JavaScript is required to for searching.
Skip Navigation Links
Exit Print View
Oracle Solaris 11.1 Administration: Security Services     Oracle Solaris 11.1 Information Library
search filter icon
search icon

Document Information

Preface

Part I Security Overview

1.  Security Services (Overview)

Part II System, File, and Device Security

2.  Managing Machine Security (Overview)

3.  Controlling Access to Systems (Tasks)

4.  Virus Scanning Service (Tasks)

5.  Controlling Access to Devices (Tasks)

6.  Verifying File Integrity by Using BART (Tasks)

7.  Controlling Access to Files (Tasks)

Part III Roles, Rights Profiles, and Privileges

8.  Using Roles and Privileges (Overview)

9.  Using Role-Based Access Control (Tasks)

10.  Security Attributes in Oracle Solaris (Reference)

Part IV Cryptographic Services

11.  Cryptographic Framework (Overview)

12.  Cryptographic Framework (Tasks)

13.  Key Management Framework

Part V Authentication Services and Secure Communication

14.  Using Pluggable Authentication Modules

15.  Using Secure Shell

16.  Secure Shell (Reference)

17.  Using Simple Authentication and Security Layer

18.  Network Services Authentication (Tasks)

Part VI Kerberos Service

19.  Introduction to the Kerberos Service

20.  Planning for the Kerberos Service

21.  Configuring the Kerberos Service (Tasks)

22.  Kerberos Error Messages and Troubleshooting

23.  Administering Kerberos Principals and Policies (Tasks)

24.  Using Kerberos Applications (Tasks)

25.  The Kerberos Service (Reference)

Part VII Auditing in Oracle Solaris

26.  Auditing (Overview)

27.  Planning for Auditing

28.  Managing Auditing (Tasks)

29.  Auditing (Reference)

Audit Service

Audit Service Man Pages

Rights Profiles for Administering Auditing

Auditing and Oracle Solaris Zones

Audit Configuration Files and Packaging

Audit Classes

Audit Class Syntax

Audit Plugins

Audit Remote Server

Audit Policy

Audit Policies for Asynchronous and Synchronous Events

Process Audit Characteristics

Audit Trail

Conventions for Binary Audit File Names

Audit Record Structure

Audit Record Analysis

Audit Token Formats

acl Token

argument Token

attribute Token

cmd Token

exec_args Token

exec_env Token

file Token

fmri Token

group Token

header Token

ip address Token

ip port Token

ipc Token

IPC_perm Token

path Token

path_attr Token

privilege Token

process Token

return Token

sequence Token

socket Token

subject Token

text Token

trailer Token

use of authorization Token

use of privilege Token

user Token

xclient Token

zonename Token

Glossary

Index

Audit Token Formats

Each audit token has a token type identifier, which is followed by data that is specific to the token. The following table shows the token names with a brief description of each token. Obsolete tokens are maintained for compatibility with previous Solaris releases.

Table 29-1 Audit Tokens for Auditing

Token Name
Description
For More Information
acl
Access Control Entry (ACE) and Access Control List (ACL) information
arbitrary
Data with format and type information
See the audit.log(4) man page.
argument
System call argument value
attribute
File vnode information
cmd
Command arguments and environment variables
exec_args
Exec system call arguments
exec_env
Exec system call environment variables
exit
Program exit information
See the audit.log(4) man page.
file
Audit file information
fmri
Framework Management Resource Indicator
group
Process groups information
header
Indicates start of audit record
ip
IP header information
See the audit.log(4) man page.
ip address
Internet address
ip port
Internet port address
ipc
System V IPC information
IPC_perm
System V IPC object access information
opaque
Unstructured data (unspecified format)
See the audit.log(4) man page.
path
Path information
path_attr
Access path information
privilege
Privilege set information
process
Process information
return
Status of system call
sequence
Sequence number
socket
Socket type and addresses
subject
Subject information (same format as process)
text
ASCII string
trailer
Indicates end of audit record
use of authorization
Use of authorization
use of privilege
Use of privilege
user
User ID and user name
xclient
X client identification
zonename
Name of zone
Trusted Extensions tokens
label and X Window System information

The following tokens are obsolete:

For information about obsolete tokens, see the reference material for the release that included the token.

An audit record always begins with a header token. The header token indicates where the audit record begins in the audit trail. In the case of attributable events, the subject and the process tokens refer to the values of the process that caused the event. In the case of non-attributable events, the process token refers to the system.

acl Token

The acl token has two forms to record information about Access Control Entries (ACEs) for a ZFS file system and Access Control Lists (ACLs) for a UFS file system.

When the acl token is recorded for a UFS file system, the praudit -x command shows the fields as follows:

<acl type="1" value="root" mode="6"/>

When the acl token is recorded for a ZFS dataset, the praudit -x command shows the fields as follows:

<acl who="root" access_mask="default" flags="-i,-R" type="2"/>

argument Token

The argument token contains information about the arguments to a system call: the argument number of the system call, the argument value, and an optional description. This token allows a 32-bit integer system-call argument in an audit record.

