smbd</program> 1259 <entry id="subject"> 1260 <internal token="subject"/> 1261 <external opt="none"/> 1262 </entry> 1263 <entry id="domain"> 1264 <internal token="text"/> 1265 <external opt="required" type="char*"/> 1266 <comment>domain</comment> 1267 </entry> 1268 <entry id="username"> 1269 <internal token="text"/> 1270 <external opt="required" type="char*"/> 1271 <comment>username</comment> 1272 </entry> 1273 <entry id="sid"> 1274 <internal token="text"/> 1275 <external opt="optional" type="char*"/> 1276 <comment>sid</comment> 1277 </entry> 1278 <entry id="return"> 1279 <internal token="return"/> 1280 <external opt="none"/> 1281 </entry> 1282 </event> 1283 1284<!-- smbd service event; smbd session logoff --> 1285 <event id="AUE_smbd_logoff" header="0" idNo="59" omit="JNI"> 1286 <title>smbd</title> 1287 <program>/usr/lib/smbsrv/smbd</program> 1288 <entry id="subject"> 1289 <internal token="subject"/> 1290 <external opt="none"/> 1291 </entry> 1292 <entry id="domain"> 1293 <internal token="text"/> 1294 <external opt="required" type="char*"/> 1295 <comment>domain</comment> 1296 </entry> 1297 <entry id="username"> 1298 <internal token="text"/> 1299 <external opt="required" type="char*"/> 1300 <comment>username</comment> 1301 </entry> 1302 <entry id="return"> 1303 <internal token="return"/> 1304 <external opt="none"/> 1305 </entry> 1306 </event> 1307 1308<!-- vscan service event; infected file detected --> 1309 <event id="AUE_vscan_quarantine" header="0" idNo="60" omit="JNI"> 1310 <title>VSCAN: quarantine infected file</title> 1311 <program>/usr/lib/vscan/vscand</program> 1312 <see>vscand(1M), ICAP RFC 3507 (Extensions)</see> 1313 <entry id="subject"> 1314 <internal token="subject"/> 1315 <external opt="none"/> 1316 </entry> 1317 <entry id="file"> 1318 <internal token="path"/> 1319 <external opt="required" type="char*"/> 1320 <comment>infected file</comment> 1321 </entry> 1322 <entry id="violations,nviolations"> 1323 <internal token="text"/> 1324 <external opt="optional" type="char**,int"/> 1325 <comment>ID - threat description</comment> 1326 </entry> 1327 <entry id="return"> 1328 <internal token="return"/> 1329 <external opt="none"/> 1330 </entry> 1331 </event> 1332 1333<!-- ndmp service event; ndmp client connect --> 1334 <event id="AUE_ndmp_connect" instance_of="AUE_generic_basic" header="0" 1335 idNo="61" omit="JNI"> 1336 <title>NDMP Connect</title> 1337 <program>/usr/lib/ndmp/ndmpd</program> 1338 <see>ndmpd(1M)</see> 1339 </event> 1340 1341<!-- ndmp service event; ndmp client disconnect --> 1342 <event id="AUE_ndmp_disconnect" instance_of="AUE_generic_basic" header="0" 1343 idNo="62" omit="JNI"> 1344 <title>NDMP Disconnect</title> 1345 <program>/usr/lib/ndmp/ndmpd</program> 1346 <see>ndmpd(1M)</see> 1347 </event> 1348 1349<!-- ndmp service event; ndmp backup --> 1350 <event id="AUE_ndmp_backup" header="0" idNo="63" omit="JNI"> 1351 <title>NDMP Backup</title> 1352 <program>/usr/lib/ndmp/ndmpd</program> 1353 <see>ndmpd(1M)</see> 1354 <entry id="subject"> 1355 <internal token="subject"/> 1356 <external opt="none"/> 1357 </entry> 1358 <entry id="source"> 1359 <internal token="path"/> 1360 <external opt="required" type="char *"/> 1361 <comment>path to be backed up</comment> 1362 </entry> 1363 <entry id="local_dest"> 1364 <internal token="path"/> 1365 <external opt="optional" type="char *"/> 1366 <comment>local path of backup destination</comment> 1367 </entry> 1368 <entry id="remote_dest"> 1369 <internal token="in_peer"/> 1370 <external opt="optional" type="fd_t"/> 1371 <comment>remote ip address and port of backup destination</comment> 1372 </entry> 1373 <entry id="return"> 1374 <internal token="return"/> 1375 <external opt="none"/> 1376 </entry> 1377 </event> 1378 1379<!