audit_kevents.h revision 171542
1/* 2 * Copyright (c) 2005 Apple Computer, Inc. 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 3. Neither the name of Apple Computer, Inc. ("Apple") nor the names of 15 * its contributors may be used to endorse or promote products derived 16 * from this software without specific prior written permission. 17 * 18 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY 19 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 20 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 21 * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY 22 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 23 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 24 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND 25 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 26 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 27 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 28 * 29 * P4: //depot/projects/trustedbsd/audit3/sys/bsm/audit_kevents.h#34 30 * $FreeBSD: head/sys/bsm/audit_kevents.h 171542 2007-07-22 12:28:13Z rwatson $ 31 */ 32 33#ifndef _BSM_AUDIT_KEVENTS_H_ 34#define _BSM_AUDIT_KEVENTS_H_ 35 36/* 37 * Values marked as AUE_NULL are not required to be audited as per CAPP. 38 * 39 * Some conflicts exist in the assignment of name to event number mappings 40 * between BSM implementations. In general, we prefer the OpenSolaris 41 * definition as we consider Solaris BSM to be authoritative. _DARWIN_ has 42 * been inserted for the Darwin variants. If necessary, other tags will be 43 * added in the future. 44 */ 45#define AUE_NULL 0 46#define AUE_EXIT 1 47#define AUE_FORK 2 48#define AUE_FORKALL AUE_FORK /* Solaris-specific. */ 49#define AUE_OPEN 3 50#define AUE_CREAT 4 51#define AUE_LINK 5 52#define AUE_UNLINK 6 53#define AUE_DELETE AUE_UNLINK /* Darwin-specific. */ 54#define AUE_EXEC 7 55#define AUE_CHDIR 8 56#define AUE_MKNOD 9 57#define AUE_CHMOD 10 58#define AUE_CHOWN 11 59#define AUE_UMOUNT 12 60#define AUE_JUNK 13 /* Solaris-specific. */ 61#define AUE_ACCESS 14 62#define AUE_CHECKUSERACCESS AUE_ACCESS /* Darwin-specific. */ 63#define AUE_KILL 15 64#define AUE_STAT 16 65#define AUE_LSTAT 17 66#define AUE_ACCT 18 67#define AUE_MCTL 19 /* Solaris-specific. */ 68#define AUE_REBOOT 20 /* XXX: Darwin conflict. */ 69#define AUE_SYMLINK 21 70#define AUE_READLINK 22 71#define AUE_EXECVE 23 72#define AUE_CHROOT 24 73#define AUE_VFORK 25 74#define AUE_SETGROUPS 26 75#define AUE_SETPGRP 27 76#define AUE_SWAPON 28 77#define AUE_SETHOSTNAME 29 /* XXX: Darwin conflict. */ 78#define AUE_FCNTL 30 79#define AUE_SETPRIORITY 31 /* XXX: Darwin conflict. */ 80#define AUE_CONNECT 32 81#define AUE_ACCEPT 33 82#define AUE_BIND 34 83#define AUE_SETSOCKOPT 35 84#define AUE_VTRACE 36 /* Solaris-specific. */ 85#define AUE_SETTIMEOFDAY 37 /* XXX: Darwin conflict. */ 86#define AUE_FCHOWN 38 87#define AUE_FCHMOD 39 88#define AUE_SETREUID 40 89#define AUE_SETREGID 41 90#define AUE_RENAME 42 91#define AUE_TRUNCATE 43 /* XXX: Darwin conflict. */ 92#define AUE_FTRUNCATE 44 /* XXX: Darwin conflict. */ 93#define AUE_FLOCK 45 /* XXX: Darwin conflict. */ 94#define AUE_SHUTDOWN 46 95#define AUE_MKDIR 47 96#define AUE_RMDIR 48 97#define AUE_UTIMES 49 98#define AUE_ADJTIME 50 99#define AUE_SETRLIMIT 51 100#define AUE_KILLPG 52 101#define AUE_NFS_SVC 53 /* XXX: Darwin conflict. */ 102#define AUE_STATFS 54 103#define AUE_FSTATFS 55 104#define AUE_UNMOUNT 56 /* XXX: Darwin conflict. */ 