| audit_event (189279) | audit_event (191273) |
|---|---|
| 1# | 1# |
| 2# $P4: //depot/projects/trustedbsd/openbsm/etc/audit_event#36 $ 3# $FreeBSD: head/contrib/openbsm/etc/audit_event 189279 2009-03-02 13:29:18Z rwatson $ | 2# $P4: //depot/projects/trustedbsd/openbsm/etc/audit_event#39 $ 3# $FreeBSD: head/contrib/openbsm/etc/audit_event 191273 2009-04-19 16:17:13Z rwatson $ |
| 4# 5# The mapping between event identifiers and values is also hard-coded in 6# audit_kevents.h and audit_uevents.h, so changes must occur in both places, 7# and programs, such as the kernel, may need to be recompiled to recognize 8# those changes. It is advisable not to change the numbering or naming of 9# kernel audit events. 10# 11# Allocation of BSM event identifier ranges: --- 303 unchanged lines hidden (view full) --- 315316:AUE_DARWIN_POLL:poll(2):no 316317:AUE_DARWIN_SOCKETPAIR:socketpair(2):nt 317318:AUE_DARWIN_FUTIMES:futimes(2):fm 318319:AUE_DARWIN_SETSID:setsid(2):pc 319320:AUE_DARWIN_SETPRIVEXEC:setprivexec(2):pc 320321:AUE_DARWIN_NFSSVC:nfssvc(2):ad 321322:AUE_DARWIN_GETFH:getfh(2):fa 322323:AUE_DARWIN_QUOTACTL:quotactl(2):ad | 4# 5# The mapping between event identifiers and values is also hard-coded in 6# audit_kevents.h and audit_uevents.h, so changes must occur in both places, 7# and programs, such as the kernel, may need to be recompiled to recognize 8# those changes. It is advisable not to change the numbering or naming of 9# kernel audit events. 10# 11# Allocation of BSM event identifier ranges: --- 303 unchanged lines hidden (view full) --- 315316:AUE_DARWIN_POLL:poll(2):no 316317:AUE_DARWIN_SOCKETPAIR:socketpair(2):nt 317318:AUE_DARWIN_FUTIMES:futimes(2):fm 318319:AUE_DARWIN_SETSID:setsid(2):pc 319320:AUE_DARWIN_SETPRIVEXEC:setprivexec(2):pc 320321:AUE_DARWIN_NFSSVC:nfssvc(2):ad 321322:AUE_DARWIN_GETFH:getfh(2):fa 322323:AUE_DARWIN_QUOTACTL:quotactl(2):ad |
| 323324:AUE_DARWIN_ADDPROFILE:system call:pc 324325:AUE_DARWIN_KDEBUGTRACE:system call:pc | 323324:AUE_DARWIN_ADDPROFILE:add_profil():pc 324325:AUE_DARWIN_KDEBUGTRACE:kdebug_trace():pc |
| 325326:AUE_DARWIN_FSTAT:fstat(2):fa 326327:AUE_DARWIN_FPATHCONF:fpathconf(2):fa 327328:AUE_DARWIN_GETDIRENTRIES:getdirentries(2):no 328329:AUE_DARWIN_TRUNCATE:truncate(2):fw 329330:AUE_DARWIN_FTRUNCATE:ftruncate(2):fw 330331:AUE_DARWIN_SYSCTL:sysctl(3):ad 331332:AUE_DARWIN_MLOCK:mlock(2):pc 332333:AUE_DARWIN_MUNLOCK:munlock(2):pc --- 38 unchanged lines hidden (view full) --- 37143008:AUE_OPENBSM_REVOKE:revoke(2):cl 37243009:AUE_UMASK:umask(2):pc 37343010:AUE_MPROTECT:mprotect(2):fm 37443011:AUE_MKFIFO:mkfifo(2):fc 37543012:AUE_POLL:poll(2):no 37643013:AUE_FUTIMES:futimes(2):fm 37743014:AUE_SETSID:setsid(2):pc 37843015:AUE_SETPRIVEXEC:setprivexec(2):pc | 325326:AUE_DARWIN_FSTAT:fstat(2):fa 326327:AUE_DARWIN_FPATHCONF:fpathconf(2):fa 327328:AUE_DARWIN_GETDIRENTRIES:getdirentries(2):no 328329:AUE_DARWIN_TRUNCATE:truncate(2):fw 329330:AUE_DARWIN_FTRUNCATE:ftruncate(2):fw 