1 <?xml version="1.0" standalone="yes"?>
   2 <!DOCTYPE specification SYSTEM "audit.dtd">
   3 <!--
   4  CDDL HEADER START
   5 
   6  The contents of this file are subject to the terms of the
   7  Common Development and Distribution License (the "License").
   8  You may not use this file except in compliance with the License.
   9 
  10  You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
  11  or http://www.opensolaris.org/os/licensing.
  12  See the License for the specific language governing permissions
  13  and limitations under the License.
  14 
  15  When distributing Covered Code, include this CDDL HEADER in each
  16  file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  17  If applicable, add the following below this CDDL HEADER, with the
  18  fields enclosed by brackets "[]" replaced with your own identifying
  19  information: Portions Copyright [yyyy] [name of copyright owner]
  20 
  21  CDDL HEADER END
  22 
  23 Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
  24 
  25 -->
  26 
  27 <specification>
  28 
  29 <!-- comments are displayed to stderr if debug is on -->
  30 <debug set="off"/>
  31 
  32     <!-- The order of events is arbitrary EXCEPT generic events must
  33          precede their instances -->
  34        <!-- The order of entries within an event determine the order
  35             data is defined in the external API -->
  36             <!-- The order of internal / external is arbitrary -->
  37 
  38 <!--
  39         tags:
  40                         The following top level tags are defined:
  41                         <event> <token> <msg_list> <debug>
  42 
  43         event           defines an audit record
  44                         - id is the record id from audit_uevents.h
  45                         - reorder="yes" or "no".  (default is "no").
  46                           if "yes" then the order of the tokens to be
  47                           output does not match the order of the data
  48                           input.  (see order attribute of <entry>)
  49                         - header defines the header file to contain the external
  50                           definitions for this event type.  The header file
  51                           name is adt_event_N.h, where N is the value supplied
  52                           header="0" is for "stable" events, > 0 for new ones.
  53                           with this attribute. (header="1").
  54                         - idNo is the number associated with the external
  55                           name of this event. (For AUE_login, ADT_login is
  56                           the external name and idNo is the value for
  57                           ADT_login.)
  58                         - omit is by default 'no' (i.e., don't omit) and can be
  59                           'always' or 'JNI'.  In the latter case, C interface
  60                           code is generated but neither Java nor JNI code is.
  61                         - included text is just a comment
  62                         Within an event block, the following tags are defined:
  63                         <entry>, <debug>, <altname>, <title>, <program>, <see>
  64 
  65         altname         defines the internal name of an audit record; if
  66                         omitted, the internal name is the same as the
  67                         external name.
  68 
  69         title,          these tags are used by auditrecord(1M) build to create
  70         program,        audit_record_attr database from adt events.
  71         see             Following example demonstrates their semantics:
  72 
  73                         auditrecord -p passwd
  74                         passwd          <-   <title>
  75                           program     various              See passwd(1)
  76                                         ^-   <program>            ^-   <see>
  77                           event ID    6163                 AUE_passwd
  78                           class       lo                   (0x00001000)
  79                               header
  80                               subject
  81                               [text]                       username...
  82                                                                 ^-   <comment>
  83                               return
  84 
  85                         If the length of string in any of the given
  86                         elements is longer than defined, the string is
  87                         silently truncated to the defined length in the
  88                         auditrecord(1M) runtime: 
  89                                 
  90                                 element <= max (non-truncated) string length
  91                                 title   <= 46
  92                                 program <= 20
  93                                 see     <= 39
  94                                 comment <= unlimited
  95                                 token   <= 28
  96 
  97         entry           defines the correspondence between the data
  98                         supplied by the caller and the token to be
  99                         output.
 100                         - id is the data name that shows up in the structures
 101                           of adt_event.h  If it is a comma separated list,
 102                           it is the list of names of data to be associated
 103                           with one output token.  (See <external>, below)
 104                         Within an entry block, the following tags are defined:
 105                         <internal>, <external>, <debug>, <comment>
 106 
 107         internal        defines the token to be generated.
 108                         - token is a name that must also be defined with
 109                           a <token> tag elsewhere in this file.  (order is
 110                           not important).
 111                         - order="some number" determines the order of the
 112                           tokens to be output, starting with 1.  The subject
 113                           token is normally order="1".  The use is to insure
 114                           that the order of fields listed in adt_event.h does
 115                           not change when we arbitrarily change the order of
 116                           tokens.  If the <event reorder="yes"> is not set,
 117                           order is ignored.
 118                         - format is a printf-like string that will be used
 119                           in to format the data supplied by the user.
 120 
 121         external        defines the data to be supplied for creating the
 122                         token defined via <internal>
 123                         - opt is one of four values:  "required", "optional",
 124                           "obsolete", or "none".  The first two values
 125                           indicate that this token's data must or may
 126                           be supplied by the user; the third value is
 127                           equivalent to "optional" but shows in the
 128                           comment that this field is no longer used;
 129                           the forth value indicates that this token
 130                           does not require any user-supplied data.  If
 131                           data is required, then a token is always
 132                           output, while optional data is output only
 133                           if data is supplied.
 134                         - type describes the C data type to be associated
 135                           with the <entry id="dataName">.  The following
 136                           data types are representative:
 137 
 138                                 au_asid_t (uint32_t)
 139                                 char
 140                                 char * (blank is optional)
 141                                 char ** (blank is optional)
 142                                 fd_t (int, a file descriptor)
 143                                 uint_t, int, int32_t, uid_t, gid_t
 144                                 uid_t *, gid_t *
 145                                 long, ulong_t
 146                                 m_label_t *
 147                                 pid_t
 148                                 priv_set_t *
 149                                 uint16_t, unit32_t, uint64_t
 150                                 uint32_t *, uint32_t[], uint64_t *
 151                                 msg  (not a C type, see below)
 152 
 153                         Below is what Tony said.  Above seems to be
 154                         what is implemented
 155                                 char
 156                                 char * (blank is optional)
 157                                 char ** (blank is optional)
 158                                 int, uid_t, gid_t
 159                                 int *, uid_t *, gid_t *
 160                                 msg  (not a C type, see below)
 161                                 time_t
 162                                 uint, uint *
 163 
 164                           The msg type refers to an enumerated type
 165                           that must be defined via a <msg> description
 166                           else where in this file. The syntax is
 167                           special.  Example: <external opt="optional"
 168                           type="msg login_text"/> "login_text" is the
 169                           id of a <msg_list> descriptor given
 170                           elsewhere in this file.
 171 
 172                         If the <entry> id is a list, the type must also
 173                         be a comma-separated list, where the types are
 174                         in the same order as the id's.
 175                         If the type is an array, its length must be given
 176                         explicitly.
 177 
 178         comment         Used by auditrecord(1M) build to generate 
 179                         audit_record_attr. Comment is explanation note
 180                         printed with token type. Colon (':') may not be
 181                         used in a comment. See example above for other
 182                         tags related to auditrecord(1M).
 183 
 184         token           Define allowed token names.
 185                         - id is the name of token; this name is used
 186                         as an <internal> id.
 187                         - a token id name may not end in digits.
 188                         - usage is an optional value.  At present, only
 189                           "TSOL" is defined; it means that this data is
 190                           to be used only in Trusted Solaris implementations.
 191                         See also example above for "token" tag relation to 
 192                         the auditrecord(1M) output.
 193 
 194         msg_list        Define a set of text strings.
 195                         - id is the name to be used for this group of text
 196                           strings in adt_event.h
 197                         - header is as defined for <event>
 198                         - start is a number where produced enum type begins;
 199                           ensure msg lists do not overlap
 200                         Within a msg_list block, <msg> and <debug> are defined.
 201                         The order of <msg> tags in a msg_list is reflected
 202                         directly in adt_event.h. Also add ADT_LIST_<<id>> to
 203                         enum adt_msg_list in adt_xlate.h.
 204 
 205         msg             Define one string.
 206                         - id is the name to be used in the enum describing
 207                           this set of strings.  Convention:  use upper case.
 208                         The content (text between <msg> and </msg>) is the
 209                         actual string.  Extra white space, including line
 210                         feeds, is ignored.  If empty, no output token
 211                         is generated unless the <external> opt attribute is
 212                         set to "required", in which case a blank text token
 213                         is generated.
 214                         Within a msg block, <debug> is defined, but has not been
 215                         tested and may have no effect.
 216 
 217         debug           This turns on/off debug messages during the processing
 218                         of the xml data.  It affects the block within which it
 219                         is defined.
 220                         - set may have one of two values:  "on" or "off".  If
 221                           set is omitted, the debug state for the current block
 222                           is toggled.
 223                         The use of the <debug> tag does not affect the output
 224                         of data to the various files created, but does generate
 225                         potentially large amounts of output to stderr.
 226 
 227 -->
 228 <!--        template for an event record definition
 229 
 230     <event id="" header="0" idNo="">
 231         <entry id="subject">
 232             <internal token="subject"/>
 233             <external opt="none"/>
 234         </entry>
 235         <entry id="">
 236             <internal token=""/>
 237             <external opt="" type="" />
 238         </entry>
 239         <entry id="return">
 240             <internal token="return"/>
 241             <external opt="none"/>
 242         </entry>
 243     </event>
 244 
 245     Generic events must precede Instance events; within each
 246     group, please group the AUE_* by area and event idNo-s in order,
 247     gaps in idNo-s are OK.
 248     N.B. Renumbering idNo-s requires recompilation of consumers.  See
 249     the contracts for whom to notify if/when this happens.
 250 -->
 251 
 252 <!-- generic events  -->
 253 
 254     <!--
 255         'omit="always"' means that this record type is not reflected
 256         in the generated header and table files.
 257      -->
 258 
 259     <event id="AUE_generic_basic" type="generic" omit="always">
 260         <!--
 261 
 262         This is a template for the event types that have no tokens
 263         other than the header and return. There is no allowed_type
 264         list because the template is not externally visible due to the
 265         omit="always".
 266 
 267         -->
 268         <entry id="subject">
 269             <internal token="subject"/>
 270             <external opt="none"/>
 271         </entry>
 272         <entry id="return">
 273             <internal token="return"/>
 274             <external opt="none"/>
 275         </entry>
 276     </event>
 277 
 278     <event id="AUE_generic_login" type="generic" omit="always">
 279         <!--
 280 
 281         This is a template for the various login event types
 282         AUE_login, AUE_ftp, etc which match this template.  There is
 283         no allowed_type list because the template is not externally
 284         visible due to the omit="always".
 285 
 286         -->
 287         <entry id="subject">
 288             <internal token="subject"/>
 289             <external opt="none"/>
 290         </entry>
 291 
 292         <!-- This field is still in use for SMC until it is cleaned up,
 293                 it must remain, see login_text msg list at the end of the
 294                 file.