105#define AUE_ASYNC_DAEMON 57 106#define AUE_NFS_GETFH 58 /* XXX: Darwin conflict. */ 107#define AUE_SETDOMAINNAME 59 108#define AUE_QUOTACTL 60 /* XXX: Darwin conflict. */ 109#define AUE_EXPORTFS 61 110#define AUE_MOUNT 62 111#define AUE_SEMSYS 63 112#define AUE_MSGSYS 64 113#define AUE_SHMSYS 65 114#define AUE_BSMSYS 66 /* Solaris-specific. */ 115#define AUE_RFSSYS 67 /* Solaris-specific. */ 116#define AUE_FCHDIR 68 117#define AUE_FCHROOT 69 118#define AUE_VPIXSYS 70 /* Solaris-specific. */ 119#define AUE_PATHCONF 71 120#define AUE_OPEN_R 72 121#define AUE_OPEN_RC 73 122#define AUE_OPEN_RT 74 123#define AUE_OPEN_RTC 75 124#define AUE_OPEN_W 76 125#define AUE_OPEN_WC 77 126#define AUE_OPEN_WT 78 127#define AUE_OPEN_WTC 79 128#define AUE_OPEN_RW 80 129#define AUE_OPEN_RWC 81 130#define AUE_OPEN_RWT 82 131#define AUE_OPEN_RWTC 83 132#define AUE_MSGCTL 84 133#define AUE_MSGCTL_RMID 85 134#define AUE_MSGCTL_SET 86 135#define AUE_MSGCTL_STAT 87 136#define AUE_MSGGET 88 137#define AUE_MSGRCV 89 138#define AUE_MSGSND 90 139#define AUE_SHMCTL 91 140#define AUE_SHMCTL_RMID 92 141#define AUE_SHMCTL_SET 93 142#define AUE_SHMCTL_STAT 94 143#define AUE_SHMGET 95 144#define AUE_SHMAT 96 145#define AUE_SHMDT 97 146#define AUE_SEMCTL 98 147#define AUE_SEMCTL_RMID 99 148#define AUE_SEMCTL_SET 100 149#define AUE_SEMCTL_STAT 101 150#define AUE_SEMCTL_GETNCNT 102 151#define AUE_SEMCTL_GETPID 103 152#define AUE_SEMCTL_GETVAL 104 153#define AUE_SEMCTL_GETALL 105 154#define AUE_SEMCTL_GETZCNT 106 155#define AUE_SEMCTL_SETVAL 107 156#define AUE_SEMCTL_SETALL 108 157#define AUE_SEMGET 109 158#define AUE_SEMOP 110 159#define AUE_CORE 111 /* Solaris-specific, currently. */ 160#define AUE_CLOSE 112 161#define AUE_SYSTEMBOOT 113 /* Solaris-specific. */ 162#define AUE_ASYNC_DAEMON_EXIT 114 /* Solaris-specific. */ 163#define AUE_NFSSVC_EXIT 115 /* Solaris-specific. */ 164#define AUE_WRITEL 128 /* Solaris-specific. */ 165#define AUE_WRITEVL 129 /* Solaris-specific. */ 166#define AUE_GETAUID 130 167#define AUE_SETAUID 131 168#define AUE_GETAUDIT 132 169#define AUE_SETAUDIT 133 170#define AUE_GETUSERAUDIT 134 /* Solaris-specific. */ 171#define AUE_SETUSERAUDIT 135 /* Solaris-specific. */ 172#define AUE_AUDITSVC 136 /* Solaris-specific. */ 173#define AUE_AUDITUSER 137 /* Solaris-specific. */ 174#define AUE_AUDITON 138 175#define AUE_AUDITON_GTERMID 139 /* Solaris-specific. */ 176#define AUE_AUDITON_STERMID 140 /* Solaris-specific. */ 177#define AUE_AUDITON_GPOLICY 141 178#define AUE_AUDITON_SPOLICY 142 179#define AUE_AUDITON_GQCTRL 145 180#define AUE_AUDITON_SQCTRL 146 181#define AUE_GETKERNSTATE 147 /* Solaris-specific. */ 182#define AUE_SETKERNSTATE 148 /* Solaris-specific. */ 183#define AUE_GETPORTAUDIT 149 /* Solaris-specific. */ 184#define AUE_AUDITSTAT 150 /* Solaris-specific. */ 185#define AUE_REVOKE 151 186#define AUE_MAC 152 /* Solaris-specific. */ 187#define AUE_ENTERPROM 153 /* Solaris-specific. */ 188#define AUE_EXITPROM 154 /* Solaris-specific. */ 189#define AUE_IFLOAT 155 /* Solaris-specific. */ 190#define AUE_PFLOAT 156 /* Solaris-specific. */ 191#define AUE_UPRIV 157 /* Solaris-specific. */ 192#define AUE_IOCTL 158 193#define AUE_SOCKET 183 194#define AUE_SENDTO 184 195#define AUE_PIPE 185 196#define AUE_SOCKETPAIR 186 /* XXX: Darwin conflict. */ 197#define AUE_SEND 187 198#define AUE_SENDMSG 188 199#define AUE_RECV 189 200#define AUE_RECVMSG 190 201#define AUE_RECVFROM 191 202#define AUE_READ 192 