]> git.saurik.com Git - apple/xnu.git/blame - bsd/bsm/audit_kevents.h
xnu-1699.32.7.tar.gz
[apple/xnu.git] / bsd / bsm / audit_kevents.h
CommitLineData
b0d623f7
A
1/*-
2 * Copyright (c) 2005-2009 Apple Inc.
3 * All rights reserved.
2d21ac55 4 *
b0d623f7
A
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 * 3. Neither the name of Apple Inc. ("Apple") nor the names of
15 * its contributors may be used to endorse or promote products derived
16 * from this software without specific prior written permission.
55e303ae 17 *
b0d623f7
A
18 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
19 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
20 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
21 * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
22 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
23 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
24 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
25 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
27 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
55e303ae 28 *
b0d623f7 29 * $P4: //depot/projects/trustedbsd/openbsm/sys/bsm/audit_kevents.h#6 $
55e303ae
A
30 */
31
b0d623f7
A
32#ifndef _BSM_AUDIT_KEVENTS_H_
33#define _BSM_AUDIT_KEVENTS_H_
55e303ae 34
b0d623f7
A
35/*
36 * The reserved event numbers for kernel events are 1...2047 and 43001..44900.
37 */
38#define AUE_IS_A_KEVENT(e) (((e) > 0 && (e) < 2048) || \
6d2010ae 39 ((e) > 43000 && (e) < 44901))
55e303ae 40
b0d623f7
A
41/*
42 * Values marked as AUE_NULL are not required to be audited as per CAPP.
43 *
44 * Some conflicts exist in the assignment of name to event number mappings
45 * between BSM implementations. In general, we prefer the OpenSolaris
46 * definition as we consider Solaris BSM to be authoritative. _DARWIN_ has
47 * been inserted for the Darwin variants. If necessary, other tags will be
48 * added in the future.
49 */
50#define AUE_NULL 0
51#define AUE_EXIT 1
52#define AUE_FORK 2
53#define AUE_FORKALL AUE_FORK /* Solaris-specific. */
54#define AUE_OPEN 3
55#define AUE_CREAT 4
56#define AUE_LINK 5
57#define AUE_UNLINK 6
58#define AUE_DELETE AUE_UNLINK /* Darwin-specific. */
59#define AUE_EXEC 7
60#define AUE_CHDIR 8
61#define AUE_MKNOD 9
62#define AUE_CHMOD 10
63#define AUE_CHOWN 11
64#define AUE_UMOUNT 12
65#define AUE_JUNK 13 /* Solaris-specific. */
66#define AUE_ACCESS 14
67#define AUE_KILL 15
68#define AUE_STAT 16
69#define AUE_LSTAT 17
70#define AUE_ACCT 18
71#define AUE_MCTL 19 /* Solaris-specific. */
72#define AUE_REBOOT 20 /* XXX: Darwin conflict. */
73#define AUE_SYMLINK 21
74#define AUE_READLINK 22
75#define AUE_EXECVE 23
76#define AUE_CHROOT 24
77#define AUE_VFORK 25
78#define AUE_SETGROUPS 26
79#define AUE_SETPGRP 27
80#define AUE_SWAPON 28
81#define AUE_SETHOSTNAME 29 /* XXX: Darwin conflict. */
82#define AUE_FCNTL 30
83#define AUE_SETPRIORITY 31 /* XXX: Darwin conflict. */
84#define AUE_CONNECT 32
85#define AUE_ACCEPT 33
86#define AUE_BIND 34
87#define AUE_SETSOCKOPT 35
88#define AUE_VTRACE 36 /* Solaris-specific. */
89#define AUE_SETTIMEOFDAY 37 /* XXX: Darwin conflict. */
90#define AUE_FCHOWN 38
91#define AUE_FCHMOD 39
92#define AUE_SETREUID 40
93#define AUE_SETREGID 41
94#define AUE_RENAME 42
95#define AUE_TRUNCATE 43 /* XXX: Darwin conflict. */
96#define AUE_FTRUNCATE 44 /* XXX: Darwin conflict. */
97#define AUE_FLOCK 45 /* XXX: Darwin conflict. */
98#define AUE_SHUTDOWN 46
99#define AUE_MKDIR 47
100#define AUE_RMDIR 48
101#define AUE_UTIMES 49
102#define AUE_ADJTIME 50
103#define AUE_SETRLIMIT 51
104#define AUE_KILLPG 52
105#define AUE_NFS_SVC 53 /* XXX: Darwin conflict. */
106#define AUE_STATFS 54
107#define AUE_FSTATFS 55
108#define AUE_UNMOUNT 56 /* XXX: Darwin conflict. */
109#define AUE_ASYNC_DAEMON 57
110#define AUE_NFS_GETFH 58 /* XXX: Darwin conflict. */
111#define AUE_SETDOMAINNAME 59
112#define AUE_QUOTACTL 60 /* XXX: Darwin conflict. */
113#define AUE_EXPORTFS 61
114#define AUE_MOUNT 62
115#define AUE_SEMSYS 63
116#define AUE_MSGSYS 64
117#define AUE_SHMSYS 65
