1<?xml version="1.0" standalone="yes"?> 2<!DOCTYPE specification SYSTEM "audit.dtd"> 3<!-- 4 CDDL HEADER START 5 6 The contents of this file are subject to the terms of the 7 Common Development and Distribution License (the "License"). 8 You may not use this file except in compliance with the License. 9 10 You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 11 or http://www.opensolaris.org/os/licensing. 12 See the License for the specific language governing permissions 13 and limitations under the License. 14 15 When distributing Covered Code, include this CDDL HEADER in each 16 file and include the License file at usr/src/OPENSOLARIS.LICENSE. 17 If applicable, add the following below this CDDL HEADER, with the 18 fields enclosed by brackets "[]" replaced with your own identifying 19 information: Portions Copyright [yyyy] [name of copyright owner] 20 21 CDDL HEADER END 22 23Copyright 2007 Sun Microsystems, Inc. All rights reserved. 24Use is subject to license terms. 25 26 ident "%Z%%M% %I% %E% SMI" 27--> 28 29<specification> 30 31<!-- comments are displayed to stderr if debug is on --> 32<debug set="off"/> 33 34 <!-- The order of events is arbitrary EXCEPT generic events must 35 precede their instances --> 36 <!-- The order of entries within an event determine the order 37 data is defined in the external API --> 38 <!-- The order of internal / external is arbitrary --> 39 40<!-- 41 tags: 42 The following top level tags are defined: 43 <event> <token> <msg_list> <debug> 44 45 event defines an audit record 46 - id is the record id from audit_uevents.h 47 - reorder="yes" or "no". (default is "no"). 48 if "yes" then the order of the tokens to be 49 output does not match the order of the data 50 input. (see order attribute of <entry>) 51 - header defines the header file to contain the external 52 definitions for this event type. The header file 53 name is adt_event_N.h, where N is the value supplied 54 header="0" is for "stable" events, > 0 for new ones. 55 with this attribute. (header="1"). 56 - idNo is the number associated with the external 57 name of this event. (For AUE_login, ADT_login is 58 the external name and idNo is the value for 59 ADT_login.) 60 - omit is by default 'no' (i.e., don't omit) and can be 61 'always' or 'JNI'. In the latter case, C interface 62 code is generated but neither Java nor JNI code is. 63 - included text is just a comment 64 Within an event block, the following tags are defined: 65 <entry>, <debug>, <altname>, <title>, <program>, <see> 66 67 altname defines the internal name of an audit record; if 68 omitted, the internal name is the same as the 69 external name. 70 71 title, these tags are used by bsmrecord build to create 72 program, audit_record_attr database from adt events. 73 see Following example demonstrates their semantics: 74 75 bsmrecord -p passwd 76 passwd <- <title> 77 program various See passwd(1) 78 ^- <program> ^- <see> 79 event ID 6163 AUE_passwd 80 class lo (0x00001000) 81 header 82 subject 83 [text] username... 84 ^- <comment> 85 return 86 87 entry defines the correspondence between the data 88 supplied by the caller and the token to be 89 output. 90 - id is the data name that shows up in the structures 91 of adt_event.h If it is a comma separated list, 92 it is the list of names of data to be associated 93 with one output token. (See <external>, below) 94 Within an entry block, the following tags are defined: 95 <internal>, <external>, <debug>, <comment> 96 97 internal defines the token to be generated. 98 - token is a name that must also be defined with 99 a <token> tag elsewhere in this file. (order is 100 not important). 101 - order="some number" determines the order of the 102 tokens to be output, starting with 1. The subject 103 token is normally order="1". The use is to insure 104 that the order of fields listed in adt_event.h does 105 not change when we arbitrarily change the order of 106 tokens. If the <event reorder="yes"> is not set, 107 order is ignored. 108 - format is a printf-like string that will be used 109 in to format the data supplied by the user. 110 111 external defines the data to be supplied for creating the 112 token defined via <internal> 113 - opt is one of four values: "required", "optional", 114 "obsolete", or "none". The first two values 115 indicate that this token's data must or may 116 be supplied by the user; the third value is 117 equivalent to "optional" but shows in the 118 comment that this field is no longer used; 119 the forth value indicates that this token 120 does not require any user-supplied data. If 121 data is required, then a token is always 122 output, while optional data is output only 123 if data is supplied. 