X-Git-Url: https://git.saurik.com/apple/xnu.git/blobdiff_plain/0c530ab8987f0ae6a1a3d9284f40182b88852816..13f56ec4e58bf8687e2a68032c093c0213dd519b:/bsd/bsm/audit_kevents.h diff --git a/bsd/bsm/audit_kevents.h b/bsd/bsm/audit_kevents.h index 73bbf2ce2..25e3eb829 100644 --- a/bsd/bsm/audit_kevents.h +++ b/bsd/bsm/audit_kevents.h @@ -1,408 +1,803 @@ -/* - * @APPLE_LICENSE_HEADER_START@ - * - * Copyright (c) 1999-2004 Apple Computer, Inc. All Rights Reserved. - * - * This file contains Original Code and/or Modifications of Original Code - * as defined in and that are subject to the Apple Public Source License - * Version 2.0 (the 'License'). You may not use this file except in - * compliance with the License. Please obtain a copy of the License at - * http://www.opensource.apple.com/apsl/ and read it before using this - * file. - * - * The Original Code and all software distributed under the License are - * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER - * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, - * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. - * Please see the License for the specific language governing rights and - * limitations under the License. - * - * @APPLE_LICENSE_HEADER_END@ - */ - -#ifndef _BSM_AUDIT_KEVENTS_H_ -#define _BSM_AUDIT_KEVENTS_H_ - -/* - * Values marked as AUE_NULL are not required to be audited as per CAPP - * - * The second value within comments is the syscall number in Darwin +/*- + * Copyright (c) 2005-2009 Apple Inc. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. Neither the name of Apple Inc. ("Apple") nor the names of + * its contributors may be used to endorse or promote products derived + * from this software without specific prior written permission. * - * Values in the third column are the values assigned by BSM for obsolete - * or old system calls + * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY + * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED + * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY + * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES + * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND + * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF + * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. * - * Values marked as XXX in the third column do not have an - * event number assigned as yet, and have (temporarily) been assigned - * value of AUE_NULL + * $P4: //depot/projects/trustedbsd/openbsm/sys/bsm/audit_kevents.h#6 $ */ -#define AUE_NULL 0 -#define AUE_EXIT 1 /*1*/ -#define AUE_FORK 2 /*2*/ -#define AUE_OPEN 3 /*3*/ -#define AUE_READ AUE_NULL /*4*/ -#define AUE_WRITE AUE_NULL /*5*/ -#define AUE_OPEN_R 72 /*5*/ -#define AUE_OPEN_RC 73 /*5*/ -#define AUE_OPEN_RTC 75 /*5*/ -#define AUE_OPEN_RT 74 /*5*/ -#define AUE_OPEN_RW 80 /*5*/ -#define AUE_OPEN_RWC 81 /*5*/ -#define AUE_OPEN_RWTC 83 /*5*/ -#define AUE_OPEN_RWT 82 /*5*/ -#define AUE_OPEN_W 76 /*5*/ -#define AUE_OPEN_WC 77 /*5*/ -#define AUE_OPEN_WTC 79 /*5*/ -#define AUE_OPEN_WT 78 /*5*/ -#define AUE_CLOSE 112 /*6*/ -#define AU_WAIT4 AUE_NULL /*7*/ -#define AUE_O_CREAT AUE_OPEN_RWTC /*8*/ /*4*/ -#define AUE_LINK 5 /*9*/ -#define AUE_UNLINK 6 /*10*/ -#define AUE_O_EXECV AUE_NULL /*11*/ -#define AUE_CHDIR 8 /*12*/ -#define AUE_FCHDIR 68 /*13*/ -#define AUE_MKNOD 9 /*14*/ -#define AUE_CHMOD 10 /*15*/ -#define AUE_CHOWN 11 /*16*/ -#define AUE_O_SBREAK AUE_NULL /*17*/ -#define AUE_GETFSSTAT 301 /*18*/ -#define AUE_O_LSEEK AUE_NULL /*19*/ -#define AUE_GETPID AUE_NULL /*20*/ -#define AUE_O_MOUNT AUE_NULL /*21*/ -#define AUE_O_UMOUNT AUE_NULL /*22*/ -#define AUE_SETUID 200 /*23*/ -#define AUE_GETUID AUE_NULL /*24*/ -#define AUE_GETEUID AUE_NULL /*25*/ -#define AUE_PTRACE 302 /*26*/ -#define AUE_RECVMSG 190 /*27*/ -#define AUE_SENDMSG 188 /*28*/ -#define AUE_RECVFROM 191 /*29*/ -#define AUE_ACCEPT 33 /*30*/ -#define AUE_GETPEERNAME AUE_NULL /*31*/ -#define AUE_GETSOCKNAME AUE_NULL /*32*/ -#define AUE_ACCESS 14 /*33*/ -#define AUE_CHFLAGS 303 /*34*/ -#define AUE_FCHFLAGS 304 /*35*/ -#define AUE_SYNC AUE_NULL /*36*/ -#define AUE_KILL 15 /*37*/ -#define AUE_O_STAT AUE_STAT /*38*/ -#define AUE_GETPPID AUE_NULL /*39*/ -#define AUE_O_LSTAT AUE_LSTAT /*40*/ -#define AUE_DUP AUE_NULL /*41*/ -#define AUE_PIPE 185 /*42*/ -#define AUE_GETEGID AUE_NULL /*43*/ -#define AUE_PROFILE 305 /*44*/ -#define AUE_KTRACE 306 /*45*/ -#define AUE_REBOOT 308 -#define AUE_SIGACTION AUE_NULL /*46*/ /*XXX*/ -#define AUE_GETGID AUE_NULL /*47*/ -#define AUE_SIGPROCMASK AUE_NULL /*48*/ /*XXX*/ -#define AUE_GETLOGIN AUE_NULL /*49*/ -#define AUE_SETLOGIN 307 /*50*/ -#define AUE_ACCT 18 /*51*/ -#define AUE_SIGPENDING AUE_NULL /*52*/ /*XXX*/ -#define AUE_SIGALTSTACK AUE_NULL /*53*/ /*XXX*/ -#define AUE_IOCTL 158 /*54*/ -#define AUE_SYSTEMBOOT 113 /*55*/ -#define AUE_REVOKE 309 /*56*/ -#define AUE_SYMLINK 21 /*57*/ -#define AUE_READLINK 22 /*58*/ -#define AUE_EXECVE 23 /*59*/ -#define AUE_UMASK 310 /*60*/ -#define AUE_CHROOT 24 /*61*/ -#define AUE_O_FSTAT AUE_FSTAT /*62*/ - -#define AUE_O_GETPAGESIZE AUE_NULL /*64*/ -#define AUE_MSYNC AUE_NULL /*65*/ -#define AUE_VFORK 25 /*66*/ -#define AUE_O_VREAD AUE_NULL /*67*/ -#define AUE_O_VWRITE AUE_NULL /*68*/ -#define AUE_SBRK AUE_NULL /*69*/ /*EOPNOTSUP*/ -#define AUE_SSTK AUE_NULL /*70*/ /*EOPNOTSUP*/ -#define AUE_O_MMAP AUE_MMAP /*71*/ -#define AUE_O_VADVISE AUE_NULL /*72*/ -#define AUE_MUNMAP 213 /*73*/ -#define AUE_MPROTECT 311 /*74*/ -#define AUE_MADVISE AUE_NULL /*75*/ -#define AUE_O_VHANGUP AUE_NULL /*76*/ -#define AUE_O_VLIMIT AUE_NULL /*77*/ -#define AUE_MINCORE AUE_NULL /*78*/ -#define AUE_GETGROUPS AUE_NULL /*79*/ -#define AUE_SETGROUPS 26 /*80*/ -#define