audit_kevents.h   [plain text]

/*-
 * Copyright (c) 2005-2017 Apple Inc.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1.  Redistributions of source code must retain the above copyright
 *     notice, this list of conditions and the following disclaimer.
 * 2.  Redistributions in binary form must reproduce the above copyright
 *     notice, this list of conditions and the following disclaimer in the
 *     documentation and/or other materials provided with the distribution.
 * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
 *     its contributors may be used to endorse or promote products derived
 *     from this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 * $P4: //depot/projects/trustedbsd/openbsm/sys/bsm/audit_kevents.h#6 $
 */

#ifndef _BSM_AUDIT_KEVENTS_H_
#define _BSM_AUDIT_KEVENTS_H_

/*
 * The reserved event numbers for kernel events are 1...2047 and 43001..44900.
 */
#define AUE_IS_A_KEVENT(e)      (((e) > 0 && (e) < 2048) ||     \
	                         ((e) > 43000 && (e) < 44901))

/*
 * Values marked as AUE_NULL are not required to be audited as per CAPP.
 *
 * Some conflicts exist in the assignment of name to event number mappings
 * between BSM implementations.  In general, we prefer the OpenSolaris
 * definition as we consider Solaris BSM to be authoritative.  _DARWIN_ has
 * been inserted for the Darwin variants.  If necessary, other tags will be
 * added in the future.
 */
#define AUE_NULL                0
#define AUE_EXIT                1
#define AUE_FORK                2
#define AUE_FORKALL             AUE_FORK        /* Solaris-specific. */
#define AUE_OPEN                3
#define AUE_CREAT               4
#define AUE_LINK                5
#define AUE_UNLINK              6
#define AUE_DELETE              AUE_UNLINK      /* Darwin-specific. */
#define AUE_EXEC                7
#define AUE_CHDIR               8
#define AUE_MKNOD               9
#define AUE_CHMOD               10
#define AUE_CHOWN               11
#define AUE_UMOUNT              12
#define AUE_JUNK                13      /* Solaris-specific. */
#define AUE_ACCESS              14
#define AUE_KILL                15
#define AUE_STAT                16
#define AUE_LSTAT               17
#define AUE_ACCT                18
#define AUE_MCTL                19      /* Solaris-specific. */
#define AUE_REBOOT              20      /* XXX: Darwin conflict. */
#define AUE_SYMLINK             21
#define AUE_READLINK            22
#define AUE_EXECVE              23
#define AUE_CHROOT              24
#define AUE_VFORK               25
#define AUE_SETGROUPS           26
#define AUE_SETPGRP             27
#define AUE_SWAPON              28
#define AUE_SETHOSTNAME         29      /* XXX: Darwin conflict. */
#define AUE_FCNTL               30
#define AUE_SETPRIORITY         31      /* XXX: Darwin conflict. */
#define AUE_CONNECT             32
#define AUE_ACCEPT              33
#define AUE_BIND                34
#define AUE_SETSOCKOPT          35
#define AUE_VTRACE              36      /* Solaris-specific. */
#define AUE_SETTIMEOFDAY        37      /* XXX: Darwin conflict. */
#define AUE_FCHOWN              38
#define AUE_FCHMOD              39
#define AUE_SETREUID            40
#define AUE_SETREGID            41
#define AUE_RENAME              42
#define AUE_TRUNCATE            43      /* XXX: Darwin conflict. */
#define AUE_FTRUNCATE           44      /* XXX: Darwin conflict. */
#define AUE_FLOCK               45      /* XXX: Darwin conflict. */
#define AUE_SHUTDOWN            46
#define AUE_MKDIR               47
#define AUE_RMDIR               48
#define AUE_UTIMES              49
#define AUE_ADJTIME             50
#define AUE_SETRLIMIT           51
#define AUE_KILLPG              52
#define AUE_NFS_SVC             53      /* XXX: Darwin conflict. */
#define AUE_STATFS              54
#define AUE_FSTATFS             55
#define AUE_UNMOUNT             56      /* XXX: Darwin conflict. */
#define AUE_ASYNC_DAEMON        57
#define AUE_NFS_GETFH           58      /* XXX: Darwin conflict. */
#define AUE_SETDOMAINNAME       59
#define AUE_QUOTACTL            60      /* XXX: Darwin conflict. */
#define AUE_EXPORTFS            61
#define AUE_MOUNT               62
#define AUE_SEMSYS              63
#define AUE_MSGSYS              64
#define AUE_SHMSYS              65
#define AUE_BSMSYS              66      /* Solaris-specific. */
#define AUE_RFSSYS              67      /* Solaris-specific. */
#define AUE_FCHDIR              68
#define AUE_FCHROOT             69
#define AUE_VPIXSYS             70      /* Solaris-specific. */
#define AUE_PATHCONF            71
#define AUE_OPEN_R              72
#define AUE_OPEN_RC             73
#define AUE_OPEN_RT             74
#define AUE_OPEN_RTC            75
#define AUE_OPEN_W              76
#define AUE_OPEN_WC             77
#define AUE_OPEN_WT             78
#define AUE_OPEN_WTC            79
#define AUE_OPEN_RW             80
#define AUE_OPEN_RWC            81
#define AUE_OPEN_RWT            82
#define AUE_OPEN_RWTC           83
#define AUE_MSGCTL              84
#define AUE_MSGCTL_RMID         85
#define AUE_MSGCTL_SET          86
#define AUE_MSGCTL_STAT         87
#define AUE_MSGGET              88
#define AUE_MSGRCV              89
#define AUE_MSGSND              90
#define AUE_SHMCTL              91
#define AUE_SHMCTL_RMID         92
#define AUE_SHMCTL_SET          93
#define AUE_SHMCTL_STAT         94
#define AUE_SHMGET              95
#define AUE_SHMAT               96
#define AUE_SHMDT               97
#define AUE_SEMCTL              98
#define AUE_SEMCTL_RMID         99
#define AUE_SEMCTL_SET          100
#define AUE_SEMCTL_STAT         101