203#define AUE_GETDENTS 193 204#define AUE_LSEEK 194 205#define AUE_WRITE 195 206#define AUE_WRITEV 196 207#define AUE_NFS 197 /* Solaris-specific. */ 208#define AUE_READV 198 209#define AUE_OSTAT 199 /* Solaris-specific. */ 210#define AUE_SETUID 200 /* XXXRW: Solaris old setuid? */ 211#define AUE_STIME 201 /* XXXRW: Solaris old stime? */ 212#define AUE_UTIME 202 /* XXXRW: Solaris old utime? */ 213#define AUE_NICE 203 /* XXXRW: Solaris old nice? */ 214#define AUE_OSETPGRP 204 /* Solaris-specific. */ 215#define AUE_SETGID 205 216#define AUE_READL 206 /* Solaris-specific. */ 217#define AUE_READVL 207 /* Solaris-specific. */ 218#define AUE_FSTAT 208 219#define AUE_DUP2 209 220#define AUE_MMAP 210 221#define AUE_AUDIT 211 222#define AUE_PRIOCNTLSYS 212 /* Solaris-specific. */ 223#define AUE_MUNMAP 213 224#define AUE_SETEGID 214 225#define AUE_SETEUID 215 226#define AUE_PUTMSG 216 /* Solaris-specific. */ 227#define AUE_GETMSG 217 /* Solaris-specific. */ 228#define AUE_PUTPMSG 218 /* Solaris-specific. */ 229#define AUE_GETPMSG 219 /* Solaris-specific. */ 230#define AUE_AUDITSYS 220 /* Solaris-specific. */ 231#define AUE_AUDITON_GETKMASK 221 232#define AUE_AUDITON_SETKMASK 222 233#define AUE_AUDITON_GETCWD 223 234#define AUE_AUDITON_GETCAR 224 235#define AUE_AUDITON_GETSTAT 225 236#define AUE_AUDITON_SETSTAT 226 237#define AUE_AUDITON_SETUMASK 227 238#define AUE_AUDITON_SETSMASK 228 239#define AUE_AUDITON_GETCOND 229 240#define AUE_AUDITON_SETCOND 230 241#define AUE_AUDITON_GETCLASS 231 242#define AUE_AUDITON_SETCLASS 232 243#define AUE_FUSERS 233 /* Solaris-specific; also UTSSYS? */ 244#define AUE_STATVFS 234 245#define AUE_XSTAT 235 /* Solaris-specific. */ 246#define AUE_LXSTAT 236 /* Solaris-specific. */ 247#define AUE_LCHOWN 237 248#define AUE_MEMCNTL 238 /* Solaris-specific. */ 249#define AUE_SYSINFO 239 /* Solaris-specific. */ 250#define AUE_XMKNOD 240 /* Solaris-specific. */ 251#define AUE_FORK1 241 252#define AUE_MODCTL 242 /* Solaris-specific. */ 253#define AUE_MODLOAD 243 254#define AUE_MODUNLOAD 244 255#define AUE_MODCONFIG 245 /* Solaris-specific. */ 256#define AUE_MODADDMAJ 246 /* Solaris-specific. */ 257#define AUE_SOCKACCEPT 247 /* Solaris-specific. */ 258#define AUE_SOCKCONNECT 248 /* Solaris-specific. */ 259#define AUE_SOCKSEND 249 /* Solaris-specific. */ 260#define AUE_SOCKRECEIVE 250 /* Solaris-specific. */ 261#define AUE_ACLSET 251 262#define AUE_FACLSET 252 263#define AUE_DOORFS 253 /* Solaris-specific. */ 264#define AUE_DOORFS_DOOR_CALL 254 /* Solaris-specific. */ 265#define AUE_DOORFS_DOOR_RETURN 255 /* Solaris-specific. */ 266#define AUE_DOORFS_DOOR_CREATE 256 /* Solaris-specific. */ 267#define AUE_DOORFS_DOOR_REVOKE 257 /* Solaris-specific. */ 268#define AUE_DOORFS_DOOR_INFO 258 /* Solaris-specific. */ 269#define AUE_DOORFS_DOOR_CRED 259 /* Solaris-specific. */ 270#define AUE_DOORFS_DOOR_BIND 260 /* Solaris-specific. */ 271#define AUE_DOORFS_DOOR_UNBIND 261 /* Solaris-specific. */ 272#define AUE_P_ONLINE 262 /* Solaris-specific. */ 273#define AUE_PROCESSOR_BIND 263 /* Solaris-specific. */ 274#define AUE_INST_SYNC 264 /* Solaris-specific. */ 275#define AUE_SOCKCONFIG 265 /* Solaris-specific. */ 276#define AUE_SETAUDIT_ADDR 266 277#define AUE_GETAUDIT_ADDR 267 278#define AUE_UMOUNT2 268 /* Solaris-specific. */ 279#define AUE_FSAT 269 /* Solaris-specific. */ 280#define AUE_OPENAT_R 270 281#define AUE_OPENAT_RC 271 282#define AUE_OPENAT_RT 272 283#define AUE_OPENAT_RTC 273 