124 - type describes the C data type to be associated 125 with the <entry id="dataName">. The following 126 data types are representative: 127 128 au_asid_t (uint32_t) 129 char 130 char * (blank is optional) 131 char ** (blank is optional) 132 uint_t, int, int32_t, uid_t, gid_t 133 uid_t *, gid_t * 134 long, ulong_t 135 m_label_t * 136 pid_t 137 priv_set_t * 138 uint16_t, unit32_t, uint64_t 139 uint32_t *, uint32_t[], uint64_t * 140 msg (not a C type, see below) 141 142 Below is what Tony said. Above seems to be 143 what is implemented 144 char 145 char * (blank is optional) 146 char ** (blank is optional) 147 int, uid_t, gid_t 148 int *, uid_t *, gid_t * 149 msg (not a C type, see below) 150 time_t 151 uint, uint * 152 153 The msg type refers to an enumerated type 154 that must be defined via a <msg> description 155 else where in this file. The syntax is 156 special. Example: <external opt="optional" 157 type="msg login_text"/> "login_text" is the 158 id of a <msg_list> descriptor given 159 elsewhere in this file. 160 161 If the <entry> id is a list, the type must also 162 be a comma-separated list, where the types are 163 in the same order as the id's. 164 If the type is an array, its length must be given 165 explicitly. 166 167 comment Used by bsmrecord build to generate audit_record_attr. 168 Comment is explanation note printed with token type. 169 See example above for other tags related to bsmrecord. 170 171 token Define allowed token names. 172 - id is the name of token; this name is used 173 as an <internal> id. 174 - usage is an optional value. At present, only 175 "TSOL" is defined; it means that this data is 176 to be used only in Trusted Solaris implementations. 177 178 msg_list Define a set of text strings. 179 - id is the name to be used for this group of text 180 strings in adt_event.h 181 - header is as defined for <event> 182 Within a msg_list block, <msg> and <debug> are defined. 183 The order of <msg> tags in a msg_list is reflected 184 directly in adt_event.h 185 186 msg Define one string. 187 - id is the name to be used in the enum describing 188 this set of strings. Convention: use upper case. 189 The content (text between <msg> and </msg>) is the 190 actual string. Extra white space, including line 191 feeds, is ignored. If empty, no output token 192 is generated unless the <external> opt attribute is 193 set to "required", in which case a blank text token 194 is generated. 195 Within a msg block, <debug> is defined, but has not been 196 tested and may have no effect. 197 198 debug This turns on/off debug messages during the processing 199 of the xml data. It affects the block within which it 200 is defined. 201 - set may have one of two values: "on" or "off". If 202 set is omitted, the debug state for the current block 203 is toggled. 204 The use of the <debug> tag does not affect the output 205 of data to the various files created, but does generate 206 potentially large amounts of output to stderr. 207 208--> 209<!-- template for an event record definition 210 211 <event id="" header="0" idNo=""> 212 <entry id="subject"> 213 <internal token="subject"/> 214 <external opt="none"/> 215 </entry> 216 <entry id=""> 217 <internal token=""/> 218 <external opt="" type="" /> 219 </entry> 220 <entry id="return"> 221 <internal token="return"/> 222 <external opt="none"/> 223 </entry> 224 </event> 225 226 Generic events must precede Instance events; within each 227 group, please group the AUE_* by area and event idNo-s in order, 228 gaps in idNo-s are OK. 229 N.B. Renumbering idNo-s requires recompilation of consumers. See 230 the contracts for whom to notify if/when this happens. 231--> 232 233<!-- generic events --> 234 235 <!-- 236 'omit="always"' means that this record type is not reflected 237 in the generated header and table files. 238 --> 239 240 <event id="AUE_generic_basic" type="generic" omit="always"> 241 <!-- 242 243 This is a template for the event types that have no tokens 244 other than the header and return. There is no allowed_type 245 list because the template is not externally visible due to the 246 omit="always". 247 248 --> 249 <entry id="subject"> 250 <internal token="subject"/> 251 <external opt="none"/> 252 </entry> 253 <entry id="return"> 254 <internal token="return"/> 255 <external opt="none"/> 256 </entry> 257 </event> 258 259 <event id="AUE_generic_login" type="generic" omit="always"> 260 <!-- 261 262 This is a template for the various login event types 263 AUE_login, AUE_ftp, etc which match this template. There is 264 no allowed_type list because the template is not externally 265 visible due to the omit="always". 266 267 --> 268 <entry id="subject"> 269 <internal token="subject"/> 270 <external opt="none"/> 271 </entry> 272 273 <!-- This field is still in use for SMC until it is cleaned up, 274 it must remain, see login_text msg list at the end of the 275 file. 276 --> 277 <entry id="message"> 278 <internal token="text"/> 279 <external opt="optional" type="msg login_text"/> 280 <comment>error message</comment> 281 </entry> 282 <entry id="return"> 283 <internal token="return"/> 284 <external opt="none"/> 285 </entry> 286 </event> 287 288<!