-- ndmp service event; ndmp restore --> 1380 <event id="AUE_ndmp_restore" header="0" idNo="64" omit="JNI"> 1381 <title>NDMP Restore</title> 1382 <program>/usr/lib/ndmp/ndmpd</program> 1383 <see>ndmpd(1M)</see> 1384 <entry id="subject"> 1385 <internal token="subject"/> 1386 <external opt="none"/> 1387 </entry> 1388 <entry id="destination"> 1389 <internal token="path"/> 1390 <external opt="required" type="char *"/> 1391 <comment>path to restore to</comment> 1392 </entry> 1393 <entry id="local_source"> 1394 <internal token="path"/> 1395 <external opt="optional" type="char *"/> 1396 <comment>local path to restore from</comment> 1397 </entry> 1398 <entry id="remote_source"> 1399 <internal token="in_peer"/> 1400 <external opt="optional" type="fd_t"/> 1401 <comment>remote ip address and port to restore from</comment> 1402 </entry> 1403 <entry id="return"> 1404 <internal token="return"/> 1405 <external opt="none"/> 1406 </entry> 1407 </event> 1408 1409<!-- SMF related events --> 1410 <event id="AUE_smf_generic" type="generic" omit="always"> 1411 <!-- 1412 This is a template for the event types that have no tokens 1413 other than the header and return. There is no allowed_type 1414 list because the template is not externally visible due to the 1415 omit="always". 1416 --> 1417 <entry id="subject"> 1418 <internal token="subject"/> 1419 <external opt="none"/> 1420 </entry> 1421 <entry id="auth_used"> 1422 <internal token="uauth"/> 1423 <external opt="required" type="char *"/> 1424 <comment>authorization used</comment> 1425 </entry> 1426 <entry id="fmri"> 1427 <internal token="fmri"/> 1428 <external opt="required" type="char *"/> 1429 <comment>name</comment> 1430 </entry> 1431 <entry id="return"> 1432 <internal token="return"/> 1433 <external opt="none"/> 1434 </entry> 1435 </event> 1436 1437 <event id="AUE_smf_generic_pg" type="generic" omit="always"> 1438 <!-- 1439 This is a template for the event types related to property groups. 1440 There is no allowed_type list because the template is not externally 1441 visible due to the omit="always". 1442 --> 1443 <entry id="subject"> 1444 <internal token="subject"/> 1445 <external opt="none"/> 1446 </entry> 1447 <entry id="auth_used"> 1448 <internal token="uauth"/> 1449 <external opt="required" type="char *"/> 1450 <comment>authorization used</comment> 1451 </entry> 1452 <entry id="fmri"> 1453 <internal token="fmri"/> 1454 <external opt="required" type="char *"/> 1455 </entry> 1456 <entry id="type"> 1457 <internal token="text"/> 1458 <external opt="required" type="char *"/> 1459 <comment>property group type</comment> 1460 </entry> 1461 <entry id="return"> 1462 <internal token="return"/> 1463 <external opt="none"/> 1464 </entry> 1465 </event> 1466 1467 <event id="AUE_smf_enable" instance_of="AUE_smf_generic" header="0" 