NEX-13644 File access audit logging
Reviewed by: Gordon Ross <gordon.ross@nexenta.com>
Reviewed by: Roman Strashkin <roman.strashkin@nexenta.com>
Reviewed by: Saso Kiselkov <saso.kiselkov@nexenta.com>
Reviewed by: Rick McNeal <rick.mcneal@nexenta.com>
Reviewed by: Yuri Pankov <yuri.pankov@nexenta.com>

@@ -1,10 +1,11 @@
 # audit_record_attr.txt
 # Two "#" are comments that are copied to audit_record_attr
 # other comments are removed.
 ##
 ## Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
+## Copyright 2018 Nexenta Systems, Inc.  All rights reserved.
 ##
 ## CDDL HEADER START
 ##
 ## The contents of this file are subject to the terms of the
 ## Common Development and Distribution License (the "License").

@@ -1482,10 +1483,18 @@
 # apparently replaced
 
 label=AUE_RMDIR
   format=path:[attr]
 
+label=AUE_SACL
+  title=File Access Audit
+  syscall=none
+  see=none
+  format=head:path:arg1:[text]2:subj
+    comment="access_mask":
+    comment="Windows SID"
+
 label=AUE_SEMCTL
   format=arg1:[ipc]:[ipc_perm]
     comment=1, semaphore ID, "sem ID"
   note=ipc_perm
 # ipc, ipc_perm token: semctl -> ipc_lookup -> audit_ipc