1 /*
2 * Copyright (c) 2005 Apple Computer, Inc.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 * 3. Neither the name of Apple Computer, Inc. ("Apple") nor the names of
15 * its contributors may be used to endorse or promote products derived
16 * from this software without specific prior written permission.
17 *
18 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
19 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
20 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
21 * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
22 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
23 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
24 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
25 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
27 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28 *
29 * P4: //depot/projects/trustedbsd/audit3/sys/bsm/audit_kevents.h#34
30 * $FreeBSD$
31 */
32
33 #ifndef _BSM_AUDIT_KEVENTS_H_
34 #define _BSM_AUDIT_KEVENTS_H_
35
36 /*
37 * Values marked as AUE_NULL are not required to be audited as per CAPP.
38 *
39 * Some conflicts exist in the assignment of name to event number mappings
40 * between BSM implementations. In general, we prefer the OpenSolaris
41 * definition as we consider Solaris BSM to be authoritative. _DARWIN_ has
42 * been inserted for the Darwin variants. If necessary, other tags will be
43 * added in the future.
44 */
45 #define AUE_NULL 0
46 #define AUE_EXIT 1
47 #define AUE_FORK 2
48 #define AUE_FORKALL AUE_FORK /* Solaris-specific. */
49 #define AUE_OPEN 3
50 #define AUE_CREAT 4
51 #define AUE_LINK 5
52 #define AUE_UNLINK 6
53 #define AUE_DELETE AUE_UNLINK /* Darwin-specific. */
54 #define AUE_EXEC 7
55 #define AUE_CHDIR 8
56 #define AUE_MKNOD 9
57 #define AUE_CHMOD 10
58 #define AUE_CHOWN 11
59 #define AUE_UMOUNT 12
60 #define AUE_JUNK 13 /* Solaris-specific. */
61 #define AUE_ACCESS 14
62 #define AUE_CHECKUSERACCESS AUE_ACCESS /* Darwin-specific. */
63 #define AUE_KILL 15
64 #define AUE_STAT 16
65 #define AUE_LSTAT 17
66 #define AUE_ACCT 18
67 #define AUE_MCTL 19 /* Solaris-specific. */
68 #define AUE_REBOOT 20 /* XXX: Darwin conflict. */
69 #define AUE_SYMLINK 21
70 #define AUE_READLINK 22
71 #define AUE_EXECVE 23
72 #define AUE_CHROOT 24
73 #define AUE_VFORK 25
74 #define AUE_SETGROUPS 26
75 #define AUE_SETPGRP 27
76 #define AUE_SWAPON 28
77 #define AUE_SETHOSTNAME 29 /* XXX: Darwin conflict. */
78 #define AUE_FCNTL 30
79 #define AUE_SETPRIORITY 31 /* XXX: Darwin conflict. */
80 #define AUE_CONNECT 32
81 #define AUE_ACCEPT 33
82 #define AUE_BIND 34
83 #define AUE_SETSOCKOPT 35
84 #define AUE_VTRACE 36 /* Solaris-specific. */
85 #define AUE_SETTIMEOFDAY 37 /* XXX: Darwin conflict. */
86 #define AUE_FCHOWN 38
87 #define AUE_FCHMOD 39
88 #define AUE_SETREUID 40
89 #define AUE_SETREGID 41
90 #define AUE_RENAME 42
91 #define AUE_TRUNCATE 43 /* XXX: Darwin conflict. */
92 #define AUE_FTRUNCATE 44 /* XXX: Darwin conflict. */
93 #define AUE_FLOCK 45 /* XXX: Darwin conflict. */
94 #define AUE_SHUTDOWN 46
95 #define AUE_MKDIR 47
96 #define AUE_RMDIR 48
97 #define AUE_UTIMES 49
98 #define AUE_ADJTIME 50
99 #define AUE_SETRLIMIT 51
100 #define AUE_KILLPG 52
101 #define AUE_NFS_SVC 53 /* XXX: Darwin conflict. */
102 #define AUE_STATFS 54
103 #define AUE_FSTATFS 55
104 #define AUE_UNMOUNT 56 /* XXX: Darwin conflict. */
105 #define AUE_ASYNC_DAEMON 57
106 #define AUE_NFS_GETFH 58 /* XXX: Darwin conflict. */
107 #define AUE_SETDOMAINNAME 59
108 #define AUE_QUOTACTL 60 /* XXX: Darwin conflict. */
109 #define AUE_EXPORTFS 61
110 #define AUE_MOUNT 62
111 #define AUE_SEMSYS 63
112 #define AUE_MSGSYS 64
113 #define AUE_SHMSYS 65
114 #define AUE_BSMSYS 66 /* Solaris-specific. */
115 #define AUE_RFSSYS 67 /* Solaris-specific. */
116 #define AUE_FCHDIR 68
117 #define AUE_FCHROOT 69
118 #define AUE_VPIXSYS 70 /* Solaris-specific. */
119 #define AUE_PATHCONF 71
120 #define AUE_OPEN_R 72
121 #define AUE_OPEN_RC 73
122 #define AUE_OPEN_RT 74
