xref: /titanic_50/usr/src/lib/libbsm/common/adt.xml (revision 273264cdcd36b34067f5b77d1af696eff72d46f3)

<?xml version="1.0" standalone="yes"?>
<!DOCTYPE specification SYSTEM "audit.dtd">
<!--
 CDDL HEADER START

 The contents of this file are subject to the terms of the
 Common Development and Distribution License (the "License").
 You may not use this file except in compliance with the License.

 You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 or http://www.opensolaris.org/os/licensing.
 See the License for the specific language governing permissions
 and limitations under the License.

 When distributing Covered Code, include this CDDL HEADER in each
 file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 If applicable, add the following below this CDDL HEADER, with the
 fields enclosed by brackets "[]" replaced with your own identifying
 information: Portions Copyright [yyyy] [name of copyright owner]

 CDDL HEADER END

Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
Use is subject to license terms.

  ident	"%Z%%M%	%I%	%E% SMI"
-->

<specification>

<!-- comments are displayed to stderr if debug is on -->
<debug set="off"/>

    <!-- The order of events is arbitrary EXCEPT generic events must
	 precede their instances -->
       <!-- The order of entries within an event determine the order
            data is defined in the external API -->
	    <!-- The order of internal / external is arbitrary -->

<!--
	tags:
			The following top level tags are defined:
			<event> <token> <msg_list> <debug>

	event		defines an audit record
			- id is the record id from audit_uevents.h
			- reorder="yes" or "no".  (default is "no").
			  if "yes" then the order of the tokens to be
			  output does not match the order of the data
			  input.  (see order attribute of <entry>)
			- header defines the header file to contain the external
			  definitions for this event type.  The header file
			  name is adt_event_N.h, where N is the value supplied
			  header="0" is for "stable" events, > 0 for new ones.
			  with this attribute. (header="1").
			- idNo is the number associated with the external
			  name of this event. (For AUE_login, ADT_login is
			  the external name and idNo is the value for
			  ADT_login.)
			- omit is by default 'no' (i.e., don't omit) and can be
			  'always' or 'JNI'.  In the latter case, C interface
			  code is generated but neither Java nor JNI code is.
			- included text is just a comment
			Within an event block, the following tags are defined:
			<entry>, <debug>, <altname>, <title>, <program>, <see>

	altname		defines the internal name of an audit record; if
			omitted, the internal name is the same as the
			external name.

	title,		these tags are used by bsmrecord build to create
	program,	audit_record_attr database from adt events.
	see		Following example demonstrates their semantics:

			bsmrecord -p passwd
			passwd		<-   <title>
			  program     various              See passwd(1)
			  		^-   <program>		^-   <see>
			  event ID    6163                 AUE_passwd
			  class       lo                   (0x00001000)
			      header
			      subject
			      [text]                       username...
			      					^-   <comment>
			      return

	entry		defines the correspondence between the data
			supplied by the caller and the token to be
			output.
			- id is the data name that shows up in the structures
			  of adt_event.h  If it is a comma separated list,
			  it is the list of names of data to be associated
			  with one output token.  (See <external>, below)
			Within an entry block, the following tags are defined:
			<internal>, <external>, <debug>, <comment>

	internal	defines the token to be generated.
			- token is a name that must also be defined with
			  a <token> tag elsewhere in this file.  (order is
			  not important).
			- order="some number" determines the order of the
			  tokens to be output, starting with 1.  The subject
			  token is normally order="1".  The use is to insure
			  that the order of fields listed in adt_event.h does
			  not change when we arbitrarily change the order of
			  tokens.  If the <event reorder="yes"> is not set,
			  order is ignored.
			- format is a printf-like string that will be used
			  in to format the data supplied by the user.

	external	defines the data to be supplied for creating the
			token defined via <internal>
			- opt is one of four values:  "required", "optional",
			  "obsolete", or "none".  The first two values
			  indicate that this token's data must or may
			  be supplied by the user; the third value is
			  equivalent to "optional" but shows in the
			  comment that this field is no longer used;
			  the forth value indicates that this token
			  does not require any user-supplied data.  If
			  data is required, then a token is always
			  output, while optional data is output only
			  if data is supplied.
			- type describes the C data type to be associated
			  with the <entry id="dataName">.  The following
			  data types are representative:

				au_asid_t (uint32_t)
				char
				char * (blank is optional)
				char ** (blank is optional)
				uint_t, int, int32_t, uid_t, gid_t
				uid_t *, gid_t *
				long, ulong_t
				m_label_t *
				pid_t
				priv_set_t *
				uint16_t, unit32_t, uint64_t
				uint32_t *, uint32_t[], uint64_t *
				msg  (not a C type, see below)

			Below is what Tony said.  Above seems to be
			what is implemented
				char
				char * (blank is optional)
				char ** (blank is optional)
				int, uid_t, gid_t
				int *, uid_t *, gid_t *
				msg  (not a C type, see below)
				time_t
				uint, uint *

			  The msg type refers to an enumerated type
			  that must be defined via a <msg> description
			  else where in this file. The syntax is
			  special.  Example: <external opt="optional"
			  type="msg login_text"/> "login_text" is the
			  id of a <msg_list> descriptor given
			  elsewhere in this file.

			If the <entry> id is a list, the type must also
			be a comma-separated list, where the types are
			in the same order as the id's.
			If the type is an array, its length must be given
			explicitly.

	comment		Used by bsmrecord build to generate audit_record_attr.
			Comment is explanation note printed with token type.
			See example above for other tags related to bsmrecord.

	token		Define allowed token names.
			- id is the name of token; this name is used
			as an <internal> id.
			- usage is an optional value.  At present, only
			  "TSOL" is defined; it means that this data is
			  to be used only in Trusted Solaris implementations.

	msg_list	Define a set of text strings.
			- id is the name to be used for this group of text
			  strings in adt_event.h
			- header is as defined for <event>
			- start is a number where produced enum type begins;
			  ensure msg lists do not overlap
			Within a msg_list block, <msg> and <debug> are defined.
			The order of <msg> tags in a msg_list is reflected
			directly in adt_event.h. Also add ADT_LIST_<<id>> to
			enum adt_msg_list in adt_xlate.h.

	msg		Define one string.
			- id is the name to be used in the enum describing
			  this set of strings.  Convention:  use upper case.
			The content (text between <msg> and </msg>) is the
			actual string.  Extra white space, including line
			feeds, is ignored.  If empty, no output token
			is generated unless the <external> opt attribute is
			set to "required", in which case a blank text token
			is generated.
			Within a msg block, <debug> is defined, but has not been
			tested and may have no effect.

	debug		This turns on/off debug messages during the processing
			of the xml data.  It affects the block within which it
			is defined.
			- set may have one of two values:  "on" or "off".  If
			  set is omitted, the debug state for the current block
			  is toggled.
			The use of the <debug> tag does not affect the output
			of data to the various files created, but does generate
			potentially large amounts of output to stderr.

