811 lines
23 KiB
Python
811 lines
23 KiB
Python
#!/usr/bin/python
|
|
# -*- coding: utf-8 -*-
|
|
#
|
|
# Copyright 2013 The Plaso Project Authors.
|
|
# Please see the AUTHORS file for details on individual authors.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
"""This file contains the Basic Security Module definitions."""
|
|
|
|
# Arbitrary tokens.
|
|
# Type of data to print in a BSM_TOKEN_DATA.
|
|
BSM_TOKEN_DATA_TYPE = {
|
|
0: u'AUR_CHAR',
|
|
1: u'AUR_SHORT',
|
|
2: u'AUR_INT32'}
|
|
|
|
BSM_TOKEN_DATA_PRINT = {
|
|
0: u'Binary',
|
|
1: u'Octal',
|
|
2: u'Decimal',
|
|
3: u'Hexadecimal',
|
|
4: u'String'}
|
|
|
|
# BSM identification errors.
|
|
BSM_ERRORS = {
|
|
0: u'Success',
|
|
1: u'Operation not permitted',
|
|
2: u'No such file or directory',
|
|
3: u'No such process',
|
|
4: u'Interrupted system call',
|
|
5: u'Input/output error',
|
|
6: u'Device not configured',
|
|
7: u'Argument list too long',
|
|
8: u'Exec format error',
|
|
9: u'Bad file descriptor',
|
|
10: u'No child processes',
|
|
11: u'Resource temporarily unavailable',
|
|
12: u'Cannot allocate memory',
|
|
13: u'Permission denied',
|
|
14: u'Bad address',
|
|
15: u'Block device required',
|
|
16: u'Device busy',
|
|
17: u'File exists',
|
|
18: u'ross-device link',
|
|
19: u'Operation not supported by device',
|
|
20: u'Not a directory',
|
|
21: u'Is a directory',
|
|
22: u'Invalid argument',
|
|
23: u'Too many open files in system',
|
|
24: u'Too many open files',
|
|
25: u'Inappropriate ioctl for device',
|
|
26: u'Text file busy',
|
|
27: u'File too large',
|
|
28: u'No space left on device',
|
|
29: u'Illegal seek',
|
|
30: u'Read-only file system',
|
|
31: u'Too many links',
|
|
32: u'Broken pipe',
|
|
33: u'Numerical argument out of domain',
|
|
34: u'Result too large',
|
|
35: u'No message of desired type',
|
|
36: u'Identifier removed',
|
|
45: u'Resource deadlock avoided',
|
|
46: u'No locks available',
|
|
47: u'Operation canceled',
|
|
48: u'Operation not supported',
|
|
49: u'Disc quota exceeded',
|
|
66: u'Too many levels of remote in path',
|
|
67: u'Link has been severed',
|
|
71: u'Protocol error',
|
|
74: u'Multihop attempted',
|
|
77: u'Bad message',
|
|
78: u'File name too long',
|
|
79: u'Value too large to be stored in data type',
|
|
88: u'Illegal byte sequence',
|
|
89: u'Function not implemented',
|
|
90: u'Too many levels of symbolic links',
|
|
91: u'Restart syscall',
|
|
93: u'Directory not empty',
|
|
94: u'Too many users',
|
|
95: u'Socket operation on non-socket',
|
|
96: u'Destination address required',
|
|
97: u'Message too long',
|
|
98: u'Protocol wrong type for socket',
|
|
99: u'Protocol not available',
|
|
120: u'Protocol not supported',
|
|
121: u'Socket type not supported',
|
|
122: u'Operation not supported',
|
|
123: u'Protocol family not supported',
|
|
124: u'Address family not supported by protocol family',
|
|
125: u'Address already in use',