118#define AUE_BSMSYS 66 /* Solaris-specific. */
119#define AUE_RFSSYS 67 /* Solaris-specific. */
120#define AUE_FCHDIR 68
121#define AUE_FCHROOT 69
122#define AUE_VPIXSYS 70 /* Solaris-specific. */
123#define AUE_PATHCONF 71
124#define AUE_OPEN_R 72
125#define AUE_OPEN_RC 73
126#define AUE_OPEN_RT 74
127#define AUE_OPEN_RTC 75
128#define AUE_OPEN_W 76
129#define AUE_OPEN_WC 77
130#define AUE_OPEN_WT 78
131#define AUE_OPEN_WTC 79
132#define AUE_OPEN_RW 80
133#define AUE_OPEN_RWC 81
134#define AUE_OPEN_RWT 82
135#define AUE_OPEN_RWTC 83
136#define AUE_MSGCTL 84
137#define AUE_MSGCTL_RMID 85
138#define AUE_MSGCTL_SET 86
139#define AUE_MSGCTL_STAT 87
140#define AUE_MSGGET 88
141#define AUE_MSGRCV 89
142#define AUE_MSGSND 90
143#define AUE_SHMCTL 91
144#define AUE_SHMCTL_RMID 92
145#define AUE_SHMCTL_SET 93
146#define AUE_SHMCTL_STAT 94
147#define AUE_SHMGET 95
148#define AUE_SHMAT 96
149#define AUE_SHMDT 97
150#define AUE_SEMCTL 98
151#define AUE_SEMCTL_RMID 99
152#define AUE_SEMCTL_SET 100
153#define AUE_SEMCTL_STAT 101
154#define AUE_SEMCTL_GETNCNT 102
155#define AUE_SEMCTL_GETPID 103
156#define AUE_SEMCTL_GETVAL 104
157#define AUE_SEMCTL_GETALL 105
158#define AUE_SEMCTL_GETZCNT 106
159#define AUE_SEMCTL_SETVAL 107
160#define AUE_SEMCTL_SETALL 108
161#define AUE_SEMGET 109
162#define AUE_SEMOP 110
163#define AUE_CORE 111 /* Solaris-specific, currently. */
164#define AUE_CLOSE 112
165#define AUE_SYSTEMBOOT 113 /* Solaris-specific. */
166#define AUE_ASYNC_DAEMON_EXIT 114 /* Solaris-specific. */
167#define AUE_NFSSVC_EXIT 115 /* Solaris-specific. */
168#define AUE_WRITEL 128 /* Solaris-specific. */
169#define AUE_WRITEVL 129 /* Solaris-specific. */
170#define AUE_GETAUID 130
171#define AUE_SETAUID 131
172#define AUE_GETAUDIT 132
173#define AUE_SETAUDIT 133
174#define AUE_GETUSERAUDIT 134 /* Solaris-specific. */
175#define AUE_SETUSERAUDIT 135 /* Solaris-specific. */
176#define AUE_AUDITSVC 136 /* Solaris-specific. */
177#define AUE_AUDITUSER 137 /* Solaris-specific. */
178#define AUE_AUDITON 138
179#define AUE_AUDITON_GTERMID 139 /* Solaris-specific. */
180#define AUE_AUDITON_STERMID 140 /* Solaris-specific. */
181#define AUE_AUDITON_GPOLICY 141
182#define AUE_AUDITON_SPOLICY 142
183#define AUE_AUDITON_GQCTRL 145
184#define AUE_AUDITON_SQCTRL 146
185#define AUE_GETKERNSTATE 147 /* Solaris-specific. */
186#define AUE_SETKERNSTATE 148 /* Solaris-specific. */
187#define AUE_GETPORTAUDIT 149 /* Solaris-specific. */
188#define AUE_AUDITSTAT 150 /* Solaris-specific. */
189#define AUE_REVOKE 151
190#define AUE_MAC 152 /* Solaris-specific. */
191#define AUE_ENTERPROM 153 /* Solaris-specific. */
192#define AUE_EXITPROM 154 /* Solaris-specific. */
193#define AUE_IFLOAT 155 /* Solaris-specific. */
194#define AUE_PFLOAT 156 /* Solaris-specific. */
195#define AUE_UPRIV 157 /* Solaris-specific. */
196#define AUE_IOCTL 158
197#define AUE_SOCKET 183
198#define AUE_SENDTO 184
199#define AUE_PIPE 185
200#define AUE_SOCKETPAIR 186 /* XXX: Darwin conflict. */
201#define AUE_SEND 187
202#define AUE_SENDMSG 188
203#define AUE_RECV 189
204#define AUE_RECVMSG 190
205#define AUE_RECVFROM 191
206#define AUE_READ 192
207#define AUE_GETDENTS 193
208#define AUE_LSEEK 194
209#define AUE_WRITE 195
210#define AUE_WRITEV 196
211#define AUE_NFS 197 /* Solaris-specific. */
212#define AUE_READV 198
213#define AUE_OSTAT 199 /* Solaris-specific. */
214#define AUE_SETUID 200 /* XXXRW: Solaris old setuid? */
215#define AUE_STIME 201 /* XXXRW: Solaris old stime? */
216#define AUE_UTIME 202 /* XXXRW: Solaris old utime? */
217#define AUE_NICE 203 /* XXXRW: Solaris old nice? */
218#define AUE_OSETPGRP 204 /* Solaris-specific. */
219#define AUE_SETGID 205
220#define AUE_READL 206 /* Solaris-specific. */
221#define AUE_READVL 207 /* Solaris-specific. */
222#define AUE_FSTAT 208
223#define AUE_DUP2 209
224#define AUE_MMAP 210
225#define AUE_AUDIT 211
226#define AUE_PRIOCNTLSYS 212 /* Solaris-specific. */
227#define AUE_MUNMAP 213
228#define AUE_SETEGID 214
229#define AUE_SETEUID 215
230#define AUE_PUTMSG 216 /* Solaris-specific. */