#define AUE_SEMCTL_GETNCNT      102
#define AUE_SEMCTL_GETPID       103
#define AUE_SEMCTL_GETVAL       104
#define AUE_SEMCTL_GETALL       105
#define AUE_SEMCTL_GETZCNT      106
#define AUE_SEMCTL_SETVAL       107
#define AUE_SEMCTL_SETALL       108
#define AUE_SEMGET              109
#define AUE_SEMOP               110
#define AUE_CORE                111     /* Solaris-specific, currently. */
#define AUE_CLOSE               112
#define AUE_SYSTEMBOOT          113     /* Solaris-specific. */
#define AUE_ASYNC_DAEMON_EXIT   114     /* Solaris-specific. */
#define AUE_NFSSVC_EXIT         115     /* Solaris-specific. */
#define AUE_WRITEL              128     /* Solaris-specific. */
#define AUE_WRITEVL             129     /* Solaris-specific. */
#define AUE_GETAUID             130
#define AUE_SETAUID             131
#define AUE_GETAUDIT            132
#define AUE_SETAUDIT            133
#define AUE_GETUSERAUDIT        134     /* Solaris-specific. */
#define AUE_SETUSERAUDIT        135     /* Solaris-specific. */
#define AUE_AUDITSVC            136     /* Solaris-specific. */
#define AUE_AUDITUSER           137     /* Solaris-specific. */
#define AUE_AUDITON             138
#define AUE_AUDITON_GTERMID     139     /* Solaris-specific. */
#define AUE_AUDITON_STERMID     140     /* Solaris-specific. */
#define AUE_AUDITON_GPOLICY     141
#define AUE_AUDITON_SPOLICY     142
#define AUE_AUDITON_GQCTRL      145
#define AUE_AUDITON_SQCTRL      146
#define AUE_GETKERNSTATE        147     /* Solaris-specific. */
#define AUE_SETKERNSTATE        148     /* Solaris-specific. */
#define AUE_GETPORTAUDIT        149     /* Solaris-specific. */
#define AUE_AUDITSTAT           150     /* Solaris-specific. */
#define AUE_REVOKE              151
#define AUE_MAC                 152     /* Solaris-specific. */
#define AUE_ENTERPROM           153     /* Solaris-specific. */
#define AUE_EXITPROM            154     /* Solaris-specific. */
#define AUE_IFLOAT              155     /* Solaris-specific. */
#define AUE_PFLOAT              156     /* Solaris-specific. */
#define AUE_UPRIV               157     /* Solaris-specific. */
#define AUE_IOCTL               158
#define AUE_SOCKET              183
#define AUE_SENDTO              184
#define AUE_PIPE                185
#define AUE_SOCKETPAIR          186     /* XXX: Darwin conflict. */
#define AUE_SEND                187
#define AUE_SENDMSG             188
#define AUE_RECV                189
#define AUE_RECVMSG             190
#define AUE_RECVFROM            191
#define AUE_READ                192
#define AUE_GETDENTS            193
#define AUE_LSEEK               194
#define AUE_WRITE               195
#define AUE_WRITEV              196
#define AUE_NFS                 197     /* Solaris-specific. */
#define AUE_READV               198
#define AUE_OSTAT               199     /* Solaris-specific. */
#define AUE_SETUID              200     /* XXXRW: Solaris old setuid? */
#define AUE_STIME               201     /* XXXRW: Solaris old stime? */
#define AUE_UTIME               202     /* XXXRW: Solaris old utime? */
#define AUE_NICE                203     /* XXXRW: Solaris old nice? */
#define AUE_OSETPGRP            204     /* Solaris-specific. */
#define AUE_SETGID              205
#define AUE_READL               206     /* Solaris-specific. */
#define AUE_READVL              207     /* Solaris-specific. */
#define AUE_FSTAT               208
#define AUE_DUP2                209
#define AUE_MMAP                210
#define AUE_AUDIT               211
#define AUE_PRIOCNTLSYS         212     /* Solaris-specific. */
#define AUE_MUNMAP              213
#define AUE_SETEGID             214
#define AUE_SETEUID             215
#define AUE_PUTMSG              216     /* Solaris-specific. */
#define AUE_GETMSG              217     /* Solaris-specific. */
#define AUE_PUTPMSG             218     /* Solaris-specific. */
#define AUE_GETPMSG             219     /* Solaris-specific. */
#define AUE_AUDITSYS            220     /* Solaris-specific. */
#define AUE_AUDITON_GETKMASK    221
#define AUE_AUDITON_SETKMASK    222
#define AUE_AUDITON_GETCWD      223
#define AUE_AUDITON_GETCAR      224
#define AUE_AUDITON_GETSTAT     225
#define AUE_AUDITON_SETSTAT     226
#define AUE_AUDITON_SETUMASK    227
#define AUE_AUDITON_SETSMASK    228
#define AUE_AUDITON_GETCOND     229
#define AUE_AUDITON_SETCOND     230
#define AUE_AUDITON_GETCLASS    231
#define AUE_AUDITON_SETCLASS    232
#define AUE_FUSERS              233     /* Solaris-specific; also UTSSYS? */
#define AUE_STATVFS             234
#define AUE_XSTAT               235     /* Solaris-specific. */
#define AUE_LXSTAT              236     /* Solaris-specific. */
#define AUE_LCHOWN              237
#define AUE_MEMCNTL             238     /* Solaris-specific. */
#define AUE_SYSINFO             239     /* Solaris-specific. */
#define AUE_XMKNOD              240     /* Solaris-specific. */
#define AUE_FORK1               241
#define AUE_MODCTL              242     /* Solaris-specific. */
#define AUE_MODLOAD             243
#define AUE_MODUNLOAD           244
#define AUE_MODCONFIG           245     /* Solaris-specific. */
#define AUE_MODADDMAJ           246     /* Solaris-specific. */
#define AUE_SOCKACCEPT          247     /* Solaris-specific. */
#define AUE_SOCKCONNECT         248     /* Solaris-specific. */
#define AUE_SOCKSEND            249     /* Solaris-specific. */
#define AUE_SOCKRECEIVE         250     /* Solaris-specific. */
#define AUE_ACLSET              251
#define AUE_FACLSET             252
#define AUE_DOORFS              253     /* Solaris-specific. */
#define AUE_DOORFS_DOOR_CALL    254     /* Solaris-specific. */
