This feature is new in the Software Express pilot program. This feature is included in the Solaris 10 3/05 release.
The path_attr audit token contains access path information for an object. The access path specifies the sequence of attribute file objects below the path token object. Systems calls such as openat() access attribute files. For more information on extended file attributes, see the fsattr(5) man page.
The path_attr token has three fields:
A token ID field that identifies this token as a path_attr token
A count that represents the number of sections of attribute file paths
One or more null-terminated strings
The praudit command displays the path_attr token as follows:
For further information, see Chapter 30, “Solaris Auditing (Reference)” and “path_attr Token” in the System Administration Guide: Security Services.