audit_kevents.h revision 162508 
1/*
2 * Copyright (c) 2005 Apple Computer, Inc.
3 * All rights reserved.
4 *
5 * @APPLE_BSD_LICENSE_HEADER_START@
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 *
11 * 1.  Redistributions of source code must retain the above copyright
12 *     notice, this list of conditions and the following disclaimer.
13 * 2.  Redistributions in binary form must reproduce the above copyright
14 *     notice, this list of conditions and the following disclaimer in the
15 *     documentation and/or other materials provided with the distribution.
16 * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
17 *     its contributors may be used to endorse or promote products derived
18 *     from this software without specific prior written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
21 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
22 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
23 * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
24 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
25 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
27 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
28 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
29 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30 *
31 * @APPLE_BSD_LICENSE_HEADER_END@
32 *
33 * $P4: //depot/projects/trustedbsd/audit3/sys/bsm/audit_kevents.h#28 $
34 * $FreeBSD: head/sys/bsm/audit_kevents.h 162508 2006-09-21 07:27:02Z rwatson $
35 */
36
37#ifndef _BSM_AUDIT_KEVENTS_H_
38#define	_BSM_AUDIT_KEVENTS_H_
39
40/*
41 * Values marked as AUE_NULL are not required to be audited as per CAPP.
42 *
43 * Some conflicts exist in the assignment of name to event number mappings
44 * between BSM implementations.  In general, we prefer the OpenSolaris
45 * definition as we consider Solaris BSM to be authoritative.  _DARWIN_ has
46 * been inserted for the Darwin variants.  If necessary, other tags will be
47 * added in the future.
48 */
49#define	AUE_NULL		0
50#define	AUE_EXIT		1
51#define	AUE_FORK		2
52#define	AUE_OPEN		3
53#define	AUE_CREAT		4
54#define	AUE_LINK		5
55#define	AUE_UNLINK		6
56#define	AUE_DELETE		AUE_UNLINK
57#define	AUE_EXEC		7
58#define	AUE_CHDIR		8
59#define	AUE_MKNOD		9
60#define	AUE_CHMOD		10
61#define	AUE_CHOWN		11
62#define	AUE_UMOUNT		12
63#define	AUE_JUNK		13	/* Solaris-specific. */
64#define	AUE_ACCESS		14
65#define	AUE_CHECKUSERACCESS	AUE_ACCESS
66#define	AUE_KILL		15
67#define	AUE_STAT		16
68#define	AUE_LSTAT		17
69#define	AUE_ACCT		18
70#define	AUE_MCTL		19	/* Solaris-specific. */
71#define	AUE_REBOOT		20	/* XXX: Darwin conflict. */
72#define	AUE_SYMLINK		21
73#define	AUE_READLINK		22
74#define	AUE_EXECVE		23
75#define	AUE_CHROOT		24
76#define	AUE_VFORK		25
77#define	AUE_SETGROUPS		26
78#define	AUE_SETPGRP		27
79#define	AUE_SWAPON		28
80#define	AUE_SETHOSTNAME		29	/* XXX: Darwin conflict. */
81#define	AUE_FCNTL		30
82#define	AUE_SETPRIORITY		31	/* XXX: Darwin conflict. */
83#define	AUE_CONNECT		32
84#define	AUE_ACCEPT		33
85#define	AUE_BIND		34
86#define	AUE_SETSOCKOPT		35
87#define	AUE_VTRACE		36	/* Solaris-specific. */
88#define	AUE_SETTIMEOFDAY	37	/* XXX: Darwin conflict. */
89#define	AUE_FCHOWN		38
90#define	AUE_FCHMOD		39
91#define	AUE_SETREUID		40
92#define	AUE_SETREGID		41
93#define	AUE_RENAME		42
94#define	AUE_TRUNCATE		43	/* XXX: Darwin conflict. */
95#define	AUE_FTRUNCATE		44	/* XXX: Darwin conflict. */
96#define	AUE_FLOCK		45	/* XXX: Darwin conflict. */