-->
<!--        template for an event record definition

    <event id="" header="0" idNo="">
	<entry id="subject">
	    <internal token="subject"/>
	    <external opt="none"/>
	</entry>
	<entry id="">
	    <internal token=""/>
	    <external opt="" type="" />
	</entry>
	<entry id="return">
	    <internal token="return"/>
	    <external opt="none"/>
	</entry>
    </event>

    Generic events must precede Instance events; within each
    group, please group the AUE_* by area and event idNo-s in order,
    gaps in idNo-s are OK.
    N.B. Renumbering idNo-s requires recompilation of consumers.  See
    the contracts for whom to notify if/when this happens.
-->

<!-- generic events  -->

    <!--
	'omit="always"' means that this record type is not reflected
	in the generated header and table files.
     -->

    <event id="AUE_generic_basic" type="generic" omit="always">
	<!--

	This is a template for the event types that have no tokens
	other than the header and return. There is no allowed_type
	list because the template is not externally visible due to the
	omit="always".

	-->
	<entry id="subject">
	    <internal token="subject"/>
	    <external opt="none"/>
	</entry>
	<entry id="return">
	    <internal token="return"/>
	    <external opt="none"/>
	</entry>
    </event>

    <event id="AUE_generic_login" type="generic" omit="always">
	<!--

	This is a template for the various login event types
	AUE_login, AUE_ftp, etc which match this template.  There is
	no allowed_type list because the template is not externally
	visible due to the omit="always".

	-->
	<entry id="subject">
	    <internal token="subject"/>
	    <external opt="none"/>
	</entry>

	<!--	This field is still in use for SMC until it is cleaned up,
		it must remain, see login_text msg list at the end of the
		file.
	-->
	<entry id="message">
	    <internal token="text"/>
	    <external opt="optional" type="msg login_text"/>
	    <comment>error message</comment>
	</entry>
	<entry id="return">
	    <internal token="return"/>
	    <external opt="none"/>
	</entry>
    </event>

<!-- generic SMC events  -->

    <event id="AUE_generic_SMC_add" type="generic" omit="always">
	<entry id="subject">
	    <internal token="subject"/>
	    <external opt="none"/>
	</entry>
	<entry id="object_name">
	    <internal token="text"/>
	    <external opt="required" type="char *"/>
	    <comment>object name</comment>
	</entry>
	<entry id="domain">
	    <internal token="text"/>
	    <external opt="optional" type="char *"/>
	    <comment>domain</comment>
	</entry>
	<entry id="name_service">
	    <internal token="text"/>
	    <external opt="required" type="char *"/>
	    <comment>name_service</comment>
	</entry>
	<entry id="auth_used">
	    <internal token="uauth"/>
	    <external opt="optional" type="char *"/>
	    <comment>authorization used</comment>
	</entry>
	<!--
	  This should really be its own token type, not "text"
	-->
	<entry id="initial_values">
	    <internal token="text"/>
	    <external opt="required" type="char *"/>
	    <comment>initial values</comment>
	</entry>
	<entry id="return">
	    <internal token="return"/>
	    <external opt="none"/>
	</entry>
    </event>

    <event id="AUE_generic_SMC_delete" type="generic" omit="always">
	<entry id="subject">
	    <internal token="subject"/>
	    <external opt="none"/>
	</entry>
	<entry id="object_name">
	    <internal token="text"/>
	    <external opt="required" type="char *"/>
	    <comment>object name</comment>
	</entry>
	<entry id="domain">
	    <internal token="text"/>
	    <external opt="optional" type="char *"/>
	    <comment>domain</comment>
	</entry>
	<entry id="name_service">
	    <internal token="text"/>
	    <external opt="required" type="char *"/>
	    <comment>name_service</comment>
	</entry>
	<entry id="auth_used">
	    <internal token="uauth"/>
	    <external opt="optional" type="char *"/>
	    <comment>authorization used</comment>
	</entry>
	<entry id="delete_values">
	    <internal token="text"/>
	    <external opt="required" type="char *"/>
	    <comment>deleted values</comment>
	</entry>
	<entry id="return">
	    <internal token="return"/>
	    <external opt="none"/>
	</entry>
    </event>

    <event id="AUE_generic_SMC_modify" type="generic" omit="always">
	<entry id="subject">
	    <internal token="subject"/>
	    <external opt="none"/>
	</entry>
	<entry id="object_name">
	    <internal token="text"/>
	    <external opt="required" type="char *"/>
	    <comment>object name</comment>
	</entry>
	<entry id="domain">
	    <internal token="text"/>
	    <external opt="optional" type="char *"/>
	    <comment>domain</comment>
	</entry>
	<entry id="name_service">
	    <internal token="text"/>
	    <external opt="required" type="char *"/>
	    <comment>name_service</comment>
	</entry>
	<entry id="auth_used">
	    <internal token="uauth"/>
	    <external opt="optional" type="char *"/>
	    <comment>authorization used</comment>
	</entry>
	<entry id="changed_values">
	    <internal token="text"/>
	    <external opt="required" type="char *"/>
	    <comment>changed values</comment>
	</entry>
	<entry id="return">
	    <internal token="return"/>
	    <external opt="none"/>
	</entry>
    </event>

