lib/fieldtab.h - master - githubmirror/audit-userspace

lib/fieldtab.h
72 строки3 KB
Richard Guy Briggs
add support to filter on sockaddr family
31 май 2019, 23:17
31 май 2019, 23:17fef4978
/* fieldtab.h --
 * Copyright 2005-07,2015-16 Red Hat Inc., Durham, North Carolina.
 * All Rights Reserved.
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2.1 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 *
 * Authors:
 *      Steve Grubb <sgrubb@redhat.com>
 *      Richard Guy Briggs <rgb@redhat.com>
 */

_S(AUDIT_PID,          "pid"          )
_S(AUDIT_UID,          "uid"          )
_S(AUDIT_EUID,         "euid"         )
_S(AUDIT_SUID,         "suid"         )
_S(AUDIT_FSUID,        "fsuid"        )
_S(AUDIT_GID,          "gid"          )
_S(AUDIT_EGID,         "egid"         )
_S(AUDIT_SGID,         "sgid"         )
_S(AUDIT_FSGID,        "fsgid"        )
_S(AUDIT_LOGINUID,     "auid"         )
_S(AUDIT_LOGINUID,     "loginuid"     )
_S(AUDIT_PERS,         "pers"         )
_S(AUDIT_ARCH,         "arch"         )
_S(AUDIT_MSGTYPE,      "msgtype"      )
_S(AUDIT_SUBJ_USER,    "subj_user"    )
_S(AUDIT_SUBJ_ROLE,    "subj_role"    )
_S(AUDIT_SUBJ_TYPE,    "subj_type"    )
_S(AUDIT_SUBJ_SEN,     "subj_sen"     )
_S(AUDIT_SUBJ_CLR,     "subj_clr"     )
_S(AUDIT_PPID,         "ppid"         )
_S(AUDIT_OBJ_USER,     "obj_user"     )
_S(AUDIT_OBJ_ROLE,     "obj_role"     )
_S(AUDIT_OBJ_TYPE,     "obj_type"     )
_S(AUDIT_OBJ_LEV_LOW,  "obj_lev_low"  )
_S(AUDIT_OBJ_LEV_HIGH, "obj_lev_high" )
_S(AUDIT_SESSIONID,    "sessionid"    )

_S(AUDIT_DEVMAJOR,     "devmajor"     )
_S(AUDIT_DEVMINOR,     "devminor"     )
_S(AUDIT_INODE,        "inode"        )
_S(AUDIT_EXIT,         "exit"         )
_S(AUDIT_SUCCESS,      "success"      )
_S(AUDIT_WATCH,        "path"         )
_S(AUDIT_PERM,         "perm"         )
_S(AUDIT_DIR,          "dir"          )
_S(AUDIT_FILETYPE,     "filetype"     )
_S(AUDIT_FSTYPE,       "fstype"       )
_S(AUDIT_OBJ_UID,      "obj_uid"      )
_S(AUDIT_OBJ_GID,      "obj_gid"      )
_S(AUDIT_FIELD_COMPARE, "field_compare" )

_S(AUDIT_ARG0,         "a0"           )
_S(AUDIT_ARG1,         "a1"           )
_S(AUDIT_ARG2,         "a2"           )
_S(AUDIT_ARG3,         "a3"           )

_S(AUDIT_FILTERKEY,    "key"          )
_S(AUDIT_EXE,          "exe"          )
_S(AUDIT_SADDR_FAM,    "saddr_fam"    )