| | 1 | /* |
| | 2 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
| | 3 | * |
| | 4 | * This file contains Original Code and/or Modifications of Original Code |
| | 5 | * as defined in and that are subject to the Apple Public Source License |
| | 6 | * Version 2.0 (the 'License'). You may not use this file except in |
| | 7 | * compliance with the License. The rights granted to you under the License |
| | 8 | * may not be used to create, or enable the creation or redistribution of, |
| | 9 | * unlawful or unlicensed copies of an Apple operating system, or to |
| | 10 | * circumvent, violate, or enable the circumvention or violation of, any |
| | 11 | * terms of an Apple operating system software license agreement. |
| | 12 | * |
| | 13 | * Please obtain a copy of the License at |
| | 14 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
| | 15 | * |
| | 16 | * The Original Code and all software distributed under the License are |
| | 17 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
| | 18 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
| | 19 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
| | 20 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
| | 21 | * Please see the License for the specific language governing rights and |
| | 22 | * limitations under the License. |
| | 23 | * |
| | 24 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
| | 25 | */ |
| | 26 | |
| | 27 | #ifndef _BSM_AUDIT_KEVENTS_H_ |
| | 28 | #define _BSM_AUDIT_KEVENTS_H_ |
| | 29 | |
| | 30 | /* |
| | 31 | * Values marked as AUE_NULL are not required to be audited as per CAPP |
| | 32 | * |
| | 33 | * The second value within comments is the syscall number in Darwin |
| | 34 | * |
| | 35 | * Values in the third column are the values assigned by BSM for obsolete |
| | 36 | * or old system calls |
| | 37 | * |
| | 38 | * Values marked as XXX in the third column do not have an |
| | 39 | * event number assigned as yet, and have (temporarily) been assigned |
| | 40 | * value of AUE_NULL |
| | 41 | */ |
| | 42 | |
| | 43 | #define AUE_NULL 0 |
| | 44 | #define AUE_EXIT 1 /*1*/ |
| | 45 | #define AUE_FORK 2 /*2*/ |
| | 46 | #define AUE_OPEN 3 /*3*/ |
| | 47 | #define AUE_READ AUE_NULL /*4*/ |
| | 48 | #define AUE_WRITE AUE_NULL /*5*/ |
| | 49 | #define AUE_OPEN_R 72 /*5*/ |
| | 50 | #define AUE_OPEN_RC 73 /*5*/ |
| | 51 | #define AUE_OPEN_RTC 75 /*5*/ |
| | 52 | #define AUE_OPEN_RT 74 /*5*/ |
| | 53 | #define AUE_OPEN_RW 80 /*5*/ |
| | 54 | #define AUE_OPEN_RWC 81 /*5*/ |
| | 55 | #define AUE_OPEN_RWTC 83 /*5*/ |
| | 56 | #define AUE_OPEN_RWT 82 /*5*/ |
| | 57 | #define AUE_OPEN_W 76 /*5*/ |
| | 58 | #define AUE_OPEN_WC 77 /*5*/ |