97#define	AUE_SHUTDOWN		46
98#define	AUE_MKDIR		47
99#define	AUE_RMDIR		48
100#define	AUE_UTIMES		49
101#define	AUE_ADJTIME		50
102#define	AUE_SETRLIMIT		51
103#define	AUE_KILLPG		52
104#define	AUE_NFS_SVC		53	/* XXX: Darwin conflict. */
105#define	AUE_STATFS		54
106#define	AUE_FSTATFS		55
107#define	AUE_UNMOUNT		56	/* XXX: Darwin conflict. */
108#define	AUE_ASYNC_DAEMON	57
109#define	AUE_NFS_GETFH		58	/* XXX: Darwin conflict. */
110#define	AUE_SETDOMAINNAME	59
111#define	AUE_QUOTACTL		60	/* XXX: Darwin conflict. */
112#define	AUE_EXPORTFS		61
113#define	AUE_MOUNT		62
114#define	AUE_SEMSYS		63
115#define	AUE_MSGSYS		64
116#define	AUE_SHMSYS		65
117#define	AUE_BSMSYS		66	/* Solaris-specific. */
118#define	AUE_RFSSYS		67	/* Solaris-specific. */
119#define	AUE_FCHDIR		68
120#define	AUE_FCHROOT		69
121#define	AUE_VPIXSYS		70	/* Solaris-specific. */
122#define	AUE_PATHCONF		71
123#define	AUE_OPEN_R		72
124#define	AUE_OPEN_RC		73
125#define	AUE_OPEN_RT		74
126#define	AUE_OPEN_RTC		75
127#define	AUE_OPEN_W		76
128#define	AUE_OPEN_WC		77
129#define	AUE_OPEN_WT		78
130#define	AUE_OPEN_WTC		79
131#define	AUE_OPEN_RW		80
132#define	AUE_OPEN_RWC		81
133#define	AUE_OPEN_RWT		82
134#define	AUE_OPEN_RWTC		83
135#define	AUE_MSGCTL		84
136#define	AUE_MSGCTL_RMID		85
137#define	AUE_MSGCTL_SET		86
138#define	AUE_MSGCTL_STAT		87
139#define	AUE_MSGGET		88
140#define	AUE_MSGRCV		89
141#define	AUE_MSGSND		90
142#define	AUE_SHMCTL		91
143#define	AUE_SHMCTL_RMID		92
144#define	AUE_SHMCTL_SET		93
145#define	AUE_SHMCTL_STAT		94
146#define	AUE_SHMGET		95
147#define	AUE_SHMAT		96
148#define	AUE_SHMDT		97
149#define	AUE_SEMCTL		98
150#define	AUE_SEMCTL_RMID		99
151#define	AUE_SEMCTL_SET		100
152#define	AUE_SEMCTL_STAT		101
153#define	AUE_SEMCTL_GETNCNT	102
154#define	AUE_SEMCTL_GETPID	103
155#define	AUE_SEMCTL_GETVAL	104
156#define	AUE_SEMCTL_GETALL	105
157#define	AUE_SEMCTL_GETZCNT	106
158#define	AUE_SEMCTL_SETVAL	107
159#define	AUE_SEMCTL_SETALL	108
160#define	AUE_SEMGET		109
161#define	AUE_SEMOP		110
162#define	AUE_CORE		111	/* Solaris-specific, currently. */
163#define	AUE_CLOSE		112
164#define	AUE_SYSTEMBOOT		113
165#define	AUE_ASYNC_DAEMON_EXIT	114	/* Solaris-specific. */
166#define	AUE_NFSSVC_EXIT		115	/* Solaris-specific. */
167#define	AUE_WRITEL		128	/* Solaris-specific. */
168#define	AUE_WRITEVL		129	/* Solaris-specific. */
169#define	AUE_GETAUID		130
170#define	AUE_SETAUID		131
171#define	AUE_GETAUDIT		132
172#define	AUE_SETAUDIT		133
173#define	AUE_GETUSERAUDIT	134	/* Solaris-specific. */
174#define	AUE_SETUSERAUDIT	135	/* Solaris-specific. */
175#define	AUE_AUDITSVC		136	/* Solaris-specific. */
176#define	AUE_AUDITUSER		137	/* Solaris-specific. */
177#define	AUE_AUDITON		138
178#define	AUE_AUDITON_GTERMID	139	/* Solaris-specific. */
179#define	AUE_AUDITON_STERMID	140	/* Solaris-specific. */
180#define	AUE_AUDITON_GPOLICY	141
181#define	AUE_AUDITON_SPOLICY	142
182#define	AUE_AUDITON_GQCTRL	145
183#define	AUE_AUDITON_SQCTRL	146
184#define	AUE_GETKERNSTATE	147	/* Solaris-specific. */
185#define	AUE_SETKERNSTATE	148	/* Solaris-specific. */
186#define	AUE_GETPORTAUDIT	149	/* Solaris-specific. */
187#define	AUE_AUDISTAT		150	/* Solaris-specific. */
188#define	AUE_ENTERPROM		153	/* Solaris-specific. */
189#define	AUE_EXITPROM		154	/* Solaris-specific. */
190#define	AUE_IOCTL		158
191#define	AUE_SOCKET		183
192#define	AUE_SENDTO		184
193#define	AUE_PIPE		185
194#define	AUE_SOCKETPAIR		186	/* XXX: Darwin conflict. */
195#define	AUE_SEND		187