#define AUE_DOORFS_DOOR_RETURN  255     /* Solaris-specific. */
#define AUE_DOORFS_DOOR_CREATE  256     /* Solaris-specific. */
#define AUE_DOORFS_DOOR_REVOKE  257     /* Solaris-specific. */
#define AUE_DOORFS_DOOR_INFO    258     /* Solaris-specific. */
#define AUE_DOORFS_DOOR_CRED    259     /* Solaris-specific. */
#define AUE_DOORFS_DOOR_BIND    260     /* Solaris-specific. */
#define AUE_DOORFS_DOOR_UNBIND  261     /* Solaris-specific. */
#define AUE_P_ONLINE            262     /* Solaris-specific. */
#define AUE_PROCESSOR_BIND      263     /* Solaris-specific. */
#define AUE_INST_SYNC           264     /* Solaris-specific. */
#define AUE_SOCKCONFIG          265     /* Solaris-specific. */
#define AUE_SETAUDIT_ADDR       266
#define AUE_GETAUDIT_ADDR       267
#define AUE_UMOUNT2             268     /* Solaris-specific. */
#define AUE_FSAT                269     /* Solaris-specific. */
#define AUE_OPENAT_R            270
#define AUE_OPENAT_RC           271
#define AUE_OPENAT_RT           272
#define AUE_OPENAT_RTC          273
#define AUE_OPENAT_W            274
#define AUE_OPENAT_WC           275
#define AUE_OPENAT_WT           276
#define AUE_OPENAT_WTC          277
#define AUE_OPENAT_RW           278
#define AUE_OPENAT_RWC          279
#define AUE_OPENAT_RWT          280
#define AUE_OPENAT_RWTC         281
#define AUE_RENAMEAT            282
#define AUE_FSTATAT             283
#define AUE_FCHOWNAT            284
#define AUE_FUTIMESAT           285
#define AUE_UNLINKAT            286
#define AUE_CLOCK_SETTIME       287
#define AUE_NTP_ADJTIME         288
#define AUE_SETPPRIV            289     /* Solaris-specific. */
#define AUE_MODDEVPLCY          290     /* Solaris-specific. */
#define AUE_MODADDPRIV          291     /* Solaris-specific. */
#define AUE_CRYPTOADM           292     /* Solaris-specific. */
#define AUE_CONFIGKSSL          293     /* Solaris-specific. */
#define AUE_BRANDSYS            294     /* Solaris-specific. */
#define AUE_PF_POLICY_ADDRULE   295     /* Solaris-specific. */
#define AUE_PF_POLICY_DELRULE   296     /* Solaris-specific. */
#define AUE_PF_POLICY_CLONE     297     /* Solaris-specific. */
#define AUE_PF_POLICY_FLIP      298     /* Solaris-specific. */
#define AUE_PF_POLICY_FLUSH     299     /* Solaris-specific. */
#define AUE_PF_POLICY_ALGS      300     /* Solaris-specific. */
#define AUE_PORTFS              301     /* Solaris-specific. */

/*
 * Events added for Apple Darwin that potentially collide with future Solaris
 * BSM events.  These are assigned AUE_DARWIN prefixes, and are deprecated in
 * new trails.  Systems generating these events should switch to the new
 * identifiers that avoid colliding with the Solaris identifier space.
 */
#define AUE_DARWIN_GETFSSTAT    301
#define AUE_DARWIN_PTRACE       302
#define AUE_DARWIN_CHFLAGS      303
#define AUE_DARWIN_FCHFLAGS     304
#define AUE_DARWIN_PROFILE      305
#define AUE_DARWIN_KTRACE       306
#define AUE_DARWIN_SETLOGIN     307
#define AUE_DARWIN_REBOOT       308
#define AUE_DARWIN_REVOKE       309
#define AUE_DARWIN_UMASK        310
#define AUE_DARWIN_MPROTECT     311
#define AUE_DARWIN_SETPRIORITY  312
#define AUE_DARWIN_SETTIMEOFDAY 313
#define AUE_DARWIN_FLOCK        314
#define AUE_DARWIN_MKFIFO       315
#define AUE_DARWIN_POLL         316
#define AUE_DARWIN_SOCKETPAIR   317
#define AUE_DARWIN_FUTIMES      318
#define AUE_DARWIN_SETSID       319
#define AUE_DARWIN_SETPRIVEXEC  320     /* Darwin-specific. */
#define AUE_DARWIN_NFSSVC       321
#define AUE_DARWIN_GETFH        322
#define AUE_DARWIN_QUOTACTL     323
#define AUE_DARWIN_ADDPROFILE   324     /* Darwin-specific. */
#define AUE_DARWIN_KDEBUGTRACE  325     /* Darwin-specific. */
#define AUE_DARWIN_KDBUGTRACE   AUE_KDEBUGTRACE
#define AUE_DARWIN_FSTAT        326
#define AUE_DARWIN_FPATHCONF    327
#define AUE_DARWIN_GETDIRENTRIES        328
#define AUE_DARWIN_TRUNCATE     329
#define AUE_DARWIN_FTRUNCATE    330
#define AUE_DARWIN_SYSCTL       331
#define AUE_DARWIN_MLOCK        332
#define AUE_DARWIN_MUNLOCK      333
#define AUE_DARWIN_UNDELETE     334
#define AUE_DARWIN_GETATTRLIST  335     /* Darwin-specific. */
#define AUE_DARWIN_SETATTRLIST  336     /* Darwin-specific. */
#define AUE_DARWIN_GETDIRENTRIESATTR    337     /* Darwin-specific. */
#define AUE_DARWIN_EXCHANGEDATA 338     /* Darwin-specific. */
#define AUE_DARWIN_SEARCHFS     339     /* Darwin-specific. */
#define AUE_DARWIN_MINHERIT     340
#define AUE_DARWIN_SEMCONFIG    341
#define AUE_DARWIN_SEMOPEN      342
#define AUE_DARWIN_SEMCLOSE     343
#define AUE_DARWIN_SEMUNLINK    344
#define AUE_DARWIN_SHMOPEN      345
#define AUE_DARWIN_SHMUNLINK    346
#define AUE_DARWIN_LOADSHFILE   347     /* Darwin-specific. */
#define AUE_DARWIN_RESETSHFILE  348     /* Darwin-specific. */
#define AUE_DARWIN_NEWSYSTEMSHREG       349     /* Darwin-specific. */
#define AUE_DARWIN_PTHREADKILL  350     /* Darwin-specific. */
#define AUE_DARWIN_PTHREADSIGMASK       351     /* Darwin-specific. */
#define AUE_DARWIN_AUDITCTL     352
#define AUE_DARWIN_RFORK        353
#define AUE_DARWIN_LCHMOD       354
#define AUE_DARWIN_SWAPOFF      355
#define AUE_DARWIN_INITPROCESS  356     /* Darwin-specific. */
#define AUE_DARWIN_MAPFD        357     /* Darwin-specific. */
#define AUE_DARWIN_TASKFORPID   358     /* Darwin-specific. */
#define AUE_DARWIN_PIDFORTASK   359     /* Darwin-specific. */
#define AUE_DARWIN_SYSCTL_NONADMIN      360
#define AUE_DARWIN_COPYFILE     361     /* Darwin-specific. */

/*
 * Audit event identifiers added as part of OpenBSM, generally corresponding
 * to events in FreeBSD, Darwin, and Linux that were not present in Solaris.