284#define AUE_OPENAT_W 274 285#define AUE_OPENAT_WC 275 286#define AUE_OPENAT_WT 276 287#define AUE_OPENAT_WTC 277 288#define AUE_OPENAT_RW 278 289#define AUE_OPENAT_RWC 279 290#define AUE_OPENAT_RWT 280 291#define AUE_OPENAT_RWTC 281 292#define AUE_RENAMEAT 282 293#define AUE_FSTATAT 283 294#define AUE_FCHOWNAT 284 295#define AUE_FUTIMESAT 285 296#define AUE_UNLINKAT 286 297#define AUE_CLOCK_SETTIME 287 298#define AUE_NTP_ADJTIME 288 299#define AUE_SETPPRIV 289 /* Solaris-specific. */ 300#define AUE_MODDEVPLCY 290 /* Solaris-specific. */ 301#define AUE_MODADDPRIV 291 /* Solaris-specific. */ 302#define AUE_CRYPTOADM 292 /* Solaris-specific. */ 303#define AUE_CONFIGKSSL 293 /* Solaris-specific. */ 304#define AUE_BRANDSYS 294 /* Solaris-specific. */ 305#define AUE_PF_POLICY_ADDRULE 295 /* Solaris-specific. */ 306#define AUE_PF_POLICY_DELRULE 296 /* Solaris-specific. */ 307#define AUE_PF_POLICY_CLONE 297 /* Solaris-specific. */ 308#define AUE_PF_POLICY_FLIP 298 /* Solaris-specific. */ 309#define AUE_PF_POLICY_FLUSH 299 /* Solaris-specific. */ 310#define AUE_PF_POLICY_ALGS 300 /* Solaris-specific. */ 311 312/* 313 * Events added for Apple Darwin that potentially collide with future Solaris 314 * BSM events. These are assigned AUE_DARWIN prefixes, and are deprecated in 315 * new trails. Systems generating these events should switch to the new 316 * identifiers that avoid colliding with the Solaris identifier space. 317 */ 318#define AUE_DARWIN_GETFSSTAT 301 319#define AUE_DARWIN_PTRACE 302 320#define AUE_DARWIN_CHFLAGS 303 321#define AUE_DARWIN_FCHFLAGS 304 322#define AUE_DARWIN_PROFILE 305 323#define AUE_DARWIN_KTRACE 306 324#define AUE_DARWIN_SETLOGIN 307 325#define AUE_DARWIN_REBOOT 308 326#define AUE_DARWIN_REVOKE 309 327#define AUE_DARWIN_UMASK 310 328#define AUE_DARWIN_MPROTECT 311 329#define AUE_DARWIN_SETPRIORITY 312 330#define AUE_DARWIN_SETTIMEOFDAY 313 331#define AUE_DARWIN_FLOCK 314 332#define AUE_DARWIN_MKFIFO 315 333#define AUE_DARWIN_POLL 316 334#define AUE_DARWIN_SOCKETPAIR 317 335#define AUE_DARWIN_FUTIMES 318 336#define AUE_DARWIN_SETSID 319 337#define AUE_DARWIN_SETPRIVEXEC 320 /* Darwin-specific. */ 338#define AUE_DARWIN_NFSSVC 321 339#define AUE_DARWIN_GETFH 322 340#define AUE_DARWIN_QUOTACTL 323 341#define AUE_DARWIN_ADDPROFILE 324 /* Darwin-specific. */ 342#define AUE_DARWIN_KDEBUGTRACE 325 /* Darwin-specific. */ 343#define AUE_DARWIN_KDBUGTRACE AUE_KDEBUGTRACE 344#define AUE_DARWIN_FSTAT 326 345#define AUE_DARWIN_FPATHCONF 327 346#define AUE_DARWIN_GETDIRENTRIES 328 347#define AUE_DARWIN_TRUNCATE 329 348#define AUE_DARWIN_FTRUNCATE 330 349#define AUE_DARWIN_SYSCTL 331 350#define AUE_DARWIN_MLOCK 332 351#define AUE_DARWIN_MUNLOCK 333 352#define AUE_DARWIN_UNDELETE 334 353#define AUE_DARWIN_GETATTRLIST 335 /* Darwin-specific. */ 354#define AUE_DARWIN_SETATTRLIST 336 /* Darwin-specific. */ 355#define AUE_DARWIN_GETDIRENTRIESATTR 337 /* Darwin-specific. */ 356#define AUE_DARWIN_EXCHANGEDATA 338 /* Darwin-specific. */ 357#define AUE_DARWIN_SEARCHFS 339 /* Darwin-specific. */ 358#define AUE_DARWIN_MINHERIT 340 359#define AUE_DARWIN_SEMCONFIG 341 360#define AUE_DARWIN_SEMOPEN 342 361#define AUE_DARWIN_SEMCLOSE 343 362#define AUE_DARWIN_SEMUNLINK 344 363#define AUE_DARWIN_SHMOPEN 345 364#define AUE_DARWIN_SHMUNLINK 346 365#define AUE_DARWIN_LOADSHFILE 347 /* Darwin-specific. */ 366#define AUE_DARWIN_RESETSHFILE 348 /* Darwin-specific. */ 367#define AUE_DARWIN_NEWSYSTEMSHREG 