196#define	AUE_SENDMSG		188
197#define	AUE_RECV		189
198#define	AUE_RECVMSG		190
199#define	AUE_RECVFROM		191
200#define	AUE_READ		192
201#define	AUE_LSEEK		194
202#define	AUE_WRITE		195
203#define	AUE_WRITEV		196
204#define	AUE_NFS			197	/* Solaris-specific. */
205#define	AUE_READV		198
206					/* XXXRW: XXX Solaris old stat()? */
207#define	AUE_SETUID		200	/* XXXRW: Solaris old setuid? */
208#define	AUE_STIME		201	/* XXXRW: Solaris old stime? */
209#define	AUE_UTIME		202	/* XXXRW: Solaris old utime? */
210#define	AUE_NICE		203	/* XXXRW: Solaris old nice? */
211					/* XXXRW: Solaris old setpgrp? */
212#define	AUE_SETGID		205	/* XXXRW: Solaris old setgid? */
213					/* XXXRW: Solaris readl? */
214					/* XXXRW: Solaris readvl()? */
215#define	AUE_DUP2		209
216#define	AUE_MMAP		210
217#define	AUE_AUDIT		211
218#define	AUE_PRIOCNTLSYS		212
219#define	AUE_MUNMAP		213
220#define	AUE_SETEGID		214
221#define	AUE_SETEUID		215
222#define	AUE_PUTMSG		216
223#define	AUE_GETMSG		217	/* Solaris-specific. */
224#define	AUE_PUTPMSG		218	/* Solaris-specific. */
225#define	AUE_GETPMSG		219	/* Solaris-specific. */
226#define	AUE_AUDITSYS		220	/* Solaris-specific. */
227#define	AUE_AUDITON_GETKMASK	221
228#define	AUE_AUDITON_SETKMASK	222
229#define	AUE_AUDITON_GETCWD	223
230#define	AUE_AUDITON_GETCAR	224
231#define	AUE_AUDITON_GETSTAT	225
232#define	AUE_AUDITON_SETSTAT	226
233#define	AUE_AUDITON_SETUMASK	227
234#define	AUE_AUDITON_SETSMASK	228
235#define	AUE_AUDITON_GETCOND	229
236#define	AUE_AUDITON_SETCOND	230
237#define	AUE_AUDITON_GETCLASS	231
238#define	AUE_AUDITON_SETCLASS	232
239#define	AUE_UTSSYS		233	/* Solaris-specific. */
240#define	AUE_STATVFS		234
241#define	AUE_XSTAT		235
242#define	AUE_LXSTAT		236
243#define	AUE_LCHOWN		237
244#define	AUE_MEMCNTL		238	/* Solaris-specific. */
245#define	AUE_SYSINFO		239	/* Solaris-specific. */
246#define	AUE_XMKNOD		240	/* Solaris-specific. */
247#define	AUE_FORK1		241
248					/* XXXRW: Solaris modctl()? */
249#define	AUE_MODLOAD		243
250#define	AUE_MODUNLOAD		244
251#define	AUE_MODCONFIG		245	/* Solaris-specific. */
252#define	AUE_MODADDMAJ		246	/* Solaris-specific. */
253#define	AUE_SOCKACCEPT		247
254#define	AUE_SOCKCONNECT		248
255#define	AUE_SOCKSEND		249
256#define	AUE_SOCKRECEIVE		250
257#define	AUE_ACLSET		251
258#define	AUE_FACLSET		252
259#define	AUE_DOORFS_DOOR_CALL	254	/* Solaris-specific. */
260#define	AUE_DOORFS_DOOR_RETURN	255	/* Solaris-specific. */
261#define	AUE_DOORFS_DOOR_CREATE	256	/* Solaris-specific. */
262#define	AUE_DOORFS_DOOR_REVOKE	257	/* Solaris-specific. */
263#define	AUE_DOORFS_DOOR_INFO	258	/* Solaris-specific. */
264#define	AUE_DOORFS_DOOR_CRED	259	/* Solaris-specific. */
265#define	AUE_DOORFS_DOOR_BIND	260	/* Solaris-specific. */
266#define	AUE_DOORFS_DOOR_UNBIND	261	/* Solaris-specific. */
267#define	AUE_P_ONLINE		262	/* Solaris-specific. */
268#define	AUE_PROCESSOR_BIND	263	/* Solaris-specific. */
269#define	AUE_INST_SYNC		264	/* Solaris-specific. */
270#define	AUE_SOCK_CONFIG		265	/* Solaris-specific. */
271#define	AUE_SETAUDIT_ADDR	266
272#define	AUE_GETAUDIT_ADDR	267
273#define	AUE_CLOCK_SETTIME	287
274#define	AUE_NTP_ADJTIME		288
275
276/*
277 * Events added for Apple Darwin that potentially collide with future Solaris
278 * BSM events.  These are assigned AUE_DARWIN prefixes, and are deprecated in
279 * new trails.  Systems generating these events should switch to the new
280 * identifiers that avoid colliding with the Solaris identifier space.