123 #define AUE_OPEN_RTC 75
124 #define AUE_OPEN_W 76
125 #define AUE_OPEN_WC 77
126 #define AUE_OPEN_WT 78
127 #define AUE_OPEN_WTC 79
128 #define AUE_OPEN_RW 80
129 #define AUE_OPEN_RWC 81
130 #define AUE_OPEN_RWT 82
131 #define AUE_OPEN_RWTC 83
132 #define AUE_MSGCTL 84
133 #define AUE_MSGCTL_RMID 85
134 #define AUE_MSGCTL_SET 86
135 #define AUE_MSGCTL_STAT 87
136 #define AUE_MSGGET 88
137 #define AUE_MSGRCV 89
138 #define AUE_MSGSND 90
139 #define AUE_SHMCTL 91
140 #define AUE_SHMCTL_RMID 92
141 #define AUE_SHMCTL_SET 93
142 #define AUE_SHMCTL_STAT 94
143 #define AUE_SHMGET 95
144 #define AUE_SHMAT 96
145 #define AUE_SHMDT 97
146 #define AUE_SEMCTL 98
147 #define AUE_SEMCTL_RMID 99
148 #define AUE_SEMCTL_SET 100
149 #define AUE_SEMCTL_STAT 101
150 #define AUE_SEMCTL_GETNCNT 102
151 #define AUE_SEMCTL_GETPID 103
152 #define AUE_SEMCTL_GETVAL 104
153 #define AUE_SEMCTL_GETALL 105
154 #define AUE_SEMCTL_GETZCNT 106
155 #define AUE_SEMCTL_SETVAL 107
156 #define AUE_SEMCTL_SETALL 108
157 #define AUE_SEMGET 109
158 #define AUE_SEMOP 110
159 #define AUE_CORE 111 /* Solaris-specific, currently. */
160 #define AUE_CLOSE 112
161 #define AUE_SYSTEMBOOT 113 /* Solaris-specific. */
162 #define AUE_ASYNC_DAEMON_EXIT 114 /* Solaris-specific. */
163 #define AUE_NFSSVC_EXIT 115 /* Solaris-specific. */
164 #define AUE_WRITEL 128 /* Solaris-specific. */
165 #define AUE_WRITEVL 129 /* Solaris-specific. */
166 #define AUE_GETAUID 130
167 #define AUE_SETAUID 131
168 #define AUE_GETAUDIT 132
169 #define AUE_SETAUDIT 133
170 #define AUE_GETUSERAUDIT 134 /* Solaris-specific. */
171 #define AUE_SETUSERAUDIT 135 /* Solaris-specific. */
172 #define AUE_AUDITSVC 136 /* Solaris-specific. */
173 #define AUE_AUDITUSER 137 /* Solaris-specific. */
174 #define AUE_AUDITON 138
175 #define AUE_AUDITON_GTERMID 139 /* Solaris-specific. */
176 #define AUE_AUDITON_STERMID 140 /* Solaris-specific. */
177 #define AUE_AUDITON_GPOLICY 141
178 #define AUE_AUDITON_SPOLICY 142
179 #define AUE_AUDITON_GQCTRL 145
180 #define AUE_AUDITON_SQCTRL 146
181 #define AUE_GETKERNSTATE 147 /* Solaris-specific. */
182 #define AUE_SETKERNSTATE 148 /* Solaris-specific. */
183 #define AUE_GETPORTAUDIT 149 /* Solaris-specific. */
184 #define AUE_AUDITSTAT 150 /* Solaris-specific. */
185 #define AUE_REVOKE 151
186 #define AUE_MAC 152 /* Solaris-specific. */
187 #define AUE_ENTERPROM 153 /* Solaris-specific. */
188 #define AUE_EXITPROM 154 /* Solaris-specific. */
189 #define AUE_IFLOAT 155 /* Solaris-specific. */
190 #define AUE_PFLOAT 156 /* Solaris-specific. */
191 #define AUE_UPRIV 157 /* Solaris-specific. */
192 #define AUE_IOCTL 158
193 #define AUE_SOCKET 183
194 #define AUE_SENDTO 184
195 #define AUE_PIPE 185
196 #define AUE_SOCKETPAIR 186 /* XXX: Darwin conflict. */
197 #define AUE_SEND 187
198 #define AUE_SENDMSG 188
199 #define AUE_RECV 189
200 #define AUE_RECVMSG 190
201 #define AUE_RECVFROM 191
202 #define AUE_READ 192
203 #define AUE_GETDENTS 193
204 #define AUE_LSEEK 194
205 #define AUE_WRITE 195
206 #define AUE_WRITEV 196
207 #define AUE_NFS 197 /* Solaris-specific. */
208 #define AUE_READV 198
209 #define AUE_OSTAT 199 /* Solaris-specific. */
210 #define AUE_SETUID 200 /* XXXRW: Solaris old setuid? */
211 #define AUE_STIME 201 /* XXXRW: Solaris old stime? */
212 #define AUE_UTIME 202 /* XXXRW: Solaris old utime? */
213 #define AUE_NICE 203 /* XXXRW: Solaris old nice? */
214 #define AUE_OSETPGRP 204 /* Solaris-specific. */
215 #define AUE_SETGID 205
216 #define AUE_READL 206 /* Solaris-specific. */
217 #define AUE_READVL 207 /* Solaris-specific. */
218 #define AUE_FSTAT 208
219 #define AUE_DUP2 209
220 #define AUE_MMAP 210
221 #define AUE_AUDIT 211
222 #define AUE_PRIOCNTLSYS 212 /* Solaris-specific. */
223 #define AUE_MUNMAP 213
224 #define AUE_SETEGID 214
225 #define AUE_SETEUID 215
226 #define AUE_PUTMSG 216 /* Solaris-specific. */
227 #define AUE_GETMSG 217 /* Solaris-specific. */
228 #define AUE_PUTPMSG 218 /* Solaris-specific. */