231#define AUE_GETMSG 217 /* Solaris-specific. */
232#define AUE_PUTPMSG 218 /* Solaris-specific. */
233#define AUE_GETPMSG 219 /* Solaris-specific. */
234#define AUE_AUDITSYS 220 /* Solaris-specific. */
235#define AUE_AUDITON_GETKMASK 221
236#define AUE_AUDITON_SETKMASK 222
237#define AUE_AUDITON_GETCWD 223
238#define AUE_AUDITON_GETCAR 224
239#define AUE_AUDITON_GETSTAT 225
240#define AUE_AUDITON_SETSTAT 226
241#define AUE_AUDITON_SETUMASK 227
242#define AUE_AUDITON_SETSMASK 228
243#define AUE_AUDITON_GETCOND 229
244#define AUE_AUDITON_SETCOND 230
245#define AUE_AUDITON_GETCLASS 231
246#define AUE_AUDITON_SETCLASS 232
247#define AUE_FUSERS 233 /* Solaris-specific; also UTSSYS? */
248#define AUE_STATVFS 234
249#define AUE_XSTAT 235 /* Solaris-specific. */
250#define AUE_LXSTAT 236 /* Solaris-specific. */
251#define AUE_LCHOWN 237
252#define AUE_MEMCNTL 238 /* Solaris-specific. */
253#define AUE_SYSINFO 239 /* Solaris-specific. */
254#define AUE_XMKNOD 240 /* Solaris-specific. */
255#define AUE_FORK1 241
256#define AUE_MODCTL 242 /* Solaris-specific. */
257#define AUE_MODLOAD 243
258#define AUE_MODUNLOAD 244
259#define AUE_MODCONFIG 245 /* Solaris-specific. */
260#define AUE_MODADDMAJ 246 /* Solaris-specific. */
261#define AUE_SOCKACCEPT 247 /* Solaris-specific. */
262#define AUE_SOCKCONNECT 248 /* Solaris-specific. */
263#define AUE_SOCKSEND 249 /* Solaris-specific. */
264#define AUE_SOCKRECEIVE 250 /* Solaris-specific. */
265#define AUE_ACLSET 251
266#define AUE_FACLSET 252
267#define AUE_DOORFS 253 /* Solaris-specific. */
268#define AUE_DOORFS_DOOR_CALL 254 /* Solaris-specific. */
269#define AUE_DOORFS_DOOR_RETURN 255 /* Solaris-specific. */
270#define AUE_DOORFS_DOOR_CREATE 256 /* Solaris-specific. */
271#define AUE_DOORFS_DOOR_REVOKE 257 /* Solaris-specific. */
272#define AUE_DOORFS_DOOR_INFO 258 /* Solaris-specific. */
273#define AUE_DOORFS_DOOR_CRED 259 /* Solaris-specific. */
274#define AUE_DOORFS_DOOR_BIND 260 /* Solaris-specific. */
275#define AUE_DOORFS_DOOR_UNBIND 261 /* Solaris-specific. */
276#define AUE_P_ONLINE 262 /* Solaris-specific. */
277#define AUE_PROCESSOR_BIND 263 /* Solaris-specific. */
278#define AUE_INST_SYNC 264 /* Solaris-specific. */
279#define AUE_SOCKCONFIG 265 /* Solaris-specific. */
280#define AUE_SETAUDIT_ADDR 266
281#define AUE_GETAUDIT_ADDR 267
282#define AUE_UMOUNT2 268 /* Solaris-specific. */
283#define AUE_FSAT 269 /* Solaris-specific. */
284#define AUE_OPENAT_R 270
285#define AUE_OPENAT_RC 271
286#define AUE_OPENAT_RT 272
287#define AUE_OPENAT_RTC 273
288#define AUE_OPENAT_W 274
289#define AUE_OPENAT_WC 275
290#define AUE_OPENAT_WT 276
291#define AUE_OPENAT_WTC 277
292#define AUE_OPENAT_RW 278
293#define AUE_OPENAT_RWC 279
294#define AUE_OPENAT_RWT 280
295#define AUE_OPENAT_RWTC 281
296#define AUE_RENAMEAT 282
297#define AUE_FSTATAT 283
298#define AUE_FCHOWNAT 284
299#define AUE_FUTIMESAT 285
300#define AUE_UNLINKAT 286
301#define AUE_CLOCK_SETTIME 287
302#define AUE_NTP_ADJTIME 288
303#define AUE_SETPPRIV 289 /* Solaris-specific. */
304#define AUE_MODDEVPLCY 290 /* Solaris-specific. */
305#define AUE_MODADDPRIV 291 /* Solaris-specific. */
306#define AUE_CRYPTOADM 292 /* Solaris-specific. */
307#define AUE_CONFIGKSSL 293 /* Solaris-specific. */
308#define AUE_BRANDSYS 294 /* Solaris-specific. */
309#define AUE_PF_POLICY_ADDRULE 295 /* Solaris-specific. */
310#define AUE_PF_POLICY_DELRULE 296 /* Solaris-specific. */
311#define AUE_PF_POLICY_CLONE 297 /* Solaris-specific. */
312#define AUE_PF_POLICY_FLIP 298 /* Solaris-specific. */
313#define AUE_PF_POLICY_FLUSH 299 /* Solaris-specific. */
314#define AUE_PF_POLICY_ALGS 300 /* Solaris-specific. */
315#define AUE_PORTFS 301 /* Solaris-specific. */
55e303ae 316
b0d623f7
A
317/*
318 * Events added for Apple Darwin that potentially collide with future Solaris
319 * BSM events. These are assigned AUE_DARWIN prefixes, and are deprecated in
320 * new trails. Systems generating these events should switch to the new
321 * identifiers that avoid colliding with the Solaris identifier space.
