summaryrefslogtreecommitdiffstats
path: root/sys/bsm/audit_kevents.h
blob: e1c91031db6a8d804d7fb8e6d25a82415e4fff70 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
/*
 * Copyright (c) 2005 Apple Computer, Inc.
 * All rights reserved.
 *
 * @APPLE_BSD_LICENSE_HEADER_START@
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1.  Redistributions of source code must retain the above copyright
 *     notice, this list of conditions and the following disclaimer.
 * 2.  Redistributions in binary form must reproduce the above copyright
 *     notice, this list of conditions and the following disclaimer in the
 *     documentation and/or other materials provided with the distribution.
 * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
 *     its contributors may be used to endorse or promote products derived
 *     from this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 * @APPLE_BSD_LICENSE_HEADER_END@
 *
 * $P4: //depot/projects/trustedbsd/audit3/sys/bsm/audit_kevents.h#32 $
 * $FreeBSD$
 */

#ifndef _BSM_AUDIT_KEVENTS_H_
#define	_BSM_AUDIT_KEVENTS_H_

/*
 * Values marked as AUE_NULL are not required to be audited as per CAPP.
 *
 * Some conflicts exist in the assignment of name to event number mappings
 * between BSM implementations.  In general, we prefer the OpenSolaris
 * definition as we consider Solaris BSM to be authoritative.  _DARWIN_ has
 * been inserted for the Darwin variants.  If necessary, other tags will be
 * added in the future.
 */
#define	AUE_NULL		0
#define	AUE_EXIT		1
#define	AUE_FORK		2
#define	AUE_OPEN		3
#define	AUE_CREAT		4
#define	AUE_LINK		5
#define	AUE_UNLINK		6
#define	AUE_DELETE		AUE_UNLINK
#define	AUE_EXEC		7
#define	AUE_CHDIR		8
#define	AUE_MKNOD		9
#define	AUE_CHMOD		10
#define	AUE_CHOWN		11
#define	AUE_UMOUNT		12
#define	AUE_JUNK		13	/* Solaris-specific. */
#define	AUE_ACCESS		14
#define	AUE_CHECKUSERACCESS	AUE_ACCESS
#define	AUE_KILL		15
#define	AUE_STAT		16
#define	AUE_LSTAT		17
#define	AUE_ACCT		18
#define	AUE_MCTL		19	/* Solaris-specific. */
#define	AUE_REBOOT		20	/* XXX: Darwin conflict. */
#define	AUE_SYMLINK		21
#define	AUE_READLINK		22
#define	AUE_EXECVE		23
#define	AUE_CHROOT		24
#define	AUE_VFORK		25
#define	AUE_SETGROUPS		26
#define	AUE_SETPGRP		27
#define	AUE_SWAPON		28
#define	AUE_SETHOSTNAME		29	/* XXX: Darwin conflict. */
#define	AUE_FCNTL		30
#define	AUE_SETPRIORITY		31	/* XXX: Darwin conflict. */
#define	AUE_CONNECT		32
#define	AUE_ACCEPT		33
#define	AUE_BIND		34
#define	AUE_SETSOCKOPT		35
#define	AUE_VTRACE		36	/* Solaris-specific. */
#define	AUE_SETTIMEOFDAY	37	/* XXX: Darwin conflict. */
#define	AUE_FCHOWN		38
#define	AUE_FCHMOD		39
#define	AUE_SETREUID		40
#define	AUE_SETREGID		41
#define	AUE_RENAME		42
#define	AUE_TRUNCATE		43	/* XXX: Darwin conflict. */
#define	AUE_FTRUNCATE		44	/* XXX: Darwin conflict. */
#define	AUE_FLOCK		45	/* XXX: Darwin conflict. */
#define	AUE_SHUTDOWN		46
#define	AUE_MKDIR		47
#define	AUE_RMDIR		48
#define	AUE_UTIMES		49
#define	AUE_ADJTIME		50
#define	AUE_SETRLIMIT		51
#define	AUE_KILLPG		52
#define	AUE_NFS_SVC		53	/* XXX: Darwin conflict. */