229 #define AUE_GETPMSG 219 /* Solaris-specific. */
230 #define AUE_AUDITSYS 220 /* Solaris-specific. */
231 #define AUE_AUDITON_GETKMASK 221
232 #define AUE_AUDITON_SETKMASK 222
233 #define AUE_AUDITON_GETCWD 223
234 #define AUE_AUDITON_GETCAR 224
235 #define AUE_AUDITON_GETSTAT 225
236 #define AUE_AUDITON_SETSTAT 226
237 #define AUE_AUDITON_SETUMASK 227
238 #define AUE_AUDITON_SETSMASK 228
239 #define AUE_AUDITON_GETCOND 229
240 #define AUE_AUDITON_SETCOND 230
241 #define AUE_AUDITON_GETCLASS 231
242 #define AUE_AUDITON_SETCLASS 232
243 #define AUE_FUSERS 233 /* Solaris-specific; also UTSSYS? */
244 #define AUE_STATVFS 234
245 #define AUE_XSTAT 235 /* Solaris-specific. */
246 #define AUE_LXSTAT 236 /* Solaris-specific. */
247 #define AUE_LCHOWN 237
248 #define AUE_MEMCNTL 238 /* Solaris-specific. */
249 #define AUE_SYSINFO 239 /* Solaris-specific. */
250 #define AUE_XMKNOD 240 /* Solaris-specific. */
251 #define AUE_FORK1 241
252 #define AUE_MODCTL 242 /* Solaris-specific. */
253 #define AUE_MODLOAD 243
254 #define AUE_MODUNLOAD 244
255 #define AUE_MODCONFIG 245 /* Solaris-specific. */
256 #define AUE_MODADDMAJ 246 /* Solaris-specific. */
257 #define AUE_SOCKACCEPT 247 /* Solaris-specific. */
258 #define AUE_SOCKCONNECT 248 /* Solaris-specific. */
259 #define AUE_SOCKSEND 249 /* Solaris-specific. */
260 #define AUE_SOCKRECEIVE 250 /* Solaris-specific. */
261 #define AUE_ACLSET 251
262 #define AUE_FACLSET 252
263 #define AUE_DOORFS 253 /* Solaris-specific. */
264 #define AUE_DOORFS_DOOR_CALL 254 /* Solaris-specific. */
265 #define AUE_DOORFS_DOOR_RETURN 255 /* Solaris-specific. */
266 #define AUE_DOORFS_DOOR_CREATE 256 /* Solaris-specific. */
267 #define AUE_DOORFS_DOOR_REVOKE 257 /* Solaris-specific. */
268 #define AUE_DOORFS_DOOR_INFO 258 /* Solaris-specific. */
269 #define AUE_DOORFS_DOOR_CRED 259 /* Solaris-specific. */
270 #define AUE_DOORFS_DOOR_BIND 260 /* Solaris-specific. */
271 #define AUE_DOORFS_DOOR_UNBIND 261 /* Solaris-specific. */
272 #define AUE_P_ONLINE 262 /* Solaris-specific. */
273 #define AUE_PROCESSOR_BIND 263 /* Solaris-specific. */
274 #define AUE_INST_SYNC 264 /* Solaris-specific. */
275 #define AUE_SOCKCONFIG 265 /* Solaris-specific. */
276 #define AUE_SETAUDIT_ADDR 266
277 #define AUE_GETAUDIT_ADDR 267
278 #define AUE_UMOUNT2 268 /* Solaris-specific. */
279 #define AUE_FSAT 269 /* Solaris-specific. */
280 #define AUE_OPENAT_R 270
281 #define AUE_OPENAT_RC 271
282 #define AUE_OPENAT_RT 272
283 #define AUE_OPENAT_RTC 273
284 #define AUE_OPENAT_W 274
285 #define AUE_OPENAT_WC 275
286 #define AUE_OPENAT_WT 276
287 #define AUE_OPENAT_WTC 277
288 #define AUE_OPENAT_RW 278
289 #define AUE_OPENAT_RWC 279
290 #define AUE_OPENAT_RWT 280
291 #define AUE_OPENAT_RWTC 281
292 #define AUE_RENAMEAT 282
293 #define AUE_FSTATAT 283
294 #define AUE_FCHOWNAT 284
295 #define AUE_FUTIMESAT 285
296 #define AUE_UNLINKAT 286
297 #define AUE_CLOCK_SETTIME 287
298 #define AUE_NTP_ADJTIME 288
299 #define AUE_SETPPRIV 289 /* Solaris-specific. */
300 #define AUE_MODDEVPLCY 290 /* Solaris-specific. */
301 #define AUE_MODADDPRIV 291 /* Solaris-specific. */
302 #define AUE_CRYPTOADM 292 /* Solaris-specific. */
303 #define AUE_CONFIGKSSL 293 /* Solaris-specific. */
304 #define AUE_BRANDSYS 294 /* Solaris-specific. */
305 #define AUE_PF_POLICY_ADDRULE 295 /* Solaris-specific. */
306 #define AUE_PF_POLICY_DELRULE 296 /* Solaris-specific. */
307 #define AUE_PF_POLICY_CLONE 297 /* Solaris-specific. */
308 #define AUE_PF_POLICY_FLIP 298 /* Solaris-specific. */
309 #define AUE_PF_POLICY_FLUSH 299 /* Solaris-specific. */
310 #define AUE_PF_POLICY_ALGS 300 /* Solaris-specific. */
311
312 /*
313 * Events added for Apple Darwin that potentially collide with future Solaris
314 * BSM events. These are assigned AUE_DARWIN prefixes, and are deprecated in
315 * new trails. Systems generating these events should switch to the new
316 * identifiers that avoid colliding with the Solaris identifier space.