The praudit -x command shows the fields of the argument token as follows:

<argument arg-num="2" value="0x5401" desc="cmd"/>

attribute Token

The attribute token contains information from the file vnode.

The attribute token usually accompanies a path token. The attribute token is produced during path searches. If a path-search error occurs, there is no vnode available to obtain the necessary file information. Therefore, the attribute token is not included as part of the audit record. The praudit -x command shows the fields of the attribute token as follows:

<attribute mode="20620" uid="root" gid="tty" fsid="0" nodeid="9267" device="108233"/>

cmd Token

The cmd token records the list of arguments and the list of environment variables that are associated with a command.

The praudit -x command shows the fields of the cmd token. The following is a truncated cmd token. The line is wrapped for display purposes.

<cmd><arge>WINDOWID=6823679</arge>
<arge>COLORTERM=gnome-terminal</arge>
<arge>...LANG=C</arge>...<arge>HOST=machine1</arge>
<arge>LPDEST=printer1</arge>...</cmd>

exec_args Token

The exec_args token records the arguments to an exec() system call.

The praudit -x command shows the fields of the exec_args token as follows:

<exec_args><arg>/usr/bin/sh</arg><arg>/usr/bin/hostname</arg></exec_args>

Note - The exec_args token is output only when the argv audit policy option is active.


exec_env Token

The exec_env token records the current environment variables to an exec() system call.

The praudit -x command shows the fields of the exec_env token. The line is wrapped for display purposes.

<exec_env><env>_=/usr/bin/hostname</env>
<env>LANG=C</env><env>PATH=/usr/bin:/usr/ucb</env>
<env><env>LOGNAME=jdoe</env><env>USER=jdoe</env>
<env>DISPLAY=:0</env><env>SHELL=/bin/csh</env>
<env>HOME=/home/jdoe</env><env>PWD=/home/jdoe</env><env>TZ=US/Pacific</env>
</exec_env>

Note - The exec_env token is output only when the arge audit policy option is active.


file Token

The file token is a special token that marks the beginning of a new audit file and the end of an old audit file as the old file is deactivated. The initial file token identifies the previous file in the audit trail. The final file token identifies the next file in the audit trail. These tokens “link” together successive audit files into one audit trail.

The praudit -x command shows the fields of the file token. The line is wrapped for display purposes.

<file iso8601="2009-04-08 14:18:26.200 -07:00">
/var/audit/machine1/files/20090408211826.not_terminated.machine1</file>

fmri Token

The fmri token records the use of a fault management resource indicator (FMRI). For more information, see the smf(5) man page.

The praudit -x command shows the content of the fmri token:

<fmri service_instance="svc:/system/cryptosvc"</fmri>

group Token

The group token records the group entries from the process's credential.

The praudit -x command shows the fields of the groups token as follows:

<group><gid>staff</gid><gid>other</gid></group>

Note - The group token is output only when the group audit policy option is active.


header Token

The header token is special in that it marks the beginning of an audit record. The header token combines with the trailer token to bracket all the other tokens in the record.

Infrequently, a header token can include one or more event modifiers:

The praudit command displays the header token as follows:

header,756,2,execve(2),,machine1,2010-10-10 12:11:10.209 -07:00

The praudit -x command displays the fields of the header token at the beginning of the audit record. The line is wrapped for display purposes.

<record version="2" event="execve(2)" host="machine1" 
iso8601="2010-10-10 12:11:10.209 -07:00">

ip address Token

The ip address token contains an Internet Protocol address (IP address). The IP address can be displayed in IPv4 or IPv6 format. The IPv4 address uses 4 bytes. The IPv6 address uses 1 byte to describe the address type, and 16 bytes to describe the address.

The praudit -x command shows the content of the ip address token as follows:

<ip_address>machine1</ip_address>

ip port Token

The ip port token contains the TCP or UDP port address.

The praudit command displays the ip port token as follows:

ip port,0xf6d6

ipc Token

The ipc token contains the System V IPC message handle, semaphore handle, or shared-memory handle that is used by the caller to identify a particular IPC object.


Note - The IPC object identifiers violate the context-free nature of the audit tokens. No global “name” uniquely identifies IPC objects. Instead, IPC objects are identified by their handles. The handles are valid only during the time that the IPC objects are active. However, the identification of IPC objects should not be a problem. The System V IPC mechanisms are seldom used, and the mechanisms all share the same audit class.


The following table shows the possible values for the IPC object type field. The values are defined in the /usr/include/bsm/audit.h file.