 295         -->
 296         <entry id="message">
 297             <internal token="text"/>
 298             <external opt="optional" type="msg login_text"/>
 299             <comment>error message</comment>
 300         </entry>
 301         <entry id="return">
 302             <internal token="return"/>
 303             <external opt="none"/>
 304         </entry>
 305     </event>
 306 
 307 <!-- generic SMC events  -->
 308 
 309     <event id="AUE_generic_SMC_add" type="generic" omit="always">
 310         <entry id="subject">
 311             <internal token="subject"/>
 312             <external opt="none"/>
 313         </entry>
 314         <entry id="object_name">
 315             <internal token="text"/>
 316             <external opt="required" type="char *"/>
 317             <comment>object name</comment>
 318         </entry>
 319         <entry id="domain">
 320             <internal token="text"/>
 321             <external opt="optional" type="char *"/>
 322             <comment>domain</comment>
 323         </entry>
 324         <entry id="name_service">
 325             <internal token="text"/>
 326             <external opt="required" type="char *"/>
 327             <comment>name_service</comment>
 328         </entry>
 329         <entry id="auth_used">
 330             <internal token="uauth"/>
 331             <external opt="optional" type="char *"/>
 332             <comment>authorization used</comment>
 333         </entry>
 334         <!--
 335           This should really be its own token type, not "text"
 336         -->
 337         <entry id="initial_values">
 338             <internal token="text"/>
 339             <external opt="required" type="char *"/>
 340             <comment>initial values</comment>
 341         </entry>
 342         <entry id="return">
 343             <internal token="return"/>
 344             <external opt="none"/>
 345         </entry>
 346     </event>
 347 
 348     <event id="AUE_generic_SMC_delete" type="generic" omit="always">
 349         <entry id="subject">
 350             <internal token="subject"/>
 351             <external opt="none"/>
 352         </entry>
 353         <entry id="object_name">
 354             <internal token="text"/>
 355             <external opt="required" type="char *"/>
 356             <comment>object name</comment>
 357         </entry>
 358         <entry id="domain">
 359             <internal token="text"/>
 360             <external opt="optional" type="char *"/>
 361             <comment>domain</comment>
 362         </entry>
 363         <entry id="name_service">
 364             <internal token="text"/>
 365             <external opt="required" type="char *"/>
 366             <comment>name_service</comment>
 367         </entry>
 368         <entry id="auth_used">
 369             <internal token="uauth"/>
 370             <external opt="optional" type="char *"/>
 371             <comment>authorization used</comment>
 372         </entry>
 373         <entry id="delete_values">
 374             <internal token="text"/>
 375             <external opt="required" type="char *"/>
 376             <comment>deleted values</comment>
 377         </entry>
 378         <entry id="return">
 379             <internal token="return"/>
 380             <external opt="none"/>
 381         </entry>
 382     </event>
 383 
 384     <event id="AUE_generic_SMC_modify" type="generic" omit="always">
 385         <entry id="subject">
 386             <internal token="subject"/>
 387             <external opt="none"/>
 388         </entry>
 389         <entry id="object_name">
 390             <internal token="text"/>
 391             <external opt="required" type="char *"/>
 392             <comment>object name</comment>
 393         </entry>
 394         <entry id="domain">
 395             <internal token="text"/>
 396             <external opt="optional" type="char *"/>
 397             <comment>domain</comment>
 398         </entry>
 399         <entry id="name_service">
 400             <internal token="text"/>
 401             <external opt="required" type="char *"/>
 402             <comment>name_service</comment>
 403         </entry>
 404         <entry id="auth_used">
 405             <internal token="uauth"/>
 406             <external opt="optional" type="char *"/>
 407             <comment>authorization used</comment>
 408         </entry>
 409         <entry id="changed_values">
 410             <internal token="text"/>
 411             <external opt="required" type="char *"/>
 412             <comment>changed values</comment>
 413         </entry>
 414         <entry id="return">
 415             <internal token="return"/>
 416             <external opt="none"/>
 417         </entry>
 418     </event>
 419 
 420 <!-- instances -->
 421 
 422 <!--
 423         Java needed for SMC events.  Since the SMC events grow less
 424         often than the C related events.  They come first.  It
 425         would be nice to reorder the idNo-s, but that's an ABI
 426         change and should rev libbsm version no.  If reordered
 427         start with 1 and eliminate the comment at the end about
 428         the highest idNo.
 429 -->
 430     <event id="AUE_admin_authenticate" instance_of="AUE_generic_login"
 431         header="0" idNo="3">
 432         <title>Admin Server Authentication</title>
 433         <program>admin (various)</program>
 434         <see>SMC, WBEM, or AdminSuite</see>
 435     </event>
 436 
 437     <event id="AUE_filesystem_add" instance_of="AUE_generic_SMC_add"
 438         header="0" idNo="4">
 439         <title>SMC: filesystem add</title>
 440         <program>SMC server</program>
 441     </event>
 442     <event id="AUE_filesystem_delete" instance_of="AUE_generic_SMC_delete"
 443         header="0" idNo="5">
 444         <title>SMC: filesystem delete</title>
 445         <program>SMC server</program>
 446     </event>
 447     <event id="AUE_filesystem_modify" instance_of="AUE_generic_SMC_modify"
 448         header="0" idNo="6">
 449         <title>SMC: filesystem modify</title>
 450         <program>SMC server</program>
 451     </event>
 452 
 453     <event id="AUE_network_add" instance_of="AUE_generic_SMC_add"
 454         header="0" idNo="7">
 455         <title>SMC: network add</title>
 456         <program>SMC server</program>
 457     </event>
 458     <event id="AUE_network_delete" instance_of="AUE_generic_SMC_delete"
 459         header="0" idNo="8">
 460         <title>SMC: network delete</title>
 461         <program>SMC server</program>
 462     </event>
 463     <event id="AUE_network_modify" instance_of="AUE_generic_SMC_modify"
 464         header="0" idNo="9">
 465         <title>SMC: network modify</title>
 466         <program>SMC server</program>
 467     </event>
 468 
 469     <event id="AUE_printer_add" instance_of="AUE_generic_SMC_add"
 470         header="0" idNo="10">
 471         <title>SMC: printer add</title>
 472         <program>SMC server</program>
 473     </event>
 474     <event id="AUE_printer_delete" instance_of="AUE_generic_SMC_delete"
 475         header="0" idNo="11">
 476         <title>SMC: printer delete</title>
 477         <program>SMC server</program>
 478     </event>
 479     <event id="AUE_printer_modify" instance_of="AUE_generic_SMC_modify"
 480         header="0" idNo="12">
 481         <title>SMC: printer modify</title>
 482         <program>SMC server</program>
 483     </event>
 484 
 485 <!--
 486         This is SMC; it's also used in su and should probably be used in
 487         desktop role login.  If we fix the SMC to not record NO_MSG here,
 488         we can fix to record failed user.  See su.c and AUE_su.
 489 -->
 490     <event id="AUE_role_login" instance_of="AUE_generic_login"
 491         header="0" idNo="13">
 492         <title>RBAC: role login</title>
 493         <program>SMC server</program>
 494         <program>/usr/bin/su</program>
 495     </event>
 496 
 497     <event id="AUE_scheduledjob_add" instance_of="AUE_generic_SMC_add"
 498         header="0" idNo="14">
 499         <title>SMC: scheduled job add</title>
 500         <program>SMC server</program>
 501     </event>
 502     <event id="AUE_scheduledjob_delete" instance_of="AUE_generic_SMC_delete"
 503         header="0" idNo="15">
 504         <title>SMC: scheduled job delete</title>
 505         <program>SMC server</program>
 506     </event>
 507     <event id="AUE_scheduledjob_modify" instance_of="AUE_generic_SMC_modify"
 508         header="0" idNo="16">
 509         <title>SMC: scheduled job modify</title>
 510         <program>SMC server</program>
 511     </event>
 512 
 513     <event id="AUE_serialport_add" instance_of="AUE_generic_SMC_add"
 514         header="0" idNo="17">
 515         <title>SMC: serial port add</title>
 516         <program>SMC server</program>
 517     </event>
 518     <event id="AUE_serialport_delete" instance_of="AUE_generic_SMC_delete"
 519         header="0" idNo="18">
 520         <title>SMC: serial port delete</title>
 521         <program>SMC server</program>
 522     </event>
 523     <event id="AUE_serialport_modify" instance_of="AUE_generic_SMC_modify"
 524         header="0" idNo="19">
 525         <title>SMC: serial port modify</title>
 526         <program>SMC server</program>
 527     </event>
 528 
 529 <!-- This is SMC; should this also be used elsewhere? -->
 530     <event id="AUE_uauth" header="0" idNo="20">
 531         <title>SMC: Use of Authorization</title>
 532         <program>SMC server</program>
 533         <entry id="subject">
 534             <internal token="subject"/>
 535             <external opt="none"/>
 536         </entry>
 537         <entry id="auth_used">
 538             <internal token="uauth"/>
 539             <external opt="required" type="char *"/>
 540             <comment>authorization used</comment>
 541         </entry>
 542         <entry id="objectname">
 543             <internal token="text"/>
 544             <external opt="required" type="char *"/>
 545             <comment>object name</comment>
 546         </entry>
 547         <entry id="return">
 548             <internal token="return"/>
 549             <external opt="none"/>
 550         </entry>
 551     </event>
 552 
 553     <event id="AUE_usermgr_add" instance_of="AUE_generic_SMC_add"
 554         header="0" idNo="21">
 555         <title>SMC: User Manager add</title>
 556         <program>SMC server</program>
 557     </event>
 558     <event id="AUE_usermgr_delete" instance_of="AUE_generic_SMC_delete"
 559         header="0" idNo="22">
 560         <title>SMC: User Manager delete</title>
 561         <program>SMC server</program>
 562     </event>
 563     <event id="AUE_usermgr_modify" instance_of="AUE_generic_SMC_modify"
 564         header="0" idNo="23">
 565         <title>SMC: User Manager modify</title>
 566         <program>SMC server</program>
 567     </event>
 568 <!-- end of Java needed for SMC events -->
 569 <!--
 570     while not used by SMC logout is used by Lockhart
 571 -->
 572     <event id="AUE_logout" header="0" idNo="1"> 
 573         <title>login: logout</title>
 574         <program>various</program>
 575         <see>login(1)</see>
 576         <entry id="subject">
 577             <internal token="subject"/>
 578             <external opt="none"/>
 579         </entry>
 580 <!-- 
 581     not used by C code, used by Lockhart,
 582     get them to change and remove
 583     event.user_name("logout " + session.getUserName());
 584     from /ws/lockhart-nv-gate/src/bundled/app/webmgt/lib/services/
 585     com/sun/management/services/audit/SolarisAuditEvent_Logout.java
 586 -->
 587         <entry id="user_name">
 588             <internal token="text" format="logout %s"/>
 589             <external opt="optional" type="char *"/>
 590             <comment>"logout" username</comment>
 591         </entry>
 592         <entry id="return">
 593             <internal token="return"/>
 594             <external opt="none"/>
 595         </entry>
 596     </event>
 597 
 598 
 599 <!-- C Only events -->
 600     <event id="AUE_init_solaris" header="0" idNo="32" omit="JNI">
 601         <title>init</title>
 602         <program>/sbin/init</program>
 603         <program>/usr/sbin/init</program>
 604         <program>/usr/sbin/shutdown</program>
 605         <entry id="subject">
 606             <internal token="subject"/>
 607             <external opt="none"/>
 608         </entry>
 609         <entry id="info">
 610             <internal token="text"/>
 611             <external opt="optional" type="char *"/>
 612             <comment>init level or zone name</comment>
 613         </entry>
 614         <entry id="return">
 615             <internal token="return"/>
 616             <external opt="none"/>
 617         </entry>
 618     </event>
 619 
 620     <event id="AUE_login" instance_of="AUE_generic_login" header="0"
 621         idNo="25" omit="JNI">
 622         <title>terminal login</title>
 623         <program>/usr/sbin/login</program>
 624         <program>/usr/dt/bin/dtlogin</program>
 625         <see>login(1)</see>
 626         <see>dtlogin</see>
 627     </event>
 628     <event id="AUE_rlogin" instance_of="AUE_generic_login" header="0"
 629         idNo="28" omit="JNI">
 630         <title>rlogin</title>
 631         <program>/usr/sbin/login</program>
 632         <see>login(1) - rlogin</see>
 633     </event>
 634     <event id="AUE_telnet" instance_of="AUE_generic_login" header="0"
 635         idNo="29" omit="JNI">
 636         <title>telnet login</title>
 637         <program>/usr/sbin/login</program>
 638         <see>login(1) - telnet</see>
 639     </event>
 640     <event id="AUE_ssh" instance_of="AUE_generic_login" header="0"
 641         idNo="2" omit="JNI">
 642         <program>/usr/lib/ssh/sshd</program>
 643     </event>
 644 
 645     <event id="AUE_zlogin" header="0" idNo="38" omit="JNI">
 646         <title>zone login</title>
 647         <program>/usr/sbin/login</program>
 648         <see>zlogin(1)</see>
 649         <entry id="subject">
 650             <internal token="subject"/>
 651             <external opt="none"/>
 652         </entry>
 653         <entry id="message">
 654             <internal token="text"/>
 655             <external opt="optional" type="char *"/>
 656             <comment>error message</comment>
 657         </entry>
 658         <entry id="return">
 659             <internal token="return"/>
 660             <external opt="none"/>
 661         </entry>
 662     </event>
 663 
 664     <event id="AUE_su" header="0" idNo="30" omit="JNI">
 665         <title>su</title>
 666         <program>/usr/bin/su</program>
 667         <see>su(1M)</see>
 668         <entry id="subject">
 669             <internal token="subject"/>
 670             <external opt="none"/>
 671         </entry>
 672 <!--
 673         should be changed to "fail_user" and su.c updated
 674         However, the jni stuff is broken, so for now it's "message"
 675 -->
 676         <entry id="message">
 677             <internal token="text"/>
 678             <external opt="optional" type="char *"/>
 679             <comment>"user name" of failed new user/role</comment>
 680         </entry>
 681         <entry id="return">
 682             <internal token="return"/>
 683             <external opt="none"/>
 684         </entry>
 685     </event>
 686 
 687     <event id="AUE_passwd" header="0" idNo="27" omit="JNI">
 688         <title>passwd</title>
 689         <program>various</program>
 690         <see>passwd(1)</see>
 691         <entry id="subject">
 692             <internal token="subject"/>
 693             <external opt="none"/>
 694         </entry>
 695         <entry id="uid,username">
 696             <internal token="user"/>
 697             <external opt="optional" type="uid_t,char *"/>
 698             <comment>user if different than caller</comment>
 699         </entry>
 700         <entry id="return">
 701             <internal token="return"/>
 702             <external opt="none"/>
 703         </entry>
 704     </event>
 705 
 706     <event id="AUE_screenlock" instance_of="AUE_generic_basic" header="0"
 707         idNo="26" omit="JNI">
 708         <program>desktop screen lock</program>
 709     </event>
 710     <event id="AUE_screenunlock" instance_of="AUE_generic_basic" header="0"