349 /* Darwin-specific. */ 368#define AUE_DARWIN_PTHREADKILL 350 /* Darwin-specific. */ 369#define AUE_DARWIN_PTHREADSIGMASK 351 /* Darwin-specific. */ 370#define AUE_DARWIN_AUDITCTL 352 371#define AUE_DARWIN_RFORK 353 372#define AUE_DARWIN_LCHMOD 354 373#define AUE_DARWIN_SWAPOFF 355 374#define AUE_DARWIN_INITPROCESS 356 /* Darwin-specific. */ 375#define AUE_DARWIN_MAPFD 357 /* Darwin-specific. */ 376#define AUE_DARWIN_TASKFORPID 358 /* Darwin-specific. */ 377#define AUE_DARWIN_PIDFORTASK 359 /* Darwin-specific. */ 378#define AUE_DARWIN_SYSCTL_NONADMIN 360 379#define AUE_DARWIN_COPYFILE 361 /* Darwin-specific. */ 380 381/* 382 * Audit event identifiers added as part of OpenBSM, generally corresponding 383 * to events in FreeBSD, Darwin, and Linux that were not present in Solaris. 384 * These often duplicate events added to the Solaris set by Darwin, but use 385 * event identifiers in a higher range in order to avoid colliding with 386 * future Solaris additions. 387 * 388 * If an event in this section is later added to Solaris, we prefer the 389 * Solaris event identifier, and add _OPENBSM_ to the OpenBSM-specific 390 * identifier so that old trails can still be processed, but new trails use 391 * the Solaris identifier. 392 */ 393#define AUE_GETFSSTAT 43001 394#define AUE_PTRACE 43002 395#define AUE_CHFLAGS 43003 396#define AUE_FCHFLAGS 43004 397#define AUE_PROFILE 43005 398#define AUE_KTRACE 43006 399#define AUE_SETLOGIN 43007 400#define AUE_OPENBSM_REVOKE 43008 /* Solaris event now preferred. */ 401#define AUE_UMASK 43009 402#define AUE_MPROTECT 43010 403#define AUE_MKFIFO 43011 404#define AUE_POLL 43012 405#define AUE_FUTIMES 43013 406#define AUE_SETSID 43014 407#define AUE_SETPRIVEXEC 43015 /* Darwin-specific. */ 408#define AUE_ADDPROFILE 43016 /* Darwin-specific. */ 409#define AUE_KDEBUGTRACE 43017 /* Darwin-specific. */ 410#define AUE_KDBUGTRACE AUE_KDEBUGTRACE 411#define AUE_OPENBSM_FSTAT 43018 /* Solaris event now preferred. */ 412#define AUE_FPATHCONF 43019 413#define AUE_GETDIRENTRIES 43020 414#define AUE_SYSCTL 43021 415#define AUE_MLOCK 43022 416#define AUE_MUNLOCK 43023 417#define AUE_UNDELETE 43024 418#define AUE_GETATTRLIST 43025 /* Darwin-specific. */ 419#define AUE_SETATTRLIST 43026 /* Darwin-specific. */ 420#define AUE_GETDIRENTRIESATTR 43027 /* Darwin-specific. */ 421#define AUE_EXCHANGEDATA 43028 /* Darwin-specific. */ 422#define AUE_SEARCHFS 43029 /* Darwin-specific. */ 423#define AUE_MINHERIT 43030 424#define AUE_SEMCONFIG 43031 425#define AUE_SEMOPEN 43032 426#define AUE_SEMCLOSE 43033 427#define AUE_SEMUNLINK 43034 428#define AUE_SHMOPEN 43035 429#define AUE_SHMUNLINK 43036 430#define AUE_LOADSHFILE 43037 /* Darwin-specific. */ 431#define AUE_RESETSHFILE 43038 /* Darwin-specific. */ 432#define AUE_NEWSYSTEMSHREG 43039 /* Darwin-specific. */ 433#define AUE_PTHREADKILL 43040 /* Darwin-specific. */ 434#define AUE_PTHREADSIGMASK 43041 /* Darwin-specific. */ 435#define AUE_AUDITCTL 43042 436#define AUE_RFORK 43043 437#define AUE_LCHMOD 43044 438#define AUE_SWAPOFF 43045 439#define AUE_INITPROCESS 43046 /* Darwin-specific. */ 440#define AUE_MAPFD 43047 /* Darwin-specific. */ 441#define AUE_TASKFORPID 43048 /* Darwin-specific. */ 442#define AUE_PIDFORTASK 43049 /* Darwin-specific. */ 443#define AUE_SYSCTL_NONADMIN 43050 444#define AUE_COPYFILE 43051 /* Darwin-specific. */ 445 446/* 447 * Events added to OpenBSM for FreeBSD and Linux; may also be used by Darwin 448 * in the future. 