auditrecord - zygaena/hammerhead

root / base / usr / src / cmd / auditrecord
auditrecord Plain Text 3437 lines 90.6 KB
#
# CDDL HEADER START
#
# The contents of this file are subject to the terms of the
# Common Development and Distribution License (the "License").
# You may not use this file except in compliance with the License.
#
# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
# or http://www.opensolaris.org/os/licensing.
# See the License for the specific language governing permissions
# and limitations under the License.
#
# When distributing Covered Code, include this CDDL HEADER in each
# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
# If applicable, add the following below this CDDL HEADER, with the
# fields enclosed by brackets "[]" replaced with your own identifying
# information: Portions Copyright [yyyy] [name of copyright owner]
#
# CDDL HEADER END
#
#
# Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
# Use is subject to license terms.
#

include $(SRC)/cmd/Makefile.cmd

ATTR =			audit_record_attr
ROOTAUDITDIR =		$(ROOT)/usr/lib/audit

SECURITYFILES = 	$(ATTR:%=$(ROOTAUDITDIR)/%)
$(SECURITYFILES) :	FILEMODE = $(LIBFILEMODE)

PROG		= auditrecord

AGETTEXT	= mkmsg
STRIPTEXT	= filter_txt
ATTRPROC	= audit_record_xml
LIBBSMDIR	= $(SRC)/lib/libbsm
ADTXMLFILE	= $(LIBBSMDIR)/common/adt.xml

.KEEP_STATE:

all: $(PROG) $(ATTR)

install: all $(ROOTUSRSBINPROG) install_data

install_data: $(SECURITYFILES) $(ATTR)

$(SECURITYFILES): $(ATTR) | $(ROOTAUDITDIR)
	$(INS.file)

$(ROOTAUDITDIR):
	$(INS.dir)

_msg: $(PROG).po

clean:
	$(RM) $(ATTR) $(STRIPTEXT) $(AGETTEXT)

$(ATTR): $(STRIPTEXT) $(ATTRPROC) $(ADTXMLFILE) $(ATTR).txt
	./$(STRIPTEXT) < $(ATTR).txt > $(ATTR)
	$(PERL) -I $(LIBBSMDIR) ./$(ATTRPROC) $(ADTXMLFILE) >> $(ATTR)

$(ROOTUSRSBINPROG): $(PROG)
	$(INS.file)

$(PROG).po: $(PROG) $(ATTR) $(AGETTEXT)
	export PERL5LIB; PERL5LIB=../perl/contrib; \
	./$(AGETTEXT) $(TEXT_DOMAIN) $(PROG).po; \
	$(XGETTEXT) -d $(PROG) -j $(PROG)

lint:

include $(SRC)/cmd/Makefile.targ
# audit_record_attr.txt
# Two "#" are comments that are copied to audit_record_attr
# other comments are removed.
##
## Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
## Copyright 2018 Nexenta Systems, Inc.  All rights reserved.
## Copyright 2019 Joyent, Inc.
##
## CDDL HEADER START
##
## The contents of this file are subject to the terms of the
## Common Development and Distribution License (the "License").
## You may not use this file except in compliance with the License.
##
## You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
## or http://www.opensolaris.org/os/licensing.
## See the License for the specific language governing permissions
## and limitations under the License.
##
## When distributing Covered Code, include this CDDL HEADER in each
## file and include the License file at usr/src/OPENSOLARIS.LICENSE.
## If applicable, add the following below this CDDL HEADER, with the
## fields enclosed by brackets "[]" replaced with your own identifying
## information: Portions Copyright [yyyy] [name of copyright owner]
##
## CDDL HEADER END
##
##

# source file for describing audit records.

# This file is in two sections.  The first is a list of attribute /
# value pairs used to provide short cuts in annotating the audit
# records.  The second is for annotation for each audit record.

# first section: general attributes

# skipClass=<class name of items to skip if only in that class>
# skipClass=no    # uncomment to filter unused events

# token name abbreviations
# token=alias:fullname  -- short names for key tokens

token=arg:argument
token=attr:attribute
token=acl:acl_entry
token=cmd:command
token=data:data
token=exec_args:exec_arguments
token=exec_env:exec_environment
token=group:group
token=inaddr:ip_addr
token=inet:socket
token=ipc:ipc
token=ipc_perm:ipc_perm
token=newgroup:newgroups
token=path:path
token=path_attr:attribute_path
token=privset:privilege
token=proc:process
token=text:text
token=tid:terminal_adr
token=uauth:use_of_authorization
token=upriv:use_of_privilege
token=user:user_object
token=zone:zonename
token=fmri:service_instance
token=label:mandatory_label

token=head:header
token=subj:subject
token=ret:return
token=exit:exit

# note names -- certain notes show up repeatedly; collected here
#
# To achieve the maximum line length to be less than 80 characters, the
# note names (message=) can be defined as a multi line, each line except the
# last one finished with the backslash character.

message=ipc_perm:The ipc and ipc_perm tokens are not included if \
  the message ID is not valid.


# basic record pattern ("insert" is where event-specific tokens
# are listed.)

kernel=head:insert:subj:[upriv]:ret
user=head:subj:insert:ret

# Second Section
# Annotation Section
#
# Most audit records need annotation beyond what is provided by
# the files audit_event and audit_class.  At a minimum, a record
# is represented by a label and a format.
#
# label=record_id             like AUE_ACCEPT
# format=token_alias
#
# there is no end line; a new label= end the preceding definition
# and starts the next.
#
# format values are a list of token names, separated by colons.  The
# name is either one of the values described above (token=) or is
# a value to be taken literally.  If a token name ends with a digit,
# the digit is an index into an array of comments.  In the few cases
# where there are no tokens (other than header, subject, return/exit),
# use "format=kernel" or "format="user".
#
# comment is an array of strings separated by colons.  If comments
# are listed on separate lines (recommended due to better
# readability/sustainability of the file), the preceding comment
# must end with  a colon.  The array starts at 1. (If the comment
# contains a colon, use "&colon;" without the quotes.)
#
# case is used to generate alternate descriptions for a given
# record.
#
# Constraints - the string length; bear in mind, that any annotation of
# primitives below longer than is specified, will be silently truncated
# to given/defined amount of characters in the auditrecord(8) runtime:
#
#     primitive <= max (non-truncated) string length
#	case	<= unlimited; if necessary, text continues on a new line
#	comment	<= unlimited; if necessary, text continues on a new line
#	label	<= 43
#	note	<= unlimited; if necessary, text continues on a new line
#	program	<= 20
#	see	<= 39
#	syscall	<= 20
#	title	<= 46
#	token	<= 28 (full name)
#
# To achieve the maximum line length to be less than 80 characters, one can
# define the unlimited primitives as a multi line, each line except the
# last one finished with the backslash character. In addition to above
# mentioned, the "format=" record attribute follows the same rule.
#
#
# AUE_ACCEPT illustrates the use of all the above.  Note that
# case is not nested; ellipsis (...) is used to give the effect
# of nesting.

label=AUE_ACCEPT
#accept(2) failure
  case=Invalid socket file descriptor
    format=arg1
      comment=1, file descriptor, "so"
#accept(2) non SOCK_STREAM socket
  case=If the socket address is not part of the AF_INET family
    format=arg1:arg2:arg3
      comment=1, "so", file descriptor:
      comment="family", so_family:
      comment="type", so_type
  case=If the socket address is part of the AF_INET family
    case=...If there is no vnode for this file descriptor
      format=[arg]1
        comment=1, file descriptor, "Bad so"
#accept(2) SOCK_STREAM socket-not bound
    case=...or if the socket is not bound
      format=[arg]1:[inet]2
        comment=1, file descriptor, "so":
        comment=local/foreign address (0.0.0.0)
    case=...or if the socket address length = 0
      format=[arg]1:[inet]2
        comment=1, file descriptor, "so":
        comment=local/foreign address (0.0.0.0)
    case=...or for all other conditions
      format=inet1:[inet]1
        comment=socket address
#accept(2) failure
#	header
#	au_to_arg32	"so",file descriptor
#	subject
#	return	<errno != 0>
#
#accept(2) non SOCK_STREAM socket
#	header
#	au_to_arg32	"so", file descriptor
#	au_to_arg32	"family", so_family
#	au_to_arg32	"type", so_type
#	subject
#	return success
#
#accept(2) SOCK_STREAM socket-not bound
#	header
#	au_to_arg32	"so", file descriptor
#	au_to_socket_ex	local/foreign address (0.0.0.0)
#	subject
#	return success
#
#accept(2) SOCK_STREAM socket-bound
#	header
#	au_to_arg32	"so", file descriptor
#	au_to_socket_ex
#	subject
#	return success



label=AUE_ACCESS
  format=path1:[attr]
    comment=may be truncated in failure case
#	header,163,2,access(2),,Wed Apr 25 13:52:49 2001, + 750000733 msec
#	path,/export/home/testsuites/CC_final/icenine/arv/access/obj_succ
#	attribute,100777,41416,staff,8388608,402255,0
#	subject,tuser10,tuser10,other,tuser10,other,1297,322,255 131585 129.146.89.30
#	return,success,0
#	trailer,163
#
#	header,163,2,access(2),,Wed Apr 25 13:53:02 2001, + 490000427 msec
#	path,/export/home/testsuites/CC_final/icenine/arv/access/obj_fail
#	attribute,100000,root,other,8388608,402257,0
#	subject,tuser10,tuser10,other,tuser10,other,1433,322,255 131585 129.146.89.30
#	return,failure: Permission denied,-1
#	trailer,163
#
#	header,135,2,access(2),,Wed Apr 25 13:53:15 2001, + 10000329 msec
#	path,/export/home/testsuites/CC_final/icenine/arv/access/obj_fail2
#	subject,tuser10,tuser10,other,tuser10,other,1553,322,255 131585 129.146.89.30
#	return,failure: No such file or directory,-1
#	trailer,135

label=AUE_ACCT
  case=Zero path
    format=arg1
      comment=1, 0, "accounting off"
  case=Non-zero path
    format=path1:[attr]2
      comment=may be truncated in failure case:
      comment=omitted if failure

label=AUE_ACLSET
  syscall=acl
  format=arg1:arg2:(0..n)[acl]3
    comment=2, SETACL, "cmd":
    comment=3, number of ACL entries, "nentries":
    comment=Access Control List entries

label=AUE_ADJTIME
  format=kernel

label=AUE_ASYNC_DAEMON
  skip=Not used

label=AUE_ASYNC_DAEMON_EXIT
  skip=Not used

label=AUE_AUDIT
  skip=Not used.  (Placeholder for the set AUE_AUDIT_*.)

label=AUE_AUDITON
  skip=Not used.  (Placeholder for the set AUE_AUDITON_*.)

label=AUE_AUDITON_GESTATE
  skip=Not used

label=AUE_AUDITON_GETAMASK
  format=kernel
  syscall=auditon: GETAMASK

label=AUE_AUDITON_GETCAR
  format=kernel
  syscall=auditon: GETCAR
#	header,68,2,auditon(2) - get car,,Wed Apr 25 13:49:02 2001, + 710001279 msec
#	subject,tuser10,root,other,root,other,966,322,255 131585 129.146.89.30
#	return,success,0
#	trailer,68

label=AUE_AUDITON_GETCLASS
  format=kernel
  syscall=auditon: GETCLASS
#	header,68,2,auditon(2) - get event class,,Mon May 15 09:14:35 2000, + 30001063 msec
#	subject,tuser10,root,other,root,other,1091,367,255 197121 tmach1
#	return,success,0
#	trailer,68

label=AUE_AUDITON_GETCOND
  format=kernel
  syscall=auditon: GETCOND
#	header,68,2,auditon(2) - get audit state,,Mon May 15 09:14:48 2000, + 110001736 msec
#	subject,tuser10,root,other,root,other,1248,367,255 197121 tmach1
#	return,success,0
#	trailer,68

label=AUE_AUDITON_GETCWD
  format=kernel
  syscall=auditon: GETCWD
#	header,68,2,auditon(2) - get cwd,,Mon May 15 09:15:01 2000, + 120001223 msec
#	subject,tuser10,root,other,root,other,1405,367,255 197121 tmach1
#	return,success,0
#	trailer,68

label=AUE_AUDITON_GETKMASK
  format=kernel
  syscall=auditon: GETKMASK
#	header,68,2,auditon(2) - get kernel mask,,Mon May 15 09:15:14 2000, + 220002225 msec
#	subject,tuser10,root,other,root,other,1562,367,255 197121 tmach1
#	return,success,0
#	trailer,68

label=AUE_AUDITON_GETSTAT
  format=kernel
  syscall=auditon: A_GETSTAT
#	header,68,2,auditon(2) - get audit statistics,,Mon May 15 09:15:27 2000, + 220003386 msec
#	subject,tuser10,root,other,root,other,1719,367,255 197121 tmach1
#	return,success,0
#	trailer,68

label=AUE_AUDITON_GPOLICY
  format=kernel
  syscall=auditon: GPOLICY
#	header,68,2,auditon(2) - get audit statistics,,Mon May 15 09:15:40 2000, + 120004056 msec
#	subject,tuser10,root,other,root,other,1879,367,255 197121 tmach1
#	return,success,0
#	trailer,68

label=AUE_AUDITON_GQCTRL
  format=kernel
  syscall=auditon: GQCTRL
#	header,68,2,auditon(2) - GQCTRL command,,Mon May 15 09:15:53 2000, + 20001415 msec
#	subject,tuser10,root,other,root,other,2033,367,255 197121 tmach1
#	return,success,0
#	trailer,68


label=AUE_AUDITON_GTERMID
  skip=Not used.