| | 59 | #define AUE_OPEN_WTC 79 /*5*/ |
| | 60 | #define AUE_OPEN_WT 78 /*5*/ |
| | 61 | #define AUE_CLOSE 112 /*6*/ |
| | 62 | #define AU_WAIT4 AUE_NULL /*7*/ |
| | 63 | #define AUE_O_CREAT AUE_OPEN_RWTC /*8*/ /*4*/ |
| | 64 | #define AUE_LINK 5 /*9*/ |
| | 65 | #define AUE_UNLINK 6 /*10*/ |
| | 66 | #define AUE_O_EXECV AUE_NULL /*11*/ |
| | 67 | #define AUE_CHDIR 8 /*12*/ |
| | 68 | #define AUE_FCHDIR 68 /*13*/ |
| | 69 | #define AUE_MKNOD 9 /*14*/ |
| | 70 | #define AUE_CHMOD 10 /*15*/ |
| | 71 | #define AUE_CHOWN 11 /*16*/ |
| | 72 | #define AUE_O_SBREAK AUE_NULL /*17*/ |
| | 73 | #define AUE_GETFSSTAT 301 /*18*/ |
| | 74 | #define AUE_O_LSEEK AUE_NULL /*19*/ |
| | 75 | #define AUE_GETPID AUE_NULL /*20*/ |
| | 76 | #define AUE_O_MOUNT AUE_NULL /*21*/ |
| | 77 | #define AUE_O_UMOUNT AUE_NULL /*22*/ |
| | 78 | #define AUE_SETUID 200 /*23*/ |
| | 79 | #define AUE_GETUID AUE_NULL /*24*/ |
| | 80 | #define AUE_GETEUID AUE_NULL /*25*/ |
| | 81 | #define AUE_PTRACE 302 /*26*/ |
| | 82 | #define AUE_RECVMSG 190 /*27*/ |
| | 83 | #define AUE_SENDMSG 188 /*28*/ |
| | 84 | #define AUE_RECVFROM 191 /*29*/ |
| | 85 | #define AUE_ACCEPT 33 /*30*/ |
| | 86 | #define AUE_GETPEERNAME AUE_NULL /*31*/ |
| | 87 | #define AUE_GETSOCKNAME AUE_NULL /*32*/ |
| | 88 | #define AUE_ACCESS 14 /*33*/ |
| | 89 | #define AUE_CHFLAGS 303 /*34*/ |
| | 90 | #define AUE_FCHFLAGS 304 /*35*/ |
| | 91 | #define AUE_SYNC AUE_NULL /*36*/ |
| | 92 | #define AUE_KILL 15 /*37*/ |
| | 93 | #define AUE_O_STAT AUE_STAT /*38*/ |
| | 94 | #define AUE_GETPPID AUE_NULL /*39*/ |
| | 95 | #define AUE_O_LSTAT AUE_LSTAT /*40*/ |
| | 96 | #define AUE_DUP AUE_NULL /*41*/ |
| | 97 | #define AUE_PIPE 185 /*42*/ |
| | 98 | #define AUE_GETEGID AUE_NULL /*43*/ |
| | 99 | #define AUE_PROFILE 305 /*44*/ |
| | 100 | #define AUE_KTRACE 306 /*45*/ |
| | 101 | #define AUE_REBOOT 308 |
| | 102 | #define AUE_SIGACTION AUE_NULL /*46*/ /*XXX*/ |
| | 103 | #define AUE_GETGID AUE_NULL /*47*/ |
| | 104 | #define AUE_SIGPROCMASK AUE_NULL /*48*/ /*XXX*/ |
| | 105 | #define AUE_GETLOGIN AUE_NULL /*49*/ |
| | 106 | #define AUE_SETLOGIN 307 /*50*/ |
| | 107 | #define AUE_ACCT 18 /*51*/ |
| | 108 | #define AUE_SIGPENDING AUE_NULL /*52*/ /*XXX*/ |
| | 109 | #define AUE_SIGALTSTACK AUE_NULL /*53*/ /*XXX*/ |
| | 110 | #define AUE_IOCTL 158 /*54*/ |
| | 111 | #define AUE_SYSTEMBOOT 113 /*55*/ |
| | 112 | #define AUE_REVOKE 309 /*56*/ |
| | 113 | #define AUE_SYMLINK 21 /*57*/ |
| | 114 | #define AUE_READLINK 22 /*58*/ |
| | 115 | #define AUE_EXECVE 23 /*59*/ |
| | 116 | #define AUE_UMASK 310 /*60*/ |
| | 117 | #define AUE_CHROOT 24 /*61*/ |
| | 118 | #define AUE_O_FSTAT AUE_FSTAT /*62*/ |
| | 119 | |