 711         idNo="31" omit="JNI">
 712         <program>desktop screen unlock</program>
 713     </event>
 714 
 715     <!--
 716         AUE_prof_cmd is not supportable for Java due to the structure of
 717         the priv token.  When and if a Java program needs to generate
 718         a priv token, we'll need to look at the data format in the
 719         Java code and provide an appropriate java and jni implementation.
 720     -->
 721 
 722     <event id="AUE_prof_cmd" header="0" idNo="24" omit="JNI">
 723         <title>pfexec</title>
 724         <program>/usr/bin/pfexec</program>
 725         <see>pfexec(1)</see>
 726         <entry id="subject">
 727             <internal token="subject"/>
 728             <external opt="none"/>
 729         </entry>
 730         <entry id="cwdpath">
 731             <internal token="path"/>
 732             <external opt="required" type="char*"/>
 733             <comment>working directory</comment>
 734         </entry>
 735         <entry id="cmdpath">
 736             <internal token="path"/>
 737             <external opt="required" type="char*"/>
 738             <comment>command pathname</comment>
 739         </entry>
 740         <entry id="argc,argv,envp">
 741             <internal token="command"/>
 742             <external opt="required" type="int,char**,char**"/>
 743         </entry>
 744         <entry id="proc_auid,proc_euid,proc_egid,proc_ruid,proc_rgid,proc_pid,proc_sid,proc_termid">
 745             <internal token="process"/>
 746             <external opt="required"
 747                 type="uid_t,uid_t,gid_t,uid_t,gid_t,pid_t,au_asid_t,termid*"/>
 748         </entry>
 749         <entry id="limit_set">
 750             <internal token="priv_limit"/>
 751             <external opt="optional" type="priv_set_t*"/>
 752         </entry>
 753         <entry id="inherit_set">
 754             <internal token="priv_inherit"/>
 755             <external opt="optional" type="priv_set_t*"/>
 756         </entry>
 757         <entry id="return">
 758             <internal token="return"/>
 759             <external opt="none"/>
 760         </entry>
 761     </event>
 762 
 763     <event id="AUE_inetd_connect" header="0" idNo="34" omit="JNI">
 764         <title>inetd</title>
 765         <program>/usr/sbin/inetd</program>
 766         <entry id="subject">
 767             <internal token="subject"/>
 768             <external opt="none"/>
 769         </entry>
 770         <entry id="service_name">
 771             <internal token="text"/>
 772             <external opt="optional" type="char *"/>
 773             <comment>service name</comment>
 774         </entry>
 775         <entry id="ip_type,ip_remote_port,ip_local_port,ip_adr">
 776             <internal token="tid"/>
 777             <external opt="required"
 778                 type="uint32_t,uint16_t,uint16_t,uint32_t[4]"/>
 779             <comment>client address</comment>
 780         </entry>
 781         <entry id="cmd">
 782             <internal token="command_alt"/>
 783             <external opt="required" type="char *"/>
 784             <comment>inetd command</comment>
 785         </entry>
 786         <entry id="privileges">
 787             <internal token="priv_effective"/>
 788             <external opt="required" type="priv_set_t *"/>
 789         </entry>
 790         <entry id="return">
 791             <internal token="return"/>
 792             <external opt="none"/>
 793         </entry>
 794     </event>
 795 
 796     <event id="AUE_inetd_ratelimit" header="0" idNo="35" omit="JNI">
 797         <title>inetd</title>
 798         <program>/usr/sbin/inetd</program>
 799         <entry id="subject">
 800             <internal token="subject"/>
 801             <external opt="none"/>
 802         </entry>
 803         <entry id="service_name">
 804             <internal token="text"/>
 805             <external opt="optional" type="char *"/>
 806             <comment>service name</comment>
 807         </entry>
 808         <entry id="limit">
 809             <internal token="text"/>
 810             <external opt="required" type="char *"/>
 811             <comment>limit value</comment>
 812         </entry>
 813         <entry id="return">
 814             <internal token="return"/>
 815             <external opt="none"/>
 816         </entry>
 817     </event>
 818 
 819     <event id="AUE_inetd_copylimit" header="0" idNo="36" omit="JNI">
 820         <title>inetd</title>
 821         <program>/usr/sbin/inetd</program>
 822         <entry id="subject">
 823             <internal token="subject"/>
 824             <external opt="none"/>
 825         </entry>
 826         <entry id="service_name">
 827             <internal token="text"/>
 828             <external opt="optional" type="char *"/>
 829             <comment>service name</comment>
 830         </entry>
 831         <entry id="limit">
 832             <internal token="text"/>
 833             <external opt="required" type="char *"/>
 834             <comment>limit value</comment>
 835         </entry>
 836         <entry id="return">
 837             <internal token="return"/>
 838             <external opt="none"/>
 839         </entry>
 840     </event>
 841 
 842     <event id="AUE_inetd_failrate" header="0" idNo="37" omit="JNI">
 843         <title>inetd</title>
 844         <program>/usr/sbin/inetd</program>
 845         <entry id="subject">
 846             <internal token="subject"/>
 847             <external opt="none"/>
 848         </entry>
 849         <entry id="service_name">
 850             <internal token="text"/>
 851             <external opt="optional" type="char *"/>
 852             <comment>service name</comment>
 853         </entry>
 854         <entry id="values">
 855             <internal token="text"/>
 856             <external opt="required" type="char *"/>
 857             <comment>limit value, interval</comment>
 858         </entry>
 859         <entry id="return">
 860             <internal token="return"/>
 861             <external opt="none"/>
 862         </entry>
 863     </event>
 864 
 865     <event id="AUE_zone_state" header="0" idNo="33" omit="JNI">
 866         <entry id="subject">
 867             <internal token="subject"/>
 868             <external opt="none"/>
 869         </entry>
 870         <entry id="new_state">
 871             <internal token="text"/>
 872             <external opt="required" type="char *"/>
 873             <comment>New zone state</comment>
 874         </entry>
 875         <entry id="zonename">
 876             <internal token="zonename"/>
 877             <external opt="required" type="char *"/>
 878             <comment>zone name</comment>
 879         </entry>
 880         <entry id="return">
 881             <internal token="return"/>
 882             <external opt="none"/>
 883         </entry>
 884     </event>
 885 
 886     <event id="AUE_su_logout" instance_of="AUE_generic_basic"
 887         header="0" idNo="39" omit="JNI">
 888         <title>su</title>
 889         <program>/usr/bin/su</program>
 890         <see>su(1M)</see>
 891     </event>
 892 
 893     <event id="AUE_role_logout" instance_of="AUE_generic_basic"
 894         header="0" idNo="40" omit="JNI">
 895         <title>su</title>
 896         <program>/usr/bin/su</program>
 897         <see>su(1M)</see>
 898     </event>
 899 
 900     <event id="AUE_newgrp_login" header="0" idNo="41" omit="JNI">
 901         <program>newgrp</program>
 902         <entry id="subject">
 903             <internal token="subject"/>
 904             <external opt="none"/>
 905         </entry>
 906         <entry id="groupname">
 907             <internal  token="text"/>
 908             <external opt="required"  type="char *"/>
 909             <comment>group name</comment>
 910         </entry>
 911         <entry id="return">
 912             <internal token="return"/>
 913             <external opt="none"/>
 914         </entry>
 915     </event>
 916 
 917     <event id="AUE_generic_mountable" type="generic" omit="always">
 918         <!--
 919 
 920         User device mounting related functions
 921 
 922         -->
 923         <entry id="subject">
 924             <internal token="subject"/>
 925             <external opt="none"/>
 926         </entry>
 927         <entry id="auth_used">
 928             <internal token="uauth"/>
 929             <external opt="required" type="char *"/>
 930             <comment>authorization used</comment>
 931         </entry>
 932         <entry id="mount_point">
 933             <internal token="path"/>
 934             <external opt="required" type="char *"/>
 935             <comment>mount point</comment>
 936         </entry>
 937         <entry id="device">
 938             <internal token="path"/>
 939             <external opt="required" type="char *"/>
 940             <comment>device</comment>
 941         </entry>
 942         <entry id="options">
 943             <internal token="text"/>
 944             <external opt="optional" type="char *"/>
 945             <comment>options</comment>
 946         </entry>
 947         <entry id="return">
 948             <internal token="return"/>
 949             <external opt="none"/>
 950         </entry>
 951     </event>
 952 
 953     <event id="AUE_attach" instance_of="AUE_generic_mountable"
 954         header="0" idNo="42" omit="JNI">
 955         <program>hald</program>
 956     </event>
 957     <event id="AUE_detach" instance_of="AUE_generic_mountable"
 958         header="0" idNo="43" omit="JNI">
 959         <program>hald</program>
 960     </event>
 961     <event id="AUE_remove" header="0" idNo="44" omit="JNI">
 962         <program>hald</program>
 963         <entry id="subject">
 964             <internal token="subject"/>
 965             <external opt="none"/>
 966         </entry>
 967         <entry id="auth_used">
 968             <internal token="uauth"/>
 969             <external opt="required" type="char *"/>
 970             <comment>authorization used</comment>
 971         </entry>
 972         <entry id="mount_point">
 973             <internal token="path"/>
 974             <external opt="optional" type="char *"/>
 975             <comment>mount point</comment>
 976         </entry>
 977         <entry id="device">
 978             <internal token="path"/>
 979             <external opt="required" type="char *"/>
 980             <comment>device</comment>
 981         </entry>
 982         <entry id="return">
 983             <internal token="return"/>
 984             <external opt="none"/>
 985         </entry>
 986     </event>
 987 
 988     <event id="AUE_pool_import" header="0" idNo="45" omit="JNI">
 989         <program>hald</program>
 990         <entry id="subject">
 991             <internal token="subject"/>
 992             <external opt="none"/>
 993         </entry>
 994         <entry id="auth_used">
 995             <internal token="uauth"/>
 996             <external opt="required" type="char *"/>
 997             <comment>authorization used</comment>
 998         </entry>
 999         <entry id="pool">
1000             <internal token="text"/>
1001             <external opt="required" type="char *"/>
1002             <comment>pool</comment>
1003         </entry>
1004         <entry id="device">
1005             <internal token="path"/>
1006             <external opt="required" type="char *"/>
1007             <comment>device</comment>
1008         </entry>
1009         <entry id="return">
1010             <internal token="return"/>
1011             <external opt="none"/>
1012         </entry>
1013     </event>
1014     <event id="AUE_pool_export" header="0" idNo="46" omit="JNI">
1015         <program>hald</program>
1016         <entry id="subject">
1017             <internal token="subject"/>
1018             <external opt="none"/>
1019         </entry>
1020         <entry id="auth_used">
1021             <internal token="uauth"/>
1022             <external opt="required" type="char *"/>
1023             <comment>authorization used</comment>
1024         </entry>
1025         <entry id="pool">
1026             <internal token="text"/>
1027             <external opt="required" type="char *"/>
1028             <comment>pool</comment>
1029         </entry>
1030         <entry id="device">
1031             <internal token="path"/>
