IRIX Base Documentation 2001 May

home *** CD-ROM | disk | FTP | other *** search

/ IRIX Base Documentation 2001 May / SGI IRIX Base Documentation 2001 May.iso / usr / share / catman / p_man / cat4 / satd.z / satd

Wrap

Text File | 2001-04-17 | 100.0 KB | 4,195 lines

ssssaaaattttdddd((((4444)))) ssssaaaattttdddd((((4444)))) NNNNAAAAMMMMEEEE satd - system auditing file format. SSSSYYYYNNNNOOOOPPPPSSSSIIIISSSS ####iiiinnnncccclllluuuuddddeeee <<<<ssssyyyyssss////ssssaaaatttt....hhhh>>>> DDDDEEEESSSSCCCCRRRRIIIIPPPPTTTTIIIIOOOONNNN An audit file consists of an Audit File Header followed by a number of AUDIT RECORDS. A new audit record is created for each auditable event. An Audit Record consists of an Audit Record Header Token followed by a number of Audit Tokens. An Audit Token consists of an Audit Token Header followed by token data which is specific to each token. The Audit Token Header consists of an unsigned 16 bit token identifier and an unsigned 16 bit token size field. The contents of the Audit File Header are: ________________________________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn ________________________________________________________________________________ File HeaderID 8 SGIAUDIT File ID ________________________________________________________________________________ sat_major 1 Audit Major Version Number ________________________________________________________________________________ sat_minor 1 Audit Minor Version Number ________________________________________________________________________________ sat_pad1 2 Alignment Filler ________________________________________________________________________________ start time 4 Time Header was written ________________________________________________________________________________ stop time 4 Time file closed ________________________________________________________________________________ Host ID 4 Host IP Number ________________________________________________________________________________ MAC enabled 4 boolean Ignore MAC fields? ________________________________________________________________________________ CAP enabled 4 boolean Ignore CAP fields? ________________________________________________________________________________ CIPSO enabled 4 boolean Ignore CIPSO fields? ________________________________________________________________________________ total bytes 4 Number of Bytes to skip past Header ________________________________________________________________________________ |||||||||||||||||||||||| |||||||||||||||||||||||| |||||||||||||||||||||||| |||||||||||||||||||||||| |||||||||||||||||||||||| PPPPaaaaggggeeee 1111 ssssaaaattttdddd((((4444)))) ssssaaaattttdddd((((4444)))) ______________________________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn _____________________________________________________________________________ User entries 2 Number of entries in user list _____________________________________________________________________________ Group entries 2 Number of entries in group list _____________________________________________________________________________ Host entries 2 Number of hosts _____________________________________________________________________________ Timezone length 1 Length of timezone string _____________________________________________________________________________ Hostname length 1 Length of Hostname name string _____________________________________________________________________________ Domainname length 1 Length of Domain name string _____________________________________________________________________________ sat_pad2 3 Alignment filler _____________________________________________________________________________ Timezone Time Zone string _____________________________________________________________________________ Hostname Host name string _____________________________________________________________________________ Domainname Domain name string _____________________________________________________________________________ User entries Users list _____________________________________________________________________________ Group entries Groups list _____________________________________________________________________________ Host ID entries Hosts List _____________________________________________________________________________ |||||||||||||||||||||||||||| |||||||||||||||||||||||||||| |||||||||||||||||||||||||||| |||||||||||||||||||||||||||| |||||||||||||||||||||||||||| PPPPaaaaggggeeee 2222 ssssaaaattttdddd((((4444)))) ssssaaaattttdddd((((4444)))) The contents of the Record Header Token are: _____________________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn _____________________________________________________________________ Token ID 2 0x0001 SAT_RECORD_HEADER_TOKEN _____________________________________________________________________ Token Size 2 14 _____________________________________________________________________ Magic Number 4 0xee6540ee SAT_RECORD_MAGIC _____________________________________________________________________ Record Size 2 Total Size of Record _____________________________________________________________________ Record Type 1 Kind of event _____________________________________________________________________ Outcome 1 Event