#define	AUE_STATFS		54
#define	AUE_FSTATFS		55
#define	AUE_UNMOUNT		56	/* XXX: Darwin conflict. */
#define	AUE_ASYNC_DAEMON	57
#define	AUE_NFS_GETFH		58	/* XXX: Darwin conflict. */
#define	AUE_SETDOMAINNAME	59
#define	AUE_QUOTACTL		60	/* XXX: Darwin conflict. */
#define	AUE_EXPORTFS		61
#define	AUE_MOUNT		62
#define	AUE_SEMSYS		63
#define	AUE_MSGSYS		64
#define	AUE_SHMSYS		65
#define	AUE_BSMSYS		66	/* Solaris-specific. */
#define	AUE_RFSSYS		67	/* Solaris-specific. */
#define	AUE_FCHDIR		68
#define	AUE_FCHROOT		69
#define	AUE_VPIXSYS		70	/* Solaris-specific. */
#define	AUE_PATHCONF		71
#define	AUE_OPEN_R		72
#define	AUE_OPEN_RC		73
#define	AUE_OPEN_RT		74
#define	AUE_OPEN_RTC		75
#define	AUE_OPEN_W		76
#define	AUE_OPEN_WC		77
#define	AUE_OPEN_WT		78
#define	AUE_OPEN_WTC		79
#define	AUE_OPEN_RW		80
#define	AUE_OPEN_RWC		81
#define	AUE_OPEN_RWT		82
#define	AUE_OPEN_RWTC		83
#define	AUE_MSGCTL		84
#define	AUE_MSGCTL_RMID		85
#define	AUE_MSGCTL_SET		86
#define	AUE_MSGCTL_STAT		87
#define	AUE_MSGGET		88
#define	AUE_MSGRCV		89
#define	AUE_MSGSND		90
#define	AUE_SHMCTL		91
#define	AUE_SHMCTL_RMID		92
#define	AUE_SHMCTL_SET		93
#define	AUE_SHMCTL_STAT		94
#define	AUE_SHMGET		95
#define	AUE_SHMAT		96
#define	AUE_SHMDT		97
#define	AUE_SEMCTL		98
#define	AUE_SEMCTL_RMID		99
#define	AUE_SEMCTL_SET		100
#define	AUE_SEMCTL_STAT		101
#define	AUE_SEMCTL_GETNCNT	102
#define	AUE_SEMCTL_GETPID	103
#define	AUE_SEMCTL_GETVAL	104
#define	AUE_SEMCTL_GETALL	105
#define	AUE_SEMCTL_GETZCNT	106
#define	AUE_SEMCTL_SETVAL	107
#define	AUE_SEMCTL_SETALL	108
#define	AUE_SEMGET		109
#define	AUE_SEMOP		110
#define	AUE_CORE		111	/* Solaris-specific, currently. */
#define	AUE_CLOSE		112
#define	AUE_SYSTEMBOOT		113
#define	AUE_ASYNC_DAEMON_EXIT	114	/* Solaris-specific. */
#define	AUE_NFSSVC_EXIT		115	/* Solaris-specific. */
#define	AUE_WRITEL		128	/* Solaris-specific. */
#define	AUE_WRITEVL		129	/* Solaris-specific. */
#define	AUE_GETAUID		130
#define	AUE_SETAUID		131
#define	AUE_GETAUDIT		132
#define	AUE_SETAUDIT		133
#define	AUE_GETUSERAUDIT	134	/* Solaris-specific. */
#define	AUE_SETUSERAUDIT	135	/* Solaris-specific. */
#define	AUE_AUDITSVC		136	/* Solaris-specific. */
#define	AUE_AUDITUSER		137	/* Solaris-specific. */
#define	AUE_AUDITON		138
#define	AUE_AUDITON_GTERMID	139	/* Solaris-specific. */
#define	AUE_AUDITON_STERMID	140	/* Solaris-specific. */
#define	AUE_AUDITON_GPOLICY	141
#define	AUE_AUDITON_SPOLICY	142
#define	AUE_AUDITON_GQCTRL	145
#define	AUE_AUDITON_SQCTRL	146
#define	AUE_GETKERNSTATE	147	/* Solaris-specific. */
#define	AUE_SETKERNSTATE	148	/* Solaris-specific. */
#define	AUE_GETPORTAUDIT	149	/* Solaris-specific. */
#define	AUE_AUDISTAT		150	/* Solaris-specific. */
#define	AUE_ENTERPROM		153	/* Solaris-specific. */
#define	AUE_EXITPROM		154	/* Solaris-specific. */
#define	AUE_IOCTL		158
#define	AUE_SOCKET		183
#define	AUE_SENDTO		184
#define	AUE_PIPE		185
#define	AUE_SOCKETPAIR		186	/* XXX: Darwin conflict. */
#define	AUE_SEND		187
#define	AUE_SENDMSG		188
#define	AUE_RECV		189
#define	AUE_RECVMSG		190
#define	AUE_RECVFROM		191
#define	AUE_READ		192