<!-- instances -->

<!--
	Java needed for SMC events.  Since the SMC events grow less
	often than the C related events.  They come first.  It
	would be nice to reorder the idNo-s, but that's an ABI
	change and should rev libbsm version no.  If reordered
	start with 1 and eliminate the comment at the end about
	the highest idNo.
-->
    <event id="AUE_admin_authenticate" instance_of="AUE_generic_login"
	header="0" idNo="3">
	<title>Admin Server Authentication</title>
	<program>admin (various)</program>
	<see>SMC, WBEM, or AdminSuite</see>
    </event>

    <event id="AUE_filesystem_add" instance_of="AUE_generic_SMC_add"
	header="0" idNo="4">
	<title>SMC: filesystem add</title>
	<program>SMC server</program>
    </event>
    <event id="AUE_filesystem_delete" instance_of="AUE_generic_SMC_delete"
	header="0" idNo="5">
	<title>SMC: filesystem delete</title>
	<program>SMC server</program>
    </event>
    <event id="AUE_filesystem_modify" instance_of="AUE_generic_SMC_modify"
	header="0" idNo="6">
	<title>SMC: filesystem modify</title>
	<program>SMC server</program>
    </event>

    <event id="AUE_network_add" instance_of="AUE_generic_SMC_add"
	header="0" idNo="7">
	<title>SMC: network add</title>
	<program>SMC server</program>
    </event>
    <event id="AUE_network_delete" instance_of="AUE_generic_SMC_delete"
	header="0" idNo="8">
	<title>SMC: network delete</title>
	<program>SMC server</program>
    </event>
    <event id="AUE_network_modify" instance_of="AUE_generic_SMC_modify"
	header="0" idNo="9">
	<title>SMC: network modify</title>
	<program>SMC server</program>
    </event>

    <event id="AUE_printer_add" instance_of="AUE_generic_SMC_add"
	header="0" idNo="10">
	<title>SMC: printer add</title>
	<program>SMC server</program>
    </event>
    <event id="AUE_printer_delete" instance_of="AUE_generic_SMC_delete"
	header="0" idNo="11">
	<title>SMC: printer delete</title>
	<program>SMC server</program>
    </event>
    <event id="AUE_printer_modify" instance_of="AUE_generic_SMC_modify"
	header="0" idNo="12">
	<title>SMC: printer modify</title>
	<program>SMC server</program>
    </event>

<!--
	This is SMC; it's also used in su and should probably be used in
	desktop role login.  If we fix the SMC to not record NO_MSG here,
	we can fix to record failed user.  See su.c and AUE_su.
-->
    <event id="AUE_role_login" instance_of="AUE_generic_login"
	header="0" idNo="13">
	<title>RBAC: role login</title>
	<program>SMC server</program>
	<program>/usr/bin/su</program>
    </event>

    <event id="AUE_scheduledjob_add" instance_of="AUE_generic_SMC_add"
	header="0" idNo="14">
	<title>SMC: scheduled job add</title>
	<program>SMC server</program>
    </event>
    <event id="AUE_scheduledjob_delete" instance_of="AUE_generic_SMC_delete"
	header="0" idNo="15">
	<title>SMC: scheduled job delete</title>
	<program>SMC server</program>
    </event>
    <event id="AUE_scheduledjob_modify" instance_of="AUE_generic_SMC_modify"
	header="0" idNo="16">
	<title>SMC: scheduled job modify</title>
	<program>SMC server</program>
    </event>

    <event id="AUE_serialport_add" instance_of="AUE_generic_SMC_add"
	header="0" idNo="17">
	<title>SMC: serial port add</title>
	<program>SMC server</program>
    </event>
    <event id="AUE_serialport_delete" instance_of="AUE_generic_SMC_delete"
	header="0" idNo="18">
	<title>SMC: serial port delete</title>
	<program>SMC server</program>
    </event>
    <event id="AUE_serialport_modify" instance_of="AUE_generic_SMC_modify"
	header="0" idNo="19">
	<title>SMC: serial port modify</title>
	<program>SMC server</program>
    </event>

<!-- This is SMC; should this also be used elsewhere? -->
    <event id="AUE_uauth" header="0" idNo="20">
    	<title>SMC: Use of Authorization</title>
	<program>SMC server</program>
	<entry id="subject">
	    <internal token="subject"/>
	    <external opt="none"/>
	</entry>
	<entry id="auth_used">
	    <internal token="uauth"/>
	    <external opt="required" type="char *"/>
	    <comment>authorization used</comment>
	</entry>
	<entry id="objectname">
	    <internal token="text"/>
	    <external opt="required" type="char *"/>
	    <comment>object name</comment>
	</entry>
	<entry id="return">
	    <internal token="return"/>
	    <external opt="none"/>
	</entry>
    </event>

    <event id="AUE_usermgr_add" instance_of="AUE_generic_SMC_add"
	header="0" idNo="21">
	<title>SMC: User Manager add</title>
	<program>SMC server</program>
    </event>
    <event id="AUE_usermgr_delete" instance_of="AUE_generic_SMC_delete"
	header="0" idNo="22">
	<title>SMC: User Manager delete</title>
	<program>SMC server</program>
    </event>
    <event id="AUE_usermgr_modify" instance_of="AUE_generic_SMC_modify"
	header="0" idNo="23">
	<title>SMC: User Manager modify</title>
	<program>SMC server</program>
    </event>
<!-- end of Java needed for SMC events -->
<!--
    while not used by SMC logout is used by Lockhart
-->
    <event id="AUE_logout" header="0" idNo="1">
    	<title>login: logout</title>
	<program>various</program>
	<see>login(1)</see>
	<entry id="subject">
	    <internal token="subject"/>
	    <external opt="none"/>
	</entry>
<!--
    not used by C code, used by Lockhart,
    get them to change and remove
    event.user_name("logout " + session.getUserName());
    from /ws/lockhart-nv-gate/src/bundled/app/webmgt/lib/services/
    com/sun/management/services/audit/SolarisAuditEvent_Logout.java
-->
	<entry id="user_name">
	    <internal token="text" format="logout %s"/>
	    <external opt="optional" type="char *"/>
	    <comment>"logout" username</comment>
	</entry>
	<entry id="return">
	    <internal token="return"/>
	    <external opt="none"/>
	</entry>
    </event>