 * These often duplicate events added to the Solaris set by Darwin, but use
 * event identifiers in a higher range in order to avoid colliding with
 * future Solaris additions.
 *
 * If an event in this section is later added to Solaris, we prefer the
 * Solaris event identifier, and add _OPENBSM_ to the OpenBSM-specific
 * identifier so that old trails can still be processed, but new trails use
 * the Solaris identifier.
 */
#define AUE_GETFSSTAT           43001
#define AUE_PTRACE              43002
#define AUE_CHFLAGS             43003
#define AUE_FCHFLAGS            43004
#define AUE_PROFILE             43005
#define AUE_KTRACE              43006
#define AUE_SETLOGIN            43007
#define AUE_OPENBSM_REVOKE      43008   /* Solaris event now preferred. */
#define AUE_UMASK               43009
#define AUE_MPROTECT            43010
#define AUE_MKFIFO              43011
#define AUE_POLL                43012
#define AUE_FUTIMES             43013
#define AUE_SETSID              43014
#define AUE_SETPRIVEXEC         43015   /* Darwin-specific. */
#define AUE_ADDPROFILE          43016   /* Darwin-specific. */
#define AUE_KDEBUGTRACE         43017   /* Darwin-specific. */
#define AUE_KDBUGTRACE          AUE_KDEBUGTRACE
#define AUE_OPENBSM_FSTAT       43018   /* Solaris event now preferred. */
#define AUE_FPATHCONF           43019
#define AUE_GETDIRENTRIES       43020
#define AUE_SYSCTL              43021
#define AUE_MLOCK               43022
#define AUE_MUNLOCK             43023
#define AUE_UNDELETE            43024
#define AUE_GETATTRLIST         43025   /* Darwin-specific. */
#define AUE_SETATTRLIST         43026   /* Darwin-specific. */
#define AUE_GETDIRENTRIESATTR   43027   /* Darwin-specific. */
#define AUE_EXCHANGEDATA        43028   /* Darwin-specific. */
#define AUE_SEARCHFS            43029   /* Darwin-specific. */
#define AUE_MINHERIT            43030
#define AUE_SEMCONFIG           43031
#define AUE_SEMOPEN             43032
#define AUE_SEMCLOSE            43033
#define AUE_SEMUNLINK           43034
#define AUE_SHMOPEN             43035
#define AUE_SHMUNLINK           43036
#define AUE_LOADSHFILE          43037   /* Darwin-specific. */
#define AUE_RESETSHFILE         43038   /* Darwin-specific. */
#define AUE_NEWSYSTEMSHREG      43039   /* Darwin-specific. */
#define AUE_PTHREADKILL         43040   /* Darwin-specific. */
#define AUE_PTHREADSIGMASK      43041   /* Darwin-specific. */
#define AUE_AUDITCTL            43042
#define AUE_RFORK               43043
#define AUE_LCHMOD              43044
#define AUE_SWAPOFF             43045
#define AUE_INITPROCESS         43046   /* Darwin-specific. */
#define AUE_MAPFD               43047   /* Darwin-specific. */
#define AUE_TASKFORPID          43048   /* Darwin-specific. */
#define AUE_PIDFORTASK          43049   /* Darwin-specific. */
#define AUE_SYSCTL_NONADMIN     43050
#define AUE_COPYFILE            43051   /* Darwin-specific. */
#define AUE_DBGPORTFORPID       43052   /* Darwin-specific. */
/*
 * Events added to OpenBSM for FreeBSD and Linux; may also be used by Darwin
 * in the future.