|
|
126: u'Can\'t assign requested address',
|
|
127: u'Network is down',
|
|
128: u'Network unreachable',
|
|
129: u'Network dropped connection on reset',
|
|
130: u'Software caused connection abort',
|
|
131: u'Connection reset by peer',
|
|
132: u'No buffer space available',
|
|
133: u'Socket is already connected',
|
|
134: u'Socket is not connected',
|
|
143: u'Can\'t send after socket shutdown',
|
|
144: u'Too many references: can\'t splice',
|
|
145: u'Operation timed out',
|
|
146: u'Connection refused',
|
|
147: u'Host is down',
|
|
148: u'No route to host',
|
|
149: u'Operation already in progress',
|
|
150: u'Operation now in progress',
|
|
151: u'Stale NFS file handle',
|
|
190: u'PROCLIM',
|
|
191: u'BADRPC',
|
|
192: u'RPCMISMATCH',
|
|
193: u'PROGUNAVAIL',
|
|
194: u'PROGMISMATCH',
|
|
195: u'PROCUNAVAIL',
|
|
196: u'FTYPE',
|
|
197: u'AUTH',
|
|
198: u'NEEDAUTH',
|
|
199: u'NOATTR',
|
|
200: u'DOOFUS',
|
|
201: u'USTRETURN',
|
|
202: u'NOIOCTL',
|
|
203: u'DIRIOCTL',
|
|
204: u'PWROFF',
|
|
205: u'DEVERR',
|
|
206: u'BADEXEC',
|
|
207: u'BADARCH',
|
|
208: u'SHLIBVERS',
|
|
209: u'BADMACHO',
|
|
210: u'POLICY'}
|
|
|
|
# BSM network protocols. The informations comes from OpenBSD project,
|
|
# it might not be exacly.
|
|
BSM_PROTOCOLS = {
|
|
0: u'UNSPEC',
|
|
1: u'LOCAL',
|
|
2: u'INET',
|
|
3: u'IMPLINK',
|
|
4: u'PUP',
|
|
5: u'CHAOS',
|
|
6: u'NS',
|
|
8: u'ECMA',
|
|
9: u'DATAKIT',
|
|
10: u'CCITT',
|
|
11: u'SNA',
|
|
12: u'DECnet',
|
|
13: u'DLI',
|
|
14: u'LAT',
|
|
15: u'HYLINK',
|
|
16: u'APPLETALK',
|
|
19: u'OSI',
|
|
23: u'IPX',
|
|
24: u'ROUTE',
|
|
25: u'LINK',
|
|
26: u'INET6',
|
|
27: u'KEY',
|
|
500: u'NETBIOS',
|
|
501: u'ISO',
|
|
502: u'XTP',
|
|
503: u'COIP',
|
|
504: u'CNT',
|
|
505: u'RTIP',
|
|
506: u'SIP',
|
|
507: u'PIP',
|
|
508: u'ISDN',
|
|
509: u'E164',
|
|
510: u'NATM',
|
|
511: u'ATM',
|
|
512: u'NETGRAPH',
|
|
513: u'SLOW',
|
|
514: u'CLUSTER',
|
|
515: u'ARP',
|
|
516: u'BLUETOOTH'}
|
|
|
|
# key event types.
|
|
BSM_AUDIT_EVENT = {
|
|
0: u'indir system call',
|
|
1: u'exit(2)',
|
|
2: u'fork(2)',
|
|
3: u'open(2) - attr only',
|
|
4: u'creat(2)',
|
|
5: u'link(2)',
|
|
6: u'unlink(2)',
|
|
7: u'exec(2)',
|
|
8: u'chdir(2)',
|
|
9: u'mknod(2)',
|
|
10: u'chmod(2)',
|
|
11: u'chown(2)',
|
|
12: u'umount(2) - old version',
|
|
13: u'junk',
|
|
14: u'access(2)',
|
|
15: u'kill(2)',
|
|
16: u'stat(2)',
|
|
17: u'lstat(2)',
|
|
18: u'acct(2)',
|
|
19: u'mctl(2)',
|
|
20: u'reboot(2)',
|
|
21: u'symlink(2)',
|
|
22: u'readlink(2)',
|
|
23: u'execve(2)',
|
|
24: u'chroot(2)',
|
|
25: u'vfork(2)',
|
|
26: u'setgroups(2)',
|
|
27: u'setpgrp(2)',
|
|
28: u'swapon(2)',
|
|
29: u'sethostname(2)',
|
|
30: u'fcntl(2)',
|
|
31: u'setpriority(2)',
|
|
32: u'connect(2)',
|
|
33: u'accept(2)',
|
|
34: u'bind(2)',
|
|
35: u'setsockopt(2)',
|
|
36: u'vtrace(2)',
|
|
37: u'settimeofday(2)',
|
|
38: u'fchown(2)',
|
|
39: u'fchmod(2)',