449 */ 450#define AUE_LUTIMES 43052 451#define AUE_LCHFLAGS 43053 /* FreeBSD-specific. */ 452#define AUE_SENDFILE 43054 /* BSD/Linux-specific. */ 453#define AUE_USELIB 43055 /* Linux-specific. */ 454#define AUE_GETRESUID 43056 455#define AUE_SETRESUID 43057 456#define AUE_GETRESGID 43058 457#define AUE_SETRESGID 43059 458#define AUE_WAIT4 43060 /* FreeBSD-specific. */ 459#define AUE_LGETFH 43061 /* FreeBSD-specific. */ 460#define AUE_FHSTATFS 43062 /* FreeBSD-specific. */ 461#define AUE_FHOPEN 43063 /* FreeBSD-specific. */ 462#define AUE_FHSTAT 43064 /* FreeBSD-specific. */ 463#define AUE_JAIL 43065 /* FreeBSD-specific. */ 464#define AUE_EACCESS 43066 /* FreeBSD-specific. */ 465#define AUE_KQUEUE 43067 /* FreeBSD-specific. */ 466#define AUE_KEVENT 43068 /* FreeBSD-specific. */ 467#define AUE_FSYNC 43069 468#define AUE_NMOUNT 43070 /* FreeBSD-specific. */ 469#define AUE_BDFLUSH 43071 /* Linux-specific. */ 470#define AUE_SETFSUID 43072 /* Linux-specific. */ 471#define AUE_SETFSGID 43073 /* Linux-specific. */ 472#define AUE_PERSONALITY 43074 /* Linux-specific. */ 473#define AUE_SCHED_GETSCHEDULER 43075 /* POSIX.1b. */ 474#define AUE_SCHED_SETSCHEDULER 43076 /* POSIX.1b. */ 475#define AUE_PRCTL 43077 /* Linux-specific. */ 476#define AUE_GETCWD 43078 /* FreeBSD/Linux-specific. */ 477#define AUE_CAPGET 43079 /* Linux-specific. */ 478#define AUE_CAPSET 43080 /* Linux-specific. */ 479#define AUE_PIVOT_ROOT 43081 /* Linux-specific. */ 480#define AUE_RTPRIO 43082 /* FreeBSD-specific. */ 481#define AUE_SCHED_GETPARAM 43083 /* POSIX.1b. */ 482#define AUE_SCHED_SETPARAM 43084 /* POSIX.1b. */ 483#define AUE_SCHED_GET_PRIORITY_MAX 43085 /* POSIX.1b. */ 484#define AUE_SCHED_GET_PRIORITY_MIN 43086 /* POSIX.1b. */ 485#define AUE_SCHED_RR_GET_INTERVAL 43087 /* POSIX.1b. */ 486#define AUE_ACL_GET_FILE 43088 /* FreeBSD. */ 487#define AUE_ACL_SET_FILE 43089 /* FreeBSD. */ 488#define AUE_ACL_GET_FD 43090 /* FreeBSD. */ 489#define AUE_ACL_SET_FD 43091 /* FreeBSD. */ 490#define AUE_ACL_DELETE_FILE 43092 /* FreeBSD. */ 491#define AUE_ACL_DELETE_FD 43093 /* FreeBSD. */ 492#define AUE_ACL_CHECK_FILE 43094 /* FreeBSD. */ 493#define AUE_ACL_CHECK_FD 43095 /* FreeBSD. */ 494#define AUE_ACL_GET_LINK 43096 /* FreeBSD. */ 495#define AUE_ACL_SET_LINK 43097 /* FreeBSD. */ 496#define AUE_ACL_DELETE_LINK 43098 /* FreeBSD. */ 497#define AUE_ACL_CHECK_LINK 43099 /* FreeBSD. */ 498#define AUE_SYSARCH 43100 /* FreeBSD. */ 499#define AUE_EXTATTRCTL 43101 /* FreeBSD. */ 500#define AUE_EXTATTR_GET_FILE 43102 /* FreeBSD. */ 501#define AUE_EXTATTR_SET_FILE 43103 /* FreeBSD. */ 502#define AUE_EXTATTR_LIST_FILE 43104 /* FreeBSD. */ 503#define AUE_EXTATTR_DELETE_FILE 43105 /* FreeBSD. */ 504#define AUE_EXTATTR_GET_FD 43106 /* FreeBSD. */ 505#define AUE_EXTATTR_SET_FD 43107 /* FreeBSD. */ 506#define AUE_EXTATTR_LIST_FD 43108 /* FreeBSD. */ 507#define AUE_EXTATTR_DELETE_FD 43109 /* FreeBSD. */ 508#define AUE_EXTATTR_GET_LINK 43110 /* FreeBSD. */ 509#define AUE_EXTATTR_SET_LINK 43111 /* FreeBSD. */ 510#define AUE_EXTATTR_LIST_LINK 43112 /* FreeBSD. */ 511#define AUE_EXTATTR_DELETE_LINK 43113 /* FreeBSD. */ 512#define AUE_KENV 43114 /* FreeBSD. */ 513#define AUE_JAIL_ATTACH 43115 /* FreeBSD. */ 514#define AUE_SYSCTL_WRITE 43116 /* FreeBSD. */ 515#define AUE_IOPERM 43117 /* Linux. */ 516#define AUE_READDIR 43118 /* Linux. */ 517#define AUE_IOPL 43119 /* Linux. */ 518#define AUE_VM86 43120 /* Linux. */ 519#define AUE_MAC_GET_PROC 