-- generic SMC events --> 289 290 <event id="AUE_generic_SMC_add" type="generic" omit="always"> 291 <entry id="subject"> 292 <internal token="subject"/> 293 <external opt="none"/> 294 </entry> 295 <entry id="object_name"> 296 <internal token="text"/> 297 <external opt="required" type="char *"/> 298 <comment>object name</comment> 299 </entry> 300 <entry id="domain"> 301 <internal token="text"/> 302 <external opt="optional" type="char *"/> 303 <comment>domain</comment> 304 </entry> 305 <entry id="name_service"> 306 <internal token="text"/> 307 <external opt="required" type="char *"/> 308 <comment>name_service</comment> 309 </entry> 310 <entry id="auth_used"> 311 <internal token="uauth"/> 312 <external opt="optional" type="char *"/> 313 <comment>authorization used</comment> 314 </entry> 315 <!-- 316 This should really be its own token type, not "text" 317 --> 318 <entry id="initial_values"> 319 <internal token="text"/> 320 <external opt="required" type="char *"/> 321 <comment>initial values</comment> 322 </entry> 323 <entry id="return"> 324 <internal token="return"/> 325 <external opt="none"/> 326 </entry> 327 </event> 328 329 <event id="AUE_generic_SMC_delete" type="generic" omit="always"> 330 <entry id="subject"> 331 <internal token="subject"/> 332 <external opt="none"/> 333 </entry> 334 <entry id="object_name"> 335 <internal token="text"/> 336 <external opt="required" type="char *"/> 337 <comment>object name</comment> 338 </entry> 339 <entry id="domain"> 340 <internal token="text"/> 341 <external opt="optional" type="char *"/> 342 <comment>domain</comment> 343 </entry> 344 <entry id="name_service"> 345 <internal token="text"/> 346 <external opt="required" type="char *"/> 347 <comment>name_service</comment> 348 </entry> 349 <entry id="auth_used"> 350 <internal token="uauth"/> 351 <external opt="optional" type="char *"/> 352 <comment>authorization used</comment> 353 </entry> 354 <entry id="delete_values"> 355 <internal token="text"/> 356 <external opt="required" type="char *"/> 357 <comment>deleted values</comment> 358 </entry> 359 <entry id="return"> 360 <internal token="return"/> 361 <external opt="none"/> 362 </entry> 363 </event> 364 365 <event id="AUE_generic_SMC_modify" type="generic" omit="always"> 366 <entry id="subject"> 367 <internal token="subject"/> 368 <external opt="none"/> 369 </entry> 370 <entry id="object_name"> 371 <internal token="text"/> 372 <external opt="required" type="char *"/> 373 <comment>object name</comment> 374 </entry> 375 <entry id="domain"> 376 <internal token="text"/> 377 <external opt="optional" type="char *"/> 378 <comment>domain</comment> 379 </entry> 380 <entry id="name_service"> 381 <internal token="text"/> 382 <external opt="required" type="char *"/> 383 <comment>name_service</comment> 384 </entry> 385 <entry id="auth_used"> 386 <internal token="uauth"/> 387 <external opt="optional" type="char *"/> 388 <comment>authorization used</comment> 389 </entry> 390 <entry id="changed_values"> 391 <internal token="text"/> 392 <external opt="required" type="char *"/> 393 <comment>changed values</comment> 394 </entry> 395 <entry id="return"> 396 <internal token="return"/> 397 <external opt="none"/> 398 </entry> 399 </event> 400 401<!-- instances --> 402 403<!-- 404 Java needed for SMC events. Since the SMC events grow less 405 often than the C related events. They come first. It 406 would be nice to reorder the idNo-s, but that's an ABI 407 change and should rev libbsm version no. If reordered 408 start with 1 and eliminate the comment at the end about 409 the highest idNo. 410--> 411 <event id="AUE_admin_authenticate" instance_of="AUE_generic_login" 412 header="0" idNo="3"> 413 <title>Admin Server Authentication</title> 414 <program>admin (various)</program> 415 <see>SMC, WBEM, or AdminSuite</see> 416 </event> 417 418 <event id="AUE_filesystem_add" instance_of="AUE_generic_SMC_add" 419 header="0" idNo="4"> 420 <title>SMC: filesystem add</title> 421 <program>SMC server</program> 422 </event> 423 <event id="AUE_filesystem_delete" instance_of="AUE_generic_SMC_delete" 424 header="0" idNo="5"> 425 <title>SMC: filesystem delete</title> 426 <program>SMC server</program> 427 </event> 428 <event id="AUE_filesystem_modify" instance_of="AUE_generic_SMC_modify" 429 header="0" idNo="6"> 430 <title>SMC: filesystem modify</title> 431 <program>SMC server</program> 432 </event> 433 434 <event id="AUE_network_add" instance_of="AUE_generic_SMC_add" 435 header="0" idNo="7"> 436 <title>SMC: network add</title> 437 <program>SMC server</program> 438 </event> 439 <event id="AUE_network_delete" instance_of="AUE_generic_SMC_delete" 440 header="0" idNo="8"> 441 <title>SMC: network delete</title> 442 <program>SMC server</program> 443 </event> 444 <event id="AUE_network_modify" instance_of="AUE_generic_SMC_modify" 445 header="0" idNo="9"> 446 <title>SMC: network modify</title> 447 <program>SMC server</program> 448 </event> 449 450 <event id="AUE_printer_add" instance_of="AUE_generic_SMC_add" 451 header="0" idNo="10"> 452 <title>SMC: printer add</title> 453 <program>SMC server</program> 454 </event> 455 <event id="AUE_printer_delete" instance_of="AUE_generic_SMC_delete" 456 header="0" idNo="11"> 457 <title>SMC: printer delete</title> 458 <program>SMC server</program> 459 </event> 460 <event id="AUE_printer_modify" instance_of="AUE_generic_SMC_modify" 461 header="0" idNo="12"> 462 <title>SMC: printer modify</title> 463 <program>SMC server</program> 464 </event> 465 466<!