label=AUE_AUDITON_SESTATE
  skip=Not used.

label=AUE_AUDITON_SETAMASK
  format=[arg]1:[arg]2
    comment=2, "setamask as_success", user default audit preselection mask:
    comment=2, "setamask as_failure", user default audit preselection mask
  syscall=auditon: SETAMASK

label=AUE_AUDITON_SETCLASS
  format=[arg]1:[arg]2
    comment=2, "setclass&colon;ec_event", event number:
    comment=3, "setclass&colon;ec_class", class mask
  syscall=auditon: SETCLASS
#	header,120,2,auditon(2) - set event class,,Mon May 15 09:16:39 2000, + 800002966 msec
#	argument,2,0x0,setclass:ec_event
#	argument,3,0x0,setclass:ec_class
#	subject,tuser10,root,other,root,other,2190,367,255 197121 tmach1
#	return,success,0
#	trailer,120

label=AUE_AUDITON_SETCOND
  format=[arg]1
    comment=3, "setcond", audit state
  syscall=auditon: SETCOND

label=AUE_AUDITON_SETKMASK
  format=[arg]1:[arg]2
    comment=2, "setkmask as_success", kernel non-attributable mask:
    comment=2, "setkmask as_failure", kernel non-attributable mask
  syscall=auditon: SETKMASK
#	header,124,2,auditon(2) - set kernel mask,,Mon May 15 09:17:06 2000, + 300000807 msec
#	argument,2,0x0,setkmask:as_success
#	argument,2,0x0,setkmask:as_failure
#	subject,tuser10,root,other,root,other,2506,367,255 197121 tmach1
#	return,success,0
#	trailer,124
#	header,124,2,auditon(2) - set kernel mask,,Mon May 15 09:17:20 2000, + 430001289 msec
#	argument,2,0x0,setkmask:as_success
#	argument,2,0x0,setkmask:as_failure
#	subject,tuser10,tuser10,other,root,other,2620,367,255 197121 tmach1
#	return,failure: Not owner,-1
#	trailer,124

label=AUE_AUDITON_SETSMASK
  format=[arg]1:[arg]2
    comment=3, "setsmask&colon;as_success", session ID mask:
    comment=3, "setsmask&colon;as_failure", session ID mask
  syscall=auditon: SETSMASK
#	header,124,2,auditon(2) - set mask per session ID,,Mon May 15 09:17:33 2000, + 580000668 msec
#	argument,3,0x400,setsmask:as_success
#	argument,3,0x400,setsmask:as_failure
#	subject,tuser10,root,other,root,other,2777,367,255 197121 tmach1
#	return,success,0
#	trailer,124
#	header,124,2,auditon(2) - set mask per session ID,,Mon May 15 09:17:45 2000, + 700001710 msec
#	argument,3,0x400,setsmask:as_success
#	argument,3,0x400,setsmask:as_failure
#	subject,tuser10,tuser10,other,root,other,2885,367,255 197121 tmach1
#	return,failure: Not owner,-1
#	trailer,124

label=AUE_AUDITON_SETSTAT
  format=kernel
  syscall=auditon: SETSTAT
#	header,68,2,auditon(2) - reset audit statistics,,Mon May 15 09:17:58 2000, + 930000818 msec
#	subject,tuser10,root,other,root,other,3042,367,255 197121 tmach1
#	return,success,0
#	trailer,68
#	header,68,2,auditon(2) - reset audit statistics,,Mon May 15 09:18:13 2000, + 160001101 msec
#	subject,tuser10,tuser10,other,root,other,3156,367,255 197121 tmach1
#	return,failure: Not owner,-1
#	trailer,68

label=AUE_AUDITON_SETUMASK
  format=[arg]1:[arg]2
    comment=3, "setumask&colon;as_success", audit ID mask:
    comment=3, "setumask&colon;as_failure", audit ID mask
  syscall=auditon: SETUMASK
#	header,124,2,auditon(2) - set mask per uid,,Mon May 15 09:18:26 2000, + 670003527 msec
#	argument,3,0x400,setumask:as_success
#	argument,3,0x400,setumask:as_failure
#	subject,tuser10,root,other,root,other,3313,367,255 197121 tmach1
#	return,success,0
#	trailer,124
#	header,124,2,auditon(2) - set mask per uid,,Mon May 15 09:18:38 2000, + 740000732 msec
#	argument,3,0x400,setumask:as_success
#	argument,3,0x400,setumask:as_failure
#	subject,tuser10,tuser10,other,root,other,3421,367,255 197121 tmach1
#	return,failure: Not owner,-1
#	trailer,124

label=AUE_AUDITON_SPOLICY
  format=[arg]1
    comment=1, audit policy flags, "setpolicy"
  syscall=auditon: SPOLICY
#	header,86,2,auditon(2) - SPOLICY command,,Mon May 15 09:18:54 2000, + 840 msec
#	argument,3,0x200,setpolicy
#	subject,tuser10,root,other,root,other,3584,367,255 197121 tmach1
#	return,success,0
#	trailer,86
#	header,86,2,auditon(2) - SPOLICY command,,Mon May 15 09:19:08 2000, + 200002798 msec
#	argument,3,0x200,setpolicy
#	subject,tuser10,tuser10,other,root,other,3698,367,255 197121 tmach1
#	return,failure: Not owner,-1
#	trailer,86

label=AUE_AUDITON_SQCTRL
  format=[arg]1:[arg]2:[arg]3:[arg]4
    comment=3, "setqctrl&colon;aq_hiwater", queue control param.:
    comment=3, "setqctrl&colon;aq_lowater", queue control param.:
    comment=3, "setqctrl&colon;aq_bufsz", queue control param.:
    comment=3, "setqctrl&colon;aq_delay", queue control param.
  syscall=auditon: SQCTRL
#	header,176,2,auditon(2) - SQCTRL command,,Mon May 15 09:19:23 2000, + 610001124 msec
#	argument,3,0x64,setqctrl:aq_hiwater
#	argument,3,0xa,setqctrl:aq_lowater
#	argument,3,0x400,setqctrl:aq_bufsz
#	argument,3,0x14,setqctrl:aq_delay
#	subject,tuser10,root,other,root,other,3861,367,255 197121 tmach1
#	return,success,0
#	trailer,176
#	header,176,2,auditon(2) - SQCTRL command,,Mon May 15 09:19:35 2000, + 720003197 msec
#	argument,3,0x64,setqctrl:aq_hiwater
#	argument,3,0xa,setqctrl:aq_lowater
#	argument,3,0x400,setqctrl:aq_bufsz
#	argument,3,0x14,setqctrl:aq_delay
#	subject,tuser10,tuser10,other,root,other,3969,367,255 197121 tmach1
#	return,failure: Not owner,-1
#	trailer,176

label=AUE_AUDITON_SETPMASK
  format=[arg]1:[arg]2
    comment=3, "setpmask&colon;pid", process
    comment=3, "setpmask&colon;as_success", audit ID mask:
    comment=3, "setpmask&colon;as_failure", audit ID mask
  syscall=auditon: SETPMASK

label=AUE_AUDITON_SETKAUDIT
  format=arg1:arg2:arg3:inaddr4:arg5:arg6:arg7
    comment=1, audit user ID, "auid":
    comment=1, terminal ID, "port":
    comment=1, type, "type":
    comment=1, terminal ID, "ip address":
    comment=1, preselection mask, "as_success":
    comment=1, preselection mask, "as_failure":
    comment=1, audit session ID, "asid"
  syscall=auditon: SETKAUDIT

label=AUE_AUDITON_GETPINFO
  format=kernel
  syscall=auditon: GETPINFO

label=AUE_AUDITON_GETKAUDIT
  format=kernel
  syscall=auditon: GETKAUDIT

label=AUE_AUDITON_OTHER
  format=kernel
  syscall=auditon: OTHER

label=AUE_AUDITON_STERMID
  skip=Not used.

label=AUE_AUDITSTAT
  skip=Not used.

label=AUE_AUDITSVC
  skip=Not used.

label=AUE_AUDITSYS
  skip=Not used. (Place holder for various auditing events.)

label=AUE_BIND
# differs from documented version.
# cases "no vnode" not fully confirmed
# family and type need argument number
  case=Invalid socket handle
    format=arg1
      comment=1, file descriptor, "so"
  case=If there is no vnode for this file descriptor
  case=or if the socket is not of the AF_INET family
    format=arg1:arg2:arg3
      comment=1, file descriptor, "so":
      comment=1, socket family, "family":
      comment=1, socket type, "type"
  case=or for all other conditions
    format=arg1:inet2
      comment=1, file descriptor, "so":
      comment=socket address

label=AUE_BRANDSYS
# generic mechanism to allow user-space and kernel components of a brand
# to communicate.  The interpretation of the arguments to the call is
# left entirely up to the brand.
  format=arg1:arg2:arg3:arg4:arg5:arg6:arg7
    comment=1, command, "cmd":
    comment=2, command args, "arg":
    comment=3, command args, "arg":
    comment=4, command args, "arg":
    comment=5, command args, "arg":
    comment=6, command args, "arg":
    comment=7, command args, "arg"

label=AUE_BSMSYS
  skip=Not used.

label=AUE_CHDIR
  format=path:[attr]
#	header,151,2,chdir(2),,Mon May 15 09:20:15 2000, + 70000899 msec
#	path,/export/home/CC_final/icenine/arv/chdir/obj_succ
#	attribute,40777,root,other,8388608,231558,0
#	subject,tuser10,tuser10,other,root,other,4436,367,255 197121 tmach1
#	return,success,0
#	trailer,151
#	header,151,2,chdir(2),,Mon May 15 09:20:27 2000, + 640003327 msec
#	path,/export/home/CC_final/icenine/arv/chdir/obj_fail
#	attribute,40000,root,other,8388608,237646,0
#	subject,tuser10,tuser10,other,root,other,4566,367,255 197121 tmach1
#	return,failure: Permission denied,-1
#	trailer,151

label=AUE_CHMOD
  format=arg1:path:[attr]
    comment=2, mode, "new file mode"
#	header,173,2,chmod(2),,Mon May 15 09:20:41 2000, + 140000831 msec
#	argument,2,0x1f8,new file mode
#	path,/export/home/CC_final/icenine/arv/chmod/obj_succ
#	attribute,100770,tuser10,other,8388608,243608,0
#	subject,tuser10,tuser10,other,root,other,4748,367,255 197121 tmach1
#	return,success,0
#	trailer,173
#	header,173,2,chmod(2),,Mon May 15 09:20:54 2000, + 400001156 msec
#	argument,2,0x1f8,new file mode
#	path,/export/home/CC_final/icenine/arv/chmod/obj_fail
#	attribute,100600,root,other,8388608,243609,0
#	subject,tuser10,tuser10,other,root,other,4879,367,255 197121 tmach1
#	return,failure: Not owner,-1
#	trailer,173

label=AUE_CHOWN
  format=arg1:arg2
    comment=2, uid, "new file uid":
    comment=3, gid, "new file gid"
#	header,193,2,chown(2),,Mon May 15 09:21:07 2000, + 930000756 msec
#	argument,2,0x271a,new file uid
#	argument,3,0xffffffff,new file gid
#	path,/export/home/CC_final/icenine/arv/chown/obj_succ
#	attribute,100644,tuser10,other,8388608,268406,0
#	subject,tuser10,tuser10,other,root,other,5062,367,255 197121 tmach1
#	return,success,0
#	trailer,193
#	header,193,2,chown(2),,Mon May 15 09:21:20 2000, + 430001153 msec
#	argument,2,0x271a,new file uid
#	argument,3,0xffffffff,new file gid
#	path,/export/home/CC_final/icenine/arv/chown/obj_fail
#	attribute,100644,root,other,8388608,268407,0
#	subject,tuser10,tuser10,other,root,other,5191,367,255 197121 tmach1
#	return,failure: Not owner,-1
#	trailer,193

label=AUE_CHROOT
  format=path:[attr]
#	header,104,2,chroot(2),,Mon May 15 09:21:33 2000, + 860001094 msec
#	path,/
#	attribute,40755,root,root,8388608,2,0
#	subject,tuser10,root,other,root,other,5370,367,255 197121 tmach1
#	return,success,0
#	trailer,104
#	header,152,2,chroot(2),,Mon May 15 09:21:46 2000, + 130002435 msec
#	path,/export/home/CC_final/icenine/arv/chroot/obj_fail
#	attribute,40777,tuser10,other,8388608,335110,0
#	subject,tuser10,tuser10,other,root,other,5499,367,255 197121 tmach1
#	return,failure: Not owner,-1
#	trailer,152

label=AUE_CLOCK_SETTIME
  format=kernel

label=AUE_CLOSE
  format=arg1:[path]:[attr]
    comment=1, file descriptor, "fd"

label=AUE_CONFIGKSSL
  case=Adding KSSL entry.
    format=text1:inaddr2:text3:text4
      comment=opcode, KSSL_ADD_ENTRY:
      comment=local IP address:
      comment=SSL port number:
      comment=proxy port number
  case=Deleting KSSL entry.
    format=text1:inaddr2:text3
      comment=opcode, KSSL_DELETE_ENTRY:
      comment=local IP address:
      comment=SSL port number

label=AUE_CONNECT
# cases "no vnode" not fully confirmed
  case=If there is no vnode for this file descriptor
  case=If the socket address is not part of the AF_INET family
    format=arg1:arg2:arg3
      comment=1, file descriptor, "so":
      comment=1, socket family, "family":
      comment=1, socket type, "type"
  case=If the socket address is part of the AF_INET family
    format=arg1:inet2
      comment=1, file descriptor, "so":
      comment=socket address

label=AUE_CORE
  syscall=none
  title=process dumped core
  see=none
  format=path:[attr]:arg1
    comment=1, signal, "signal"
# see uts/common/c2/audit.c

label=AUE_CREAT
# obsolete - see open(2)
  format=path:[attr]
# does not match old BSM manual
#	header,151,2,creat(2),,Mon May 15 09:21:59 2000, + 509998810 msec
#	path,/export/home/CC_final/icenine/arv/creat/obj_succ
#	attribute,100644,tuser10,other,8388608,49679,0
#	subject,tuser10,tuser10,other,root,other,5678,367,255 197121 tmach1
#	return,success,8
#	trailer,151
#	header,107,2,creat(2),,Mon May 15 09:22:12 2000, + 50001852 msec
#	path,/devices/pseudo/mm@0:null
#	subject,tuser10,root,other,root,other,5809,367,255 197121 tmach1
#	return,success,8
#	trailer,107
#	header,83,2,creat(2),,Mon May 15 09:22:12 2000, + 70001870 msec
#	path,/obj_fail
#	subject,tuser10,tuser10,other,root,other,5806,367,255 197121 tmach1
#	return,failure: Permission denied,-1
#	trailer,83

label=AUE_CRYPTOADM
  title=kernel cryptographic framework
  format=text1:(0..n)[text]2
  comment=cryptoadm command/operation:
  comment=mechanism list

label=AUE_DOORFS
  skip=Not used.  (Place holder for set of door audit events.)