#define	AUE_LSEEK		194
#define	AUE_WRITE		195
#define	AUE_WRITEV		196
#define	AUE_NFS			197	/* Solaris-specific. */
#define	AUE_READV		198
					/* XXXRW: XXX Solaris old stat()? */
#define	AUE_SETUID		200	/* XXXRW: Solaris old setuid? */
#define	AUE_STIME		201	/* XXXRW: Solaris old stime? */
#define	AUE_UTIME		202	/* XXXRW: Solaris old utime? */
#define	AUE_NICE		203	/* XXXRW: Solaris old nice? */
					/* XXXRW: Solaris old setpgrp? */
#define	AUE_SETGID		205	/* XXXRW: Solaris old setgid? */
					/* XXXRW: Solaris readl? */
					/* XXXRW: Solaris readvl()? */
#define	AUE_DUP2		209
#define	AUE_MMAP		210
#define	AUE_AUDIT		211
#define	AUE_PRIOCNTLSYS		212
#define	AUE_MUNMAP		213
#define	AUE_SETEGID		214
#define	AUE_SETEUID		215
#define	AUE_PUTMSG		216
#define	AUE_GETMSG		217	/* Solaris-specific. */
#define	AUE_PUTPMSG		218	/* Solaris-specific. */
#define	AUE_GETPMSG		219	/* Solaris-specific. */
#define	AUE_AUDITSYS		220	/* Solaris-specific. */
#define	AUE_AUDITON_GETKMASK	221
#define	AUE_AUDITON_SETKMASK	222
#define	AUE_AUDITON_GETCWD	223
#define	AUE_AUDITON_GETCAR	224
#define	AUE_AUDITON_GETSTAT	225
#define	AUE_AUDITON_SETSTAT	226
#define	AUE_AUDITON_SETUMASK	227
#define	AUE_AUDITON_SETSMASK	228
#define	AUE_AUDITON_GETCOND	229
#define	AUE_AUDITON_SETCOND	230
#define	AUE_AUDITON_GETCLASS	231
#define	AUE_AUDITON_SETCLASS	232
#define	AUE_UTSSYS		233	/* Solaris-specific. */
#define	AUE_STATVFS		234
#define	AUE_XSTAT		235
#define	AUE_LXSTAT		236
#define	AUE_LCHOWN		237
#define	AUE_MEMCNTL		238	/* Solaris-specific. */
#define	AUE_SYSINFO		239	/* Solaris-specific. */
#define	AUE_XMKNOD		240	/* Solaris-specific. */
#define	AUE_FORK1		241
					/* XXXRW: Solaris modctl()? */
#define	AUE_MODLOAD		243
#define	AUE_MODUNLOAD		244
#define	AUE_MODCONFIG		245	/* Solaris-specific. */
#define	AUE_MODADDMAJ		246	/* Solaris-specific. */
#define	AUE_SOCKACCEPT		247
#define	AUE_SOCKCONNECT		248
#define	AUE_SOCKSEND		249
#define	AUE_SOCKRECEIVE		250
#define	AUE_ACLSET		251
#define	AUE_FACLSET		252
#define	AUE_DOORFS_DOOR_CALL	254	/* Solaris-specific. */
#define	AUE_DOORFS_DOOR_RETURN	255	/* Solaris-specific. */
#define	AUE_DOORFS_DOOR_CREATE	256	/* Solaris-specific. */
#define	AUE_DOORFS_DOOR_REVOKE	257	/* Solaris-specific. */
#define	AUE_DOORFS_DOOR_INFO	258	/* Solaris-specific. */
#define	AUE_DOORFS_DOOR_CRED	259	/* Solaris-specific. */
#define	AUE_DOORFS_DOOR_BIND	260	/* Solaris-specific. */
#define	AUE_DOORFS_DOOR_UNBIND	261	/* Solaris-specific. */
#define	AUE_P_ONLINE		262	/* Solaris-specific. */
#define	AUE_PROCESSOR_BIND	263	/* Solaris-specific. */
#define	AUE_INST_SYNC		264	/* Solaris-specific. */
#define	AUE_SOCK_CONFIG		265	/* Solaris-specific. */
#define	AUE_SETAUDIT_ADDR	266
#define	AUE_GETAUDIT_ADDR	267
#define	AUE_CLOCK_SETTIME	287
#define	AUE_NTP_ADJTIME		288

/*
 * Events added for Apple Darwin that potentially collide with future Solaris
 * BSM events.  These are assigned AUE_DARWIN prefixes, and are deprecated in
 * new trails.  Systems generating these events should switch to the new
 * identifiers that avoid colliding with the Solaris identifier space.