43121 /* FreeBSD. */ 520#define AUE_MAC_SET_PROC 43122 /* FreeBSD. */ 521#define AUE_MAC_GET_FD 43123 /* FreeBSD. */ 522#define AUE_MAC_GET_FILE 43124 /* FreeBSD. */ 523#define AUE_MAC_SET_FD 43125 /* FreeBSD. */ 524#define AUE_MAC_SET_FILE 43126 /* FreeBSD. */ 525#define AUE_MAC_SYSCALL 43127 /* FreeBSD. */ 526#define AUE_MAC_GET_PID 43128 /* FreeBSD. */ 527#define AUE_MAC_GET_LINK 43129 /* FreeBSD. */ 528#define AUE_MAC_SET_LINK 43130 /* FreeBSD. */ 529#define AUE_MAC_EXECVE 43131 /* FreeBSD. */ 530#define AUE_GETPATH_FROMFD 43132 /* FreeBSD. */ 531#define AUE_GETPATH_FROMADDR 43133 /* FreeBSD. */ 532#define AUE_MQ_OPEN 43134 /* FreeBSD. */ 533#define AUE_MQ_SETATTR 43135 /* FreeBSD. */ 534#define AUE_MQ_TIMEDRECEIVE 43136 /* FreeBSD. */ 535#define AUE_MQ_TIMEDSEND 43137 /* FreeBSD. */ 536#define AUE_MQ_NOTIFY 43138 /* FreeBSD. */ 537#define AUE_MQ_UNLINK 43139 /* FreeBSD. */ 538#define AUE_LISTEN 43140 /* FreeBSD/Darwin/Linux. */ 539#define AUE_MLOCKALL 43141 /* FreeBSD. */ 540#define AUE_MUNLOCKALL 43142 /* FreeBSD. */ 541#define AUE_CLOSEFROM 43143 /* FreeBSD. */ 542#define AUE_FEXECVE 43144 /* FreeBSD. */ 543#define AUE_FACCESSAT 43145 /* FreeBSD. */ 544#define AUE_FCHMODAT 43146 /* FreeBSD. */ 545#define AUE_LINKAT 43147 /* FreeBSD. */ 546#define AUE_MKDIRAT 43148 /* FreeBSD. */ 547#define AUE_MKFIFOAT 43149 /* FreeBSD. */ 548#define AUE_MKNODAT 43150 /* FreeBSD. */ 549#define AUE_READLINKAT 43151 /* FreeBSD. */ 550#define AUE_SYMLINKAT 43152 /* FreeBSD. */ 551 552/* 553 * Darwin BSM uses a number of AUE_O_* definitions, which are aliased to the 554 * normal Solaris BSM identifiers. _O_ refers to it being an old, or compat 555 * interface. In most cases, Darwin has never implemented these system calls 556 * but picked up the fields in their system call table from their FreeBSD 557 * import. Happily, these have different names than the AUE_O* definitions 558 * in Solaris BSM. 559 */ 560#define AUE_O_CREAT AUE_OPEN_RWTC /* Darwin */ 561#define AUE_O_EXECVE AUE_NULL /* Darwin */ 562#define AUE_O_SBREAK AUE_NULL /* Darwin */ 563#define AUE_O_LSEEK AUE_NULL /* Darwin */ 564#define AUE_O_MOUNT AUE_NULL /* Darwin */ 565#define AUE_O_UMOUNT AUE_NULL /* Darwin */ 566#define AUE_O_STAT AUE_STAT /* Darwin */ 567#define AUE_O_LSTAT AUE_LSTAT /* Darwin */ 568#define AUE_O_FSTAT AUE_FSTAT /* Darwin */ 569#define AUE_O_GETPAGESIZE AUE_NULL /* Darwin */ 570#define AUE_O_VREAD AUE_NULL /* Darwin */ 571#define AUE_O_VWRITE AUE_NULL /* Darwin */ 572#define AUE_O_MMAP AUE_MMAP /* Darwin */ 573#define AUE_O_VADVISE AUE_NULL /* Darwin */ 574#define AUE_O_VHANGUP AUE_NULL /* Darwin */ 575#define AUE_O_VLIMIT AUE_NULL /* Darwin */ 576#define AUE_O_WAIT AUE_NULL /* Darwin */ 577#define AUE_O_GETHOSTNAME AUE_NULL /* Darwin */ 578#define AUE_O_SETHOSTNAME AUE_SYSCTL /* Darwin */ 579#define AUE_O_GETDOPT AUE_NULL /* Darwin */ 580#define AUE_O_SETDOPT AUE_NULL /* Darwin */ 581#define AUE_O_ACCEPT AUE_NULL /* Darwin */ 582#define AUE_O_SEND AUE_SENDMSG /* Darwin */ 583#define AUE_O_RECV AUE_RECVMSG /* Darwin */ 584#define AUE_O_VTIMES AUE_NULL /* Darwin */ 585#define AUE_O_SIGVEC AUE_NULL /* Darwin */ 586#define AUE_O_SIGBLOCK AUE_NULL /* Darwin */ 587#define AUE_O_SIGSETMASK AUE_NULL /* Darwin */ 588#define AUE_O_SIGSTACK AUE_NULL /* Darwin */ 589#define AUE_O_RECVMSG AUE_RECVMSG /* Darwin */ 590#define AUE_O_SENDMSG AUE_SENDMSG /* Darwin */ 591#define AUE_O_VTRACE AUE_NULL /* Darwin */ 592#define