281 */
282#define	AUE_DARWIN_GETFSSTAT	301
283#define	AUE_DARWIN_PTRACE	302
284#define	AUE_DARWIN_CHFLAGS	303
285#define	AUE_DARWIN_FCHFLAGS	304
286#define	AUE_DARWIN_PROFILE	305
287#define	AUE_DARWIN_KTRACE	306
288#define	AUE_DARWIN_SETLOGIN	307
289#define	AUE_DARWIN_REBOOT	308	/* XXX: See AUE_REBOOT. */
290#define	AUE_DARWIN_REVOKE	309
291#define	AUE_DARWIN_UMASK	310
292#define	AUE_DARWIN_MPROTECT	311
293#define	AUE_DARWIN_SETPRIORITY	312	/* XXX: See AUE_SETPRIORITY. */
294#define	AUE_DARWIN_SETTIMEOFDAY	313	/* XXX: See AUE_SETTIMEOFDAY. */
295#define	AUE_DARWIN_FLOCK	314	/* XXX: See AUE_FLOCK. */
296#define	AUE_DARWIN_MKFIFO	315
297#define	AUE_DARWIN_POLL		316
298#define	AUE_DARWIN_SOCKETPAIR	317	/* XXXRW: See AUE_SOCKETPAIR. */
299#define	AUE_DARWIN_FUTIMES	318
300#define	AUE_DARWIN_SETSID	319
301#define	AUE_DARWIN_SETPRIVEXEC	320	/* Darwin-specific. */
302#define	AUE_DARWIN_NFSSVC	321	/* XXX: See AUE_NFS_SVC. */
303#define	AUE_DARWIN_GETFH	322	/* XXX: See AUE_NFS_GETFH. */
304#define	AUE_DARWIN_QUOTACTL	323	/* XXX: See AUE_QUOTACTL. */
305#define	AUE_DARWIN_ADDPROFILE	324	/* Darwin-specific. */
306#define	AUE_DARWIN_KDEBUGTRACE	325	/* Darwin-specific. */
307#define	AUE_DARWIN_KDBUGTRACE	AUE_KDEBUGTRACE
308#define	AUE_DARWIN_FSTAT	326
309#define	AUE_DARWIN_FPATHCONF	327
310#define	AUE_DARWIN_GETDIRENTRIES	328
311#define	AUE_DARWIN_TRUNCATE	329	/* XXX: See AUE_TRUNCATE. */
312#define	AUE_DARWIN_FTRUNCATE	330	/* XXX: See AUE_FTRUNCATE. */
313#define	AUE_DARWIN_SYSCTL	331
314#define	AUE_DARWIN_MLOCK	332
315#define	AUE_DARWIN_MUNLOCK	333
316#define	AUE_DARWIN_UNDELETE	334
317#define	AUE_DARWIN_GETATTRLIST	335	/* Darwin-specific. */
318#define	AUE_DARWIN_SETATTRLIST	336	/* Darwin-specific. */
319#define	AUE_DARWIN_GETDIRENTRIESATTR	337	/* Darwin-specific. */
320#define	AUE_DARWIN_EXCHANGEDATA	338	/* Darwin-specific. */
321#define	AUE_DARWIN_SEARCHFS	339	/* Darwin-specific. */
322#define	AUE_DARWIN_MINHERIT	340
323#define	AUE_DARWIN_SEMCONFIG	341
324#define	AUE_DARWIN_SEMOPEN	342
325#define	AUE_DARWIN_SEMCLOSE	343
326#define	AUE_DARWIN_SEMUNLINK	344
327#define	AUE_DARWIN_SHMOPEN	345
328#define	AUE_DARWIN_SHMUNLINK	346
329#define	AUE_DARWIN_LOADSHFILE	347	/* Darwin-specific. */
330#define	AUE_DARWIN_RESETSHFILE	348	/* Darwin-specific. */
331#define	AUE_DARWIN_NEWSYSTEMSHREG	349	/* Darwin-specific. */
332#define	AUE_DARWIN_PTHREADKILL	350	/* Darwin-specific. */
333#define	AUE_DARWIN_PTHREADSIGMASK	351	/* Darwin-specific. */
334#define	AUE_DARWIN_AUDITCTL	352
335#define	AUE_DARWIN_RFORK	353
336#define	AUE_DARWIN_LCHMOD	354
337#define	AUE_DARWIN_SWAPOFF	355
338#define	AUE_DARWIN_INITPROCESS	356	/* Darwin-specific. */
339#define	AUE_DARWIN_MAPFD	357	/* Darwin-specific. */
340#define	AUE_DARWIN_TASKFORPID	358	/* Darwin-specific. */
341#define	AUE_DARWIN_PIDFORTASK	359	/* Darwin-specific. */
342#define	AUE_DARWIN_SYSCTL_NONADMIN	360
343#define	AUE_DARWIN_COPYFILE	361	/* Darwin-specific. */
344
345/*
346 * Audit event identifiers added as part of OpenBSM, generally corresponding
347 * to events in FreeBSD, Darwin, and Linux that were not present in Solaris.