| | 120 | #define AUE_O_GETPAGESIZE AUE_NULL /*64*/ |
| | 121 | #define AUE_MSYNC AUE_NULL /*65*/ |
| | 122 | #define AUE_VFORK 25 /*66*/ |
| | 123 | #define AUE_O_VREAD AUE_NULL /*67*/ |
| | 124 | #define AUE_O_VWRITE AUE_NULL /*68*/ |
| | 125 | #define AUE_SBRK AUE_NULL /*69*/ /*EOPNOTSUP*/ |
| | 126 | #define AUE_SSTK AUE_NULL /*70*/ /*EOPNOTSUP*/ |
| | 127 | #define AUE_O_MMAP AUE_MMAP /*71*/ |
| | 128 | #define AUE_O_VADVISE AUE_NULL /*72*/ |
| | 129 | #define AUE_MUNMAP 213 /*73*/ |
| | 130 | #define AUE_MPROTECT 311 /*74*/ |
| | 131 | #define AUE_MADVISE AUE_NULL /*75*/ |
| | 132 | #define AUE_O_VHANGUP AUE_NULL /*76*/ |
| | 133 | #define AUE_O_VLIMIT AUE_NULL /*77*/ |
| | 134 | #define AUE_MINCORE AUE_NULL /*78*/ |
| | 135 | #define AUE_GETGROUPS AUE_NULL /*79*/ |
| | 136 | #define AUE_SETGROUPS 26 /*80*/ |
| | 137 | #define AUE_GETPGRP AUE_NULL /*81*/ |
| | 138 | #define AUE_SETPGRP 27 /*82*/ |
| | 139 | #define AUE_SETITIMER AUE_NULL /*83*/ /*XXX*/ |
| | 140 | #define AUE_O_WAIT AUE_NULL /*84*/ |
| | 141 | #define AUE_SWAPON 28 /*85*/ |
| | 142 | #define AUE_GETITIMER AUE_NULL /*86*/ |
| | 143 | #define AUE_O_GETHOSTNAME AUE_NULL /*87*/ |
| | 144 | #define AUE_O_SETHOSTNAME AUE_SYSCTL /*88*/ |
| | 145 | #define AUE_GETDTABLESIZE AUE_NULL /*89*/ |
| | 146 | #define AUE_DUP2 AUE_NULL /*90*/ |
| | 147 | #define AUE_O_GETDOPT AUE_NULL /*91*/ |
| | 148 | #define AUE_FCNTL 30 /*92*/ |
| | 149 | #define AUE_SELECT AUE_NULL /*93*/ |
| | 150 | #define AUE_O_SETDOPT AUE_NULL /*94*/ |
| | 151 | #define AUE_FSYNC AUE_NULL /*95*/ |
| | 152 | #define AUE_SETPRIORITY 312 /*96*/ |
| | 153 | #define AUE_SOCKET 183 /*97*/ |
| | 154 | #define AUE_CONNECT 32 /*98*/ |
| | 155 | #define AUE_O_ACCEPT AUE_NULL /*99*/ |
| | 156 | #define AUE_GETPRIORITY AUE_NULL /*100*/ |
| | 157 | #define AUE_O_SEND AUE_SENDMSG /*101*/ |
| | 158 | #define AUE_O_RECV AUE_RECVMSG /*102*/ |
| | 159 | #define AUE_SIGRETURN AUE_NULL /*103*/ /*XXX*/ |
| | 160 | #define AUE_BIND 34 /*104*/ |
| | 161 | #define AUE_SETSOCKOPT 35 /*105*/ |
| | 162 | #define AUE_LISTEN AUE_NULL /*106*/ |
| | 163 | #define AUE_O_VTIMES AUE_NULL /*107*/ |
| | 164 | #define AUE_O_SIGVEC AUE_NULL /*108*/ |
| | 165 | #define AUE_O_SIGBLOCK AUE_NULL /*109*/ |
| | 166 | #define AUE_O_SIGSETMASK AUE_NULL /*110*/ |
| | 167 | #define AUE_SIGSUSPEND AUE_NULL /*111*/ /*XXX*/ |
| | 168 | #define AUE_O_SIGSTACK AUE_NULL /*112*/ |
| | 169 | #define AUE_O_RECVMSG AUE_RECVMSG /*113*/ |
| | 170 | #define AUE_O_SENDMSG AUE_SENDMSG /*114*/ |
| | 171 | #define AUE_O_VTRACE AUE_NULL /*115*/ /*36*/ |
| | 172 | #define AUE_GETTIMEOFDAY AUE_NULL /*116*/ |
| | 173 | #define AUE_GETRUSAGE AUE_NULL /*117*/ |
