test

Trusted Solaris Audit Administration

Audit Token Structure

Logically, each token has a token type identifier followed by data specific to the token. Each token type has its own format and structure. The audit tokens are shown in the table below. Those marked TS in the TS7 column are in Trusted Solaris 2.5.1 and Trusted Solaris 7 only. Those not marked TS are modified versions of audit tokens from the Solaris Basic Security Module. The token scheme can be extended.

Table B-1 Trusted Solaris Audit Tokens

Token Name 

Description 

TS7 

acl

Access Control List information 

TS 

arbitrary

Data with format and type information 

 

arg

System call argument value 

 

attr

File attributes 

 

clearance

Clearance information 

TS 

exec_args

Exec system call arguments 

 

exec_env

Exec system call environment variables 

 

exit

Program exit information 

 

file

Audit file information 

 

groups

Process groups information (obsolete) 

 

header

Indicates start of record 

 

host

Indicates the host where the audit record was collected 

TS 

ilabel

Information label information (obsolete in Trusted Solaris 7) 

TS 

in_addr

Internet address 

 

ip

IP header information 

 

ipc

System V IPC information 

 

ipc_perm

System V IPC object tokens 

 

iport

Internet port address 

 

liaison

Liaison information for Trusted Networking 

TS 

newgroups

Process groups information 

 

opaque

Unstructured data (unspecified format) 

 

path

Path information (path) 

 

priv

Use of privilege information 

TS 

privilege

Privilege set information 

TS 

process

Process token information 

 

return

Status of system call 

 

seq

Sequence number token 

 

slabel

sensitivity label information 

TS 

socket

Socket type and addresses 

 

socket-inet

Socket port and address 

 

subject

Subject information (same structure as process token) 

 

text

character string 

 

trailer

Indicates end of record 

 

xatom

X window atom identification 

TS 

xclient

X client identification 

TS 

xcolormap

X window color information 

TS 

xcursor

X window cursor information 

TS 

xfont

X window font information 

TS 

xgc

X window graphical context information 

TS 

xpixmap

Xwindow pixel mapping information 

TS 

xproperty

X window property information 

TS 

xselect

X window data information 

TS 

xwindow

X window window information 

TS 

An audit record always contains a header token and may contain a trailer token. The header token indicates where the audit record begins in the audit trail. The optional trailer token allows backward seeks of the audit trail. Every audit record contains a subject token, except for audit records from some non-attributable events. In the case of attributable events, these two tokens refer to the values of the process that caused the event. In the case of asynchronous events, the process tokens refer to the system. For an example of how to read an audit record, go to "Reading an Audit Record".

acl Token

The acl token provides information about any access control lists in place on an object. If there is no current acl, this token is not written to the audit record. Also, unless required by an audit record format, this token is normally recorded only when the appropriate auditing policy is set. The fields are:

The following figure shows the token format.

Figure B-2 acl Token Format

Graphic

A list of acl tokens is displayed by praudit(1M) as follows: 

acl,user_obj,,rwx
acl,user,bin,---
acl,group_obj,,r-x
acl,class_obj,,r--
acl,other_obj,,r-x

arbitrary Token

The arbitrary token encapsulates data for the audit trail. It consists of four fixed fields and an array of data. The item array may have a number of items. The fields are:

The following figure shows the token format.

Figure B-3 arbitrary Token Format

Graphic

The print format field can take the values shown in Table B-2.

Table B-2 arbitrary Token Print Format Field Values

Value 

Action 

AUP_BINARY

Print date in binary 

AUP_OCTAL

Print date in octal 

AUP_DECIMAL

Print date in decimal 

AUP_HEX

Print date in hex 

AUP_STRING

Print date as a string 

The item size field can take the values shown in Table B-3.

Table B-3 arbitrary Token Item Size Field Values

Value 

Action 

AUR_BYTE

Data is in units of bytes (1 byte) 

AUR_SHORT

Data is in units of shorts (2 bytes) 

AUR_LONG

Data is in units of longs (4 bytes) 

AUR_LONGLONG

Data is in units of longlongs (8 bytes) 

An arbitrary token is displayed by praudit as follows:

arbitrary,decimal,int,1
42

arg Token

The arg token contains system call argument information. A 32-bit integer system call argument is allowed in an audit record. The fields are:

The following figure shows the token format.