348 * These often duplicate events added to the Solaris set by Darwin, but use
349 * event identifiers in a higher range in order to avoid colliding with
350 * future Solaris additions.
351 */
352#define	AUE_GETFSSTAT		43001
353#define	AUE_PTRACE		43002
354#define	AUE_CHFLAGS		43003
355#define	AUE_FCHFLAGS		43004
356#define	AUE_PROFILE		43005
357#define	AUE_KTRACE		43006
358#define	AUE_SETLOGIN		43007
359#define	AUE_REVOKE		43008
360#define	AUE_UMASK		43009
361#define	AUE_MPROTECT		43010
362#define	AUE_MKFIFO		43011
363#define	AUE_POLL		43012
364#define	AUE_FUTIMES		43013
365#define	AUE_SETSID		43014
366#define	AUE_SETPRIVEXEC		43015	/* Darwin-specific. */
367#define	AUE_ADDPROFILE		43016	/* Darwin-specific. */
368#define	AUE_KDEBUGTRACE		43017	/* Darwin-specific. */
369#define	AUE_KDBUGTRACE		AUE_KDEBUGTRACE
370#define	AUE_FSTAT		43018
371#define	AUE_FPATHCONF		43019
372#define	AUE_GETDIRENTRIES	43020
373#define	AUE_SYSCTL		43021
374#define	AUE_MLOCK		43022
375#define	AUE_MUNLOCK		43023
376#define	AUE_UNDELETE		43024
377#define	AUE_GETATTRLIST		43025	/* Darwin-specific. */
378#define	AUE_SETATTRLIST		43026	/* Darwin-specific. */
379#define	AUE_GETDIRENTRIESATTR	43027	/* Darwin-specific. */
380#define	AUE_EXCHANGEDATA	43028	/* Darwin-specific. */
381#define	AUE_SEARCHFS		43029	/* Darwin-specific. */
382#define	AUE_MINHERIT		43030
383#define	AUE_SEMCONFIG		43031
384#define	AUE_SEMOPEN		43032
385#define	AUE_SEMCLOSE		43033
386#define	AUE_SEMUNLINK		43034
387#define	AUE_SHMOPEN		43035
388#define	AUE_SHMUNLINK		43036
389#define	AUE_LOADSHFILE		43037	/* Darwin-specific. */
390#define	AUE_RESETSHFILE		43038	/* Darwin-specific. */
391#define	AUE_NEWSYSTEMSHREG	43039	/* Darwin-specific. */
392#define	AUE_PTHREADKILL		43040	/* Darwin-specific. */
393#define	AUE_PTHREADSIGMASK	43041	/* Darwin-specific. */
394#define	AUE_AUDITCTL		43042
395#define	AUE_RFORK		43043
396#define	AUE_LCHMOD		43044
397#define	AUE_SWAPOFF		43045
398#define	AUE_INITPROCESS		43046	/* Darwin-specific. */
399#define	AUE_MAPFD		43047	/* Darwin-specific. */
400#define	AUE_TASKFORPID		43048	/* Darwin-specific. */
401#define	AUE_PIDFORTASK		43049	/* Darwin-specific. */
402#define	AUE_SYSCTL_NONADMIN	43050
403#define	AUE_COPYFILE		43051	/* Darwin-specific. */
404
405/*
406 * Events added to OpenBSM for FreeBSD and Linux; may also be used by Darwin
407 * in the future.