<!-- C Only events -->
    <event id="AUE_init_solaris" header="0" idNo="32" omit="JNI">
    	<title>init</title>
	<program>/sbin/init</program>
	<program>/usr/sbin/init</program>
	<program>/usr/sbin/shutdown</program>
	<entry id="subject">
	    <internal token="subject"/>
	    <external opt="none"/>
	</entry>
	<entry id="info">
	    <internal token="text"/>
	    <external opt="optional" type="char *"/>
	    <comment>init level or zone name</comment>
	</entry>
	<entry id="return">
	    <internal token="return"/>
	    <external opt="none"/>
	</entry>
    </event>

    <event id="AUE_login" instance_of="AUE_generic_login" header="0"
	idNo="25" omit="JNI">
	<title>terminal login</title>
	<program>/usr/sbin/login</program>
	<program>/usr/dt/bin/dtlogin</program>
	<see>login(1)</see>
	<see>dtlogin</see>
    </event>
    <event id="AUE_rlogin" instance_of="AUE_generic_login" header="0"
	idNo="28" omit="JNI">
	<title>rlogin</title>
	<program>/usr/sbin/login</program>
	<see>login(1) - rlogin</see>
    </event>
    <event id="AUE_telnet" instance_of="AUE_generic_login" header="0"
	idNo="29" omit="JNI">
	<title>telnet login</title>
	<program>/usr/sbin/login</program>
	<see>login(1) - telnet</see>
    </event>
    <event id="AUE_ssh" instance_of="AUE_generic_login" header="0"
	idNo="2" omit="JNI">
	<program>/usr/lib/ssh/sshd</program>
    </event>

    <event id="AUE_zlogin" header="0" idNo="38" omit="JNI">
    	<title>zone login</title>
	<program>/usr/sbin/login</program>
	<see>zlogin(1)</see>
	<entry id="subject">
	    <internal token="subject"/>
	    <external opt="none"/>
	</entry>
	<entry id="message">
	    <internal token="text"/>
	    <external opt="optional" type="char *"/>
	    <comment>error message</comment>
	</entry>
	<entry id="return">
	    <internal token="return"/>
	    <external opt="none"/>
	</entry>
    </event>

    <event id="AUE_su" header="0" idNo="30" omit="JNI">
    	<title>su</title>
	<program>/usr/bin/su</program>
	<see>su(1M)</see>
	<entry id="subject">
	    <internal token="subject"/>
	    <external opt="none"/>
	</entry>
<!--
	should be changed to "fail_user" and su.c updated
	However, the jni stuff is broken, so for now it's "message"
-->
	<entry id="message">
	    <internal token="text"/>
	    <external opt="optional" type="char *"/>
	    <comment>"user name" of failed new user/role</comment>
	</entry>
	<entry id="return">
	    <internal token="return"/>
	    <external opt="none"/>
	</entry>
    </event>

    <event id="AUE_passwd" header="0" idNo="27" omit="JNI">
    	<title>passwd</title>
	<program>various</program>
	<see>passwd(1)</see>
	<entry id="subject">
	    <internal token="subject"/>
	    <external opt="none"/>
	</entry>
	<entry id="username">
	    <internal token="text"/>
	    <external opt="optional" type="char *"/>
	    <comment>username if different than caller</comment>
	</entry>
	<entry id="return">
	    <internal token="return"/>
	    <external opt="none"/>
	</entry>
    </event>

    <event id="AUE_screenlock" instance_of="AUE_generic_basic" header="0"
	idNo="26" omit="JNI">
	<program>desktop screen lock</program>
    </event>
    <event id="AUE_screenunlock" instance_of="AUE_generic_basic" header="0"
	idNo="31" omit="JNI">
	<program>desktop screen unlock</program>
    </event>

    <!--
	AUE_prof_cmd is not supportable for Java due to the structure of
	the priv token.  When and if a Java program needs to generate
	a priv token, we'll need to look at the data format in the
	Java code and provide an appropriate java and jni implementation.
    -->

    <event id="AUE_prof_cmd" header="0" idNo="24" omit="JNI">
    	<title>pfexec</title>
	<program>/usr/bin/pfexec</program>
	<see>pfexec(1)</see>
	<entry id="subject">
	    <internal token="subject"/>
	    <external opt="none"/>
	</entry>
	<entry id="cwdpath">
	    <internal token="path"/>
	    <external opt="required" type="char*"/>
	    <comment>working directory</comment>
	</entry>
	<entry id="cmdpath">
	    <internal token="path"/>
	    <external opt="required" type="char*"/>
	    <comment>command pathname</comment>
	</entry>
	<entry id="argc,argv,envp">
	    <internal token="command"/>
	    <external opt="required" type="int,char**,char**"/>
	</entry>
	<entry id="proc_auid,proc_euid,proc_egid,proc_ruid,proc_rgid,proc_pid,proc_sid,proc_termid">
	    <internal token="process"/>
	    <external opt="required"
		type="uid_t,uid_t,gid_t,uid_t,gid_t,pid_t,au_asid_t,termid*"/>
	</entry>
	<entry id="limit_set">
	    <internal token="priv_limit"/>
	    <external opt="optional" type="priv_set_t*"/>
 	</entry>
	<entry id="inherit_set">
	    <internal token="priv_inherit"/>
	    <external opt="optional" type="priv_set_t*"/>
	</entry>
	<entry id="return">
	    <internal token="return"/>
	    <external opt="none"/>
	</entry>
    </event>