-- 467 This is SMC; it's also used in su and should probably be used in 468 desktop role login. If we fix the SMC to not record NO_MSG here, 469 we can fix to record failed user. See su.c and AUE_su. 470--> 471 <event id="AUE_role_login" instance_of="AUE_generic_login" 472 header="0" idNo="13"> 473 <title>RBAC: role login</title> 474 <program>SMC server</program> 475 <program>/usr/bin/su</program> 476 </event> 477 478 <event id="AUE_scheduledjob_add" instance_of="AUE_generic_SMC_add" 479 header="0" idNo="14"> 480 <title>SMC: scheduled job add</title> 481 <program>SMC server</program> 482 </event> 483 <event id="AUE_scheduledjob_delete" instance_of="AUE_generic_SMC_delete" 484 header="0" idNo="15"> 485 <title>SMC: scheduled job delete</title> 486 <program>SMC server</program> 487 </event> 488 <event id="AUE_scheduledjob_modify" instance_of="AUE_generic_SMC_modify" 489 header="0" idNo="16"> 490 <title>SMC: scheduled job modify</title> 491 <program>SMC server</program> 492 </event> 493 494 <event id="AUE_serialport_add" instance_of="AUE_generic_SMC_add" 495 header="0" idNo="17"> 496 <title>SMC: serial port add</title> 497 <program>SMC server</program> 498 </event> 499 <event id="AUE_serialport_delete" instance_of="AUE_generic_SMC_delete" 500 header="0" idNo="18"> 501 <title>SMC: serial port delete</title> 502 <program>SMC server</program> 503 </event> 504 <event id="AUE_serialport_modify" instance_of="AUE_generic_SMC_modify" 505 header="0" idNo="19"> 506 <title>SMC: serial port modify</title> 507 <program>SMC server</program> 508 </event> 509 510<!-- This is SMC; should this also be used elsewhere? --> 511 <event id="AUE_uauth" header="0" idNo="20"> 512 <title>SMC: Use of Authorization</title> 513 <program>SMC server</program> 514 <entry id="subject"> 515 <internal token="subject"/> 516 <external opt="none"/> 517 </entry> 518 <entry id="auth_used"> 519 <internal token="uauth"/> 520 <external opt="required" type="char *"/> 521 <comment>authorization used</comment> 522 </entry> 523 <entry id="objectname"> 524 <internal token="text"/> 525 <external opt="required" type="char *"/> 526 <comment>object name</comment> 527 </entry> 528 <entry id="return"> 529 <internal token="return"/> 530 <external opt="none"/> 531 </entry> 532 </event> 533 534 <event id="AUE_usermgr_add" instance_of="AUE_generic_SMC_add" 535 header="0" idNo="21"> 536 <title>SMC: User Manager add</title> 537 <program>SMC server</program> 538 </event> 539 <event id="AUE_usermgr_delete" instance_of="AUE_generic_SMC_delete" 540 header="0" idNo="22"> 541 <title>SMC: User Manager delete</title> 542 <program>SMC server</program> 543 </event> 544 <event id="AUE_usermgr_modify" instance_of="AUE_generic_SMC_modify" 545 header="0" idNo="23"> 546 <title>SMC: User Manager modify</title> 547 <program>SMC server</program> 548 </event> 549<!-- end of Java needed for SMC events --> 550<!-- 551 while not used by SMC logout is used by Lockhart 552--> 553 <event id="AUE_logout" header="0" idNo="1"> 554 <title>login: logout</title> 555 <program>various</program> 556 <see>login(1)</see> 557 <entry id="subject"> 558 <internal token="subject"/> 559 <external opt="none"/> 560 </entry> 561<!-- 562 not used by C code, used by Lockhart, 563 get them to change and remove 564 event.user_name("logout " + session.getUserName()); 565 from /ws/lockhart-nv-gate/src/bundled/app/webmgt/lib/services/ 566 com/sun/management/services/audit/SolarisAuditEvent_Logout.java 567--> 568 <entry id="user_name"> 569 <internal token="text" format="logout %s"/> 570 <external opt="optional" type="char *"/> 571 <comment>"logout" username</comment> 572 </entry> 573 <entry id="return"> 574 <internal token="return"/> 575 <external opt="none"/> 576 </entry> 577 </event> 578 579 580<!-- C Only events --> 581 <event id="AUE_init_solaris" header="0" idNo="32" omit="JNI"> 582 <title>init</title> 583 <program>/sbin/init</program> 584 <program>/usr/sbin/init</program> 585 <program>/usr/sbin/shutdown</program> 586 <entry id="subject"> 587 <internal token="subject"/> 588 <external opt="none"/> 589 </entry> 590 <entry id="info"> 591 <internal token="text"/> 592 <external opt="optional" type="char *"/> 593 <comment>init level or zone name</comment> 594 </entry> 595 <entry id="return"> 596 <internal token="return"/> 597 <external opt="none"/> 598 </entry> 599 </event> 600 601 <event id="AUE_login" instance_of="AUE_generic_login" header="0" 602 idNo="25" omit="JNI"> 603 <title>terminal login</title> 604 <program>/usr/sbin/login</program> 605 <program>/usr/dt/bin/dtlogin</program> 606 <see>login(1)</see> 607 <see>dtlogin</see> 608 </event> 609 <event id="AUE_rlogin" instance_of="AUE_generic_login" header="0" 610 idNo="28" omit="JNI"> 611 <title>rlogin</title> 612 <program>/usr/sbin/login</program> 613 <see>login(1) - rlogin</see> 614 </event> 615 <event id="AUE_telnet" instance_of="AUE_generic_login" header="0" 616 idNo="29" omit="JNI"> 617 <title>telnet login</title> 618 <program>/usr/sbin/login</program> 619 <see>login(1) - telnet</see> 620 </event> 621 <event id="AUE_ssh" instance_of="AUE_generic_login" header="0" 622 idNo="2" omit="JNI"> 623 <program>/usr/lib/ssh/sshd</program> 