1468 idNo="65" omit="JNI"> 1469 <program>svc.configd(1M)</program> 1470 <see>svcadm(1M)</see> 1471 </event> 1472 <event id="AUE_smf_tmp_enable" instance_of="AUE_smf_generic" header="0" 1473 idNo="66" omit="JNI"> 1474 <program>svc.configd(1M)</program> 1475 <see>svcadm(1M)</see> 1476 </event> 1477 <event id="AUE_smf_disable" instance_of="AUE_smf_generic" header="0" 1478 idNo="67" omit="JNI"> 1479 <program>svc.configd(1M)</program> 1480 <see>svcadm(1M)</see> 1481 </event> 1482 <event id="AUE_smf_tmp_disable" instance_of="AUE_smf_generic" header="0" 1483 idNo="68" omit="JNI"> 1484 <program>svc.configd(1M)</program> 1485 <see>svcadm(1M)</see> 1486 </event> 1487 <event id="AUE_smf_restart" instance_of="AUE_smf_generic" header="0" 1488 idNo="69" omit="JNI"> 1489 <program>svc.configd(1M)</program> 1490 <see>svcadm(1M)</see> 1491 </event> 1492 <event id="AUE_smf_refresh" instance_of="AUE_smf_generic" header="0" 1493 idNo="70" omit="JNI"> 1494 <program>svc.configd(1M)</program> 1495 <see>svcadm(1M)</see> 1496 </event> 1497 <event id="AUE_smf_clear" instance_of="AUE_smf_generic" header="0" 1498 idNo="71" omit="JNI"> 1499 <program>svc.configd(1M)</program> 1500 <see>svcadm(1M)</see> 1501 </event> 1502 <event id="AUE_smf_degrade" instance_of="AUE_smf_generic" header="0" 1503 idNo="72" omit="JNI"> 1504 <program>svc.configd(1M)</program> 1505 <see>svcadm(1M)</see> 1506 </event> 1507 <event id="AUE_smf_immediate_degrade" instance_of="AUE_smf_generic" 1508 header="0" idNo="73" omit="JNI"> 1509 <program>svc.configd(1M)</program> 1510 <see>svcadm(1M)</see> 1511 </event> 1512 <event id="AUE_smf_maintenance" instance_of="AUE_smf_generic" header="0" 1513 idNo="74" omit="JNI"> 1514 <program>svc.configd(1M)</program> 1515 <see>svcadm(1M)</see> 1516 </event> 1517 <event id="AUE_smf_immediate_maintenance" instance_of="AUE_smf_generic" 1518 header="0" idNo="75" omit="JNI"> 1519 <program>svc.configd(1M)</program> 1520 <see>svcadm(1M)</see> 1521 </event> 1522 <event id="AUE_smf_immtmp_maintenance" instance_of="AUE_smf_generic" 1523 header="0" idNo="76" omit="JNI"> 1524 <program>svc.configd(1M)</program> 1525 <see>svcadm(1M)</see> 1526 </event> 1527 <event id="AUE_smf_tmp_maintenance" instance_of="AUE_smf_generic" header="0" 1528 idNo="77" omit="JNI"> 1529 <program>svc.configd(1M)</program> 1530 <see>svcadm(1M)</see> 1531 </event> 1532 <event id="AUE_smf_milestone" instance_of="AUE_smf_generic" header="0" 1533 idNo="78" omit="JNI"> 1534 <program>svc.configd(1M)</program> 1535 <see>svcadm(1M)</see> 1536 </event> 1537 1538 <event id="AUE_smf_create" instance_of="AUE_smf_generic" header="0" 1539 idNo="79" omit="JNI"> 1540 <program>svc.configd(1M)</program> 1541 <see>svccfg(1M)</see> 1542 </event> 1543 <event id="AUE_smf_delete" instance_of="AUE_smf_generic" header="0" 1544 idNo="80" omit="JNI"> 1545 <program>svc.configd(1M)</program> 1546 <see>svccfg(1M)</see> 1547 </event> 1548 1549 <event id="AUE_smf_create_pg" instance_of="AUE_smf_generic_pg" header="0" 1550 idNo="81" omit="JNI"> 1551 <program>svc.configd(1M)</program> 1552 <see>svccfg(1M)</see> 1553 </event> 1554 <event id="AUE_smf_create_npg" instance_of="AUE_smf_generic_pg" header="0" 1555 idNo="82" omit="JNI"> 1556 <program>svc.configd(1M)</program> 1557 <see>svccfg(1M)</see> 1558 </event> 1559 <event id="AUE_smf_delete_pg" instance_of="AUE_smf_generic_pg" header="0" 1560 idNo="83" omit="JNI"> 1561 <program>svc.configd(1M)</program> 1562 <see>svccfg(1M)</see> 1563 </event> 1564 <event id="AUE_smf_delete_npg" instance_of="AUE_smf_generic_pg" header="0" 1565 idNo="84" omit="JNI"> 1566 <program>svc.configd(1M)</program> 1567 <see>svccfg(1M)</see> 1568 </event> 1569 1570 <event id="AUE_smf_create_snap" header="0" idNo="85" omit="JNI"> 1571 <program>svc.configd(1M)</program> 1572 <see>svccfg(1M)</see> 1573 <entry id="subject"> 1574 <internal token="subject"/> 1575 <external opt="none"/> 1576 </entry> 1577 <entry id="auth_used"> 1578 <internal token="uauth"/> 1579 <external opt="required" type="char *"/> 1580 <comment>authorization used</comment> 1581 </entry> 1582 <entry id="fmri"> 1583 <internal token="fmri"/> 1584 <external opt="required" type="char *"/> 1585 <comment>name</comment> 1586 </entry> 1587 <entry id="name"> 1588 <internal token="text"/> 1589 <external opt="required" type="char *"/> 1590 <comment>snapshot name</comment> 1591 </entry> 1592 <entry id="return"> 1593 <internal token="return"/> 1594 <external opt="none"/> 1595 </entry> 1596 </event> 1597 <event id="AUE_smf_delete_snap" header="0" idNo="86" omit="JNI"> 1598 <program>svc.configd(1M)</program> 1599 <see>svccfg(1M)</see> 1600 <entry id="subject"> 1601 <internal token="subject"/> 1602 <external opt="none"/> 1603 </entry> 1604 <entry id="auth_used"> 1605 <internal token="uauth"/> 1606 <external opt="required" type="char *"/> 1607 <comment>authorization used</comment> 1608 </entry> 1609 <entry id="fmri"> 1610 <internal token="fmri"/> 1611 <external opt="required" type="char *"/> 1612 <comment>name</comment> 1613 </entry> 1614 <entry id="name"> 1615 <internal token="text"/> 1616 <external opt="required" type="char *"/> 1617 <comment>snapshot name</comment> 1618 </entry> 1619 <entry id="return"> 1620 <internal token="return"/> 1621 <external opt="none"/> 1622 </entry> 1623 </event> 1624 <event id="AUE_smf_attach_snap" header="0" idNo="87" omit="JNI"> 1625 <program>svc.configd(1M)</program> 1626 <see>svccfg(1M)</see> 1627 <entry id="subject"> 1628 <internal token="subject"/> 1629 <external opt="none"/> 1630 </entry> 1631 <entry id="auth_used"> 1632 <internal token="uauth"/> 1633 <external opt="required" type="char *"/> 1634 <comment>authorization used</comment> 1635 </entry> 1636 <entry id="old_fmri"> 1637 <internal token="fmri"/> 1638 <external opt="required" type="char *"/> 1639 <comment>old name</comment> 1640 </entry> 1641 <entry id="old_name"> 1642 <internal token="text"/> 1643 <external opt="required" type="char *"/> 1644 <comment>old snapshot</comment> 1645 </entry> 1646 <entry id="new_fmri"> 1647 <internal token="fmri"/> 1648 <external opt="required" type="char *"/> 1649 <comment>new name</comment> 1650 </entry> 1651 <entry id="new_name"> 1652 <internal token="text"/> 1653 <external opt="required" type="char *"/> 1654 <comment>new snapshot</comment> 1655 </entry> 1656 <entry id="return"> 1657 <internal token="return"/> 1658 <external opt="none"/> 1659 </entry> 1660 </event> 1661 1662 <event id="AUE_smf_annotation" header="0" idNo="88" omit="JNI"> 1663 <program>svc.configd(1M)</program> 1664 <see>svccfg(1M)</see> 