1032             <external opt="required" type="char *"/>
1033             <comment>device</comment>
1034         </entry>
1035         <entry id="return">
1036             <internal token="return"/>
1037             <external opt="none"/>
1038         </entry>
1039     </event>
1040 
1041 <!-- dladm security objected events -->
1042     <event id="AUE_dladm_generic" type="generic" omit="always">
1043         <entry id="subject">
1044             <internal token="subject"/>
1045             <external opt="none"/>
1046         </entry>
1047         <entry id="auth_used">
1048             <internal token="uauth"/>
1049             <external opt="required" type="char *"/>
1050             <comment>authorization used</comment>
1051         </entry>
1052         <entry id="obj_class">
1053             <internal token="text"/>
1054             <external opt="required" type="char *"/>
1055             <comment>object class name</comment>
1056         </entry>
1057         <entry id="obj_name">
1058             <internal token="text"/>
1059             <external opt="required" type="char *"/>
1060             <comment>object name</comment>
1061         </entry>
1062         <entry id="return">
1063             <internal token="return"/>
1064             <external opt="none"/>
1065         </entry>
1066     </event>
1067 
1068     <event id="AUE_dladm_create_secobj" instance_of="AUE_dladm_generic"
1069         header="0" idNo="47" omit="JNI">
1070         <title>create wifi security object</title>
1071         <program>/usr/sbin/dladm</program>
1072         <see>dladm(1M)</see>
1073     </event>
1074     <event id="AUE_dladm_delete_secobj" instance_of="AUE_dladm_generic"
1075         header="0" idNo="48" omit="JNI">
1076         <title>delete wifi security object</title>
1077         <program>/usr/sbin/dladm</program>
1078         <see>dladm(1M)</see>
1079     </event>
1080 
1081 <!-- Trusted eXtensions (TX) events -->
1082 
1083     <!-- labeld events -->
1084     <event id="AUE_file_relabel" header="0" idNo="49" omit="JNI">
1085         <title>relabel file from one zone to another</title>
1086         <program>setlabel(1)</program>
1087         <see>setflabel(3TSOL)</see>
1088         <entry id="subject">
1089             <internal token="subject"/>
1090             <external opt="none"/>
1091         </entry>
1092         <entry id="auth_used">
1093             <internal token="uauth"/>
1094             <external opt="required" type="char *"/>
1095             <comment>authorization used</comment>
1096         </entry>
1097         <entry id="file">
1098             <internal token="path"/>
1099             <external opt="required" type="char *"/>
1100             <comment>file relabeled</comment>
1101         </entry>
1102         <entry id="src_label">
1103             <internal token="label"/>
1104             <external opt="required" type="m_label_t *"/>
1105             <comment>original label</comment>
1106         </entry>
1107         <entry id="dst_label">
1108             <internal token="label"/>
1109             <external opt="required" type="m_label_t *"/>
1110             <comment>new label</comment>
1111         </entry>
1112         <entry id="return">
1113             <internal token="return"/>
1114             <external opt="none"/>
1115         </entry>
1116     </event>
1117 
1118     <event id="AUE_file_copy" header="0" idNo="50" omit="JNI">
1119         <title>copy file to another zone</title>
1120         <program>dtfile(1X)</program>
1121         <entry id="subject">
1122             <internal token="subject"/>
1123             <external opt="none"/>
1124         </entry>
1125         <entry id="auth_used">
1126             <internal token="uauth"/>
1127             <external opt="required" type="char *"/>
1128             <comment>authorization used</comment>
1129         </entry>
1130         <entry id="src_file">
1131             <internal token="path"/>
1132             <external opt="required" type="char *"/>
1133             <comment>source file</comment>
1134         </entry>
1135         <entry id="src_label">
1136             <internal token="label"/>
1137             <external opt="required" type="m_label_t *"/>
1138             <comment>source label</comment>
1139         </entry>
1140         <entry id="dst_file">
1141             <internal token="path"/>
1142             <external opt="required" type="char *"/>
1143             <comment>destination directory</comment>
1144         </entry>
1145         <entry id="dst_label">
1146             <internal token="label"/>
1147             <external opt="required" type="m_label_t *"/>
1148             <comment>destination label</comment>
1149         </entry>
1150         <entry id="return">
1151             <internal token="return"/>
1152             <external opt="none"/>
1153         </entry>
1154     </event>
1155 
1156     <!-- uadmin(1m) events -->
1157     <event id="AUE_uadmin_generic" type="generic" omit="always">
1158         <entry id="subject">
1159             <internal token="subject"/>
1160             <external opt="none"/>
1161         </entry>
1162         <entry id="fcn">
1163             <internal token="text"/>
1164             <external opt="required" type="msg uadmin_fcn"/>
1165             <comment>next action</comment>
1166         </entry>
1167         <entry id="mdep">
1168             <internal token="text"/>
1169             <external opt="optional" type="char *"/>
1170             <comment>machine dependent argument</comment>
1171         </entry>
1172         <entry id="return">
1173             <internal token="return"/>
1174             <external opt="none"/>
1175         </entry>
1176     </event>
1177     <event id="AUE_uadmin_generic_fcn" type="generic" omit="always">
1178         <entry id="subject">
1179             <internal token="subject"/>
1180             <external opt="none"/>
1181         </entry>
1182         <entry id="fcn">
1183             <internal token="text"/>
1184             <external opt="required" type="msg uadmin_fcn"/>
1185             <comment>next action</comment>
1186         </entry>
1187         <entry id="return">
1188             <internal token="return"/>
1189             <external opt="none"/>
1190         </entry>
1191     </event>
1192     <event id="AUE_uadmin_shutdown" instance_of="AUE_uadmin_generic"
1193         header="0" idNo="51" omit="JNI">
1194         <title>uadmin shutdown</title>
1195         <program>/sbin/uadmin</program>
1196         <program>/usr/sbin/uadmin</program>
1197         <see>uadmin(1M)</see>
1198     </event>
1199     <event id="AUE_uadmin_reboot" instance_of="AUE_uadmin_generic"
1200         header="0" idNo="52" omit="JNI">
1201         <title>uadmin reboot</title>
1202         <program>/sbin/uadmin</program>
1203         <program>/usr/sbin/uadmin</program>
1204         <see>uadmin(1M)</see>
1205     </event>
1206     <event id="AUE_uadmin_dump" instance_of="AUE_uadmin_generic"
1207         header="0" idNo="53" omit="JNI">
1208         <title>uadmin dump</title>
1209         <program>/sbin/uadmin</program>
1210         <program>/usr/sbin/uadmin</program>
1211         <see>uadmin(1M)</see>
1212     </event>
1213     <event id="AUE_uadmin_freeze" instance_of="AUE_uadmin_generic"
1214         header="0" idNo="54" omit="JNI">
1215         <title>uadmin freeze</title>
1216         <program>/sbin/uadmin</program>
1217         <program>/usr/sbin/uadmin</program>
1218         <see>uadmin(1M)</see>
1219     </event>
1220     <event id="AUE_uadmin_remount" header="0" idNo="55" omit="JNI">
1221         <title>uadmin remount</title>
1222         <program>/sbin/uadmin</program>
1223         <program>/usr/sbin/uadmin</program>
1224         <see>uadmin(1M)</see>
1225         <entry id="subject">
1226             <internal token="subject"/>
1227             <external opt="none"/>
1228         </entry>
1229         <entry id="return">
1230             <internal token="return"/>
1231             <external opt="none"/>
1232         </entry>
1233     </event>
1234     <!-- uadmin ftrace and swapctl are not documented in uadmin(2) -->
1235     <event id="AUE_uadmin_ftrace" instance_of="AUE_uadmin_generic"
1236         header="0" idNo="56" omit="JNI">
1237         <title>uadmin ftrace</title>
1238         <program>/sbin/uadmin</program>
1239         <program>/usr/sbin/uadmin</program>
1240         <see>uadmin(1M)</see>
1241     </event>
1242     <event id="AUE_uadmin_swapctl" instance_of="AUE_uadmin_generic_fcn"
1243         header="0" idNo="57" omit="JNI">
1244         <title>uadmin swapctl</title>
1245         <program>/sbin/uadmin</program>
1246         <program>/usr/sbin/uadmin</program>
1247         <see>uadmin(1M)</see>
1248     </event>
1249     <event id="AUE_uadmin_thaw" header="0" idNo="96" omit="JNI">
1250         <title>thaw after freeze</title>
1251         <program>/sbin/uadmin</program>
1252         <program>/usr/sbin/uadmin</program>
1253         <see>uadmin(1M)</see>
1254         <entry id="subject">
1255             <internal token="subject"/>
1256             <external opt="none"/>
1257         </entry>
1258         <entry id="fcn">
1259             <internal token="text"/>
1260             <external opt="required" type="msg uadmin_fcn"/>
1261             <comment>freeze action type</comment>
1262         </entry>
1263         <entry id="return">
1264             <internal token="return"/>
1265             <external opt="none"/>
1266         </entry>
1267     </event>
1268     <!-- uadmin config is not documented in uadmin(2) -->
1269     <event id="AUE_uadmin_config" instance_of="AUE_uadmin_generic"
1270         header="0" idNo="119" omit="JNI">
1271         <title>uadmin config</title>
1272         <program>/sbin/uadmin</program>
1273         <program>/usr/sbin/uadmin</program>
1274         <see>uadmin(1M)</see>
1275     </event>
1276 
1277 <!-- smbd service event; smbd session setup -->
1278     <event id="AUE_smbd_session" header="0" idNo="58" omit="JNI">
1279         <title>smbd</title>
1280         <program>/usr/lib/smbsrv/smbd</program>
1281         <entry id="subject">
1282             <internal token="subject"/>
1283             <external opt="none"/>
1284         </entry>
1285         <entry id="domain">
1286             <internal token="text"/>
1287             <external opt="required" type="char*"/>
1288         <comment>domain</comment>
1289         </entry>
1290         <entry id="username">
1291             <internal token="text"/>
1292             <external opt="required" type="char*"/>
1293         <comment>username</comment>
1294         </entry>
1295         <entry id="sid">
1296             <internal token="text"/>
1297             <external opt="optional" type="char*"/>
1298         <comment>sid</comment>
1299         </entry>
1300         <entry id="return">
1301             <internal token="return"/>
1302             <external opt="none"/>
1303         </entry>
1304     </event>
1305 
1306 <!-- smbd service event; smbd session logoff -->
1307     <event id="AUE_smbd_logoff" header="0" idNo="59" omit="JNI">
1308         <title>smbd</title>
1309         <program>/usr/lib/smbsrv/smbd</program>
1310         <entry id="subject">
1311             <internal token="subject"/>
1312             <external opt="none"/>
1313         </entry>
1314         <entry id="domain">
1315             <internal token="text"/>
1316             <external opt="required" type="char*"/>
1317         <comment>domain</comment>
1318         </entry>
1319         <entry id="username">
1320             <internal token="text"/>
1321             <external opt="required" type="char*"/>
1322         <comment>username</comment>
1323         </entry>
1324         <entry id="return">
1325             <internal token="return"/>
1326             <external opt="none"/>
1327         </entry>
1328     </event>
1329 
1330 <!-- vscan service event; infected file detected -->
1331     <event id="AUE_vscan_quarantine" header="0" idNo="60" omit="JNI">
1332         <title>VSCAN: quarantine infected file</title>
1333         <program>/usr/lib/vscan/vscand</program>
1334         <see>vscand(1M), ICAP RFC 3507 (Extensions)</see>
1335         <entry id="subject">
1336             <internal token="subject"/>
1337             <external opt="none"/>
1338         </entry>
1339         <entry id="file">
1340             <internal token="path"/>