label=AUE_DOORFS_DOOR_BIND
  skip=Not used.
  syscall=doorfs:  DOOR_BIND

label=AUE_DOORFS_DOOR_CALL
  format=arg1:proc2
    comment=1, door ID, "door ID":
    comment=for process that owns the door
  syscall=doorfs:  DOOR_CALL

label=AUE_DOORFS_DOOR_CREATE
  format=arg1
    comment=1, door attributes, "door attr"
  syscall=doorfs:  DOOR_CREATE

label=AUE_DOORFS_DOOR_CRED
  skip=Not used.
  syscall=doorfs:  DOOR_CRED

label=AUE_DOORFS_DOOR_INFO
  skip=Not used.
  syscall=doorfs:  DOOR_INFO

label=AUE_DOORFS_DOOR_RETURN
  format=kernel
  syscall=doorfs:  DOOR_RETURN

label=AUE_DOORFS_DOOR_REVOKE
  format=arg1
    comment=1, door ID, "door ID"
  syscall=doorfs:  DOOR_REVOKE

label=AUE_DOORFS_DOOR_UNBIND
  skip=Not used.
  syscall=doorfs:  DOOR_UNBIND

label=AUE_DUP2
skip=Not used.

label=AUE_ENTERPROM
  title=enter prom
  syscall=none
  format=head:text1:ret
    comment="kmdb"
#	header,48,2,enter prom,na,tmach1,2004-11-12 09:07:41.342 -08:00
#	text,kmdb
#	return,success,0

label=AUE_EXEC
# obsolete - see execve(2)
  format=path:[attr]1:[exec_args]2:[exec_env]3
    comment=omitted on error:
    comment=output if argv policy is set:
    comment=output if arge policy is set

label=AUE_EXECVE
  format=path:[attr]1:[exec_args]2:[exec_env]3
    comment=omitted on error:
    comment=output if argv policy is set:
    comment=output if arge policy is set
#	header,107,2,creat(2),,Mon May 15 09:22:25 2000, + 559997464 msec
#	path,/devices/pseudo/mm@0:null
#	subject,tuser10,root,other,root,other,5974,367,255 197121 tmach1
#	return,success,8
#	trailer,107
#	header,86,2,execve(2),,Mon May 15 09:22:25 2000, + 590003684 msec
#	path,/usr/bin/pig
#	subject,tuser10,tuser10,other,root,other,5971,367,255 197121 tmach1
#	return,failure: No such file or directory,-1
#	trailer,86

label=AUE_PFEXEC
  format=path1:path2:[privileges]3:[privileges]3:[proc]4:exec_args:[exec_env]5
    comment=pathname of the executable:
    comment=pathname of working directory:
    comment=privileges if the limit or inheritable set are changed:
    comment=process if ruid, euid, rgid or egid is changed:
    comment=output if arge policy is set

label=AUE_sudo
  format=exec_args1:[text]2
    comment=command args:
    comment=error message (failure only)

label=AUE_EXIT
  format=arg1:[text]2
    comment=1, exit status, "exit status":
    comment=event aborted

label=AUE_EXITPROM
  title=exit prom
  syscall=none
  format=head:text1:ret
    comment="kmdb"
#	header,48,2,exit prom,na,tmach1,2004-11-12 09:07:43.547 -08:00
#	text,kmdb
#	return,success,0

label=AUE_EXPORTFS
  skip=Not used.

label=AUE_FACCESSAT
# obsolete
  see=access(2)
  format=path:[attr]

label=AUE_FACLSET
  syscall=facl
  case=Invalid file descriptor
    format=arg1:arg2
      comment=2, SETACL, "cmd":
      comment=3, number of ACL entries, "nentries"
  case=Zero path
    format=arg1:arg2:arg3:[attr]:(0..n)[acl]4
      comment=2, SETACL, "cmd":
      comment=3, number of ACL entries, "nentries":
      comment=1, file descriptor, "no path&colon; fd":
      comment=ACLs
  case=Non-zero path
    format=arg1:arg2:path:[attr]:(0..n)[acl]3
      comment=2, SETACL, "cmd":
      comment=3, number of ACL entries, "nentries":
      comment=ACLs

label=AUE_FCHDIR
  format=[path]:[attr]
#	header,150,2,fchdir(2),,Mon May 15 09:22:38 2000, + 680001393 msec
#	path,/export/home/CC_final/icenine/arv/fchdir/obj_succ
#	attribute,40777,tuser10,other,8388608,207662,0
#	subject,tuser10,tuser10,other,root,other,6129,367,255 197121 tmach1
#	return,success,0
#	trailer,150
#	header,68,2,fchdir(2),,Mon May 15 09:22:51 2000, + 710001196 msec
#	subject,tuser10,tuser10,other,root,other,6258,367,255 197121 tmach1
#	return,failure: Permission denied,-1
#	trailer,68

label=AUE_FCHMOD
  case=With a valid file descriptor and path
    format=arg1:path:[attr]
      comment=2, mode, "new file mode"
  case=With a valid file descriptor and invalid path
    format=arg1:[arg]2:[attr]
      comment=2, mode, "new file mode":
      comment=1, file descriptor, "no path&colon; fd"
  case=With an invalid file descriptor
    format=arg1
      comment=2, mode, "new file mode"
#	header,168,2,fchmod(2),,Sat Apr 29 12:28:06 2000, + 350000000 msec
#	argument,2,0x1a4,new file mode
#	path,/export/home/CC/icenine/arv/fchmod/obj_succ
#	attribute,100644,tuser10,other,7602240,26092,0
#	subject,tuser10,tuser10,other,root,other,11507,346,16064 196866 tmach1
#	return,success,0
#	trailer,168
#	header,90,2,fchmod(2),,Sat Apr 29 12:28:32 2000, + 930000000 msec
#	argument,2,0x1a4,new file mode
#	subject,tuser10,tuser10,other,root,other,11759,346,16064 196866 tmach1
#	return,failure: Bad file number,-1
#	trailer,90
#	header,168,2,fchmod(2),,Sat Apr 29 12:28:20 2000, + 770000000 msec
#	argument,2,0x1a4,new file mode
#	path,/export/home/CC/icenine/arv/fchmod/obj_fail
#	attribute,100644,root,other,7602240,26093,0
#	subject,tuser10,tuser10,other,root,other,11644,346,16064 196866 tmach1
#	return,failure: Not owner,-1
#	trailer,168

label=AUE_FCHOWN
  case=With a valid file descriptor
    format=arg1:arg2:[path]:[attr]
      comment=2, uid, "new file uid":
      comment=3, gid, "new file gid"
  case=With an invalid file descriptor
    format=arg1:arg2:[arg]3:[attr]
       comment=2, uid, "new file uid":
       comment=3, gid, "new file gid":
       comment=1, file descriptor, "no path fd"

label=AUE_FCHOWNAT
# obsolete
  see=openat(2)
  case=With a valid absolute/relative file path
    format=path:[attr]
  case=With an file path eq. NULL and valid file descriptor
    format=kernel

label=AUE_FCHROOT
  format=[path]:[attr]
# fchroot -> chdirec -> audit_chdirec

label=AUE_FCNTL
  case=With a valid file descriptor
    format=arg1:[arg]2:path:attr
      comment=2, command, "cmd":
      comment=3, flags, "flags"
  case=With an invalid file descriptor
    format=arg1:[arg]2:arg3
      comment=2, command, "cmd":
      comment=3, flags, "flags":
      comment=1, file descriptor, "no path fd"
  note=Flags are included only when cmd is F_SETFL.

label=AUE_FLOCK
  skip=Not used.

label=AUE_FORKALL
  format=[arg]1
    comment=0, pid, "child PID"
  note=The forkall(2) return values are undefined because the audit record
  note=is produced at the point that the child process is spawned.
# see audit.c

label=AUE_FORK1
  format=[arg]1
    comment=0, pid, "child PID"
  note=The fork1(2) return values are undefined because the audit record
  note=is produced at the point that the child process is spawned.
# see audit.c

label=AUE_FSAT
# obsolete
  skip=Not used.  (Placeholder for AUE_*AT records)

label=AUE_FSTAT
  skip=Not used.

label=AUE_FSTATAT
# obsolete
  format=path:[attr]

label=AUE_FSTATFS
  case=With a valid file descriptor
    format=[path]:[attr]
  case=With an invalid file descriptor
    format=arg1
      comment=1, file descriptor, "no path fd"

label=AUE_FTRUNCATE
  skip=Not used.

label=AUE_FUSERS
  syscall=utssys: UTS_FUSERS
  format=path:attr

label=AUE_FUTIMESAT
# obsolete
  format=[path]:[attr]

label=AUE_GETAUDIT
  format=kernel
#	header,68,2,getaudit(2),,Mon May 15 09:23:57 2000, + 620001408 msec
#	subject,tuser10,root,other,root,other,7063,367,255 197121 tmach1
#	return,success,0
#	trailer,68
#	header,68,2,getaudit(2),,Mon May 15 09:24:09 2000, + 490003700 msec
#	subject,tuser10,root,other,root,other,7158,367,255 197121 tmach1
#	return,success,0
#	trailer,68

label=AUE_GETAUDIT_ADDR
  format=kernel
#	header,73,2,getaudit_addr(2),,Thu Nov 08 15:14:01 2001, + 0 msec
#	subject,tuser1,root,staff,root,staff,9689,12289,0 0 tmach2
#	return,success,0

label=AUE_GETAUID
  format=kernel
#	header,68,2,getauid(2),,Mon May 15 09:24:22 2000, + 420000668 msec
#	subject,tuser10,root,other,root,other,7303,367,255 197121 tmach1
#	return,success,0
#	trailer,68
#	header,68,2,getauid(2),,Mon May 15 09:24:34 2000, + 490002988 msec
#	subject,tuser10,tuser10,other,root,other,7410,367,255 197121 tmach1
#	return,failure: Not owner,-1
#	trailer,68

label=AUE_GETDENTS
  skip=Not used.
#Not security relevant

label=AUE_GETKERNSTATE
  skip=Not used.

label=AUE_GETMSG
  case=With a valid file descriptor
  format=arg1:[path]:attr:arg2
    comment=1, file descriptor, "fd":
    comment=4, priority, "pri"
  case=With an invalid file descriptor
  format=arg1:arg2
    comment=1, file descriptor, "fd":
    comment=4, priority, "pri"

label=AUE_GETPMSG
  case=With a valid file descriptor
  format=arg1:[path]:attr
    comment=1, file descriptor, "fd"
  case=With an invalid file descriptor
  format=arg1
    comment=1, file descriptor, "fd"

label=AUE_GETPORTAUDIT
  format=Not used.

label=AUE_GETUSERAUDIT
  skip=Not used.

label=AUE_INST_SYNC
  format=arg1
    comment=2, flags value, "flags"

label=AUE_IOCTL
  case=With an invalid file descriptor
    format=arg1:arg2:arg3
      comment=1, file descriptor, "fd":
      comment=2, command, "cmd":
      comment=3, arg, "arg"
  case=With a valid file descriptor
    format=path:[attr]:arg1:arg2
      comment=2, ioctl cmd, "cmd":
      comment=3, ioctl arg, "arg"
  case=Non-file file descriptor
    format=arg1:arg2:arg3
      comment=1, file descriptor, "fd":
      comment=2, ioctl cmd, "cmd":
      comment=3, ioctl arg, "arg"
  case=Bad file name
    format=arg1:arg2:arg3
      comment=1, file descriptor, "no path&colon; fd":
      comment=2, ioctl cmd, "cmd":
      comment=3, ioctl arg, "arg"
# old BSM manual misses a case

label=AUE_JUNK
  skip=Not used.

label=AUE_KILL
  case=Valid process
    format=arg1:[proc]
      comment=2, signo, "signal"
  case=Zero or negative process
    format=arg1:arg2
      comment=2, signo, "signal":
      comment=1, pid, "process"

label=AUE_KILLPG
  skip=Not used.

label=AUE_LCHOWN
  format=arg1:arg2:path:[attr]
    comment=2, uid, "new file uid":
    comment=3, gid, "new file gid"

label=AUE_LINK
  format=path1:[attr]:path2
     comment=from path:
     comment=to path

label=AUE_LSEEK
  skip=Not used.