|
|
40: u'setreuid(2)',
|
|
41: u'setregid(2)',
|
|
42: u'rename(2)',
|
|
43: u'truncate(2)',
|
|
44: u'ftruncate(2)',
|
|
45: u'flock(2)',
|
|
46: u'shutdown(2)',
|
|
47: u'mkdir(2)',
|
|
48: u'rmdir(2)',
|
|
49: u'utimes(2)',
|
|
50: u'adjtime(2)',
|
|
51: u'setrlimit(2)',
|
|
52: u'killpg(2)',
|
|
53: u'nfs_svc(2)',
|
|
54: u'statfs(2)',
|
|
55: u'fstatfs(2)',
|
|
56: u'unmount(2)',
|
|
57: u'async_daemon(2)',
|
|
58: u'nfs_getfh(2)',
|
|
59: u'setdomainname(2)',
|
|
60: u'quotactl(2)',
|
|
61: u'exportfs(2)',
|
|
62: u'mount(2)',
|
|
63: u'semsys(2)',
|
|
64: u'msgsys(2)',
|
|
65: u'shmsys(2)',
|
|
66: u'bsmsys(2)',
|
|
67: u'rfssys(2)',
|
|
68: u'fchdir(2)',
|
|
69: u'fchroot(2)',
|
|
70: u'vpixsys(2)',
|
|
71: u'pathconf(2)',
|
|
72: u'open(2) - read',
|
|
73: u'open(2) - read,creat',
|
|
74: u'open(2) - read,trunc',
|
|
75: u'open(2) - read,creat,trunc',
|
|
76: u'open(2) - write',
|
|
77: u'open(2) - write,creat',
|
|
78: u'open(2) - write,trunc',
|
|
79: u'open(2) - write,creat,trunc',
|
|
80: u'open(2) - read,write',
|
|
81: u'open(2) - read,write,creat',
|
|
82: u'open(2) - read,write,trunc',
|
|
83: u'open(2) - read,write,creat,trunc',
|
|
84: u'msgctl(2) - illegal command',
|
|
85: u'msgctl(2) - IPC_RMID command',
|
|
86: u'msgctl(2) - IPC_SET command',
|
|
87: u'msgctl(2) - IPC_STAT command',
|
|
88: u'msgget(2)',
|
|
89: u'msgrcv(2)',
|
|
90: u'msgsnd(2)',
|
|
91: u'shmctl(2) - illegal command',
|
|
92: u'shmctl(2) - IPC_RMID command',
|
|
93: u'shmctl(2) - IPC_SET command',
|
|
94: u'shmctl(2) - IPC_STAT command',
|
|
95: u'shmget(2)',
|
|
96: u'shmat(2)',
|
|
97: u'shmdt(2)',
|
|
98: u'semctl(2) - illegal command',
|
|
99: u'semctl(2) - IPC_RMID command',
|
|
100: u'semctl(2) - IPC_SET command',
|
|
101: u'semctl(2) - IPC_STAT command',
|
|
102: u'semctl(2) - GETNCNT command',
|
|
103: u'semctl(2) - GETPID command',
|
|
104: u'semctl(2) - GETVAL command',
|
|
105: u'semctl(2) - GETALL command',
|
|
106: u'semctl(2) - GETZCNT command',
|
|
107: u'semctl(2) - SETVAL command',
|
|
108: u'semctl(2) - SETALL command',
|
|
109: u'semget(2)',
|
|
110: u'semop(2)',
|
|
111: u'process dumped core',
|
|
112: u'close(2)',
|
|
113: u'system booted',
|
|
114: u'async_daemon(2) exited',
|
|
115: u'nfssvc(2) exited',
|
|
128: u'writel(2)',
|
|
129: u'writevl(2)',
|
|
130: u'getauid(2)',
|
|
131: u'setauid(2)',
|
|
132: u'getaudit(2)',
|
|
133: u'setaudit(2)',
|
|
134: u'getuseraudit(2)',
|
|
135: u'setuseraudit(2)',
|
|
136: u'auditsvc(2)',
|
|
137: u'audituser(2)',
|
|
138: u'auditon(2)',
|
|
139: u'auditon(2) - GETTERMID command',
|
|
140: u'auditon(2) - SETTERMID command',
|
|
141: u'auditon(2) - GPOLICY command',
|
|
142: u'auditon(2) - SPOLICY command',
|
|
143: u'auditon(2) - GESTATE command',
|
|
144: u'auditon(2) - SESTATE command',
|
|
145: u'auditon(2) - GQCTRL command',
|
|
146: u'auditon(2) - SQCTRL command',
|
|
147: u'getkernstate(2)',
|
|