| | 174 | #define AUE_GTSOCKOPT AUE_NULL /*118*/ |
| | 175 | #define AUE_O_RESUBA AUE_NULL /*119*/ |
| | 176 | #define AUE_READV AUE_NULL /*120*/ |
| | 177 | #define AUE_WRITEV AUE_NULL /*121*/ |
| | 178 | #define AUE_SETTIMEOFDAY 313 /*122*/ |
| | 179 | #define AUE_FCHOWN 38 /*123*/ |
| | 180 | #define AUE_FCHMOD 39 /*124*/ |
| | 181 | #define AUE_O_RECVFROM AUE_RECVFROM /*125*/ |
| | 182 | #define AUE_O_SETREUID AUE_SETEUID /*126*/ /*40*/ |
| | 183 | #define AUE_O_SETREGID AUE_SETEGID /*127*/ /*41*/ |
| | 184 | #define AUE_RENAME 42 /*128*/ |
| | 185 | #define AUE_O_TRUNCATE AUE_TRUNCATE /*129*/ |
| | 186 | #define AUE_O_FTRUNCATE AUE_FTRUNCATE /*130*/ |
| | 187 | #define AUE_FLOCK 314 /*131*/ |
| | 188 | #define AUE_MKFIFO 315 /*132*/ |
| | 189 | #define AUE_SENDTO 184 /*133*/ |
| | 190 | #define AUE_SHUTDOWN 46 /*134*/ |
| | 191 | #define AUE_SOCKETPAIR 317 /*135*/ |
| | 192 | #define AUE_MKDIR 47 /*136*/ |
| | 193 | #define AUE_RMDIR 48 /*137*/ |
| | 194 | #define AUE_UTIMES 49 /*138*/ |
| | 195 | #define AUE_FUTIMES 318 /*139*/ |
| | 196 | #define AUE_ADJTIME 50 /*140*/ |
| | 197 | #define AUE_O_GETPEERNAME AUE_NULL /*141*/ |
| | 198 | #define AUE_O_GETHOSTID AUE_NULL /*142*/ |
| | 199 | #define AUE_O_SETHOSTID AUE_NULL /*143*/ |
| | 200 | #define AUE_O_GETRLIMIT AUE_NULL /*144*/ |
| | 201 | #define AUE_O_SETRLIMIT AUE_SETRLIMIT /*145*/ |
| | 202 | #define AUE_O_KILLPG AUE_KILL /*146*/ |
| | 203 | #define AUE_SETSID 319 /*147*/ |
| | 204 | #define AUE_O_SETQUOTA AUE_NULL /*148*/ |
| | 205 | #define AUE_O_QUOTA AUE_NULL /*149*/ |
| | 206 | #define AUE_O_GETSOCKNAME AUE_NULL /*150*/ |
| | 207 | #define AUE_GETPGID AUE_NULL /*151*/ |
| | 208 | #define AUE_SETPRIVEXEC 320 /*152*/ |
| | 209 | #define AUE_PREAD AUE_NULL /*153*/ |
| | 210 | #define AUE_PWRITE AUE_NULL /*154*/ |
| | 211 | #define AUE_NFSSVC 321 /*155*/ |
| | 212 | #define AUE_O_GETDIRENTRIES AUE_GETDIRENTRIES /*156*/ |
| | 213 | #define AUE_STATFS 54 /*157*/ |
| | 214 | #define AUE_FSTATFS 55 /*158*/ |
| | 215 | #define AUE_UNMOUNT 12 /*159*/ |
| | 216 | #define AUE_O_ASYNCDAEMON AUE_NULL /*160*/ |
| | 217 | #define AUE_GETFH 322 /*161*/ |
| | 218 | #define AUE_O_GETDOMAINNAME AUE_NULL /*162*/ |
| | 219 | #define AUE_O_SETDOMAINNAME AUE_SYSCTL /*163*/ |
| | 220 | #define AUE_O_PCFS_MOUNT AUE_NULL /*164*/ |
| | 221 | #define AUE_QUOTACTL 60 /*165*/ |
| | 222 | #define AUE_O_EXPORTFS AUE_NULL /*166*/ |
| | 223 | #define AUE_MOUNT 62 /*167*/ |
| | 224 | #define AUE_O_USTATE AUE_NULL /*168*/ |
| | 225 | #define AUE_TABLE AUE_NULL /*170*/ /*ENOSYS*/ |
| | 226 | #define AUE_O_WAIT3 AUE_NULL /*171*/ |
| | 227 | #define AUE_O_RPAUSE AUE_NULL /*172*/ |