Table 29-2 Values for the IPC Object Type Field

Name
Value
Description
AU_IPC_MSG
1
IPC message object
AU_IPC_SEM
2
IPC semaphore object
AU_IPC_SHM
3
IPC shared-memory object

The praudit -x command shows the fields of the ipc token as follows:

<IPC ipc-type="shm" ipc-id="15"/>

IPC_perm Token

The IPC_perm token contains a copy of the System V IPC access permissions. This token is added to audit records that are generated by IPC shared-memory events, IPC semaphore events, and IPC message events.

The praudit -x command shows the fields of the IPC_perm token. The line is wrapped for display purposes.

<IPC_perm uid="jdoe" gid="staff" creator-uid="jdoe" 
creator-gid="staff" mode="100600" seq="0" key="0x0"/>

The values are taken from the IPC_perm structure that is associated with the IPC object.

path Token

The path token contains access path information for an object.

The praudit -x command shows the content of the path token:

<path>/export/home/srv/.xsession-errors</path>

path_attr Token

The path_attr token contains access path information for an object. The access path specifies the sequence of attribute file objects below the path token object. Systems calls such as openat() access attribute files. For more information about attribute file objects, see the fsattr(5) man page.

The praudit command displays the path_attr token as follows:

path_attr,1,attr_file_name

privilege Token

The privilege token records the use of privileges on a process. The privilege token is not recorded for privileges in the basic set. If a privilege has been removed from the basic set by administrative action, then the use of that privilege is recorded. For more information about privileges, see Privileges (Overview)

The praudit -x command shows the fields of the privilege token.

<privilege set-type="Inheritable">ALL</privilege>

process Token

The process token contains information about a user who is associated with a process, such as the recipient of a signal.

The praudit -x command shows the fields of the process token. The line is wrapped for display purposes.

<process audit-uid="-2" uid="root" gid="root" ruid="root" 
rgid="root" pid="567" sid="0" tid="0 0 0.0.0.0"/>

return Token

The return token contains the return status of the system call (u_error) and the process return value (u_rval1).

The return token is always returned as part of kernel-generated audit records for system calls. In application auditing, this token indicates exit status and other return values.

The praudit command displays the return token for a system call as follows:

return,failure: Operation now in progress,-1

The praudit -x command shows the fields of the return token as follows:

<return errval="failure: Operation now in progress" retval="-1/">

sequence Token

The sequence token contains a sequence number. The sequence number is incremented every time an audit record is added to the audit trail. This token is useful for debugging.

The praudit -x command shows the content of the sequence token:

<sequence seq-num="1292"/>

Note - The sequence token is output only when the seq audit policy option is active.


socket Token

The socket token contains information that describes an Internet socket. In some instances, the token includes only the remote port and remote IP address.

The praudit command displays this instance of the socket token as follows:

socket,0x0002,0x83b1,localhost

The expanded token adds information, including socket type and local port information.

The praudit -x command displays this instance of the socket token as follows. The line is wrapped for display purposes.

<socket sock_domain="0x0002" sock_type="0x0002" lport="0x83cf" 
laddr="example1" fport="0x2383" faddr="server1.Subdomain.Domain.COM"/>

subject Token

The subject token describes a user who performs or attempts to perform an operation. The format is the same as the process token.

The subject token is always returned as part of kernel-generated audit records for system calls. The praudit command displays the subject token as follows:

subject,jdoe,root,root,root,root,1631,1421584480,8243 65558 machine1

The praudit -x command shows the fields of the subject token. The line is wrapped for display purposes.

<subject audit-uid="jdoe" uid="root" gid="root" ruid="root" 
rgid="root" pid="1631" sid="1421584480" tid="8243 65558 machine1"/>

text Token

The text token contains a text string.

The praudit -x command shows the content of the text token:

<text>booting kernel</text>

trailer Token

The two tokens, header and trailer, are special in that they distinguish the end points of an audit record and bracket all the other tokens. A header token begins an audit record. A trailer token ends an audit record. The trailer token is an optional token. The trailer token is added as the last token of each record only when the trail audit policy option has been set.

When an audit record is generated with trailers turned on, the auditreduce command can verify that the trailer correctly points back to the record header. The trailer token supports backward seeks of the audit trail.

The praudit command displays the trailer token as follows:

trailer,136

use of authorization Token

The use of authorization token records the use of authorization.

The praudit command displays the use of authorization token as follows:

use of authorization,solaris.role.delegate

use of privilege Token

The use of privilege token records the use of privilege.

The praudit -x command shows the fields of the use of privilege token as follows:

<use_of_privilege result="successful use of priv">proc_setid</use_of_privilege>

user Token

The user token records the user name and user ID. This token is present if the user name is different from the caller.

The praudit -x command shows the fields of the user token as follows:

<user uid="123456" username="tester1"/>

xclient Token

The xclient token contains the number of the client connection to the X server.

The praudit -x command shows the content of the xlient token as follows:

<X_client>15</X_client>

zonename Token

The zonename token records the zone in which the audit event occurred. The string “global” indicates audit events that occur in the global zone.

The praudit -x command shows the content of the zonename token:

<zone name="graphzone"/>