148: u'setkernstate(2)',
|
|
149: u'getportaudit(2)',
|
|
150: u'auditstat(2)',
|
|
151: u'revoke(2)',
|
|
152: u'Solaris AUE_MAC',
|
|
153: u'enter prom',
|
|
154: u'exit prom',
|
|
155: u'Solaris AUE_IFLOAT',
|
|
156: u'Solaris AUE_PFLOAT',
|
|
157: u'Solaris AUE_UPRIV',
|
|
158: u'ioctl(2)',
|
|
173: u'one-sided session record',
|
|
174: u'msggetl(2)',
|
|
175: u'msgrcvl(2)',
|
|
176: u'msgsndl(2)',
|
|
177: u'semgetl(2)',
|
|
178: u'shmgetl(2)',
|
|
183: u'socket(2)',
|
|
184: u'sendto(2)',
|
|
185: u'pipe(2)',
|
|
186: u'socketpair(2)',
|
|
187: u'send(2)',
|
|
188: u'sendmsg(2)',
|
|
189: u'recv(2)',
|
|
190: u'recvmsg(2)',
|
|
191: u'recvfrom(2)',
|
|
192: u'read(2)',
|
|
193: u'getdents(2)',
|
|
194: u'lseek(2)',
|
|
195: u'write(2)',
|
|
196: u'writev(2)',
|
|
197: u'nfs server',
|
|
198: u'readv(2)',
|
|
199: u'Solaris old stat(2)',
|
|
200: u'setuid(2)',
|
|
201: u'old stime(2)',
|
|
202: u'old utime(2)',
|
|
203: u'old nice(2)',
|
|
204: u'Solaris old setpgrp(2)',
|
|
205: u'setgid(2)',
|
|
206: u'readl(2)',
|
|
207: u'readvl(2)',
|
|
208: u'fstat(2)',
|
|
209: u'dup2(2)',
|
|
210: u'mmap(2)',
|
|
211: u'audit(2)',
|
|
212: u'Solaris priocntlsys(2)',
|
|
213: u'munmap(2)',
|
|
214: u'setegid(2)',
|
|
215: u'seteuid(2)',
|
|
216: u'putmsg(2)',
|
|
217: u'getmsg(2)',
|
|
218: u'putpmsg(2)',
|
|
219: u'getpmsg(2)',
|
|
220: u'audit system calls place holder',
|
|
221: u'auditon(2) - get kernel mask',
|
|
222: u'auditon(2) - set kernel mask',
|
|
223: u'auditon(2) - get cwd',
|
|
224: u'auditon(2) - get car',
|
|
225: u'auditon(2) - get audit statistics',
|
|
226: u'auditon(2) - reset audit statistics',
|
|
227: u'auditon(2) - set mask per uid',
|
|
228: u'auditon(2) - set mask per session ID',
|
|
229: u'auditon(2) - get audit state',
|
|
230: u'auditon(2) - set audit state',
|
|
231: u'auditon(2) - get event class',
|
|
232: u'auditon(2) - set event class',
|
|
233: u'utssys(2) - fusers',
|
|
234: u'statvfs(2)',
|
|
235: u'xstat(2)',
|
|
236: u'lxstat(2)',
|
|
237: u'lchown(2)',
|
|
238: u'memcntl(2)',
|
|
239: u'sysinfo(2)',
|
|
240: u'xmknod(2)',
|
|
241: u'fork1(2)',
|
|
242: u'modctl(2) system call place holder',
|
|
243: u'modctl(2) - load module',
|
|
244: u'modctl(2) - unload module',
|
|
245: u'modctl(2) - configure module',
|
|
246: u'modctl(2) - bind module',
|
|
247: u'getmsg-accept',
|
|
248: u'putmsg-connect',
|
|
249: u'putmsg-send',
|
|
250: u'getmsg-receive',
|
|
251: u'acl(2) - SETACL comand',
|
|
252: u'facl(2) - SETACL command',
|
|
253: u'doorfs(2) - system call place holder',
|
|
254: u'doorfs(2) - DOOR_CALL',
|
|
255: u'doorfs(2) - DOOR_RETURN',
|
|
256: u'doorfs(2) - DOOR_CREATE',
|
|
257: u'doorfs(2) - DOOR_REVOKE',
|
|
258: u'doorfs(2) - DOOR_INFO',
|
|
259: u'doorfs(2) - DOOR_CRED',
|
|
260: u'doorfs(2) - DOOR_BIND',
|
|
261: u'doorfs(2) - DOOR_UNBIND',
|
|
262: u'p_online(2)',
|
|
263: u'processor_bind(2)',
|
|
264: u'inst_sync(2)',
|
|