AUE_GETPGRP AUE_NULL /*81*/ -#define AUE_SETPGRP 27 /*82*/ -#define AUE_SETITIMER AUE_NULL /*83*/ /*XXX*/ -#define AUE_O_WAIT AUE_NULL /*84*/ -#define AUE_SWAPON 28 /*85*/ -#define AUE_GETITIMER AUE_NULL /*86*/ -#define AUE_O_GETHOSTNAME AUE_NULL /*87*/ -#define AUE_O_SETHOSTNAME AUE_SYSCTL /*88*/ -#define AUE_GETDTABLESIZE AUE_NULL /*89*/ -#define AUE_DUP2 AUE_NULL /*90*/ -#define AUE_O_GETDOPT AUE_NULL /*91*/ -#define AUE_FCNTL 30 /*92*/ -#define AUE_SELECT AUE_NULL /*93*/ -#define AUE_O_SETDOPT AUE_NULL /*94*/ -#define AUE_FSYNC AUE_NULL /*95*/ -#define AUE_SETPRIORITY 312 /*96*/ -#define AUE_SOCKET 183 /*97*/ -#define AUE_CONNECT 32 /*98*/ -#define AUE_O_ACCEPT AUE_NULL /*99*/ -#define AUE_GETPRIORITY AUE_NULL /*100*/ -#define AUE_O_SEND AUE_SENDMSG /*101*/ -#define AUE_O_RECV AUE_RECVMSG /*102*/ -#define AUE_SIGRETURN AUE_NULL /*103*/ /*XXX*/ -#define AUE_BIND 34 /*104*/ -#define AUE_SETSOCKOPT 35 /*105*/ -#define AUE_LISTEN AUE_NULL /*106*/ -#define AUE_O_VTIMES AUE_NULL /*107*/ -#define AUE_O_SIGVEC AUE_NULL /*108*/ -#define AUE_O_SIGBLOCK AUE_NULL /*109*/ -#define AUE_O_SIGSETMASK AUE_NULL /*110*/ -#define AUE_SIGSUSPEND AUE_NULL /*111*/ /*XXX*/ -#define AUE_O_SIGSTACK AUE_NULL /*112*/ -#define AUE_O_RECVMSG AUE_RECVMSG /*113*/ -#define AUE_O_SENDMSG AUE_SENDMSG /*114*/ -#define AUE_O_VTRACE AUE_NULL /*115*/ /*36*/ -#define AUE_GETTIMEOFDAY AUE_NULL /*116*/ -#define AUE_GETRUSAGE AUE_NULL /*117*/ -#define AUE_GTSOCKOPT AUE_NULL /*118*/ -#define AUE_O_RESUBA AUE_NULL /*119*/ -#define AUE_READV AUE_NULL /*120*/ -#define AUE_WRITEV AUE_NULL /*121*/ -#define AUE_SETTIMEOFDAY 313 /*122*/ -#define AUE_FCHOWN 38 /*123*/ -#define AUE_FCHMOD 39 /*124*/ -#define AUE_O_RECVFROM AUE_RECVFROM /*125*/ -#define AUE_O_SETREUID AUE_SETEUID /*126*/ /*40*/ -#define AUE_O_SETREGID AUE_SETEGID /*127*/ /*41*/ -#define AUE_RENAME 42 /*128*/ -#define AUE_O_TRUNCATE AUE_TRUNCATE /*129*/ -#define AUE_O_FTRUNCATE AUE_FTRUNCATE /*130*/ -#define AUE_FLOCK 314 /*131*/ -#define AUE_MKFIFO 315 /*132*/ -#define AUE_SENDTO 184 /*133*/ -#define AUE_SHUTDOWN 46 /*134*/ -#define AUE_SOCKETPAIR 317 /*135*/ -#define AUE_MKDIR 47 /*136*/ -#define AUE_RMDIR 48 /*137*/ -#define AUE_UTIMES 49 /*138*/ -#define AUE_FUTIMES 318 /*139*/ -#define AUE_ADJTIME 50 /*140*/ -#define AUE_O_GETPEERNAME AUE_NULL /*141*/ -#define AUE_O_GETHOSTID AUE_NULL /*142*/ -#define AUE_O_SETHOSTID AUE_NULL /*143*/ -#define AUE_O_GETRLIMIT AUE_NULL /*144*/ -#define AUE_O_SETRLIMIT AUE_SETRLIMIT /*145*/ -#define AUE_O_KILLPG AUE_KILL /*146*/ -#define AUE_SETSID 319 /*147*/ -#define AUE_O_SETQUOTA AUE_NULL /*148*/ -#define AUE_O_QUOTA AUE_NULL /*149*/ -#define AUE_O_GETSOCKNAME AUE_NULL /*150*/ -#define AUE_GETPGID AUE_NULL /*151*/ -#define AUE_SETPRIVEXEC 320 /*152*/ -#define AUE_PREAD AUE_NULL /*153*/ -#define AUE_PWRITE AUE_NULL /*154*/ -#define AUE_NFSSVC 321 /*155*/ -#define AUE_O_GETDIRENTRIES AUE_GETDIRENTRIES /*156*/ -#define AUE_STATFS 54 /*157*/ -#define AUE_FSTATFS 55 /*158*/ -#define AUE_UNMOUNT 12 /*159*/ -#define AUE_O_ASYNCDAEMON AUE_NULL /*160*/ -#define AUE_GETFH 322 /*161*/ -#define AUE_O_GETDOMAINNAME AUE_NULL /*162*/ -#define AUE_O_SETDOMAINNAME AUE_SYSCTL /*163*/ -#define AUE_O_PCFS_MOUNT AUE_NULL /*164*/ -#define AUE_QUOTACTL 60 /*165*/ -#define AUE_O_EXPORTFS AUE_NULL /*166*/ -#define AUE_MOUNT 62 /*167*/ -#define AUE_O_USTATE AUE_NULL /*168*/ -#define AUE_TABLE AUE_NULL /*170*/ /*ENOSYS*/ -#define AUE_O_WAIT3 AUE_NULL /*171*/ -#define AUE_O_RPAUSE AUE_NULL /*172*/ -#define AUE_O_GETDENTS AUE_NULL /*174*/ -#define AUE_GCCONTROL AUE_NULL /*175*/ /*ENOSYS*/ -#define AUE_ADDPROFILE 324 /*176*/ - -#define AUE_KDBUGTRACE 325 /*180*/ -#define AUE_SETGID 205 /*181*/ -#define AUE_SETEGID 214 /*182*/ -#define AUE_SETEUID 215 /*183*/ - -#define AUE_STAT 16 /*188*/ -#define AUE_FSTAT 326 /*189*/ -#define AUE_LSTAT 17 /*190*/ -#define AUE_PATHCONF 71 /*191*/ -#define AUE_FPATHCONF 327 /*192*/ -#define AUE_GETRLIMIT AUE_NULL /*194*/ -#define AUE_SETRLIMIT 51 /*195*/ -#define AUE_GETDIRENTRIES 328 /*196*/ -#define AUE_MMAP 210 /*197*/ -#define AUE_SYSCALL AUE_NULL /*198*/ /*ENOSYS*/ -#define AUE_LSEEK AUE_NULL /*199*/ -#define AUE_TRUNCATE 329 /*200*/ -#define AUE_FTRUNCATE 330 /*201*/ -#define AUE_SYSCTL 331 /*202*/ -#define AUE_MLOCK 332 /*203*/ -#define AUE_MUNLOCK 333 /*204*/ -#define AUE_UNDELETE 334 /*205*/ +#ifndef _BSM_AUDIT_KEVENTS_H_ +#define _BSM_AUDIT_KEVENTS_H_ -#define AUE_MKCOMPLEX AUE_NULL /*216*/ /*XXX*/ -#define AUE_STATV AUE_NULL /*217*/ /*EOPNOTSUPP*/ -#define AUE_LSTATV AUE_NULL /*218*/ /*EOPNOTSUPP*/ -#define AUE_FSTATV AUE_NULL /*219*/ /*EOPNOTSUPP*/ -#define AUE_GETATTRLIST 335 /*220*/ -#define AUE_SETATTRLIST 336 /*221*/ -#define AUE_GETDIRENTRIESATTR 337 /*222*/ -#define AUE_EXCHANGEDATA 338 /*223*/ -#define AUE_CHECKUSERACCESS AUE_ACCESS /*224*/ /* To Be Removed */ -#define AUE_SEARCHFS 339 /*225*/ +/* + * The reserved event numbers for kernel events are 1...2047 and 43001..44900. + */ +#define AUE_IS_A_KEVENT(e) (((e) > 0 && (e) < 2048) || \ + ((e) > 43000 && (e) < 44901)) -#define AUE_DELETE AUE_UNLINK /*226*/ /* reserved */ -#define AUE_COPYFILE 361 /*227*/ /* reserved */ -#define AUE_WATCHEVENT AUE_NULL /*231*/ /* reserved */ -#define AUE_WAITEVENT AUE_NULL /*232*/ /* reserved */ -#define AUE_MODWATCH AUE_NULL /*233*/ /* reserved */ -#define AUE_FSCTL AUE_NULL /*242*/ /* reserved */ +/* + * Values marked as AUE_NULL are not required to be audited as per CAPP. + * + * Some conflicts exist in the assignment of name to event number mappings + * between BSM implementations. In general, we prefer the OpenSolaris + * definition as we consider Solaris BSM to be