624 </event> 625 626 <event id="AUE_zlogin" header="0" idNo="38" omit="JNI"> 627 <title>zone login</title> 628 <program>/usr/sbin/login</program> 629 <see>zlogin(1)</see> 630 <entry id="subject"> 631 <internal token="subject"/> 632 <external opt="none"/> 633 </entry> 634 <entry id="message"> 635 <internal token="text"/> 636 <external opt="optional" type="char *"/> 637 <comment>error message</comment> 638 </entry> 639 <entry id="return"> 640 <internal token="return"/> 641 <external opt="none"/> 642 </entry> 643 </event> 644 645 <event id="AUE_su" header="0" idNo="30" omit="JNI"> 646 <title>su</title> 647 <program>/usr/bin/su</program> 648 <see>su(1M)</see> 649 <entry id="subject"> 650 <internal token="subject"/> 651 <external opt="none"/> 652 </entry> 653<!-- 654 should be changed to "fail_user" and su.c updated 655 However, the jni stuff is broken, so for now it's "message" 656--> 657 <entry id="message"> 658 <internal token="text"/> 659 <external opt="optional" type="char *"/> 660 <comment>"user name" of failed new user/role</comment> 661 </entry> 662 <entry id="return"> 663 <internal token="return"/> 664 <external opt="none"/> 665 </entry> 666 </event> 667 668 <event id="AUE_passwd" header="0" idNo="27" omit="JNI"> 669 <title>passwd</title> 670 <program>various</program> 671 <see>passwd(1)</see> 672 <entry id="subject"> 673 <internal token="subject"/> 674 <external opt="none"/> 675 </entry> 676 <entry id="username"> 677 <internal token="text"/> 678 <external opt="optional" type="char *"/> 679 <comment>username if different than caller</comment> 680 </entry> 681 <entry id="return"> 682 <internal token="return"/> 683 <external opt="none"/> 684 </entry> 685 </event> 686 687 <event id="AUE_screenlock" instance_of="AUE_generic_basic" header="0" 688 idNo="26" omit="JNI"> 689 <program>desktop screen lock</program> 690 </event> 691 <event id="AUE_screenunlock" instance_of="AUE_generic_basic" header="0" 692 idNo="31" omit="JNI"> 693 <program>desktop screen unlock</program> 694 </event> 695 696 <!-- 697 AUE_prof_cmd is not supportable for Java due to the structure of 698 the priv token. When and if a Java program needs to generate 699 a priv token, we'll need to look at the data format in the 700 Java code and provide an appropriate java and jni implementation. 701 --> 702 703 <event id="AUE_prof_cmd" header="0" idNo="24" omit="JNI"> 704 <title>pfexec</title> 705 <program>/usr/bin/pfexec</program> 706 <see>pfexec(1)</see> 707 <entry id="subject"> 708 <internal token="subject"/> 709 <external opt="none"/> 710 </entry> 711 <entry id="cwdpath"> 712 <internal token="path"/> 713 <external opt="required" type="char*"/> 714 <comment>working directory</comment> 715 </entry> 716 <entry id="cmdpath"> 717 <internal token="path"/> 718 <external opt="required" type="char*"/> 719 <comment>command pathname</comment> 720 </entry> 721 <entry id="argc,argv,envp"> 722 <internal token="command"/> 723 <external opt="required" type="int,char**,char**"/> 724 </entry> 725 <entry id="proc_auid,proc_euid,proc_egid,proc_ruid,proc_rgid,proc_pid,proc_sid,proc_termid"> 726 <internal token="process"/> 727 <external opt="required" 728 type="uid_t,uid_t,gid_t,uid_t,gid_t,pid_t,au_asid_t,termid*"/> 729 </entry> 730 <entry id="limit_set"> 731 <internal token="priv_limit"/> 732 <external opt="optional" type="priv_set_t*"/> 733 </entry> 734 <entry id="inherit_set"> 735 <internal token="priv_inherit"/> 736 <external opt="optional" type="priv_set_t*"/> 737 </entry> 738 <entry id="return"> 739 <internal token="return"/> 740 <external opt="none"/> 741 </entry> 742 </event> 743 744 <event id="AUE_inetd_connect" header="0" idNo="34" omit="JNI"> 745 <title>inetd</title> 746 <program>/usr/sbin/inetd</program> 747 <entry id="subject"> 748 <internal token="subject"/> 749 <external opt="none"/> 750 </entry> 751 <entry id="service_name"> 752 <internal token="text"/> 753 <external opt="optional" type="char *"/> 754 <comment>service name</comment> 755 </entry> 756 <entry id="ip_type,ip_remote_port,ip_local_port,ip_adr"> 757 <internal token="tid"/> 758 <external opt="required" 759 type="uint32_t,uint16_t,uint16_t,uint32_t[4]"/> 760 <comment>client address</comment> 761 </entry> 762 <entry id="cmd"> 763 <internal token="command_1"/> 764 <external opt="required" type="char *"/> 765 <comment>inetd command</comment> 766 </entry> 767 <entry id="privileges"> 768 <internal token="priv_effective"/> 769 <external opt="required" type="priv_set_t *"/> 770 </entry> 771 <entry id="return"> 772 <internal token="return"/> 773 <external opt="none"/> 774 </entry> 775 </event> 776 777 <event id="AUE_inetd_ratelimit" header="0" idNo="35" omit="JNI"> 778 <title>inetd</title> 779 <program>/usr/sbin/inetd</program> 780 <entry id="subject"> 781 <internal token="subject"/> 782 <external opt="none"/> 783 </entry> 784 <entry id="service_name"> 785 <internal token="text"/> 786 <external opt="optional" type="char *"/> 787 <comment>service name</comment> 788 </entry> 789 <entry id="limit"> 790 <internal token="text"/> 791 <external opt="required" type="char *"/> 792 <comment>limit value</comment> 