1665 <entry id="subject"> 1666 <internal token="subject"/> 1667 <external opt="none"/> 1668 </entry> 1669 <entry id="operation"> 1670 <internal token="text"/> 1671 <external opt="required" type="char *"/> 1672 <comment>operation</comment> 1673 </entry> 1674 <entry id="file"> 1675 <internal token="path"/> 1676 <external opt="required" type="char *"/> 1677 <comment>imported file</comment> 1678 </entry> 1679 <entry id="return"> 1680 <internal token="return"/> 1681 <external opt="none"/> 1682 </entry> 1683 </event> 1684 1685 <event id="AUE_smf_create_prop" header="0" idNo="89" omit="JNI"> 1686 <program>svc.configd(1M)</program> 1687 <see>svccfg(1M)</see> 1688 <entry id="subject"> 1689 <internal token="subject"/> 1690 <external opt="none"/> 1691 </entry> 1692 <entry id="auth_used"> 1693 <internal token="uauth"/> 1694 <external opt="required" type="char *"/> 1695 <comment>authorization used</comment> 1696 </entry> 1697 <entry id="fmri"> 1698 <internal token="fmri"/> 1699 <external opt="required" type="char *"/> 1700 <comment>name</comment> 1701 </entry> 1702 <entry id="type"> 1703 <internal token="text"/> 1704 <external opt="required" type="char *"/> 1705 <comment>type</comment> 1706 </entry> 1707 <entry id="value"> 1708 <internal token="text"/> 1709 <external opt="optional" type="char *"/> 1710 <comment>value</comment> 1711 </entry> 1712 <entry id="return"> 1713 <internal token="return"/> 1714 <external opt="none"/> 1715 </entry> 1716 </event> 1717 1718 <event id="AUE_smf_change_prop" header="0" idNo="90" omit="JNI"> 1719 <program>svc.configd(1M)</program> 1720 <see>svccfg(1M)</see> 1721 <entry id="subject"> 1722 <internal token="subject"/> 1723 <external opt="none"/> 1724 </entry> 1725 <entry id="auth_used"> 1726 <internal token="uauth"/> 1727 <external opt="required" type="char *"/> 1728 <comment>authorization used</comment> 1729 </entry> 1730 <entry id="fmri"> 1731 <internal token="fmri"/> 1732 <external opt="required" type="char *"/> 1733 <comment>name</comment> 1734 </entry> 1735 <entry id="type"> 1736 <internal token="text"/> 1737 <external opt="required" type="char *"/> 1738 <comment>type</comment> 1739 </entry> 1740 <entry id="value"> 1741 <internal token="text"/> 1742 <external opt="optional" type="char *"/> 1743 <comment>value</comment> 1744 </entry> 1745 <entry id="return"> 1746 <internal token="return"/> 1747 <external opt="none"/> 1748 </entry> 1749 </event> 1750 <event id="AUE_smf_delete_prop" header="0" idNo="91" omit="JNI"> 1751 <program>svc.configd(1M)</program> 1752 <see>svccfg(1M)</see> 1753 <entry id="subject"> 1754 <internal token="subject"/> 1755 <external opt="none"/> 1756 </entry> 1757 <entry id="auth_used"> 1758 <internal token="uauth"/> 1759 <external opt="required" type="char *"/> 1760 <comment>authorization used</comment> 1761 </entry> 1762 <entry id="fmri"> 1763 <internal token="fmri"/> 1764 <external opt="required" type="char *"/> 1765 <comment>name</comment> 1766 </entry> 1767 <entry id="return"> 1768 <internal token="return"/> 1769 <external opt="none"/> 1770 </entry> 1771 </event> 1772 1773 <event id="AUE_smf_read_prop" instance_of="AUE_smf_generic" header="0" 1774 idNo="92" omit="JNI"> 1775 <program>svc.configd(1M)</program> 1776 <see>svccfg(1M)</see> 1777 </event> 1778 1779<!