authoritative. _DARWIN_ has + * been inserted for the Darwin variants. If necessary, other tags will be + * added in the future. + */ +#define AUE_NULL 0 +#define AUE_EXIT 1 +#define AUE_FORK 2 +#define AUE_FORKALL AUE_FORK /* Solaris-specific. */ +#define AUE_OPEN 3 +#define AUE_CREAT 4 +#define AUE_LINK 5 +#define AUE_UNLINK 6 +#define AUE_DELETE AUE_UNLINK /* Darwin-specific. */ +#define AUE_EXEC 7 +#define AUE_CHDIR 8 +#define AUE_MKNOD 9 +#define AUE_CHMOD 10 +#define AUE_CHOWN 11 +#define AUE_UMOUNT 12 +#define AUE_JUNK 13 /* Solaris-specific. */ +#define AUE_ACCESS 14 +#define AUE_KILL 15 +#define AUE_STAT 16 +#define AUE_LSTAT 17 +#define AUE_ACCT 18 +#define AUE_MCTL 19 /* Solaris-specific. */ +#define AUE_REBOOT 20 /* XXX: Darwin conflict. */ +#define AUE_SYMLINK 21 +#define AUE_READLINK 22 +#define AUE_EXECVE 23 +#define AUE_CHROOT 24 +#define AUE_VFORK 25 +#define AUE_SETGROUPS 26 +#define AUE_SETPGRP 27 +#define AUE_SWAPON 28 +#define AUE_SETHOSTNAME 29 /* XXX: Darwin conflict. */ +#define AUE_FCNTL 30 +#define AUE_SETPRIORITY 31 /* XXX: Darwin conflict. */ +#define AUE_CONNECT 32 +#define AUE_ACCEPT 33 +#define AUE_BIND 34 +#define AUE_SETSOCKOPT 35 +#define AUE_VTRACE 36 /* Solaris-specific. */ +#define AUE_SETTIMEOFDAY 37 /* XXX: Darwin conflict. */ +#define AUE_FCHOWN 38 +#define AUE_FCHMOD 39 +#define AUE_SETREUID 40 +#define AUE_SETREGID 41 +#define AUE_RENAME 42 +#define AUE_TRUNCATE 43 /* XXX: Darwin conflict. */ +#define AUE_FTRUNCATE 44 /* XXX: Darwin conflict. */ +#define AUE_FLOCK 45 /* XXX: Darwin conflict. */ +#define AUE_SHUTDOWN 46 +#define AUE_MKDIR 47 +#define AUE_RMDIR 48 +#define AUE_UTIMES 49 +#define AUE_ADJTIME 50 +#define AUE_SETRLIMIT 51 +#define AUE_KILLPG 52 +#define AUE_NFS_SVC 53 /* XXX: Darwin conflict. */ +#define AUE_STATFS 54 +#define AUE_FSTATFS 55 +#define AUE_UNMOUNT 56 /* XXX: Darwin conflict. */ +#define AUE_ASYNC_DAEMON 57 +#define AUE_NFS_GETFH 58 /* XXX: Darwin conflict. */ +#define AUE_SETDOMAINNAME 59 +#define AUE_QUOTACTL 60 /* XXX: Darwin conflict. */ +#define AUE_EXPORTFS 61 +#define AUE_MOUNT 62 +#define AUE_SEMSYS 63 +#define AUE_MSGSYS 64 +#define AUE_SHMSYS 65 +#define AUE_BSMSYS 66 /* Solaris-specific. */ +#define AUE_RFSSYS 67 /* Solaris-specific. */ +#define AUE_FCHDIR 68 +#define AUE_FCHROOT 69 +#define AUE_VPIXSYS 70 /* Solaris-specific. */ +#define AUE_PATHCONF 71 +#define AUE_OPEN_R 72 +#define AUE_OPEN_RC 73 +#define AUE_OPEN_RT 74 +#define AUE_OPEN_RTC 75 +#define AUE_OPEN_W 76 +#define AUE_OPEN_WC 77 +#define AUE_OPEN_WT 78 +#define AUE_OPEN_WTC 79 +#define AUE_OPEN_RW 80 +#define AUE_OPEN_RWC 81 +#define AUE_OPEN_RWT 82 +#define AUE_OPEN_RWTC 83 +#define AUE_MSGCTL 84 +#define AUE_MSGCTL_RMID 85 +#define AUE_MSGCTL_SET 86 +#define AUE_MSGCTL_STAT 87 +#define AUE_MSGGET 88 +#define AUE_MSGRCV 89 +#define AUE_MSGSND 90 +#define AUE_SHMCTL 91 +#define AUE_SHMCTL_RMID 92 +#define AUE_SHMCTL_SET 93 +#define AUE_SHMCTL_STAT 94 +#define AUE_SHMGET 95 +#define AUE_SHMAT 96 +#define AUE_SHMDT 97 +#define AUE_SEMCTL 98 +#define AUE_SEMCTL_RMID 99 +#define AUE_SEMCTL_SET 100 +#define AUE_SEMCTL_STAT 101 +#define AUE_SEMCTL_GETNCNT 102 +#define AUE_SEMCTL_GETPID 103 +#define AUE_SEMCTL_GETVAL 104 +#define AUE_SEMCTL_GETALL 105 +#define AUE_SEMCTL_GETZCNT 106 +#define AUE_SEMCTL_SETVAL 107 +#define AUE_SEMCTL_SETALL 108 +#define AUE_SEMGET 109 +#define AUE_SEMOP 110 +#define AUE_CORE 111 /* Solaris-specific, currently. */ +#define AUE_CLOSE 112 +#define AUE_SYSTEMBOOT 113 /* Solaris-specific. */ +#define AUE_ASYNC_DAEMON_EXIT 114 /* Solaris-specific. */ +#define AUE_NFSSVC_EXIT 115 /* Solaris-specific. */ +#define AUE_WRITEL 128 /* Solaris-specific. */ +#define AUE_WRITEVL 129 /* Solaris-specific. */ +#define AUE_GETAUID 130 +#define AUE_SETAUID 131 +#define AUE_GETAUDIT 132 +#define AUE_SETAUDIT 133 +#define AUE_GETUSERAUDIT 134 /* Solaris-specific. */ +#define AUE_SETUSERAUDIT 135 /* Solaris-specific. */ +#define AUE_AUDITSVC 136 /* Solaris-specific. */ +#define AUE_AUDITUSER 137 /* Solaris-specific. */ +#define AUE_AUDITON 138 +#define AUE_AUDITON_GTERMID 139 /* Solaris-specific. */ +#define AUE_AUDITON_STERMID 140 /* Solaris-specific. */ +#define AUE_AUDITON_GPOLICY 141 +#define AUE_AUDITON_SPOLICY 142 +#define AUE_AUDITON_GQCTRL 145 +#define AUE_AUDITON_SQCTRL 146 +#define AUE_GETKERNSTATE 147 /* Solaris-specific. */ +#define AUE_SETKERNSTATE 148 /* Solaris-specific. */ +#define AUE_GETPORTAUDIT 149 /* Solaris-specific. */ +#define AUE_AUDITSTAT 150 /* Solaris-specific. */ +#define AUE_REVOKE 151 +#define AUE_MAC 152 /* Solaris-specific. */ +#define AUE_ENTERPROM 153 /* Solaris-specific. */ +#define AUE_EXITPROM 154 /* Solaris-specific. */ +#define AUE_IFLOAT 155 /* Solaris-specific. */ +#define AUE_PFLOAT 156 /* Solaris-specific. */ +#define AUE_UPRIV 157 /* Solaris-specific. */ +#define AUE_IOCTL 158 +#define AUE_SOCKET 183 +#define AUE_SENDTO 184 +#define AUE_PIPE 185 +#define AUE_SOCKETPAIR 186 /* XXX: Darwin conflict. */ +#define AUE_SEND 187 +#define AUE_SENDMSG 188 +#define AUE_RECV 189 +#define AUE_RECVMSG 190 +#define AUE_RECVFROM 191 +#define AUE_READ 192 +#define AUE_GETDENTS 193 +#define AUE_LSEEK 194 +#define AUE_WRITE 195 +#define AUE_WRITEV 196 +#define AUE_NFS 197 /* Solaris-specific. */ +#define AUE_READV 198 +#define AUE_OSTAT 199 /* Solaris-specific. */ +#define AUE_SETUID 200 /* XXXRW: Solaris old setuid? */ +#define AUE_STIME 201 /* XXXRW: Solaris old stime? */ +#define AUE_UTIME 202 /* XXXRW: Solaris old utime? */ +#define AUE_NICE 203 /* XXXRW: Solaris old nice? */ +#define AUE_OSETPGRP 204 /* Solaris-specific. */ +#define AUE_SETGID 205 +#define