265: u'configure socket',
|
|
266: u'setaudit_addr(2)',
|
|
267: u'getaudit_addr(2)',
|
|
268: u'Solaris umount(2)',
|
|
269: u'fsat(2) - place holder',
|
|
270: u'openat(2) - read',
|
|
271: u'openat(2) - read,creat',
|
|
272: u'openat(2) - read,trunc',
|
|
273: u'openat(2) - read,creat,trunc',
|
|
274: u'openat(2) - write',
|
|
275: u'openat(2) - write,creat',
|
|
276: u'openat(2) - write,trunc',
|
|
277: u'openat(2) - write,creat,trunc',
|
|
278: u'openat(2) - read,write',
|
|
279: u'openat(2) - read,write,create',
|
|
280: u'openat(2) - read,write,trunc',
|
|
281: u'openat(2) - read,write,creat,trunc',
|
|
282: u'renameat(2)',
|
|
283: u'fstatat(2)',
|
|
284: u'fchownat(2)',
|
|
285: u'futimesat(2)',
|
|
286: u'unlinkat(2)',
|
|
287: u'clock_settime(2)',
|
|
288: u'ntp_adjtime(2)',
|
|
289: u'setppriv(2)',
|
|
290: u'modctl(2) - configure device policy',
|
|
291: u'modctl(2) - configure additional privilege',
|
|
292: u'kernel cryptographic framework',
|
|
293: u'configure kernel SSL',
|
|
294: u'brandsys(2)',
|
|
295: u'Add IPsec policy rule',
|
|
296: u'Delete IPsec policy rule',
|
|
297: u'Clone IPsec policy',
|
|
298: u'Flip IPsec policy',
|
|
299: u'Flush IPsec policy rules',
|
|
300: u'Update IPsec algorithms',
|
|
301: u'portfs',
|
|
302: u'ptrace(2)',
|
|
303: u'chflags(2)',
|
|
304: u'fchflags(2)',
|
|
305: u'profil(2)',
|
|
306: u'ktrace(2)',
|
|
307: u'setlogin(2)',
|
|
308: u'reboot(2)',
|
|
309: u'revoke(2)',
|
|
310: u'umask(2)',
|
|
311: u'mprotect(2)',
|
|
312: u'setpriority(2)',
|
|
313: u'settimeofday(2)',
|
|
314: u'flock(2)',
|
|
315: u'mkfifo(2)',
|
|
316: u'poll(2)',
|
|
317: u'socketpair(2)',
|
|
318: u'futimes(2)',
|
|
319: u'setsid(2)',
|
|
320: u'setprivexec(2)',
|
|
321: u'nfssvc(2)',
|
|
322: u'getfh(2)',
|
|
323: u'quotactl(2)',
|
|
324: u'add_profil()',
|
|
325: u'kdebug_trace()',
|
|
326: u'fstat(2)',
|
|
327: u'fpathconf(2)',
|
|
328: u'getdirentries(2)',
|
|
329: u'truncate(2)',
|
|
330: u'ftruncate(2)',
|
|
331: u'sysctl(3)',
|
|
332: u'mlock(2)',
|
|
333: u'munlock(2)',
|
|
334: u'undelete(2)',
|
|
335: u'getattrlist()',
|
|
336: u'setattrlist()',
|
|
337: u'getdirentriesattr()',
|
|
338: u'exchangedata()',
|
|
339: u'searchfs()',
|
|
340: u'minherit(2)',
|
|
341: u'semconfig()',
|
|
342: u'sem_open(2)',
|
|
343: u'sem_close(2)',
|
|
344: u'sem_unlink(2)',
|
|
345: u'shm_open(2)',
|
|
346: u'shm_unlink(2)',
|
|
347: u'load_shared_file()',
|
|
348: u'reset_shared_file()',
|
|
349: u'new_system_share_regions()',
|
|
350: u'pthread_kill(2)',
|
|
351: u'pthread_sigmask(2)',
|
|
352: u'auditctl(2)',
|
|
353: u'rfork(2)',
|
|
354: u'lchmod(2)',
|
|
355: u'swapoff(2)',
|
|
356: u'init_process()',
|
|
357: u'map_fd()',
|
|
358: u'task_for_pid()',
|
|
359: u'pid_for_task()',
|
|
360: u'sysctl() - non-admin',
|
|
361: u'copyfile()',
|
|
43001: u'getfsstat(2)',
|
|
43002: u'ptrace(2)',
|
|
43003: u'chflags(2)',
|
|
43004: u'fchflags(2)',
|
|