    <event id="AUE_inetd_connect" header="0" idNo="34" omit="JNI">
    	<title>inetd</title>
	<program>/usr/sbin/inetd</program>
	<entry id="subject">
	    <internal token="subject"/>
	    <external opt="none"/>
	</entry>
	<entry id="service_name">
	    <internal token="text"/>
	    <external opt="optional" type="char *"/>
	    <comment>service name</comment>
	</entry>
	<entry id="ip_type,ip_remote_port,ip_local_port,ip_adr">
	    <internal token="tid"/>
	    <external opt="required"
		type="uint32_t,uint16_t,uint16_t,uint32_t[4]"/>
	    <comment>client address</comment>
	</entry>
	<entry id="cmd">
	    <internal token="command_1"/>
	    <external opt="required" type="char *"/>
	    <comment>inetd command</comment>
	</entry>
	<entry id="privileges">
	    <internal token="priv_effective"/>
	    <external opt="required" type="priv_set_t *"/>
	</entry>
	<entry id="return">
	    <internal token="return"/>
	    <external opt="none"/>
	</entry>
    </event>

    <event id="AUE_inetd_ratelimit" header="0" idNo="35" omit="JNI">
    	<title>inetd</title>
	<program>/usr/sbin/inetd</program>
	<entry id="subject">
	    <internal token="subject"/>
	    <external opt="none"/>
	</entry>
	<entry id="service_name">
	    <internal token="text"/>
	    <external opt="optional" type="char *"/>
	    <comment>service name</comment>
	</entry>
	<entry id="limit">
	    <internal token="text"/>
	    <external opt="required" type="char *"/>
	    <comment>limit value</comment>
	</entry>
	<entry id="return">
	    <internal token="return"/>
	    <external opt="none"/>
	</entry>
    </event>

    <event id="AUE_inetd_copylimit" header="0" idNo="36" omit="JNI">
    	<title>inetd</title>
	<program>/usr/sbin/inetd</program>
	<entry id="subject">
	    <internal token="subject"/>
	    <external opt="none"/>
	</entry>
	<entry id="service_name">
	    <internal token="text"/>
	    <external opt="optional" type="char *"/>
	    <comment>service name</comment>
	</entry>
	<entry id="limit">
	    <internal token="text"/>
	    <external opt="required" type="char *"/>
	    <comment>limit value</comment>
	</entry>
	<entry id="return">
	    <internal token="return"/>
	    <external opt="none"/>
	</entry>
    </event>

    <event id="AUE_inetd_failrate" header="0" idNo="37" omit="JNI">
    	<title>inetd</title>
	<program>/usr/sbin/inetd</program>
	<entry id="subject">
	    <internal token="subject"/>
	    <external opt="none"/>
	</entry>
	<entry id="service_name">
	    <internal token="text"/>
	    <external opt="optional" type="char *"/>
	    <comment>service name</comment>
	</entry>
	<entry id="values">
	    <internal token="text"/>
	    <external opt="required" type="char *"/>
	    <comment>limit value, interval</comment>
	</entry>
	<entry id="return">
	    <internal token="return"/>
	    <external opt="none"/>
	</entry>
    </event>

    <event id="AUE_zone_state" header="0" idNo="33" omit="JNI">
	<entry id="subject">
	    <internal token="subject"/>
	    <external opt="none"/>
	</entry>
	<entry id="new_state">
	    <internal token="text"/>
	    <external opt="required" type="char *"/>
	    <comment>New zone state</comment>
	</entry>
	<entry id="zonename">
	    <internal token="zonename"/>
	    <external opt="required" type="char *"/>
	    <comment>zone name</comment>
	</entry>
	<entry id="return">
	    <internal token="return"/>
	    <external opt="none"/>
	</entry>
    </event>

    <event id="AUE_su_logout" instance_of="AUE_generic_basic"
	header="0" idNo="39" omit="JNI">
	<title>su</title>
	<program>/usr/bin/su</program>
	<see>su(1M)</see>
    </event>

    <event id="AUE_role_logout" instance_of="AUE_generic_basic"
	header="0" idNo="40" omit="JNI">
	<title>su</title>
	<program>/usr/bin/su</program>
	<see>su(1M)</see>
    </event>

    <event id="AUE_newgrp_login" header="0" idNo="41" omit="JNI">
    	<program>newgrp</program>
	<entry id="subject">
	    <internal token="subject"/>
	    <external opt="none"/>
	</entry>
	<entry id="groupname">
	    <internal  token="text"/>
	    <external opt="required"  type="char *"/>
	    <comment>group name</comment>
	</entry>
	<entry id="return">
	    <internal token="return"/>
	    <external opt="none"/>
	</entry>
    </event>

    <event id="AUE_generic_mountable" type="generic" omit="always">
	<!--

	User device mounting related functions

	-->
	<entry id="subject">
	    <internal token="subject"/>
	    <external opt="none"/>
	</entry>
	<entry id="auth_used">
	    <internal token="uauth"/>
	    <external opt="required" type="char *"/>
	    <comment>authorization used</comment>
	</entry>
	<entry id="mount_point">
	    <internal token="path"/>
	    <external opt="required" type="char *"/>
	    <comment>mount point</comment>
	</entry>
	<entry id="device">
	    <internal token="path"/>
	    <external opt="required" type="char *"/>
	    <comment>device</comment>
	</entry>
	<entry id="options">
	    <internal token="text"/>
	    <external opt="optional" type="char *"/>
	    <comment>options</comment>
	</entry>
	<entry id="return">
	    <internal token="return"/>
	    <external opt="none"/>
	</entry>
    </event>

    <event id="AUE_attach" instance_of="AUE_generic_mountable"
	header="0" idNo="42" omit="JNI">
	<program>hald</program>
    </event>
    <event id="AUE_detach" instance_of="AUE_generic_mountable"
	header="0" idNo="43" omit="JNI">
	<program>hald</program>
    </event>
    <event id="AUE_remove" header="0" idNo="44" omit="JNI">
	<program>hald</program>
	<entry id="subject">
	    <internal token="subject"/>
	    <external opt="none"/>
	</entry>
	<entry id="auth_used">
	    <internal token="uauth"/>
	    <external opt="required" type="char *"/>
	    <comment>authorization used</comment>
	</entry>
	<entry id="mount_point">
	    <internal token="path"/>
	    <external opt="optional" type="char *"/>
	    <comment>mount point</comment>
	</entry>
	<entry id="device">
	    <internal token="path"/>
	    <external opt="required" type="char *"/>
	    <comment>device</comment>
	</entry>
	<entry id="return">
	    <internal token="return"/>
	    <external opt="none"/>
	</entry>
    </event>