408 */
409#define	AUE_LUTIMES		43052
410#define	AUE_LCHFLAGS		43053	/* FreeBSD-specific. */
411#define	AUE_SENDFILE		43054	/* BSD/Linux-specific. */
412#define	AUE_USELIB		43055	/* Linux-specific. */
413#define	AUE_GETRESUID		43056
414#define	AUE_SETRESUID		43057
415#define	AUE_GETRESGID		43058
416#define	AUE_SETRESGID		43059
417#define	AUE_WAIT4		43060	/* FreeBSD-specific. */
418#define	AUE_LGETFH		43061	/* FreeBSD-specific. */
419#define	AUE_FHSTATFS		43062	/* FreeBSD-specific. */
420#define	AUE_FHOPEN		43063	/* FreeBSD-specific. */
421#define	AUE_FHSTAT		43064	/* FreeBSD-specific. */
422#define	AUE_JAIL		43065	/* FreeBSD-specific. */
423#define	AUE_EACCESS		43066	/* FreeBSD-specific. */
424#define	AUE_KQUEUE		43067	/* FreeBSD-specific. */
425#define	AUE_KEVENT		43068	/* FreeBSD-specific. */
426#define	AUE_FSYNC		43069
427#define	AUE_NMOUNT		43070	/* FreeBSD-specific. */
428#define	AUE_BDFLUSH		43071	/* Linux-specific. */
429#define	AUE_SETFSUID		43072	/* Linux-specific. */
430#define	AUE_SETFSGID		43073	/* Linux-specific. */
431#define	AUE_PERSONALITY		43074	/* Linux-specific. */
432#define	AUE_SCHED_GETSCHEDULER	43075	/* POSIX.1b. */
433#define	AUE_SCHED_SETSCHEDULER	43076	/* POSIX.1b. */
434#define	AUE_PRCTL		43077	/* Linux-specific. */
435#define	AUE_GETCWD		43078	/* FreeBSD/Linux-specific. */
436#define	AUE_CAPGET		43079	/* Linux-specific. */
437#define	AUE_CAPSET		43080	/* Linux-specific. */
438#define	AUE_PIVOT_ROOT		43081	/* Linux-specific. */
439#define	AUE_RTPRIO		43082	/* FreeBSD-specific. */
440#define	AUE_SCHED_GETPARAM	43083	/* POSIX.1b. */
441#define	AUE_SCHED_SETPARAM	43084	/* POSIX.1b. */
442#define	AUE_SCHED_GET_PRIORITY_MAX	43085	/* POSIX.1b. */
443#define	AUE_SCHED_GET_PRIORITY_MIN	43086	/* POSIX.1b. */
444#define	AUE_SCHED_RR_GET_INTERVAL	43087	/* POSIX.1b. */
445#define	AUE_ACL_GET_FILE	43088	/* FreeBSD. */
446#define	AUE_ACL_SET_FILE	43089	/* FreeBSD. */
447#define	AUE_ACL_GET_FD		43090	/* FreeBSD. */
448#define	AUE_ACL_SET_FD		43091	/* FreeBSD. */
449#define	AUE_ACL_DELETE_FILE	43092	/* FreeBSD. */
450#define	AUE_ACL_DELETE_FD	43093	/* FreeBSD. */
451#define	AUE_ACL_CHECK_FILE	43094	/* FreeBSD. */
452#define	AUE_ACL_CHECK_FD	43095	/* FreeBSD. */
453#define	AUE_ACL_GET_LINK	43096	/* FreeBSD. */
454#define	AUE_ACL_SET_LINK	43097	/* FreeBSD. */
455#define	AUE_ACL_DELETE_LINK	43098	/* FreeBSD. */
456#define	AUE_ACL_CHECK_LINK	43099	/* FreeBSD. */
457#define	AUE_SYSARCH		43100	/* FreeBSD. */
458#define	AUE_EXTATTRCTL		43101	/* FreeBSD. */
459#define	AUE_EXTATTR_GET_FILE	43102	/* FreeBSD. */
460#define	AUE_EXTATTR_SET_FILE	43103	/* FreeBSD. */
461#define	AUE_EXTATTR_LIST_FILE	43104	/* FreeBSD. */
462#define	AUE_EXTATTR_DELETE_FILE	43105	/* FreeBSD. */
463#define	AUE_EXTATTR_GET_FD	43106	/* FreeBSD. */
464#define	AUE_EXTATTR_SET_FD	43107	/* FreeBSD. */
465#define	AUE_EXTATTR_LIST_FD	43108	/* FreeBSD. */
466#define	AUE_EXTATTR_DELETE_FD	43109	/* FreeBSD. */
467#define	AUE_EXTATTR_GET_LINK	43110	/* FreeBSD. */
468#define	AUE_EXTATTR_SET_LINK	43111	/* FreeBSD. */
469#define	AUE_EXTATTR_LIST_LINK	43112	/* FreeBSD. */
470#define	AUE_EXTATTR_DELETE_LINK	43113	/* FreeBSD. */
471#define	AUE_KENV		43114	/* FreeBSD. */
472#define	AUE_JAIL_ATTACH		43115	/* FreeBSD. */
473#define	AUE_SYSCTL_WRITE	43116	/* FreeBSD. */
474
475/*
476 * Darwin BSM uses a number of AUE_O_* definitions, which are aliased to the
477 * normal Solaris BSM identifiers.  _O_ refers to it being an old, or compat
478 * interface.  In most cases, Darwin has never implemented these system calls
479 * but picked up the fields in their system call table from their FreeBSD
480 * import.  Happily, these have different names than the AUE_O* definitions
481 * in Solaris BSM.