330331:AUE_DARWIN_SYSCTL:sysctl(3):ad 331332:AUE_DARWIN_MLOCK:mlock(2):pc 332333:AUE_DARWIN_MUNLOCK:munlock(2):pc --- 38 unchanged lines hidden (view full) --- 37143008:AUE_OPENBSM_REVOKE:revoke(2):cl 37243009:AUE_UMASK:umask(2):pc 37343010:AUE_MPROTECT:mprotect(2):fm 37443011:AUE_MKFIFO:mkfifo(2):fc 37543012:AUE_POLL:poll(2):no 37643013:AUE_FUTIMES:futimes(2):fm 37743014:AUE_SETSID:setsid(2):pc 37843015:AUE_SETPRIVEXEC:setprivexec(2):pc |
| 37943016:AUE_ADDPROFILE:system call:pc 38043017:AUE_KDEBUGTRACE:system call:pc | 37943016:AUE_ADDPROFILE:add_profil():pc 38043017:AUE_KDEBUGTRACE:kdebug_trace():pc |
| 38143018:AUE_OPENBSM_FSTAT:fstat(2):fa 38243019:AUE_FPATHCONF:fpathconf(2):fa 38343020:AUE_GETDIRENTRIES:getdirentries(2):no 38443021:AUE_SYSCTL:sysctl(3):ot 38543022:AUE_MLOCK:mlock(2):pc 38643023:AUE_MUNLOCK:munlock(2):pc 38743024:AUE_UNDELETE:undelete(2):fm 38843025:AUE_GETATTRLIST:getattrlist():fa --- 160 unchanged lines hidden (view full) --- 54943186:AUE_CAP_NEW:cap_new(2):fm 55043187:AUE_CAP_GETRIGHTS:cap_getrights(2):fm 55143188:AUE_CAP_ENTER:cap_enter(2):pc 55243189:AUE_CAP_GETMODE:cap_getmode(2):pc 55343190:AUE_POSIX_SPAWN:posix_spawn(2):pc 55443191:AUE_FSGETPATH:fsgetpath(2):ot 55543192:AUE_PREAD:pread(2):no 55643193:AUE_PWRITE:pwrite(2):no | 38143018:AUE_OPENBSM_FSTAT:fstat(2):fa 38243019:AUE_FPATHCONF:fpathconf(2):fa 38343020:AUE_GETDIRENTRIES:getdirentries(2):no 38443021:AUE_SYSCTL:sysctl(3):ot 38543022:AUE_MLOCK:mlock(2):pc 38643023:AUE_MUNLOCK:munlock(2):pc 38743024:AUE_UNDELETE:undelete(2):fm 38843025:AUE_GETATTRLIST:getattrlist():fa --- 160 unchanged lines hidden (view full) --- 54943186:AUE_CAP_NEW:cap_new(2):fm 55043187:AUE_CAP_GETRIGHTS:cap_getrights(2):fm 55143188:AUE_CAP_ENTER:cap_enter(2):pc 55243189:AUE_CAP_GETMODE:cap_getmode(2):pc 55343190:AUE_POSIX_SPAWN:posix_spawn(2):pc 55443191:AUE_FSGETPATH:fsgetpath(2):ot 55543192:AUE_PREAD:pread(2):no 55643193:AUE_PWRITE:pwrite(2):no |
| 55743194:AUE_FSCTL:fsctl():fm 55843195:AUE_FFSCTL:ffsctl():fm |
|
| 557# 558# Solaris userspace events. 559# 5606144:AUE_at_create:at-create atjob:ad 5616145:AUE_at_delete:at-delete atjob (at or atrm):ad 5626146:AUE_at_perm:at-permission:no 5636147:AUE_cron_invoke:cron-invoke:ad 5646148:AUE_crontab_create:crontab-crontab created:ad --- 57 unchanged lines hidden (view full) --- 6226511:AUE_DARWIN_create_group:create group:ad 6236512:AUE_DARWIN_delete_group:delete group:ad 6246513:AUE_DARWIN_modify_group:modify group:ad 6256514:AUE_DARWIN_add_to_group:add to group:ad 6266515:AUE_DARWIN_remove_from_group:remove from group:ad 6276521:AUE_DARWIN_revoke_obj:revoke object priv:fm 6286600:AUE_DARWIN_lw_login:loginwindow login:lo 6296601:AUE_DARWIN_lw_logout:loginwindow logout:lo | 559# 560# Solaris userspace events. 