Figure B-4 arg Token Format

Graphic

An arg token is displayed by praudit as follows: 

argument,2,0x3,cmd

attr Token

The attr token contains file attribute information from the kernel's internal representation of a file or folder. This token usually accompanies a path token and is produced during path searches. In the event of a path-search error, this token is not included as part of the audit record since the file attribute information is not available. The fields are:

See the statvfs(2) man page for further information about the file system ID and the device ID. The following figure shows the token format.

Figure B-5 attr Token Format

Graphic

An attr token is displayed by praudit as follows: 

attribute,100555,root,root,1805,13871,-4288

clearance Token

The clearance token contains Trusted Solaris clearance information. The fields are:

The following figure shows the token format.

Figure B-6 clearance Token Format

Graphic

A clearance token is displayed by praudit as follows:

clearance,TOP SECRET

exec_args Token

The exec_args token records the arguments to an exec() system call. The fields are:

The following figure shows an exec_args token.

Figure B-7 exec_args Token Format

Graphic

Note -

The exec_args token is output only when the audit policy argv is active. See "Dynamic Procedures" for more information.

An exec_args token is displayed by praudit as follows: 

exec_args,

exec_env Token

The exec_env token records the current environment variables to an exec() system call. The fields are:

The following figure shows an exec_env token.

Figure B-8 exec_env Token Format

Graphic

Note -

The exec_env token is output only when the audit policy arge is active. See "Dynamic Procedures" for more information.

An exec_envtoken is displayed by praudit as follows: 

exec_env,

exit Token

The exit token records the exit status of a program and a return value. The fields are:

The following figure shows an exit token.

Figure B-9 exit Token Format

Graphic

An exit token is displayed by praudit as follows: 

exit,Error 0,0

file Token

The file token is a special token generated by the audit daemon to mark the beginning of a new audit trail file and the end of an old file as it is deactivated. The audit daemon builds a special audit record containing this token to link together successive audit files into one audit trail. The fields are:

The following figure shows the token format.

Figure B-10 file Token Format

Graphic

A file token is displayed by praudit as follows: 

file,Fri Jan 23 13:32:42 1997, + 79249 msec,	
/etc/security/audit/patchwork/files/19920901202558.19920901203241.patchwork

groups Token (Obsolete)

This token has been replaced by the newgroups token, which provides the same type of information but requires less space. A description of the groups token is provided here for completeness, but the application designer should use the newgroups token. Note that praudit does not distinguish between the two tokens as both token IDs are labelled groups when character output is displayed.

The groups token records the groups entries from the process's credential. The fields are:

The following figure shows a groups token.

Figure B-11 groups Token Format

Graphic

A groups token is displayed by praudit as follows: 

group,staff,wheel,daemon,kmem,bin,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1
Note -

The groups token is output only when the audit policy group is active. See "The auditconfig Command" for more information.

header Token

The header token is special in that it marks the beginning of an audit record and combines with the trailer token to bracket all the other tokens in the record. The fields are:

The following figure shows a header token.

Figure B-12 header Token Format

Graphic

The event modifier field has the following flags defined:

Value 

Constant Name 

Description 

0x0001 

PAD_MACUSE 

MAC decision was successful 

0x0002 

PAD_MACREAD 

MAC read failure 

0x0004 

PAD_MACWRITE 

MAC write failure 

0x0008 

PAD_MACSEARCH 

MAC search failure 

0x0010 

PAD_MACKILL 

MAC signal failure 

0x0020 

PAD_MACTRACE 

MAC trace failure 

0x0040 

PAD_MACIOCTL 

MAC ioctl failure 

0x0080 

PAD_SPRIVUSE 

Successful use of privilege 

0x0100 

PAD_FPRIVUSE 

Failed use of privilege 

0x4000 

PAD_NONATTR 

Nonattributable event 

0x8000 

PAD_FAILURE 

Failed audit event 

A header token is displayed by praudit as follows: 

header,449,3,pfsh(1M),,Mon May

host Token

The host token contains the machine ID for the workstation which generated this audit record. The fields are:

The following figure shows the token format.

Figure B-13 host Token Format

Graphic

A host token is displayed by praudit as follows: 

host,patchwork

in_addr Token

The in_addr token contains an Internet address. This 4-byte value is an Internet Protocol address. The fields are:

The following figure shows the token format.

Figure B-14 in_addr Token Format

Graphic

An in_addr token is displayed by praudit as follows: 

ip addr,129.150.110.3

ip Token

The ip token contains a copy of an Internet Protocol header but does not include any IP options. The IP options may be added by including more of the IP header in the token. The IP header structure is defined in /usr/include/netinet/ip.h. The fields are:

The following figure shows the token format.