| | 228 | #define AUE_O_GETDENTS AUE_NULL /*174*/ |
| | 229 | #define AUE_GCCONTROL AUE_NULL /*175*/ /*ENOSYS*/ |
| | 230 | #define AUE_ADDPROFILE 324 /*176*/ |
| | 231 | |
| | 232 | #define AUE_KDBUGTRACE 325 /*180*/ |
| | 233 | #define AUE_SETGID 205 /*181*/ |
| | 234 | #define AUE_SETEGID 214 /*182*/ |
| | 235 | #define AUE_SETEUID 215 /*183*/ |
| | 236 | |
| | 237 | #define AUE_STAT 16 /*188*/ |
| | 238 | #define AUE_FSTAT 326 /*189*/ |
| | 239 | #define AUE_LSTAT 17 /*190*/ |
| | 240 | #define AUE_PATHCONF 71 /*191*/ |
| | 241 | #define AUE_FPATHCONF 327 /*192*/ |
| | 242 | #define AUE_GETRLIMIT AUE_NULL /*194*/ |
| | 243 | #define AUE_SETRLIMIT 51 /*195*/ |
| | 244 | #define AUE_GETDIRENTRIES 328 /*196*/ |
| | 245 | #define AUE_MMAP 210 /*197*/ |
| | 246 | #define AUE_SYSCALL AUE_NULL /*198*/ /*ENOSYS*/ |
| | 247 | #define AUE_LSEEK AUE_NULL /*199*/ |
| | 248 | #define AUE_TRUNCATE 329 /*200*/ |
| | 249 | #define AUE_FTRUNCATE 330 /*201*/ |
| | 250 | #define AUE_SYSCTL 331 /*202*/ |
| | 251 | #define AUE_MLOCK 332 /*203*/ |
| | 252 | #define AUE_MUNLOCK 333 /*204*/ |
| | 253 | #define AUE_UNDELETE 334 /*205*/ |
| | 254 | |
| | 255 | #define AUE_MKCOMPLEX AUE_NULL /*216*/ /*XXX*/ |
| | 256 | #define AUE_STATV AUE_NULL /*217*/ /*EOPNOTSUPP*/ |
| | 257 | #define AUE_LSTATV AUE_NULL /*218*/ /*EOPNOTSUPP*/ |
| | 258 | #define AUE_FSTATV AUE_NULL /*219*/ /*EOPNOTSUPP*/ |
| | 259 | #define AUE_GETATTRLIST 335 /*220*/ |
| | 260 | #define AUE_SETATTRLIST 336 /*221*/ |
| | 261 | #define AUE_GETDIRENTRIESATTR 337 /*222*/ |
| | 262 | #define AUE_EXCHANGEDATA 338 /*223*/ |
| | 263 | #define AUE_CHECKUSERACCESS AUE_ACCESS /*224*/ /* To Be Removed */ |
| | 264 | #define AUE_SEARCHFS 339 /*225*/ |
| | 265 | |
| | 266 | #define AUE_DELETE AUE_UNLINK /*226*/ /* reserved */ |
| | 267 | #define AUE_COPYFILE 361 /*227*/ /* reserved */ |
| | 268 | #define AUE_WATCHEVENT AUE_NULL /*231*/ /* reserved */ |
| | 269 | #define AUE_WAITEVENT AUE_NULL /*232*/ /* reserved */ |
| | 270 | #define AUE_MODWATCH AUE_NULL /*233*/ /* reserved */ |
| | 271 | #define AUE_FSCTL AUE_NULL /*242*/ /* reserved */ |
| | 272 | |
| | 273 | #define AUE_MINHERIT 340 /*250*/ |
| | 274 | #define AUE_SEMSYS AUE_NULL /*251*/ /* To Be Removed */ |
| | 275 | #define AUE_MSGSYS AUE_NULL /*252*/ /* To Be Removed */ |
| | 276 | #define AUE_SHMSYS AUE_NULL /*253*/ |
| | 277 | #define AUE_SEMCTL 98 /*254*/ |
| | 278 | #define AUE_SEMCTL_GETALL 105 /*254*/ |
| | 279 | #define AUE_SEMCTL_GETNCNT 102 /*254*/ |
| | 280 | #define AUE_SEMCTL_GETPID 103 /*254*/ |
| | 281 | #define AUE_SEMCTL_GETVAL 104 /*254*/ |
| | 282 | #define AUE_SEMCTL_GETZCNT 106 /*254*/ |
| | 283 | #define AUE_SEMCTL_RMID 99 /*254*/ |