AUE_READL 206 /* Solaris-specific. */ +#define AUE_READVL 207 /* Solaris-specific. */ +#define AUE_FSTAT 208 +#define AUE_DUP2 209 +#define AUE_MMAP 210 +#define AUE_AUDIT 211 +#define AUE_PRIOCNTLSYS 212 /* Solaris-specific. */ +#define AUE_MUNMAP 213 +#define AUE_SETEGID 214 +#define AUE_SETEUID 215 +#define AUE_PUTMSG 216 /* Solaris-specific. */ +#define AUE_GETMSG 217 /* Solaris-specific. */ +#define AUE_PUTPMSG 218 /* Solaris-specific. */ +#define AUE_GETPMSG 219 /* Solaris-specific. */ +#define AUE_AUDITSYS 220 /* Solaris-specific. */ +#define AUE_AUDITON_GETKMASK 221 +#define AUE_AUDITON_SETKMASK 222 +#define AUE_AUDITON_GETCWD 223 +#define AUE_AUDITON_GETCAR 224 +#define AUE_AUDITON_GETSTAT 225 +#define AUE_AUDITON_SETSTAT 226 +#define AUE_AUDITON_SETUMASK 227 +#define AUE_AUDITON_SETSMASK 228 +#define AUE_AUDITON_GETCOND 229 +#define AUE_AUDITON_SETCOND 230 +#define AUE_AUDITON_GETCLASS 231 +#define AUE_AUDITON_SETCLASS 232 +#define AUE_FUSERS 233 /* Solaris-specific; also UTSSYS? */ +#define AUE_STATVFS 234 +#define AUE_XSTAT 235 /* Solaris-specific. */ +#define AUE_LXSTAT 236 /* Solaris-specific. */ +#define AUE_LCHOWN 237 +#define AUE_MEMCNTL 238 /* Solaris-specific. */ +#define AUE_SYSINFO 239 /* Solaris-specific. */ +#define AUE_XMKNOD 240 /* Solaris-specific. */ +#define AUE_FORK1 241 +#define AUE_MODCTL 242 /* Solaris-specific. */ +#define AUE_MODLOAD 243 +#define AUE_MODUNLOAD 244 +#define AUE_MODCONFIG 245 /* Solaris-specific. */ +#define AUE_MODADDMAJ 246 /* Solaris-specific. */ +#define AUE_SOCKACCEPT 247 /* Solaris-specific. */ +#define AUE_SOCKCONNECT 248 /* Solaris-specific. */ +#define AUE_SOCKSEND 249 /* Solaris-specific. */ +#define AUE_SOCKRECEIVE 250 /* Solaris-specific. */ +#define AUE_ACLSET 251 +#define AUE_FACLSET 252 +#define AUE_DOORFS 253 /* Solaris-specific. */ +#define AUE_DOORFS_DOOR_CALL 254 /* Solaris-specific. */ +#define AUE_DOORFS_DOOR_RETURN 255 /* Solaris-specific. */ +#define AUE_DOORFS_DOOR_CREATE 256 /* Solaris-specific. */ +#define AUE_DOORFS_DOOR_REVOKE 257 /* Solaris-specific. */ +#define AUE_DOORFS_DOOR_INFO 258 /* Solaris-specific. */ +#define AUE_DOORFS_DOOR_CRED 259 /* Solaris-specific. */ +#define AUE_DOORFS_DOOR_BIND 260 /* Solaris-specific. */ +#define AUE_DOORFS_DOOR_UNBIND 261 /* Solaris-specific. */ +#define AUE_P_ONLINE 262 /* Solaris-specific. */ +#define AUE_PROCESSOR_BIND 263 /* Solaris-specific. */ +#define AUE_INST_SYNC 264 /* Solaris-specific. */ +#define AUE_SOCKCONFIG 265 /* Solaris-specific. */ +#define AUE_SETAUDIT_ADDR 266 +#define AUE_GETAUDIT_ADDR 267 +#define AUE_UMOUNT2 268 /* Solaris-specific. */ +#define AUE_FSAT 269 /* Solaris-specific. */ +#define AUE_OPENAT_R 270 +#define AUE_OPENAT_RC 271 +#define AUE_OPENAT_RT 272 +#define AUE_OPENAT_RTC 273 +#define AUE_OPENAT_W 274 +#define AUE_OPENAT_WC 275 +#define AUE_OPENAT_WT 276 +#define AUE_OPENAT_WTC 277 +#define AUE_OPENAT_RW 278 +#define AUE_OPENAT_RWC 279 +#define AUE_OPENAT_RWT 280 +#define AUE_OPENAT_RWTC 281 +#define AUE_RENAMEAT 282 +#define AUE_FSTATAT 283 +#define AUE_FCHOWNAT 284 +#define AUE_FUTIMESAT 285 +#define AUE_UNLINKAT 286 +#define AUE_CLOCK_SETTIME 287 +#define AUE_NTP_ADJTIME 288 +#define AUE_SETPPRIV 289 /* Solaris-specific. */ +#define AUE_MODDEVPLCY 290 /* Solaris-specific. */ +#define AUE_MODADDPRIV 291 /* Solaris-specific. */ +#define AUE_CRYPTOADM 292 /* Solaris-specific. */ +#define AUE_CONFIGKSSL 293 /* Solaris-specific. */ +#define AUE_BRANDSYS 294 /* Solaris-specific. */ +#define AUE_PF_POLICY_ADDRULE 295 /* Solaris-specific. */ +#define AUE_PF_POLICY_DELRULE 296 /* Solaris-specific. */ +#define AUE_PF_POLICY_CLONE 297 /* Solaris-specific. */ +#define AUE_PF_POLICY_FLIP 298 /* Solaris-specific. */ +#define AUE_PF_POLICY_FLUSH 299 /* Solaris-specific. */ +#define AUE_PF_POLICY_ALGS 300 /* Solaris-specific. */ +#define AUE_PORTFS 301 /* Solaris-specific. */ -#define AUE_MINHERIT 340 /*250*/ -#define AUE_SEMSYS AUE_NULL /*251*/ /* To Be Removed */ -#define AUE_MSGSYS AUE_NULL /*252*/ /* To Be Removed */ -#define AUE_SHMSYS AUE_NULL /*253*/ -#define AUE_SEMCTL 98 /*254*/ -#define AUE_SEMCTL_GETALL 105 /*254*/ -#define AUE_SEMCTL_GETNCNT 102 /*254*/ -#define AUE_SEMCTL_GETPID 103 /*254*/ -#define AUE_SEMCTL_GETVAL 104 /*254*/ -#define AUE_SEMCTL_GETZCNT 106 /*254*/ -#define AUE_SEMCTL_RMID 99 /*254*/ -#define AUE_SEMCTL_SET 100 /*254*/ -#define AUE_SEMCTL_SETALL 108 /*254*/ -#define AUE_SEMCTL_SETVAL 107 /*254*/ -#define AUE_SEMCTL_STAT 101 /*254*/ -#define AUE_SEMGET 109 /*255*/ -#define AUE_SEMOP 110 /*256*/ -#define AUE_SEMCONFIG 341 /*257*/ -#define AUE_MSGCL AUE_NULL /*258*/ /*EOPNOTSUPP*/ -#define AUE_MSGGET 88 /*259*/ /*88-EOPNOTSUPP*/ -#define AUE_MSGRCV 89 /*261*/ /*89-EOPNOTSUPP*/ -#define AUE_MSGSND 90 /*260*/ /*90-EOPNOTSUPP*/ -#define AUE_SHMAT 96 /*262*/ -#define AUE_SHMCTL 91 /*263*/ -#define AUE_SHMCTL_RMID 92 /*263*/ -#define AUE_SHMCTL_SET 93 /*263*/ -#define AUE_SHMCTL_STAT 94 /*263*/ -#define AUE_SHMDT 97 /*264*/ -#define AUE_SHMGET 95 /*265*/ -#define AUE_SHMOPEN 345 /*266*/ -#define AUE_SHMUNLINK 346 /*267*/ -#define AUE_SEMOPEN 342 /*268*/ -#define AUE_SEMCLOSE 343 /*269*/ -#define AUE_SEMUNLINK 344 /*270*/ -#define AUE_SEMWAIT AUE_NULL /*271*/ -#define AUE_SEMTRYWAIT AUE_NULL /*272*/ -#define AUE_SEMPOST AUE_NULL /*273*/ -#define AUE_SEMGETVALUE AUE_NULL /*274*/ /*ENOSYS*/ -#define AUE_SEMINIT AUE_NULL /*275*/ /*ENOSYS*/ -#define AUE_SEMDESTROY AUE_NULL /*276*/ /*ENOSYS*/ +/* + * Events added for Apple Darwin that potentially collide with future Solaris + * BSM events. These are assigned AUE_DARWIN prefixes, and are deprecated in + * new trails. Systems generating