Outcome _____________________________________________________________________ Sequence 1 within event _____________________________________________________________________ Error Number 1 errno _____________________________________________________________________ |||||||||||||||||| |||||||||||||||||| |||||||||||||||||| |||||||||||||||||| |||||||||||||||||| The contents of the Audit Tokens are: _________________________________________________________ SSSSAAAATTTT____IIIIFFFFRRRREEEEQQQQ____TTTTOOOOKKKKEEEENNNN _________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn _________________________________________________________ Token ID 2 0x0002 SAT_IFREQ_TOKEN _________________________________________________________ Token Size 2 36 _________________________________________________________ Struct ifreq 32 from <sys/if.h> _________________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| __________________________________________________________ SSSSAAAATTTT____PPPPRRRROOOOTTTTOOOOCCCCOOOOLLLL____TTTTOOOOKKKKEEEENNNN __________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn __________________________________________________________ Token ID 2 0x0003 SAT_PROTOCOL_TOKEN __________________________________________________________ Token Size 2 8 __________________________________________________________ Domain 2 Domain __________________________________________________________ Protocol 2 Protocol __________________________________________________________ |||||||||||| ||||||||||| ||||||||||| ||||||||||| |||||||||||| PPPPaaaaggggeeee 3333 ssssaaaattttdddd((((4444)))) ssssaaaattttdddd((((4444)))) ______________________________________________________ SSSSAAAATTTT____TTTTIIIIMMMMEEEE____TTTTOOOOKKKKEEEENNNN ______________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn ______________________________________________________ Token ID 2 0x0004 SAT_TIME_TOKEN ______________________________________________________ Token Size 2 9 ______________________________________________________ Time 4 Time ______________________________________________________ Ticks 1 Ticks ______________________________________________________ |||||||||||| ||||||||||| ||||||||||| ||||||||||| |||||||||||| ____________________________________________________________________ SSSSAAAATTTT____SSSSYYYYSSSSCCCCAAAALLLLLLLL____TTTTOOOOKKKKEEEENNNN ____________________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn ____________________________________________________________________ Token ID 2 0x0005 SAT_SYSCALL_TOKEN ____________________________________________________________________ Token Size 2 7 ____________________________________________________________________ Sys Call No. 1 Sys Call No. ____________________________________________________________________ Sys Call Vector No. 2 Sys Call Vector No. ____________________________________________________________________ |||||||||||| ||||||||||| ||||||||||| ||||||||||| |||||||||||| ______________________________________________________ SSSSAAAATTTT____UUUUGGGGIIIIDDDD____TTTTOOOOKKKKEEEENNNN ______________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn ______________________________________________________ Token ID 2 0x0006 SAT_UGID_TOKEN ______________________________________________________ Token Size 2 12 ______________________________________________________ User ID 4 User ID ______________________________________________________ Group ID 4 Group ID ______________________________________________________ |||||||||||| ||||||||||| ||||||||||| ||||||||||| |||||||||||| PPPPaaaaggggeeee 4444 ssssaaaattttdddd((((4444)))) ssssaaaattttdddd((((4444)))) ___________________________________________________________________________ SSSSAAAATTTT____FFFFIIIILLLLEEEE____TTTTOOOOKKKKEEEENNNN __________________________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn __________________________________________________________________________ Token ID 2 0x0007 SAT_FILE_TOKEN __________________________________________________________________________ Token Size 2 16 __________________________________________________________________________ File Identifier(inode) 8 File Identifier(inode) __________________________________________________________________________ dev_t 4 from <sys/types.h> __________________________________________________________________________ |||||||||||| ||||||||||| ||||||||||| ||||||||||| |||||||||||| ________________________________________________________________ SSSSAAAATTTT____SSSSOOOOCCCCKKKKAAAADDDDDDDDEEEERRRR____TTTTOOOOKKKKEEEENNNN ________________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn ________________________________________________________________ Token ID 2 0x0008 SAT_SOCKADDER_TOKEN ________________________________________________________________ Token Size 2 20 ________________________________________________________________ Struct sockaddr 16 from <sys/socket.h> ________________________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| PPPPaaaaggggeeee 5555 ssssaaaattttdddd((((4444)))) ssssaaaattttdddd((((4444)))) ____________________________________________________________ SSSSAAAATTTT____IIIIPPPP____HHHHEEEEAAAADDDDEEEERRRR____TTTTOOOOKKKKEEEENNNN ___________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn ___________________________________________________________ Token ID 2 0x0009 SAT_IP_HEADER_TOKEN ___________________________________________________________ Token Size 2 24 ___________________________________________________________ Struct ip 20 netinet/ip.h ___________________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| ___________________________________________________________ SSSSAAAATTTT____GGGGIIIIDDDD____LLLLIIIISSSSTTTT____TTTTOOOOKKKKEEEENNNN ___________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn ___________________________________________________________ Token ID 2 0x000a SAT_GID_LIST_TOKEN ___________________________________________________________ Token Size 2 ___________________________________________________________ Group IDs (Token Size)-4 Group IDs ___________________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| ___________________________________________________________ SSSSAAAATTTT____UUUUIIIIDDDD____LLLLIIIISSSSTTTT____TTTTOOOOKKKKEEEENNNN ___________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn ___________________________________________________________ Token ID 2 0x000b SAT_UID_LIST_TOKEN ___________________________________________________________ Token Size 2 ___________________________________________________________ User IDs (Token Size)-4 User IDs ___________________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| _________________________________________________________________________ SSSSAAAATTTT____SSSSYYYYSSSSAAAARRRRGGGG____LLLLIIIISSSSTTTT____TTTTOOOOKKKKEEEENNNN _________________________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn _________________________________________________________________________ Token ID 2 0x000c SAT_SYSARG_LIST_TOKEN _________________________________________________________________________ Token Size 2 _________________________________________________________________________ System Call Arguments (Token Size)-4 System Call Arguments _________________________________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| PPPPaaaaggggeeee 6666 ssssaaaattttdddd((((4444)))) ssssaaaattttdddd((((4444)))) ___________________________________________________________________ SSSSAAAATTTT____DDDDEEEESSSSCCCCRRRRIIIIPPPPTTTTOOOORRRR____LLLLIIIISSSSTTTT____TTTTOOOOKKKKEEEENNNN ___________________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn ___________________________________________________________________ Token ID 2 0x000d SAT_DESCRIPTOR_LIST_TOKEN ___________________________________________________________________ Token Size 2 ___________________________________________________________________ Descriptors (Token Size)-4 Descriptors ___________________________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| ____________________________________________________________ SSSSAAAATTTT____IIIIFFFFNNNNAAAAMMMMEEEE____TTTTOOOOKKKKEEEENNNN ____________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn ____________________________________________________________ Token ID 2 0x000e SAT_IFNAME_TOKEN ____________________________________________________________ Token Size 2 20 ____________________________________________________________ Interface Name 16 Interface Name ____________________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| ________________________________________________________ SSSSAAAATTTT____SSSSOOOOCCCCKKKKEEEETTTT____TTTTOOOOKKKKEEEENNNN ________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn ________________________________________________________ Token ID 2 0x000f SAT_SOCKET_TOKEN ________________________________________________________ Token Size 2 12 ________________________________________________________ Socket ID 8 Socket ID ________________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| _________________________________________________________________________ SSSSAAAATTTT____MMMMAAAACCCC____LLLLAAAABBBBEEEELLLL____TTTTOOOOKKKKEEEENNNN _________________________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn _________________________________________________________________________ Token ID 2 0x00010 SAT_MAC_LABEL_TOKEN _________________________________________________________________________ Token Size 2 _________________________________________________________________________ MAC Label Size 2 MAC Label Size _________________________________________________________________________ MAC Label struct mac_label MAC Label _________________________________________________________________________ |||||||||||| ||||||||||| ||||||||||| ||||||||||| |||||||||||| PPPPaaaaggggeeee 7777 ssssaaaattttdddd((((4444)))) ssssaaaattttdddd((((4444)))) _____________________________________________________________ SSSSAAAATTTT____AAAACCCCLLLL____TTTTOOOOKKKKEEEENNNN ____________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn ____________________________________________________________ Token ID 2 0x00011 SAT_ACL_TOKEN ____________________________________________________________ Token Size 2 258 ____________________________________________________________ acl_t 254 struct acl from <sys/acl.h> ____________________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| ________________________________________________________________ SSSSAAAATTTT____CCCCAAAAPPPP____VVVVAAAALLLLUUUUEEEE____TTTTOOOOKKKKEEEENNNN ________________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn ________________________________________________________________ Token ID 2 0x0012 SAT_CAP_VALUE_TOKEN ________________________________________________________________ Token Size 2 12 ________________________________________________________________ cap_value_t 8 from <sys/capability.h> ________________________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| _______________________________________________________________ SSSSAAAATTTT____CCCCAAAAPPPP____SSSSEEEETTTT____TTTTOOOOKKKKEEEENNNN _______________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn _______________________________________________________________ Token ID 2 0x0013 SAT_CAP_SET_TOKEN _______________________________________________________________ Token Size 2 28 _______________________________________________________________ cap_set_t 24 from <sys/capability.h> _______________________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| PPPPaaaaggggeeee 8888 ssssaaaattttdddd((((4444)))) ssssaaaattttdddd((((4444)))) _______________________________________________________ SSSSAAAATTTT____TTTTEEEEXXXXTTTT____TTTTOOOOKKKKEEEENNNN _______________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn _______________________________________________________ Token ID 2 0x0014 SAT_TEXT_TOKEN _______________________________________________________ Token Size 2 _______________________________________________________ Text (Token Size)-4 Text _______________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| _________________________________________________________________ SSSSAAAATTTT____SSSSVVVVIIIIPPPPCCCC____KKKKEEEEYYYY____TTTTOOOOKKKKEEEENNNN _________________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn _________________________________________________________________ Token ID 2 0x0015 SAT_SVIPC_KEY_TOKEN _________________________________________________________________ Token Size 2 8 _________________________________________________________________ System V IPC Key 4 System V IPC Key _________________________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| _______________________________________________________________ SSSSAAAATTTT____SSSSVVVVIIIIPPPPCCCC____IIIIDDDD____TTTTOOOOKKKKEEEENNNN _______________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn _______________________________________________________________ Token ID 2 0x0016 SAT_SVIPC_ID_TOKEN _______________________________________________________________ Token Size 2 8 _______________________________________________________________ System V IPC ID 4 System V IPC ID _______________________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| ______________________________________________________ SSSSAAAATTTT____MMMMOOOODDDDEEEE____TTTTOOOOKKKKEEEENNNN ______________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn ______________________________________________________ Token ID 2 0x0017 SAT_MODE_TOKEN ______________________________________________________ Token Size 2 6 ______________________________________________________ Mode bits 2 Mode bits ______________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| PPPPaaaaggggeeee 9999 ssssaaaattttdddd((((4444)))) ssssaaaattttdddd((((4444)))) ________________________________________________________ SSSSAAAATTTT____PPPPOOOORRRRTTTT____TTTTOOOOKKKKEEEENNNN _______________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn _______________________________________________________ Token ID 2 0x0018 SAT_PORT_TOKEN _______________________________________________________ Token Size 2 8 _______________________________________________________ Port Number 4 Port Number _______________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| ________________________________________________________ SSSSAAAATTTT____HHHHOOOOSSSSTTTTIIIIDDDD____TTTTOOOOKKKKEEEENNNN ________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn ________________________________________________________ Token ID 2 0x0019 SAT_HOSTID_TOKEN ________________________________________________________ Token Size 2 8 ________________________________________________________ Host ID 4 Host ID ________________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| ________________________________________________________ SSSSAAAATTTT____BBBBIIIINNNNAAAARRRRYYYY____TTTTOOOOKKKKEEEENNNN ________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn ________________________________________________________ Token ID 2 0x001a SAT_BINARY_TOKEN ________________________________________________________ Token Size 2 5 ________________________________________________________ 1 or 0 1 1 or 0 ________________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| _____________________________________________________ SSSSAAAATTTT____PPPPIIIIDDDD____TTTTOOOOKKKKEEEENNNN _____________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn _____________________________________________________ Token ID 2 0x001b SAT_PID_TOKEN _____________________________________________________ Token Size 2 8 _____________________________________________________ Process ID 4 Process ID _____________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| PPPPaaaaggggeeee 