Figure B-15 ip Token Format

Graphic

An ip token is displayed by praudit as follows: 

ip,0.0.0.0

ipc Token

The ipc token contains the System V IPC message/semaphore/shared-memory handle used by the caller to identify a particular IPC object. The fields are:

The following figure shows the token format.

Figure B-16 ipc Token Format

Graphic

An ipc token is displayed by praudit as follows: 

IPC,msg,3
Note -

The IPC object identifiers violate the context-free nature of the Solaris CMW audit tokens. No global "name" uniquely identifies IPC objects; instead, they are identified by their handles, which are valid only during the time the IPC objects are active. The identification should not be a problem since the System V IPC mechanisms are seldom used and they all share the same audit class.

The IPC object type field may have the values shown in Table B-4. The values are defined in </usr/include/bsm/audit.h>.

Table B-4 IPC Object Type Field

Name 

Value 

Description 

AU_IPC_MSG

1 

IPC message object 

AU_IPC_SEM

2 

IPC semaphore object 

AU_IPC_SHM

3 

IPC shared memory object 

ipc_perm Token

The ipc_perm token contains a copy of the System V IPC access information. Audit records for shared memory, semaphore, and message IPCs have this token added. The fields are:

The values are taken from the ipc_perm structure associated with the IPC object. The following figure shows the token format.

Figure B-17 ipc_perm Token Format

Graphic

An ipc_perm token is displayed by praudit as follows: 

IPC perm,root,wheel,root,wheel,0,0,0x00000000

iport Token

The iport token contains the TCP (or UDP) port address. The fields are:

The following figure shows the token format.

Figure B-18 iport Token Format

Graphic

An iport token is displayed by praudit as follows:

iport,0xf6d6

liaison Token

The liaison token contains a liaison ID used by the Trusted Networking software. The fields are:

The following figure shows the token format.

Figure B-19 liaison Token Format

Graphic

A liaisontoken is displayed by praudit as follows: 

liaison,17

newgroups Token

This token is the replacement for the groups token. Note that praudit does not distinguish between the two tokens as both token IDs are labelled groups when character output is displayed.

The newgroups token records the groups entries from the process's credential. The fields are:

The following figure shows the token format.

Figure B-20 newgroups Token Format

Graphic

Note -

The newgroups token is output only when the audit policy group is active. See "The auditconfig Command" for more information.

A newgroups token is displayed by praudit as follows:

newgroups,1,analysts

opaque Token

The opaque token contains unformatted data as a sequence of bytes. The fields are:

The following figure shows the token format.

Figure B-21 opaque Token Format

Graphic

An opaque token is displayed by praudit as follows: 

opaque,12,0x4f5041515545204441544100

path Token

The path token contains access path information for an object. The fields are:

The following figure shows the token format.

Figure B-22 path Token Format

Graphic

A path token is displayed by praudit as follows:

path,/etc/security/audit/patchwork

priv Token

The priv token contains use of privilege information. The fields are:

The following figure shows a priv token.

Figure B-23 priv Token Format

Graphic

A priv token is displayed by praudit as follows: 

useofpriv,failed use of priv,win_mac_write

privilege Token

The privilege token contains privilege information for an object or a subject. The fields are:

where type is one of the following:

Value 

Type 

0 

Unknown or Undefined 

1 

Forced 

2 

Allowed 

3 

Effective 

4 

Inheritable 

5 

Permitted 

6 

Saved 

The following figure shows the token format.

Figure B-24 privilege Token Format

Graphic

A privilege token is displayed by praudit as follows: 

privilege,1,proc_tcb_audit

process Token

The process token contains information describing a process as an object such as the recipient of a signal. The fields are:

The following figure shows the token format.

Figure B-25 Format for process and subject Tokens

Graphic

The audit ID, user ID, group ID, process ID, and session ID are long instead of short.

Note -

The process token fields for the session ID, the real user ID, or the real group ID may be unavailable. The entry is then set to -1.

A process token is displayed by praudit as follows:

process,root,root,wheel,root,wheel,0,0,0,0.0.0.0

return Token

The return token contains the return status of the system call (u_error) and the process return value (u_rval1). The token indicates exit status and other return values in application auditing. This token is always returned as part of kernel-generated audit records for system calls. The fields are:

The following figure shows the token format.

Figure B-26 return Token Format

Graphic

A return token is displayed by praudit as follows: 

return,failure: No such file or directory,-1

seq Token

The seq token (sequence token) is an optional token that contains an increasing sequence number. This token is for debugging. The token is added to each audit record when the AUDIT_SEQ policy is active. The fields are:

The sequence number is incremented every time an audit record is generated and put onto the audit trail. The following figure shows the token format.

