1185573Srwatson/*- 2186647Srwatson * Copyright (c) 2004-2008 Apple Inc. 3155131Srwatson * All rights reserved. 4155131Srwatson * 5155131Srwatson * Redistribution and use in source and binary forms, with or without 6155131Srwatson * modification, are permitted provided that the following conditions 7155131Srwatson * are met: 8155131Srwatson * 1. Redistributions of source code must retain the above copyright 9155131Srwatson * notice, this list of conditions and the following disclaimer. 10155131Srwatson * 2. Redistributions in binary form must reproduce the above copyright 11155131Srwatson * notice, this list of conditions and the following disclaimer in the 12155131Srwatson * documentation and/or other materials provided with the distribution. 13185573Srwatson * 3. Neither the name of Apple Inc. ("Apple") nor the names of 14155131Srwatson * its contributors may be used to endorse or promote products derived 15155131Srwatson * from this software without specific prior written permission. 16155131Srwatson * 17155131Srwatson * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND 18155131Srwatson * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19155131Srwatson * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20155131Srwatson * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR 21155131Srwatson * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22155131Srwatson * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23155131Srwatson * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24155131Srwatson * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 25155131Srwatson * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING 26155131Srwatson * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 27155131Srwatson * POSSIBILITY OF SUCH DAMAGE. 28155131Srwatson * 29191273Srwatson * $P4: //depot/projects/trustedbsd/openbsm/bsm/audit_uevents.h#11 $ 30155131Srwatson */ 31155131Srwatson 32155131Srwatson#ifndef _BSM_AUDIT_UEVENTS_H_ 33155131Srwatson#define _BSM_AUDIT_UEVENTS_H_ 34155131Srwatson 35186647Srwatson/* 36186647Srwatson * Solaris userspace events. 37155131Srwatson */ 38155131Srwatson#define AUE_at_create 6144 39155131Srwatson#define AUE_at_delete 6145 40155131Srwatson#define AUE_at_perm 6146 41155131Srwatson#define AUE_cron_invoke 6147 42155131Srwatson#define AUE_crontab_create 6148 43155131Srwatson#define AUE_crontab_delete 6149 44155131Srwatson#define AUE_crontab_perm 6150 45155131Srwatson#define AUE_inetd_connect 6151 46155131Srwatson#define AUE_login 6152 47155131Srwatson#define AUE_logout 6153 48155131Srwatson#define AUE_telnet 6154 49155131Srwatson#define AUE_rlogin 6155 50155131Srwatson#define AUE_mountd_mount 6156 51155131Srwatson#define AUE_mountd_umount 6157 52155131Srwatson#define AUE_rshd 6158 53155131Srwatson#define AUE_su 6159 54155131Srwatson#define AUE_halt 6160 55155131Srwatson#define AUE_reboot 6161 56155131Srwatson#define AUE_rexecd 6162 57155131Srwatson#define AUE_passwd 6163 58155131Srwatson#define AUE_rexd 6164 59155131Srwatson#define AUE_ftpd 6165 60155131Srwatson#define AUE_init 6166 61155131Srwatson#define AUE_uadmin 6167 62155131Srwatson#define AUE_shutdown 6168 63155131Srwatson#define AUE_poweroff 6169 64155131Srwatson#define AUE_crontab_mod 6170 65186647Srwatson#define AUE_ftpd_logout 6171 66186647Srwatson#define AUE_ssh 6172 67186647Srwatson#define AUE_role_login 6173 68186647Srwatson#define AUE_prof_cmd 6180 69186647Srwatson#define AUE_filesystem_add 6181 70186647Srwatson#define AUE_filesystem_delete 6182 71186647Srwatson#define AUE_filesystem_modify 6183 72155131Srwatson#define AUE_allocate_succ 6200 73155131Srwatson#define AUE_allocate_fail 6201 74155131Srwatson#define AUE_deallocate_succ 