these events should switch to the new + * identifiers that avoid colliding with the Solaris identifier space. + */ +#define AUE_DARWIN_GETFSSTAT 301 +#define AUE_DARWIN_PTRACE 302 +#define AUE_DARWIN_CHFLAGS 303 +#define AUE_DARWIN_FCHFLAGS 304 +#define AUE_DARWIN_PROFILE 305 +#define AUE_DARWIN_KTRACE 306 +#define AUE_DARWIN_SETLOGIN 307 +#define AUE_DARWIN_REBOOT 308 +#define AUE_DARWIN_REVOKE 309 +#define AUE_DARWIN_UMASK 310 +#define AUE_DARWIN_MPROTECT 311 +#define AUE_DARWIN_SETPRIORITY 312 +#define AUE_DARWIN_SETTIMEOFDAY 313 +#define AUE_DARWIN_FLOCK 314 +#define AUE_DARWIN_MKFIFO 315 +#define AUE_DARWIN_POLL 316 +#define AUE_DARWIN_SOCKETPAIR 317 +#define AUE_DARWIN_FUTIMES 318 +#define AUE_DARWIN_SETSID 319 +#define AUE_DARWIN_SETPRIVEXEC 320 /* Darwin-specific. */ +#define AUE_DARWIN_NFSSVC 321 +#define AUE_DARWIN_GETFH 322 +#define AUE_DARWIN_QUOTACTL 323 +#define AUE_DARWIN_ADDPROFILE 324 /* Darwin-specific. */ +#define AUE_DARWIN_KDEBUGTRACE 325 /* Darwin-specific. */ +#define AUE_DARWIN_KDBUGTRACE AUE_KDEBUGTRACE +#define AUE_DARWIN_FSTAT 326 +#define AUE_DARWIN_FPATHCONF 327 +#define AUE_DARWIN_GETDIRENTRIES 328 +#define AUE_DARWIN_TRUNCATE 329 +#define AUE_DARWIN_FTRUNCATE 330 +#define AUE_DARWIN_SYSCTL 331 +#define AUE_DARWIN_MLOCK 332 +#define AUE_DARWIN_MUNLOCK 333 +#define AUE_DARWIN_UNDELETE 334 +#define AUE_DARWIN_GETATTRLIST 335 /* Darwin-specific. */ +#define AUE_DARWIN_SETATTRLIST 336 /* Darwin-specific. */ +#define AUE_DARWIN_GETDIRENTRIESATTR 337 /* Darwin-specific. */ +#define AUE_DARWIN_EXCHANGEDATA 338 /* Darwin-specific. */ +#define AUE_DARWIN_SEARCHFS 339 /* Darwin-specific. */ +#define AUE_DARWIN_MINHERIT 340 +#define AUE_DARWIN_SEMCONFIG 341 +#define AUE_DARWIN_SEMOPEN 342 +#define AUE_DARWIN_SEMCLOSE 343 +#define AUE_DARWIN_SEMUNLINK 344 +#define AUE_DARWIN_SHMOPEN 345 +#define AUE_DARWIN_SHMUNLINK 346 +#define AUE_DARWIN_LOADSHFILE 347 /* Darwin-specific. */ +#define AUE_DARWIN_RESETSHFILE 348 /* Darwin-specific. */ +#define AUE_DARWIN_NEWSYSTEMSHREG 349 /* Darwin-specific. */ +#define AUE_DARWIN_PTHREADKILL 350 /* Darwin-specific. */ +#define AUE_DARWIN_PTHREADSIGMASK 351 /* Darwin-specific. */ +#define AUE_DARWIN_AUDITCTL 352 +#define AUE_DARWIN_RFORK 353 +#define AUE_DARWIN_LCHMOD 354 +#define AUE_DARWIN_SWAPOFF 355 +#define AUE_DARWIN_INITPROCESS 356 /* Darwin-specific. */ +#define AUE_DARWIN_MAPFD 357 /* Darwin-specific. */ +#define AUE_DARWIN_TASKFORPID 358 /* Darwin-specific. */ +#define AUE_DARWIN_PIDFORTASK 359 /* Darwin-specific. */ +#define AUE_DARWIN_SYSCTL_NONADMIN 360 +#define AUE_DARWIN_COPYFILE 361 /* Darwin-specific. */ -#define AUE_LOADSHFILE 347 /*296*/ -#define AUE_RESETSHFILE 348 /*297*/ -#define AUE_NEWSYSTEMSHREG 349 /*298*/ +/* + * Audit event identifiers added as part of OpenBSM, generally corresponding + * to events in FreeBSD, Darwin, and Linux that were not present in Solaris. + * These often duplicate events added to the Solaris set by Darwin, but use + * event identifiers in a higher range in order to avoid colliding with + * future Solaris additions. + * + * If an event in this section is later added to Solaris, we prefer the + * Solaris event identifier, and add _OPENBSM_ to the OpenBSM-specific + * identifier so that old trails can still be processed, but new trails use + * the Solaris identifier. + */ +#define AUE_GETFSSTAT 43001 +#define AUE_PTRACE 43002 +#define AUE_CHFLAGS 43003 +#define AUE_FCHFLAGS 43004 +#define AUE_PROFILE 43005 +#define AUE_KTRACE 43006 +#define AUE_SETLOGIN 43007 +#define AUE_OPENBSM_REVOKE 43008 /* Solaris event now preferred. */ +#define AUE_UMASK 43009 +#define AUE_MPROTECT 43010 +#define AUE_MKFIFO 43011 +#define AUE_POLL 43012 +#define AUE_FUTIMES 43013 +#define AUE_SETSID 43014 +#define AUE_SETPRIVEXEC 43015 /* Darwin-specific. */ +#define AUE_ADDPROFILE 43016 /* Darwin-specific. */ +#define AUE_KDEBUGTRACE 43017 /* Darwin-specific. */ +#define AUE_KDBUGTRACE AUE_KDEBUGTRACE +#define AUE_OPENBSM_FSTAT 43018 /* Solaris event now preferred. */ +#define AUE_FPATHCONF 43019 +#define AUE_GETDIRENTRIES 43020 +#define AUE_SYSCTL 43021 +#define AUE_MLOCK 43022 +#define AUE_MUNLOCK 43023 +#define AUE_UNDELETE 43024 +#define AUE_GETATTRLIST 43025 /* Darwin-specific. */ +#define AUE_SETATTRLIST 43026 /* Darwin-specific. */ +#define AUE_GETDIRENTRIESATTR 43027 /* Darwin-specific. */ +#define AUE_EXCHANGEDATA 43028 /* Darwin-specific. */ +#define AUE_SEARCHFS 43029 /* Darwin-specific. */ +#define AUE_MINHERIT 43030 +#define AUE_SEMCONFIG 43031 +#define AUE_SEMOPEN 43032 +#define AUE_SEMCLOSE 43033 +#define AUE_SEMUNLINK 43034 +#define AUE_SHMOPEN 43035 +#define AUE_SHMUNLINK 43036 +#define AUE_LOADSHFILE 43037 /* Darwin-specific. */ +#define AUE_RESETSHFILE 43038 /* Darwin-specific. */ +#define AUE_NEWSYSTEMSHREG 43039 /* Darwin-specific. */ +#define AUE_PTHREADKILL 43040 /* Darwin-specific. */ +#define AUE_PTHREADSIGMASK 43041 /* Darwin-specific. */ +#define AUE_AUDITCTL 43042 +#define AUE_RFORK 43043 +#define AUE_LCHMOD 43044 +#define AUE_SWAPOFF 43045 +#define AUE_INITPROCESS 43046 /* Darwin-specific. */ +#define AUE_MAPFD 43047 /* Darwin-specific. */ +#define AUE_TASKFORPID 43048 /* Darwin-specific. */ +#define AUE_PIDFORTASK 43049 /* Darwin-specific. */ +#define AUE_SYSCTL_NONADMIN 43050 +#define AUE_COPYFILE 43051 /* Darwin-specific. */ -#define AUE_GETSID AUE_NULL /*310*/ +/* + * Events added to OpenBSM for FreeBSD and Linux; may also be used by Darwin + * in the future. + */ +#define AUE_LUTIMES 43052 +#define AUE_LCHFLAGS 43053 /* FreeBSD-specific. */ +#define AUE_SENDFILE 43054 /* BSD/Linux-specific. */ +#define AUE_USELIB 43055 /* Linux-specific. */ +#define AUE_GETRESUID 43056 +#define AUE_SETRESUID 43057 +#define AUE_GETRESGID 43058 +#define AUE_SETRESGID 43059 +#define AUE_WAIT4 43060 /* FreeBSD-specific. */ +#define AUE_LGETFH 43061 /* FreeBSD-specific. */ +#define AUE_FHSTATFS 43062 /* FreeBSD-specific. */ +#define AUE_FHOPEN 43063 /* FreeBSD-specific. */ +#define AUE_FHSTAT 43064 /* FreeBSD-specific. */ +#define AUE_JAIL 43065 /* FreeBSD-specific. */ +#define AUE_EACCESS 43066 /* FreeBSD-specific. */ +#define AUE_KQUEUE 43067 /* FreeBSD-specific. */ +#define AUE_KEVENT 43068 /* FreeBSD-specific. */ +#define AUE_FSYNC 43069 +#define AUE_NMOUNT 43070 /* FreeBSD-specific. */ +#define AUE_BDFLUSH 43071 /* Linux-specific. */ +#define AUE_SETFSUID 43072 /* Linux-specific. */ +#define AUE_SETFSGID 43073 /* Linux-specific. */ +#define AUE_PERSONALITY 43074 /* Linux-specific. */ +#define AUE_SCHED_GETSCHEDULER 43075 /* POSIX.1b. */ +#define AUE_SCHED_SETSCHEDULER 43076 /* POSIX.1b. */ +#define AUE_PRCTL 43077 /* Linux-specific. */ +#define AUE_GETCWD 43078 /* FreeBSD/Linux-specific. */ +#define AUE_CAPGET 43079 /* Linux-specific. */ +#define AUE_CAPSET 43080 /* Linux-specific. */ +#define AUE_PIVOT_ROOT 43081 /* Linux-specific. */ +#define AUE_RTPRIO 43082 /* FreeBSD-specific. */ +#define AUE_SCHED_GETPARAM 43083 /* POSIX.1b. */ +#define AUE_SCHED_SETPARAM 43084 /* POSIX.1b. */ +#define AUE_SCHED_GET_PRIORITY_MAX 43085 /* POSIX.1b. */ +#define AUE_SCHED_GET_PRIORITY_MIN 43086 /* POSIX.1b. */ +#define AUE_SCHED_RR_GET_INTERVAL 43087 /* POSIX.1b. */ +#define AUE_ACL_GET_FILE 43088 /* FreeBSD. */ +#define AUE_ACL_SET_FILE 43089 /* FreeBSD. */ +#define AUE_ACL_GET_FD 43090 /* FreeBSD. */ +#define AUE_ACL_SET_FD 43091 /* FreeBSD. */ +#define AUE_ACL_DELETE_FILE 43092 /* FreeBSD. */ +#define AUE_ACL_DELETE_FD 43093 /* FreeBSD. */ +#define AUE_ACL_CHECK_FILE 43094 /* FreeBSD. */ +#define AUE_ACL_CHECK_FD 43095 /* FreeBSD. */ +#define AUE_ACL_GET_LINK 43096 /* FreeBSD. */ +#define AUE_ACL_SET_LINK 43097 /* FreeBSD. */ +#define AUE_ACL_DELETE_LINK 43098 /* FreeBSD. */ +#define AUE_ACL_CHECK_LINK 43099 /* FreeBSD. */ +#define AUE_SYSARCH 43100 /* FreeBSD. */ +#define AUE_EXTATTRCTL 43101 /* FreeBSD. */ +#define AUE_EXTATTR_GET_FILE 43102 /* FreeBSD. */ +#define AUE_EXTATTR_SET_FILE 43103 /* FreeBSD. */ +#define AUE_EXTATTR_LIST_FILE 43104 /* FreeBSD. */ +#define AUE_EXTATTR_DELETE_FILE 43105 /* FreeBSD. */ +#define AUE_EXTATTR_GET_FD 43106 /* FreeBSD. */ +#define AUE_EXTATTR_SET_FD 43107 /* FreeBSD. */ +#define AUE_EXTATTR_LIST_FD 43108 /* FreeBSD. */ +#define AUE_EXTATTR_DELETE_FD 43109 /* FreeBSD. */ +#define AUE_EXTATTR_GET_LINK 43110 /* FreeBSD. */ +#define AUE_EXTATTR_SET_LINK 43111 /* FreeBSD. */ +#define AUE_EXTATTR_LIST_LINK 43112 /* FreeBSD. */ +#define AUE_EXTATTR_DELETE_LINK 43113 /* FreeBSD. */ +#define AUE_KENV 43114 /* FreeBSD. */ +#define AUE_JAIL_ATTACH 43115 /* FreeBSD. */ +#define AUE_SYSCTL_WRITE 43116 /* FreeBSD. */ +#define AUE_IOPERM 43117 /* Linux. */ +#define AUE_READDIR 43118 /* Linux. */ +#define AUE_IOPL 43119 /* Linux. */ +#define AUE_VM86 43120 /* Linux. */ +#define AUE_MAC_GET_PROC 43121 /* FreeBSD/Darwin. */ +#define AUE_MAC_SET_PROC 43122 /* FreeBSD/Darwin. */ +#define AUE_MAC_GET_FD 43123 /* FreeBSD/Darwin. */ +#define AUE_MAC_GET_FILE 43124 /* FreeBSD/Darwin. */ +#define AUE_MAC_SET_FD 43125 /* FreeBSD/Darwin. */ +#define AUE_MAC_SET_FILE 43126 /* FreeBSD/Darwin. */ +#define AUE_MAC_SYSCALL 43127 /* FreeBSD. */ +#define AUE_MAC_GET_PID 43128 /* FreeBSD/Darwin. */ +#define AUE_MAC_GET_LINK 43129 /* FreeBSD/Darwin. */ +#define AUE_MAC_SET_LINK 43130 /* FreeBSD/Darwin. */ +#define AUE_MAC_EXECVE 43131 /* FreeBSD/Darwin. */ +#define AUE_GETPATH_FROMFD 43132 /* FreeBSD. */ +#define AUE_GETPATH_FROMADDR 43133 /* FreeBSD. */ +#define AUE_MQ_OPEN 43134 /* FreeBSD. */ +#define AUE_MQ_SETATTR 43135 /* FreeBSD. */ +#define AUE_MQ_TIMEDRECEIVE 43136 /* FreeBSD. */ +#define AUE_MQ_TIMEDSEND 43137 /* FreeBSD. */ +#define AUE_MQ_NOTIFY 43138 /* FreeBSD. */ +#define AUE_MQ_UNLINK 43139 /* FreeBSD. */ +#define AUE_LISTEN 43140 /* FreeBSD/Darwin/Linux. */ +#define AUE_MLOCKALL 43141 /* FreeBSD. */ +#define AUE_MUNLOCKALL 43142 /* FreeBSD. */ +#define AUE_CLOSEFROM 43143 /* FreeBSD. */ +#define AUE_FEXECVE 43144 /* FreeBSD. */ +#define AUE_FACCESSAT 43145 /* FreeBSD. */ +#define AUE_FCHMODAT 43146 /* FreeBSD. */ +#define AUE_LINKAT 43147 /* FreeBSD. */ +#define AUE_MKDIRAT 43148 /* FreeBSD. */ +#define AUE_MKFIFOAT 43149 /* FreeBSD. */ +#define AUE_MKNODAT 43150 /* FreeBSD. */ +#define AUE_READLINKAT 43151 /* FreeBSD. */ +#define AUE_SYMLINKAT 43152 /* FreeBSD. */ +#define AUE_MAC_GETFSSTAT 43153 /* Darwin. */ +#define AUE_MAC_GET_MOUNT 43154 /* Darwin. */ +#define AUE_MAC_GET_LCID 43155 /* Darwin. */ +#define AUE_MAC_GET_LCTX 43156 /* Darwin. */ +#define AUE_MAC_SET_LCTX 43157 /* Darwin. */ +#define AUE_MAC_MOUNT 43158 /* Darwin. */ +#define AUE_GETLCID 43159 /* Darwin. */ +#define AUE_SETLCID 43160 /* Darwin. */ +#define AUE_TASKNAMEFORPID 43161 /* Darwin. */ +#define AUE_ACCESS_EXTENDED 43162 /* Darwin. */ +#define AUE_CHMOD_EXTENDED 43163 /* Darwin. */ +#define AUE_FCHMOD_EXTENDED 43164 /* Darwin. */ +#define AUE_FSTAT_EXTENDED 43165 /* Darwin. */ +#define AUE_LSTAT_EXTENDED 43166 /* Darwin. */ +#define AUE_MKDIR_EXTENDED 43167 /* Darwin. */ +#define AUE_MKFIFO_EXTENDED 43168 /* Darwin. */ +#define AUE_OPEN_EXTENDED 43169 /* Darwin. */ +#define AUE_OPEN_EXTENDED_R 43170 /* Darwin. */ +#define AUE_OPEN_EXTENDED_RC 43171 /* Darwin. */ +#define AUE_OPEN_EXTENDED_RT 43172 /* Darwin. */ +#define AUE_OPEN_EXTENDED_RTC 43173 /* Darwin. */ +#define AUE_OPEN_EXTENDED_W 