43005: u'profil(2)',
|
|
43006: u'ktrace(2)',
|
|
43007: u'setlogin(2)',
|
|
43008: u'revoke(2)',
|
|
43009: u'umask(2)',
|
|
43010: u'mprotect(2)',
|
|
43011: u'mkfifo(2)',
|
|
43012: u'poll(2)',
|
|
43013: u'futimes(2)',
|
|
43014: u'setsid(2)',
|
|
43015: u'setprivexec(2)',
|
|
43016: u'add_profil()',
|
|
43017: u'kdebug_trace()',
|
|
43018: u'fstat(2)',
|
|
43019: u'fpathconf(2)',
|
|
43020: u'getdirentries(2)',
|
|
43021: u'sysctl(3)',
|
|
43022: u'mlock(2)',
|
|
43023: u'munlock(2)',
|
|
43024: u'undelete(2)',
|
|
43025: u'getattrlist()',
|
|
43026: u'setattrlist()',
|
|
43027: u'getdirentriesattr()',
|
|
43028: u'exchangedata()',
|
|
43029: u'searchfs()',
|
|
43030: u'minherit(2)',
|
|
43031: u'semconfig()',
|
|
43032: u'sem_open(2)',
|
|
43033: u'sem_close(2)',
|
|
43034: u'sem_unlink(2)',
|
|
43035: u'shm_open(2)',
|
|
43036: u'shm_unlink(2)',
|
|
43037: u'load_shared_file()',
|
|
43038: u'reset_shared_file()',
|
|
43039: u'new_system_share_regions()',
|
|
43040: u'pthread_kill(2)',
|
|
43041: u'pthread_sigmask(2)',
|
|
43042: u'auditctl(2)',
|
|
43043: u'rfork(2)',
|
|
43044: u'lchmod(2)',
|
|
43045: u'swapoff(2)',
|
|
43046: u'init_process()',
|
|
43047: u'map_fd()',
|
|
43048: u'task_for_pid()',
|
|
43049: u'pid_for_task()',
|
|
43050: u'sysctl() - non-admin',
|
|
43051: u'copyfile(2)',
|
|
43052: u'lutimes(2)',
|
|
43053: u'lchflags(2)',
|
|
43054: u'sendfile(2)',
|
|
43055: u'uselib(2)',
|
|
43056: u'getresuid(2)',
|
|
43057: u'setresuid(2)',
|
|
43058: u'getresgid(2)',
|
|
43059: u'setresgid(2)',
|
|
43060: u'wait4(2)',
|
|
43061: u'lgetfh(2)',
|
|
43062: u'fhstatfs(2)',
|
|
43063: u'fhopen(2)',
|
|
43064: u'fhstat(2)',
|
|
43065: u'jail(2)',
|
|
43066: u'eaccess(2)',
|
|
43067: u'kqueue(2)',
|
|
43068: u'kevent(2)',
|
|
43069: u'fsync(2)',
|
|
43070: u'nmount(2)',
|
|
43071: u'bdflush(2)',
|
|
43072: u'setfsuid(2)',
|
|
43073: u'setfsgid(2)',
|
|
43074: u'personality(2)',
|
|
43075: u'getscheduler(2)',
|
|
43076: u'setscheduler(2)',
|
|
43077: u'prctl(2)',
|
|
43078: u'getcwd(2)',
|
|
43079: u'capget(2)',
|
|
43080: u'capset(2)',
|
|
43081: u'pivot_root(2)',
|
|
43082: u'rtprio(2)',
|
|
43083: u'sched_getparam(2)',
|
|
43084: u'sched_setparam(2)',
|
|
43085: u'sched_get_priority_max(2)',
|
|
43086: u'sched_get_priority_min(2)',
|
|
43087: u'sched_rr_get_interval(2)',
|
|
43088: u'acl_get_file(2)',
|
|
43089: u'acl_set_file(2)',
|
|
43090: u'acl_get_fd(2)',
|
|
43091: u'acl_set_fd(2)',
|
|
43092: u'acl_delete_file(2)',
|
|
43093: u'acl_delete_fd(2)',
|
|
43094: u'acl_aclcheck_file(2)',
|
|
43095: u'acl_aclcheck_fd(2)',
|
|
43096: u'acl_get_link(2)',
|
|
43097: u'acl_set_link(2)',
|
|
43098: u'acl_delete_link(2)',
|
|
43099: u'acl_aclcheck_link(2)',
|
|
43100: u'sysarch(2)',
|
|
43101: u'extattrctl(2)',
|
|
43102: u'extattr_get_file(2)',
|
|
43103: u'extattr_set_file(2)',
|
|
43104: u'extattr_list_file(2)',
|
|
43105: u'extattr_delete_file(2)',
|
|