-- CPUFreq related events --> 1780 1781 <event id="AUE_cpu_ondemand" header="0" idNo="93" omit="JNI"> 1782 <title>set CPU freq to minimal unless load increases</title> 1783 <program>/usr/lib/hal/hald-addon-cpufreq</program> 1784 <see>hald(1M)</see> 1785 <entry id="subject"> 1786 <internal token="subject"/> 1787 <external opt="none"/> 1788 </entry> 1789 <entry id="auth_used"> 1790 <internal token="uauth"/> 1791 <external opt="required" type="char *"/> 1792 <comment>authorization used</comment> 1793 </entry> 1794 <entry id="return"> 1795 <internal token="return"/> 1796 <external opt="none"/> 1797 </entry> 1798 </event> 1799 <event id="AUE_cpu_performance" header="0" idNo="94" omit="JNI"> 1800 <title>set CPU freq to Max</title> 1801 <program>/usr/lib/hal/hald-addon-cpufreq</program> 1802 <see>hald(1M)</see> 1803 <entry id="subject"> 1804 <internal token="subject"/> 1805 <external opt="none"/> 1806 </entry> 1807 <entry id="auth_used"> 1808 <internal token="uauth"/> 1809 <external opt="required" type="char *"/> 1810 <comment>authorization used</comment> 1811 </entry> 1812 <entry id="return"> 1813 <internal token="return"/> 1814 <external opt="none"/> 1815 </entry> 1816 </event> 1817 <event id="AUE_cpu_threshold" header="0" idNo="95" omit="JNI"> 1818 <title>set CPU frequency threshold percentage</title> 1819 <program>/usr/lib/hal/hald-addon-cpufreq</program> 1820 <see>hald(1M)</see> 1821 <entry id="subject"> 1822 <internal token="subject"/> 1823 <external opt="none"/> 1824 </entry> 1825 <entry id="auth_used"> 1826 <internal token="uauth"/> 1827 <external opt="required" type="char *"/> 1828 <comment>authorization used</comment> 1829 </entry> 1830 <entry id="threshold"> 1831 <internal token="text"/> 1832 <external opt="required" type="int"/> 1833 <comment>threshold percent 1-100</comment> 1834 </entry> 1835 <entry id="return"> 1836 <internal token="return"/> 1837 <external opt="none"/> 1838 </entry> 1839 </event> 1840 1841<!-- NWAM events --> 1842 1843 <event id="AUE_nwam_attach" header="0" idNo="97" omit="JNI"> 1844 <title>Network Autoconfig Client</title> 1845 <program>nwamd</program> 1846 <see>nwamd(1M)</see> 1847 <entry id="subject"> 1848 <internal token="subject"/> 1849 <external opt="none"/> 1850 </entry> 1851 <entry id="auth_used"> 1852 <internal token="uauth"/> 1853 <external opt="required" type="char *"/> 1854 <comment>authorization used</comment> 1855 </entry> 1856 <entry id="return"> 1857 <internal token="return"/> 1858 <external opt="none"/> 1859 </entry> 1860 </event> 1861 1862 <event id="AUE_nwam_detach" instance_of="AUE_generic_basic" header="0" 1863 idNo="98" omit="JNI"> 1864 <title>Network Autoconfig Client</title> 1865 <program>nwamd</program> 1866 <see>nwamd(1M)</see> 1867 </event> 1868 1869<!-- add new events here with the next higher idNo --> 1870<!-- Highest idNo is 98, so next is 99, then fix this comment --> 1871<!-- end of C Only events --> 1872 1873 1874<!-- 1875 token definitions are partially implemented. All they do for now 1876 is create a list of defined token names. In the future they may 1877 become a way of describing token structure. 