label=AUE_LSTAT
  format=path:[attr]

label=AUE_LXSTAT
# obsolete
  skip=Not used.

label=AUE_MCTL
  skip=Not used.

label=AUE_MEMCNTL
  format=arg1:arg2:arg3:arg4:arg5:arg6
    comment=1, base address, "base":
    comment=2, length, "len":
    comment=3, command, "cmd":
    comment=4, command args, "arg":
    comment=5, command attributes, "attr":
    comment=6, 0, "mask"

label=AUE_MKDIR
  format=arg1:path:[attr]
    comment=2, mode, "mode"

label=AUE_MKNOD
  format=arg1:arg2:path:[attr]
    comment=2, mode, "mode":
    comment=3, dev, "dev"

label=AUE_MMAP
  case=With a valid file descriptor
    format=arg1:arg2:[path]3:[attr]
      comment=1, segment address, "addr":
      comment=2, segment address, "len":
      comment=if no path, then argument&colon; \
        1, "nopath&colon; fd", file descriptor
  case=With an invalid file descriptor
    format=arg1:arg2:arg3
      comment=1, segment address, "addr":
      comment=2, segment address, "len":
      comment=1, file descriptor, "no path&colon; fd"

label=AUE_MODADDMAJ
  title=modctl: bind module
  syscall=modctl
  format=[text]1:[text]2:text3:arg4:(0..n)[text]5
    comment=driver major number:
    comment=driver name:
    comment=driver major number or "no drvname":
    comment=5, number of aliases, "":
    comment=aliases

label=AUE_MODADDPRIV
  format=kernel

label=AUE_MODCONFIG
  skip=Not used.

label=AUE_MODCTL
  skip=Not used. (placeholder)

label=AUE_MODDEVPLCY
  syscall=modctl
  title=modctl: set device policy
  case=If unknown minor name/pattern
    format=arg1:arg2:arg3:arg4:arg5
      comment=2, "major", major number:
      comment=2, "lomin", low minor number, if known:
      comment=2, "himin", hi minor number, if known:
      comment=privileges required for reading:
      comment=privileges required for writing
  case=else
    format=arg1:text2:arg3:arg4
      comment=2, "major", major number:
      comment=minor name/pattern:
      comment=privileges required for reading:
      comment=privileges required for writing

label=AUE_MODLOAD
  syscall=modctl
  title=modctl: load module
  format=[text]1:text2
    comment=default path:
    comment=filename path

label=AUE_MODUNLOAD
  syscall=modctl
  title=modctl: unload module
  format=arg1
    comment=1, module ID, "id"

label=AUE_MOUNT
  case=UNIX file system
    format=arg1:text2:path:[attr]
      comment=3, flags, "flags":
      comment=filesystem type
  case=NFS file system
    format=arg1:text2:text3:arg4:path:[attr]
      comment=3, flags, "flags":
      comment=filesystem type:
      comment=host name:
      comment=3, flags, "internal flags"
# unix example:
#	header,239,2,mount(2),,Sun Apr 16 14:42:32 2000, + 979995208 msec
#	argument,3,0x104,flags
#	text,ufs
#	path,/var2
#	attribute,40755,root,root,32,12160,0
#	path,/devices/pci@1f,4000/scsi@3/sd@0,0:e
#	attribute,60640,root,sys,32,231268,137438953476
#	subject,abc,root,other,root,other,1726,1715,255 66049 ohboy
#	return,success,4290707268
#		       ^^^^^^^^^^         <- bugid 4333559

label=AUE_MSGCTL
  format=arg1:[ipc]:[ipc_perm]
    comment=1, message ID, "msg ID"
  note=ipc_perm
# ipc, ipc_perm: msgctl -> ipc_lookup -> audit_ipc

label=AUE_MSGCTL_RMID
  format=arg1:[ipc]:[ipc_perm]
    comment=1, message ID, "msg ID"
  note=ipc_perm
  syscall=msgctl: IPC_RMID
# ipc, ipc_perm: msgctl -> ipc_lookup -> audit_ipc

label=AUE_MSGCTL_SET
  format=arg1:[ipc]:[ipc_perm]
    comment=1, message ID, "msg ID"
  note=ipc_perm
  syscall=msgctl: IPC_SET
# ipc, ipc_perm: msgctl -> ipc_lookup -> audit_ipc

label=AUE_MSGCTL_STAT
  format=arg1:[ipc]:[ipc_perm]
    comment=1, message ID, "msg ID"
  note=ipc_perm
  syscall=msgctl: IPC_STAT
# ipc, ipc_perm: msgctl -> ipc_lookup -> audit_ipc

label=AUE_MSGGET
  format=arg1:ipc
    comment=1, message key, "msg key"
  note=ipc_perm
  syscall=msgget

label=AUE_MSGGETL
  skip=Not used.

label=AUE_MSGRCV
  format=arg1:[ipc]:[ipc_perm]
    comment=1, message ID, "msg ID"
  note=ipc_perm
  syscall=msgrcv
# ipc, ipc_perm: msgrcv -> ipc_lookup -> audit_ipc

label=AUE_MSGRCVL
  skip=Not used.

label=AUE_MSGSND
  format=arg1:[ipc]:[ipc_perm]
    comment=1, message ID, "msg ID"
  note=ipc_perm
  syscall=msgsnd
# ipc, ipc_perm: msgsnd -> ipc_lookup -> audit_ipc

label=AUE_MSGSNDL
  skip=Not used.

label=AUE_MSGSYS
skip=Not used.  (Placeholder for AUE_MSG* events.)

label=AUE_MUNMAP
  format=arg1:arg2
    comment=1, address of memory, "addr":
    comment=2, memory segment size, "len"

label=AUE_NFS
  skip=Not used.

label=AUE_NFSSVC_EXIT
  skip=Not used.

label=AUE_NFS_GETFH
  skip=Not used.

label=AUE_NFS_SVC
  skip=Not used.

label=AUE_NICE
  format=kernel

label=AUE_NULL
  skip=Not used.  (placeholder)
# used internal to audit_event.c for minimal audit

label=AUE_NTP_ADJTIME
  format=kernel

label=AUE_ONESIDE
  skip=Not used.

label=AUE_OPEN
  skip=Not used.  (placeholder for AUE_OPEN_*).

label=AUE_OPEN_R
  format=path:[path_attr]:[attr]
  see=open(2) - read

label=AUE_OPENAT_R
# obsolete
  format=path:[path_attr]:[attr]
  see=openat(2)

label=AUE_OPEN_RC
  format=path:[path_attr]:[attr]
  see=open(2) - read,creat

label=AUE_OPENAT_RC
# obsolete
  see=openat(2)
  format=path:[path_attr]:[attr]

label=AUE_OPEN_RT
  format=path:[path_attr]:[attr]
  see=open(2) - read,trunc

label=AUE_OPENAT_RT
# obsolete
  see=openat(2)
  format=path:[path_attr]:[attr]

label=AUE_OPEN_RTC
  format=path:[path_attr]:[attr]
  see=open(2) - read,trunc,creat

label=AUE_OPENAT_RTC
# obsolete
  see=openat(2)
  format=path:[path_attr]:[attr]

label=AUE_OPEN_RW
  format=path:[path_attr]:[attr]
  see=open(2) - read,write

label=AUE_OPENAT_RW
# obsolete
  see=openat(2)
  format=path:[path_attr]:[attr]
# aui_fsat(): fm & O_RDWR

label=AUE_OPEN_RWC
  format=path:[path_attr]:[attr]
  see=open(2) - read,write,creat

label=AUE_OPENAT_RWC
# obsolete
  see=openat(2)
  format=path:[path_attr]:[attr]

label=AUE_OPEN_RWT
  format=path:[path_attr]:[attr]
  see=open(2) - read,write,trunc

label=AUE_OPENAT_RWT
# obsolete
  see=openat(2)
  format=path:[path_attr]:[attr]

label=AUE_OPEN_RWTC
  format=path:[path_attr]:[attr]
  see=open(2) - read,write,trunc,creat

label=AUE_OPENAT_RWTC
# obsolete
  see=openat(2)
  format=path:[path_attr]:[attr]

label=AUE_OPEN_W
  format=path:[path_attr]:[attr]
  see=open(2) - write

label=AUE_OPENAT_W
  see=openat(2)
  format=path:[path_attr]:[attr]

label=AUE_OPEN_WC
  format=path:[path_attr]:[attr]
  see=open(2) - write,creat

label=AUE_OPENAT_WC
  see=openat(2)
  format=path:[path_attr]:[attr]

label=AUE_OPEN_WT
  format=path:[path_attr]:[attr]
  see=open(2) - write,trunc

label=AUE_OPENAT_WT
  see=openat(2)
  format=path:[path_attr]:[attr]

label=AUE_OPEN_WTC
  format=path:[path_attr]:[attr]
  see=open(2) - write,trunc,creat

label=AUE_OPENAT_WTC
  see=openat(2)
  format=path:[path_attr]:[attr]

label=AUE_OPEN_S
  format=path:[path_attr]:[attr]
  see=open(2) - search

label=AUE_OPEN_E
  format=path:[path_attr]:[attr]
  see=open(2) - exec

label=AUE_OSETPGRP
  skip=Not used.

label=AUE_OSTAT
# obsolete
  skip=Not used.

label=AUE_PATHCONF
  format=path:[attr]

label=AUE_PIPE
format=kernel
# class is no, not usually printed

label=AUE_PORTFS
  skip=Not used (placeholder for AUE_PORTFS_*).

label=AUE_PORTFS
  skip=Not used (placeholder for AUE_PORTFS_*).

label=AUE_PORTFS_ASSOCIATE
  syscall=portfs
  see=port_associate(3C)
  case=Port association via PORT_SOURCE_FILE
  format=[path]1:attr
    comment=name of the file/directory to be watched

label=AUE_PORTFS_DISSOCIATE
  syscall=portfs
  see=port_dissociate(3C)
  case=Port disassociation via PORT_SOURCE_FILE
  format=kernel

label=AUE_PRIOCNTLSYS
  syscall=priocntl
  see=priocntl(2)
  format=arg1:arg2
    comment=1, priocntl version number, "pc_version":
    comment=3, command, "cmd"

label=AUE_PROCESSOR_BIND
  case=No LWP/thread bound to the processor
    format=arg1:arg2:text3:[proc]
      comment=1, type of ID, "ID type":
      comment=2, ID value, "ID":
      comment="PBIND_NONE"
  case=With processor bound
    format=arg1:arg2:arg3:[proc]
      comment=1, type of ID, "ID type":
      comment=2, ID value, "ID":
      comment=3, processor ID, "processor_id"

label=AUE_PUTMSG
  see=putmsg(2)
  format=arg1:[path]:[attr]:arg2
    comment=1, file descriptor, "fd":
    comment=4, priority, "pri"

label=AUE_PUTPMSG
  see=putpmsg(2)
  format=arg1:[path]:[attr]:arg2:arg3
    comment=1, file descriptor, "fd":
    comment=4, priority, "pri":
    comment=5, flags, "flags"

label=AUE_P_ONLINE
  format=arg1:arg2:text3
    comment=1, processor ID, "processor ID":
    comment=2, flags value, "flags":
    comment=text form of flags.  Values&colon;  \
      P_ONLINE, P_OFFLINE, P_NOINTR, P_SPARE, P_FAULTED, P_STATUS, P_DISABLED

label=AUE_QUOTACTL
  skip=Not used.

label=AUE_READ
  skip=Not used.  (Placeholder for AUE_READ_* events)

label=AUE_READL
  skip=Not used. (Obsolete)

label=AUE_READLINK
  format=path:[attr]

label=AUE_READV
  skip=Not used (obsolete)
# detritus from CMS

label=AUE_READVL
  skip=Not used (obsolete)
# detritus from CMS

label=AUE_REBOOT
  skip=Not used.