322 */
323#define AUE_DARWIN_GETFSSTAT 301
324#define AUE_DARWIN_PTRACE 302
325#define AUE_DARWIN_CHFLAGS 303
326#define AUE_DARWIN_FCHFLAGS 304
327#define AUE_DARWIN_PROFILE 305
328#define AUE_DARWIN_KTRACE 306
329#define AUE_DARWIN_SETLOGIN 307
330#define AUE_DARWIN_REBOOT 308
331#define AUE_DARWIN_REVOKE 309
332#define AUE_DARWIN_UMASK 310
333#define AUE_DARWIN_MPROTECT 311
334#define AUE_DARWIN_SETPRIORITY 312
335#define AUE_DARWIN_SETTIMEOFDAY 313
336#define AUE_DARWIN_FLOCK 314
337#define AUE_DARWIN_MKFIFO 315
338#define AUE_DARWIN_POLL 316
339#define AUE_DARWIN_SOCKETPAIR 317
340#define AUE_DARWIN_FUTIMES 318
341#define AUE_DARWIN_SETSID 319
342#define AUE_DARWIN_SETPRIVEXEC 320 /* Darwin-specific. */
343#define AUE_DARWIN_NFSSVC 321
344#define AUE_DARWIN_GETFH 322
345#define AUE_DARWIN_QUOTACTL 323
346#define AUE_DARWIN_ADDPROFILE 324 /* Darwin-specific. */
347#define AUE_DARWIN_KDEBUGTRACE 325 /* Darwin-specific. */
348#define AUE_DARWIN_KDBUGTRACE AUE_KDEBUGTRACE
349#define AUE_DARWIN_FSTAT 326
350#define AUE_DARWIN_FPATHCONF 327
351#define AUE_DARWIN_GETDIRENTRIES 328
352#define AUE_DARWIN_TRUNCATE 329
353#define AUE_DARWIN_FTRUNCATE 330
354#define AUE_DARWIN_SYSCTL 331
355#define AUE_DARWIN_MLOCK 332
356#define AUE_DARWIN_MUNLOCK 333
357#define AUE_DARWIN_UNDELETE 334
358#define AUE_DARWIN_GETATTRLIST 335 /* Darwin-specific. */
359#define AUE_DARWIN_SETATTRLIST 336 /* Darwin-specific. */
360#define AUE_DARWIN_GETDIRENTRIESATTR 337 /* Darwin-specific. */
361#define AUE_DARWIN_EXCHANGEDATA 338 /* Darwin-specific. */
362#define AUE_DARWIN_SEARCHFS 339 /* Darwin-specific. */
363#define AUE_DARWIN_MINHERIT 340
364#define AUE_DARWIN_SEMCONFIG 341
365#define AUE_DARWIN_SEMOPEN 342
366#define AUE_DARWIN_SEMCLOSE 343
367#define AUE_DARWIN_SEMUNLINK 344
368#define AUE_DARWIN_SHMOPEN 345
369#define AUE_DARWIN_SHMUNLINK 346
370#define AUE_DARWIN_LOADSHFILE 347 /* Darwin-specific. */
371#define AUE_DARWIN_RESETSHFILE 348 /* Darwin-specific. */
372#define AUE_DARWIN_NEWSYSTEMSHREG 349 /* Darwin-specific. */
373#define AUE_DARWIN_PTHREADKILL 350 /* Darwin-specific. */
374#define AUE_DARWIN_PTHREADSIGMASK 351 /* Darwin-specific. */
375#define AUE_DARWIN_AUDITCTL 352
376#define AUE_DARWIN_RFORK 353
377#define AUE_DARWIN_LCHMOD 354
378#define AUE_DARWIN_SWAPOFF 355
379#define AUE_DARWIN_INITPROCESS 356 /* Darwin-specific. */
380#define AUE_DARWIN_MAPFD 357 /* Darwin-specific. */
381#define AUE_DARWIN_TASKFORPID 358 /* Darwin-specific. */
382#define AUE_DARWIN_PIDFORTASK 359 /* Darwin-specific. */
383#define AUE_DARWIN_SYSCTL_NONADMIN 360
384#define AUE_DARWIN_COPYFILE 361 /* Darwin-specific. */
55e303ae 385
b0d623f7
A
386/*
387 * Audit event identifiers added as part of OpenBSM, generally corresponding
388 * to events in FreeBSD, Darwin, and Linux that were not present in Solaris.
389 * These often duplicate events added to the Solaris set by Darwin, but use
390 * event identifiers in a higher range in order to avoid colliding with
391 * future Solaris additions.
392 *
393 * If an event in this section is later added to Solaris, we prefer the
394 * Solaris event identifier, and add _OPENBSM_ to the OpenBSM-specific
395 * identifier so that old trails can still be processed, but new trails use
396 * the Solaris identifier.
397 */
398#define AUE_GETFSSTAT 43001
399#define AUE_PTRACE 43002
400#define AUE_CHFLAGS 43003
401#define AUE_FCHFLAGS 43004
402#define AUE_PROFILE 43005
403#define AUE_KTRACE 43006
404#define AUE_SETLOGIN 43007
405#define AUE_OPENBSM_REVOKE 43008 /* Solaris event now preferred. */
406#define AUE_UMASK 43009
407#define AUE_MPROTECT 43010
408#define AUE_MKFIFO 43011
409#define AUE_POLL 43012
410#define AUE_FUTIMES 43013
411#define AUE_SETSID 43014
412#define AUE_SETPRIVEXEC 43015 /* Darwin-specific. */
413#define AUE_ADDPROFILE 43016 /* Darwin-specific. */
414#define AUE_KDEBUGTRACE 43017 /* Darwin-specific. */
415#define AUE_KDBUGTRACE AUE_KDEBUGTRACE
416#define AUE_OPENBSM_FSTAT 43018 /* Solaris event now preferred. */
417#define AUE_FPATHCONF 43019
418#define AUE_GETDIRENTRIES 43020
419#define AUE_SYSCTL 43021
420#define AUE_MLOCK 43022
421#define AUE_MUNLOCK 43023
422#define AUE_UNDELETE 43024
423#define AUE_GETATTRLIST 43025 /* Darwin-specific. */
424#define AUE_SETATTRLIST 43026 /* Darwin-specific. */
425#define AUE_GETDIRENTRIESATTR 43027 /* Darwin-specific. */
426#define AUE_EXCHANGEDATA 43028 /* Darwin-specific. */
427#define AUE_SEARCHFS 43029 /* Darwin-specific. */
428#define AUE_MINHERIT 43030
429#define AUE_SEMCONFIG 43031
430#define AUE_SEMOPEN 43032
431#define AUE_SEMCLOSE 43033
432#define AUE_SEMUNLINK 43034
433#define AUE_SHMOPEN 43035
434#define AUE_SHMUNLINK 43036
435#define AUE_LOADSHFILE 43037 /* Darwin-specific. */
436#define AUE_RESETSHFILE 43038 /* Darwin-specific. */
437#define AUE_NEWSYSTEMSHREG 43039 /* Darwin-specific. */
438#define AUE_PTHREADKILL 43040 /* Darwin-specific. */
439#define AUE_PTHREADSIGMASK 43041 /* Darwin-specific. */
440#define AUE_AUDITCTL 43042
441#define AUE_RFORK 43043
442#define AUE_LCHMOD 43044
443#define AUE_SWAPOFF 43045
444#define AUE_INITPROCESS 43046 /* Darwin-specific. */
445#define AUE_MAPFD 43047 /* Darwin-specific. */
446#define AUE_TASKFORPID 43048 /* Darwin-specific. */
447#define AUE_PIDFORTASK 43049 /* Darwin-specific. */
448#define AUE_SYSCTL_NONADMIN 43050
449#define AUE_COPYFILE 43051 /* Darwin-specific. */
55e303ae 450
b0d623f7
A
451/*
452 * Events added to OpenBSM for FreeBSD and Linux; may also be used by Darwin
453 * in the future.