| | 284 | #define AUE_SEMCTL_SET 100 /*254*/ |
| | 285 | #define AUE_SEMCTL_SETALL 108 /*254*/ |
| | 286 | #define AUE_SEMCTL_SETVAL 107 /*254*/ |
| | 287 | #define AUE_SEMCTL_STAT 101 /*254*/ |
| | 288 | #define AUE_SEMGET 109 /*255*/ |
| | 289 | #define AUE_SEMOP 110 /*256*/ |
| | 290 | #define AUE_SEMCONFIG 341 /*257*/ |
| | 291 | #define AUE_MSGCL AUE_NULL /*258*/ /*EOPNOTSUPP*/ |
| | 292 | #define AUE_MSGGET 88 /*259*/ /*88-EOPNOTSUPP*/ |
| | 293 | #define AUE_MSGRCV 89 /*261*/ /*89-EOPNOTSUPP*/ |
| | 294 | #define AUE_MSGSND 90 /*260*/ /*90-EOPNOTSUPP*/ |
| | 295 | #define AUE_SHMAT 96 /*262*/ |
| | 296 | #define AUE_SHMCTL 91 /*263*/ |
| | 297 | #define AUE_SHMCTL_RMID 92 /*263*/ |
| | 298 | #define AUE_SHMCTL_SET 93 /*263*/ |
| | 299 | #define AUE_SHMCTL_STAT 94 /*263*/ |
| | 300 | #define AUE_SHMDT 97 /*264*/ |
| | 301 | #define AUE_SHMGET 95 /*265*/ |
| | 302 | #define AUE_SHMOPEN 345 /*266*/ |
| | 303 | #define AUE_SHMUNLINK 346 /*267*/ |
| | 304 | #define AUE_SEMOPEN 342 /*268*/ |
| | 305 | #define AUE_SEMCLOSE 343 /*269*/ |
| | 306 | #define AUE_SEMUNLINK 344 /*270*/ |
| | 307 | #define AUE_SEMWAIT AUE_NULL /*271*/ |
| | 308 | #define AUE_SEMTRYWAIT AUE_NULL /*272*/ |
| | 309 | #define AUE_SEMPOST AUE_NULL /*273*/ |
| | 310 | #define AUE_SEMGETVALUE AUE_NULL /*274*/ /*ENOSYS*/ |
| | 311 | #define AUE_SEMINIT AUE_NULL /*275*/ /*ENOSYS*/ |
| | 312 | #define AUE_SEMDESTROY AUE_NULL /*276*/ /*ENOSYS*/ |
| | 313 | |
| | 314 | #define AUE_LOADSHFILE 347 /*296*/ |
| | 315 | #define AUE_RESETSHFILE 348 /*297*/ |
| | 316 | #define AUE_NEWSYSTEMSHREG 349 /*298*/ |
| | 317 | |
| | 318 | #define AUE_GETSID AUE_NULL /*310*/ |
| | 319 | |
| | 320 | #define AUE_MLOCKALL AUE_NULL /*324*/ /*ENOSYS*/ |
| | 321 | #define AUE_MUNLOCKALL AUE_NULL /*325*/ /*ENOSYS*/ |
| | 322 | |
| | 323 | #define AUE_ISSETUGID AUE_NULL /*327*/ |
| | 324 | #define AUE_PTHREADKILL 350 /*328*/ |
| | 325 | #define AUE_PTHREADSIGMASK 351 /*329*/ |
| | 326 | #define AUE_SIGWAIT AUE_NULL /*330*/ /*XXX*/ |
| | 327 | #define AUE_SWAPOFF 355 |
| | 328 | #define AUE_INITPROCESS 356 |
| | 329 | #define AUE_MAPFD 357 |
| | 330 | #define AUE_TASKFORPID 358 |
| | 331 | #define AUE_PIDFORTASK 359 |
| | 332 | #define AUE_SYSCTL_NONADMIN 360 |
| | 333 | |
| | 334 | // BSM events - Have to identify which ones are relevant to MacOSX |
| | 335 | #define AUE_ACLSET 251 |
| | 336 | #define AUE_AUDIT 211 |
| | 337 | #define AUE_AUDITON 138 |
| | 338 | #define AUE_AUDITON_GETCAR 224 |
| | 339 | #define AUE_AUDITON_GETCLASS 231 |
| | 340 | #define AUE_AUDITON_GETCOND 229 |
| | 341 | #define AUE_AUDITON_GETCWD 223 |
| | 342 | #define AUE_AUDITON_GETKMASK 221 |