 */
#define AUE_LUTIMES             43052
#define AUE_LCHFLAGS            43053   /* FreeBSD-specific. */
#define AUE_SENDFILE            43054   /* BSD/Linux-specific. */
#define AUE_USELIB              43055   /* Linux-specific. */
#define AUE_GETRESUID           43056
#define AUE_SETRESUID           43057
#define AUE_GETRESGID           43058
#define AUE_SETRESGID           43059
#define AUE_WAIT4               43060   /* FreeBSD-specific. */
#define AUE_LGETFH              43061   /* FreeBSD-specific. */
#define AUE_FHSTATFS            43062   /* FreeBSD-specific. */
#define AUE_FHOPEN              43063   /* FreeBSD-specific. */
#define AUE_FHSTAT              43064   /* FreeBSD-specific. */
#define AUE_JAIL                43065   /* FreeBSD-specific. */
#define AUE_EACCESS             43066   /* FreeBSD-specific. */
#define AUE_KQUEUE              43067   /* FreeBSD-specific. */
#define AUE_KEVENT              43068   /* FreeBSD-specific. */
#define AUE_FSYNC               43069
#define AUE_NMOUNT              43070   /* FreeBSD-specific. */
#define AUE_BDFLUSH             43071   /* Linux-specific. */
#define AUE_SETFSUID            43072   /* Linux-specific. */
#define AUE_SETFSGID            43073   /* Linux-specific. */
#define AUE_PERSONALITY         43074   /* Linux-specific. */
#define AUE_SCHED_GETSCHEDULER  43075   /* POSIX.1b. */
#define AUE_SCHED_SETSCHEDULER  43076   /* POSIX.1b. */
#define AUE_PRCTL               43077   /* Linux-specific. */
#define AUE_GETCWD              43078   /* FreeBSD/Linux-specific. */
#define AUE_CAPGET              43079   /* Linux-specific. */
#define AUE_CAPSET              43080   /* Linux-specific. */
#define AUE_PIVOT_ROOT          43081   /* Linux-specific. */
#define AUE_RTPRIO              43082   /* FreeBSD-specific. */
#define AUE_SCHED_GETPARAM      43083   /* POSIX.1b. */
#define AUE_SCHED_SETPARAM      43084   /* POSIX.1b. */
#define AUE_SCHED_GET_PRIORITY_MAX      43085   /* POSIX.1b. */
#define AUE_SCHED_GET_PRIORITY_MIN      43086   /* POSIX.1b. */
#define AUE_SCHED_RR_GET_INTERVAL       43087   /* POSIX.1b. */
#define AUE_ACL_GET_FILE        43088   /* FreeBSD. */
#define AUE_ACL_SET_FILE        43089   /* FreeBSD. */
#define AUE_ACL_GET_FD          43090   /* FreeBSD. */
#define AUE_ACL_SET_FD          43091   /* FreeBSD. */
#define AUE_ACL_DELETE_FILE     43092   /* FreeBSD. */
#define AUE_ACL_DELETE_FD       43093   /* FreeBSD. */
#define AUE_ACL_CHECK_FILE      43094   /* FreeBSD. */
#define AUE_ACL_CHECK_FD        43095   /* FreeBSD. */
#define AUE_ACL_GET_LINK        43096   /* FreeBSD. */
#define AUE_ACL_SET_LINK        43097   /* FreeBSD. */
#define AUE_ACL_DELETE_LINK     43098   /* FreeBSD. */
#define AUE_ACL_CHECK_LINK      43099   /* FreeBSD. */
#define AUE_SYSARCH             43100   /* FreeBSD. */
#define AUE_EXTATTRCTL          43101   /* FreeBSD. */
#define AUE_EXTATTR_GET_FILE    43102   /* FreeBSD. */
#define AUE_EXTATTR_SET_FILE    43103   /* FreeBSD. */
#define AUE_EXTATTR_LIST_FILE   43104   /* FreeBSD. */
#define AUE_EXTATTR_DELETE_FILE 43105   /* FreeBSD. */
#define AUE_EXTATTR_GET_FD      43106   /* FreeBSD. */
#define AUE_EXTATTR_SET_FD      43107   /* FreeBSD. */
#define AUE_EXTATTR_LIST_FD     43108   /* FreeBSD. */
#define AUE_EXTATTR_DELETE_FD   43109   /* FreeBSD. */
#define AUE_EXTATTR_GET_LINK    43110   /* FreeBSD. */
#define AUE_EXTATTR_SET_LINK    43111   /* FreeBSD. */
#define AUE_EXTATTR_LIST_LINK   43112   /* FreeBSD. */
#define AUE_EXTATTR_DELETE_LINK 43113   /* FreeBSD. */
#define AUE_KENV                43114   /* FreeBSD. */
#define AUE_JAIL_ATTACH         43115   /* FreeBSD. */
#define AUE_SYSCTL_WRITE        43116   /* FreeBSD. */
#define AUE_IOPERM              43117   /* Linux. */
#define AUE_READDIR             43118   /* Linux. */
#define AUE_IOPL                43119   /* Linux. */
#define AUE_VM86                43120   /* Linux. */
#define AUE_MAC_GET_PROC        43121   /* FreeBSD/Darwin. */
#define AUE_MAC_SET_PROC        43122   /* FreeBSD/Darwin. */
#define AUE_MAC_GET_FD          43123   /* FreeBSD/Darwin. */
#define AUE_MAC_GET_FILE        43124   /* FreeBSD/Darwin. */
#define AUE_MAC_SET_FD          43125   /* FreeBSD/Darwin. */
#define AUE_MAC_SET_FILE        43126   /* FreeBSD/Darwin. */
#define AUE_MAC_SYSCALL         43127   /* FreeBSD. */
#define AUE_MAC_GET_PID         43128   /* FreeBSD/Darwin. */
#define AUE_MAC_GET_LINK        43129   /* FreeBSD/Darwin. */
#define AUE_MAC_SET_LINK        43130   /* FreeBSD/Darwin. */
#define AUE_MAC_EXECVE          43131   /* FreeBSD/Darwin. */
#define AUE_GETPATH_FROMFD      43132   /* FreeBSD. */
#define AUE_GETPATH_FROMADDR    43133   /* FreeBSD. */
#define AUE_MQ_OPEN             43134   /* FreeBSD. */
#define AUE_MQ_SETATTR          43135   /* FreeBSD. */
#define AUE_MQ_TIMEDRECEIVE     43136   /* FreeBSD. */
