1 '\" te
   2 .\" Copyright (c) 2008, Sun Microsystems, Inc.
   3 .\" Copyright 2018 Nexenta Systems, Inc. All rights reserved.
   4 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
   5 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
   6 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
   7 .TH AUDIT_CLASS 4 "Jul 10, 2018"
   8 .SH NAME
   9 audit_class \- audit class definitions
  10 .SH SYNOPSIS
  11 .LP
  12 .nf
  13 \fB/etc/security/audit_class\fR
  14 .fi
  15 
  16 .SH DESCRIPTION
  17 .LP
  18 \fB/etc/security/audit_class\fR is a user-configurable ASCII system file that
  19 stores class definitions used in the audit system. Audit events in
  20 \fBaudit_event\fR(4) are mapped to one or more of the defined audit classes.
  21 \fBaudit_event\fR can be updated in conjunction with changes to
  22 \fBaudit_class\fR.
  23 Programs can use the \fBgetauclassent\fR(3BSM) routines to access audit
  24 class information.
  25 .sp
  26 .LP
  27 The fields for each class entry are separated by colons. Each class entry is a
  28 bitmap and is separated from each other by a newline.
  29 .sp
  30 .LP
  31 Each entry in the \fBaudit_class\fR file has the form:
  32 .sp
  33 .in +2
  34 .nf
  35 \fImask\fR:\fIname\fR:\fIdescription\fR
  36 .fi
  37 .in -2
  38 
  39 .sp
  40 .LP
  41 The fields are defined as follows:
  42 .sp
  43 .ne 2
  44 .na
  45 \fB\fImask\fR\fR
  46 .ad
  47 .RS 15n
  48 class mask
  49 .RE
  50 
  51 .sp
  52 .ne 2
  53 .na
  54 \fB\fIname\fR\fR
  55 .ad
  56 .RS 15n
  57 class name
  58 .RE
  59 
  60 .sp
  61 .ne 2
  62 .na
  63 \fB\fIdescription\fR\fR
  64 .ad
  65 .RS 15n
  66 class description
  67 .RE
  68 
  69 .sp
  70 .LP
  71 Each class is represented as a bit in the class mask which is an unsigned
  72 integer. Thus, there are 32 different classes available. Meta-classes can also
  73 be defined. These are supersets composed of multiple base classes, and thus
  74 will have more than 1 bit in its mask. See Examples. Two special meta-classes
  75 are also pre-defined: \fBall\fR, and \fBno\fR.
  76 .sp
  77 .ne 2
  78 .na
  79 \fB\fBall\fR\fR
  80 .ad
  81 .RS 7n
  82 Represents a conjunction of all allowed classes, and is provided as a shorthand
  83 method of specifying all classes.
  84 .RE
  85 
  86 .sp
  87 .ne 2
  88 .na
  89 \fB\fBno\fR\fR
  90 .ad
  91 .RS 7n
  92 Is the invalid class, and any event mapped solely to this class will not be
  93 audited. Turning auditing on to the \fBall\fR meta class will not cause events
  94 mapped solely to the \fBno\fR class to be written to the audit trail. This
  95 class is also used to map obsolete events which are no longer generated.
  96 Obsolete events are retained to process old audit trails files.
  97 .RE
  98 
  99 .SH EXAMPLES
 100 .LP
 101 \fBExample 1 \fRUsing an \fBaudit_class\fR File
 102 .sp
 103 .LP
 104 The following is an example of an \fBaudit_class\fR file:
 105 
 106 .sp
 107 .in +2
 108 .nf
 109 0x00000000:no:invalid class
 110 0x00000001:fr:file read
 111 0x00000002:fw:file write
 112 0x00000004:fa:file attribute access
 113 0x00000008:fm:file attribute modify
 114 0x00000010:fc:file create
 115 0x00000020:fd:file delete
 116 0x00000040:cl:file close
 117 0x00000100:nt:network
 118 0x00000200:ip:ipc
 119 0x00000400:na:non-attribute
 120 0x00001000:lo:login or logout
 121 0x00004000:ap:application
 122 0x000f0000:ad:old administrative (meta-class)
 123 0x00070000:am:administrative (meta-class)
 124 0x00010000:ss:change system state
 125 0x00020000:as:system-wide administration
 126 0x00040000:ua:user administration
 127 0x00080000:aa:audit utilization
 128 0x00300000:pc:process (meta-class)
 129 0x00100000:ps:process start/stop
 130 0x00200000:pm:process modify
 131 0x02000000:sa:SACL-based File Access Auditing
 132 0x20000000:io:ioctl
 133 0x40000000:ex:exec
 134 0x80000000:ot:other
 135 0xffffffff:all:all classes (meta-class)
 136 .fi
 137 .in -2
 138 .sp
 139 
 140 .SH FILES
 141 .ne 2
 142 .na
 143 \fB\fB/etc/security/audit_class\fR\fR
 144 .ad
 145 .RS 29n
 146 
 147 .RE
 148 
 149 .SH ATTRIBUTES
 150 .LP
 151 See \fBattributes\fR(5) for descriptions of the following attributes:
 152 .sp
 153 
 154 .sp
 155 .TS
 156 box;
 157 c | c
 158 l | l .
 159 ATTRIBUTE TYPE  ATTRIBUTE VALUE
 160 _
 161 Interface Stability      See below.
 162 .TE
 163 
 164 .sp
 165 .LP
 166 The file format stability is Committed. The file content is Uncommitted.
 167 .SH SEE ALSO
 168 .LP
 169 \fBau_preselect\fR(3BSM), \fBgetauclassent\fR(3BSM),
 170 \fBaudit_event\fR(4), \fBattributes\fR(5)
 171 .SH NOTES
 172 .LP
 173 It is possible to deliberately turn on the \fBno\fR class in the kernel, in
 174 which case the audit trail will be flooded with records for the audit event
 175 \fBAUE_NULL\fR.