454 */
455#define AUE_LUTIMES 43052
456#define AUE_LCHFLAGS 43053 /* FreeBSD-specific. */
457#define AUE_SENDFILE 43054 /* BSD/Linux-specific. */
458#define AUE_USELIB 43055 /* Linux-specific. */
459#define AUE_GETRESUID 43056
460#define AUE_SETRESUID 43057
461#define AUE_GETRESGID 43058
462#define AUE_SETRESGID 43059
463#define AUE_WAIT4 43060 /* FreeBSD-specific. */
464#define AUE_LGETFH 43061 /* FreeBSD-specific. */
465#define AUE_FHSTATFS 43062 /* FreeBSD-specific. */
466#define AUE_FHOPEN 43063 /* FreeBSD-specific. */
467#define AUE_FHSTAT 43064 /* FreeBSD-specific. */
468#define AUE_JAIL 43065 /* FreeBSD-specific. */
469#define AUE_EACCESS 43066 /* FreeBSD-specific. */
470#define AUE_KQUEUE 43067 /* FreeBSD-specific. */
471#define AUE_KEVENT 43068 /* FreeBSD-specific. */
472#define AUE_FSYNC 43069
473#define AUE_NMOUNT 43070 /* FreeBSD-specific. */
474#define AUE_BDFLUSH 43071 /* Linux-specific. */
475#define AUE_SETFSUID 43072 /* Linux-specific. */
476#define AUE_SETFSGID 43073 /* Linux-specific. */
477#define AUE_PERSONALITY 43074 /* Linux-specific. */
478#define AUE_SCHED_GETSCHEDULER 43075 /* POSIX.1b. */
479#define AUE_SCHED_SETSCHEDULER 43076 /* POSIX.1b. */
480#define AUE_PRCTL 43077 /* Linux-specific. */
481#define AUE_GETCWD 43078 /* FreeBSD/Linux-specific. */
482#define AUE_CAPGET 43079 /* Linux-specific. */
483#define AUE_CAPSET 43080 /* Linux-specific. */
484#define AUE_PIVOT_ROOT 43081 /* Linux-specific. */
485#define AUE_RTPRIO 43082 /* FreeBSD-specific. */
486#define AUE_SCHED_GETPARAM 43083 /* POSIX.1b. */
487#define AUE_SCHED_SETPARAM 43084 /* POSIX.1b. */
488#define AUE_SCHED_GET_PRIORITY_MAX 43085 /* POSIX.1b. */
489#define AUE_SCHED_GET_PRIORITY_MIN 43086 /* POSIX.1b. */
490#define AUE_SCHED_RR_GET_INTERVAL 43087 /* POSIX.1b. */
491#define AUE_ACL_GET_FILE 43088 /* FreeBSD. */
492#define AUE_ACL_SET_FILE 43089 /* FreeBSD. */
493#define AUE_ACL_GET_FD 43090 /* FreeBSD. */
494#define AUE_ACL_SET_FD 43091 /* FreeBSD. */
495#define AUE_ACL_DELETE_FILE 43092 /* FreeBSD. */
496#define AUE_ACL_DELETE_FD 43093 /* FreeBSD. */
497#define AUE_ACL_CHECK_FILE 43094 /* FreeBSD. */
498#define AUE_ACL_CHECK_FD 43095 /* FreeBSD. */
499#define AUE_ACL_GET_LINK 43096 /* FreeBSD. */
500#define AUE_ACL_SET_LINK 43097 /* FreeBSD. */
501#define AUE_ACL_DELETE_LINK 43098 /* FreeBSD. */
502#define AUE_ACL_CHECK_LINK 43099 /* FreeBSD. */
503#define AUE_SYSARCH 43100 /* FreeBSD. */
504#define AUE_EXTATTRCTL 43101 /* FreeBSD. */
505#define AUE_EXTATTR_GET_FILE 43102 /* FreeBSD. */
506#define AUE_EXTATTR_SET_FILE 43103 /* FreeBSD. */
507#define AUE_EXTATTR_LIST_FILE 43104 /* FreeBSD. */
508#define AUE_EXTATTR_DELETE_FILE 43105 /* FreeBSD. */
509#define AUE_EXTATTR_GET_FD 43106 /* FreeBSD. */
510#define AUE_EXTATTR_SET_FD 43107 /* FreeBSD. */
511#define AUE_EXTATTR_LIST_FD 43108 /* FreeBSD. */
512#define AUE_EXTATTR_DELETE_FD 43109 /* FreeBSD. */
513#define AUE_EXTATTR_GET_LINK 43110 /* FreeBSD. */
514#define AUE_EXTATTR_SET_LINK 43111 /* FreeBSD. */
515#define AUE_EXTATTR_LIST_LINK 43112 /* FreeBSD. */
516#define AUE_EXTATTR_DELETE_LINK 43113 /* FreeBSD. */
517#define AUE_KENV 43114 /* FreeBSD. */
518#define AUE_JAIL_ATTACH 43115 /* FreeBSD. */
519#define AUE_SYSCTL_WRITE 43116 /* FreeBSD. */
520#define AUE_IOPERM 43117 /* Linux. */
521#define AUE_READDIR 43118 /* Linux. */
522#define AUE_IOPL 43119 /* Linux. */
523#define AUE_VM86 43120 /* Linux. */
524#define AUE_MAC_GET_PROC 43121 /* FreeBSD/Darwin. */
525#define AUE_MAC_SET_PROC 43122 /* FreeBSD/Darwin. */
526#define AUE_MAC_GET_FD 43123 /* FreeBSD/Darwin. */
527#define AUE_MAC_GET_FILE 43124 /* FreeBSD/Darwin. */
528#define AUE_MAC_SET_FD 43125 /* FreeBSD/Darwin. */
529#define AUE_MAC_SET_FILE 43126 /* FreeBSD/Darwin. */
530#define AUE_MAC_SYSCALL 43127 /* FreeBSD. */
531#define AUE_MAC_GET_PID 43128 /* FreeBSD/Darwin. */
532#define AUE_MAC_GET_LINK 43129 /* FreeBSD/Darwin. */
533#define AUE_MAC_SET_LINK 43130 /* FreeBSD/Darwin. */
534#define AUE_MAC_EXECVE 43131 /* FreeBSD/Darwin. */