#define AUE_MQ_TIMEDSEND        43137   /* FreeBSD. */
#define AUE_MQ_NOTIFY           43138   /* FreeBSD. */
#define AUE_MQ_UNLINK           43139   /* FreeBSD. */
#define AUE_LISTEN              43140   /* FreeBSD/Darwin/Linux. */
#define AUE_MLOCKALL            43141   /* FreeBSD. */
#define AUE_MUNLOCKALL          43142   /* FreeBSD. */
#define AUE_CLOSEFROM           43143   /* FreeBSD. */
#define AUE_FEXECVE             43144   /* FreeBSD. */
#define AUE_FACCESSAT           43145   /* FreeBSD. */
#define AUE_FCHMODAT            43146   /* FreeBSD. */
#define AUE_LINKAT              43147   /* FreeBSD. */
#define AUE_MKDIRAT             43148   /* FreeBSD. */
#define AUE_MKFIFOAT            43149   /* FreeBSD. */
#define AUE_MKNODAT             43150   /* FreeBSD. */
#define AUE_READLINKAT          43151   /* FreeBSD. */
#define AUE_SYMLINKAT           43152   /* FreeBSD. */
#define AUE_MAC_GETFSSTAT       43153   /* Darwin. */
#define AUE_MAC_GET_MOUNT       43154   /* Darwin. */
#define AUE_MAC_GET_LCID        43155   /* Darwin. */
#define AUE_MAC_GET_LCTX        43156   /* Darwin. */
#define AUE_MAC_SET_LCTX        43157   /* Darwin. */
#define AUE_MAC_MOUNT           43158   /* Darwin. */
#define AUE_GETLCID             43159   /* Darwin. */
#define AUE_SETLCID             43160   /* Darwin. */
#define AUE_TASKNAMEFORPID      43161   /* Darwin. */
#define AUE_ACCESS_EXTENDED     43162   /* Darwin. */
#define AUE_CHMOD_EXTENDED      43163   /* Darwin. */
#define AUE_FCHMOD_EXTENDED     43164   /* Darwin. */
#define AUE_FSTAT_EXTENDED      43165   /* Darwin. */
#define AUE_LSTAT_EXTENDED      43166   /* Darwin. */
#define AUE_MKDIR_EXTENDED      43167   /* Darwin. */
#define AUE_MKFIFO_EXTENDED     43168   /* Darwin. */
#define AUE_OPEN_EXTENDED       43169   /* Darwin. */
#define AUE_OPEN_EXTENDED_R     43170   /* Darwin. */
#define AUE_OPEN_EXTENDED_RC    43171   /* Darwin. */
#define AUE_OPEN_EXTENDED_RT    43172   /* Darwin. */
#define AUE_OPEN_EXTENDED_RTC   43173   /* Darwin. */
#define AUE_OPEN_EXTENDED_W     43174   /* Darwin. */
#define AUE_OPEN_EXTENDED_WC    43175   /* Darwin. */
#define AUE_OPEN_EXTENDED_WT    43176   /* Darwin. */
#define AUE_OPEN_EXTENDED_WTC   43177   /* Darwin. */
#define AUE_OPEN_EXTENDED_RW    43178   /* Darwin. */
#define AUE_OPEN_EXTENDED_RWC   43179   /* Darwin. */
#define AUE_OPEN_EXTENDED_RWT   43180   /* Darwin. */
#define AUE_OPEN_EXTENDED_RWTC  43181   /* Darwin. */
#define AUE_STAT_EXTENDED       43182   /* Darwin. */
#define AUE_UMASK_EXTENDED      43183   /* Darwin. */
#define AUE_OPENAT              43184   /* FreeBSD. */
#define AUE_POSIX_OPENPT        43185   /* FreeBSD. */
#define AUE_CAP_NEW             43186   /* TrustedBSD. */
#define AUE_CAP_GETRIGHTS       43187   /* TrustedBSD. */
#define AUE_CAP_ENTER           43188   /* TrustedBSD. */
#define AUE_CAP_GETMODE         43189   /* TrustedBSD. */
#define AUE_POSIX_SPAWN         43190   /* Darwin. */
#define AUE_FSGETPATH           43191   /* Darwin. */
#define AUE_PREAD               43192   /* Darwin/FreeBSD. */
#define AUE_PWRITE              43193   /* Darwin/FreeBSD. */
#define AUE_FSCTL               43194   /* Darwin. */
#define AUE_FFSCTL              43195   /* Darwin. */
#define AUE_LPATHCONF           43196   /* FreeBSD. */
#define AUE_PDFORK              43197   /* FreeBSD. */
#define AUE_PDKILL              43198   /* FreeBSD. */
#define AUE_PDGETPID            43199   /* FreeBSD. */
#define AUE_PDWAIT              43200   /* FreeBSD. */
#define AUE_GETATTRLISTBULK     43201   /* Darwin. */
#define AUE_GETATTRLISTAT       43202   /* Darwin. */
#define AUE_OPENBYID            43203   /* Darwin. */
#define AUE_OPENBYID_R          43204   /* Darwin. */
#define AUE_OPENBYID_RT         43205   /* Darwin. */
#define AUE_OPENBYID_W          43206   /* Darwin. */
#define AUE_OPENBYID_WT         43207   /* Darwin. */
#define AUE_OPENBYID_RW         43208   /* Darwin. */
#define AUE_OPENBYID_RWT        43209   /* Darwin. */
#define AUE_CLONEFILEAT         43210   /* Darwin. */
#define AUE_FCLONEFILEAT        43211   /* Darwin. */
#define AUE_SETATTRLISTAT       43212   /* Darwin. */
#define AUE_FMOUNT              43213   /* Darwin. */
#define AUE_FSGETPATH_EXTENDED  43214   /* Darwin. */

#define AUE_SESSION_START       44901   /* Darwin. */
#define AUE_SESSION_UPDATE      44902   /* Darwin. */
#define AUE_SESSION_END         44903   /* Darwin. */
#define AUE_SESSION_CLOSE       44904   /* Darwin. */

/*
 * Darwin BSM uses a number of AUE_O_* definitions, which are aliased to the
 * normal Solaris BSM identifiers.  _O_ refers to it being an old, or compat
 * interface.  In most cases, Darwin has never implemented these system calls
 * but picked up the fields in their system call table from their FreeBSD
 * import.  Happily, these have different names than the AUE_O* definitions
 * in Solaris BSM.
