2 * Copyright (c) 2004-2008 Apple Inc.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. Neither the name of Apple Inc. ("Apple") nor the names of
14 * its contributors may be used to endorse or promote products derived
15 * from this software without specific prior written permission.
17 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
21 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
25 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
26 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
27 * POSSIBILITY OF SUCH DAMAGE.
30 #ifndef _BSM_AUDIT_UEVENTS_H_
31 #define _BSM_AUDIT_UEVENTS_H_
34 * Solaris userspace events.
36 #define AUE_at_create 6144
37 #define AUE_at_delete 6145
38 #define AUE_at_perm 6146
39 #define AUE_cron_invoke 6147
40 #define AUE_crontab_create 6148
41 #define AUE_crontab_delete 6149
42 #define AUE_crontab_perm 6150
43 #define AUE_inetd_connect 6151
44 #define AUE_login 6152
45 #define AUE_logout 6153
46 #define AUE_telnet 6154
47 #define AUE_rlogin 6155
48 #define AUE_mountd_mount 6156
49 #define AUE_mountd_umount 6157
53 #define AUE_reboot 6161
54 #define AUE_rexecd 6162
55 #define AUE_passwd 6163
59 #define AUE_uadmin 6167
60 #define AUE_shutdown 6168
61 #define AUE_poweroff 6169
62 #define AUE_crontab_mod 6170
63 #define AUE_ftpd_logout 6171
65 #define AUE_role_login 6173
66 #define AUE_prof_cmd 6180
67 #define AUE_filesystem_add 6181
68 #define AUE_filesystem_delete 6182
69 #define AUE_filesystem_modify 6183
70 #define AUE_allocate_succ 6200
71 #define AUE_allocate_fail 6201
72 #define AUE_deallocate_succ 6202
73 #define AUE_deallocate_fail 6203
74 #define AUE_listdevice_succ 6205
75 #define AUE_listdevice_fail 6206
76 #define AUE_create_user 6207
77 #define AUE_modify_user 6208
78 #define AUE_delete_user 6209
79 #define AUE_disable_user 6210
80 #define AUE_enable_user 6211
81 #define AUE_newgrp_login 6212
82 #define AUE_admin_authentication 6213
83 #define AUE_kadmind_auth 6214
84 #define AUE_kadmind_unauth 6215
85 #define AUE_krb5kdc_as_req 6216
86 #define AUE_krb5kdc_tgs_req 6217
87 #define AUE_krb5kdc_tgs_req_2ndtktmm 6218
88 #define AUE_krb5kdc_tgs_req_alt_tgt 6219
91 * Historic Darwin use of the low event numbering space, which collided with
92 * the Solaris event space. Now obsoleted and new, higher, event numbers
93 * assigned to make it easier to interpret Solaris events using the OpenBSM
96 #define AUE_DARWIN_audit_startup 6171
97 #define AUE_DARWIN_audit_shutdown 6172
98 #define AUE_DARWIN_sudo 6300
99 #define AUE_DARWIN_modify_password 6501
100 #define AUE_DARWIN_create_group 6511
101 #define AUE_DARWIN_delete_group 6512
102 #define AUE_DARWIN_modify_group 6513
103 #define AUE_DARWIN_add_to_group 6514
104 #define AUE_DARWIN_remove_from_group 6515
105 #define AUE_DARWIN_revoke_obj 6521
106 #define AUE_DARWIN_lw_login 6600
107 #define AUE_DARWIN_lw_logout 6601
108 #define AUE_DARWIN_auth_user 7000
109 #define AUE_DARWIN_ssconn 7001
110 #define AUE_DARWIN_ssauthorize 7002
111 #define AUE_DARWIN_ssauthint 7003
114 * Historic/third-party appliation allocations of event idenfiers.
116 #define AUE_openssh 32800
119 * OpenBSM-managed application event space.
121 #define AUE_audit_startup 45000 /* Darwin-specific. */
122 #define AUE_audit_shutdown 45001 /* Darwin-specific. */
123 #define AUE_modify_password 45014 /* Darwin-specific. */
124 #define AUE_create_group 45015 /* Darwin-specific. */
125 #define AUE_delete_group 45016 /* Darwin-specific. */
126 #define AUE_modify_group 45017 /* Darwin-specific. */
127 #define AUE_add_to_group 45018 /* Darwin-specific. */
128 #define AUE_remove_from_group 45019 /* Darwin-specific. */
129 #define AUE_revoke_obj 45020 /* Darwin-specific. */
130 #define AUE_lw_login 45021 /* Darwin-specific. */
131 #define AUE_lw_logout 45022 /* Darwin-specific. */
132 #define AUE_auth_user 45023 /* Darwin-specific. */
133 #define AUE_ssconn 45024 /* Darwin-specific. */
134 #define AUE_ssauthorize 45025 /* Darwin-specific. */
135 #define AUE_ssauthint 45026 /* Darwin-specific. */
136 #define AUE_calife 45027 /* OpenBSM-allocated. */
137 #define AUE_sudo 45028 /* OpenBSM-allocated. */
138 #define AUE_audit_recovery 45029 /* OpenBSM-allocated. */
139 #define AUE_ssauthmech 45030 /* Darwin-specific. */
141 #endif /* !_BSM_AUDIT_UEVENTS_H_ */