535#define AUE_GETPATH_FROMFD 43132 /* FreeBSD. */
536#define AUE_GETPATH_FROMADDR 43133 /* FreeBSD. */
537#define AUE_MQ_OPEN 43134 /* FreeBSD. */
538#define AUE_MQ_SETATTR 43135 /* FreeBSD. */
539#define AUE_MQ_TIMEDRECEIVE 43136 /* FreeBSD. */
540#define AUE_MQ_TIMEDSEND 43137 /* FreeBSD. */
541#define AUE_MQ_NOTIFY 43138 /* FreeBSD. */
542#define AUE_MQ_UNLINK 43139 /* FreeBSD. */
543#define AUE_LISTEN 43140 /* FreeBSD/Darwin/Linux. */
544#define AUE_MLOCKALL 43141 /* FreeBSD. */
545#define AUE_MUNLOCKALL 43142 /* FreeBSD. */
546#define AUE_CLOSEFROM 43143 /* FreeBSD. */
547#define AUE_FEXECVE 43144 /* FreeBSD. */
548#define AUE_FACCESSAT 43145 /* FreeBSD. */
549#define AUE_FCHMODAT 43146 /* FreeBSD. */
550#define AUE_LINKAT 43147 /* FreeBSD. */
551#define AUE_MKDIRAT 43148 /* FreeBSD. */
552#define AUE_MKFIFOAT 43149 /* FreeBSD. */
553#define AUE_MKNODAT 43150 /* FreeBSD. */
554#define AUE_READLINKAT 43151 /* FreeBSD. */
555#define AUE_SYMLINKAT 43152 /* FreeBSD. */
556#define AUE_MAC_GETFSSTAT 43153 /* Darwin. */
557#define AUE_MAC_GET_MOUNT 43154 /* Darwin. */
558#define AUE_MAC_GET_LCID 43155 /* Darwin. */
559#define AUE_MAC_GET_LCTX 43156 /* Darwin. */
560#define AUE_MAC_SET_LCTX 43157 /* Darwin. */
561#define AUE_MAC_MOUNT 43158 /* Darwin. */
562#define AUE_GETLCID 43159 /* Darwin. */
563#define AUE_SETLCID 43160 /* Darwin. */
564#define AUE_TASKNAMEFORPID 43161 /* Darwin. */
565#define AUE_ACCESS_EXTENDED 43162 /* Darwin. */
566#define AUE_CHMOD_EXTENDED 43163 /* Darwin. */
567#define AUE_FCHMOD_EXTENDED 43164 /* Darwin. */
568#define AUE_FSTAT_EXTENDED 43165 /* Darwin. */
569#define AUE_LSTAT_EXTENDED 43166 /* Darwin. */
570#define AUE_MKDIR_EXTENDED 43167 /* Darwin. */
571#define AUE_MKFIFO_EXTENDED 43168 /* Darwin. */
572#define AUE_OPEN_EXTENDED 43169 /* Darwin. */
573#define AUE_OPEN_EXTENDED_R 43170 /* Darwin. */
574#define AUE_OPEN_EXTENDED_RC 43171 /* Darwin. */
575#define AUE_OPEN_EXTENDED_RT 43172 /* Darwin. */
576#define AUE_OPEN_EXTENDED_RTC 43173 /* Darwin. */
577#define AUE_OPEN_EXTENDED_W 43174 /* Darwin. */
578#define AUE_OPEN_EXTENDED_WC 43175 /* Darwin. */
579#define AUE_OPEN_EXTENDED_WT 43176 /* Darwin. */
580#define AUE_OPEN_EXTENDED_WTC 43177 /* Darwin. */
581#define AUE_OPEN_EXTENDED_RW 43178 /* Darwin. */
582#define AUE_OPEN_EXTENDED_RWC 43179 /* Darwin. */
583#define AUE_OPEN_EXTENDED_RWT 43180 /* Darwin. */
584#define AUE_OPEN_EXTENDED_RWTC 43181 /* Darwin. */
585#define AUE_STAT_EXTENDED 43182 /* Darwin. */
586#define AUE_UMASK_EXTENDED 43183 /* Darwin. */
587#define AUE_OPENAT 43184 /* FreeBSD. */
588#define AUE_POSIX_OPENPT 43185 /* FreeBSD. */
589#define AUE_CAP_NEW 43186 /* TrustedBSD. */
590#define AUE_CAP_GETRIGHTS 43187 /* TrustedBSD. */
591#define AUE_CAP_ENTER 43188 /* TrustedBSD. */
592#define AUE_CAP_GETMODE 43189 /* TrustedBSD. */
593#define AUE_POSIX_SPAWN 43190 /* Darwin. */
594#define AUE_FSGETPATH 43191 /* Darwin. */
595#define AUE_PREAD 43192 /* Darwin/FreeBSD. */
596#define AUE_PWRITE 43193 /* Darwin/FreeBSD. */
597#define AUE_FSCTL 43194 /* Darwin. */
598#define AUE_FFSCTL 43195 /* Darwin. */
6d2010ae
A
599#define AUE_LPATHCONF 43196 /* FreeBSD. */
600#define AUE_PDFORK 43197 /* FreeBSD. */
601#define AUE_PDKILL 43198 /* FreeBSD. */
602#define AUE_PDGETPID 43199 /* FreeBSD. */
603#define AUE_PDWAIT 43200 /* FreeBSD. */
604
605#define AUE_SESSION_START 44901 /* Darwin. */
606#define AUE_SESSION_UPDATE 44902 /* Darwin. */
607#define AUE_SESSION_END 44903 /* Darwin. */
608#define AUE_SESSION_CLOSE 44904 /* Darwin. */
55e303ae 609
b0d623f7
A
610/*
611 * Darwin BSM uses a number of AUE_O_* definitions, which are aliased to the
612 * normal Solaris BSM identifiers. _O_ refers to it being an old, or compat
613 * interface. In most cases, Darwin has never implemented these system calls
614 * but picked up the fields in their system call table from their FreeBSD
615 * import. Happily, these have different names than the AUE_O* definitions
616 * in Solaris BSM.