793 </entry> 794 <entry id="return"> 795 <internal token="return"/> 796 <external opt="none"/> 797 </entry> 798 </event> 799 800 <event id="AUE_inetd_copylimit" header="0" idNo="36" omit="JNI"> 801 <title>inetd</title> 802 <program>/usr/sbin/inetd</program> 803 <entry id="subject"> 804 <internal token="subject"/> 805 <external opt="none"/> 806 </entry> 807 <entry id="service_name"> 808 <internal token="text"/> 809 <external opt="optional" type="char *"/> 810 <comment>service name</comment> 811 </entry> 812 <entry id="limit"> 813 <internal token="text"/> 814 <external opt="required" type="char *"/> 815 <comment>limit value</comment> 816 </entry> 817 <entry id="return"> 818 <internal token="return"/> 819 <external opt="none"/> 820 </entry> 821 </event> 822 823 <event id="AUE_inetd_failrate" header="0" idNo="37" omit="JNI"> 824 <title>inetd</title> 825 <program>/usr/sbin/inetd</program> 826 <entry id="subject"> 827 <internal token="subject"/> 828 <external opt="none"/> 829 </entry> 830 <entry id="service_name"> 831 <internal token="text"/> 832 <external opt="optional" type="char *"/> 833 <comment>service name</comment> 834 </entry> 835 <entry id="values"> 836 <internal token="text"/> 837 <external opt="required" type="char *"/> 838 <comment>limit value, interval</comment> 839 </entry> 840 <entry id="return"> 841 <internal token="return"/> 842 <external opt="none"/> 843 </entry> 844 </event> 845 846 <event id="AUE_zone_state" header="0" idNo="33" omit="JNI"> 847 <entry id="subject"> 848 <internal token="subject"/> 849 <external opt="none"/> 850 </entry> 851 <entry id="new_state"> 852 <internal token="text"/> 853 <external opt="required" type="char *"/> 854 <comment>New zone state</comment> 855 </entry> 856 <entry id="zonename"> 857 <internal token="zonename"/> 858 <external opt="required" type="char *"/> 859 <comment>zone name</comment> 860 </entry> 861 <entry id="return"> 862 <internal token="return"/> 863 <external opt="none"/> 864 </entry> 865 </event> 866 867 <event id="AUE_su_logout" instance_of="AUE_generic_basic" 868 header="0" idNo="39" omit="JNI"> 869 <title>su</title> 870 <program>/usr/bin/su</program> 871 <see>su(1M)</see> 872 </event> 873 874 <event id="AUE_role_logout" instance_of="AUE_generic_basic" 875 header="0" idNo="40" omit="JNI"> 876 <title>su</title> 877 <program>/usr/bin/su</program> 878 <see>su(1M)</see> 879 </event> 880 881 <event id="AUE_newgrp_login" header="0" idNo="41" omit="JNI"> 882 <program>newgrp</program> 883 <entry id="subject"> 884 <internal token="subject"/> 885 <external opt="none"/> 886 </entry> 887 <entry id="groupname"> 888 <internal token="text"/> 889 <external opt="required" type="char *"/> 890 <comment>group name</comment> 891 </entry> 892 <entry id="return"> 893 <internal token="return"/> 894 <external opt="none"/> 895 </entry> 896 </event> 897 898 <event id="AUE_generic_mountable" type="generic" omit="always"> 899 <!-- 900 901 User device mounting related functions 902 903 --> 904 <entry id="subject"> 905 <internal token="subject"/> 906 <external opt="none"/> 907 </entry> 908 <entry id="auth_used"> 909 <internal token="uauth"/> 910 <external opt="required" type="char *"/> 911 <comment>authorization used</comment> 912 </entry> 913 <entry id="mount_point"> 914 <internal token="path"/> 915 <external opt="required" type="char *"/> 916 <comment>mount point</comment> 917 </entry> 918 <entry id="device"> 919 <internal token="path"/> 920 <external opt="required" type="char *"/> 921 <comment>device</comment> 922 </entry> 923 <entry id="options"> 924 <internal token="text"/> 925 <external opt="optional" type="char *"/> 926 <comment>options</comment> 927 </entry> 928 <entry id="return"> 929 <internal token="return"/> 930 <external opt="none"/> 931 </entry> 932 </event> 933 934 <event id="AUE_attach" instance_of="AUE_generic_mountable" 935 header="0" idNo="42" omit="JNI"> 936 <program>hald</program> 937 </event> 938 <event id="AUE_detach" instance_of="AUE_generic_mountable" 939 header="0" idNo="43" omit="JNI"> 940 <program>hald</program> 941 </event> 942 <event id="AUE_remove" header="0" idNo="44" omit="JNI"> 943 <program>hald</program> 944 <entry id="subject"> 945 <internal token="subject"/> 946 <external opt="none"/> 947 </entry> 948 <entry id="auth_used"> 949 <internal token="uauth"/> 950 <external opt="required" type="char *"/> 951 <comment>authorization used</comment> 952 </entry> 953 <entry id="mount_point"> 954 <internal token="path"/> 955 <external opt="optional" type="char *"/> 956 <comment>mount point</comment> 957 </entry> 958 <entry id="device"> 959 <internal token="path"/> 960 <external opt="required" type="char *"/> 961 <comment>device</comment> 962 </entry> 963 <entry id="return"> 964 <internal token="return"/> 965 <external opt="none"/> 966 </entry> 967 </event> 968 969 <event id="AUE_pool_import" header="0" idNo="45" omit="JNI"> 970 <program>hald</program> 971 <entry id="subject"> 972 <internal token="subject"/> 973 <external opt="none"/> 974 </entry> 975 <entry id="auth_used"> 976 <internal token="uauth"/> 977 <external opt="required" type="char *"/> 978 <comment>authorization