482 */
483#define	AUE_O_CREAT		AUE_OPEN_RWTC	/* Darwin */
484#define	AUE_O_EXECVE		AUE_NULL	/* Darwin */
485#define	AUE_O_SBREAK		AUE_NULL	/* Darwin */
486#define	AUE_O_LSEEK		AUE_NULL	/* Darwin */
487#define	AUE_O_MOUNT		AUE_NULL	/* Darwin */
488#define	AUE_O_UMOUNT		AUE_NULL	/* Darwin */
489#define	AUE_O_STAT		AUE_STAT	/* Darwin */
490#define	AUE_O_LSTAT		AUE_LSTAT	/* Darwin */
491#define	AUE_O_FSTAT		AUE_FSTAT	/* Darwin */
492#define	AUE_O_GETPAGESIZE	AUE_NULL	/* Darwin */
493#define	AUE_O_VREAD		AUE_NULL	/* Darwin */
494#define	AUE_O_VWRITE		AUE_NULL	/* Darwin */
495#define	AUE_O_MMAP		AUE_MMAP	/* Darwin */
496#define	AUE_O_VADVISE		AUE_NULL	/* Darwin */
497#define	AUE_O_VHANGUP		AUE_NULL	/* Darwin */
498#define	AUE_O_VLIMIT		AUE_NULL	/* Darwin */
499#define	AUE_O_WAIT		AUE_NULL	/* Darwin */
500#define	AUE_O_GETHOSTNAME	AUE_NULL	/* Darwin */
501#define	AUE_O_SETHOSTNAME	AUE_SYSCTL	/* Darwin */
502#define	AUE_O_GETDOPT		AUE_NULL	/* Darwin */
503#define	AUE_O_SETDOPT		AUE_NULL	/* Darwin */
504#define	AUE_O_ACCEPT		AUE_NULL	/* Darwin */
505#define	AUE_O_SEND		AUE_SENDMSG	/* Darwin */
506#define	AUE_O_RECV		AUE_RECVMSG	/* Darwin */
507#define	AUE_O_VTIMES		AUE_NULL	/* Darwin */
508#define	AUE_O_SIGVEC		AUE_NULL	/* Darwin */
509#define	AUE_O_SIGBLOCK		AUE_NULL	/* Darwin */
510#define	AUE_O_SIGSETMASK	AUE_NULL	/* Darwin */
511#define	AUE_O_SIGSTACK		AUE_NULL	/* Darwin */
512#define	AUE_O_RECVMSG		AUE_RECVMSG	/* Darwin */
513#define	AUE_O_SENDMSG		AUE_SENDMSG	/* Darwin */
514#define	AUE_O_VTRACE		AUE_NULL	/* Darwin */
515#define	AUE_O_RESUBA		AUE_NULL	/* Darwin */
516#define	AUE_O_RECVFROM		AUE_RECVFROM	/* Darwin */
517#define	AUE_O_SETREUID		AUE_SETREUID	/* Darwin */
518#define	AUE_O_SETREGID		AUE_SETREGID	/* Darwin */
519#define	AUE_O_GETDIRENTRIES	AUE_GETDIRENTRIES	/* Darwin */
520#define	AUE_O_TRUNCATE		AUE_TRUNCATE	/* Darwin */
521#define	AUE_O_FTRUNCATE		AUE_FTRUNCATE	/* Darwin */
522#define	AUE_O_GETPEERNAME	AUE_NULL	/* Darwin */
523#define	AUE_O_GETHOSTID		AUE_NULL	/* Darwin */
524#define	AUE_O_SETHOSTID		AUE_NULL	/* Darwin */
525#define	AUE_O_GETRLIMIT		AUE_NULL	/* Darwin */
526#define	AUE_O_SETRLIMIT		AUE_SETRLIMIT	/* Darwin */
527#define	AUE_O_KILLPG		AUE_KILL	/* Darwin */
528#define	AUE_O_SETQUOTA		AUE_NULL	/* Darwin */
529#define	AUE_O_QUOTA		AUE_NULL	/* Darwin */
530#define	AUE_O_GETSOCKNAME	AUE_NULL	/* Darwin */
531#define	AUE_O_GETDIREENTRIES	AUE_GETDIREENTRIES	/* Darwin */
532#define	AUE_O_ASYNCDAEMON	AUE_NULL	/* Darwin */
533#define	AUE_O_GETDOMAINNAME	AUE_NULL	/* Darwin */
534#define	AUE_O_SETDOMAINNAME	AUE_SYSCTL	/* Darwin */
535#define	AUE_O_PCFS_MOUNT	AUE_NULL	/* Darwin */
536#define	AUE_O_EXPORTFS		AUE_NULL	/* Darwin */
537#define	AUE_O_USTATE		AUE_NULL	/* Darwin */
538#define	AUE_O_WAIT3		AUE_NULL	/* Darwin */
539#define	AUE_O_RPAUSE		AUE_NULL	/* Darwin */
540#define	AUE_O_GETDENTS		AUE_NULL	/* Darwin */
541
542/*
543 * Possible desired future values based on review of BSD/Darwin system calls.
