4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright 2010 Sun Microsystems, Inc. All rights reserved.
23 * Use is subject to license terms.
24 */
25
26 /*
27 * Solaris Audit Token Table.
28 */
29
30 #include <locale.h>
31
32 #include <stdio.h>
33 #include <stdlib.h>
34 #include <string.h>
35 #include <bsm/audit.h>
36 #include <bsm/audit_record.h>
37 #include <bsm/libbsm.h>
38
39 #include "praudit.h"
40 #include "toktable.h"
41
42 token_desc_t tokentable[MAXTAG + 1];
43
180 header64_token, T_EXTENDED);
181 table_init(AUT_SUBJECT64, "subject", subject64_token, T_ENCLOSED);
182 table_init(AUT_PROCESS64, "process", process64_token, T_ENCLOSED);
183 table_init(AUT_OTHER_FILE64, "file", file64_token, T_EXTENDED);
184
185 /*
186 * Extended network address token types
187 */
188
189 table_initx(AUT_HEADER64_EX, "header", "record",
190 header64_ex_token, T_EXTENDED);
191 table_init(AUT_SUBJECT32_EX, "subject", subject32_ex_token, T_ENCLOSED);
192 table_init(AUT_PROCESS32_EX, "process", process32_ex_token, T_ENCLOSED);
193 table_init(AUT_SUBJECT64_EX, "subject", subject64_ex_token, T_ENCLOSED);
194 table_init(AUT_PROCESS64_EX, "process", process64_ex_token, T_ENCLOSED);
195 table_initx(AUT_IN_ADDR_EX, "ip address", "ip_address",
196 ip_addr_ex_token, T_ELEMENT);
197 table_init(AUT_SOCKET_EX, "socket", socket_ex_token, T_ENCLOSED);
198 table_init(AUT_TID, "tid", tid_token, T_EXTENDED);
199
200 #ifdef _PRAUDIT
201 /*
202 * Done with tokens above here. Now do remaining tags.
203 */
204 table_init(TAG_AUID, "audit-uid", pa_pw_uid, T_ATTRIBUTE);
205 table_init(TAG_UID, "uid", pa_pw_uid, T_ATTRIBUTE);
206 table_init(TAG_GID, "gid", pa_gr_uid, T_ATTRIBUTE);
207 table_init(TAG_RUID, "ruid", pa_pw_uid, T_ATTRIBUTE);
208 table_init(TAG_RGID, "rgid", pa_gr_uid, T_ATTRIBUTE);
209
210 table_init(TAG_PID, "pid", pa_adr_u_int32, T_ATTRIBUTE);
211 table_init(TAG_SID, "sid", pa_adr_u_int32, T_ATTRIBUTE);
212
213 table_init(TAG_TID32, "tid", pa_tid32, T_ATTRIBUTE);
214 table_init(TAG_TID64, "tid", pa_tid64, T_ATTRIBUTE);
215 table_init(TAG_TID32_EX, "tid", pa_tid32_ex, T_ATTRIBUTE);
216 table_init(TAG_TID64_EX, "tid", pa_tid64_ex, T_ATTRIBUTE);
217 table_init(TAG_TID_TYPE, "type", NOFUNC, T_ATTRIBUTE);
218 table_init(TAG_IP, "ipadr", NOFUNC, T_ENCLOSED);
219 table_init(TAG_IP_LOCAL, "local-port", pa_adr_u_short, T_ATTRIBUTE);
289 table_init(TAG_SOCKTYPE, "type", pa_adr_shorthex, T_ATTRIBUTE);
290 table_init(TAG_SOCKPORT, "port", pa_adr_shorthex, T_ATTRIBUTE);
291 table_init(TAG_SOCKADDR, "addr", NOFUNC, T_ATTRIBUTE);
292
293 table_init(TAG_SOCKEXDOM, "sock_domain", pa_adr_shorthex, T_ATTRIBUTE);
294 table_init(TAG_SOCKEXTYPE, "sock_type", pa_adr_shorthex, T_ATTRIBUTE);
295 table_init(TAG_SOCKEXLPORT, "lport", NOFUNC, T_ATTRIBUTE);
296 table_init(TAG_SOCKEXLADDR, "laddr", NOFUNC, T_ATTRIBUTE);
297 table_init(TAG_SOCKEXFPORT, "fport", NOFUNC, T_ATTRIBUTE);
298 table_init(TAG_SOCKEXFADDR, "faddr", NOFUNC, T_ATTRIBUTE);
299
300 table_init(TAG_IPCTYPE, "ipc-type", NOFUNC, T_ATTRIBUTE);
301 table_init(TAG_IPCID, "ipc-id", pa_adr_int32, T_ATTRIBUTE);
302
303 table_init(TAG_ARBPRINT, "print", NOFUNC, T_ATTRIBUTE);
304 table_init(TAG_ARBTYPE, "type", NOFUNC, T_ATTRIBUTE);
305 table_init(TAG_ARBCOUNT, "count", NOFUNC, T_ATTRIBUTE);
306
307 table_init(TAG_HOSTID, "host", NOFUNC, T_ATTRIBUTE);
308 table_init(TAG_USERNAME, "username", pa_adr_string, T_ATTRIBUTE);
309 #endif /* _PRAUDIT */
310 }
|
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright 2010 Sun Microsystems, Inc. All rights reserved.
23 * Use is subject to license terms.
24 *
25 * Copyright 2018 Nexenta Systems, Inc. All rights reserved.