11110000 ssssaaaattttdddd((((4444)))) ssssaaaattttdddd((((4444)))) __________________________________________________________________________ SSSSAAAATTTT____PPPPRRRRIIIIVVVVIIIILLLLEEEEGGGGEEEE____TTTTOOOOKKKKEEEENNNN _________________________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn _________________________________________________________________________ Token ID 2 0x001c SAT_PRIVILEGE_TOKEN _________________________________________________________________________ Token Size 2 13 _________________________________________________________________________ cap_value_t 8 from <sys/capability.h> _________________________________________________________________________ how privilege was obtained 1 how privilege was obtained _________________________________________________________________________ ||||||||||||| |||||||||||| |||||||||||| |||||||||||| ||||||||||||| _________________________________________________________ SSSSAAAATTTT____EEEERRRRRRRRNNNNOOOO____TTTTOOOOKKKKEEEENNNN _________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn _________________________________________________________ Token ID 2 0x001d SAT_ERRNO_TOKEN _________________________________________________________ Token Size 2 5 _________________________________________________________ Error Number 1 Error Number _________________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| __________________________________________________________ SSSSAAAATTTT____SSSSAAAATTTTIIIIDDDD____TTTTOOOOKKKKEEEENNNN __________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn __________________________________________________________ Token ID 2 0x001e SAT_SATID_TOKEN __________________________________________________________ Token Size 2 8 __________________________________________________________ Audit User ID 4 Audit User ID __________________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| PPPPaaaaggggeeee 11111111 ssssaaaattttdddd((((4444)))) ssssaaaattttdddd((((4444)))) ___________________________________________________________ SSSSAAAATTTT____DDDDEEEEVVVVIIIICCCCEEEE____TTTTOOOOKKKKEEEENNNN __________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn __________________________________________________________ Token ID 2 0x001f SAT_DEVICE_TOKEN __________________________________________________________ Token Size 2 8 __________________________________________________________ dev_t 4 from <sys/types.h> __________________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| _________________________________________________________________ SSSSAAAATTTT____TTTTIIIITTTTLLLLEEEEDDDD____TTTTEEEEXXXXTTTT____TTTTOOOOKKKKEEEENNNN _________________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn _________________________________________________________________ Token ID 2 0x0020 SAT_TITLED_TEXT_TOKEN _________________________________________________________________ Token Size 2 _________________________________________________________________ Title String 16 Title Text String _________________________________________________________________ Text String (Token Size)-20 Text String _________________________________________________________________ |||||||||||| ||||||||||| ||||||||||| ||||||||||| |||||||||||| ___________________________________________________________ SSSSAAAATTTT____PPPPAAAATTTTHHHHNNNNAAAAMMMMEEEE____TTTTOOOOKKKKEEEENNNN ___________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn ___________________________________________________________ Token ID 2 0x0021 SAT_PATHNAME_TOKEN ___________________________________________________________ Token Size 2 ___________________________________________________________ Pathname (Token Size)-4 Pathname ___________________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| __________________________________________________________ SSSSAAAATTTT____OOOOPPPPEEEENNNNMMMMOOOODDDDEEEE____TTTTOOOOKKKKEEEENNNN __________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn __________________________________________________________ Token ID 2 0x0022 SAT_OPENMODE_TOKEN __________________________________________________________ Token Size 2 8 __________________________________________________________ Open Flags 4 Open Flags __________________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| PPPPaaaaggggeeee 11112222 ssssaaaattttdddd((((4444)))) ssssaaaattttdddd((((4444)))) ___________________________________________________________ SSSSAAAATTTT____SSSSIIIIGGGGNNNNAAAALLLL____TTTTOOOOKKKKEEEENNNN ___________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn ___________________________________________________________ Token ID 2 0x0023 SAT_SIGNAL_TOKEN ___________________________________________________________ Token Size 2 8 ___________________________________________________________ Signal Number 4 Signal Number ___________________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| ________________________________________________________ SSSSAAAATTTT____SSSSTTTTAAAATTTTUUUUSSSS____TTTTOOOOKKKKEEEENNNN ________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn ________________________________________________________ Token ID 2 0x0024 SAT_STATUS_TOKEN ________________________________________________________ Token Size 2 