label=AUE_RECV
  case=If address family is AF_INET or AF_INET6
    format=[arg]1:[inet]
      comment=1, file descriptor, "so"
  case=If address family is AF_UNIX and path is defined
    format=[path]1:[attr]
      comment=1, file descriptor, "so"
  case=If address family is AF_UNIX and path is NULL
    format=[path]1:[attr]
      comment=1, file descriptor, "no path&colon; fd"
  case=If address family is other than AF_UNIX, AF_INET, AF_INET6
    format=[arg]1:[arg]2:[arg]3
      comment=1, file descriptor, "so":
      comment=1, family, "family":
      comment=1, type, "type"
# associated class remapped to AUE_READ's class (audit_event.c:audit_s2e[237])

label=AUE_RECVFROM
  format=inet:arg1:[arg]2:inet3:arg4
    comment=3, message length, "len":
    comment=4, flags, "flags":
    comment=from address:
    comment=6, address length, "tolen"
  note=The socket token for a bad socket is reported as "argument
  note=token (1, socket descriptor, "fd")"

label=AUE_RECVMSG
  case=If invalid file descriptor
    format=arg1:arg2
      comment=1, file descriptor, "so":
      comment=3, flags, "flags"
  case=If valid file descriptor and socket is AF_UNIX and no path
  format=arg1:[attr]
    comment=1, file descriptor, "no path&colon; fd"
  case=If valid file descriptor and socket is AF_UNIX and path defined
  format=path:attr
  case=If valid file descriptor and socket is AF_INET or AF_INET6
  case=.. if socket type is SOCK_DGRAM or SOCK_RAW or SOCK_STREAM
  format=arg1:arg2:inet
    comment=1, file descriptor, "so":
    comment=2, flags, "flags"
  case=.. if socket type is unknown
  format=arg1:arg2:arg3:arg4
    comment=1, file descriptor, "so":
    comment=1, family, "family":
    comment=1, type, "type":
    comment=3, flags, "flags"

label=AUE_RENAME
  format=path1:[attr]1:[path]2
  comment=from name:
  comment=to name

label=AUE_RENAMEAT
# obsolete
  format=path1:[attr]1:[path]2
  comment=from name:
  comment=to name

label=AUE_RFSSYS
  skip=Not used.
# apparently replaced

label=AUE_RMDIR
  format=path:[attr]

label=AUE_SACL
  title=File Access Audit
  syscall=none
  see=none
  format=head:path:arg1:[text]2:subj
    comment="access_mask":
    comment="Windows SID"

label=AUE_SEMCTL
  format=arg1:[ipc]:[ipc_perm]
    comment=1, semaphore ID, "sem ID"
  note=ipc_perm
# ipc, ipc_perm token: semctl -> ipc_lookup -> audit_ipc

label=AUE_SEMCTL_GETALL
  format=arg1:[ipc]:[ipc_perm]
    comment=1, semaphore ID, "sem ID"
  note=ipc_perm
  syscall=semctl: GETALL
# ipc, ipc_perm token: semctl -> ipc_lookup -> audit_ipc

label=AUE_SEMCTL_GETNCNT
  format=arg1:[ipc]:[ipc_perm]
    comment=1, semaphore ID, "sem ID"
  note=ipc_perm
  syscall=semctl: GETNCNT
# ipc, ipc_perm token: semctl -> ipc_lookup -> audit_ipc

label=AUE_SEMCTL_GETPID
  format=arg1:[ipc]:[ipc_perm]
    comment=1, semaphore ID, "sem ID"
  note=ipc_perm
  syscall=semctl: GETPID
# ipc, ipc_perm token: semctl -> ipc_lookup -> audit_ipc

label=AUE_SEMCTL_GETVAL
  format=arg1:[ipc]:[ipc_perm]
    comment=1, semaphore ID, "sem ID"
  note=ipc_perm
  syscall=semctl: GETVAL
# ipc, ipc_perm token: semctl -> ipc_lookup -> audit_ipc

label=AUE_SEMCTL_GETZCNT
  format=arg1:[ipc]:[ipc_perm]
    comment=1, semaphore ID, "sem ID"
  note=ipc_perm
  syscall=semctl: GETZCNT
# ipc, ipc_perm token: semctl -> ipc_lookup -> audit_ipc

label=AUE_SEMCTL_RMID
  format=arg1:[ipc]:[ipc_perm]
    comment=1, semaphore ID, "sem ID"
  note=ipc_perm
  syscall=semctl: IPC_RMID
# ipc, ipc_perm token: semctl -> ipc_rmid -> ipc_lookup -> audit_ipc

label=AUE_SEMCTL_SET
  format=arg1:[ipc]:[ipc_perm]
    comment=1, semaphore ID, "sem ID"
  note=ipc_perm
  syscall=semctl: IPC_SET
# ipc, ipc_perm token: semctl -> ipc_lookup -> audit_ipc

label=AUE_SEMCTL_SETALL
  format=arg1:[ipc]:[ipc_perm]
    comment=1, semaphore ID, "sem ID"
  note=ipc_perm
  syscall=semctl: SETALL
# ipc, ipc_perm token: semctl -> ipc_lookup -> audit_ipc

label=AUE_SEMCTL_SETVAL
  format=arg1:[ipc]:[ipc_perm]
    comment=1, semaphore ID, "sem ID"
  note=ipc_perm
  syscall=semctl: SETVAL
# ipc, ipc_perm token: semctl -> ipc_lookup -> audit_ipc

label=AUE_SEMCTL_STAT
  format=arg1:[ipc]:[ipc_perm]
    comment=1, semaphore ID, "sem ID"
  note=ipc_perm
  syscall=semctl: IPC_STAT
# ipc, ipc_perm token: semctl -> ipc_lookup -> audit_ipc

label=AUE_SEMGET
  format=arg1:[ipc_perm]:ipc
    comment=1, semaphore ID, "sem key"
  note=ipc_perm
  syscall=semctl: SETVAL
# ipc_perm token: semget -> audit_ipcget

label=AUE_SEMGETL
  skip=Not used.

label=AUE_SEMOP
  format=arg1:[ipc]:[ipc_perm]
    comment=1, semaphore ID, "sem ID"
  note=ipc_perm
# ipc, ipc_perm token: semop -> ipc_lookup -> audit_ipc

label=AUE_SEMSYS
  skip=Not used.  (place holder) -- defaults to a semget variant

label=AUE_SEND
  case=If address family is AF_INET or AF_INET6
    format=[arg]1:[inet]
      comment=1, file descriptor, "so"
  case=If address family is AF_UNIX and path is defined
    format=[path]1:[attr]
      comment=1, file descriptor, "so"
  case=If address family is AF_UNIX and path is NULL
    format=[path]1:[attr]
      comment=1, file descriptor, "no path&colon; fd"
  case=If address family is other than AF_UNIX, AF_INET, AF_INET6
    format=[arg]1:[arg]2:[arg]3
      comment=1, file descriptor, "so":
      comment=1, family, "family":
      comment=1, type, "type"
# associated class remapped to AUE_WRITE's class (audit_event.c:audit_s2e[240])

label=AUE_SENDMSG
  case=If invalid file descriptor
    format=arg1:arg2
      comment=1, file descriptor, "so":
      comment=3, flags, "flags"
  case=If valid file descriptor
  case=...and address family is AF_UNIX and path is defined
    format=path:attr
  case=...and address family is AF_UNIX and path is NULL
    format=path1:attr
      comment=1, file descriptor, "nopath&colon; fd"
  case=...and address family is AF_INET or AF_INET6, \
    socket is SOCK_DGRAM, SOCK_RAW or SOCK_STREAM
    format=arg1:arg2:inet
      comment=1, file descriptor, "so":
      comment=3, flags, "flags"
  case=...and unknown address family or address family AF_INET or AF_INET6 \
    and not socket SOCK_DGRAM, SOCK_RAW or SOCK_STREAM
    format=arg1:arg2:arg3:arg4
      comment=1, file descriptor, "so":
      comment=1, family, "family":
      comment=1, type, "type":
      comment=1, flags, "flags"

label=AUE_SENDTO
  case=If invalid file descriptor
    format=arg1:arg2
      comment=1, file descriptor, "so":
      comment=3, flags, "flags"
  case=If valid file descriptor
  case=...and socket is AF_UNIX and path is defined
    format=path:attr
  case=...and address family is AF_UNIX and path is NULL
    format=path1:attr
      comment=1, file descriptor, "nopath&colon; fd"
  case=...and address family is AF_INET or AF_INET6
    format=arg1:arg2:inet
      comment=1, file descriptor, "so":
      comment=3, flags, "flags"
  case=...and unknown address family
    format=arg1:arg2:arg3:arg4
      comment=1, file descriptor, "so":
      comment=1, family, "family":
      comment=1, type, "type":
      comment=1, flags, "flags"

label=AUE_SETAUDIT
  case=With a valid program stack address
    format=arg1:arg2:arg3:arg4:arg5:arg6
      comment=1, audit user ID, "setaudit&colon;auid":
      comment=1, terminal ID, "setaudit&colon;port":
      comment=1, terminal ID, "setaudit&colon;machine":
      comment=1, preselection mask, "setaudit&colon;as_success":
      comment=1, preselection mask, "setaudit&colon;as_failure":
      comment=1, audit session ID, "setaudit&colon;asid"
  case=With an invalid program stack address
    format=kernel
#	header,215,2,setaudit(2),,Mon May 15 09:43:28 2000, + 60002627 msec
#	argument,1,0x271a,setaudit:auid
#	argument,1,0x3ff0201,setaudit:port
#	argument,1,0x8192591e,setaudit:machine
#	argument,1,0x400,setaudit:as_success
#	argument,1,0x400,setaudit:as_failure
#	argument,1,0x16f,setaudit:asid
#	subject,tuser10,root,other,root,other,20620,367,255 197121 tmach1
#	return,success,0
#	trailer,215
#	header,215,2,setaudit(2),,Mon May 15 09:43:40 2000, + 50000847 msec
#	argument,1,0x271a,setaudit:auid
#	argument,1,0x3ff0201,setaudit:port
#	argument,1,0x8192591e,setaudit:machine
#	argument,1,0x400,setaudit:as_success
#	argument,1,0x400,setaudit:as_failure
#	argument,1,0x16f,setaudit:asid
#	subject,tuser10,root,other,root,other,20720,367,255 197121 tmach1
#	return,success,0
#	trailer,215

label=AUE_SETAUDIT_ADDR
  case=With a valid program stack address
    format=arg1:arg2:arg3:inaddr4:arg5:arg6:arg7
      comment=1, audit user ID, "auid":
      comment=1, terminal ID, "port":
      comment=1, type, "type":
      comment=1, terminal ID, "ip address":
      comment=1, preselection mask, "as_success":
      comment=1, preselection mask, "as_failure":
      comment=1, audit session ID, "asid"
  case=With an invalid program stack address
    format=kernel
#	header,172,2,setaudit_addr(2),,Fri Nov 09 13:52:26 2001, + 0 msec
#	argument,1,0x15fa7,auid
#	argument,1,0x0,port
#	argument,1,0x4,type
#	ip address,tmach2
#	argument,1,0x9c00,as_success
#	argument,1,0x9c00,as_failure
#	argument,1,0x1f1,asid
#	subject,tuser1,root,staff,tuser1,staff,10420,497,0 0 tmach2
#	return,success,0

label=AUE_SETAUID
  format=arg1
    comment=2, audit user ID, "setauid"

label=AUE_SETDOMAINNAME
  skip=Not used.  (See AUE_SYSINFO)
# See AUE_SYSINFO with SI_SET_SRPC_DOMAIN

label=AUE_SETEGID
  format=arg1
    comment=1, group ID, "gid"

label=AUE_SETEUID
  format=arg1
    comment=1, user ID, "euid"

label=AUE_SETGID
  format=arg1
    comment=1, group ID, "gid"

label=AUE_SETGROUPS
  note=If more than NGROUPS_MAX_DEFAULT groups listed,
  note=no tokens are generated.
  case=If no groups in list
    format=[arg]1
      comment=1, 0, "setgroups"
  case=If 1 or more groups in list
    format=(1..n)arg1
      comment=1, gid, "setgroups"

label=AUE_SETHOSTNAME
  skip=Not used.  (See AUE_SYSINFO)
# See sysinfo call with command SI_SET_HOSTNAME

label=AUE_SETKERNSTATE
  skip=Not used.

label=AUE_SETPGID
  format=[proc]:[arg]1
  comment=2, pgid, "pgid"

label=AUE_SETPGRP
  format=kernel

label=AUE_SETPRIORITY
  skip=Not used.

label=AUE_SETPPRIV
  case=operation privileges off
  format=arg1:privset2
    comment=setppriv operation:
    comment=privileges actually switched off
  case=operation privileges on
  format=arg1:privset2
    comment=setppriv operation:
    comment=privileges actually switched on
  case=operation privileges off
  format=arg1:privset2:privset3
    comment=setppriv operation:
    comment=privileges before privset:
    comment=privileges after privset
#header,220,2,settppriv(2),,test1,Mon Oct  6 10:09:05 PDT 2003, + 753 msec
#argument,2,0x2,op
#privilege,Inheritable,file_link_any,proc_exec,proc_fork,proc_session
#privilege,Inheritable,file_link_any,proc_exec,proc_fork,proc_session
#subject,tuser,root,staff,tuser,staff,444,426,200 131585 test0
#return,success,0

label=AUE_SETREGID
  format=arg1:arg2
    comment=1, real group ID, "rgid":
    comment=2, effective group ID, "egid"

label=AUE_SETREUID
  format=arg1:arg2
    comment=1, real user ID, "ruid":
    comment=2, effective user ID, "euid"

label=AUE_SETRLIMIT
  format=kernel
#	header,73,2,setrlimit(2),,Thu Nov 08 15:14:17 2001, + 0 msec
#	subject,tuser1,tuser1,staff,tuser1,staff,9707,497,0 0 tmach2
#	return,success,0

label=AUE_SETSID
  format=kernel

label=AUE_SETSOCKOPT
  case=Invalid file descriptor
    format=arg1:arg2
      comment=1, file descriptor, "so":
      comment=2, level, "level"
  case=Valid file descriptor
  case=...and socket is AF_UNIX
    format=path1:arg2:arg3:arg4:arg5:arg6:[arg]7:[data]8
      comment=if no path, will be argument&colon; 1, "nopath&colon; fd", \
        file descriptor:
      comment=1, file descriptor, "so":
      comment=1, family, "family":
      comment=1, type, "type":
      comment=2, protocol level, "level":
      comment=3, option name, "optname":
      comment=5, option length, "optlen":
      comment=option data
  case=...and socket is AF_INET or AF_INET6
    format=arg1:arg2:arg3:[arg]4:[data]5:inet
      comment=1, file descriptor, "so":
      comment=2, protocol level, "level":
      comment=3, option name, "optname":
      comment=5, option length, "optlen":
      comment=option data
  case=...and socket adddress family is unknown
    format=arg1:arg2:arg3:arg4:arg5:[arg]6:[data]7
      comment=1, file descriptor, "so":
      comment=1, family, "family":
      comment=1, type, "type":
      comment=2, protocol level, "level":
      comment=3, option name, "optname":
      comment=5, option length, "optlen":
      comment=option data

label=AUE_SETTIMEOFDAY
  skip=Not used.

