Trusted Extensions Audit Tokens

The audit tokens that Trusted Extensions software adds to the Solaris OS are listed alphabetically in the following table. The tokens are also listed in the audit.log(4) man page.

label Token

The label token contains a sensitivity label. This token contains the following fields:

• A token ID

• A sensitivity label

The following figure shows the token format.

Figure 18–2 label Token Format

A label token is displayed by the praudit command as follows:

sensitivity label,ADMIN_LOW

xatom Token

The xatom token contains information concerning an X atom. This token contains the following fields:

• A token ID

• The string length

• A text string that identifies the atom

An xatom token is displayed by praudit as follows:

X atom,_DT_SAVE_MODE

xclient Token

The xclient token contains information concerning the X client. This token contains the following fields:

• A token ID

• The client ID

An xclient token is displayed by praudit as follows:

X client,15

xcolormap Token

The xcolormap token contains information about the colormaps. This token contains the following fields:

• A token ID

• The X server identifier

• The creator's user ID

The following figure shows the token format.

Figure 18–3 Format for xcolormap, xcursor, xfont, xgc, xpixmap, and xwindow Tokens

An xcolormap token is displayed by praudit as follows:

X color map,0x08c00005,srv

xcursor Token

The xcursor token contains information about the cursors. This token contains the following fields:

• A token ID

• The X server identifier

• The creator's user ID

Figure 18–3 shows the token format.

An xcursor token is displayed by praudit as follows:

X cursor,0x0f400006,srv

xfont Token

The xfont token contains information about the fonts. This token contains the following fields:

• A token ID

• The X server identifier

• The creator's user ID

Figure 18–3 shows the token format.

An xfont token is displayed by praudit as follows:

X font,0x08c00001,srv

xgc Token

The xgc token contains information about the xgc. This token contains the following fields:

• A token ID

• The X server identifier

• The creator's user ID

Figure 18–3 shows the token format.

An xgc token is displayed by praudit as follows:

Xgraphic context,0x002f2ca0,srv

xpixmap Token

The xpixmap token contains information about the pixel mappings. This token contains the following fields:

• A token ID

• The X server identifier

• The creator's user ID

Figure 18–3 shows the token format.

An xpixmap token is displayed by praudit as follows:

X pixmap,0x08c00005,srv

xproperty Token

The xproperty token contains information about various properties of a window. This token contains the following fields:

• A token ID

• The X server identifier

• The creator's user ID

• A string length

• A text string that identifies the atom

The following figure shows an xproperty token format.

Figure 18–4 xproperty Token Format

An xproperty token is displayed by praudit as follows:

X property,0x000075d5,root,_MOTIF_DEFAULT_BINDINGS

xselect Token

The xselect token contains the data that is moved between windows. This data is a byte stream with no assumed internal structure and a property string. This token contains the following fields:

• A token ID

• The length of the property string

• The property string

• The length of the property type

• The property type string

• A length field that gives the number of bytes of data

• A byte string that contains the data

The following figure shows the token format.

Figure 18–5 xselect Token Format

An xselect token is displayed by praudit as follows:

X selection,entryfield,halogen

xwindow Token

The xwindow token contains information about a window. This token contains the following fields:

• A token ID

• The X server identifier

• The creator's user ID

Figure 18–3 shows the token format.

An xwindow token is displayed by praudit as follows:

X window,0x07400001,srv