43174 /* Darwin. */ +#define AUE_OPEN_EXTENDED_WC 43175 /* Darwin. */ +#define AUE_OPEN_EXTENDED_WT 43176 /* Darwin. */ +#define AUE_OPEN_EXTENDED_WTC 43177 /* Darwin. */ +#define AUE_OPEN_EXTENDED_RW 43178 /* Darwin. */ +#define AUE_OPEN_EXTENDED_RWC 43179 /* Darwin. */ +#define AUE_OPEN_EXTENDED_RWT 43180 /* Darwin. */ +#define AUE_OPEN_EXTENDED_RWTC 43181 /* Darwin. */ +#define AUE_STAT_EXTENDED 43182 /* Darwin. */ +#define AUE_UMASK_EXTENDED 43183 /* Darwin. */ +#define AUE_OPENAT 43184 /* FreeBSD. */ +#define AUE_POSIX_OPENPT 43185 /* FreeBSD. */ +#define AUE_CAP_NEW 43186 /* TrustedBSD. */ +#define AUE_CAP_GETRIGHTS 43187 /* TrustedBSD. */ +#define AUE_CAP_ENTER 43188 /* TrustedBSD. */ +#define AUE_CAP_GETMODE 43189 /* TrustedBSD. */ +#define AUE_POSIX_SPAWN 43190 /* Darwin. */ +#define AUE_FSGETPATH 43191 /* Darwin. */ +#define AUE_PREAD 43192 /* Darwin/FreeBSD. */ +#define AUE_PWRITE 43193 /* Darwin/FreeBSD. */ +#define AUE_FSCTL 43194 /* Darwin. */ +#define AUE_FFSCTL 43195 /* Darwin. */ +#define AUE_LPATHCONF 43196 /* FreeBSD. */ +#define AUE_PDFORK 43197 /* FreeBSD. */ +#define AUE_PDKILL 43198 /* FreeBSD. */ +#define AUE_PDGETPID 43199 /* FreeBSD. */ +#define AUE_PDWAIT 43200 /* FreeBSD. */ -#define AUE_MLOCKALL AUE_NULL /*324*/ /*ENOSYS*/ -#define AUE_MUNLOCKALL AUE_NULL /*325*/ /*ENOSYS*/ +#define AUE_SESSION_START 44901 /* Darwin. */ +#define AUE_SESSION_UPDATE 44902 /* Darwin. */ +#define AUE_SESSION_END 44903 /* Darwin. */ +#define AUE_SESSION_CLOSE 44904 /* Darwin. */ -#define AUE_ISSETUGID AUE_NULL /*327*/ -#define AUE_PTHREADKILL 350 /*328*/ -#define AUE_PTHREADSIGMASK 351 /*329*/ -#define AUE_SIGWAIT AUE_NULL /*330*/ /*XXX*/ -#define AUE_SWAPOFF 355 -#define AUE_INITPROCESS 356 -#define AUE_MAPFD 357 -#define AUE_TASKNAMEFORPID AUE_NULL -#define AUE_TASKFORPID 358 -#define AUE_PIDFORTASK 359 -#define AUE_SYSCTL_NONADMIN 360 +/* + * Darwin BSM uses a number of AUE_O_* definitions, which are aliased to the + * normal Solaris BSM identifiers. _O_ refers to it being an old, or compat + * interface. In most cases, Darwin has never implemented these system calls + * but picked up the fields in their system call table from their FreeBSD + * import. Happily, these have different names than the AUE_O* definitions + * in Solaris BSM. + */ +#define AUE_O_CREAT AUE_OPEN_RWTC /* Darwin */ +#define AUE_O_EXECVE AUE_NULL /* Darwin */ +#define AUE_O_SBREAK AUE_NULL /* Darwin */ +#define AUE_O_LSEEK AUE_NULL /* Darwin */ +#define AUE_O_MOUNT AUE_NULL /* Darwin */ +#define AUE_O_UMOUNT AUE_NULL /* Darwin */ +#define AUE_O_STAT AUE_STAT /* Darwin */ +#define AUE_O_LSTAT AUE_LSTAT /* Darwin */ +#define AUE_O_FSTAT AUE_FSTAT /* Darwin */ +#define AUE_O_GETPAGESIZE AUE_NULL /* Darwin */ +#define AUE_O_VREAD AUE_NULL /* Darwin */ +#define AUE_O_VWRITE AUE_NULL /* Darwin */ +#define AUE_O_MMAP AUE_MMAP /* Darwin */ +#define AUE_O_VADVISE AUE_NULL /* Darwin */ +#define AUE_O_VHANGUP AUE_NULL /* Darwin */ +#define AUE_O_VLIMIT AUE_NULL /* Darwin */ +#define AUE_O_WAIT AUE_NULL /* Darwin */ +#define AUE_O_GETHOSTNAME AUE_NULL /* Darwin */ +#define AUE_O_SETHOSTNAME AUE_SYSCTL /* Darwin */ +#define AUE_O_GETDOPT AUE_NULL /* Darwin */ +#define AUE_O_SETDOPT AUE_NULL /* Darwin */ +#define AUE_O_ACCEPT AUE_NULL /* Darwin */ +#define AUE_O_SEND AUE_SENDMSG /* Darwin */ +#define AUE_O_RECV AUE_RECVMSG /* Darwin */ +#define AUE_O_VTIMES AUE_NULL /* Darwin */ +#define AUE_O_SIGVEC AUE_NULL /* Darwin */ +#define AUE_O_SIGBLOCK AUE_NULL /* Darwin */ +#define AUE_O_SIGSETMASK AUE_NULL /* Darwin */ +#define AUE_O_SIGSTACK AUE_NULL /* Darwin */ +#define AUE_O_RECVMSG AUE_RECVMSG /* Darwin */ +#define AUE_O_SENDMSG AUE_SENDMSG /* Darwin */ +#define AUE_O_VTRACE AUE_NULL /* Darwin */ +#define AUE_O_RESUBA AUE_NULL /* Darwin */ +#define AUE_O_RECVFROM AUE_RECVFROM /* Darwin */ +#define AUE_O_SETREUID AUE_SETREUID /* Darwin */ +#define AUE_O_SETREGID AUE_SETREGID /* Darwin */ +#define AUE_O_GETDIRENTRIES AUE_GETDIRENTRIES /* Darwin */ +#define AUE_O_TRUNCATE AUE_TRUNCATE /* Darwin */ +#define AUE_O_FTRUNCATE AUE_FTRUNCATE /* Darwin */ +#define AUE_O_GETPEERNAME AUE_NULL /* Darwin */ +#define AUE_O_GETHOSTID AUE_NULL /* Darwin */ +#define AUE_O_SETHOSTID AUE_NULL /* Darwin */ +#define AUE_O_GETRLIMIT AUE_NULL /* Darwin */ +#define AUE_O_SETRLIMIT AUE_SETRLIMIT /* Darwin */ +#define AUE_O_KILLPG AUE_KILL /* Darwin */ +#define AUE_O_SETQUOTA AUE_NULL /* Darwin */ +#define AUE_O_QUOTA AUE_NULL /* Darwin */ +#define AUE_O_GETSOCKNAME AUE_NULL /* Darwin */ +#define AUE_O_GETDIREENTRIES AUE_GETDIREENTRIES /* Darwin */ +#define AUE_O_ASYNCDAEMON AUE_NULL /* Darwin */ +#define AUE_O_GETDOMAINNAME AUE_NULL /* Darwin */ +#define AUE_O_SETDOMAINNAME AUE_SYSCTL /* Darwin */ +#define AUE_O_PCFS_MOUNT AUE_NULL /* Darwin */ +#define AUE_O_EXPORTFS AUE_NULL /* Darwin */ +#define AUE_O_USTATE AUE_NULL /* Darwin */ +#define AUE_O_WAIT3 AUE_NULL /* Darwin */ +#define AUE_O_RPAUSE AUE_NULL /* Darwin */ +#define AUE_O_GETDENTS AUE_NULL /* Darwin */ -// BSM events - Have to identify which ones are relevant to MacOSX -#define AUE_ACLSET 251 -#define AUE_AUDIT 211 -#define AUE_AUDITON 138 -#define AUE_AUDITON_GETCAR 224 -#define AUE_AUDITON_GETCLASS 231 -#define AUE_AUDITON_GETCOND 229 -#define AUE_AUDITON_GETCWD 223 -#define AUE_AUDITON_GETKMASK 221 -#define AUE_AUDITON_GETSTAT 225 -#define AUE_AUDITON_GPOLICY 141 -#define AUE_AUDITON_GQCTRL 145 -#define AUE_AUDITON_SETCLASS 232 -#define AUE_AUDITON_SETCOND 230 -#define AUE_AUDITON_SETKMASK 222 -#define AUE_AUDITON_SETSMASK 228 -#define AUE_AUDITON_SETSTAT 226 -#define AUE_AUDITON_SETUMASK 227 -#define AUE_AUDITON_SPOLICY 142 -#define