New Audit Token path_attr

This feature is new in the Software Express pilot program. This feature is included in the Solaris 10 3/05 release.

The path_attr audit token contains access path information for an object. The access path specifies the sequence of attribute file objects below the path token object. Systems calls such as openat() access attribute files. For more information on extended file attributes, see the fsattr(5) man page.

The path_attr token has three fields:

• A token ID field that identifies this token as a path_attr token

• A count that represents the number of sections of attribute file paths

• One or more null-terminated strings

The praudit command displays the path_attr token as follows:

path_attr,1,attr_file_name

For further information, see Chapter 30, “Solaris Auditing (Reference)” and “path_attr Token” in the System Administration Guide: Security Services.