26 */
27
28 /*
29 * Solaris Audit Token Table.
30 */
31
32 #include <locale.h>
33
34 #include <stdio.h>
35 #include <stdlib.h>
36 #include <string.h>
37 #include <bsm/audit.h>
38 #include <bsm/audit_record.h>
39 #include <bsm/libbsm.h>
40
41 #include "praudit.h"
42 #include "toktable.h"
43
44 token_desc_t tokentable[MAXTAG + 1];
45
182 header64_token, T_EXTENDED);
183 table_init(AUT_SUBJECT64, "subject", subject64_token, T_ENCLOSED);
184 table_init(AUT_PROCESS64, "process", process64_token, T_ENCLOSED);
185 table_init(AUT_OTHER_FILE64, "file", file64_token, T_EXTENDED);
186
187 /*
188 * Extended network address token types
189 */
190
191 table_initx(AUT_HEADER64_EX, "header", "record",
192 header64_ex_token, T_EXTENDED);
193 table_init(AUT_SUBJECT32_EX, "subject", subject32_ex_token, T_ENCLOSED);
194 table_init(AUT_PROCESS32_EX, "process", process32_ex_token, T_ENCLOSED);
195 table_init(AUT_SUBJECT64_EX, "subject", subject64_ex_token, T_ENCLOSED);
196 table_init(AUT_PROCESS64_EX, "process", process64_ex_token, T_ENCLOSED);
197 table_initx(AUT_IN_ADDR_EX, "ip address", "ip_address",
198 ip_addr_ex_token, T_ELEMENT);
199 table_init(AUT_SOCKET_EX, "socket", socket_ex_token, T_ENCLOSED);
200 table_init(AUT_TID, "tid", tid_token, T_EXTENDED);
201
202 table_init(AUT_ACCESS_MASK, "access mask", access_mask_token,
203 T_ELEMENT);
204 table_init(AUT_WSID, "Windows SID", wsid_token, T_ELEMENT);
205
206 #ifdef _PRAUDIT
207 /*
208 * Done with tokens above here. Now do remaining tags.
209 */
210 table_init(TAG_AUID, "audit-uid", pa_pw_uid, T_ATTRIBUTE);
211 table_init(TAG_UID, "uid", pa_pw_uid, T_ATTRIBUTE);
212 table_init(TAG_GID, "gid", pa_gr_uid, T_ATTRIBUTE);
213 table_init(TAG_RUID, "ruid", pa_pw_uid, T_ATTRIBUTE);
214 table_init(TAG_RGID, "rgid", pa_gr_uid, T_ATTRIBUTE);
215
216 table_init(TAG_PID, "pid", pa_adr_u_int32, T_ATTRIBUTE);
217 table_init(TAG_SID, "sid", pa_adr_u_int32, T_ATTRIBUTE);
218
219 table_init(TAG_TID32, "tid", pa_tid32, T_ATTRIBUTE);
220 table_init(TAG_TID64, "tid", pa_tid64, T_ATTRIBUTE);
221 table_init(TAG_TID32_EX, "tid", pa_tid32_ex, T_ATTRIBUTE);
222 table_init(TAG_TID64_EX, "tid", pa_tid64_ex, T_ATTRIBUTE);
223 table_init(TAG_TID_TYPE, "type", NOFUNC, T_ATTRIBUTE);
224 table_init(TAG_IP, "ipadr", NOFUNC, T_ENCLOSED);
225 table_init(TAG_IP_LOCAL, "local-port", pa_adr_u_short, T_ATTRIBUTE);
295 table_init(TAG_SOCKTYPE, "type", pa_adr_shorthex, T_ATTRIBUTE);
296 table_init(TAG_SOCKPORT, "port", pa_adr_shorthex, T_ATTRIBUTE);
297 table_init(TAG_SOCKADDR, "addr", NOFUNC, T_ATTRIBUTE);
298
299 table_init(TAG_SOCKEXDOM, "sock_domain", pa_adr_shorthex, T_ATTRIBUTE);
300 table_init(TAG_SOCKEXTYPE, "sock_type", pa_adr_shorthex, T_ATTRIBUTE);
301 table_init(TAG_SOCKEXLPORT, "lport", NOFUNC, T_ATTRIBUTE);
302 table_init(TAG_SOCKEXLADDR, "laddr", NOFUNC, T_ATTRIBUTE);
303 table_init(TAG_SOCKEXFPORT, "fport", NOFUNC, T_ATTRIBUTE);
304 table_init(TAG_SOCKEXFADDR, "faddr", NOFUNC, T_ATTRIBUTE);
305
306 table_init(TAG_IPCTYPE, "ipc-type", NOFUNC, T_ATTRIBUTE);
307 table_init(TAG_IPCID, "ipc-id", pa_adr_int32, T_ATTRIBUTE);
308
309 table_init(TAG_ARBPRINT, "print", NOFUNC, T_ATTRIBUTE);
310 table_init(TAG_ARBTYPE, "type", NOFUNC, T_ATTRIBUTE);
311 table_init(TAG_ARBCOUNT, "count", NOFUNC, T_ATTRIBUTE);
312
313 table_init(TAG_HOSTID, "host", NOFUNC, T_ATTRIBUTE);
314 table_init(TAG_USERNAME, "username", pa_adr_string, T_ATTRIBUTE);
315 table_init(TAG_WSID, "wsid", NOFUNC, T_ATTRIBUTE);
316
317 #endif /* _PRAUDIT */
318 }
|