617 */
618#define AUE_O_CREAT AUE_OPEN_RWTC /* Darwin */
619#define AUE_O_EXECVE AUE_NULL /* Darwin */
620#define AUE_O_SBREAK AUE_NULL /* Darwin */
621#define AUE_O_LSEEK AUE_NULL /* Darwin */
622#define AUE_O_MOUNT AUE_NULL /* Darwin */
623#define AUE_O_UMOUNT AUE_NULL /* Darwin */
624#define AUE_O_STAT AUE_STAT /* Darwin */
625#define AUE_O_LSTAT AUE_LSTAT /* Darwin */
626#define AUE_O_FSTAT AUE_FSTAT /* Darwin */
627#define AUE_O_GETPAGESIZE AUE_NULL /* Darwin */
628#define AUE_O_VREAD AUE_NULL /* Darwin */
629#define AUE_O_VWRITE AUE_NULL /* Darwin */
630#define AUE_O_MMAP AUE_MMAP /* Darwin */
631#define AUE_O_VADVISE AUE_NULL /* Darwin */
632#define AUE_O_VHANGUP AUE_NULL /* Darwin */
633#define AUE_O_VLIMIT AUE_NULL /* Darwin */
634#define AUE_O_WAIT AUE_NULL /* Darwin */
635#define AUE_O_GETHOSTNAME AUE_NULL /* Darwin */
636#define AUE_O_SETHOSTNAME AUE_SYSCTL /* Darwin */
637#define AUE_O_GETDOPT AUE_NULL /* Darwin */
638#define AUE_O_SETDOPT AUE_NULL /* Darwin */
639#define AUE_O_ACCEPT AUE_NULL /* Darwin */
640#define AUE_O_SEND AUE_SENDMSG /* Darwin */
641#define AUE_O_RECV AUE_RECVMSG /* Darwin */
642#define AUE_O_VTIMES AUE_NULL /* Darwin */
643#define AUE_O_SIGVEC AUE_NULL /* Darwin */
644#define AUE_O_SIGBLOCK AUE_NULL /* Darwin */
645#define AUE_O_SIGSETMASK AUE_NULL /* Darwin */
646#define AUE_O_SIGSTACK AUE_NULL /* Darwin */
647#define AUE_O_RECVMSG AUE_RECVMSG /* Darwin */
648#define AUE_O_SENDMSG AUE_SENDMSG /* Darwin */
649#define AUE_O_VTRACE AUE_NULL /* Darwin */
650#define AUE_O_RESUBA AUE_NULL /* Darwin */
651#define AUE_O_RECVFROM AUE_RECVFROM /* Darwin */
652#define AUE_O_SETREUID AUE_SETREUID /* Darwin */
653#define AUE_O_SETREGID AUE_SETREGID /* Darwin */
654#define AUE_O_GETDIRENTRIES AUE_GETDIRENTRIES /* Darwin */
655#define AUE_O_TRUNCATE AUE_TRUNCATE /* Darwin */
656#define AUE_O_FTRUNCATE AUE_FTRUNCATE /* Darwin */
657#define AUE_O_GETPEERNAME AUE_NULL /* Darwin */
658#define AUE_O_GETHOSTID AUE_NULL /* Darwin */
659#define AUE_O_SETHOSTID AUE_NULL /* Darwin */
660#define AUE_O_GETRLIMIT AUE_NULL /* Darwin */
661#define AUE_O_SETRLIMIT AUE_SETRLIMIT /* Darwin */
662#define AUE_O_KILLPG AUE_KILL /* Darwin */
663#define AUE_O_SETQUOTA AUE_NULL /* Darwin */
664#define AUE_O_QUOTA AUE_NULL /* Darwin */
665#define AUE_O_GETSOCKNAME AUE_NULL /* Darwin */
666#define AUE_O_GETDIREENTRIES AUE_GETDIREENTRIES /* Darwin */
667#define AUE_O_ASYNCDAEMON AUE_NULL /* Darwin */
668#define AUE_O_GETDOMAINNAME AUE_NULL /* Darwin */
669#define AUE_O_SETDOMAINNAME AUE_SYSCTL /* Darwin */
670#define AUE_O_PCFS_MOUNT AUE_NULL /* Darwin */
671#define AUE_O_EXPORTFS AUE_NULL /* Darwin */
672#define AUE_O_USTATE AUE_NULL /* Darwin */
673#define AUE_O_WAIT3 AUE_NULL /* Darwin */
674#define AUE_O_RPAUSE AUE_NULL /* Darwin */
675#define AUE_O_GETDENTS AUE_NULL /* Darwin */
2d21ac55 676
b0d623f7
A
677/*
678 * Possible desired future values based on review of BSD/Darwin system calls.