317 */
318 #define AUE_DARWIN_GETFSSTAT 301
319 #define AUE_DARWIN_PTRACE 302
320 #define AUE_DARWIN_CHFLAGS 303
321 #define AUE_DARWIN_FCHFLAGS 304
322 #define AUE_DARWIN_PROFILE 305
323 #define AUE_DARWIN_KTRACE 306
324 #define AUE_DARWIN_SETLOGIN 307
325 #define AUE_DARWIN_REBOOT 308
326 #define AUE_DARWIN_REVOKE 309
327 #define AUE_DARWIN_UMASK 310
328 #define AUE_DARWIN_MPROTECT 311
329 #define AUE_DARWIN_SETPRIORITY 312
330 #define AUE_DARWIN_SETTIMEOFDAY 313
331 #define AUE_DARWIN_FLOCK 314
332 #define AUE_DARWIN_MKFIFO 315
333 #define AUE_DARWIN_POLL 316
334 #define AUE_DARWIN_SOCKETPAIR 317
335 #define AUE_DARWIN_FUTIMES 318
336 #define AUE_DARWIN_SETSID 319
337 #define AUE_DARWIN_SETPRIVEXEC 320 /* Darwin-specific. */
338 #define AUE_DARWIN_NFSSVC 321
339 #define AUE_DARWIN_GETFH 322
340 #define AUE_DARWIN_QUOTACTL 323
341 #define AUE_DARWIN_ADDPROFILE 324 /* Darwin-specific. */
342 #define AUE_DARWIN_KDEBUGTRACE 325 /* Darwin-specific. */
343 #define AUE_DARWIN_KDBUGTRACE AUE_KDEBUGTRACE
344 #define AUE_DARWIN_FSTAT 326
345 #define AUE_DARWIN_FPATHCONF 327
346 #define AUE_DARWIN_GETDIRENTRIES 328
347 #define AUE_DARWIN_TRUNCATE 329
348 #define AUE_DARWIN_FTRUNCATE 330
349 #define AUE_DARWIN_SYSCTL 331
350 #define AUE_DARWIN_MLOCK 332
351 #define AUE_DARWIN_MUNLOCK 333
352 #define AUE_DARWIN_UNDELETE 334
353 #define AUE_DARWIN_GETATTRLIST 335 /* Darwin-specific. */
354 #define AUE_DARWIN_SETATTRLIST 336 /* Darwin-specific. */
355 #define AUE_DARWIN_GETDIRENTRIESATTR 337 /* Darwin-specific. */
356 #define AUE_DARWIN_EXCHANGEDATA 338 /* Darwin-specific. */
357 #define AUE_DARWIN_SEARCHFS 339 /* Darwin-specific. */
358 #define AUE_DARWIN_MINHERIT 340
359 #define AUE_DARWIN_SEMCONFIG 341
360 #define AUE_DARWIN_SEMOPEN 342
361 #define AUE_DARWIN_SEMCLOSE 343
362 #define AUE_DARWIN_SEMUNLINK 344
363 #define AUE_DARWIN_SHMOPEN 345
364 #define AUE_DARWIN_SHMUNLINK 346
365 #define AUE_DARWIN_LOADSHFILE 347 /* Darwin-specific. */
366 #define AUE_DARWIN_RESETSHFILE 348 /* Darwin-specific. */
367 #define AUE_DARWIN_NEWSYSTEMSHREG 349 /* Darwin-specific. */
368 #define AUE_DARWIN_PTHREADKILL 350 /* Darwin-specific. */
369 #define AUE_DARWIN_PTHREADSIGMASK 351 /* Darwin-specific. */
370 #define AUE_DARWIN_AUDITCTL 352
371 #define AUE_DARWIN_RFORK 353
372 #define AUE_DARWIN_LCHMOD 354
373 #define AUE_DARWIN_SWAPOFF 355
374 #define AUE_DARWIN_INITPROCESS 356 /* Darwin-specific. */
375 #define AUE_DARWIN_MAPFD 357 /* Darwin-specific. */
376 #define AUE_DARWIN_TASKFORPID 358 /* Darwin-specific. */
377 #define AUE_DARWIN_PIDFORTASK 359 /* Darwin-specific. */
378 #define AUE_DARWIN_SYSCTL_NONADMIN 360
379 #define AUE_DARWIN_COPYFILE 361 /* Darwin-specific. */
380
381 /*
382 * Audit event identifiers added as part of OpenBSM, generally corresponding
383 * to events in FreeBSD, Darwin, and Linux that were not present in Solaris.