1878--> 1879 1880 <token id="acl"> 1881 </token> 1882 <token id="arbitrary"> 1883 </token> 1884 <token id="arg"> 1885 </token> 1886 <token id="attr"> 1887 </token> 1888 <token id="command"> 1889 </token> 1890 <token id="command_alt"> 1891 </token> 1892 <token id="date"> 1893 </token> 1894 <token id="exec_args"> 1895 </token> 1896 <token id="exec_env"> 1897 </token> 1898 <token id="exit"> 1899 </token> 1900 <token id="file"> 1901 </token> 1902 <token id="fmri"> 1903 </token> 1904 <token id="groups"> 1905 </token> 1906 <!-- pseudo token; in_addr and in_port of peer --> 1907 <token id="in_peer"> 1908 </token> 1909 <token id="ipc"> 1910 </token> 1911 <token id="ipc_perm"> 1912 </token> 1913 <token id="label"> 1914 </token> 1915 <token id="newgroups"> 1916 </token> 1917 <token id="opaque"> 1918 </token> 1919 <token id="path"> 1920 </token> 1921 <!-- pseudo token; path list generates 0 or more path tokens --> 1922 <token id="path_list"> 1923 </token> 1924 <token id="tid"> 1925 </token> 1926 1927 <!-- 1928 privilege token is implemented as one of the pseudo tokens 1929 priv_limit, priv_effective, or priv_inherit 1930 1931 <token id="privilege"> 1932 </token> 1933 --> 1934 <token id="priv_effective"> 1935 </token> 1936 <token id="priv_inherit"> 1937 </token> 1938 <token id="priv_limit"> 1939 </token> 1940 <token id="process"> 1941 </token> 1942 <token id="return"> 1943 </token> 1944 <token id="seq"> 1945 </token> 1946 <token id="socket"> 1947 </token> 1948 <token id="socket-inet"> 1949 </token> 1950 <token id="subject"> 1951 </token> 1952 <token id="text"> 1953 </token> 1954 <token id="uauth"> 1955 </token> 1956 <token id="zonename"> 1957 </token> 1958 1959<!-- 1960 error value list for return values with success/fail code of fail. 1961 These values start at 1000 so praudit can tell the difference 1962 between the libbsm/common/audit_*.c broken error values and 1963 the new adt_ error value list. It is public so that praudit 1964 can find it. 1965 1966 praudit outputs "failure" %s" for these strings, so there is 1967 no need to use words such as "failed" in the message. 1968 1969 ** Add to the end only to maintain validity across versions of 1970 the audit log. ** 1971--> 1972 1973 <msg_list id="fail_value" header="0" start="1000" public="true"> 1974 <msg id="PW_ATTR">Attribute update</msg> 1975 <msg id="PW">Password update</msg> 1976 <msg id="USERNAME">bad username</msg> 1977 <msg id="AUTH">authorization failed</msg> 1978 <msg id="UID">bad uid</msg> 1979 <msg id="UNKNOWN">unknown failure</msg> 1980 <msg id="EXPIRED">password expired</msg> 1981 <msg id="ACCOUNT_LOCKED">Account is locked</msg> 1982 <msg id="BAD_DIALUP">Bad dial up</msg> 1983 <msg id="BAD_ID">Invalid ID</msg> 1984 <msg id="BAD_PW">Invalid password</msg> 1985 <msg id="CONSOLE">Not on console</msg> 1986 <msg id="MAX_TRIES">Too many failed attempts</msg> 1987 <msg id="PROTOCOL_FAILURE">Protocol failure</msg> 1988 <msg id="EXCLUDED_USER">Excluded user</msg> 1989 <msg id="ANON_USER">No anonymous</msg> 1990 <msg id="BAD_CMD">Invalid command</msg> 1991 <msg id="BAD_TTY">Standard input not a tty line</msg> 1992 <msg id="PROGRAM">Program failure</msg> 1993 <msg id="CHDIR_FAILED">chdir to home directory</msg> 1994 <msg id="INPUT_OVERFLOW">Input line too long.</msg> 1995 <msg id="DEVICE_PERM">login device override</msg> 1996 <msg id="AUTH_BYPASS">authorization bypass</msg> 1997 <msg id="LOGIN_DISABLED">login disabled</msg> 1998 </msg_list> 1999 2000<!