AUE_AUDITON_SQCTRL 146 -#define AUE_AUDITCTL 352 -#define AUE_DOORFS_DOOR_BIND 260 -#define AUE_DOORFS_DOOR_CALL 254 -#define AUE_DOORFS_DOOR_CREATE 256 -#define AUE_DOORFS_DOOR_CRED 259 -#define AUE_DOORFS_DOOR_INFO 258 -#define AUE_DOORFS_DOOR_RETURN 255 -#define AUE_DOORFS_DOOR_REVOKE 257 -#define AUE_DOORFS_DOOR_UNBIND 261 -#define AUE_ENTERPROM 153 -#define AUE_EXEC 7 -#define AUE_EXITPROM 154 -#define AUE_FACLSET 252 -#define AUE_FCHROOT 69 -#define AUE_FORK1 241 -#define AUE_GETAUDIT 132 -#define AUE_GETAUDIT_ADDR 267 -#define AUE_GETAUID 130 -#define AUE_GETMSG 217 -#define AUE_SOCKACCEPT 247 -#define AUE_SOCKRECEIVE 250 -#define AUE_GETPMSG 219 -#define AUE_GETPORTAUDIT 149 -#define AUE_INST_SYNC 264 -#define AUE_LCHOWN 237 -#define AUE_LXSTAT 236 -#define AUE_MEMCNTL 238 -#define AUE_MODADDMAJ 246 -#define AUE_MODCONFIG 245 -#define AUE_MODLOAD 243 -#define AUE_MODUNLOAD 244 -#define AUE_MSGCTL 84 -#define AUE_MSGCTL_RMID 85 -#define AUE_MSGCTL_SET 86 -#define AUE_MSGCTL_STAT 87 -#define AUE_NICE 203 -#define AUE_P_ONLINE 262 -#define AUE_PRIOCNTLSYS 212 -#define AUE_CORE 111 -#define AUE_PROCESSOR_BIND 263 -#define AUE_PUTMSG 216 -#define AUE_SOCKCONNECT 248 -#define AUE_SOCKSEND 249 -#define AUE_PUTPMSG 218 -#define AUE_SETAUDIT 133 -#define AUE_SETAUDIT_ADDR 266 -#define AUE_SETAUID 131 -#define AUE_SOCKCONFIG 183 -#define AUE_STATVFS 234 -#define AUE_STIME 201 -#define AUE_SYSINFO 39 -#define AUE_UTIME 202 -#define AUE_UTSYS 233 -#define AUE_XMKNOD 240 -#define AUE_XSTAT 235 +/* + * Possible desired future values based on review of BSD/Darwin system calls. + */ +#define AUE_ATGETMSG AUE_NULL +#define AUE_ATPUTMSG AUE_NULL +#define AUE_ATSOCKET AUE_NULL +#define AUE_ATPGETREQ AUE_NULL +#define AUE_ATPGETRSP AUE_NULL +#define AUE_ATPSNDREQ AUE_NULL +#define AUE_ATPSNDRSP AUE_NULL +#define AUE_BSDTHREADCREATE AUE_NULL +#define AUE_BSDTHREADTERMINATE AUE_NULL +#define AUE_BSDTHREADREGISTER AUE_NULL +#define AUE_CHUD AUE_NULL +#define AUE_CSOPS AUE_NULL +#define AUE_DUP AUE_NULL +#define AUE_FDATASYNC AUE_NULL +#define AUE_FGETATTRLIST AUE_NULL +#define AUE_FGETXATTR AUE_NULL +#define AUE_FLISTXATTR AUE_NULL +#define AUE_FREMOVEXATTR AUE_NULL +#define AUE_FSETATTRLIST AUE_NULL +#define AUE_FSETXATTR AUE_NULL +#define AUE_FSTATFS64 AUE_NULL +#define AUE_FSTATV AUE_NULL +#define AUE_FSTAT64 AUE_NULL +#define AUE_FSTAT64_EXTENDED AUE_NULL +#define AUE_GCCONTROL AUE_NULL +#define AUE_GETDIRENTRIES64 AUE_NULL +#define AUE_GETDTABLESIZE AUE_NULL +#define AUE_GETEGID AUE_NULL +#define AUE_GETEUID AUE_NULL +#define AUE_GETFSSTAT64 AUE_NULL +#define AUE_GETGID AUE_NULL +#define AUE_GETGROUPS AUE_NULL +#define AUE_GETITIMER AUE_NULL +#define AUE_GETLOGIN AUE_NULL +#define AUE_GETPEERNAME AUE_NULL +#define AUE_GETPGID AUE_NULL +#define AUE_GETPGRP AUE_NULL +#define AUE_GETPID AUE_NULL +#define AUE_GETPPID AUE_NULL +#define AUE_GETPRIORITY AUE_NULL +#define AUE_GETRLIMIT AUE_NULL +#define AUE_GETRUSAGE AUE_NULL +#define AUE_GETSGROUPS AUE_NULL +#define AUE_GETSID AUE_NULL +#define AUE_GETSOCKNAME AUE_NULL +#define AUE_GETTIMEOFDAY AUE_NULL +#define AUE_GETTID AUE_NULL +#define AUE_GETUID AUE_NULL +#define AUE_GETSOCKOPT AUE_NULL +#define AUE_GETWGROUPS AUE_NULL +#define AUE_GETXATTR AUE_NULL +#define AUE_IDENTITYSVC AUE_NULL +#define AUE_INITGROUPS AUE_NULL +#define AUE_IOPOLICYSYS AUE_NULL +#define AUE_ISSETUGID AUE_NULL +#define AUE_LIOLISTIO AUE_NULL +#define AUE_LISTXATTR AUE_NULL +#define AUE_LSTATV AUE_NULL +#define AUE_LSTAT64 AUE_NULL +#define AUE_LSTAT64_EXTENDED AUE_NULL +#define AUE_MADVISE AUE_NULL +#define AUE_MINCORE AUE_NULL +#define AUE_MKCOMPLEX AUE_NULL +#define AUE_MODWATCH AUE_NULL +#define AUE_MSGCL AUE_NULL +#define AUE_MSYNC AUE_NULL +#define AUE_PREADV AUE_NULL +#define AUE_PROCINFO AUE_NULL +#define AUE_PTHREADCANCELED AUE_NULL +#define AUE_PTHREADCHDIR AUE_NULL +#define AUE_PTHREADCONDBROADCAST AUE_NULL +#define AUE_PTHREADCONDDESTORY AUE_NULL +#define AUE_PTHREADCONDINIT AUE_NULL +#define AUE_PTHREADCONDSIGNAL AUE_NULL +#define AUE_PTHREADCONDWAIT AUE_NULL +#define AUE_PTHREADFCHDIR AUE_NULL +#define AUE_PTHREADMARK AUE_NULL +#define AUE_PTHREADMUTEXDESTROY AUE_NULL +#define AUE_PTHREADMUTEXINIT AUE_NULL +#define AUE_PTHREADMUTEXTRYLOCK AUE_NULL +#define AUE_PTHREADMUTEXUNLOCK AUE_NULL +#define AUE_PWRITEV AUE_NULL +#define AUE_REMOVEXATTR AUE_NULL +#define AUE_SBRK AUE_NULL +#define AUE_SELECT AUE_NULL +#define AUE_SEMDESTROY AUE_NULL +#define AUE_SEMGETVALUE AUE_NULL +#define AUE_SEMINIT AUE_NULL +#define AUE_SEMPOST AUE_NULL +#define AUE_SEMTRYWAIT AUE_NULL +#define AUE_SEMWAIT AUE_NULL +#define AUE_SEMWAITSIGNAL AUE_NULL +#define AUE_SETITIMER AUE_NULL +#define AUE_SETSGROUPS AUE_NULL +#define AUE_SETTID AUE_NULL +#define AUE_SETTIDWITHPID AUE_NULL +#define AUE_SETWGROUPS AUE_NULL +#define AUE_SETXATTR AUE_NULL +#define AUE_SHAREDREGIONCHECK AUE_NULL +#define AUE_SHAREDREGIONMAP AUE_NULL +#define AUE_SIGACTION AUE_NULL +#define AUE_SIGALTSTACK AUE_NULL +#define AUE_SIGPENDING AUE_NULL +#define AUE_SIGPROCMASK AUE_NULL +#define AUE_SIGRETURN AUE_NULL +#define AUE_SIGSUSPEND AUE_NULL +#define AUE_SIGWAIT AUE_NULL +#define AUE_SSTK AUE_NULL +#define AUE_STACKSNAPSHOT AUE_NULL +#define AUE_STATFS64 AUE_NULL +#define AUE_STATV AUE_NULL +#define AUE_STAT64 AUE_NULL +#define AUE_STAT64_EXTENDED AUE_NULL +#define AUE_SYNC AUE_NULL +#define AUE_SYSCALL AUE_NULL +#define AUE_TABLE AUE_NULL +#define AUE_VMPRESSUREMONITOR AUE_NULL +#define AUE_WAITEVENT AUE_NULL +#define AUE_WAITID AUE_NULL +#define AUE_WATCHEVENT AUE_NULL +#define AUE_WORKQOPEN AUE_NULL +#define AUE_WORKQOPS AUE_NULL #endif /* !_BSM_AUDIT_KEVENTS_H_ */