384 * These often duplicate events added to the Solaris set by Darwin, but use
385 * event identifiers in a higher range in order to avoid colliding with
386 * future Solaris additions.
387 *
388 * If an event in this section is later added to Solaris, we prefer the
389 * Solaris event identifier, and add _OPENBSM_ to the OpenBSM-specific
390 * identifier so that old trails can still be processed, but new trails use
391 * the Solaris identifier.
392 */
393 #define AUE_GETFSSTAT 43001
394 #define AUE_PTRACE 43002
395 #define AUE_CHFLAGS 43003
396 #define AUE_FCHFLAGS 43004
397 #define AUE_PROFILE 43005
398 #define AUE_KTRACE 43006
399 #define AUE_SETLOGIN 43007
400 #define AUE_OPENBSM_REVOKE 43008 /* Solaris event now preferred. */
401 #define AUE_UMASK 43009
402 #define AUE_MPROTECT 43010
403 #define AUE_MKFIFO 43011
404 #define AUE_POLL 43012
405 #define AUE_FUTIMES 43013
406 #define AUE_SETSID 43014
407 #define AUE_SETPRIVEXEC 43015 /* Darwin-specific. */
408 #define AUE_ADDPROFILE 43016 /* Darwin-specific. */
409 #define AUE_KDEBUGTRACE 43017 /* Darwin-specific. */
410 #define AUE_KDBUGTRACE AUE_KDEBUGTRACE
411 #define AUE_OPENBSM_FSTAT 43018 /* Solaris event now preferred. */
412 #define AUE_FPATHCONF 43019
413 #define AUE_GETDIRENTRIES 43020
414 #define AUE_SYSCTL 43021
415 #define AUE_MLOCK 43022
416 #define AUE_MUNLOCK 43023
417 #define AUE_UNDELETE 43024
418 #define AUE_GETATTRLIST 43025 /* Darwin-specific. */
419 #define AUE_SETATTRLIST 43026 /* Darwin-specific. */
420 #define AUE_GETDIRENTRIESATTR 43027 /* Darwin-specific. */
421 #define AUE_EXCHANGEDATA 43028 /* Darwin-specific. */
422 #define AUE_SEARCHFS 43029 /* Darwin-specific. */
423 #define AUE_MINHERIT 43030
424 #define AUE_SEMCONFIG 43031
425 #define AUE_SEMOPEN 43032
426 #define AUE_SEMCLOSE 43033
427 #define AUE_SEMUNLINK 43034
428 #define AUE_SHMOPEN 43035
429 #define AUE_SHMUNLINK 43036
430 #define AUE_LOADSHFILE 43037 /* Darwin-specific. */
431 #define AUE_RESETSHFILE 43038 /* Darwin-specific. */
432 #define AUE_NEWSYSTEMSHREG 43039 /* Darwin-specific. */
433 #define AUE_PTHREADKILL 43040 /* Darwin-specific. */
434 #define AUE_PTHREADSIGMASK 43041 /* Darwin-specific. */
435 #define AUE_AUDITCTL 43042
436 #define AUE_RFORK 43043
437 #define AUE_LCHMOD 43044
438 #define AUE_SWAPOFF 43045
439 #define AUE_INITPROCESS 43046 /* Darwin-specific. */
440 #define AUE_MAPFD 43047 /* Darwin-specific. */
441 #define AUE_TASKFORPID 43048 /* Darwin-specific. */
442 #define AUE_PIDFORTASK 43049 /* Darwin-specific. */
443 #define AUE_SYSCTL_NONADMIN 43050
444 #define AUE_COPYFILE 43051 /* Darwin-specific. */
445
446 /*
447 * Events added to OpenBSM for FreeBSD and Linux; may also be used by Darwin
448 * in the future.