 */
#define	AUE_DARWIN_GETFSSTAT	301
#define	AUE_DARWIN_PTRACE	302
#define	AUE_DARWIN_CHFLAGS	303
#define	AUE_DARWIN_FCHFLAGS	304
#define	AUE_DARWIN_PROFILE	305
#define	AUE_DARWIN_KTRACE	306
#define	AUE_DARWIN_SETLOGIN	307
#define	AUE_DARWIN_REBOOT	308	/* XXX: See AUE_REBOOT. */
#define	AUE_DARWIN_REVOKE	309
#define	AUE_DARWIN_UMASK	310
#define	AUE_DARWIN_MPROTECT	311
#define	AUE_DARWIN_SETPRIORITY	312	/* XXX: See AUE_SETPRIORITY. */
#define	AUE_DARWIN_SETTIMEOFDAY	313	/* XXX: See AUE_SETTIMEOFDAY. */
#define	AUE_DARWIN_FLOCK	314	/* XXX: See AUE_FLOCK. */
#define	AUE_DARWIN_MKFIFO	315
#define	AUE_DARWIN_POLL		316
#define	AUE_DARWIN_SOCKETPAIR	317	/* XXXRW: See AUE_SOCKETPAIR. */
#define	AUE_DARWIN_FUTIMES	318
#define	AUE_DARWIN_SETSID	319
#define	AUE_DARWIN_SETPRIVEXEC	320	/* Darwin-specific. */
#define	AUE_DARWIN_NFSSVC	321	/* XXX: See AUE_NFS_SVC. */
#define	AUE_DARWIN_GETFH	322	/* XXX: See AUE_NFS_GETFH. */
#define	AUE_DARWIN_QUOTACTL	323	/* XXX: See AUE_QUOTACTL. */
#define	AUE_DARWIN_ADDPROFILE	324	/* Darwin-specific. */
#define	AUE_DARWIN_KDEBUGTRACE	325	/* Darwin-specific. */
#define	AUE_DARWIN_KDBUGTRACE	AUE_KDEBUGTRACE
#define	AUE_DARWIN_FSTAT	326
#define	AUE_DARWIN_FPATHCONF	327
#define	AUE_DARWIN_GETDIRENTRIES	328
#define	AUE_DARWIN_TRUNCATE	329	/* XXX: See AUE_TRUNCATE. */
#define	AUE_DARWIN_FTRUNCATE	330	/* XXX: See AUE_FTRUNCATE. */
#define	AUE_DARWIN_SYSCTL	331
#define	AUE_DARWIN_MLOCK	332
#define	AUE_DARWIN_MUNLOCK	333
#define	AUE_DARWIN_UNDELETE	334
#define	AUE_DARWIN_GETATTRLIST	335	/* Darwin-specific. */
#define	AUE_DARWIN_SETATTRLIST	336	/* Darwin-specific. */
#define	AUE_DARWIN_GETDIRENTRIESATTR	337	/* Darwin-specific. */
#define	AUE_DARWIN_EXCHANGEDATA	338	/* Darwin-specific. */
#define	AUE_DARWIN_SEARCHFS	339	/* Darwin-specific. */
#define	AUE_DARWIN_MINHERIT	340
#define	AUE_DARWIN_SEMCONFIG	341
#define	AUE_DARWIN_SEMOPEN	342
#define	AUE_DARWIN_SEMCLOSE	343
#define	AUE_DARWIN_SEMUNLINK	344
#define	AUE_DARWIN_SHMOPEN	345
#define	AUE_DARWIN_SHMUNLINK	346
#define	AUE_DARWIN_LOADSHFILE	347	/* Darwin-specific. */
#define	AUE_DARWIN_RESETSHFILE	348	/* Darwin-specific. */
#define	AUE_DARWIN_NEWSYSTEMSHREG	349	/* Darwin-specific. */
#define	AUE_DARWIN_PTHREADKILL	350	/* Darwin-specific. */
#define	AUE_DARWIN_PTHREADSIGMASK	351	/* Darwin-specific. */
#define	AUE_DARWIN_AUDITCTL	352
#define	AUE_DARWIN_RFORK	353
#define	AUE_DARWIN_LCHMOD	354
#define	AUE_DARWIN_SWAPOFF	355
#define	AUE_DARWIN_INITPROCESS	356	/* Darwin-specific. */
#define	AUE_DARWIN_MAPFD	357	/* Darwin-specific. */
#define	AUE_DARWIN_TASKFORPID	358	/* Darwin-specific. */
#define	AUE_DARWIN_PIDFORTASK	359	/* Darwin-specific. */
#define	AUE_DARWIN_SYSCTL_NONADMIN	360
#define	AUE_DARWIN_COPYFILE	361	/* Darwin-specific. */

/*
 * Audit event identifiers added as part of OpenBSM, generally corresponding
 * to events in FreeBSD, Darwin, and Linux that were not present in Solaris.
 * These often duplicate events added to the Solaris set by Darwin, but use
 * event identifiers in a higher range in order to avoid colliding with
 * future Solaris additions.