label=AUE_SETUID
  syscall=setuid
  format=arg1
    comment=1, "uid" to be set

label=AUE_SETUSERAUDIT
  skip=Not used.

label=AUE_SHMAT
  format=arg1:arg2:[ipc]:[ipc_perm]
    comment=1, shared memory ID, "shm ID":
    comment=2, shared mem addr, "shm addr"
  note=ipc_perm
# ipc, ipc_perm token: shmat -> ipc_lookup -> audit_ipc

label=AUE_SHMCTL
  format=arg1:[ipc]:[ipc_perm]
    comment=1, shared memory ID, "shm ID"
  note=ipc_perm
# ipc, ipc_perm token: shmctl -> ipc_lookup -> audit_ipc

label=AUE_SHMCTL_RMID
  format=arg1:[ipc]:[ipc_perm]
  comment=1, shared memory ID, "shm ID"
  note=ipc_perm
  syscall=semctl:  IPC_RMID
# ipc, ipc_perm token: shmctl -> ipc_rmid -> ipc_lookup -> audit_ipc

label=AUE_SHMCTL_SET
  format=arg1:[ipc]:[ipc_perm]
    comment=1, shared memory ID, "shm ID"
  note=ipc_perm
  syscall=semctl:  IPC_SET
# ipc, ipc_perm token: shmctl -> ipc_lookup -> audit_ipc

label=AUE_SHMCTL_STAT
  format=arg1:[ipc]:[ipc_perm]
    comment=1, shared memory ID, "shm ID"
  note=ipc_perm
  syscall=semctl:  IPC_STAT
# ipc, ipc_perm token: shmctl -> ipc_lookup -> audit_ipc

label=AUE_SHMDT
  format=arg1
    comment=1, shared memory address, "shm adr"

label=AUE_SHMGET
  format=arg1:[ipc_perm]:[ipc]
    comment=0, shared memory key, "shm key"
  note=ipc_perm
# ipc_perm: shmget -> audit_ipcget

label=AUE_SHMGETL
  skip=Not used.

label=AUE_SHMSYS
  skip=Not used.  (Placeholder for shmget and shmctl*)

label=AUE_SHUTDOWN
  case=If the socket address is invalid
    format=[arg]1:[text]2:[text]3
      comment=1, file descriptor, "fd":
      comment=bad socket address:
      comment=bad peer address
  case=If the socket address is part of the AF_INET family
    case=..with zero file descriptor
      format=arg1:[arg]2:[arg]3:[arg]4
	comment=1, file descriptor, "so":
	comment=1, family, "family":
	comment=1, type, "type":
	comment=2, how shutdown code, "how"
    case=...with non-zero file descriptor
      format=arg1:arg2:inet
	comment=1, file descriptor, "so":
	comment=2, how shutdown code, "how"
  case=If the socket address is AF_UNIX
    case=...with zero file descriptor
      format=path1:arg2:[arg]3:[arg]4:[arg]5
	comment=If error&colon; argument&colon; \
	  1, "no path&colon; fd", file descriptor:
	comment=1, file descriptor, "so":
	comment=1, family, "family":
	comment=1, type, "type":
	comment=2, how shutdown code, "how"
    case=...with non-zero file descriptor
      format=path1:arg2:arg3:inet
	comment=If error&colon; argument&colon; \
	  1, file descriptor, "no path&colon; fd":
	comment=1, file descriptor, "so":
	comment=2, how shutdown code, "how"
#old BSM manual wrong; used audit_event.c

label=AUE_SOCKACCEPT
  syscall=getmsg:  socket accept
  format=inet:arg1:[path]:attr:arg2
    comment=1, file descriptor, "fd":
    comment=4, priority, "pri"
# see putmsg and getmsg for record format
# See audit.c for inet token and audit_start.c for other reference

label=AUE_SOCKCONFIG
  format=arg1:arg2:arg3:[path]4
    comment=1, domain address, "domain":
    comment=2, type, "type":
    comment=3, protocol, "protocol":
    comment=If no path&colon;argument -- 3, 0, "devpath"

label=AUE_SOCKCONNECT
  syscall=putmsg:  socket connect
  format=inet:arg1:[path]:attr:arg2
    comment=1, file descriptor, "fd":
    comment=4, priority, "pri"
# same as AUE_SOCKACCEPT

label=AUE_SOCKET
  format=arg1:[arg]2:arg3
    comment=1, socket domain, "domain":
    comment=2, socket type, "type":
    comment=3, socket protocol, "protocol"

label=AUE_SOCKETPAIR
  skip=Not used.
# unreferenced

label=AUE_SOCKRECEIVE
  syscall=getmsg
  format=inet:arg1:[path]:attr:arg2
    comment=1, file descriptor, "fd":
    comment=4, priority, "pri"
# see AUE_SOCKACCEPT

label=AUE_SOCKSEND
syscall=putmsg
  format=inet:arg1:[path]:attr:arg2
    comment=1, file descriptor, "fd":
    comment=4, priority, "pri"
# see AUE_SOCKACCEPT

label=AUE_STAT
  format=path:[attr]

label=AUE_STATFS
  format=path:[attr]

label=AUE_STATVFS
  format=path:[attr]

label=AUE_STIME
  format=kernel

label=AUE_SWAPON
  skip=Not used.

label=AUE_SYMLINK
  format=path:text1:[attr]
    comment=symbolic link string

label=AUE_SYSINFO
  note=Only SI_SET_HOSTNAME and SI_SET_SRPC_DOMAIN commands
  note=are currently audited.
  format=arg1:[text]2
    comment=1, command, "cmd":
    comment=name

label=AUE_SYSTEMBOOT
  title=system booted
  syscall=none
  format=head:text1
    comment="booting kernel"
# see audit_start.c and audit_io.c
# no subject or return / exit token
#	header,44,2,system booted,na,Fri Nov 09 13:53:42 2001, + 0 msec
#	text,booting kernel

label=AUE_TRUNCATE
  skip=Not used.

label=AUE_UMOUNT
  syscall=umount: old version
  note=Implemented as call of the newer umount2(2).
  format=path:arg1:[path]:[attr]
    comment=2, mflag value = 0, "flags"

label=AUE_UMOUNT2
  syscall=umount2
  format=path:arg1:[path]:[attr]
    comment=2, mflag value, "flags"

label=AUE_UNLINK
  format=path:[attr]

label=AUE_UNLINKAT
# obsolete
  see=openat(2)
  format=path:[attr]

label=AUE_UNMOUNT
  skip=Not used.

label=AUE_UTIME
# obsolete
  format=path:[attr]

label=AUE_UTIMES
  see=futimens(2)
  format=path:[attr]

label=AUE_VFORK
  format=arg1
    comment=0, pid, "child PID"
  note=The vfork(2) return values are undefined because the audit record is
  note=produced at the point that the child process is spawned.

label=AUE_VPIXSYS
  skip=Not used.

label=AUE_VTRACE
  skip=Not used.

label=AUE_WRITE
  format=path1:attr
    comment=if no path, argument -- "1, file descriptor, "no path: fd"
  note:An audit record is generated for write only once per file close.

label=AUE_WRITEV
  skip=Not used. (obsolete)

label=AUE_XMKNOD
# obsolete
  skip=Not used.

label=AUE_XSTAT
# obsolete
  skip=Not Used.

label=AUE_PF_POLICY_ADDRULE
  title=Add IPsec policy rule
  see=
  syscall=none
  format=arg1:arg2:[zone]3:[text]4
  comment=Operation applied to active policy (1 is active, 0 is inactive):
  comment=Operation applied to global policy (1 is global, 0 is tunnel):
  comment=affected zone:
  comment=Name of target tunnel

label=AUE_PF_POLICY_DELRULE
  title=Delete IPsec policy rule
  see=
  syscall=none
  format=arg1:arg2:[zone]3:[text]4
  comment=Operation applied to active policy (1 is active, 0 is inactive):
  comment=Operation applied to global policy (1 is global, 0 is tunnel):
  comment=affected zone:
  comment=Name of target tunnel

label=AUE_PF_POLICY_CLONE
  title=Clone IPsec policy
  see=
  syscall=none
  format=arg1:arg2:[zone]3:[text]4
  comment=Operation applied to active policy (1 is active, 0 is inactive):
  comment=Operation applied to global policy (1 is global, 0 is tunnel):
  comment=affected zone:
  comment=Name of target tunnel

label=AUE_PF_POLICY_FLIP
  title=Flip IPsec policy
  see=
  syscall=none
  format=arg1:arg2:[zone]3:[text]4
  comment=Operation applied to active policy (1 is active, 0 is inactive):
  comment=Operation applied to global policy (1 is global, 0 is tunnel):
  comment=affected zone:
  comment=Name of target tunnel

label=AUE_PF_POLICY_FLUSH
  title=Flip IPsec policy rules
  see=
  syscall=none
  format=arg1:arg2:[zone]3:[text]4
  comment=Operation applied to active policy (1 is active, 0 is inactive):
  comment=Operation applied to global policy (1 is global, 0 is tunnel):
  comment=affected zone:
  comment=Name of target tunnel

label=AUE_PF_POLICY_ALGS
  title=Update IPsec algorithms
  see=
  syscall=none
  format=arg1:arg2:[zone]3:[text]4
  comment=Operation applied to active policy (1 is active, 0 is inactive):
  comment=Operation applied to global policy (1 is global, 0 is tunnel):
  comment=affected zone:
  comment=Name of target tunnel

label=AUE_allocate_fail
  program=/usr/sbin/allocate
  title=allocate: allocate-device failure
  format=(0..n)[text]1
    comment=command line arguments
# see audit_allocate.c

label=AUE_allocate_succ
  program=/usr/sbin/allocate
  title=allocate: allocate-device success
  format=(0..n)[text]1
    comment=command line arguments
# see audit_allocate.c

label=AUE_at_create
  program=/usr/bin/at
  title=at: at-create crontab
  format=path

label=AUE_at_delete
  program=/usr/bin/at
  title=at: at-delete atjob (at or atrm)
  format=text1:path
  comment="ancillary file&colon;" filename or "bad format of at-job name"

label=AUE_at_perm
  skip=Not used.
# not referenced outside uevents.h

label=AUE_create_user
  skip=Not used.

label=AUE_cron_invoke
  program=/usr/sbin/cron
  title=cron: cron-invoke at or cron
  case=If issue with account find
  format=text1
    comment="bad user" name or "user <name> account expired"
  case=else
  format=text1:text2
    comment="at-job", "batch-job", "crontab-job", "queue-job (<queue_name>)", \
      or "unknown job type (<job_type_id>)":
    comment=command

label=AUE_crontab_create
  program=/usr/bin/crontab
  title=crontab: crontab created
  format=path
# See audit_crontab.c

label=AUE_crontab_delete
  program=/usr/bin/crontab
  title=crontab: crontab delete
  format=path
# See audit_crontab.c

label=AUE_crontab_mod
  program=/usr/bin/crontab
  title=crontab:  crontab modify
  format=path
# See audit_crontab.c

label=AUE_crontab_perm
  skip=Not used.

label=AUE_deallocate_fail
  program=/usr/sbin/deallocate
  title=deallocate-device failure
  format=(0..n)[text]1
    comment=command line arguments
# See audit_allocate.c

label=AUE_deallocate_succ
  program=/usr/sbin/deallocate
  title=deallocate-device success
  format=(0..n)[text]1
    comment=command line arguments
# See audit_allocate.c

label=AUE_delete_user
  skip=Not used.

label=AUE_disable_user
  skip=Not used.

label=AUE_enable_user
  skip=Not used.

label=AUE_ftpd
  skip=Not used (Hammerhead: in.ftpd removed).

label=AUE_ftpd_logout
  skip=Not used (Hammerhead: in.ftpd removed).

label=AUE_halt_solaris
  program=/sbin/halt
  title=halt
  format=user
# See audit_halt.c

label=AUE_kadmind_auth
  format=text1:text2:text3
    comment=Op&colon; <requested information>:
    comment=Arg&colon; <argument for Op>:
    comment=Client&colon; <client principal name>
# See audit_kadmin.c / common_audit()

label=AUE_kadmind_unauth
  format=text1:text2:text3
    comment=Op&colon; <requested information>:
    comment=Arg&colon; <argument for Op>:
    comment=Client&colon; <client principal name>
# See audit_kadmin.c / common_audit()

label=AUE_krb5kdc_as_req
  format=text1:text2
    comment=Client&colon; <client principal name>:
    comment=Service&colon; <requested service name>
# See audit_krb5kdc.c / common_audit()

label=AUE_krb5kdc_tgs_req
  format=text1:text2
    comment=Client&colon; <client principal name>:
    comment=Service&colon; <requested service name>
# See audit_krb5kdc.c / common_audit()

label=AUE_krb5kdc_tgs_req_alt_tgt
  format=text1:text2
    comment=Client&colon; <client principal name>:
    comment=Service&colon; <requested service name>
# See audit_krb5kdc.c / common_audit()

label=AUE_krb5kdc_tgs_req_2ndtktmm
  format=text1:text2
    comment=Client&colon; <client principal name>:
    comment=Service&colon; <requested service name>
# See audit_krb5kdc.c / common_audit()

label=AUE_listdevice_fail
  title=allocate-list devices failure
  program=/usr/sbin/allocate
  format=(0..n)[text]1
    comment=command line arguments
# See audit_allocate.c

label=AUE_listdevice_succ
  title=allocate-list devices success
  program=/usr/sbin/allocate
  format=(0..n)[text]1
    comment=command line arguments
# See audit_allocate.c

label=AUE_modify_user
  skip=Not used.