43106: u'extattr_get_fd(2)',
|
|
43107: u'extattr_set_fd(2)',
|
|
43108: u'extattr_list_fd(2)',
|
|
43109: u'extattr_delete_fd(2)',
|
|
43110: u'extattr_get_link(2)',
|
|
43111: u'extattr_set_link(2)',
|
|
43112: u'extattr_list_link(2)',
|
|
43113: u'extattr_delete_link(2)',
|
|
43114: u'kenv(8)',
|
|
43115: u'jail_attach(2)',
|
|
43116: u'sysctl(3)',
|
|
43117: u'linux ioperm',
|
|
43118: u'readdir(3)',
|
|
43119: u'linux iopl',
|
|
43120: u'linux vm86',
|
|
43121: u'mac_get_proc(2)',
|
|
43122: u'mac_set_proc(2)',
|
|
43123: u'mac_get_fd(2)',
|
|
43124: u'mac_get_file(2)',
|
|
43125: u'mac_set_fd(2)',
|
|
43126: u'mac_set_file(2)',
|
|
43127: u'mac_syscall(2)',
|
|
43128: u'mac_get_pid(2)',
|
|
43129: u'mac_get_link(2)',
|
|
43130: u'mac_set_link(2)',
|
|
43131: u'mac_execve(2)',
|
|
43132: u'getpath_fromfd(2)',
|
|
43133: u'getpath_fromaddr(2)',
|
|
43134: u'mq_open(2)',
|
|
43135: u'mq_setattr(2)',
|
|
43136: u'mq_timedreceive(2)',
|
|
43137: u'mq_timedsend(2)',
|
|
43138: u'mq_notify(2)',
|
|
43139: u'mq_unlink(2)',
|
|
43140: u'listen(2)',
|
|
43141: u'mlockall(2)',
|
|
43142: u'munlockall(2)',
|
|
43143: u'closefrom(2)',
|
|
43144: u'fexecve(2)',
|
|
43145: u'faccessat(2)',
|
|
43146: u'fchmodat(2)',
|
|
43147: u'linkat(2)',
|
|
43148: u'mkdirat(2)',
|
|
43149: u'mkfifoat(2)',
|
|
43150: u'mknodat(2)',
|
|
43151: u'readlinkat(2)',
|
|
43152: u'symlinkat(2)',
|
|
43153: u'mac_getfsstat(2)',
|
|
43154: u'mac_get_mount(2)',
|
|
43155: u'mac_get_lcid(2)',
|
|
43156: u'mac_get_lctx(2)',
|
|
43157: u'mac_set_lctx(2)',
|
|
43158: u'mac_mount(2)',
|
|
43159: u'getlcid(2)',
|
|
43160: u'setlcid(2)',
|
|
43161: u'taskname_for_pid()',
|
|
43162: u'access_extended(2)',
|
|
43163: u'chmod_extended(2)',
|
|
43164: u'fchmod_extended(2)',
|
|
43165: u'fstat_extended(2)',
|
|
43166: u'lstat_extended(2)',
|
|
43167: u'mkdir_extended(2)',
|
|
43168: u'mkfifo_extended(2)',
|
|
43169: u'open_extended(2) - attr only',
|
|
43170: u'open_extended(2) - read',
|
|
43171: u'open_extended(2) - read,creat',
|
|
43172: u'open_extended(2) - read,trunc',
|
|
43173: u'open_extended(2) - read,creat,trunc',
|
|
43174: u'open_extended(2) - write',
|
|
43175: u'open_extended(2) - write,creat',
|
|
43176: u'open_extended(2) - write,trunc',
|
|
43177: u'open_extended(2) - write,creat,trunc',
|
|
43178: u'open_extended(2) - read,write',
|
|
43179: u'open_extended(2) - read,write,creat',
|
|
43180: u'open_extended(2) - read,write,trunc',
|
|
43181: u'open_extended(2) - read,write,creat,trunc',
|
|
43182: u'stat_extended(2)',
|
|
43183: u'umask_extended(2)',
|
|
43184: u'openat(2) - attr only',
|
|
43185: u'posix_openpt(2)',
|
|
43186: u'cap_new(2)',
|
|
43187: u'cap_getrights(2)',
|
|
43188: u'cap_enter(2)',
|
|
43189: u'cap_getmode(2)',
|
|
43190: u'posix_spawn(2)',
|
|
43191: u'fsgetpath(2)',
|
|
43192: u'pread(2)',
|
|
43193: u'pwrite(2)',
|
|
43194: u'fsctl()',
|
|
43195: u'ffsctl()',
|
|