 */
#define AUE_O_CREAT             AUE_OPEN_RWTC   /* Darwin */
#define AUE_O_EXECVE            AUE_NULL        /* Darwin */
#define AUE_O_SBREAK            AUE_NULL        /* Darwin */
#define AUE_O_LSEEK             AUE_NULL        /* Darwin */
#define AUE_O_MOUNT             AUE_NULL        /* Darwin */
#define AUE_O_UMOUNT            AUE_NULL        /* Darwin */
#define AUE_O_STAT              AUE_STAT        /* Darwin */
#define AUE_O_LSTAT             AUE_LSTAT       /* Darwin */
#define AUE_O_FSTAT             AUE_FSTAT       /* Darwin */
#define AUE_O_GETPAGESIZE       AUE_NULL        /* Darwin */
#define AUE_O_VREAD             AUE_NULL        /* Darwin */
#define AUE_O_VWRITE            AUE_NULL        /* Darwin */
#define AUE_O_MMAP              AUE_MMAP        /* Darwin */
#define AUE_O_VADVISE           AUE_NULL        /* Darwin */
#define AUE_O_VHANGUP           AUE_NULL        /* Darwin */
#define AUE_O_VLIMIT            AUE_NULL        /* Darwin */
#define AUE_O_WAIT              AUE_NULL        /* Darwin */
#define AUE_O_GETHOSTNAME       AUE_NULL        /* Darwin */
#define AUE_O_SETHOSTNAME       AUE_SYSCTL      /* Darwin */
#define AUE_O_GETDOPT           AUE_NULL        /* Darwin */
#define AUE_O_SETDOPT           AUE_NULL        /* Darwin */
#define AUE_O_ACCEPT            AUE_NULL        /* Darwin */
#define AUE_O_SEND              AUE_SENDMSG     /* Darwin */
#define AUE_O_RECV              AUE_RECVMSG     /* Darwin */
#define AUE_O_VTIMES            AUE_NULL        /* Darwin */
#define AUE_O_SIGVEC            AUE_NULL        /* Darwin */
#define AUE_O_SIGBLOCK          AUE_NULL        /* Darwin */
#define AUE_O_SIGSETMASK        AUE_NULL        /* Darwin */
#define AUE_O_SIGSTACK          AUE_NULL        /* Darwin */
#define AUE_O_RECVMSG           AUE_RECVMSG     /* Darwin */
#define AUE_O_SENDMSG           AUE_SENDMSG     /* Darwin */
#define AUE_O_VTRACE            AUE_NULL        /* Darwin */
#define AUE_O_RESUBA            AUE_NULL        /* Darwin */
#define AUE_O_RECVFROM          AUE_RECVFROM    /* Darwin */
#define AUE_O_SETREUID          AUE_SETREUID    /* Darwin */
#define AUE_O_SETREGID          AUE_SETREGID    /* Darwin */
#define AUE_O_GETDIRENTRIES     AUE_GETDIRENTRIES       /* Darwin */
#define AUE_O_TRUNCATE          AUE_TRUNCATE    /* Darwin */
#define AUE_O_FTRUNCATE         AUE_FTRUNCATE   /* Darwin */
#define AUE_O_GETPEERNAME       AUE_NULL        /* Darwin */
#define AUE_O_GETHOSTID         AUE_NULL        /* Darwin */
#define AUE_O_SETHOSTID         AUE_NULL        /* Darwin */
#define AUE_O_GETRLIMIT         AUE_NULL        /* Darwin */
#define AUE_O_SETRLIMIT         AUE_SETRLIMIT   /* Darwin */
#define AUE_O_KILLPG            AUE_KILL        /* Darwin */
#define AUE_O_SETQUOTA          AUE_NULL        /* Darwin */
#define AUE_O_QUOTA             AUE_NULL        /* Darwin */
#define AUE_O_GETSOCKNAME       AUE_NULL        /* Darwin */
#define AUE_O_GETDIREENTRIES    AUE_GETDIREENTRIES      /* Darwin */
#define AUE_O_ASYNCDAEMON       AUE_NULL        /* Darwin */
#define AUE_O_GETDOMAINNAME     AUE_NULL        /* Darwin */
#define AUE_O_SETDOMAINNAME     AUE_SYSCTL      /* Darwin */
#define AUE_O_PCFS_MOUNT        AUE_NULL        /* Darwin */
#define AUE_O_EXPORTFS          AUE_NULL        /* Darwin */
#define AUE_O_USTATE            AUE_NULL        /* Darwin */
#define AUE_O_WAIT3             AUE_NULL        /* Darwin */
#define AUE_O_RPAUSE            AUE_NULL        /* Darwin */
#define AUE_O_GETDENTS          AUE_NULL        /* Darwin */

/*
 * Possible desired future values based on review of BSD/Darwin system calls.