 */
#define	AUE_GETFSSTAT		43001
#define	AUE_PTRACE		43002
#define	AUE_CHFLAGS		43003
#define	AUE_FCHFLAGS		43004
#define	AUE_PROFILE		43005
#define	AUE_KTRACE		43006
#define	AUE_SETLOGIN		43007
#define	AUE_REVOKE		43008
#define	AUE_UMASK		43009
#define	AUE_MPROTECT		43010
#define	AUE_MKFIFO		43011
#define	AUE_POLL		43012
#define	AUE_FUTIMES		43013
#define	AUE_SETSID		43014
#define	AUE_SETPRIVEXEC		43015	/* Darwin-specific. */
#define	AUE_ADDPROFILE		43016	/* Darwin-specific. */
#define	AUE_KDEBUGTRACE		43017	/* Darwin-specific. */
#define	AUE_KDBUGTRACE		AUE_KDEBUGTRACE
#define	AUE_FSTAT		43018
#define	AUE_FPATHCONF		43019
#define	AUE_GETDIRENTRIES	43020
#define	AUE_SYSCTL		43021
#define	AUE_MLOCK		43022
#define	AUE_MUNLOCK		43023
#define	AUE_UNDELETE		43024
#define	AUE_GETATTRLIST		43025	/* Darwin-specific. */
#define	AUE_SETATTRLIST		43026	/* Darwin-specific. */
#define	AUE_GETDIRENTRIESATTR	43027	/* Darwin-specific. */
#define	AUE_EXCHANGEDATA	43028	/* Darwin-specific. */
#define	AUE_SEARCHFS		43029	/* Darwin-specific. */
#define	AUE_MINHERIT		43030
#define	AUE_SEMCONFIG		43031
#define	AUE_SEMOPEN		43032
#define	AUE_SEMCLOSE		43033
#define	AUE_SEMUNLINK		43034
#define	AUE_SHMOPEN		43035
#define	AUE_SHMUNLINK		43036
#define	AUE_LOADSHFILE		43037	/* Darwin-specific. */
#define	AUE_RESETSHFILE		43038	/* Darwin-specific. */
#define	AUE_NEWSYSTEMSHREG	43039	/* Darwin-specific. */
#define	AUE_PTHREADKILL		43040	/* Darwin-specific. */
#define	AUE_PTHREADSIGMASK	43041	/* Darwin-specific. */
#define	AUE_AUDITCTL		43042
#define	AUE_RFORK		43043
#define	AUE_LCHMOD		43044
#define	AUE_SWAPOFF		43045
#define	AUE_INITPROCESS		43046	/* Darwin-specific. */
#define	AUE_MAPFD		43047	/* Darwin-specific. */
#define	AUE_TASKFORPID		43048	/* Darwin-specific. */
#define	AUE_PIDFORTASK		43049	/* Darwin-specific. */
#define	AUE_SYSCTL_NONADMIN	43050
#define	AUE_COPYFILE		43051	/* Darwin-specific. */

/*
 * Events added to OpenBSM for FreeBSD and Linux; may also be used by Darwin
 * in the future.
 */
#define	AUE_LUTIMES		43052
#define	AUE_LCHFLAGS		43053	/* FreeBSD-specific. */
#define	AUE_SENDFILE		43054	/* BSD/Linux-specific. */
#define	AUE_USELIB		43055	/* Linux-specific. */
#define	AUE_GETRESUID		43056
#define	AUE_SETRESUID		43057
#define	AUE_GETRESGID		43058
#define	AUE_SETRESGID		43059
#define	AUE_WAIT4		43060	/* FreeBSD-specific. */
#define	AUE_LGETFH		43061	/* FreeBSD-specific. */
#define	AUE_FHSTATFS		43062	/* FreeBSD-specific. */
#define	AUE_FHOPEN		43063	/* FreeBSD-specific. */
#define	AUE_FHSTAT		43064	/* FreeBSD-specific. */
#define	AUE_JAIL		43065	/* FreeBSD-specific. */
#define	AUE_EACCESS		43066	/* FreeBSD-specific. */
#define	AUE_KQUEUE		43067	/* FreeBSD-specific. */
#define	AUE_KEVENT		43068	/* FreeBSD-specific. */
#define	AUE_FSYNC		43069
#define	AUE_NMOUNT		43070	/* FreeBSD-specific. */
#define	AUE_BDFLUSH		43071	/* Linux-specific. */
#define	AUE_SETFSUID		43072	/* Linux-specific. */
#define	AUE_SETFSGID		43073	/* Linux-specific. */
#define	AUE_PERSONALITY		43074	/* Linux-specific. */
#define	AUE_SCHED_GETSCHEDULER	43075	/* POSIX.1b. */
#define	AUE_SCHED_SETSCHEDULER	43076	/* POSIX.1b. */
#define	AUE_PRCTL		43077	/* Linux-specific. */
#define	AUE_GETCWD		43078	/* FreeBSD/Linux-specific. */
#define	AUE_CAPGET		43079	/* Linux-specific. */
#define	AUE_CAPSET		43080	/* Linux-specific. */