8 ________________________________________________________ Status 4 Status ________________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| _________________________________________________________ SSSSAAAATTTT____OOOOPPPPAAAAQQQQUUUUEEEE____TTTTOOOOKKKKEEEENNNN _________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn _________________________________________________________ Token ID 2 0x0025 SAT_OPAQUE_TOKEN _________________________________________________________ Token Size 2 _________________________________________________________ Data (Token Size)-4 Data _________________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| __________________________________________________________ SSSSAAAATTTT____LLLLOOOOOOOOKKKKUUUUPPPP____TTTTOOOOKKKKEEEENNNN __________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn __________________________________________________________ Token ID 2 0x0026 SAT_LOOKUP_TOKEN __________________________________________________________ Token Size 2 __________________________________________________________ Lookup Name (Token Size)-4 Lookup Name __________________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| PPPPaaaaggggeeee 11113333 ssssaaaattttdddd((((4444)))) ssssaaaattttdddd((((4444)))) __________________________________________________________________________ SSSSAAAATTTT____CCCCWWWWDDDD____TTTTOOOOKKKKEEEENNNN _________________________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn _________________________________________________________________________ Token ID 2 0x0027 SAT_CWD_TOKEN _________________________________________________________________________ Token Size 2 _________________________________________________________________________ Current Working Directory (Token Size)-4 Current Working Directory _________________________________________________________________________ ||||||||||| |||||||||| |||||||||| |||||||||| ||||||||||| ___________________________________________________________ SSSSAAAATTTT____RRRROOOOOOOOTTTT____TTTTOOOOKKKKEEEENNNN ___________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn ___________________________________________________________ Token ID 2 0x0028 SAT_ROOT_TOKEN ___________________________________________________________ Token Size 2 ___________________________________________________________ Root Directory (Token Size)-4 Root Directory ___________________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| ____________________________________________________________ SSSSAAAATTTT____PPPPAAAARRRREEEENNNNTTTT____PPPPIIIIDDDD____TTTTOOOOKKKKEEEENNNN ____________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn ____________________________________________________________ Token ID 2 0x0029 SAT_PARENT_PID_TOKEN ____________________________________________________________ Token Size 2 8 ____________________________________________________________ PPID 4 Parent Process ID ____________________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| ____________________________________________________________ SSSSAAAATTTT____CCCCOOOOMMMMMMMMAAAANNNNDDDD____TTTTOOOOKKKKEEEENNNN ____________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn ____________________________________________________________ Token ID 2 0x002a SAT_COMMAND_TOKEN ____________________________________________________________ Token Size 2 ____________________________________________________________ Command Name (Token Size)-4 Command Name ____________________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| PPPPaaaaggggeeee 11114444 ssssaaaattttdddd((((4444)))) ssssaaaattttdddd((((4444)))) ______________________________________________________________ SSSSAAAATTTT____AAAACCCCCCCCTTTT____CCCCOOOOUUUUNNNNTTTTSSSS____TTTTOOOOKKKKEEEENNNN ______________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn ______________________________________________________________ Token ID 2 0x002b SAT_ACCT_COUNTS_TOKEN ______________________________________________________________ Token Size 2 100 ______________________________________________________________ acct_counts 96 ______________________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| _____________________________________________________________________ SSSSAAAATTTT____AAAACCCCCCCCTTTT____TTTTIIIIMMMMEEEERRRRSSSS____TTTTOOOOKKKKEEEENNNN _____________________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn _____________________________________________________________________ Token ID 2 0x002c SAT_ACCT_TIMERS_TOKEN _____________________________________________________________________ Token Size 2 68 _____________________________________________________________________ Struct acct_timers 64 from <sys/extacct.h> _____________________________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| ______________________________________________________________________ SSSSAAAATTTT____AAAACCCCCCCCTTTT____PPPPRRRROOOOCCCC____TTTTOOOOKKKKEEEENNNN ______________________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn ______________________________________________________________________ Token ID 2 0x002d SAT_ACCT_PROC_TOKEN ______________________________________________________________________ Token Size 2 44 ______________________________________________________________________ Struct sat_proc_acct 40 from <sys/extacct.h> ______________________________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| ____________________________________________________________________ SSSSAAAATTTT____AAAACCCCCCCCTTTT____SSSSEEEESSSSSSSSIIIIOOOONNNN____TTTTOOOOKKKKEEEENNNN ____________________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn ____________________________________________________________________ Token ID 2 0x002e SAT_ACCT_SESSION_TOKEN ____________________________________________________________________ Token Size 2 44 ____________________________________________________________________ Struct sat_session_acct 40 from <sys/extacct.h> ____________________________________________________________________ ||||||||||| |||||||||| |||||||||| |||||||||| ||||||||||| PPPPaaaaggggeeee 11115555 ssssaaaattttdddd((((4444)))) ssssaaaattttdddd((((4444)))) _________________________________________________________________ SSSSAAAATTTT____AAAACCCCCCCCTTTT____SSSSPPPPIIII____TTTTOOOOKKKKEEEENNNN _________________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn _________________________________________________________________ Token ID 2 0x002f SAT_ACCT_SPI_TOKEN _________________________________________________________________ Token Size 2 68 _________________________________________________________________ Struct acct_spi 64 from <sys/extacct.h> _________________________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| ___________________________________________________________ SSSSAAAATTTT____AAAACCCCCCCCTTTT____SSSSPPPPIIII2222____TTTTOOOOKKKKEEEENNNN ___________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn ___________________________________________________________ Token ID 2 0x0030 SAT_ACCT_SPI2_TOKEN ___________________________________________________________ Token Size 2 ___________________________________________________________ SPI Size SPI Size SPI ___________________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| _________________________________________________________ SSSSAAAATTTT____OOOOBBBBJJJJEEEECCCCTTTT____TTTTOOOOKKKKEEEENNNN _________________________________________________________ FFFFiiiieeeelllldddd SSSSiiiizzzzeeee iiiinnnn BBBByyyytttteeeessss VVVVaaaalllluuuueeee DDDDeeeessssccccrrrriiiippppttttiiiioooonnnn _________________________________________________________ Token ID 2 0x0031 SAT_OBJECT_TOKEN _________________________________________________________ Token Size 2 _________________________________________________________ Text (Token Size)-4 Text _________________________________________________________ |||||||||| ||||||||| ||||||||| ||||||||| |||||||||| PPPPaaaaggggeeee 11116666 ssssaaaattttdddd((((4444)))) ssssaaaattttdddd((((4444)))) NOTE: Audit records only appear if satd is configured to record them (see sat_select(1)). _____________________________________ RRRREEEECCCCOOOORRRRDDDD TTTTYYYYPPPPEEEE DDDDEEEEFFFFIIIINNNNIIIITTTTIIIIOOOONNNNSSSS _____________________________________ RRRReeeeccccoooorrrrdddd TTTTyyyyppppeeee RRRReeeeccccoooorrrrdddd NNNNuuuummmmbbbbeeeerrrr _____________________________________ SAT_FILE_HEADER 0 _____________________________________ SAT_ACCESS_DENIED 1 _____________________________________ SAT_ACCESS_FAILED 2 _____________________________________ SAT_CHDIR 3 _____________________________________ SAT_CHROOT 4 _____________________________________ SAT_OPEN 5 _____________________________________ SAT_OPEN_RO 6 _____________________________________ SAT_READ_SYMLINK 7 _____________________________________ SAT_FILE_CRT_DEL 8 _____________________________________ SAT_FILE_CRT_DEL2 9 _____________________________________ SAT_FILE_WRITE 10 _____________________________________ SAT_MOUNT 11 _____________________________________ SAT_FILE_ATTR_READ 12 _____________________________________ SAT_FILE_ATTR_WRITE 13 _____________________________________ SAT_EXEC 14 _____________________________________ SAT_SYSACCT 15 _____________________________________ SAT_FCHDIR 20 _____________________________________ SAT_FD_READ 21 _____________________________________ SAT_FD_READ2 22 _____________________________________ SAT_TTY_SETLABEL 23 _____________________________________ SAT_FD_WRITE 24 _____________________________________ |||||||||||||||||||||||||||||||||||||||||||||| ||||||||||||||||||||||||||||||||||||||||||||| |||||||||||||||||||||||||||||||||||||||||||||| PPPPaaaaggggeeee 11117777 ssssaaaattttdddd((((4444)))) ssssaaaattttdddd((((4444)))) ________________________________________________ RRRREEEECCCCOOOORRRRDDDD TTTTYYYYPPPPEEEE DDDDEEEEFFFFIIIINNNNIIIITTTTIIIIOOOONNNNSSSS ________________________________________________ RRRReeeeccccoooorrrrdddd TTTTyyyyppppeeee RRRReeeeccccoooorrrrdddd NNNNuuuummmmbbbbeeeerrrr ________________________________________________ SAT_FD_ATTR_WRITE 25 ________________________________________________ SAT_PIPE 26 ________________________________________________ SAT_DUP 27 ________________________________________________ SAT_CLOSE 28 ________________________________________________ SAT_FORK 40 ________________________________________________ SAT_EXIT 41 ________________________________________________ SAT_PROC_READ 42 ________________________________________________ SAT_PROC_WRITE 43 ________________________________________________ SAT_PROC_ATTR_READ 44 ________________________________________________ SAT_PROC_ATTR_WRITE 45 ________________________________________________ SAT_PROC_OWN_ATTR_WRITE 46 ________________________________________________ SAT_PROC_ACCT 47 ________________________________________________ SAT_SESSION_ACCT 48 ________________________________________________ SAT_SVIPC_ACCESS 50 ________________________________________________ SAT_SVIPC_CREATE 51 ________________________________________________ SAT_SVIPC_REMOVE 52 ________________________________________________ SAT_SVIPC_CHANGE 53 ________________________________________________ SAT_BSDIPC_CREATE 60 ________________________________________________ SAT_BSDIPC_CREATE_PAIR 61 ________________________________________________ SAT_BSDIPC_SHUTDOWN 62 ________________________________________________ SAT_BSDIPC_MAC_CHANGE 63 ________________________________________________ ||||||||||||||||||||||||||||||||||||||||||||||| |||||||||||||||||||||||||||||||||||||||||||||| ||||||||||||||||||||||||||||||||||||||||||||||| PPPPaaaaggggeeee 11118888 ssssaaaattttdddd((((4444)))) ssssaaaattttdddd((((4444)))) ___________________________________________________ RRRREEEECCCCOOOORRRRDDDD TTTTYYYYPPPPEEEE DDDDEEEEFFFFIIIINNNNIIIITTTTIIIIOOOONNNNSSSS __________________________________________________ RRRReeeeccccoooorrrrdddd TTTTyyyyppppeeee RRRReeeeccccoooorrrrdddd NNNNuuuummmmbbbbeeeerrrr __________________________________________________ SAT_BSDIPC_ADDRESS 64 __________________________________________________ SAT_BSDIPC_RESVPORT 65 __________________________________________________ SAT_BSDIPC_DELIVER 66 __________________________________________________ SAT_BSDIPC_CANTFIND 67 __________________________________________________ SAT_BSDIPC_SNOOP_OK 68 __________________________________________________ SAT_BSDIPC_SNOOP_FAIL 69 __________________________________________________ SAT_CLOCK_SET 70 __________________________________________________ SAT_HOSTNAME_SET 71 __________________________________________________ SAT_DOMAINNAME_SET 72 __________________________________________________ SAT_HOSTID_SET 73 __________________________________________________ SAT_CHECK_PRIV 80 __________________________________________________ SAT_CONTROL 81 __________________________________________________ SAT_SYS_NOTE 82 __________________________________________________ SAT_BSDIPC_DAC_CHANGE 87 __________________________________________________ SAT_BSDIPC_DAC_DENIED 88 __________________________________________________ SAT_BSDIPC_IF_SETUID 89 __________________________________________________ SAT_BSDIPC_RX_OK 90 __________________________________________________ SAT_BSDIPC_RX_RANGE 91 __________________________________________________ SAT_BSDIPC_RX_MISSING 92 __________________________________________________ SAT_BSDIPC_TX_OK 93 __________________________________________________ SAT_BSDIPC_TX_RANGE 94 __________________________________________________ SAT_BSDIPC_TX_TOOBIG 95 __________________________________________________ |||||||||||||||||||||||||||||||||||||||||||||||| ||||||||||||||||||||||||||||||||||||||||||||||| |||||||||||||||||||||||||||||||||||||||||||||||| PPPPaaaaggggeeee 11119999 ssssaaaattttdddd((((4444)))) ssssaaaattttdddd((((4444)))) ______________________________________________________ RRRREEEECCCCOOOORRRRDDDD TTTTYYYYPPPPEEEE DDDDEEEEFFFFIIIINNNNIIIITTTTIIIIOOOONNNNSSSS ______________________________________________________ RRRReeeeccccoooorrrrdddd TTTTyyyyppppeeee RRRReeeeccccoooorrrrdddd NNNNuuuummmmbbbbeeeerrrr ______________________________________________________ SAT_BSDIPC_IF_CONFIG 96 ______________________________________________________ SAT_BSDIPC_IF_INVALID 97 ______________________________________________________ SAT_BSDIPC_IF_SETLABEL 98 ______________________________________________________ SAT_USER_RECORDS 100 ______________________________________________________ SAT_AE_AUDIT 100 ______________________________________________________ SAT_AE_IDENTITY 101 ______________________________________________________ SAT_AE_DBEDIT 102 ______________________________________________________ SAT_AE_MOUNT 103 ______________________________________________________ SAT_AE_CUSTOM 104 ______________________________________________________ SAT_AE_LP 105 ______________________________________________________ SAT_AE_X_ALLOWED 106 ______________________________________________________ SAT_AE_X_DENIED 107 ______________________________________________________ SAT_SVR4NET_CREATE 120 ______________________________________________________ SAT_SVR4NET_ADDRESS 121 ______________________________________________________ SAT_SVR4NET_SHUTDOWN 122 ______________________________________________________ SAT_PROC_OWN_EXT_ATTR_WRITE 123 ______________________________________________________ SAT_NTYPES 130 ______________________________________________________ |||||||||||||||||||||||||||||||||||||| ||||||||||||||||||||||||||||||||||||| |||||||||||||||||||||||||||||||||||||| SSSSEEEEEEEE AAAALLLLSSSSOOOO satd(1M), sat_interpret(1M), sat_reduce(1M), sat_select(1M), sat_summarize(1M), satread(2). PPPPaaaaggggeeee 22220000