1341             <external opt="required" type="char*"/>
1342             <comment>infected file</comment>
1343         </entry>
1344         <entry id="violations,nviolations">
1345             <internal token="text"/>
1346             <external opt="optional" type="char**,int"/>
1347             <comment>ID - threat description</comment>
1348         </entry>
1349         <entry id="return">
1350             <internal token="return"/>
1351             <external opt="none"/>
1352         </entry>
1353     </event>
1354 
1355 <!-- ndmp service event; ndmp client connect -->
1356     <event id="AUE_ndmp_connect" instance_of="AUE_generic_basic" header="0"
1357         idNo="61" omit="JNI">
1358         <title>NDMP Connect</title>
1359         <program>/usr/lib/ndmp/ndmpd</program>
1360         <see>ndmpd(1M)</see>
1361     </event>
1362 
1363 <!-- ndmp service event; ndmp client disconnect -->
1364     <event id="AUE_ndmp_disconnect" instance_of="AUE_generic_basic" header="0"
1365         idNo="62" omit="JNI">
1366         <title>NDMP Disconnect</title>
1367         <program>/usr/lib/ndmp/ndmpd</program>
1368         <see>ndmpd(1M)</see>
1369     </event>
1370 
1371 <!-- ndmp service event; ndmp backup -->
1372     <event id="AUE_ndmp_backup" header="0" idNo="63" omit="JNI">
1373         <title>NDMP Backup</title>
1374         <program>/usr/lib/ndmp/ndmpd</program>
1375         <see>ndmpd(1M)</see>
1376         <entry id="subject">
1377             <internal token="subject"/>
1378             <external opt="none"/>
1379         </entry>
1380         <entry id="source">
1381             <internal token="path"/>
1382             <external opt="required" type="char *"/>
1383             <comment>path to be backed up</comment>
1384         </entry>
1385         <entry id="local_dest">
1386             <internal token="path"/>
1387             <external opt="optional" type="char *"/>
1388             <comment>local path of backup destination</comment>
1389         </entry>
1390         <entry id="remote_dest">
1391             <internal token="in_peer"/>
1392             <external opt="optional" type="fd_t"/>
1393             <comment>remote ip address and port of backup destination</comment>
1394         </entry>
1395         <entry id="return">
1396             <internal token="return"/>
1397             <external opt="none"/>
1398         </entry>
1399     </event>
1400 
1401 <!-- ndmp service event; ndmp restore -->
1402     <event id="AUE_ndmp_restore" header="0" idNo="64" omit="JNI">
1403         <title>NDMP Restore</title>
1404         <program>/usr/lib/ndmp/ndmpd</program>
1405         <see>ndmpd(1M)</see>
1406         <entry id="subject">
1407             <internal token="subject"/>
1408             <external opt="none"/>
1409         </entry>
1410         <entry id="destination">
1411             <internal token="path"/>
1412             <external opt="required" type="char *"/>
1413             <comment>path to restore to</comment>
1414         </entry>
1415         <entry id="local_source">
1416             <internal token="path"/>
1417             <external opt="optional" type="char *"/>
1418             <comment>local path to restore from</comment>
1419         </entry>
1420         <entry id="remote_source">
1421             <internal token="in_peer"/>
1422             <external opt="optional" type="fd_t"/>
1423             <comment>remote ip address and port to restore from</comment>
1424         </entry>
1425         <entry id="return">
1426             <internal token="return"/>
1427             <external opt="none"/>
1428         </entry>
1429     </event>
1430 
1431 <!-- SMF related events -->
1432     <event id="AUE_smf_generic" type="generic" omit="always">
1433         <!--
1434         This is a template for the event types that have no tokens
1435         other than the header and return. There is no allowed_type
1436         list because the template is not externally visible due to the
1437         omit="always".
1438         -->
1439         <entry id="subject">
1440             <internal token="subject"/>
1441             <external opt="none"/>
1442         </entry>
1443         <entry id="auth_used">
1444             <internal token="uauth"/>
1445             <external opt="required" type="char *"/>
1446             <comment>authorization used</comment>
1447         </entry>
1448         <entry id="fmri">
1449             <internal token="fmri"/>
1450             <external opt="required" type="char *"/>
1451             <comment>name</comment>
1452         </entry>
1453         <entry id="return">
1454             <internal token="return"/>
1455             <external opt="none"/>
1456         </entry>
1457     </event>
1458 
1459     <event id="AUE_smf_generic_pg" type="generic" omit="always">
1460         <!--
1461         This is a template for the event types related to property groups.
1462         There is no allowed_type list because the template is not externally
1463         visible due to the omit="always".
1464         -->
1465         <entry id="subject">
1466             <internal token="subject"/>
1467             <external opt="none"/>
1468         </entry>
1469         <entry id="auth_used">
1470             <internal token="uauth"/>
1471             <external opt="required" type="char *"/>
1472             <comment>authorization used</comment>
1473         </entry>
1474         <entry id="fmri">
1475             <internal token="fmri"/>
1476             <external opt="required" type="char *"/>
1477         </entry>
1478         <entry id="type">
1479             <internal token="text"/>
1480             <external opt="required" type="char *"/>
1481             <comment>property group type</comment>
1482         </entry>
1483         <entry id="return">
1484             <internal token="return"/>
1485             <external opt="none"/>
1486         </entry>
1487     </event>
1488 
1489     <event id="AUE_smf_enable" instance_of="AUE_smf_generic" header="0"
1490         idNo="65" omit="JNI">
1491         <program>svc.configd(1M)</program>
1492         <see>svcadm(1M)</see>
1493     </event>
1494     <event id="AUE_smf_tmp_enable" instance_of="AUE_smf_generic" header="0"
1495         idNo="66" omit="JNI">
1496         <program>svc.configd(1M)</program>
1497         <see>svcadm(1M)</see>
1498     </event>
1499     <event id="AUE_smf_disable" instance_of="AUE_smf_generic" header="0"
1500         idNo="67" omit="JNI">
1501         <program>svc.configd(1M)</program>
1502         <see>svcadm(1M)</see>
1503     </event>
1504     <event id="AUE_smf_tmp_disable" instance_of="AUE_smf_generic" header="0"
1505         idNo="68" omit="JNI">
1506         <program>svc.configd(1M)</program>
1507         <see>svcadm(1M)</see>
1508     </event>
1509     <event id="AUE_smf_restart" instance_of="AUE_smf_generic" header="0"
1510         idNo="69" omit="JNI">
1511         <program>svc.configd(1M)</program>
1512         <see>svcadm(1M)</see>
1513     </event>
1514     <event id="AUE_smf_refresh" instance_of="AUE_smf_generic" header="0"
1515         idNo="70" omit="JNI">
1516         <program>svc.configd(1M)</program>
1517         <see>svcadm(1M)</see>
1518     </event>
1519     <event id="AUE_smf_clear" instance_of="AUE_smf_generic" header="0"
1520         idNo="71" omit="JNI">
1521         <program>svc.configd(1M)</program>
1522         <see>svcadm(1M)</see>
1523     </event>
1524     <event id="AUE_smf_degrade" instance_of="AUE_smf_generic" header="0"
1525         idNo="72" omit="JNI">
1526         <program>svc.configd(1M)</program>
1527         <see>svcadm(1M)</see>
1528     </event>
1529     <event id="AUE_smf_immediate_degrade" instance_of="AUE_smf_generic"
1530         header="0" idNo="73" omit="JNI">
1531         <program>svc.configd(1M)</program>
1532         <see>svcadm(1M)</see>
1533     </event>
1534     <event id="AUE_smf_maintenance" instance_of="AUE_smf_generic" header="0"
1535         idNo="74" omit="JNI">
1536         <program>svc.configd(1M)</program>
1537         <see>svcadm(1M)</see>
1538     </event>
1539     <event id="AUE_smf_immediate_maintenance" instance_of="AUE_smf_generic"
1540         header="0" idNo="75" omit="JNI">
1541         <program>svc.configd(1M)</program>
1542         <see>svcadm(1M)</see>
1543     </event>
1544     <event id="AUE_smf_immtmp_maintenance" instance_of="AUE_smf_generic"
1545         header="0" idNo="76" omit="JNI">
1546         <program>svc.configd(1M)</program>
1547         <see>svcadm(1M)</see>
1548     </event>
1549     <event id="AUE_smf_tmp_maintenance" instance_of="AUE_smf_generic" header="0"
1550         idNo="77" omit="JNI">
1551         <program>svc.configd(1M)</program>
1552         <see>svcadm(1M)</see>
1553     </event>
1554     <event id="AUE_smf_milestone" instance_of="AUE_smf_generic" header="0"
1555         idNo="78" omit="JNI">
1556         <program>svc.configd(1M)</program>
1557         <see>svcadm(1M)</see>
1558     </event>
1559 
1560     <event id="AUE_smf_create" instance_of="AUE_smf_generic" header="0"
1561         idNo="79" omit="JNI">
1562         <program>svc.configd(1M)</program>
1563         <see>svccfg(1M)</see>
1564     </event>
1565     <event id="AUE_smf_delete" instance_of="AUE_smf_generic" header="0"
1566         idNo="80" omit="JNI">
1567         <program>svc.configd(1M)</program>
1568         <see>svccfg(1M)</see>
1569     </event>
1570 
1571     <event id="AUE_smf_create_pg" instance_of="AUE_smf_generic_pg" header="0"
1572         idNo="81" omit="JNI">
1573         <program>svc.configd(1M)</program>
1574         <see>svccfg(1M)</see>
1575     </event>
1576     <event id="AUE_smf_create_npg" instance_of="AUE_smf_generic_pg" header="0"
1577         idNo="82" omit="JNI">
1578         <program>svc.configd(1M)</program>
1579         <see>svccfg(1M)</see>
1580     </event>
1581     <event id="AUE_smf_delete_pg" instance_of="AUE_smf_generic_pg" header="0"
1582         idNo="83" omit="JNI">
1583         <program>svc.configd(1M)</program>
1584         <see>svccfg(1M)</see>
1585     </event>
1586     <event id="AUE_smf_delete_npg" instance_of="AUE_smf_generic_pg" header="0"
1587         idNo="84" omit="JNI">
1588         <program>svc.configd(1M)</program>
1589         <see>svccfg(1M)</see>
1590     </event>
1591 
1592     <event id="AUE_smf_create_snap" header="0" idNo="85" omit="JNI">
1593         <program>svc.configd(1M)</program>
1594         <see>svccfg(1M)</see>
1595         <entry id="subject">
1596             <internal token="subject"/>
1597             <external opt="none"/>
1598         </entry>
1599         <entry id="auth_used">
1600             <internal token="uauth"/>
1601             <external opt="required" type="char *"/>
1602             <comment>authorization used</comment>
1603         </entry>
1604         <entry id="fmri">
1605             <internal token="fmri"/>
1606             <external opt="required" type="char *"/>
1607             <comment>name</comment>
1608         </entry>
1609         <entry id="name">
1610             <internal token="text"/>
1611             <external opt="required" type="char *"/>
1612             <comment>snapshot name</comment>
1613         </entry>
1614         <entry id="return">
1615             <internal token="return"/>
1616             <external opt="none"/>
1617         </entry>
1618     </event>
1619     <event id="AUE_smf_delete_snap" header="0" idNo="86" omit="JNI">
1620         <program>svc.configd(1M)</program>
1621         <see>svccfg(1M)</see>
1622         <entry id="subject">
1623             <internal token="subject"/>
1624             <external opt="none"/>
1625         </entry>
1626         <entry id="auth_used">
1627             <internal token="uauth"/>
1628             <external opt="required" type="char *"/>
1629             <comment>authorization used</comment>
1630         </entry>
1631         <entry id="fmri">
1632             <internal token="fmri"/>
1633             <external opt="required" type="char *"/>
1634             <comment>name</comment>
1635         </entry>
1636         <entry id="name">
1637             <internal token="text"/>
1638             <external opt="required" type="char *"/>
1639             <comment>snapshot name</comment>
1640         </entry>
1641         <entry id="return">
1642             <internal token="return"/>
1643             <external opt="none"/>
1644         </entry>
1645     </event>