-- 2001 The following empty list is used for PAM errors; the "start" 2002 value is used by praudit to know to use the PAM infrastructure 2003 for generating error strings 2004--> 2005 <msg_list id="fail_pam" header="0" start="2000" public="true"> 2006 </msg_list> 2007 2008<!-- 2009 This is still in use by SMC. See AUE_generic_login. When 2010 either SMC is fixed to stop using this, or SMC goes away. 2011 REMOVE this stuff and the corresponding AUE_generic_login 2012 message field. 2013 2014 Message list for the various authentication events, such 2015 as AUE_login and AUE_admin_authenticate. Add new entries 2016 at the end. The order of msg_list entries and the order 2017 of msg entries both affect the names in adt.h and the value 2018 of the associated enumerated types. 2019 2020 Each of these messages except NO_MSG is also in the failure_attribute 2021 list; the difference is that the messages below use a text token 2022 in the audit record, while the failure_attribute messages are 2023 associated with the return value of the return token. 2024 2025 This list is deprecated; please don't use text tokens for error 2026 messages. 2027--> 2028 2029 <msg_list id="login_text" header="0" deprecated="true"> 2030 <msg id="NO_MSG"></msg> 2031 <msg id="ACCOUNT_LOCKED">Account is locked</msg> 2032 <msg id="BAD_DIALUP">Bad dial up</msg> 2033 <msg id="BAD_ID">Invalid ID</msg> 2034 <msg id="BAD_PW">Invalid password</msg> 2035 <msg id="CONSOLE">Not on console</msg> 2036 <msg id="MAX_TRIES">Too many failed attempts</msg> 2037 <msg id="PROTOCOL_FAILURE">Protocol failure</msg> 2038 <msg id="EXCLUDED_USER">Excluded user</msg> 2039 <msg id="ANON_USER">No anonymous</msg> 2040 </msg_list> 2041 2042<!-- msg list for uadmin(1m) fcn argument (next action, see uadmin(2)) --> 2043 <msg_list id="uadmin_fcn" header="0" start="3000" public="true"> 2044 <msg id="AD_HALT">Halt the processor(s)</msg> 2045 <msg id="AD_POWEROFF">Halt the processor(s) and turn off the power</msg> 2046 <msg id="AD_BOOT">Reboot the system using the kernel file</msg> 2047 <msg id="AD_IBOOT">Interactive reboot</msg> 2048 <msg id="AD_SUSPEND_TO_DISK">Save the system state to the state file</msg> 2049 <msg id="AD_CHECK_SUSPEND_TO_DISK">Check if system supports suspend to disk</msg> 2050 <msg id="AD_FORCE">Force suspend to disk even when threads of user 2051 applications are not suspendable</msg> 2052 <msg id="AD_SUSPEND_TO_RAM">Save the system state to memory</msg> 2053 <msg id="AD_CHECK_SUSPEND_TO_RAM">Check if system supports suspend to memory</msg> 2054 <msg id="AD_SBOOT">Single-user reboot</msg> 2055 <msg id="AD_SIBOOT">Single-user interactive reboot</msg> 2056 <msg id="AD_NOSYNC">Do not sync filesystems on next A_DUMP</msg> 2057 <msg id="AD_FASTREBOOT">Reboot bypassing BIOS and boot loader</msg> 2058 <msg id="AD_FASTREBOOT_DRYRUN">Check if system supports reboot bypassing BIOS and boot loader</msg> 2059 <msg id="AD_REUSEINIT">Prepare for AD_REUSABLE</msg> 2060 <msg id="AD_REUSABLE">Create reusable statefile</msg> 2061 <msg id="AD_REUSEFINI">Revert to normal CPR mode (not reusable)</msg> 2062 <msg id="AD_FTRACE_START">ftrace start</msg> 2063 <msg id="AD_FTRACE_STOP">ftrace stop</msg> 2064 </msg_list> 2065</specification> 2066