#define	AUE_PIVOT_ROOT		43081	/* Linux-specific. */
#define	AUE_RTPRIO		43082	/* FreeBSD-specific. */
#define	AUE_SCHED_GETPARAM	43083	/* POSIX.1b. */
#define	AUE_SCHED_SETPARAM	43084	/* POSIX.1b. */
#define	AUE_SCHED_GET_PRIORITY_MAX	43085	/* POSIX.1b. */
#define	AUE_SCHED_GET_PRIORITY_MIN	43086	/* POSIX.1b. */
#define	AUE_SCHED_RR_GET_INTERVAL	43087	/* POSIX.1b. */
#define	AUE_ACL_GET_FILE	43088	/* FreeBSD. */
#define	AUE_ACL_SET_FILE	43089	/* FreeBSD. */
#define	AUE_ACL_GET_FD		43090	/* FreeBSD. */
#define	AUE_ACL_SET_FD		43091	/* FreeBSD. */
#define	AUE_ACL_DELETE_FILE	43092	/* FreeBSD. */
#define	AUE_ACL_DELETE_FD	43093	/* FreeBSD. */
#define	AUE_ACL_CHECK_FILE	43094	/* FreeBSD. */
#define	AUE_ACL_CHECK_FD	43095	/* FreeBSD. */
#define	AUE_ACL_GET_LINK	43096	/* FreeBSD. */
#define	AUE_ACL_SET_LINK	43097	/* FreeBSD. */
#define	AUE_ACL_DELETE_LINK	43098	/* FreeBSD. */
#define	AUE_ACL_CHECK_LINK	43099	/* FreeBSD. */
#define	AUE_SYSARCH		43100	/* FreeBSD. */
#define	AUE_EXTATTRCTL		43101	/* FreeBSD. */
#define	AUE_EXTATTR_GET_FILE	43102	/* FreeBSD. */
#define	AUE_EXTATTR_SET_FILE	43103	/* FreeBSD. */
#define	AUE_EXTATTR_LIST_FILE	43104	/* FreeBSD. */
#define	AUE_EXTATTR_DELETE_FILE	43105	/* FreeBSD. */
#define	AUE_EXTATTR_GET_FD	43106	/* FreeBSD. */
#define	AUE_EXTATTR_SET_FD	43107	/* FreeBSD. */
#define	AUE_EXTATTR_LIST_FD	43108	/* FreeBSD. */
#define	AUE_EXTATTR_DELETE_FD	43109	/* FreeBSD. */
#define	AUE_EXTATTR_GET_LINK	43110	/* FreeBSD. */
#define	AUE_EXTATTR_SET_LINK	43111	/* FreeBSD. */
#define	AUE_EXTATTR_LIST_LINK	43112	/* FreeBSD. */
#define	AUE_EXTATTR_DELETE_LINK	43113	/* FreeBSD. */
#define	AUE_KENV		43114	/* FreeBSD. */
#define	AUE_JAIL_ATTACH		43115	/* FreeBSD. */
#define	AUE_SYSCTL_WRITE	43116	/* FreeBSD. */
#define	AUE_IOPERM		43117	/* Linux. */
#define	AUE_READDIR		43118	/* Linux. */
#define	AUE_IOPL		43119	/* Linux. */
#define	AUE_VM86		43120	/* Linux. */
#define	AUE_MAC_GET_PROC	43121	/* FreeBSD. */
#define	AUE_MAC_SET_PROC	43122	/* FreeBSD. */
#define	AUE_MAC_GET_FD		43123	/* FreeBSD. */
#define	AUE_MAC_GET_FILE	43124	/* FreeBSD. */
#define	AUE_MAC_SET_FD		43125	/* FreeBSD. */
#define	AUE_MAC_SET_FILE	43126	/* FreeBSD. */
#define	AUE_MAC_SYSCALL		43127	/* FreeBSD. */
#define	AUE_MAC_GET_PID		43128	/* FreeBSD. */
#define	AUE_MAC_GET_LINK	43129	/* FreeBSD. */
#define	AUE_MAC_SET_LINK	43130	/* FreeBSD. */
#define	AUE_MAC_EXECVE		43131	/* FreeBSD. */
#define	AUE_GETPATH_FROMFD	43132	/* FreeBSD. */
#define	AUE_GETPATH_FROMADDR	43133	/* FreeBSD. */
#define	AUE_MQ_OPEN		43134	/* FreeBSD. */
#define	AUE_MQ_SETATTR		43135	/* FreeBSD. */
#define	AUE_MQ_TIMEDRECEIVE	43136	/* FreeBSD. */
#define	AUE_MQ_TIMEDSEND	43137	/* FreeBSD. */
#define	AUE_MQ_NOTIFY		43138	/* FreeBSD. */
#define	AUE_MQ_UNLINK		43139	/* FreeBSD. */
#define	AUE_LISTEN		43140	/* FreeBSD/Darwin/Linux. */
#define	AUE_MLOCKALL		43141	/* FreeBSD. */
#define	AUE_MUNLOCKALL		43142	/* FreeBSD. */

/*
 * Darwin BSM uses a number of AUE_O_* definitions, which are aliased to the
 * normal Solaris BSM identifiers.  _O_ refers to it being an old, or compat
 * interface.  In most cases, Darwin has never implemented these system calls
 * but picked up the fields in their system call table from their FreeBSD
 * import.  Happily, these have different names than the AUE_O* definitions
 * in Solaris BSM.