    <event id="AUE_pool_import" header="0" idNo="45" omit="JNI">
    	<program>hald</program>
	<entry id="subject">
	    <internal token="subject"/>
	    <external opt="none"/>
	</entry>
	<entry id="auth_used">
	    <internal token="uauth"/>
	    <external opt="required" type="char *"/>
	    <comment>authorization used</comment>
	</entry>
	<entry id="pool">
	    <internal token="text"/>
	    <external opt="required" type="char *"/>
	    <comment>pool</comment>
	</entry>
	<entry id="device">
	    <internal token="path"/>
	    <external opt="required" type="char *"/>
	    <comment>device</comment>
	</entry>
	<entry id="return">
	    <internal token="return"/>
	    <external opt="none"/>
	</entry>
    </event>
    <event id="AUE_pool_export" header="0" idNo="46" omit="JNI">
    	<program>hald</program>
	<entry id="subject">
	    <internal token="subject"/>
	    <external opt="none"/>
	</entry>
	<entry id="auth_used">
	    <internal token="uauth"/>
	    <external opt="required" type="char *"/>
	    <comment>authorization used</comment>
	</entry>
	<entry id="pool">
	    <internal token="text"/>
	    <external opt="required" type="char *"/>
	    <comment>pool</comment>
	</entry>
	<entry id="device">
	    <internal token="path"/>
	    <external opt="required" type="char *"/>
	    <comment>device</comment>
	</entry>
	<entry id="return">
	    <internal token="return"/>
	    <external opt="none"/>
	</entry>
    </event>

<!-- dladm security objected events -->
    <event id="AUE_dladm_generic" type="generic" omit="always">
	<entry id="subject">
	    <internal token="subject"/>
	    <external opt="none"/>
	</entry>
	<entry id="auth_used">
	    <internal token="uauth"/>
	    <external opt="required" type="char *"/>
	    <comment>authorization used</comment>
	</entry>
	<entry id="obj_class">
	    <internal token="text"/>
	    <external opt="required" type="char *"/>
	    <comment>object class name</comment>
	</entry>
	<entry id="obj_name">
	    <internal token="text"/>
	    <external opt="required" type="char *"/>
	    <comment>object name</comment>
	</entry>
	<entry id="return">
	    <internal token="return"/>
	    <external opt="none"/>
	</entry>
    </event>

    <event id="AUE_dladm_create_secobj" instance_of="AUE_dladm_generic"
	header="0" idNo="47" omit="JNI">
	<title>create wifi security object</title>
	<program>/usr/sbin/dladm</program>
	<see>dladm(1M)</see>
    </event>
    <event id="AUE_dladm_delete_secobj" instance_of="AUE_dladm_generic"
	header="0" idNo="48" omit="JNI">
	<title>delete wifi security object</title>
	<program>/usr/sbin/dladm</program>
	<see>dladm(1M)</see>
    </event>

<!-- Trusted eXtensions (TX) events -->

    <!-- labeld events -->
    <event id="AUE_file_relabel" header="0" idNo="49" omit="JNI">
    	<title>relabel file from one zone to another</title>
	<program>setlabel(1)</program>
	<see>setflabel(3TSOL)</see>
	<entry id="subject">
	    <internal token="subject"/>
	    <external opt="none"/>
	</entry>
	<entry id="auth_used">
	    <internal token="uauth"/>
	    <external opt="required" type="char *"/>
	    <comment>authorization used</comment>
	</entry>
	<entry id="file">
	    <internal token="path"/>
	    <external opt="required" type="char *"/>
	    <comment>file relabeled</comment>
	</entry>
	<entry id="src_label">
	    <internal token="label"/>
	    <external opt="required" type="m_label_t *"/>
	    <comment>original label</comment>
	</entry>
	<entry id="dst_label">
	    <internal token="label"/>
	    <external opt="required" type="m_label_t *"/>
	    <comment>new label</comment>
	</entry>
	<entry id="return">
	    <internal token="return"/>
	    <external opt="none"/>
	</entry>
    </event>

    <event id="AUE_file_copy" header="0" idNo="50" omit="JNI">
    	<title>copy file to another zone</title>
	<program>dtfile(1X)</program>
	<entry id="subject">
	    <internal token="subject"/>
	    <external opt="none"/>
	</entry>
	<entry id="auth_used">
	    <internal token="uauth"/>
	    <external opt="required" type="char *"/>
	    <comment>authorization used</comment>
	</entry>
	<entry id="src_file">
	    <internal token="path"/>
	    <external opt="required" type="char *"/>
	    <comment>source file</comment>
	</entry>
	<entry id="src_label">
	    <internal token="label"/>
	    <external opt="required" type="m_label_t *"/>
	    <comment>source label</comment>
	</entry>
	<entry id="dst_file">
	    <internal token="path"/>
	    <external opt="required" type="char *"/>
	    <comment>destination directory</comment>
	</entry>
	<entry id="dst_label">
	    <internal token="label"/>
	    <external opt="required" type="m_label_t *"/>
	    <comment>destination label</comment>
	</entry>
	<entry id="return">
	    <internal token="return"/>
	    <external opt="none"/>
	</entry>
    </event>