449 */
450 #define AUE_LUTIMES 43052
451 #define AUE_LCHFLAGS 43053 /* FreeBSD-specific. */
452 #define AUE_SENDFILE 43054 /* BSD/Linux-specific. */
453 #define AUE_USELIB 43055 /* Linux-specific. */
454 #define AUE_GETRESUID 43056
455 #define AUE_SETRESUID 43057
456 #define AUE_GETRESGID 43058
457 #define AUE_SETRESGID 43059
458 #define AUE_WAIT4 43060 /* FreeBSD-specific. */
459 #define AUE_LGETFH 43061 /* FreeBSD-specific. */
460 #define AUE_FHSTATFS 43062 /* FreeBSD-specific. */
461 #define AUE_FHOPEN 43063 /* FreeBSD-specific. */
462 #define AUE_FHSTAT 43064 /* FreeBSD-specific. */
463 #define AUE_JAIL 43065 /* FreeBSD-specific. */
464 #define AUE_EACCESS 43066 /* FreeBSD-specific. */
465 #define AUE_KQUEUE 43067 /* FreeBSD-specific. */
466 #define AUE_KEVENT 43068 /* FreeBSD-specific. */
467 #define AUE_FSYNC 43069
468 #define AUE_NMOUNT 43070 /* FreeBSD-specific. */
469 #define AUE_BDFLUSH 43071 /* Linux-specific. */
470 #define AUE_SETFSUID 43072 /* Linux-specific. */
471 #define AUE_SETFSGID 43073 /* Linux-specific. */
472 #define AUE_PERSONALITY 43074 /* Linux-specific. */
473 #define AUE_SCHED_GETSCHEDULER 43075 /* POSIX.1b. */
474 #define AUE_SCHED_SETSCHEDULER 43076 /* POSIX.1b. */
475 #define AUE_PRCTL 43077 /* Linux-specific. */
476 #define AUE_GETCWD 43078 /* FreeBSD/Linux-specific. */
477 #define AUE_CAPGET 43079 /* Linux-specific. */
478 #define AUE_CAPSET 43080 /* Linux-specific. */
479 #define AUE_PIVOT_ROOT 43081 /* Linux-specific. */
480 #define AUE_RTPRIO 43082 /* FreeBSD-specific. */
481 #define AUE_SCHED_GETPARAM 43083 /* POSIX.1b. */
482 #define AUE_SCHED_SETPARAM 43084 /* POSIX.1b. */
483 #define AUE_SCHED_GET_PRIORITY_MAX 43085 /* POSIX.1b. */
484 #define AUE_SCHED_GET_PRIORITY_MIN 43086 /* POSIX.1b. */
485 #define AUE_SCHED_RR_GET_INTERVAL 43087 /* POSIX.1b. */
486 #define AUE_ACL_GET_FILE 43088 /* FreeBSD. */
487 #define AUE_ACL_SET_FILE 43089 /* FreeBSD. */
488 #define AUE_ACL_GET_FD 43090 /* FreeBSD. */
489 #define AUE_ACL_SET_FD 43091 /* FreeBSD. */
490 #define AUE_ACL_DELETE_FILE 43092 /* FreeBSD. */
491 #define AUE_ACL_DELETE_FD 43093 /* FreeBSD. */
492 #define AUE_ACL_CHECK_FILE 43094 /* FreeBSD. */
493 #define AUE_ACL_CHECK_FD 43095 /* FreeBSD. */
494 #define AUE_ACL_GET_LINK 43096 /* FreeBSD. */
495 #define AUE_ACL_SET_LINK 43097 /* FreeBSD. */
496 #define AUE_ACL_DELETE_LINK 43098 /* FreeBSD. */
497 #define AUE_ACL_CHECK_LINK 43099 /* FreeBSD. */
498 #define AUE_SYSARCH 43100 /* FreeBSD. */
499 #define AUE_EXTATTRCTL 43101 /* FreeBSD. */
500 #define AUE_EXTATTR_GET_FILE 43102 /* FreeBSD. */
501 #define AUE_EXTATTR_SET_FILE 43103 /* FreeBSD. */
502 #define AUE_EXTATTR_LIST_FILE 43104 /* FreeBSD. */
503 #define AUE_EXTATTR_DELETE_FILE 43105 /* FreeBSD. */
504 #define AUE_EXTATTR_GET_FD 43106 /* FreeBSD. */
505 #define AUE_EXTATTR_SET_FD 43107 /* FreeBSD. */
506 #define AUE_EXTATTR_LIST_FD 43108 /* FreeBSD. */
507 #define AUE_EXTATTR_DELETE_FD 43109 /* FreeBSD. */
508 #define AUE_EXTATTR_GET_LINK 43110 /* FreeBSD. */
509 #define AUE_EXTATTR_SET_LINK 43111 /* FreeBSD. */
510 #define AUE_EXTATTR_LIST_LINK 43112 /* FreeBSD. */
511 #define AUE_EXTATTR_DELETE_LINK 43113 /* FreeBSD. */
512 #define AUE_KENV 43114 /* FreeBSD. */
513 #define AUE_JAIL_ATTACH 43115 /* FreeBSD. */
514 #define AUE_SYSCTL_WRITE 43116 /* FreeBSD. */
515 #define AUE_IOPERM 43117 /* Linux. */
516 #define AUE_READDIR 43118 /* Linux. */
517 #define AUE_IOPL 43119 /* Linux. */
518 #define AUE_VM86 43120 /* Linux. */
519 #define AUE_MAC_GET_PROC 43121 /* FreeBSD. */