label=AUE_mountd_mount
  title=mountd: NFS mount
  program=/usr/lib/nfs/mountd
  see=mountd(8)
  format=text1:path2
    comment=remote client hostname:
    comment=mount dir
# See audit_mountd.c

label=AUE_mountd_umount
  title=mountd: NFS unmount
  program=/usr/lib/nfs/mountd
  format=text1:path2
  comment=remote client hostname:
  comment=mount dir
# See audit_mountd.c

label=AUE_poweroff_solaris
  program=/sbin/poweroff
  title=poweroff
  format=user
# See audit_halt.c

label=AUE_reboot_solaris
  program=/sbin/reboot
  title=reboot
  format=user
# See audit_reboot.c
#	header,61,2,reboot(8),,Fri Nov 09 13:52:34 2001, + 726 msec
#	subject,tuser1,root,other,root,other,10422,497,0 0 tmach2
#	return,success,0

label=AUE_rexd
  skip=Not used (Hammerhead: rpc.rexd removed).

label=AUE_rexecd
  skip=Not used (Hammerhead: rpc.rexecd removed).

label=AUE_rshd
  skip=Not used (Hammerhead: in.rshd removed).

label=AUE_shutdown_solaris
  title=shutdown
  program=/usr/ucb/shutdown
  format=user
# See audit_shutdown.c

label=AUE_smserverd
  program=/usr/lib/smedia/rpc.smserverd
  format=[text]1:[text]2
    comment=state change:
    comment=vid, pid, major/minor device
# see usr/src/cmd/smserverd
# code shows a third token, path, but it isn't implemented.

label=AUE_uadmin_solaris
  title=uadmin (obsolete)
  program=
  see=
  format=text1:text2
  comment=function code:
  comment=argument code
# not used. Replaced by AUE_uadmin_* events, see uadmin.c, adt.xml

label=AUE_LABELSYS_TNRH
  title=config Trusted Network remote host cache
  see=tnrh(2)
  syscall=labelsys: TSOL_TNRH
  case=With the flush command (cmd=3)
    format=arg1
      comment=1, command, "cmd"
  case=With the load (cmd=1) and delete (cmd=2) commands
    format=arg1:inaddr2:arg3
      comment=1, command, "cmd":
      comment=ip address of host:
      comment=2, prefix length, "prefix len"

label=AUE_LABELSYS_TNRHTP
  title=config Trusted Network remote host template
  see=tnrhtp(2)
  syscall=labelsys: TSOL_TNRHTP
  case=With the flush command (cmd=3)
    format=arg1
      comment=1, command, "cmd"
  case=With the load (cmd=1) and delete (cmd=2) commands
    format=arg1:text2
      comment=1, command, "cmd":
      comment=name of template

label=AUE_LABELSYS_TNMLP
  title=config Trusted Network multi-level port entry
  see=tnmlp(2)
  syscall=labelsys: TSOL_TNMLP
  case=With the flush command (cmd=3)
    format=arg1:text2
      comment=1, command, "cmd":
      comment="shared", or name of zone
  case=With the load (cmd=1) and delete (cmd=2) commands
    format=arg1:text2:arg3:arg4:[arg]5
      comment=1, command, "cmd":
      comment="shared", or name of zone:
      comment=2, protocol number, "proto num":
      comment=2, starting mlp port number, "mlp_port":
      comment=2, ending mlp port number, "mlp_port_upper"
#!/usr/bin/perl -w
#
# CDDL HEADER START
#
# The contents of this file are subject to the terms of the
# Common Development and Distribution License (the "License").
# You may not use this file except in compliance with the License.
#
# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
# or http://www.opensolaris.org/os/licensing.
# See the License for the specific language governing permissions
# and limitations under the License.
#
# When distributing Covered Code, include this CDDL HEADER in each
# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
# If applicable, add the following below this CDDL HEADER, with the
# fields enclosed by brackets "[]" replaced with your own identifying
# information: Portions Copyright [yyyy] [name of copyright owner]
#
# CDDL HEADER END
#
#
# Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
# Use is subject to license terms.
#

# audit_record_xml [-d] <xml input file>

# audit_record_xml takes the audit record description (.xml file) and
# generates adt_ part of audit_record_attr on stdout.

use auditxml;
use Getopt::Std;
use vars qw($opt_d);
use strict;


our $debug = 0; # normal use is to set via the file being parsed.
               # <debug set="on"/> or <debug set="off"/> or <debug/>
               # if the set attribute is omitted, debug state is toggled
               # Override with appDebug, but toggle won't do what you
               # want.
my $appDebug = 0; # used after return from "new auditxml";

my $prog = $0; $prog =~ s|.*/||g;
my $usage = "usage: $prog [-d] file.xml\n";

getopts('d');

$appDebug = $opt_d;

die $usage if ($#ARGV < 0);

my $doc = new auditxml ($ARGV[0]);  # input XML file

$debug = $appDebug;

foreach my $eventId ($doc->getEventIds) {
	my $event = $doc->getEvent($eventId);
	next if ($event->getOmit eq 'always');
	print "label=$eventId\n";
	my $title = $event->getTitle;
	print "  title=$title\n" if (defined $title && length($title));
	my $program = $event->getProgram;
	if (defined $program && scalar @$program) {
		print "  program=";
		print join(";", @$program);
		print "\n";
	}
	my $see = $event->getSee;
	if (defined $see && scalar @$see) {
		print "  see=";
		print join(";", @$see);
		print "\n";
	}
	my $format = [];
	my $comments = [];
	my $idx = 0;
	my $superClass = $event->getSuperClass;
	$event = $superClass if (defined $superClass && ref($superClass));
	foreach my $entryId ($event->getExternal->getEntryIds) {
		next if $entryId eq 'subject';
		next if $entryId eq 'return';
		my @entry = $event->getExternal->getEntry($entryId);
		my $token = $entry[2];
		my $comment = $entry[4];
		my $opt = $entry[0]->getAttr('opt');
		$token = "[$token]" if ($opt eq 'optional');
		if (defined $comment && ($comment ne '')) {
			$idx++;
			$token .= $idx;
			push @$comments, $comment;
		}
		push @$format, $token;
	}
	if (scalar @$format) {
		print "  format=".join(":", @$format)."\n";
	} else {
		print "  format=user\n";
	}
	my $commentStr = '';
	foreach (@$comments) {
		$commentStr .= "  comment=$_:\n";
	}
	$commentStr =~ s/:\n$/\n/s;
	print $commentStr;
	print "\n";
}

exit (0);

#!/usr/bin/perl
#
# CDDL HEADER START
#
# The contents of this file are subject to the terms of the
# Common Development and Distribution License (the "License").
# You may not use this file except in compliance with the License.
#
# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
# or http://www.opensolaris.org/os/licensing.
# See the License for the specific language governing permissions
# and limitations under the License.
#
# When distributing Covered Code, include this CDDL HEADER in each
# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
# If applicable, add the following below this CDDL HEADER, with the
# fields enclosed by brackets "[]" replaced with your own identifying
# information: Portions Copyright [yyyy] [name of copyright owner]
#
# CDDL HEADER END
#
#
# Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
# Use is subject to license terms.
#

# auditrecord - display one or more audit records

require 5.8.4;		
use strict;
use warnings;

our (%opt, $parse, $callFilter, $debug,
    %attr, %event, %class, %skipClass, %token, %noteAlias,
    $title, $note, $name, $col1, $col2, $col3, $skip);

use Getopt::Std;
use locale;
use POSIX qw(locale_h);
use Sun::Solaris::Utils qw(gettext textdomain);
use Sun::Solaris::BSM::_BSMparse;

setlocale(LC_ALL, "");
textdomain(TEXT_DOMAIN);

if (!getopts('adhe:c:i:p:s:', \%opt) || @ARGV) {
	my $errString =
	    gettext("$0 takes no arguments other than switches.\n");
	print STDERR $errString if (@ARGV);
	usage();
	exit (1);
}

unless ($opt{a} || $opt{c} || $opt{e} || $opt{h} || $opt{i} ||
	$opt{p} || $opt{s}) {
	usage();
	exit (1);
}

my %options;
$options{'classFilter'} = $opt{c};   # filter on this class
$debug			= $opt{d};   # debug mode on
$options{'eventFilter'} = $opt{e};   # filter on this event
my $html		= $opt{h};   # output in html format
$options{'idFilter'}	= $opt{i};   # filter on this id
$callFilter		= $opt{p};   # filter on this program name
$callFilter		= $opt{s} if ($opt{s}); # filter on this system call

if (defined($callFilter)) {
	$callFilter = qr/\b$callFilter\b/;
} else {
	$callFilter = qr//;
}
$parse = new Sun::Solaris::BSM::_BSMparse($debug, \%options);

my ($attr, $token, $skipClass, $noteAlias) = $parse->readAttr();
%attr  = %$attr;
%token = %$token;
%noteAlias = %$noteAlias;
%skipClass = %$skipClass;

%class = %{$parse->readClass()};
%event = %{$parse->readEvent()};

# the calls to readControl and readUser are for debug; they are not
# needed for generation of record formats.  'ignore' means if there
# is no permission to read the file, don't die, just soldier on.

# $error is L10N'd by $parse

if ($debug) {
	my ($cnt, $error);

	# verify audit_control content
	($cnt, $error) = $parse->readControl('ignore');
	print STDERR $error if ($cnt);

	# verify audit_user content
	($cnt, $error) = $parse->readUser('ignore');
	print STDERR $error if ($cnt);

	# check audit_event, audit_display_attr
	($cnt, $error) = $parse->ckAttrEvent();
	print STDERR $error if ($cnt);
}

# check for invalid class to -c option if supplied
if (defined $options{'classFilter'}) {
	my $invalidClass = gettext('Invalid class %s supplied.');
	my $isInvalidClass = 0;
	foreach (split(/\s*,\s*/, $options{'classFilter'})) {
		unless (exists $class{$_}) {
			printf STDERR "$invalidClass\n", $_;
			$isInvalidClass = 1;
		}
	}
	exit (1) if $isInvalidClass;
}

if ($html) {
	writeHTML();
} else {
	writeASCII();
}

exit (0);

# writeASCII -- collect what's been read from various sources and
# output the formatted audit records

sub writeASCII {
	my $label;

	my $errString;

	foreach $label (sort(keys(%event))) {
		my $description;
		my @case;

		my ($id, $class, $eventDescription) = @{$event{$label}};

		our ($title, $note, $name, $col1, $col2, $col3);

		my ($skipThisClass, $mask) = classToMask($class, $label);

		next if ($skipThisClass);

		$mask = sprintf("0x%08X", $mask);

		($name, $description, $title, $skip, @case) =
			getAttributes($label, $eventDescription);

		next if ($name eq 'undefined');

		next unless $description =~ $callFilter;

		$~ = 'nameLine';
		write;

		$note = $skip;
		$~ = 'wrapped1';
		while ($note) {
			write;
		}
		next if ($skip);

		$~ = 'threeColumns';
		($col1, $col2, $col3) = getCallInfo($id, $name, $description);
		my @col1 = split(/\s*;\s*/, $col1);
		my @col2 = split(/\s*;\s*/, $col2);
		my @col3 = split(/\s*;\s*/, $col3);
		my $rows = $#col1;
		$rows = $#col2 if ($#col2 > $rows);
		$rows = $#col3 if ($#col3 > $rows);
		for (my $i = 0; $i <= $rows; $i++) {
			$col1 = defined ($col1[$i]) ? $col1[$i] : '';
			$col2 = defined ($col2[$i]) ? $col2[$i] : '';
			$col3 = defined ($col3[$i]) ? 'See ' . $col3[$i] : '';
			write;
		}
		$col1 = 'event ID';
		$col2 = $id;
		$col3 = $label;
		write;

		$col1 = 'class';
		$col2 = $class;
		$col3 = "($mask)";
		write;

		my $haveFormat = 0;
		my $caseElement;

		foreach $caseElement (@case) {
			# $note1 is the "case" description
			# $note2 is a "note"
			my ($note1, $format, $comment, $note2) = @$caseElement;

			$note = $note1;
			$~ = 'wrapped1';
			while ($note) {
				write;
			}
			unless (defined($format)) {
				$errString = gettext(
				    "missing format field: %s");
				printf STDERR ("$errString\n", $label);
				next;
			}
			unless ($format eq 'none') {
				$haveFormat = 1;

				my $list = getFormatList($format, $id);

				my @format  = split(/\s*:\s*/, $list);
				my @comment = split(/\s*:\s*/, $comment);

				my $item;

				foreach $item (@format) {
					$~ = 'twoColumns';
					($col1, $col2) =
					    getFormatLine($item, $label,
					    @comment);
					write;
					$~ = "col2Wrapped";
					while ($col2) {
						write;
					}
				}
			}
			$note2 = $noteAlias{$note2} if ($noteAlias{$note2});
			if ($note2) {
				$note = $note2;
				$~ = 'space';
				write;
				$~ = 'wrapped1';
				while ($note) {
					write;
				}
			}
		}
		unless ($haveFormat) {
			$~ = 'wrapped1';
			$note = gettext('No format information available');
			write;
		}
	}
}

# writeHTML -- collect what's been read from various sources
# and output the formatted audit records
#

sub writeHTML {
	my $label;

	my $description;
	my @case;

	my $docTitle = gettext("Audit Record Formats");

	print qq{
<!doctype html PUBLIC "-//IETF//DTD HTML//EN">
<html>
<head>
  <title>$docTitle</title>
  <META http-equiv="Content-Style-Type" content="text/css">
</head>