679 */
680#define AUE_ATGETMSG AUE_NULL
681#define AUE_ATPUTMSG AUE_NULL
682#define AUE_ATSOCKET AUE_NULL
683#define AUE_ATPGETREQ AUE_NULL
684#define AUE_ATPGETRSP AUE_NULL
685#define AUE_ATPSNDREQ AUE_NULL
686#define AUE_ATPSNDRSP AUE_NULL
687#define AUE_BSDTHREADCREATE AUE_NULL
688#define AUE_BSDTHREADTERMINATE AUE_NULL
689#define AUE_BSDTHREADREGISTER AUE_NULL
690#define AUE_CHUD AUE_NULL
691#define AUE_CSOPS AUE_NULL
692#define AUE_DUP AUE_NULL
693#define AUE_FDATASYNC AUE_NULL
694#define AUE_FGETATTRLIST AUE_NULL
695#define AUE_FGETXATTR AUE_NULL
696#define AUE_FLISTXATTR AUE_NULL
697#define AUE_FREMOVEXATTR AUE_NULL
698#define AUE_FSETATTRLIST AUE_NULL
699#define AUE_FSETXATTR AUE_NULL
700#define AUE_FSTATFS64 AUE_NULL
701#define AUE_FSTATV AUE_NULL
702#define AUE_FSTAT64 AUE_NULL
703#define AUE_FSTAT64_EXTENDED AUE_NULL
704#define AUE_GCCONTROL AUE_NULL
705#define AUE_GETDIRENTRIES64 AUE_NULL
706#define AUE_GETDTABLESIZE AUE_NULL
707#define AUE_GETEGID AUE_NULL
708#define AUE_GETEUID AUE_NULL
709#define AUE_GETFSSTAT64 AUE_NULL
710#define AUE_GETGID AUE_NULL
711#define AUE_GETGROUPS AUE_NULL
712#define AUE_GETITIMER AUE_NULL
713#define AUE_GETLOGIN AUE_NULL
714#define AUE_GETPEERNAME AUE_NULL
715#define AUE_GETPGID AUE_NULL
716#define AUE_GETPGRP AUE_NULL
717#define AUE_GETPID AUE_NULL
718#define AUE_GETPPID AUE_NULL
719#define AUE_GETPRIORITY AUE_NULL
720#define AUE_GETRLIMIT AUE_NULL
721#define AUE_GETRUSAGE AUE_NULL
722#define AUE_GETSGROUPS AUE_NULL
723#define AUE_GETSID AUE_NULL
724#define AUE_GETSOCKNAME AUE_NULL
725#define AUE_GETTIMEOFDAY AUE_NULL
726#define AUE_GETTID AUE_NULL
727#define AUE_GETUID AUE_NULL
728#define AUE_GETSOCKOPT AUE_NULL
729#define AUE_GETWGROUPS AUE_NULL
730#define AUE_GETXATTR AUE_NULL
731#define AUE_IDENTITYSVC AUE_NULL
732#define AUE_INITGROUPS AUE_NULL
733#define AUE_IOPOLICYSYS AUE_NULL
734#define AUE_ISSETUGID AUE_NULL
735#define AUE_LIOLISTIO AUE_NULL
736#define AUE_LISTXATTR AUE_NULL
737#define AUE_LSTATV AUE_NULL
738#define AUE_LSTAT64 AUE_NULL
739#define AUE_LSTAT64_EXTENDED AUE_NULL
740#define AUE_MADVISE AUE_NULL
741#define AUE_MINCORE AUE_NULL
742#define AUE_MKCOMPLEX AUE_NULL
743#define AUE_MODWATCH AUE_NULL
744#define AUE_MSGCL AUE_NULL
745#define AUE_MSYNC AUE_NULL
746#define AUE_PREADV AUE_NULL
747#define AUE_PROCINFO AUE_NULL
748#define AUE_PTHREADCANCELED AUE_NULL
749#define AUE_PTHREADCHDIR AUE_NULL
750#define AUE_PTHREADCONDBROADCAST AUE_NULL
751#define AUE_PTHREADCONDDESTORY AUE_NULL
752#define AUE_PTHREADCONDINIT AUE_NULL
753#define AUE_PTHREADCONDSIGNAL AUE_NULL
754#define AUE_PTHREADCONDWAIT AUE_NULL
755#define AUE_PTHREADFCHDIR AUE_NULL
756#define AUE_PTHREADMARK AUE_NULL
757#define AUE_PTHREADMUTEXDESTROY AUE_NULL
758#define AUE_PTHREADMUTEXINIT AUE_NULL
759#define AUE_PTHREADMUTEXTRYLOCK AUE_NULL
760#define AUE_PTHREADMUTEXUNLOCK AUE_NULL
761#define AUE_PWRITEV AUE_NULL
762#define AUE_REMOVEXATTR AUE_NULL
763#define AUE_SBRK AUE_NULL
764#define AUE_SELECT AUE_NULL
765#define AUE_SEMDESTROY AUE_NULL
766#define AUE_SEMGETVALUE AUE_NULL
767#define AUE_SEMINIT AUE_NULL
768#define AUE_SEMPOST AUE_NULL
769#define AUE_SEMTRYWAIT AUE_NULL
770#define AUE_SEMWAIT AUE_NULL
771#define AUE_SEMWAITSIGNAL AUE_NULL
772#define AUE_SETITIMER AUE_NULL
773#define AUE_SETSGROUPS AUE_NULL
774#define AUE_SETTID AUE_NULL
775#define AUE_SETTIDWITHPID AUE_NULL
776#define AUE_SETWGROUPS AUE_NULL
777#define AUE_SETXATTR AUE_NULL
778#define AUE_SHAREDREGIONCHECK AUE_NULL
779#define AUE_SHAREDREGIONMAP AUE_NULL
780#define AUE_SIGACTION AUE_NULL
781#define AUE_SIGALTSTACK AUE_NULL
782#define AUE_SIGPENDING AUE_NULL
783#define AUE_SIGPROCMASK AUE_NULL
784#define AUE_SIGRETURN AUE_NULL
785#define AUE_SIGSUSPEND AUE_NULL
786#define AUE_SIGWAIT AUE_NULL
787#define AUE_SSTK AUE_NULL
788#define AUE_STACKSNAPSHOT AUE_NULL
789#define AUE_STATFS64 AUE_NULL
790#define AUE_STATV AUE_NULL
791#define AUE_STAT64 AUE_NULL
792#define AUE_STAT64_EXTENDED AUE_NULL
793#define AUE_SYNC AUE_NULL
794#define AUE_SYSCALL AUE_NULL
795#define AUE_TABLE AUE_NULL
796#define AUE_VMPRESSUREMONITOR AUE_NULL
797#define AUE_WAITEVENT AUE_NULL
798#define AUE_WAITID AUE_NULL
799#define AUE_WATCHEVENT AUE_NULL
800#define AUE_WORKQOPEN AUE_NULL
801#define AUE_WORKQOPS AUE_NULL
55e303ae 802
e5568f75 803#endif /* !_BSM_AUDIT_KEVENTS_H_ */