520 #define AUE_MAC_SET_PROC 43122 /* FreeBSD. */
521 #define AUE_MAC_GET_FD 43123 /* FreeBSD. */
522 #define AUE_MAC_GET_FILE 43124 /* FreeBSD. */
523 #define AUE_MAC_SET_FD 43125 /* FreeBSD. */
524 #define AUE_MAC_SET_FILE 43126 /* FreeBSD. */
525 #define AUE_MAC_SYSCALL 43127 /* FreeBSD. */
526 #define AUE_MAC_GET_PID 43128 /* FreeBSD. */
527 #define AUE_MAC_GET_LINK 43129 /* FreeBSD. */
528 #define AUE_MAC_SET_LINK 43130 /* FreeBSD. */
529 #define AUE_MAC_EXECVE 43131 /* FreeBSD. */
530 #define AUE_GETPATH_FROMFD 43132 /* FreeBSD. */
531 #define AUE_GETPATH_FROMADDR 43133 /* FreeBSD. */
532 #define AUE_MQ_OPEN 43134 /* FreeBSD. */
533 #define AUE_MQ_SETATTR 43135 /* FreeBSD. */
534 #define AUE_MQ_TIMEDRECEIVE 43136 /* FreeBSD. */
535 #define AUE_MQ_TIMEDSEND 43137 /* FreeBSD. */
536 #define AUE_MQ_NOTIFY 43138 /* FreeBSD. */
537 #define AUE_MQ_UNLINK 43139 /* FreeBSD. */
538 #define AUE_LISTEN 43140 /* FreeBSD/Darwin/Linux. */
539 #define AUE_MLOCKALL 43141 /* FreeBSD. */
540 #define AUE_MUNLOCKALL 43142 /* FreeBSD. */
541 #define AUE_CLOSEFROM 43143 /* FreeBSD. */
542 #define AUE_FEXECVE 43144 /* FreeBSD. */
543 #define AUE_FACCESSAT 43145 /* FreeBSD. */
544 #define AUE_FCHMODAT 43146 /* FreeBSD. */
545 #define AUE_LINKAT 43147 /* FreeBSD. */
546 #define AUE_MKDIRAT 43148 /* FreeBSD. */
547 #define AUE_MKFIFOAT 43149 /* FreeBSD. */
548 #define AUE_MKNODAT 43150 /* FreeBSD. */
549 #define AUE_READLINKAT 43151 /* FreeBSD. */
550 #define AUE_SYMLINKAT 43152 /* FreeBSD. */
551
552 /*
553 * Darwin BSM uses a number of AUE_O_* definitions, which are aliased to the
554 * normal Solaris BSM identifiers. _O_ refers to it being an old, or compat
555 * interface. In most cases, Darwin has never implemented these system calls
556 * but picked up the fields in their system call table from their FreeBSD
557 * import. Happily, these have different names than the AUE_O* definitions
558 * in Solaris BSM.
559 */
560 #define AUE_O_CREAT AUE_OPEN_RWTC /* Darwin */
561 #define AUE_O_EXECVE AUE_NULL /* Darwin */
562 #define AUE_O_SBREAK AUE_NULL /* Darwin */
563 #define AUE_O_LSEEK AUE_NULL /* Darwin */
564 #define AUE_O_MOUNT AUE_NULL /* Darwin */
565 #define AUE_O_UMOUNT AUE_NULL /* Darwin */
566 #define AUE_O_STAT AUE_STAT /* Darwin */
567 #define AUE_O_LSTAT AUE_LSTAT /* Darwin */
568 #define AUE_O_FSTAT AUE_FSTAT /* Darwin */
569 #define AUE_O_GETPAGESIZE AUE_NULL /* Darwin */
570 #define AUE_O_VREAD AUE_NULL /* Darwin */
571 #define AUE_O_VWRITE AUE_NULL /* Darwin */
572 #define AUE_O_MMAP AUE_MMAP /* Darwin */
573 #define AUE_O_VADVISE AUE_NULL /* Darwin */
574 #define AUE_O_VHANGUP AUE_NULL /* Darwin */
575 #define AUE_O_VLIMIT AUE_NULL /* Darwin */
576 #define AUE_O_WAIT AUE_NULL /* Darwin */
577 #define AUE_O_GETHOSTNAME AUE_NULL /* Darwin */
578 #define AUE_O_SETHOSTNAME AUE_SYSCTL /* Darwin */
579 #define AUE_O_GETDOPT AUE_NULL /* Darwin */
580 #define AUE_O_SETDOPT AUE_NULL /* Darwin */
581 #define AUE_O_ACCEPT AUE_NULL /* Darwin */
582 #define AUE_O_SEND AUE_SENDMSG /* Darwin */
583 #define AUE_O_RECV AUE_RECVMSG /* Darwin */
584 #define AUE_O_VTIMES AUE_NULL /* Darwin */
585 #define AUE_O_SIGVEC AUE_NULL /* Darwin */
586 #define AUE_O_SIGBLOCK AUE_NULL /* Darwin */
587 #define AUE_O_SIGSETMASK AUE_NULL /* Darwin */
588 #define AUE_O_SIGSTACK AUE_NULL /* Darwin */
589 #define AUE_O_RECVMSG AUE_RECVMSG /* Darwin */
590 #define AUE_O_SENDMSG AUE_SENDMSG /* Darwin */
591 #define AUE_O_VTRACE AUE_NULL /* Darwin */
592 #define AUE_O_RESUBA AUE_NULL /* Darwin */