6202 75155131Srwatson#define AUE_deallocate_fail 6203 76155131Srwatson#define AUE_listdevice_succ 6205 77155131Srwatson#define AUE_listdevice_fail 6206 78155131Srwatson#define AUE_create_user 6207 79155131Srwatson#define AUE_modify_user 6208 80155131Srwatson#define AUE_delete_user 6209 81155131Srwatson#define AUE_disable_user 6210 82155131Srwatson#define AUE_enable_user 6211 83186647Srwatson#define AUE_newgrp_login 6212 84186647Srwatson#define AUE_admin_authentication 6213 85186647Srwatson#define AUE_kadmind_auth 6214 86186647Srwatson#define AUE_kadmind_unauth 6215 87186647Srwatson#define AUE_krb5kdc_as_req 6216 88186647Srwatson#define AUE_krb5kdc_tgs_req 6217 89186647Srwatson#define AUE_krb5kdc_tgs_req_2ndtktmm 6218 90186647Srwatson#define AUE_krb5kdc_tgs_req_alt_tgt 6219 91186647Srwatson 92186647Srwatson/* 93186647Srwatson * Historic Darwin use of the low event numbering space, which collided with 94186647Srwatson * the Solaris event space. Now obsoleted and new, higher, event numbers 95186647Srwatson * assigned to make it easier to interpret Solaris events using the OpenBSM 96186647Srwatson * tools. 97186647Srwatson */ 98186647Srwatson#define AUE_DARWIN_audit_startup 6171 99186647Srwatson#define AUE_DARWIN_audit_shutdown 6172 100186647Srwatson#define AUE_DARWIN_sudo 6300 101186647Srwatson#define AUE_DARWIN_modify_password 6501 102186647Srwatson#define AUE_DARWIN_create_group 6511 103186647Srwatson#define AUE_DARWIN_delete_group 6512 104186647Srwatson#define AUE_DARWIN_modify_group 6513 105186647Srwatson#define AUE_DARWIN_add_to_group 6514 106186647Srwatson#define AUE_DARWIN_remove_from_group 6515 107186647Srwatson#define AUE_DARWIN_revoke_obj 6521 108186647Srwatson#define AUE_DARWIN_lw_login 6600 109186647Srwatson#define AUE_DARWIN_lw_logout 6601 110186647Srwatson#define AUE_DARWIN_auth_user 7000 111186647Srwatson#define AUE_DARWIN_ssconn 7001 112186647Srwatson#define AUE_DARWIN_ssauthorize 7002 113186647Srwatson#define AUE_DARWIN_ssauthint 7003 114186647Srwatson 115186647Srwatson/* 116186647Srwatson * Historic/third-party appliation allocations of event idenfiers. 117186647Srwatson */ 118155131Srwatson#define AUE_openssh 32800 119155131Srwatson 120186647Srwatson/* 121186647Srwatson * OpenBSM-managed application event space. 122186647Srwatson */ 123186647Srwatson#define AUE_audit_startup 45000 /* Darwin-specific. */ 124186647Srwatson#define AUE_audit_shutdown 45001 /* Darwin-specific. */ 125186647Srwatson#define AUE_modify_password 45014 /* Darwin-specific. */ 126186647Srwatson#define AUE_create_group 45015 /* Darwin-specific. */ 127186647Srwatson#define AUE_delete_group 45016 /* Darwin-specific. */ 128186647Srwatson#define AUE_modify_group 45017 /* Darwin-specific. */ 129186647Srwatson#define AUE_add_to_group 45018 /* Darwin-specific. */ 130186647Srwatson#define AUE_remove_from_group 45019 /* Darwin-specific. */ 131186647Srwatson#define AUE_revoke_obj 45020 /* Darwin-specific. */ 132186647Srwatson#define AUE_lw_login 45021 /* Darwin-specific. */ 133186647Srwatson#define AUE_lw_logout 45022 /* Darwin-specific. */ 134186647Srwatson#define AUE_auth_user 45023 /* Darwin-specific. */ 135186647Srwatson#define AUE_ssconn 45024 /* Darwin-specific. */ 136186647Srwatson#define AUE_ssauthorize 45025 /* Darwin-specific. */ 137186647Srwatson#define AUE_ssauthint 45026 /* Darwin-specific. */ 138186647Srwatson#define AUE_calife 45027 /* OpenBSM-allocated. */ 139186647Srwatson#define AUE_sudo 45028 /* OpenBSM-allocated. */ 140186647Srwatson#define AUE_audit_recovery 45029 /* OpenBSM-allocated. */ 141191273Srwatson#define AUE_ssauthmech 45030 /* Darwin-specific. */ 142186647Srwatson 143155131Srwatson#endif /* !_BSM_AUDIT_UEVENTS_H_ */ 144