11037 SMB File access audit logging (reserve IDs)

@@ -1,10 +1,11 @@
 # audit_record_attr.txt
 # Two "#" are comments that are copied to audit_record_attr
 # other comments are removed.
 ##
 ## Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
+## Copyright 2018 Nexenta Systems, Inc.  All rights reserved.
 ## Copyright 2019 Joyent, Inc.
 ##
 ## CDDL HEADER START
 ##
 ## The contents of this file are subject to the terms of the

@@ -1483,10 +1484,18 @@
 # apparently replaced
 
 label=AUE_RMDIR
   format=path:[attr]
 
+label=AUE_SACL
+  title=File Access Audit
+  syscall=none
+  see=none
+  format=head:path:arg1:[text]2:subj
+    comment="access_mask":
+    comment="Windows SID"
+
 label=AUE_SEMCTL
   format=arg1:[ipc]:[ipc_perm]
     comment=1, semaphore ID, "sem ID"
   note=ipc_perm
 # ipc, ipc_perm token: semctl -> ipc_lookup -> audit_ipc