593 #define AUE_O_RECVFROM AUE_RECVFROM /* Darwin */
594 #define AUE_O_SETREUID AUE_SETREUID /* Darwin */
595 #define AUE_O_SETREGID AUE_SETREGID /* Darwin */
596 #define AUE_O_GETDIRENTRIES AUE_GETDIRENTRIES /* Darwin */
597 #define AUE_O_TRUNCATE AUE_TRUNCATE /* Darwin */
598 #define AUE_O_FTRUNCATE AUE_FTRUNCATE /* Darwin */
599 #define AUE_O_GETPEERNAME AUE_NULL /* Darwin */
600 #define AUE_O_GETHOSTID AUE_NULL /* Darwin */
601 #define AUE_O_SETHOSTID AUE_NULL /* Darwin */
602 #define AUE_O_GETRLIMIT AUE_NULL /* Darwin */
603 #define AUE_O_SETRLIMIT AUE_SETRLIMIT /* Darwin */
604 #define AUE_O_KILLPG AUE_KILL /* Darwin */
605 #define AUE_O_SETQUOTA AUE_NULL /* Darwin */
606 #define AUE_O_QUOTA AUE_NULL /* Darwin */
607 #define AUE_O_GETSOCKNAME AUE_NULL /* Darwin */
608 #define AUE_O_GETDIREENTRIES AUE_GETDIREENTRIES /* Darwin */
609 #define AUE_O_ASYNCDAEMON AUE_NULL /* Darwin */
610 #define AUE_O_GETDOMAINNAME AUE_NULL /* Darwin */
611 #define AUE_O_SETDOMAINNAME AUE_SYSCTL /* Darwin */
612 #define AUE_O_PCFS_MOUNT AUE_NULL /* Darwin */
613 #define AUE_O_EXPORTFS AUE_NULL /* Darwin */
614 #define AUE_O_USTATE AUE_NULL /* Darwin */
615 #define AUE_O_WAIT3 AUE_NULL /* Darwin */
616 #define AUE_O_RPAUSE AUE_NULL /* Darwin */
617 #define AUE_O_GETDENTS AUE_NULL /* Darwin */
618
619 /*
620 * Possible desired future values based on review of BSD/Darwin system calls.
621 */
622 #define AUE_DUP AUE_NULL
623 #define AUE_FSCTL AUE_NULL
624 #define AUE_FSTATV AUE_NULL
625 #define AUE_GCCONTROL AUE_NULL
626 #define AUE_GETDTABLESIZE AUE_NULL
627 #define AUE_GETEGID AUE_NULL
628 #define AUE_GETEUID AUE_NULL
629 #define AUE_GETGID AUE_NULL
630 #define AUE_GETGROUPS AUE_NULL
631 #define AUE_GETITIMER AUE_NULL
632 #define AUE_GETLOGIN AUE_NULL
633 #define AUE_GETPEERNAME AUE_NULL
634 #define AUE_GETPGID AUE_NULL
635 #define AUE_GETPGRP AUE_NULL
636 #define AUE_GETPID AUE_NULL
637 #define AUE_GETPPID AUE_NULL
638 #define AUE_GETPRIORITY AUE_NULL
639 #define AUE_GETRLIMIT AUE_NULL
640 #define AUE_GETRUSAGE AUE_NULL
641 #define AUE_GETSID AUE_NULL
642 #define AUE_GETSOCKNAME AUE_NULL
643 #define AUE_GETTIMEOFDAY AUE_NULL
644 #define AUE_GETUID AUE_NULL
645 #define AUE_GETSOCKOPT AUE_NULL
646 #define AUE_GTSOCKOPT AUE_GETSOCKOPT /* XXX: Typo in Darwin. */
647 #define AUE_ISSETUGID AUE_NULL
648 #define AUE_LSTATV AUE_NULL
649 #define AUE_MADVISE AUE_NULL
650 #define AUE_MINCORE AUE_NULL
651 #define AUE_MKCOMPLEX AUE_NULL
652 #define AUE_MODWATCH AUE_NULL
653 #define AUE_MSGCL AUE_NULL
654 #define AUE_MSYNC AUE_NULL
655 #define AUE_PREAD AUE_NULL
656 #define AUE_PWRITE AUE_NULL
657 #define AUE_PREADV AUE_NULL
658 #define AUE_PWRITEV AUE_NULL
659 #define AUE_SBRK AUE_NULL
660 #define AUE_SELECT AUE_NULL
661 #define AUE_SEMDESTROY AUE_NULL
662 #define AUE_SEMGETVALUE AUE_NULL
663 #define AUE_SEMINIT AUE_NULL
664 #define AUE_SEMPOST AUE_NULL
665 #define AUE_SEMTRYWAIT AUE_NULL
666 #define AUE_SEMWAIT AUE_NULL
667 #define AUE_SETITIMER AUE_NULL
668 #define AUE_SIGACTION AUE_NULL
669 #define AUE_SIGALTSTACK AUE_NULL
670 #define AUE_SIGPENDING AUE_NULL
671 #define AUE_SIGPROCMASK AUE_NULL
672 #define AUE_SIGRETURN AUE_NULL
673 #define AUE_SIGSUSPEND AUE_NULL
674 #define AUE_SIGWAIT AUE_NULL
675 #define AUE_SSTK AUE_NULL
676 #define AUE_STATV AUE_NULL
677 #define AUE_SYNC AUE_NULL
678 #define AUE_SYSCALL AUE_NULL
679 #define AUE_TABLE AUE_NULL
680 #define AUE_WAITEVENT AUE_NULL
681 #define AUE_WATCHEVENT AUE_NULL
682
683 #endif /* !_BSM_AUDIT_KEVENTS_H_ */
Cache object: 8389ce9ed7b0879cea5ee9734f129b9a
|