43196: u'lpathconf(2)',
|
|
43197: u'pdfork(2)',
|
|
43198: u'pdkill(2)',
|
|
43199: u'pdgetpid(2)',
|
|
43200: u'pdwait(2)',
|
|
44901: u'session start',
|
|
44902: u'session update',
|
|
44903: u'session end',
|
|
44904: u'session close',
|
|
6144: u'at-create atjob',
|
|
6145: u'at-delete atjob (at or atrm)',
|
|
6146: u'at-permission',
|
|
6147: u'cron-invoke',
|
|
6148: u'crontab-crontab created',
|
|
6149: u'crontab-crontab deleted',
|
|
6150: u'crontab-permission',
|
|
6151: u'inetd connection',
|
|
6152: u'login - local',
|
|
6153: u'logout - local',
|
|
6154: u'login - telnet',
|
|
6155: u'login - rlogin',
|
|
6156: u'mount',
|
|
6157: u'unmount',
|
|
6158: u'rsh access',
|
|
6159: u'su(1)',
|
|
6160: u'system halt',
|
|
6161: u'system reboot',
|
|
6162: u'rexecd',
|
|
6163: u'passwd',
|
|
6164: u'rexd',
|
|
6165: u'ftp access',
|
|
6166: u'init',
|
|
6167: u'uadmin',
|
|
6168: u'system shutdown',
|
|
6170: u'crontab-modify',
|
|
6171: u'ftp logout',
|
|
6172: u'login - ssh',
|
|
6173: u'role login',
|
|
6180: u' profile command',
|
|
6181: u'add filesystem',
|
|
6182: u'delete filesystem',
|
|
6183: u'modify filesystem',
|
|
6200: u'allocate-device success',
|
|
6201: u'allocate-device failure',
|
|
6202: u'deallocate-device success',
|
|
6203: u'deallocate-device failure',
|
|
6204: u'allocate-list devices success',
|
|
6205: u'allocate-list devices failure',
|
|
6207: u'create user',
|
|
6208: u'modify user',
|
|
6209: u'delete user',
|
|
6210: u'disable user',
|
|
6211: u'enable user',
|
|
6212: u'newgrp login',
|
|
6213: u'admin login',
|
|
6214: u'authenticated kadmind request',
|
|
6215: u'unauthenticated kadmind req',
|
|
6216: u'kdc authentication svc request',
|
|
6217: u'kdc tkt-grant svc request',
|
|
6218: u'kdc tgs 2ndtkt mismtch',
|
|
6219: u'kdc tgs issue alt tgt',
|
|
6300: u'sudo(1)',
|
|
6501: u'modify password',
|
|
6511: u'create group',
|
|
6512: u'delete group',
|
|
6513: u'modify group',
|
|
6514: u'add to group',
|
|
6515: u'remove from group',
|
|
6521: u'revoke object priv',
|
|
6600: u'loginwindow login',
|
|
6601: u'loginwindow logout',
|
|
7000: u'user authentication',
|
|
7001: u'SecSrvr connection setup',
|
|
7002: u'SecSrvr AuthEngine',
|
|
7003: u'SecSrvr authinternal mech',
|
|
32800: u'OpenSSH login',
|
|
45000: u'audit startup',
|
|
45001: u'audit shutdown',
|
|
45014: u'modify password',
|
|
45015: u'create group',
|
|
45016: u'delete group',
|
|
45017: u'modify group',
|
|
45018: u'add to group',
|
|
45019: u'remove from group',
|
|
45020: u'revoke object priv',
|
|
45021: u'loginwindow login',
|
|
45022: u'loginwindow logout',
|
|
45023: u'user authentication',
|
|
45024: u'SecSrvr connection setup',
|
|
45025: u'SecSrvr AuthEngine',
|
|
45026: u'SecSrvr authinternal mech',
|
|
45027: u'Calife',
|
|
45028: u'sudo(1)',
|
|
45029: u'audit crash recovery',
|
|
45030: u'SecSrvr AuthMechanism',
|
|
45031: u'Security Assessment'
|
|
}
|