544 */
545#define	AUE_DUP			AUE_NULL
546#define	AUE_FSCTL		AUE_NULL
547#define	AUE_FSTATV		AUE_NULL
548#define	AUE_GCCONTROL		AUE_NULL
549#define	AUE_GETDTABLESIZE	AUE_NULL
550#define	AUE_GETEGID		AUE_NULL
551#define	AUE_GETEUID		AUE_NULL
552#define	AUE_GETGID		AUE_NULL
553#define	AUE_GETGROUPS		AUE_NULL
554#define	AUE_GETITIMER		AUE_NULL
555#define	AUE_GETLOGIN		AUE_NULL
556#define	AUE_GETPEERNAME		AUE_NULL
557#define	AUE_GETPGID		AUE_NULL
558#define	AUE_GETPGRP		AUE_NULL
559#define	AUE_GETPID		AUE_NULL
560#define	AUE_GETPPID		AUE_NULL
561#define	AUE_GETPRIORITY		AUE_NULL
562#define	AUE_GETRLIMIT		AUE_NULL
563#define	AUE_GETRUSAGE		AUE_NULL
564#define	AUE_GETSID		AUE_NULL
565#define	AUE_GETSOCKNAME		AUE_NULL
566#define	AUE_GETTIMEOFDAY	AUE_NULL
567#define	AUE_GETUID		AUE_NULL
568#define	AUE_GETSOCKOPT		AUE_NULL
569#define	AUE_GTSOCKOPT		AUE_GETSOCKOPT	/* XXX: Typo in Darwin. */
570#define	AUE_ISSETUGID		AUE_NULL
571#define	AUE_LISTEN		AUE_NULL
572#define	AUE_LSTATV		AUE_NULL
573#define	AUE_MADVISE		AUE_NULL
574#define	AUE_MINCORE		AUE_NULL
575#define	AUE_MKCOMPLEX		AUE_NULL
576#define	AUE_MLOCKALL		AUE_NULL
577#define	AUE_MODWATCH		AUE_NULL
578#define	AUE_MSGCL		AUE_NULL
579#define	AUE_MSYNC		AUE_NULL
580#define	AUE_MUNLOCKALL		AUE_NULL
581#define	AUE_PREAD		AUE_NULL
582#define	AUE_PWRITE		AUE_NULL
583#define	AUE_PREADV		AUE_NULL
584#define	AUE_PWRITEV		AUE_NULL
585#define	AUE_SBRK		AUE_NULL
586#define	AUE_SELECT		AUE_NULL
587#define	AUE_SEMDESTROY		AUE_NULL
588#define	AUE_SEMGETVALUE		AUE_NULL
589#define	AUE_SEMINIT		AUE_NULL
590#define	AUE_SEMPOST		AUE_NULL
591#define	AUE_SEMTRYWAIT		AUE_NULL
592#define	AUE_SEMWAIT		AUE_NULL
593#define	AUE_SETITIMER		AUE_NULL
594#define	AUE_SIGACTION		AUE_NULL
595#define	AUE_SIGALTSTACK		AUE_NULL
596#define	AUE_SIGPENDING		AUE_NULL
597#define	AUE_SIGPROCMASK		AUE_NULL
598#define	AUE_SIGRETURN		AUE_NULL
599#define	AUE_SIGSUSPEND		AUE_NULL
600#define	AUE_SIGWAIT		AUE_NULL
601#define	AUE_SSTK		AUE_NULL
602#define	AUE_STATV		AUE_NULL
603#define	AUE_SYNC		AUE_NULL
604#define	AUE_SYSCALL		AUE_NULL
605#define	AUE_TABLE		AUE_NULL
606#define	AUE_WAITEVENT		AUE_NULL
607#define	AUE_WATCHEVENT		AUE_NULL
608
609#endif /* !_BSM_AUDIT_KEVENTS_H_ */
610