1646     <event id="AUE_smf_attach_snap" header="0" idNo="87" omit="JNI">
1647         <program>svc.configd(1M)</program>
1648         <see>svccfg(1M)</see>
1649         <entry id="subject">
1650             <internal token="subject"/>
1651             <external opt="none"/>
1652         </entry>
1653         <entry id="auth_used">
1654             <internal token="uauth"/>
1655             <external opt="required" type="char *"/>
1656             <comment>authorization used</comment>
1657         </entry>
1658         <entry id="old_fmri">
1659             <internal token="fmri"/>
1660             <external opt="required" type="char *"/>
1661             <comment>old name</comment>
1662         </entry>
1663         <entry id="old_name">
1664             <internal token="text"/>
1665             <external opt="required" type="char *"/>
1666             <comment>old snapshot</comment>
1667         </entry>
1668         <entry id="new_fmri">
1669             <internal token="fmri"/>
1670             <external opt="required" type="char *"/>
1671             <comment>new name</comment>
1672         </entry>
1673         <entry id="new_name">
1674             <internal token="text"/>
1675             <external opt="required" type="char *"/>
1676             <comment>new snapshot</comment>
1677         </entry>
1678         <entry id="return">
1679             <internal token="return"/>
1680             <external opt="none"/>
1681         </entry>
1682     </event>
1683 
1684     <event id="AUE_smf_annotation" header="0" idNo="88" omit="JNI">
1685         <program>svc.configd(1M)</program>
1686         <see>svccfg(1M)</see>
1687         <entry id="subject">
1688             <internal token="subject"/>
1689             <external opt="none"/>
1690         </entry>
1691         <entry id="operation">
1692             <internal token="text"/>
1693             <external opt="required" type="char *"/>
1694             <comment>operation</comment>
1695         </entry>
1696         <entry id="file">
1697             <internal token="path"/>
1698             <external opt="required" type="char *"/>
1699             <comment>imported file</comment>
1700         </entry>
1701         <entry id="return">
1702             <internal token="return"/>
1703             <external opt="none"/>
1704         </entry>
1705     </event>
1706 
1707     <event id="AUE_smf_create_prop" header="0" idNo="89" omit="JNI">
1708         <program>svc.configd(1M)</program>
1709         <see>svccfg(1M)</see>
1710         <entry id="subject">
1711             <internal token="subject"/>
1712             <external opt="none"/>
1713         </entry>
1714         <entry id="auth_used">
1715             <internal token="uauth"/>
1716             <external opt="required" type="char *"/>
1717             <comment>authorization used</comment>
1718         </entry>
1719         <entry id="fmri">
1720             <internal token="fmri"/>
1721             <external opt="required" type="char *"/>
1722             <comment>name</comment>
1723         </entry>
1724         <entry id="type">
1725             <internal token="text"/>
1726             <external opt="required" type="char *"/>
1727             <comment>type</comment>
1728         </entry>
1729         <entry id="value">
1730             <internal token="text"/>
1731             <external opt="optional" type="char *"/>
1732             <comment>value</comment>
1733         </entry>
1734         <entry id="return">
1735             <internal token="return"/>
1736             <external opt="none"/>
1737         </entry>
1738     </event>
1739 
1740     <event id="AUE_smf_change_prop" header="0" idNo="90" omit="JNI">
1741         <program>svc.configd(1M)</program>
1742         <see>svccfg(1M)</see>
1743         <entry id="subject">
1744             <internal token="subject"/>
1745             <external opt="none"/>
1746         </entry>
1747         <entry id="auth_used">
1748             <internal token="uauth"/>
1749             <external opt="required" type="char *"/>
1750             <comment>authorization used</comment>
1751         </entry>
1752         <entry id="fmri">
1753             <internal token="fmri"/>
1754             <external opt="required" type="char *"/>
1755             <comment>name</comment>
1756         </entry>
1757         <entry id="type">
1758             <internal token="text"/>
1759             <external opt="required" type="char *"/>
1760             <comment>type</comment>
1761         </entry>
1762         <entry id="value">
1763             <internal token="text"/>
1764             <external opt="optional" type="char *"/>
1765             <comment>value</comment>
1766         </entry>
1767         <entry id="return">
1768             <internal token="return"/>
1769             <external opt="none"/>
1770         </entry>
1771     </event>
1772     <event id="AUE_smf_delete_prop" header="0" idNo="91" omit="JNI">
1773         <program>svc.configd(1M)</program>
1774         <see>svccfg(1M)</see>
1775         <entry id="subject">
1776             <internal token="subject"/>
1777             <external opt="none"/>
1778         </entry>
1779         <entry id="auth_used">
1780             <internal token="uauth"/>
1781             <external opt="required" type="char *"/>
1782             <comment>authorization used</comment>
1783         </entry>
1784         <entry id="fmri">
1785             <internal token="fmri"/>
1786             <external opt="required" type="char *"/>
1787             <comment>name</comment>
1788         </entry>
1789         <entry id="return">
1790             <internal token="return"/>
1791             <external opt="none"/>
1792         </entry>
1793     </event>
1794 
1795     <event id="AUE_smf_read_prop" instance_of="AUE_smf_generic" header="0"
1796         idNo="92" omit="JNI">
1797         <program>svc.configd(1M)</program>
1798         <see>svccfg(1M)</see>
1799     </event>
1800 
1801 <!-- CPUFreq related events -->
1802 
1803     <event id="AUE_cpu_ondemand" header="0" idNo="93" omit="JNI">
1804         <title>set CPU freq to minimal unless load increases</title>
1805         <program>/usr/lib/hal/hald-addon-cpufreq</program>
1806         <see>hald(1M)</see>
1807         <entry id="subject">
1808             <internal token="subject"/>
1809             <external opt="none"/>
1810         </entry>
1811         <entry id="auth_used">
1812             <internal token="uauth"/>
1813             <external opt="required" type="char *"/>
1814             <comment>authorization used</comment>
1815         </entry>
1816         <entry id="return">
1817             <internal token="return"/>
1818             <external opt="none"/>
1819         </entry>
1820     </event>
1821     <event id="AUE_cpu_performance" header="0" idNo="94" omit="JNI">
1822         <title>set CPU freq to Max</title>
1823         <program>/usr/lib/hal/hald-addon-cpufreq</program>
1824         <see>hald(1M)</see>
1825         <entry id="subject">
1826             <internal token="subject"/>
1827             <external opt="none"/>
1828         </entry>
1829         <entry id="auth_used">
1830             <internal token="uauth"/>
1831             <external opt="required" type="char *"/>
1832             <comment>authorization used</comment>
1833         </entry>
1834         <entry id="return">
1835             <internal token="return"/>
1836             <external opt="none"/>
1837         </entry>
1838     </event>
1839     <event id="AUE_cpu_threshold" header="0" idNo="95" omit="JNI">
1840         <title>set CPU frequency threshold percentage</title>
1841         <program>/usr/lib/hal/hald-addon-cpufreq</program>
1842         <see>hald(1M)</see>
1843         <entry id="subject">
1844             <internal token="subject"/>
1845             <external opt="none"/>
1846         </entry>
1847         <entry id="auth_used">
1848             <internal token="uauth"/>
1849             <external opt="required" type="char *"/>
1850             <comment>authorization used</comment>
1851         </entry>
1852         <entry id="threshold">
1853             <internal token="text"/>
1854             <external opt="required" type="int"/>
1855             <comment>threshold percent 1-100</comment>
1856         </entry>
1857         <entry id="return">
1858             <internal token="return"/>
1859             <external opt="none"/>
1860         </entry>
1861     </event>
1862 
1863 <!-- TPM events recorded by tcsd(8) -->
1864 
1865     <event id="AUE_generic_tpm" type="generic" omit="always">
1866         <entry id="subject">
1867             <internal token="subject"/>
1868             <external opt="none"/>
1869         </entry>
1870         <entry id="message">
1871                 <internal token="text"/>
1872                 <external opt="optional" type="msg tpm_e"/>
1873                 <comment>TPM error message</comment>
1874         </entry>
1875         <entry id="return">
1876             <internal token="return"/>
1877             <external opt="none"/>
1878         </entry>
1879     </event>
1880 
1881     <event id="AUE_tpm_takeownership" instance_of="AUE_generic_tpm"
1882         header="0" idNo="99" omit="JNI">
1883         <title>TPM_TakeOwnership</title>
1884         <program>/usr/lib/tcsd</program>
1885         <see>tcsd(8)</see>
1886     </event>
1887     <event id="AUE_tpm_setoperatorauth" instance_of="AUE_generic_tpm"
1888         header="0" idNo="100" omit="JNI">
1889         <title>TPM_SetOperatorAuth</title>
1890         <program>/usr/lib/tcsd</program>
1891         <see>tcsd(8)</see>
1892     </event>
1893     <event id="AUE_tpm_setownerinstall" instance_of="AUE_generic_tpm"
1894         header="0" idNo="101" omit="JNI">
1895         <title>TPM_SetOwnerInstall</title>
1896         <program>/usr/lib/tcsd</program>
1897         <see>tcsd(8)</see>
1898     </event>
1899     <event id="AUE_tpm_selftestfull" instance_of="AUE_generic_tpm"
1900         header="0" idNo="102" omit="JNI">
1901         <title>TPM_SelfTestFull</title>
1902         <program>/usr/lib/tcsd</program>
1903         <see>tcsd(8)</see>
1904     </event>
1905     <event id="AUE_tpm_certifyselftest" instance_of="AUE_generic_tpm"
1906         header="0" idNo="103" omit="JNI">
1907         <title>TPM_CertifySelfTest</title>
1908         <program>/usr/lib/tcsd</program>
1909         <see>tcsd(8)</see>
1910     </event>
1911     <event id="AUE_tpm_continueselftest" instance_of="AUE_generic_tpm"
1912         header="0" idNo="104" omit="JNI">
1913         <title>TPM_ContinueSelfTest</title>
1914         <program>/usr/lib/tcsd</program>
1915         <see>tcsd(8)</see>
1916     </event>
1917     <event id="AUE_tpm_ownersetdisable" instance_of="AUE_generic_tpm"
1918         header="0" idNo="105" omit="JNI">
1919         <title>TPM_OwnerSetDisable</title>
1920         <program>/usr/lib/tcsd</program>
1921         <see>tcsd(8)</see>
1922     </event>
1923     <event id="AUE_tpm_ownerclear" instance_of="AUE_generic_tpm"
1924         header="0" idNo="106" omit="JNI">
1925         <title>TPM_OwnerClear</title>
1926         <program>/usr/lib/tcsd</program>
1927         <see>tcsd(8)</see>
1928     </event>
1929     <event id="AUE_tpm_disableownerclear" instance_of="AUE_generic_tpm"
1930         header="0" idNo="107" omit="JNI">
1931         <title>TPM_DisableOwnerClear</title>
1932         <program>/usr/lib/tcsd</program>
1933         <see>tcsd(8)</see>
1934     </event>
1935     <event id="AUE_tpm_forceclear" instance_of="AUE_generic_tpm"
1936         header="0" idNo="108" omit="JNI">
1937         <title>TPM_ForceClear</title>
1938         <program>/usr/lib/tcsd</program>
1939         <see>tcsd(8)</see>
1940     </event>
1941     <event id="AUE_tpm_disableforceclear" instance_of="AUE_generic_tpm"
1942         header="0" idNo="109" omit="JNI">
1943         <title>TPM_DisableForceClear</title>
1944         <program>/usr/lib/tcsd</program>
1945         <see>tcsd(8)</see>
1946     </event>
1947     <event id="AUE_tpm_physicaldisable" instance_of="AUE_generic_tpm"
1948         header="0" idNo="110" omit="JNI">
1949         <title>TPM_PhysicalDisable</title>
1950         <program>/usr/lib/tcsd</program>
1951         <see>tcsd(8)</see>
1952     </event>
1953     <event id="AUE_tpm_physicalenable" instance_of="AUE_generic_tpm"
1954         header="0" idNo="111" omit="JNI">
1955         <title>TPM_PhysicalEnsable</title>