Figure B-27 seq Token Format

Graphic

A seq token is displayed by praudit as follows: 

sequence,1292

slabel Token

The slabel token contains a sensitivity label. The fields are:

The following figure shows the token format.

Figure B-28 slabel Token Format

Graphic

An slabel token is displayed by praudit as follows: 

slabel,ADMIN_LOW

socket Token

The socket token contains information describing an Internet socket. The fields are:

The socket type is taken from the designated socket and the port and Internet addresses are taken from the socket's inpcb control structure. The following figure shows the token format.

Figure B-29 socket Token Format

Graphic

A socket token is displayed by praudit as follows: 

socket,0x0000,0x0000,0.0.0.0,0x0000,0.0.0.0

socket,0x0002,0x8008,patchwork

socket-inet Token

The socket-inet token describes a socket connection to a local port, which is used to represent the socket information in the Internet namespace. The fields are:

The following figure shows the token format.

Figure B-30 socket-inet Token Format

Graphic

A socket-inet token is displayed by praudit as follows:

socket,0x0002,0x8008,patchwork

subject Token

The subject token describes a subject (process). The structure is the same as the process token:

This token is always returned as part of kernel-generated audit records for system calls. The audit ID, user ID, group ID, process ID, and session ID are long instead of short. Figure B-25 shows the token format.

Note -

The subject token fields for the session ID, the real user ID, or the real group ID may be unavailable. The entry is then set to -1.

A subject token is displayed by praudit as follows: 

subject,root,root,staff,root,staff,552,552,24 3 patchwork

text Token

The text token contains a text string. The fields are:

The following figure shows the token format.

Figure B-31 text Token Format

Graphic

A text token is displayed by praudit as follows: 

text,emily

trailer Token

A trailer token it marks the end of an audit record to support backward seeks of the audit trail. It is an optional token that is added as the last token of each record only when the AUDIT_TRAIL audit policy has been set. The fields are:

The following figure shows the token format.

Figure B-32 trailer Token Format

Graphic

A trailer token is displayed by praudit as follows: 

trailer,136

xatom Token

The xatom token contains information concerning an X atom. The fields are:

The following figure shows the token format.

Figure B-33 xatom Token Format

Graphic

An xatom token is displayed by praudit as follows:

xatom,_DT_SAVE_MODE

xclient Token

The xclient token contains information concerning the X client. The fields are:

The following figure shows the token format.

Figure B-34 xclient Token Format

Graphic

An xclient token is displayed by praudit as follows: 

xclient,15

xcolormap Token

The xcolormap token contains information about the colormaps. The fields are:

The following figure shows the token format.

Figure B-35 Format for xcolormap, xcursor, xfont, xgc, xpixmap, and xwindow Tokens

Graphic

An xcolormap token is displayed by praudit as follows: 

xcolormap,0x08c00005,srv

xcursor Token

The xcursor token contains information about the cursors. The fields are:

Figure B-35 shows the token format.

An xcursor token is displayed by praudit as follows:

xcursor,0x0f400006,srv

xfont Token

The xfont token contains information about the fonts. The fields are:

Figure B-35 shows the token format.

An xfont token is displayed by praudit as follows: 

xfont,0x08c00001,srv

xgc Token

The xgc token contains information about the xgc. The fields are:

Figure B-35 shows the token format.

An xgc token is displayed by praudit as follows: 

xgc,0x002f2ca0,srv

xpixmap Token

The xpixmap token contains information about the pixel mappings. The fields are:

Figure B-35 shows the token format.

An xpixmap token is displayed by praudit as follows: 

xpixmap,0x08c00005,srv

xproperty Token

The xproperty token contains information about various properties of a window. The fields are:

The following figure shows an xproperty token format.

Figure B-36 xproperty Token Format

Graphic

An xproperty token is displayed by praudit as follows:

xproperty,0x000075d5,root,_MOTIF_DEFAULT_BINDINGS

xselect Token

The xselect token contains the data moved between windows. This data is a byte stream with no assumed internal structure, and a property string. The fields are:

The following figure shows the token format.

Figure B-37 xselect Token Format

Graphic

An xselect token is displayed by praudit as follows: 

xselect,

xwindow Token

The xwindow token contains information about a window. The fields are:

Figure B-35 shows the token format.

An xwindow token is displayed by praudit as follows:

xwindow,0x07400001,gww