 */
#define	AUE_O_CREAT		AUE_OPEN_RWTC	/* Darwin */
#define	AUE_O_EXECVE		AUE_NULL	/* Darwin */
#define	AUE_O_SBREAK		AUE_NULL	/* Darwin */
#define	AUE_O_LSEEK		AUE_NULL	/* Darwin */
#define	AUE_O_MOUNT		AUE_NULL	/* Darwin */
#define	AUE_O_UMOUNT		AUE_NULL	/* Darwin */
#define	AUE_O_STAT		AUE_STAT	/* Darwin */
#define	AUE_O_LSTAT		AUE_LSTAT	/* Darwin */
#define	AUE_O_FSTAT		AUE_FSTAT	/* Darwin */
#define	AUE_O_GETPAGESIZE	AUE_NULL	/* Darwin */
#define	AUE_O_VREAD		AUE_NULL	/* Darwin */
#define	AUE_O_VWRITE		AUE_NULL	/* Darwin */
#define	AUE_O_MMAP		AUE_MMAP	/* Darwin */
#define	AUE_O_VADVISE		AUE_NULL	/* Darwin */
#define	AUE_O_VHANGUP		AUE_NULL	/* Darwin */
#define	AUE_O_VLIMIT		AUE_NULL	/* Darwin */
#define	AUE_O_WAIT		AUE_NULL	/* Darwin */
#define	AUE_O_GETHOSTNAME	AUE_NULL	/* Darwin */
#define	AUE_O_SETHOSTNAME	AUE_SYSCTL	/* Darwin */
#define	AUE_O_GETDOPT		AUE_NULL	/* Darwin */
#define	AUE_O_SETDOPT		AUE_NULL	/* Darwin */
#define	AUE_O_ACCEPT		AUE_NULL	/* Darwin */
#define	AUE_O_SEND		AUE_SENDMSG	/* Darwin */
#define	AUE_O_RECV		AUE_RECVMSG	/* Darwin */
#define	AUE_O_VTIMES		AUE_NULL	/* Darwin */
#define	AUE_O_SIGVEC		AUE_NULL	/* Darwin */
#define	AUE_O_SIGBLOCK		AUE_NULL	/* Darwin */
#define	AUE_O_SIGSETMASK	AUE_NULL	/* Darwin */
#define	AUE_O_SIGSTACK		AUE_NULL	/* Darwin */
#define	AUE_O_RECVMSG		AUE_RECVMSG	/* Darwin */
#define	AUE_O_SENDMSG		AUE_SENDMSG	/* Darwin */
#define	AUE_O_VTRACE		AUE_NULL	/* Darwin */
#define	AUE_O_RESUBA		AUE_NULL	/* Darwin */
#define	AUE_O_RECVFROM		AUE_RECVFROM	/* Darwin */
#define	AUE_O_SETREUID		AUE_SETREUID	/* Darwin */
#define	AUE_O_SETREGID		AUE_SETREGID	/* Darwin */
#define	AUE_O_GETDIRENTRIES	AUE_GETDIRENTRIES	/* Darwin */
#define	AUE_O_TRUNCATE		AUE_TRUNCATE	/* Darwin */
#define	AUE_O_FTRUNCATE		AUE_FTRUNCATE	/* Darwin */
#define	AUE_O_GETPEERNAME	AUE_NULL	/* Darwin */
#define	AUE_O_GETHOSTID		AUE_NULL	/* Darwin */
#define	AUE_O_SETHOSTID		AUE_NULL	/* Darwin */
#define	AUE_O_GETRLIMIT		AUE_NULL	/* Darwin */
#define	AUE_O_SETRLIMIT		AUE_SETRLIMIT	/* Darwin */
#define	AUE_O_KILLPG		AUE_KILL	/* Darwin */
#define	AUE_O_SETQUOTA		AUE_NULL	/* Darwin */
#define	AUE_O_QUOTA		AUE_NULL	/* Darwin */
#define	AUE_O_GETSOCKNAME	AUE_NULL	/* Darwin */
#define	AUE_O_GETDIREENTRIES	AUE_GETDIREENTRIES	/* Darwin */
#define	AUE_O_ASYNCDAEMON	AUE_NULL	/* Darwin */
#define	AUE_O_GETDOMAINNAME	AUE_NULL	/* Darwin */
#define	AUE_O_SETDOMAINNAME	AUE_SYSCTL	/* Darwin */
#define	AUE_O_PCFS_MOUNT	AUE_NULL	/* Darwin */
#define	AUE_O_EXPORTFS		AUE_NULL	/* Darwin */
#define	AUE_O_USTATE		AUE_NULL	/* Darwin */
#define	AUE_O_WAIT3		AUE_NULL	/* Darwin */
#define	AUE_O_RPAUSE		AUE_NULL	/* Darwin */
#define	AUE_O_GETDENTS		AUE_NULL	/* Darwin */

/*
 * Possible desired future values based on review of BSD/Darwin system calls.