| | 343 | #define AUE_AUDITON_GETSTAT 225 |
| | 344 | #define AUE_AUDITON_GPOLICY 141 |
| | 345 | #define AUE_AUDITON_GQCTRL 145 |
| | 346 | #define AUE_AUDITON_SETCLASS 232 |
| | 347 | #define AUE_AUDITON_SETCOND 230 |
| | 348 | #define AUE_AUDITON_SETKMASK 222 |
| | 349 | #define AUE_AUDITON_SETSMASK 228 |
| | 350 | #define AUE_AUDITON_SETSTAT 226 |
| | 351 | #define AUE_AUDITON_SETUMASK 227 |
| | 352 | #define AUE_AUDITON_SPOLICY 142 |
| | 353 | #define AUE_AUDITON_SQCTRL 146 |
| | 354 | #define AUE_AUDITCTL 352 |
| | 355 | #define AUE_DOORFS_DOOR_BIND 260 |
| | 356 | #define AUE_DOORFS_DOOR_CALL 254 |
| | 357 | #define AUE_DOORFS_DOOR_CREATE 256 |
| | 358 | #define AUE_DOORFS_DOOR_CRED 259 |
| | 359 | #define AUE_DOORFS_DOOR_INFO 258 |
| | 360 | #define AUE_DOORFS_DOOR_RETURN 255 |
| | 361 | #define AUE_DOORFS_DOOR_REVOKE 257 |
| | 362 | #define AUE_DOORFS_DOOR_UNBIND 261 |
| | 363 | #define AUE_ENTERPROM 153 |
| | 364 | #define AUE_EXEC 7 |
| | 365 | #define AUE_EXITPROM 154 |
| | 366 | #define AUE_FACLSET 252 |
| | 367 | #define AUE_FCHROOT 69 |
| | 368 | #define AUE_FORK1 241 |
| | 369 | #define AUE_GETAUDIT 132 |
| | 370 | #define AUE_GETAUDIT_ADDR 267 |
| | 371 | #define AUE_GETAUID 130 |
| | 372 | #define AUE_GETMSG 217 |
| | 373 | #define AUE_SOCKACCEPT 247 |
| | 374 | #define AUE_SOCKRECEIVE 250 |
| | 375 | #define AUE_GETPMSG 219 |
| | 376 | #define AUE_GETPORTAUDIT 149 |
| | 377 | #define AUE_INST_SYNC 264 |
| | 378 | #define AUE_LCHOWN 237 |
| | 379 | #define AUE_LXSTAT 236 |
| | 380 | #define AUE_MEMCNTL 238 |
| | 381 | #define AUE_MODADDMAJ 246 |
| | 382 | #define AUE_MODCONFIG 245 |
| | 383 | #define AUE_MODLOAD 243 |
| | 384 | #define AUE_MODUNLOAD 244 |
| | 385 | #define AUE_MSGCTL 84 |
| | 386 | #define AUE_MSGCTL_RMID 85 |
| | 387 | #define AUE_MSGCTL_SET 86 |
| | 388 | #define AUE_MSGCTL_STAT 87 |
| | 389 | #define AUE_NICE 203 |
| | 390 | #define AUE_P_ONLINE 262 |
| | 391 | #define AUE_PRIOCNTLSYS 212 |
| | 392 | #define AUE_CORE 111 |
| | 393 | #define AUE_PROCESSOR_BIND 263 |
| | 394 | #define AUE_PUTMSG 216 |
| | 395 | #define AUE_SOCKCONNECT 248 |
| | 396 | #define AUE_SOCKSEND 249 |
| | 397 | #define AUE_PUTPMSG 218 |
| | 398 | #define AUE_SETAUDIT 133 |
| | 399 | #define AUE_SETAUDIT_ADDR 266 |
| | 400 | #define AUE_SETAUID 131 |
| | 401 | #define AUE_SOCKCONFIG 183 |
| | 402 | #define AUE_STATVFS 234 |
| | 403 | #define AUE_STIME 201 |
| | 404 | #define AUE_SYSINFO 39 |
| | 405 | #define AUE_UTIME 202 |
| | 406 | #define AUE_UTSYS 233 |
| | 407 | #define AUE_XMKNOD 240 |
| | 408 | #define AUE_XSTAT 235 |
| | 409 | |
| | 410 | #endif /* !_BSM_AUDIT_KEVENTS_H_ */ |
projects / apple / xnu.git / blame_incremental