The attr token contains information from the file vnode. This token has seven fields:
a token ID that identifies this token as an attr token
the file access mode and type
the owner user ID
the owner group ID
the file system ID
the inode ID
the device ID the file might represent
See the statvfs(2) man page for further information about the file system ID and the device ID.
The attr token usually accompanies a path token and is produced during path searches. In the event of a path-search error, the attr token is not included as part of the audit record since there is no vnode available to obtain the necessary file information. The praudit command displays the attr token as follows:
attribute,100555,root,staff,1805,13871,-4288 |
The following figure shows the format of an attr token.