 */
#define AUE_ATGETMSG            AUE_NULL
#define AUE_ATPUTMSG            AUE_NULL
#define AUE_ATSOCKET            AUE_NULL
#define AUE_ATPGETREQ           AUE_NULL
#define AUE_ATPGETRSP           AUE_NULL
#define AUE_ATPSNDREQ           AUE_NULL
#define AUE_ATPSNDRSP           AUE_NULL
#define AUE_BSDTHREADCREATE     AUE_NULL
#define AUE_BSDTHREADTERMINATE  AUE_NULL
#define AUE_BSDTHREADREGISTER   AUE_NULL
#define AUE_CSOPS               AUE_NULL
#define AUE_DUP                 AUE_NULL
#define AUE_FDATASYNC           AUE_NULL
#define AUE_FGETATTRLIST        AUE_NULL
#define AUE_FGETXATTR           AUE_NULL
#define AUE_FLISTXATTR          AUE_NULL
#define AUE_FREMOVEXATTR        AUE_NULL
#define AUE_FSETATTRLIST        AUE_NULL
#define AUE_FSETXATTR           AUE_NULL
#define AUE_FSTATFS64           AUE_NULL
#define AUE_FSTATV              AUE_NULL
#define AUE_FSTAT64             AUE_NULL
#define AUE_FSTAT64_EXTENDED    AUE_NULL
#define AUE_GCCONTROL           AUE_NULL
#define AUE_GETDIRENTRIES64     AUE_NULL
#define AUE_GETDTABLESIZE       AUE_NULL
#define AUE_GETEGID             AUE_NULL
#define AUE_GETEUID             AUE_NULL
#define AUE_GETFSSTAT64         AUE_NULL
#define AUE_GETGID              AUE_NULL
#define AUE_GETGROUPS           AUE_NULL
#define AUE_GETITIMER           AUE_NULL
#define AUE_GETLOGIN            AUE_NULL
#define AUE_GETPEERNAME         AUE_NULL
#define AUE_GETPGID             AUE_NULL
#define AUE_GETPGRP             AUE_NULL
#define AUE_GETPID              AUE_NULL
#define AUE_GETPPID             AUE_NULL
#define AUE_GETPRIORITY         AUE_NULL
#define AUE_GETRLIMIT           AUE_NULL
#define AUE_GETRUSAGE           AUE_NULL
#define AUE_GETSGROUPS          AUE_NULL
#define AUE_GETSID              AUE_NULL
#define AUE_GETSOCKNAME         AUE_NULL
#define AUE_GETTIMEOFDAY        AUE_NULL
#define AUE_GETTID              AUE_NULL
#define AUE_GETUID              AUE_NULL
#define AUE_GETSOCKOPT          AUE_NULL
#define AUE_GETWGROUPS          AUE_NULL
#define AUE_GETXATTR            AUE_NULL
#define AUE_IDENTITYSVC         AUE_NULL
#define AUE_INITGROUPS          AUE_NULL
#define AUE_IOPOLICYSYS         AUE_NULL
#define AUE_ISSETUGID           AUE_NULL
#define AUE_LEDGER              AUE_NULL
#define AUE_LIOLISTIO           AUE_NULL
#define AUE_LISTXATTR           AUE_NULL
#define AUE_LSTATV              AUE_NULL
#define AUE_LSTAT64             AUE_NULL
#define AUE_LSTAT64_EXTENDED    AUE_NULL
#define AUE_MADVISE             AUE_NULL
#define AUE_MINCORE             AUE_NULL
#define AUE_MKCOMPLEX           AUE_NULL
#define AUE_MODWATCH            AUE_NULL
#define AUE_MSGCL               AUE_NULL
#define AUE_MSYNC               AUE_NULL
#define AUE_NECP                AUE_NULL
#define AUE_NETAGENT    AUE_NULL
#define AUE_PREADV              AUE_NULL
#define AUE_PROCINFO            AUE_NULL
#define AUE_PTHREADCANCELED     AUE_NULL
#define AUE_PTHREADCHDIR        AUE_NULL
#define AUE_PTHREADCONDBROADCAST        AUE_NULL
#define AUE_PTHREADCONDDESTORY  AUE_NULL
#define AUE_PTHREADCONDINIT     AUE_NULL
#define AUE_PTHREADCONDSIGNAL   AUE_NULL
#define AUE_PTHREADCONDWAIT     AUE_NULL
#define AUE_PTHREADFCHDIR       AUE_NULL
#define AUE_PTHREADMARK         AUE_NULL
#define AUE_PTHREADMUTEXDESTROY AUE_NULL
#define AUE_PTHREADMUTEXINIT    AUE_NULL
#define AUE_PTHREADMUTEXTRYLOCK AUE_NULL
#define AUE_PTHREADMUTEXUNLOCK  AUE_NULL
#define AUE_PWRITEV             AUE_NULL
#define AUE_REMOVEXATTR         AUE_NULL
#define AUE_SBRK                AUE_NULL
#define AUE_SELECT              AUE_NULL
#define AUE_SEMDESTROY          AUE_NULL
#define AUE_SEMGETVALUE         AUE_NULL
#define AUE_SEMINIT             AUE_NULL
#define AUE_SEMPOST             AUE_NULL
#define AUE_SEMTRYWAIT          AUE_NULL
#define AUE_SEMWAIT             AUE_NULL
#define AUE_SEMWAITSIGNAL       AUE_NULL
#define AUE_SETITIMER           AUE_NULL
#define AUE_SETSGROUPS          AUE_NULL
#define AUE_SETTID              AUE_NULL
#define AUE_SETTIDWITHPID       AUE_NULL
#define AUE_SETWGROUPS          AUE_NULL
#define AUE_SETXATTR            AUE_NULL
#define AUE_SHAREDREGIONCHECK   AUE_NULL
#define AUE_SHAREDREGIONMAP     AUE_NULL
#define AUE_SIGACTION           AUE_NULL
#define AUE_SIGALTSTACK         AUE_NULL
#define AUE_SIGPENDING          AUE_NULL
#define AUE_SIGPROCMASK         AUE_NULL
#define AUE_SIGRETURN           AUE_NULL
#define AUE_SIGSUSPEND          AUE_NULL
#define AUE_SIGWAIT             AUE_NULL
#define AUE_SSTK                AUE_NULL
#define AUE_STACKSNAPSHOT       AUE_NULL
#define AUE_STATFS64            AUE_NULL
#define AUE_STATV               AUE_NULL
#define AUE_STAT64              AUE_NULL
#define AUE_STAT64_EXTENDED     AUE_NULL
#define AUE_SYNC                AUE_NULL
#define AUE_SYSCALL             AUE_NULL
#define AUE_TABLE               AUE_NULL
#define AUE_VMPRESSUREMONITOR   AUE_NULL
#define AUE_WAITEVENT           AUE_NULL
#define AUE_WAITID              AUE_NULL
#define AUE_WATCHEVENT          AUE_NULL
#define AUE_WORKQOPEN           AUE_NULL
#define AUE_WORKQOPS            AUE_NULL
#define AUE_WORKLOOPCTL         AUE_NULL
#define AUE_PERSONA             AUE_NULL
#define AUE_USRCTL              AUE_NULL
#define AUE_NEXUS               AUE_NULL
#define AUE_CHANNEL             AUE_NULL
#define AUE_NET                 AUE_NULL

#endif /* !_BSM_AUDIT_KEVENTS_H_ */