used</comment> 979 </entry> 980 <entry id="pool"> 981 <internal token="text"/> 982 <external opt="required" type="char *"/> 983 <comment>pool</comment> 984 </entry> 985 <entry id="device"> 986 <internal token="path"/> 987 <external opt="required" type="char *"/> 988 <comment>device</comment> 989 </entry> 990 <entry id="return"> 991 <internal token="return"/> 992 <external opt="none"/> 993 </entry> 994 </event> 995 <event id="AUE_pool_export" header="0" idNo="46" omit="JNI"> 996 <program>hald</program> 997 <entry id="subject"> 998 <internal token="subject"/> 999 <external opt="none"/> 1000 </entry> 1001 <entry id="auth_used"> 1002 <internal token="uauth"/> 1003 <external opt="required" type="char *"/> 1004 <comment>authorization used</comment> 1005 </entry> 1006 <entry id="pool"> 1007 <internal token="text"/> 1008 <external opt="required" type="char *"/> 1009 <comment>pool</comment> 1010 </entry> 1011 <entry id="device"> 1012 <internal token="path"/> 1013 <external opt="required" type="char *"/> 1014 <comment>device</comment> 1015 </entry> 1016 <entry id="return"> 1017 <internal token="return"/> 1018 <external opt="none"/> 1019 </entry> 1020 </event> 1021 1022<!-- dladm security objected events --> 1023 <event id="AUE_dladm_generic" type="generic" omit="always"> 1024 <entry id="subject"> 1025 <internal token="subject"/> 1026 <external opt="none"/> 1027 </entry> 1028 <entry id="auth_used"> 1029 <internal token="uauth"/> 1030 <external opt="required" type="char *"/> 1031 <comment>authorization used</comment> 1032 </entry> 1033 <entry id="obj_class"> 1034 <internal token="text"/> 1035 <external opt="required" type="char *"/> 1036 <comment>object class name</comment> 1037 </entry> 1038 <entry id="obj_name"> 1039 <internal token="text"/> 1040 <external opt="required" type="char *"/> 1041 <comment>object name</comment> 1042 </entry> 1043 <entry id="return"> 1044 <internal token="return"/> 1045 <external opt="none"/> 1046 </entry> 1047 </event> 1048 1049 <event id="AUE_dladm_create_secobj" instance_of="AUE_dladm_generic" 1050 header="0" idNo="47" omit="JNI"> 1051 <title>create wifi security object</title> 1052 <program>/usr/sbin/dladm</program> 1053 <see>dladm(1M)</see> 1054 </event> 1055 <event id="AUE_dladm_delete_secobj" instance_of="AUE_dladm_generic" 1056 header="0" idNo="48" omit="JNI"> 1057 <title>delete wifi security object</title> 1058 <program>/usr/sbin/dladm</program> 1059 <see>dladm(1M)</see> 1060 </event> 1061 1062<!-- Trusted eXtensions (TX) events --> 1063 1064 <!-- labeld events --> 1065 <event id="AUE_file_relabel" header="0" idNo="49" omit="JNI"> 1066 <title>relabel file from one zone to another</title> 1067 <program>setlabel(1)</program> 1068 <see>setflabel(3TSOL)</see> 1069 <entry id="subject"> 1070 <internal token="subject"/> 1071 <external opt="none"/> 1072 </entry> 1073 <entry id="auth_used"> 1074 <internal token="uauth"/> 1075 <external opt="required" type="char *"/> 1076 <comment>authorization used</comment> 1077 </entry> 1078 <entry id="file"> 1079 <internal token="path"/> 1080 <external opt="required" type="char *"/> 1081 <comment>file relabeled</comment> 1082 </entry> 1083 <entry id="src_label"> 1084 <internal token="label"/> 1085 <external opt="required" type="m_label_t *"/> 1086 <comment>original label</comment> 1087 </entry> 1088 <entry id="dst_label"> 1089 <internal token="label"/> 1090 <external opt="required" type="m_label_t *"/> 1091 <comment>new label</comment> 1092 </entry> 1093 <entry id="return"> 1094 <internal token="return"/> 1095 <external opt="none"/> 1096 </entry> 1097 </event> 1098 1099 <event id="AUE_file_copy" header="0" idNo="50" omit="JNI"> 1100 <title>copy file to another zone</title> 1101 <program>dtfile(1X)</program> 1102 <entry id="subject"> 1103 <internal token="subject"/> 1104 <external opt="none"/> 1105 </entry> 1106 <entry id="auth_used"> 1107 <internal token="uauth"/> 1108 <external opt="required" type="char *"/> 1109 <comment>authorization used</comment> 1110 </entry> 1111 <entry id="src_file"> 1112 <internal token="path"/> 1113 <external opt="required" type="char *"/> 1114 <comment>source file</comment> 1115 </entry> 1116 <entry id="src_label"> 1117 <internal token="label"/> 1118 <external opt="required" type="m_label_t *"/> 1119 <comment>source label</comment> 1120 </entry> 1121 <entry id="dst_file"> 1122 <internal token="path"/> 1123 <external opt="required" type="char *"/> 1124 <comment>destination directory</comment> 1125 </entry> 1126 <entry id="dst_label"> 1127 <internal token="label"/> 1128 <external opt="required" type="m_label_t *"/> 1129 <comment>destination label</comment> 1130 </entry> 1131 <entry id="return"> 1132 <internal token="return"/> 1133 <external opt="none"/> 1134 </entry> 1135 </event> 1136 1137<!-- add new events here with the next higher idNo --> 1138<!-- Highest idNo is 50, so next is 51, then fix this comment --> 1139<!-- end of C Only events --> 1140 1141 1142<!-- 1143 token definitions are partially implemented. All they do for now 1144 is create a list of defined token names. In the future they may 1145 become a way of describing token structure. 