561# 5626144:AUE_at_create:at-create atjob:ad 5636145:AUE_at_delete:at-delete atjob (at or atrm):ad 5646146:AUE_at_perm:at-permission:no 5656147:AUE_cron_invoke:cron-invoke:ad 5666148:AUE_crontab_create:crontab-crontab created:ad --- 57 unchanged lines hidden (view full) --- 6246511:AUE_DARWIN_create_group:create group:ad 6256512:AUE_DARWIN_delete_group:delete group:ad 6266513:AUE_DARWIN_modify_group:modify group:ad 6276514:AUE_DARWIN_add_to_group:add to group:ad 6286515:AUE_DARWIN_remove_from_group:remove from group:ad 6296521:AUE_DARWIN_revoke_obj:revoke object priv:fm 6306600:AUE_DARWIN_lw_login:loginwindow login:lo 6316601:AUE_DARWIN_lw_logout:loginwindow logout:lo |
| 6307000:AUE_DARWIN_auth_user:user authentication:ad 6317001:AUE_DARWIN_ssconn:SecSrvr connection setup:ad 6327002:AUE_DARWIN_ssauthorize:SecSrvr AuthEngine:ad 6337003:AUE_DARWIN_ssauthint:SecSrvr authinternal mech:ad | 6327000:AUE_DARWIN_auth_user:user authentication:aa 6337001:AUE_DARWIN_ssconn:SecSrvr connection setup:aa 6347002:AUE_DARWIN_ssauthorize:SecSrvr AuthEngine:aa 6357003:AUE_DARWIN_ssauthint:SecSrvr authinternal mech:aa |
| 634# 635# Historic/third-party application allocations of event identifiers. 636# 63732800:AUE_openssh:OpenSSH login:lo 638# 639# OpenBSM-managed application event space. 640# 64145000:AUE_audit_startup:audit startup:ad 64245001:AUE_audit_shutdown:audit shutdown:ad 64345014:AUE_modify_password:modify password:ad 64445015:AUE_create_group:create group:ad 64545016:AUE_delete_group:delete group:ad 64645017:AUE_modify_group:modify group:ad 64745018:AUE_add_to_group:add to group:ad 64845019:AUE_remove_from_group:remove from group:ad 64945020:AUE_revoke_obj:revoke object priv:fm 65045021:AUE_lw_login:loginwindow login:lo 65145022:AUE_lw_logout:loginwindow logout:lo | 636# 637# Historic/third-party application allocations of event identifiers. 638# 63932800:AUE_openssh:OpenSSH login:lo 640# 641# OpenBSM-managed application event space. 642# 64345000:AUE_audit_startup:audit startup:ad 64445001:AUE_audit_shutdown:audit shutdown:ad 64545014:AUE_modify_password:modify password:ad 64645015:AUE_create_group:create group:ad 64745016:AUE_delete_group:delete group:ad 64845017:AUE_modify_group:modify group:ad 64945018:AUE_add_to_group:add to group:ad 65045019:AUE_remove_from_group:remove from group:ad 65145020:AUE_revoke_obj:revoke object priv:fm 65245021:AUE_lw_login:loginwindow login:lo 65345022:AUE_lw_logout:loginwindow logout:lo |
| 65245023:AUE_auth_user:user authentication:ad 65345024:AUE_ssconn:SecSrvr connection setup:ad 65445025:AUE_ssauthorize:SecSrvr AuthEngine:ad 65545026:AUE_ssauthint:SecSrvr authinternal mech:ad | 65445023:AUE_auth_user:user authentication:aa 65545024:AUE_ssconn:SecSrvr connection setup:aa 65645025:AUE_ssauthorize:SecSrvr AuthEngine:aa 65745026:AUE_ssauthint:SecSrvr authinternal mech:aa |
| 65645027:AUE_calife:Calife:ad | 65845027:AUE_calife:Calife:ad |
| 65745028:AUE_sudo:sudo(1):ad | 65945028:AUE_sudo:sudo(1):aa |
| 65845029:AUE_audit_recovery:audit crash recovery:ad | 66045029:AUE_audit_recovery:audit crash recovery:ad |
| 66145030:AUE_ssauthmech:SecSrvr AuthMechanism:aa |
|