AUE_O_RESUBA AUE_NULL /* Darwin */ 593#define AUE_O_RECVFROM AUE_RECVFROM /* Darwin */ 594#define AUE_O_SETREUID AUE_SETREUID /* Darwin */ 595#define AUE_O_SETREGID AUE_SETREGID /* Darwin */ 596#define AUE_O_GETDIRENTRIES AUE_GETDIRENTRIES /* Darwin */ 597#define AUE_O_TRUNCATE AUE_TRUNCATE /* Darwin */ 598#define AUE_O_FTRUNCATE AUE_FTRUNCATE /* Darwin */ 599#define AUE_O_GETPEERNAME AUE_NULL /* Darwin */ 600#define AUE_O_GETHOSTID AUE_NULL /* Darwin */ 601#define AUE_O_SETHOSTID AUE_NULL /* Darwin */ 602#define AUE_O_GETRLIMIT AUE_NULL /* Darwin */ 603#define AUE_O_SETRLIMIT AUE_SETRLIMIT /* Darwin */ 604#define AUE_O_KILLPG AUE_KILL /* Darwin */ 605#define AUE_O_SETQUOTA AUE_NULL /* Darwin */ 606#define AUE_O_QUOTA AUE_NULL /* Darwin */ 607#define AUE_O_GETSOCKNAME AUE_NULL /* Darwin */ 608#define AUE_O_GETDIREENTRIES AUE_GETDIREENTRIES /* Darwin */ 609#define AUE_O_ASYNCDAEMON AUE_NULL /* Darwin */ 610#define AUE_O_GETDOMAINNAME AUE_NULL /* Darwin */ 611#define AUE_O_SETDOMAINNAME AUE_SYSCTL /* Darwin */ 612#define AUE_O_PCFS_MOUNT AUE_NULL /* Darwin */ 613#define AUE_O_EXPORTFS AUE_NULL /* Darwin */ 614#define AUE_O_USTATE AUE_NULL /* Darwin */ 615#define AUE_O_WAIT3 AUE_NULL /* Darwin */ 616#define AUE_O_RPAUSE AUE_NULL /* Darwin */ 617#define AUE_O_GETDENTS AUE_NULL /* Darwin */ 618 619/* 620 * Possible desired future values based on review of BSD/Darwin system calls. 621 */ 622#define AUE_DUP AUE_NULL 623#define AUE_FSCTL AUE_NULL 624#define AUE_FSTATV AUE_NULL 625#define AUE_GCCONTROL AUE_NULL 626#define AUE_GETDTABLESIZE AUE_NULL 627#define AUE_GETEGID AUE_NULL 628#define AUE_GETEUID AUE_NULL 629#define AUE_GETGID AUE_NULL 630#define AUE_GETGROUPS AUE_NULL 631#define AUE_GETITIMER AUE_NULL 632#define AUE_GETLOGIN AUE_NULL 633#define AUE_GETPEERNAME AUE_NULL 634#define AUE_GETPGID AUE_NULL 635#define AUE_GETPGRP AUE_NULL 636#define AUE_GETPID AUE_NULL 637#define AUE_GETPPID AUE_NULL 638#define AUE_GETPRIORITY AUE_NULL 639#define AUE_GETRLIMIT AUE_NULL 640#define AUE_GETRUSAGE AUE_NULL 641#define AUE_GETSID AUE_NULL 642#define AUE_GETSOCKNAME AUE_NULL 643#define AUE_GETTIMEOFDAY AUE_NULL 644#define AUE_GETUID AUE_NULL 645#define AUE_GETSOCKOPT AUE_NULL 646#define AUE_GTSOCKOPT AUE_GETSOCKOPT /* XXX: Typo in Darwin. */ 647#define AUE_ISSETUGID AUE_NULL 648#define AUE_LSTATV AUE_NULL 649#define AUE_MADVISE AUE_NULL 650#define AUE_MINCORE AUE_NULL 651#define AUE_MKCOMPLEX AUE_NULL 652#define AUE_MODWATCH AUE_NULL 653#define AUE_MSGCL AUE_NULL 654#define AUE_MSYNC AUE_NULL 655#define AUE_PREAD AUE_NULL 656#define AUE_PWRITE AUE_NULL 657#define AUE_PREADV AUE_NULL 658#define AUE_PWRITEV AUE_NULL 659#define AUE_SBRK AUE_NULL 660#define AUE_SELECT AUE_NULL 661#define AUE_SEMDESTROY AUE_NULL 662#define AUE_SEMGETVALUE AUE_NULL 663#define AUE_SEMINIT AUE_NULL 664#define AUE_SEMPOST AUE_NULL 665#define AUE_SEMTRYWAIT AUE_NULL 666#define AUE_SEMWAIT AUE_NULL 667#define AUE_SETITIMER AUE_NULL 668#define AUE_SIGACTION AUE_NULL 669#define AUE_SIGALTSTACK AUE_NULL 670#define AUE_SIGPENDING AUE_NULL 671#define AUE_SIGPROCMASK AUE_NULL 672#define AUE_SIGRETURN AUE_NULL 673#define AUE_SIGSUSPEND AUE_NULL 674#define AUE_SIGWAIT AUE_NULL 675#define AUE_SSTK AUE_NULL 676#define AUE_STATV AUE_NULL 677#define AUE_SYNC AUE_NULL 678#define AUE_SYSCALL AUE_NULL 679#define AUE_TABLE AUE_NULL 680#define AUE_WAITEVENT AUE_NULL 681#define AUE_WATCHEVENT AUE_NULL 682 683#endif /* !_BSM_AUDIT_KEVENTS_H_ */ 684