In Trusted Extensions, the audit classes for X events have been collapsed from six classes to four classes. The xa class and the xl class are removed. Events that were assigned to the xa class are in the ot class. Events that were assigned to the xl class are in the lo class. The bit masks of the remaining X audit classes have been changed from their Trusted Solaris 8 masks.
0x00800000:xc:X - object create/destroy 0x00400000:xp:X - privileged/administrative operations 0x01000000:xs:X - operations that always silently fail, if bad 0x01c00000:xx:X - all X events (meta-class