1956         <program>/usr/lib/tcsd</program>
1957         <see>tcsd(8)</see>
1958     </event>
1959     <event id="AUE_tpm_physicaldeactivate" instance_of="AUE_generic_tpm"
1960         header="0" idNo="112" omit="JNI">
1961         <title>TPM_PhysicalSetDeactivated</title>
1962         <program>/usr/lib/tcsd</program>
1963         <see>tcsd(8)</see>
1964     </event>
1965     <event id="AUE_tpm_settempdeactivated" instance_of="AUE_generic_tpm"
1966         header="0" idNo="113" omit="JNI">
1967         <title>TPM_SetTempDeactivated</title>
1968         <program>/usr/lib/tcsd</program>
1969         <see>tcsd(8)</see>
1970     </event>
1971     <event id="AUE_tpm_physicalpresence" instance_of="AUE_generic_tpm"
1972         header="0" idNo="114" omit="JNI">
1973         <title>TPM_PhysicalPresence</title>
1974         <program>/usr/lib/tcsd</program>
1975         <see>tcsd(8)</see>
1976     </event>
1977     <event id="AUE_tpm_fieldupgrade" instance_of="AUE_generic_tpm"
1978         header="0" idNo="115" omit="JNI">
1979         <title>TPM_FieldUpgrade</title>
1980         <program>/usr/lib/tcsd</program>
1981         <see>tcsd(8)</see>
1982     </event>
1983     <event id="AUE_tpm_resetlockvalue" instance_of="AUE_generic_tpm"
1984         header="0" idNo="116" omit="JNI">
1985         <title>TPM_ResetLockValue</title>
1986         <program>/usr/lib/tcsd</program>
1987         <see>tcsd(8)</see>
1988     </event>
1989 
1990 <!-- hotplug events recorded by hotplugd(1m) -->
1991 
1992     <event id="AUE_hotplug_state" header="0" idNo="117" omit="JNI">
1993         <title>change hotplug connection state</title>
1994         <program>/usr/lib/hotplugd</program>
1995         <see>hotplugd(1M)</see>
1996         <entry id="subject">
1997             <internal token="subject"/>
1998             <external opt="none"/>
1999         </entry>
2000         <entry id="auth_used">
2001             <internal token="uauth"/>
2002             <external opt="required" type="char *"/>
2003             <comment>authorization used</comment>
2004         </entry>
2005         <entry id="device_path">
2006             <internal token="path"/>
2007             <external opt="required" type="char *"/>
2008             <comment>device path</comment>
2009         </entry>
2010         <entry id="connection">
2011             <internal token="text"/>
2012             <external opt="required" type="char *"/>
2013             <comment>connector or port</comment>
2014         </entry>
2015         <entry id="new_state">
2016             <internal token="text"/>
2017             <external opt="required" type="char *"/>
2018             <comment>new connection state</comment>
2019         </entry>
2020         <entry id="old_state">
2021             <internal token="text"/>
2022             <external opt="required" type="char *"/>
2023             <comment>old connection state</comment>
2024         </entry>
2025         <entry id="return">
2026             <internal token="return"/>
2027             <external opt="none"/>
2028         </entry>
2029     </event>
2030 
2031     <event id="AUE_hotplug_set" header="0" idNo="118" omit="JNI">
2032         <title>set hotplug bus private options</title>
2033         <program>/usr/lib/hotplugd</program>
2034         <see>hotplugd(1M)</see>
2035         <entry id="subject">
2036             <internal token="subject"/>
2037             <external opt="none"/>
2038         </entry>
2039         <entry id="auth_used">
2040             <internal token="uauth"/>
2041             <external opt="required" type="char *"/>
2042             <comment>authorization used</comment>
2043         </entry>
2044         <entry id="device_path">
2045             <internal token="path"/>
2046             <external opt="required" type="char *"/>
2047             <comment>device path</comment>
2048         </entry>
2049         <entry id="connection">
2050             <internal token="text"/>
2051             <external opt="required" type="char *"/>
2052             <comment>connector or port</comment>
2053         </entry>
2054         <entry id="options">
2055             <internal token="text"/>
2056             <external opt="required" type="char *"/>
2057             <comment>bus private options</comment>
2058         </entry>
2059         <entry id="return">
2060             <internal token="return"/>
2061             <external opt="none"/>
2062         </entry>
2063     </event>
2064 
2065     <event id="AUE_ilb_create_healthcheck" header="0" idNo="120" omit="JNI">
2066         <title>Create Integrated Loadbalancer healthcheck object</title>
2067         <program>/usr/sbin/ilbadm</program>
2068         <see>ilbadm(1m)</see>
2069         <entry id="subject">
2070             <internal token="subject"/>
2071             <external opt="none"/>
2072         </entry>
2073         <entry id="auth_used">
2074             <internal token="uauth"/>
2075             <external opt="required" type="char *"/>
2076             <comment>authorization used</comment>
2077         </entry>
2078         <entry id="hc_test">
2079             <internal token="path"/>
2080             <external opt="required" type="char *"/>
2081             <comment>healthcheck type-PING,TCP,UDP or 3rd party script</comment>
2082         </entry>
2083         <entry id="hc_name">
2084             <internal token="text"/>
2085             <external opt="required" type="char *"/>
2086             <comment>healthcheck name</comment>
2087         </entry>
2088         <entry id="hc_timeout">
2089             <internal token="text"/>
2090             <external opt="required" type="int32_t" />
2091             <comment>timeout(secs) to kill a hung healthcheck probe
2092                 - 0 means default value (see man page)
2093             </comment>
2094         </entry>
2095         <entry id="hc_count">
2096             <internal token="text"/>
2097             <external opt="required" type="int"/>
2098             <comment>number of times to run a health check probe
2099                 before declaring a server to be dead - 0 means
2100                 default value (see man page)
2101             </comment>
2102         </entry>
2103         <entry id="hc_interval">
2104             <internal token="text"/>
2105             <external opt="required" type="int32_t"/>
2106             <comment>time(secs) between 2 healthcheck events -
2107                 0 means default value(see man page)
2108             </comment>
2109         </entry>
2110         <entry id="return">
2111             <internal token="return"/>
2112             <external opt="none"/>
2113         </entry>
2114     </event> 
2115 
2116     <event id="AUE_ilb_delete_healthcheck" header="0" idNo="121" omit="JNI">
2117         <title>Delete Integrated Loadbalancer healthcheck object</title>
2118         <program>/usr/sbin/ilbadm</program>
2119         <see>ilbadm(1m)</see>
2120         <entry id="subject">
2121             <internal token="subject"/>
2122             <external opt="none"/>
2123         </entry>
2124         <entry id="auth_used">
2125             <internal token="uauth"/>
2126             <external opt="required" type="char *"/>
2127             <comment>authorization used</comment>
2128         </entry>
2129         <entry id="hc_name">
2130             <internal token="text"/>
2131             <external opt="required" type="char *"/>
2132             <comment>healthcheck name</comment>
2133         </entry>
2134         <entry id="return">
2135             <internal token="return"/>
2136             <external opt="none"/>
2137         </entry>
2138     </event>
2139 
2140     <event id="AUE_ilb_create_rule" header="0" idNo="122" omit="JNI">
2141         <title>Create Integrated Loadbalancer rule</title>
2142         <program>/usr/sbin/ilbadm</program>
2143         <see>ilbadm(1m)</see>
2144         <entry id="subject">
2145             <internal token="subject"/>
2146             <external opt="none"/>
2147         </entry>
2148         <entry id="auth_used">
2149             <internal token="uauth"/>
2150             <external opt="required" type="char *"/>
2151             <comment>authorization used</comment>
2152         </entry>
2153         <entry id="virtual_ipaddress_type,virtual_ipaddress">
2154             <internal token="in_remote"/>
2155             <external opt="required" type="int32_t,uint32_t[4]"/>
2156             <comment>LB virtual IP address</comment>
2157         </entry>
2158         <entry id="min_port">
2159             <internal token="iport"/>
2160             <external opt="required" type="uint16_t"/>
2161             <comment>minimum value in port range</comment>
2162         </entry>
2163         <entry id="max_port">
2164             <internal token="iport"/>
2165             <external opt="required" type="uint16_t"/>
2166             <comment>maximum value in port range - max=min means single
2167                 port is specified
2168             </comment>
2169         </entry>
2170         <entry id="protocol">
2171             <internal token="text"/>
2172             <external opt="required" type="char *"/>
2173             <comment>protocol</comment>
2174         </entry>
2175         <entry id="algo_optype">
2176             <internal token="text"/>
2177             <external opt="required" type="char *"/>
2178             <comment>[rr,hip,hipp,hipv],[dsr,nat,half-nat]</comment>
2179         </entry>
2180         <entry id="proxy_src_min_type,proxy_src_min">
2181             <internal token="in_remote"/>
2182             <external opt="optional" type="int32_t,uint32_t[4]"/>
2183             <comment>min value for proxy source address for NAT</comment>
2184         </entry>
2185         <entry id="proxy_src_max_type,proxy_src_max">
2186             <internal token="in_remote"/>
2187             <external opt="optional" type="int32_t,uint32_t[4]"/>
2188             <comment>max value in proxy source address range for NAT
2189                   - max=min means single address is specified
2190             </comment>
2191         </entry>
2192         <entry id="persist_mask">
2193             <internal token="text"/>
2194             <external opt="required" type="char *"/>
2195             <comment>prefix length</comment>
2196         </entry>
2197         <entry id="hcname">
2198             <internal token="text"/>
2199             <external opt="optional" type="char *"/>
2200             <comment>healthcheck name</comment>
2201         </entry>
2202         <entry id="hcport">
2203             <internal token="text"/>
2204             <external opt="optional" type="char *"/>
2205             <comment>healthcheck port - ANY(dynamically determined by ilbd)
2206                 or a positive integer
2207             </comment>
2208         </entry>
2209         <entry id="conndrain_timeout">
2210             <internal token="text"/>
2211             <external opt="required" type="uint32_t"/>
2212             <comment>connection timeout for NAT/half-NAT in sec. - 0 means
2213                 no forced removal)
2214             </comment>
2215         </entry>
2216         <entry id="nat_timeout">
2217             <internal token="text"/>
2218             <external opt="required" type="uint32_t"/>
2219             <comment>nat entry timeout for NAT/half-NAT in sec - 0 means
2220                 default value(see man page)
2221             </comment>
2222         </entry>
2223         <entry id="persist_timeout">
2224             <internal token="text"/>
2225             <external opt="required" type="uint32_t"/>
2226             <comment>session persistence mapping in sec - 0 means no
2227                 persistence
2228             </comment>
2229         </entry>
2230         <entry id="server_group">
2231             <internal token="text"/>
2232             <external opt="required" type="char *"/>
2233             <comment>server group name</comment>
2234         </entry>
2235         <entry id="rule_name">
2236             <internal token="text"/>
2237             <external opt="required" type="char *"/>
2238             <comment>rule name</comment>
2239         </entry>
2240         <entry id="return">
2241             <internal token="return"/>
2242             <external opt="none"/>
2243         </entry>
2244     </event>
2245 
2246 <!-- generic ILB rule event -->
2247 
2248     <event id="AUE_generic_ILB_rule" type="generic" omit="always">
