Audit Events and Classes in Trusted Extensions

In Trusted Extensions, the audit classes for X events have been collapsed from six classes to four classes. The xa class and the xl class are removed. Events that were assigned to the xa class are in the ot class. Events that were assigned to the xl class are in the lo class. The bit masks of the remaining X audit classes have been changed from their Trusted Solaris 8 masks.

0x00800000:xc:X - object create/destroy
0x00400000:xp:X - privileged/administrative operations
0x01000000:xs:X - operations that always silently fail, if bad
0x01c00000:xx:X - all X events (meta-class