1146--> 1147 1148 <token id="acl"> 1149 </token> 1150 <token id="arbitrary"> 1151 </token> 1152 <token id="arg"> 1153 </token> 1154 <token id="attr"> 1155 </token> 1156 <token id="command"> 1157 </token> 1158 <token id="command_1"> 1159 </token> 1160 <token id="date"> 1161 </token> 1162 <token id="exec_args"> 1163 </token> 1164 <token id="exec_env"> 1165 </token> 1166 <token id="exit"> 1167 </token> 1168 <token id="file"> 1169 </token> 1170 <token id="fmri"> 1171 </token> 1172 <token id="groups"> 1173 </token> 1174 <token id="in_addr"> 1175 </token> 1176 <token id="ipc"> 1177 </token> 1178 <token id="ipc_perm"> 1179 </token> 1180 <token id="label"> 1181 </token> 1182 <token id="newgroups"> 1183 </token> 1184 <token id="opaque"> 1185 </token> 1186 <token id="path"> 1187 </token> 1188 <!-- pseudo token; path list generates 0 or more path tokens --> 1189 <token id="path_list"> 1190 </token> 1191 <token id="tid"> 1192 </token> 1193 1194 <!-- 1195 privilege token is implemented as one of the pseudo tokens 1196 priv_limit, priv_effective, or priv_inherit 1197 1198 <token id="privilege"> 1199 </token> 1200 --> 1201 <token id="priv_effective"> 1202 </token> 1203 <token id="priv_inherit"> 1204 </token> 1205 <token id="priv_limit"> 1206 </token> 1207 <token id="process"> 1208 </token> 1209 <token id="return"> 1210 </token> 1211 <token id="seq"> 1212 </token> 1213 <token id="socket"> 1214 </token> 1215 <token id="socket-inet"> 1216 </token> 1217 <token id="subject"> 1218 </token> 1219 <token id="text"> 1220 </token> 1221 <token id="uauth"> 1222 </token> 1223 <token id="zonename"> 1224 </token> 1225 1226<!-- 1227 error value list for return values with success/fail code of fail. 1228 These values start at 1000 so praudit can tell the difference 1229 between the libbsm/common/audit_*.c broken error values and 1230 the new adt_ error value list. It is public so that praudit 1231 can find it. 1232 1233 praudit outputs "failure" %s" for these strings, so there is 1234 no need to use words such as "failed" in the message. 1235 1236 ** Add to the end only to maintain validity across versions of 1237 the audit log. ** 1238--> 1239 1240 <msg_list id="fail_value" header="0" start="1000" public="true"> 1241 <msg id="PW_ATTR">Attribute update</msg> 1242 <msg id="PW">Password update</msg> 1243 <msg id="USERNAME">bad username</msg> 1244 <msg id="AUTH">authorization failed</msg> 1245 <msg id="UID">bad uid</msg> 1246 <msg id="UNKNOWN">unknown failure</msg> 1247 <msg id="EXPIRED">password expired</msg> 1248 <msg id="ACCOUNT_LOCKED">Account is locked</msg> 1249 <msg id="BAD_DIALUP">Bad dial up</msg> 1250 <msg id="BAD_ID">Invalid ID</msg> 1251 <msg id="BAD_PW">Invalid password</msg> 1252 <msg id="CONSOLE">Not on console</msg> 1253 <msg id="MAX_TRIES">Too many failed attempts</msg> 1254 <msg id="PROTOCOL_FAILURE">Protocol failure</msg> 1255 <msg id="EXCLUDED_USER">Excluded user</msg> 1256 <msg id="ANON_USER">No anonymous</msg> 1257 <msg id="BAD_CMD">Invalid command</msg> 1258 <msg id="BAD_TTY">Standard input not a tty line</msg> 1259 <msg id="PROGRAM">Program failure</msg> 1260 <msg id="CHDIR_FAILED">chdir to home directory</msg> 1261 <msg id="INPUT_OVERFLOW">Input line too long.</msg> 1262 <msg id="DEVICE_PERM">login device override</msg> 1263 <msg id="AUTH_BYPASS">authorization bypass</msg> 1264 <msg id="LOGIN_DISABLED">login disabled</msg> 1265 </msg_list> 1266 1267<!-- 1268 The following empty list is used for PAM errors; the "start" 1269 value is used by praudit to know to use the PAM infrastructure 1270 for generating error strings 1271--> 1272 <msg_list id="fail_pam" header="0" start="2000" public="true"> 1273 </msg_list> 1274 1275<!-- 1276 This is still in use by SMC. See AUE_generic_login. When 1277 either SMC is fixed to stop using this, or SMC goes away. 1278 REMOVE this stuff and the corresponding AUE_generic_login 1279 message field. 1280 1281 Message list for the various authentication events, such 1282 as AUE_login and AUE_admin_authenticate. Add new entries 1283 at the end. The order of msg_list entries and the order 1284 of msg entries both affect the names in adt.h and the value 1285 of the associated enumerated types. 1286 1287 Each of these messages except NO_MSG is also in the failure_attribute 1288 list; the difference is that the messages below use a text token 1289 in the audit record, while the failure_attribute messages are 1290 associated with the return value of the return token. 1291 1292 This list is deprecated; please don't use text tokens for error 1293 messages. 1294--> 1295 1296 <msg_list id="login_text" header="0" deprecated="true"> 1297 <msg id="NO_MSG"></msg> 1298 <msg id="ACCOUNT_LOCKED">Account is locked</msg> 1299 <msg id="BAD_DIALUP">Bad dial up</msg> 1300 <msg id="BAD_ID">Invalid ID</msg> 1301 <msg id="BAD_PW">Invalid password</msg> 1302 <msg id="CONSOLE">Not on console</msg> 1303 <msg id="MAX_TRIES">Too many failed attempts</msg> 1304 <msg id="PROTOCOL_FAILURE">Protocol failure</msg> 1305 <msg id="EXCLUDED_USER">Excluded user</msg> 1306 <msg id="ANON_USER">No anonymous</msg> 1307 </msg_list> 1308 1309</specification> 1310