Trusted Solaris Audit Administration

process Token

The process token contains information describing a process as an object such as the recipient of a signal. The fields are:

The audit ID, user ID, group ID, process ID, and session ID are long instead of short.


Note –

The process token fields for the session ID, the real user ID, or the real group ID might be unavailable. The entry is then set to -1.


For the Trusted Solaris 7 release, the process token can be displayed using a 64-bit device ID, in place of the 32-bit value.

For the Trusted Solaris 8 4/01 release, the terminal ID can report an IPv6 address by changing the format to use either 4 or 8 bytes to describe the device, 16 bytes to describe the type, and 16 bytes to describe the address.

The following figure shows the token format.

Figure B–24 Format for process and subject Tokens

Graphic

subject

A process token is displayed by praudit as follows:

process,root,root,wheel,root,wheel,0,0,0,0.0.0.0