Date: Mon, 8 Dec 2008 11:09:12 GMT From: Robert Watson <rwatson@FreeBSD.org> To: Perforce Change Reviews <perforce@freebsd.org> Subject: PERFORCE change 154328 for review Message-ID: <200812081109.mB8B9CUR029216@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
http://perforce.freebsd.org/chv.cgi?CH=154328 Change 154328 by rwatson@rwatson_cinnamon_macosx on 2008/12/08 11:08:37 Document current thinking on the allocation of BSM event identifiers. Affected files ... .. //depot/projects/trustedbsd/openbsm/etc/audit_event#32 edit Differences ... ==== //depot/projects/trustedbsd/openbsm/etc/audit_event#32 (text+ko) ==== @@ -1,5 +1,5 @@ # -# $P4: //depot/projects/trustedbsd/openbsm/etc/audit_event#31 $ +# $P4: //depot/projects/trustedbsd/openbsm/etc/audit_event#32 $ # # The mapping between event identifiers and values is also hard-coded in # audit_kevents.h and audit_uevents.h, so changes must occur in both places, @@ -7,6 +7,20 @@ # those changes. It is advisable not to change the numbering or naming of # kernel audit events. # +# Allocation of BSM event identifier ranges: +# +# 0 Reserved and invalid +# 1 - 2047 Reserved for Solaris kernel events +# 2048 - 5999 Reserved and unallocated +# 6000 - 9999 Reserved for Solaris user events +# 10000 - 32767 Reserved and unallocated +# 32768 - 65535 Available for third party applications +# +# Of the third party range, OpenBSM allocates from the following ranges: +# +# 43000 - 44999 Reserved for OpenBSM kernel events +# 45000 - 46999 Reserved for OpenBSM application events +# 0:AUE_NULL:indir system call:no 1:AUE_EXIT:exit(2):pc 2:AUE_FORK:fork(2):pc
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200812081109.mB8B9CUR029216>