 */
#define	AUE_DUP			AUE_NULL
#define	AUE_FSCTL		AUE_NULL
#define	AUE_FSTATV		AUE_NULL
#define	AUE_GCCONTROL		AUE_NULL
#define	AUE_GETDTABLESIZE	AUE_NULL
#define	AUE_GETEGID		AUE_NULL
#define	AUE_GETEUID		AUE_NULL
#define	AUE_GETGID		AUE_NULL
#define	AUE_GETGROUPS		AUE_NULL
#define	AUE_GETITIMER		AUE_NULL
#define	AUE_GETLOGIN		AUE_NULL
#define	AUE_GETPEERNAME		AUE_NULL
#define	AUE_GETPGID		AUE_NULL
#define	AUE_GETPGRP		AUE_NULL
#define	AUE_GETPID		AUE_NULL
#define	AUE_GETPPID		AUE_NULL
#define	AUE_GETPRIORITY		AUE_NULL
#define	AUE_GETRLIMIT		AUE_NULL
#define	AUE_GETRUSAGE		AUE_NULL
#define	AUE_GETSID		AUE_NULL
#define	AUE_GETSOCKNAME		AUE_NULL
#define	AUE_GETTIMEOFDAY	AUE_NULL
#define	AUE_GETUID		AUE_NULL
#define	AUE_GETSOCKOPT		AUE_NULL
#define	AUE_GTSOCKOPT		AUE_GETSOCKOPT	/* XXX: Typo in Darwin. */
#define	AUE_ISSETUGID		AUE_NULL
#define	AUE_LSTATV		AUE_NULL
#define	AUE_MADVISE		AUE_NULL
#define	AUE_MINCORE		AUE_NULL
#define	AUE_MKCOMPLEX		AUE_NULL
#define	AUE_MODWATCH		AUE_NULL
#define	AUE_MSGCL		AUE_NULL
#define	AUE_MSYNC		AUE_NULL
#define	AUE_PREAD		AUE_NULL
#define	AUE_PWRITE		AUE_NULL
#define	AUE_PREADV		AUE_NULL
#define	AUE_PWRITEV		AUE_NULL
#define	AUE_SBRK		AUE_NULL
#define	AUE_SELECT		AUE_NULL
#define	AUE_SEMDESTROY		AUE_NULL
#define	AUE_SEMGETVALUE		AUE_NULL
#define	AUE_SEMINIT		AUE_NULL
#define	AUE_SEMPOST		AUE_NULL
#define	AUE_SEMTRYWAIT		AUE_NULL
#define	AUE_SEMWAIT		AUE_NULL
#define	AUE_SETITIMER		AUE_NULL
#define	AUE_SIGACTION		AUE_NULL
#define	AUE_SIGALTSTACK		AUE_NULL
#define	AUE_SIGPENDING		AUE_NULL
#define	AUE_SIGPROCMASK		AUE_NULL
#define	AUE_SIGRETURN		AUE_NULL
#define	AUE_SIGSUSPEND		AUE_NULL
#define	AUE_SIGWAIT		AUE_NULL
#define	AUE_SSTK		AUE_NULL
#define	AUE_STATV		AUE_NULL
#define	AUE_SYNC		AUE_NULL
#define	AUE_SYSCALL		AUE_NULL
#define	AUE_TABLE		AUE_NULL
#define	AUE_WAITEVENT		AUE_NULL
#define	AUE_WATCHEVENT		AUE_NULL

#endif /* !_BSM_AUDIT_KEVENTS_H_ */
OpenPOWER on IntegriCloud