    <!-- uadmin(1m) events -->
    <event id="AUE_uadmin_generic" type="generic" omit="always">
	<entry id="subject">
	    <internal token="subject"/>
	    <external opt="none"/>
	</entry>
	<entry id="fcn">
	    <internal token="text"/>
	    <external opt="required" type="msg uadmin_fcn"/>
	    <comment>next action</comment>
	</entry>
	<entry id="mdep">
	    <internal token="text"/>
	    <external opt="optional" type="char *"/>
	    <comment>machine dependent argument</comment>
	</entry>
	<entry id="return">
	    <internal token="return"/>
	    <external opt="none"/>
	</entry>
    </event>
    <event id="AUE_uadmin_generic_fcn" type="generic" omit="always">
	<entry id="subject">
	    <internal token="subject"/>
	    <external opt="none"/>
	</entry>
	<entry id="fcn">
	    <internal token="text"/>
	    <external opt="required" type="msg uadmin_fcn"/>
	    <comment>next action</comment>
	</entry>
	<entry id="return">
	    <internal token="return"/>
	    <external opt="none"/>
	</entry>
    </event>
    <event id="AUE_uadmin_shutdown" instance_of="AUE_uadmin_generic"
        header="0" idNo="51" omit="JNI">
    	<title>uadmin shutdown</title>
	<program>/sbin/uadmin</program>
	<program>/usr/sbin/uadmin</program>
	<see>uadmin(1M)</see>
    </event>
    <event id="AUE_uadmin_reboot" instance_of="AUE_uadmin_generic"
        header="0" idNo="52" omit="JNI">
    	<title>uadmin reboot</title>
	<program>/sbin/uadmin</program>
	<program>/usr/sbin/uadmin</program>
	<see>uadmin(1M)</see>
    </event>
    <event id="AUE_uadmin_dump" instance_of="AUE_uadmin_generic"
        header="0" idNo="53" omit="JNI">
    	<title>uadmin dump</title>
	<program>/sbin/uadmin</program>
	<program>/usr/sbin/uadmin</program>
	<see>uadmin(1M)</see>
    </event>
    <event id="AUE_uadmin_freeze" instance_of="AUE_uadmin_generic"
        header="0" idNo="54" omit="JNI">
    	<title>uadmin freeze</title>
	<program>/sbin/uadmin</program>
	<program>/usr/sbin/uadmin</program>
	<see>uadmin(1M)</see>
    </event>
    <event id="AUE_uadmin_remount" header="0" idNo="55" omit="JNI">
    	<title>uadmin remount</title>
	<program>/sbin/uadmin</program>
	<program>/usr/sbin/uadmin</program>
	<see>uadmin(1M)</see>
	<entry id="subject">
	    <internal token="subject"/>
	    <external opt="none"/>
	</entry>
	<entry id="return">
	    <internal token="return"/>
	    <external opt="none"/>
	</entry>
    </event>
    <!-- uadmin ftrace and swapctl are not documented in uadmin(2) -->
    <event id="AUE_uadmin_ftrace" instance_of="AUE_uadmin_generic_fcn"
        header="0" idNo="56" omit="JNI">
    	<title>uadmin ftrace</title>
	<program>/sbin/uadmin</program>
	<program>/usr/sbin/uadmin</program>
	<see>uadmin(1M)</see>
    </event>
    <event id="AUE_uadmin_swapctl" instance_of="AUE_uadmin_generic_fcn"
        header="0" idNo="57" omit="JNI">
    	<title>uadmin swapctl</title>
	<program>/sbin/uadmin</program>
	<program>/usr/sbin/uadmin</program>
	<see>uadmin(1M)</see>
    </event>

<!-- smbd service event; smbd session setup -->
    <event id="AUE_smbd_session" header="0" idNo="58" omit="JNI">
	<title>smbd</title>
	<program>/usr/lib/smbsrv/smbd</program>
	<entry id="subject">
	    <internal token="subject"/>
	    <external opt="none"/>
	</entry>
	<entry id="domain">
	    <internal token="text"/>
	    <external opt="required" type="char*"/>
	<comment>domain</comment>
	</entry>
	<entry id="username">
	    <internal token="text"/>
	    <external opt="required" type="char*"/>
	<comment>username</comment>
	</entry>
	<entry id="sid">
	    <internal token="text"/>
	    <external opt="optional" type="char*"/>
	<comment>sid</comment>
	</entry>
	<entry id="return">
	    <internal token="return"/>
	    <external opt="none"/>
	</entry>
    </event>

<!-- smbd service event; smbd session logoff -->
    <event id="AUE_smbd_logoff" header="0" idNo="59" omit="JNI">
	<title>smbd</title>
	<program>/usr/lib/smbsrv/smbd</program>
	<entry id="subject">
	    <internal token="subject"/>
	    <external opt="none"/>
	</entry>
	<entry id="domain">
	    <internal token="text"/>
	    <external opt="required" type="char*"/>
	<comment>domain</comment>
	</entry>
	<entry id="username">
	    <internal token="text"/>
	    <external opt="required" type="char*"/>
	<comment>username</comment>
	</entry>
	<entry id="return">
	    <internal token="return"/>
	    <external opt="none"/>
	</entry>
    </event>

<!-- vscan service event; infected file detected -->
    <event id="AUE_vscan_quarantine" header="0" idNo="60" omit="JNI">
    	<title>VSCAN: quarantine infected file</title>
	<program>/usr/lib/vscan/vscand</program>
	<see>vscand(1M), ICAP RFC 3507 (Extensions)</see>
	<entry id="subject">
	    <internal token="subject"/>
	    <external opt="none"/>
	</entry>
	<entry id="file">
	    <internal token="path"/>
	    <external opt="required" type="char*"/>
	    <comment>infected file</comment>
	</entry>
	<entry id="violations,nviolations">
	    <internal token="text"/>
	    <external opt="optional" type="char**,int"/>
	    <comment>ID - threat description</comment>
	</entry>
	<entry id="return">
	    <internal token="return"/>
	    <external opt="none"/>
	</entry>
    </event>


<!-- add new events here with the next higher idNo -->
<!-- Highest idNo is 60, so next is 61, then fix this comment -->
<!-- end of C Only events -->


<!--
     token definitions are partially implemented.  All they do for now
     is create a list of defined token names.  In the future they may
     become a way of describing token structure.
-->

    <token id="acl">
    </token>
    <token id="arbitrary">
    </token>
    <token id="arg">
    </token>
    <token id="attr">
    </token>
    <token id="command">
    </token>
    <token id="command_1">
    </token>
    <token id="date">
    </token>
    <token id="exec_args">
    </token>
    <token id="exec_env">
    </token>
    <token id="exit">
    </token>
    <token id="file">
    </token>
    <token id="fmri">
    </token>
    <token id="groups">
    </token>
    <token id="in_addr">
    </token>
    <token id="ipc">
    </token>
    <token id="ipc_perm">
    </token>
    <token id="label">
    </token>
    <token id="newgroups">
    </token>
    <token id="opaque">
    </token>
    <token id="path">
    </token>
    <!-- pseudo token; path list generates 0 or more path tokens -->
    <token id="path_list">
    </token>
    <token id="tid">
    </token>

