The audit tokens that Trusted Extensions software adds to Oracle Solaris are listed alphabetically in the following table. The token definitions are listed in the audit.log(4) man page.
|
The label token contains a sensitivity label.
A label token is displayed by the praudit -x command as follows:
<sensitivity_label>ADMIN_LOW</sensitivity_label>
The xatom token identifies an X atom.
An xatom token is displayed by praudit as follows:
X atom,_DT_SAVE_MODE
The xcolormap token contains information about the use of colormaps, including the X server identifier and the creator's user ID.
An xcolormap token is displayed by praudit as follows:
<X_colormap xid="0x08c00005" xcreator-uid="srv"/>
The xcursor token contains information about cursor use, including the X server identifier and the creator's user ID.
An xcursor token is displayed by praudit as follows:
X cursor,0x0f400006,srv
The xfont token contains information about the font use, including the X server identifier and the creator's user ID.
An xfont token is displayed by praudit as follows:
<X_font xid="0x08c00001" xcreator-uid="srv"/>
The xgc token contains information about the graphic context of an X window.
An xgc token is displayed by praudit as follows:
Xgraphic context,0x002f2ca0,srv
<X_graphic_context xid="0x30002804" xcreator-uid="srv"/>
The xpixmap token contains information about the use of pixel mappings, including the X server identifier and the creator's user ID.
An xpixmap token is displayed by praudit -x as follows:
<X_pixmap xid="0x2f002004" xcreator-uid="srv"/>
The xproperty token contains information about various properties of a window, such as the X server identifier, the creator's user ID, and an atom identifier.
An xproperty token is displayed by praudit as follows:
X_property,0x000075d5,root,_MOTIF_DEFAULT_BINDINGS
The xselect token contains the data that is moved between windows. This data is a byte stream with no assumed internal structure and a property string.
An xselect token is displayed by praudit as follows:
X selection,entryfield,halogen
The xwindow token identifies the Xserver and the creator's user ID.
An xwindow token is displayed by praudit as follows:
<X_window xid="0x07400001" xcreator-uid="srv"/>