<body TEXT="#000000" BGCOLOR="#F0F0F0">
	};

	my $tableRows = 0;	# work around Netscape large table bug
	startTable();		# by generating multiple tables

	foreach $label (sort(keys(%event))) {
		my ($id, $class, $eventDescription) = @{$event{$label}};

		our ($title, $name, $note, $col1, $col2, $col3);

		my ($skipThisClass, $mask) = classToMask($class, $label);

		next if ($skipThisClass);

		$mask = sprintf("0x%08X", $mask);

		my $description;

		($name, $description, $title, $skip, @case) =
			getAttributes($label, $eventDescription);

		next if ($name eq 'undefined');

		next unless $description =~ $callFilter;

		$tableRows++;
		if ($tableRows > 50) {
			endTable();
			startTable();
			$tableRows = 0;
		}

		my ($callType, $callName);
		($callType, $callName, $description) =
			getCallInfo($id, $name, $description);
		$description =~ s/\s*;\s*/<br>/g;

		my $titleName = $title;
		if ($callName) {
			$titleName = $callName;
		}
		$titleName =~ s/\s*;\s*/<br>/g;
		$titleName = '&nbsp;' if ($titleName eq $title);

		print qq{
  <tr bgcolor="#C0C0C0">
    <td>$label</td>
    <td>$id</td>
    <td>$class</td>
    <td>$mask</td>
  </tr>
  <tr>
    <td colspan=2>$titleName</td>
    <td colspan=2>$description</td>
  </tr>
  <tr>
    <td colspan=4>
      <pre>
};

		$note = $skip;
		$~ = 'wrapped2';
		while ($note) {
			write;
		}
		next if ($skip);

		my $haveFormat = 0;
		my $caseElement;

		foreach $caseElement (@case) {
			my ($note1, $format, $comment, $note2) = @$caseElement;

			$note = $note1;
			$~ = 'wrapped2';
			while ($note) {
				write;
			}
			unless (defined($format)) {
				my $errString = gettext(
				    "Missing format field: %s\n");
				printf STDERR ($errString, $label);
				next;
			}
			unless ($format eq 'none') {
				$haveFormat = 1;

				my $list = getFormatList($format, $id);

				my @format  = split(/\s*:\s*/, $list);
				my @comment = split(/\s*:\s*/, $comment);
				my $item;

				$~ = 'twoColumns';
				foreach $item (@format) {
					($col1, $col2) =
					    getFormatLine($item, $label,
					    @comment);
					write;
				}
			}
			if ($note2) {
				$note2 = $noteAlias{$note2} if ($noteAlias{$note2});
				$note = $note2;
				$~ = 'space';
				write;
				$~ = 'wrapped2';
				while ($note) {
					write;
				}
			}
		}
		unless ($haveFormat) {
			$~ = 'wrapped2';
			$note = 'No format information available';
			write;
		}
		print q{
      </pre>
    </td/>
  </tr>
		};
	}
	endTable();
}

sub startTable {

	print q{
<table border=1>
  <tr bgcolor="#C0C0C0">
    <th>Event Name</th>
    <th>Event ID</th>
    <th>Event Class</th>
    <th>Mask</th>
  </tr>
  <tr>
    <th colspan=2>Call Name</th>
    <th colspan=2>Reference</th>
  <tr>
  <tr>
    <th colspan=4>Format</th>
  </tr>
	};
}

sub endTable {

	print q{
</table>
</body>
</html>
	};
}

# classToMask: One, given a class list, it calculates the mask; Two,
# it checks to see if every item on the class list is marked for
# skipping, and if so, sets a flag.

sub classToMask {
	my $classList = shift;
	my $label = shift;
	my $mask = 0;

	my @classes = split(/\s*,\s*/, $classList);
	my $skipThisClass = 0;

	my $thisClass;
	foreach $thisClass (@classes) {
		unless (defined($class{$thisClass})) {
			my $errString = gettext(
			    "%s not found in audit_class.  Omitting %s\n");
			$errString = sprintf($errString, $thisClass,
			    $label);
			print STDERR $errString if ($debug);
			next;
		}
		$skipThisClass = 1 if ($skipClass{$thisClass});
		$mask |=  $class{$thisClass};
	}
	return ($skipThisClass, $mask);
}

# getAttributes: Combine fields from %event and %attr; a description
# in the attribute file overrides a description from audit_event

sub getAttributes {
	my $label = shift;
	my $desc = shift;	# description from audit_event

	my ($description, $title, $skip, @case);

	my $errString = gettext("%s not found in attribute file.");
	my $name = gettext("undefined");

	if (defined($attr{$label})) {
		($name, $description, $title, $skip, @case) = @{$attr{$label}};
		if ($description eq 'none') {
			if ($desc eq 'blank') {
				$description = '';
			} else {
				$description = $desc;
			}
		}
		$name = '' if ($name eq 'none');
		$title = $name if (($title eq 'none') || (!defined($title)));
	} else {
		printf STDERR ("$errString\n", $label) if ($debug);
	}
	return ($name, $description, $title, $skip, @case);
}

# getCallInfo: the system call or program name for an audit record can
# usually be derived from the event name; %attr provides exceptions to
# this rule

sub getCallInfo {
	my $id = shift;
	my $name = shift;
	my $desc = shift;

	my $callType;
	my $callName;
	my $description;

	if ($name) {
		if ($id < 6000) {
			$callType = 'system call';
		} else {
			$callType = 'program';
		}
		($callName) = split(/\s*:\s*/, $name);
	} else {
		$callType = '';
		$callName = '';
	}
	$description = '';
	$description = "$desc" if ($desc);

	return ($callType, $callName, $description);
}

# getFormatList: determine the order and details of kernel vs user
# audit records.  If the first token is "head" then the token list
# is explicit, otherwise the header, subject and return are implied.

sub getFormatList {
	my $format = shift;
	my $id = shift;

	my $list;

	if ($format =~ /^head:/) {
		$list = $format;
	}
	elsif ($format eq 'kernel') {
		$list = $parse->{'kernelDefault'};
		$list =~ s/insert://;
	} elsif ($format eq 'user') {
		$list = $parse->{'userDefault'};
		$list =~ s/insert://;
	} elsif ($id < 6000) {
		$list = $parse->{'kernelDefault'};
		$list =~ s/insert/$format/;
	} else {
		$list = $parse->{'userDefault'};
		$list =~ s/insert/$format/;
	}
	return ($list);
}

# getFormatLine: the arguments from the attribute 'format' are
# expanded to their printable form and also paired with a comment if
# one exists

sub getFormatLine {
	my $arg = shift;
	my $label = shift;
	my @comment = @_;

	my $isOption = 0;

	my ($token, $comment);

	my $cmt = -1;
	if ($arg =~ s/(\D*)(\d+)$/$1/) {  # trailing digits select a comment
		$cmt = $2 - 1;
	}
	$isOption = 1 if ($arg =~ s/^\[(.+)\]$/$1/);

	if (defined($token{$arg})) {	# expand abbreviated name to token
		$token = $token{$arg};
	} else {
		$token = $arg;		# no abbreviation found
	}
	$token = '['.$token.']' if ($isOption);

	if ($cmt > -1) {
		unless(defined($comment[$cmt])) {
			my $errString = gettext(
			    "missing comment for %s %s token %d\n");
			printf STDERR ($errString, $label, $token,
			    $cmt);
			$comment = gettext('missing comment field');
		} else {
			$comment = $comment[$cmt];
			$comment =~ s/&colon;/:/g;	#':' is a delimiter
		}
	} else {
		$comment = '';
	}
	unless (defined($token) && defined($comment)) {
		my $errString = gettext("attribute format/comment error for %s\n");
		printf STDERR ($errString, $label);
	}
	return ($token, $comment);
}

sub usage {
	print "$0 [ -d ] [ -h ] {[ -a ] | [ -e event ] |\n";
	print "\t[ -c class ] | [-i id ] | [ -p program ] |\n";
	print "\t[ -s syscall ]}\n";
}

format nameLine =

@<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
$title
.

format threeColumns =
  @<<<<<<<<<< @<<<<<<<<<<<<<<<<<<< @<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
$col1, $col2, $col3
.

format twoColumns =
      @<<<<<<<<<<<<<<<<<<<<<<<<<<< ^<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
$col1, $col2
.
format col2Wrapped =
				   ^<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
$col2
.

format space =

.

format wrapped1 =
    ^<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
$note
.

format wrapped2 =
^<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
$note
.
#!/usr/bin/perl -w
#
# CDDL HEADER START
#
# The contents of this file are subject to the terms of the
# Common Development and Distribution License (the "License").
# You may not use this file except in compliance with the License.
#
# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
# or http://www.opensolaris.org/os/licensing.
# See the License for the specific language governing permissions
# and limitations under the License.
#
# When distributing Covered Code, include this CDDL HEADER in each
# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
# If applicable, add the following below this CDDL HEADER, with the
# fields enclosed by brackets "[]" replaced with your own identifying
# information: Portions Copyright [yyyy] [name of copyright owner]
#
# CDDL HEADER END
#
#
# Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
# Use is subject to license terms.
#

# local script to process audit_record_attr.txt -> audit_record_attr
#
# comments in the source file may start with "#" or "##" in any
# column.  Those with double hash are retained as comments (but with a
# single "#") in the destination and the others are removed.  Because
# of the comment removal, any sequence of more than one line of blank
# lines is also removed.

use strict;
require 5.005;

my $blankCount = 1;	# not zero is a kludge to avoid making the first
			# line of the output a blank line.
while (<>) {
        s/(?<!#)#(?!#).*//;
	if (/^\s*$/) {
		$blankCount++ ;
		next if ($blankCount > 1);
	} else {
		$blankCount = 0;
	}
	s/##/#/;
	print;
}
#!/usr/bin/perl -w
#
# CDDL HEADER START
#
# The contents of this file are subject to the terms of the
# Common Development and Distribution License (the "License").
# You may not use this file except in compliance with the License.
#
# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
# or http://www.opensolaris.org/os/licensing.
# See the License for the specific language governing permissions
# and limitations under the License.
#
# When distributing Covered Code, include this CDDL HEADER in each
# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
# If applicable, add the following below this CDDL HEADER, with the
# fields enclosed by brackets "[]" replaced with your own identifying
# information: Portions Copyright [yyyy] [name of copyright owner]
#
# CDDL HEADER END
#
#
# Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
# Use is subject to license terms.
#

# mkmsg.pl -- generate message file content for strings that
# originate in audit_record_attr and audit_event
#
# mkmsg.pl domain po_file_name

require 5.005;
use strict;

use vars qw(
    $parse %translateText
    $debug
    %attr %event %class %skipClass %token %noteAlias);

use locale;
use POSIX qw(locale_h);
use Sun::Solaris::Utils qw(gettext textdomain);
use Sun::Solaris::BSM::_BSMparse;

unless ($#ARGV == 1) {
	print STDERR "usage: $0 domain_name file_name\n";
	exit (1);
}
my $textDomain = $ARGV[0];
my $poFile = $ARGV[1];

# Set message locale
setlocale(LC_ALL, "");
textdomain($textDomain);

my %options;
$options{'classFilter'} = '';		# don''t filter
$debug			= 0;		# debug mode on
$options{'eventFilter'} = '';   	# don''t filter
$options{'idFilter'}	= '';		# don''t filter

$parse = new Sun::Solaris::BSM::_BSMparse($debug, \%options, './',
    '../../lib/libbsm', '.txt');

my ($attr, $token, $skipClass, $noteAlias) = $parse->readAttr();
%class = %{$parse->readClass()};
%event = %{$parse->readEvent()};

%attr  = %$attr;
%token = %$token;
%noteAlias = %$noteAlias;
%skipClass = %$skipClass;

my $label;

my $errString;

foreach $label (sort keys %event) {

	my ($id, $class, $eventDescription) = ('', '', '');
	if (defined($event{$label})) {
		($id, $class, $eventDescription) = @{$event{$label}};
		$eventDescription =~ s/\(\w+\)//;
	}

	my ($name, $description, $title, $skip, @case) = ('', '', '', '', ());
	if (defined($attr{$label})) {
		($name, $description, $title, $skip, @case) = @{$attr{$label}};
		$description = '' if ($description eq 'none');
		$name = '' if ($name eq 'none');
		$title = $name if (($title eq 'none') || (!defined($title)));
	}

# in auditrecord.pl, _either_ $description _or_ $eventDescription
# is used.  Both are put into the message file so that this script
# doesn't have logic dependent on auditrecord.pl

	addToMsgFile($title);
	addToMsgFile($eventDescription);
	addToMsgFile($description);

	my $case;

	foreach $case (@case) {
		addToMsgFile(${$case}[0]);	# description
		#		[1]		# token id (a name list)
		my @comment = split(/\s*:\s*/, ${$case}[2]);
		my $note = ${$case}[3];

		my $comment;
		foreach $comment (@comment) {
			addToMsgFile($comment);
		}
		if ($noteAlias{$note}) {
			addToMsgFile($noteAlias{$note});
		} else {
			addToMsgFile($note);
		}
	}
	
}
writeMsgFile($textDomain, $poFile);

exit (0);

sub addToMsgFile {
	my @text = @_;

	my $text;
	foreach $text (@text) {
		next if ($text =~ /^$/);
		$text =~ s/&colon;/:/g;
		$translateText{$text} = 1;
	}
}

# ids in the .po file must be quoted; since the messages themselves
# contain quotes, quotes must be escaped

sub writeMsgFile {
	my $domain = shift;
	my $file = shift;

	my $text;

	open(Message, ">$file") or
		die "Failed to open $file: $!\n";

	print Message "# File:audit_record_attr: textdomain(\"$domain\")\n";
	foreach $text (sort keys %translateText) {
		$text =~ s/"/\\"/g;
		print Message "msgid \"$text\"\nmsgstr\n";
	}
	close Message;
}