    <!--
	privilege token is implemented as one of the pseudo tokens
	priv_limit, priv_effective, or priv_inherit

    <token id="privilege">
    </token>
    -->
    <token id="priv_effective">
    </token>
    <token id="priv_inherit">
    </token>
    <token id="priv_limit">
    </token>
    <token id="process">
    </token>
    <token id="return">
    </token>
    <token id="seq">
    </token>
    <token id="socket">
    </token>
    <token id="socket-inet">
    </token>
    <token id="subject">
    </token>
    <token id="text">
    </token>
    <token id="uauth">
    </token>
    <token id="zonename">
    </token>

<!--
    error value list for return values with success/fail code of fail.
    These values start at 1000 so praudit can tell the difference
    between the libbsm/common/audit_*.c broken error values and
    the new adt_ error value list.  It is public so that praudit
    can find it.

    praudit outputs "failure" %s" for these strings, so there is
    no need to use words such as "failed" in the message.

    ** Add to the end only to maintain validity across versions of
    the audit log. **
-->

    <msg_list id="fail_value" header="0" start="1000" public="true">
	<msg id="PW_ATTR">Attribute update</msg>
	<msg id="PW">Password update</msg>
	<msg id="USERNAME">bad username</msg>
	<msg id="AUTH">authorization failed</msg>
	<msg id="UID">bad uid</msg>
	<msg id="UNKNOWN">unknown failure</msg>
	<msg id="EXPIRED">password expired</msg>
	<msg id="ACCOUNT_LOCKED">Account is locked</msg>
	<msg id="BAD_DIALUP">Bad dial up</msg>
	<msg id="BAD_ID">Invalid ID</msg>
	<msg id="BAD_PW">Invalid password</msg>
	<msg id="CONSOLE">Not on console</msg>
	<msg id="MAX_TRIES">Too many failed attempts</msg>
	<msg id="PROTOCOL_FAILURE">Protocol failure</msg>
	<msg id="EXCLUDED_USER">Excluded user</msg>
	<msg id="ANON_USER">No anonymous</msg>
	<msg id="BAD_CMD">Invalid command</msg>
	<msg id="BAD_TTY">Standard input not a tty line</msg>
	<msg id="PROGRAM">Program failure</msg>
	<msg id="CHDIR_FAILED">chdir to home directory</msg>
	<msg id="INPUT_OVERFLOW">Input line too long.</msg>
	<msg id="DEVICE_PERM">login device override</msg>
	<msg id="AUTH_BYPASS">authorization bypass</msg>
	<msg id="LOGIN_DISABLED">login disabled</msg>
    </msg_list>

<!--
	The following empty list is used for PAM errors; the "start"
	value is used by praudit to know to use the PAM infrastructure
	for generating error strings
-->
    <msg_list id="fail_pam" header="0" start="2000" public="true">
    </msg_list>

<!--
     This is still in use by SMC.  See AUE_generic_login.  When
     either SMC is fixed to stop using this, or SMC goes away.
     REMOVE this stuff and the corresponding AUE_generic_login
     message field.

     Message list for the various authentication events, such
     as AUE_login and AUE_admin_authenticate.  Add new entries
     at the end.  The order of msg_list entries and the order
     of msg entries both affect the names in adt.h and the value
     of the associated enumerated types.

     Each of these messages except NO_MSG is also in the failure_attribute
     list; the difference is that the messages below use a text token
     in the audit record, while the failure_attribute messages are
     associated with the return value of the return token.

     This list is deprecated; please don't use text tokens for error
     messages.
-->

    <msg_list id="login_text" header="0" deprecated="true">
	<msg id="NO_MSG"></msg>
	<msg id="ACCOUNT_LOCKED">Account is locked</msg>
	<msg id="BAD_DIALUP">Bad dial up</msg>
	<msg id="BAD_ID">Invalid ID</msg>
	<msg id="BAD_PW">Invalid password</msg>
	<msg id="CONSOLE">Not on console</msg>
	<msg id="MAX_TRIES">Too many failed attempts</msg>
	<msg id="PROTOCOL_FAILURE">Protocol failure</msg>
	<msg id="EXCLUDED_USER">Excluded user</msg>
	<msg id="ANON_USER">No anonymous</msg>
    </msg_list>

<!-- msg list for uadmin(1m) fcn argument (next action, see uadmin(2)) -->
    <msg_list id="uadmin_fcn" header="0" start="3000" public="true">
    	<msg id="AD_HALT">Halt the processor(s)</msg>
	<msg id="AD_POWEROFF">Halt the processor(s) and turn off the power</msg>
	<msg id="AD_BOOT">Reboot the system using the kernel file</msg>
	<msg id="AD_IBOOT">Interactive reboot</msg>
	<msg id="AD_SUSPEND_TO_DISK">Save the system state to the state file</msg>
	<msg id="AD_CHECK_SUSPEND_TO_DISK">Check if system supports suspend to disk</msg>
	<msg id="AD_FORCE">Force suspend to disk even when threads of user
	applications are not suspendable</msg>
	<msg id="AD_SUSPEND_TO_RAM">Save the system state to memory</msg>
	<msg id="AD_CHECK_SUSPEND_TO_RAM">Check if system supports suspend to memory</msg>
	<msg id="AD_SBOOT">Single-user reboot</msg>
	<msg id="AD_SIBOOT">Single-user interactive reboot</msg>
	<msg id="AD_NOSYNC">Do not sync filesystems on next A_DUMP</msg>
	<msg id="AD_REUSEINIT">Prepare for AD_REUSABLE</msg>
	<msg id="AD_REUSABLE">Create reusable statefile</msg>
	<msg id="AD_REUSEFINI">Revert to normal CPR mode (not reusable)</msg>
	<msg id="AD_FTRACE_START">ftrace start</msg>
	<msg id="AD_FTRACE_STOP">ftrace stop</msg>
    </msg_list>
</specification>