2249         <entry id="subject">
2250             <internal token="subject"/>
2251             <external opt="none"/>
2252         </entry>
2253         <entry id="auth_used">
2254             <internal token="uauth"/>
2255             <external opt="required" type="char *"/>
2256             <comment>authorization used</comment>
2257         </entry>
2258         <entry id="rule_name">
2259             <internal token="text"/>
2260             <external opt="required" type="char *"/>
2261             <comment>rule name - "all" means all rules</comment>
2262         </entry>
2263         <entry id="return">
2264             <internal token="return"/>
2265             <external opt="none"/>
2266         </entry>
2267     </event>
2268 
2269 <!--  instances of the ILB generic rule  event. -->
2270     <event id="AUE_ilb_delete_rule" instance_of="AUE_generic_ILB_rule"
2271         header="0" idNo="123">
2272         <title>Delete Integrated Loadbalancer rule</title>
2273         <program>/usr/sbin/ilbadm</program>
2274         <see>ilbadm(1m)</see>
2275     </event>
2276 
2277     <event id="AUE_ilb_disable_rule" instance_of="AUE_generic_ILB_rule"
2278         header="0" idNo="124">
2279         <title>Disable Integrated Loadbalancer rule</title>
2280         <program>/usr/sbin/ilbadm</program>
2281         <see>ilbadm(1m)</see>
2282     </event>
2283 
2284     <event id="AUE_ilb_enable_rule" instance_of="AUE_generic_ILB_rule"
2285         header="0" idNo="125">
2286         <title>Enable Integrated Loadbalancer rule</title>
2287         <program>/usr/sbin/ilbadm</program>
2288         <see>ilbadm(1m)</see>
2289     </event>
2290 
2291     <event id="AUE_ilb_add_server" header="0" idNo="126" omit="JNI">
2292         <title>Add server to Integrated Loadbalancer</title>
2293         <program>/usr/sbin/ilbadm</program>
2294         <see>ilbadm(1m)</see>
2295         <entry id="subject">
2296             <internal token="subject"/>
2297             <external opt="none"/>
2298         </entry>
2299         <entry id="auth_used">
2300             <internal token="uauth"/>
2301             <external opt="required" type="char *"/>
2302             <comment>authorization used</comment>
2303         </entry>
2304         <entry id="server_ipaddress_type,server_ipaddress">
2305             <internal token="in_remote"/>
2306             <external opt="required" type="int32_t,uint32_t[4]"/>
2307             <comment>IP address</comment>
2308         </entry>
2309         <entry id="server_id">
2310             <internal token="text"/>
2311             <external opt="optional" type="char *"/>
2312             <comment>serverid that corresponds IP address - empty
2313                 if authorization fails, user specified IP address
2314                 is invalid or server cannot be added because
2315                 server group is full
2316             </comment>  
2317         </entry>
2318         <entry id="server_group">
2319             <internal token="text"/>
2320             <external opt="required" type="char *"/>
2321             <comment>server group name</comment>
2322         </entry>
2323         <entry id="server_minport">
2324             <internal token="iport"/>
2325             <external opt="optional" type="uint16_t" />
2326             <comment>server's minimum value in port range - empty
2327                 means default value (see man page)
2328             </comment>
2329         </entry>
2330         <entry id="server_maxport">
2331             <internal token="iport"/>
2332             <external opt="optional" type="uint16_t" />
2333             <comment>server's maximum value in port range - empty 
2334                 means default value(see man page)
2335             </comment>
2336         </entry>
2337         <entry id="return">
2338             <internal token="return"/>
2339             <external opt="none"/>
2340         </entry>
2341     </event> 
2342 
2343     <event id="AUE_ilb_disable_server" header="0" idNo="127" omit="JNI">
2344         <title>Disable server to Integrated Loadbalancer</title>
2345         <program>/usr/sbin/ilbadm</program>
2346         <see>ilbadm(1m)</see>
2347         <entry id="subject">
2348             <internal token="subject"/>
2349             <external opt="none"/>
2350         </entry>
2351         <entry id="auth_used">
2352             <internal token="uauth"/>
2353             <external opt="required" type="char *"/>
2354             <comment>authorization used</comment>
2355         </entry>
2356         <entry id="server_id">
2357             <internal token="text"/>
2358             <external opt="required" type="char *"/>
2359             <comment>serverid</comment>
2360         </entry>
2361         <entry id="server_ipaddress_type,server_ipaddress">
2362             <internal token="in_remote"/>
2363             <external opt="optional" type="int32_t,uint32_t[4]"/>
2364             <comment>IPaddr corresponding to the serverid - empty 
2365                 if authorization fails, or user specified serverid
2366                 is nonexistent
2367             </comment>
2368         </entry>
2369         <entry id="return">
2370             <internal token="return"/>
2371             <external opt="none"/>
2372         </entry>
2373     </event> 
2374 
2375     <event id="AUE_ilb_enable_server" header="0" idNo="128" omit="JNI">
2376         <title>Enable server to Integrated Loadbalancer</title>
2377         <program>/usr/sbin/ilbadm</program>
2378         <see>ilbadm(1m)</see>
2379         <entry id="subject">
2380             <internal token="subject"/>
2381             <external opt="none"/>
2382         </entry>
2383         <entry id="auth_used">
2384             <internal token="uauth"/>
2385             <external opt="required" type="char *"/>
2386             <comment>authorization used</comment>
2387         </entry>
2388         <entry id="server_id">
2389             <internal token="text"/>
2390             <external opt="required" type="char *"/>
2391             <comment>serverid</comment>
2392         </entry>
2393         <entry id="server_ipaddress_type,server_ipaddress">
2394             <internal token="in_remote"/>
2395             <external opt="optional" type="int32_t,uint32_t[4]"/>
2396             <comment>IPaddr corresponding to the serverid - empty 
2397                 if authorization fails, or user specified serverid
2398                 is nonexistent
2399             </comment>
2400         </entry>
2401         <entry id="return">
2402             <internal token="return"/>
2403             <external opt="none"/>
2404         </entry>
2405     </event> 
2406 
2407     <event id="AUE_ilb_remove_server" header="0" idNo="129" omit="JNI">
2408         <title>Remove server from Integrated Loadbalancer</title>
2409         <program>/usr/sbin/ilbadm</program>
2410         <see>ilbadm(1m)</see>
2411         <entry id="subject">
2412             <internal token="subject"/>
2413             <external opt="none"/>
2414         </entry>
2415         <entry id="auth_used">
2416             <internal token="uauth"/>
2417             <external opt="required" type="char *"/>
2418             <comment>authorization used</comment>
2419         </entry>
2420         <entry id="server_id">
2421             <internal token="text"/>
2422             <external opt="required" type="char *"/>
2423             <comment>serverid</comment>
2424         </entry>
2425         <entry id="server_group">
2426             <internal token="text"/>
2427             <external opt="required" type="char *"/>
2428             <comment>server group name</comment>
2429         </entry>
2430         <entry id="server_ipaddress_type,server_ipaddress">
2431             <internal token="in_remote"/>
2432             <external opt="optional" type="int32_t,uint32_t[4]"/>
2433             <comment>IPaddr corresponding to serverid - empty 
2434                 if authorization fails or user specified serverid
2435                 serverid is nonexistent
2436             </comment>
2437         </entry>
2438         <entry id="return">
2439             <internal token="return"/>
2440             <external opt="none"/>
2441         </entry>
2442     </event> 
2443 
2444     <event id="AUE_ilb_create_servergroup" header="0" idNo="130" omit="JNI">
2445         <title>Create server group for Integrated Loadbalancer</title>
2446         <program>/usr/sbin/ilbadm</program>
2447         <see>ilbadm(1m)</see>
2448         <entry id="subject">
2449             <internal token="subject"/>
2450             <external opt="none"/>
2451         </entry>
2452         <entry id="auth_used">
2453             <internal token="uauth"/>
2454             <external opt="required" type="char *"/>
2455             <comment>authorization used</comment>
2456         </entry>
2457         <entry id="server_group">
2458             <internal token="text"/>
2459             <external opt="required" type="char *"/>
2460             <comment>server group name</comment>
2461         </entry>
2462         <entry id="return">
2463             <internal token="return"/>
2464             <external opt="none"/>
2465         </entry>
2466     </event> 
2467 
2468     <event id="AUE_ilb_delete_servergroup" header="0" idNo="131" omit="JNI">
2469         <title>Delete server group from Integrated Loadbalancer</title>
2470         <program>/usr/sbin/ilbadm</program>
2471         <see>ilbadm(1m)</see>
2472         <entry id="subject">
2473             <internal token="subject"/>
2474             <external opt="none"/>
2475         </entry>
2476         <entry id="auth_used">
2477             <internal token="uauth"/>
2478             <external opt="required" type="char *"/>
2479             <comment>authorization used</comment>
2480         </entry>
2481         <entry id="server_group">
2482             <internal token="text"/>
2483             <external opt="required" type="char *"/>
2484             <comment>server group name</comment>
2485         </entry>
2486         <entry id="return">
2487             <internal token="return"/>
2488             <external opt="none"/>
2489         </entry>
2490     </event> 
2491 
2492     <event id="AUE_nwam_enable" header="0" idNo="132" omit="JNI">
2493         <entry id="subject">
2494             <internal token="subject"/>
2495             <external opt="none"/>
2496         </entry>
2497         <entry id="profile_type">
2498             <internal token="text"/>
2499             <external opt="required" type="char *"/>
2500             <comment>Type of profile being enabled</comment>
2501         </entry>
2502         <entry id="profile_name">
2503             <internal token="text"/>
2504             <external opt="required" type="char *"/>
2505             <comment>Name of profile being enabled</comment>
2506         </entry>
2507         <entry id="return">
2508             <internal token="return"/>
2509             <external opt="none"/>
2510         </entry>
2511     </event>
2512 
2513     <event id="AUE_nwam_disable" header="0" idNo="133" omit="JNI">
2514         <entry id="subject">
2515             <internal token="subject"/>
2516             <external opt="none"/>
2517         </entry>
2518         <entry id="profile_type">
2519             <internal token="text"/>
2520             <external opt="required" type="char *"/>
2521             <comment>Type of profile being disabled</comment>
2522         </entry>
2523         <entry id="profile_name">
2524             <internal token="text"/>
2525             <external opt="required" type="char *"/>
2526             <comment>Name of profile being disabled</comment>
2527         </entry>
2528         <entry id="return">
2529             <internal token="return"/>
2530             <external opt="none"/>
2531         </entry>
2532     </event>
2533 
2534     <event id="AUE_netcfg_update" header="0" idNo="134" omit="JNI">
2535         <entry id="subject">
2536             <internal token="subject"/>
2537             <external opt="none"/>
2538         </entry>
2539         <entry id="parent_file">
2540             <internal token="text"/>
2541             <external opt="required" type="char *"/>
2542             <comment>Back-end data file being updated</comment>
2543         </entry>
2544         <entry id="object_name">
2545             <internal token="text"/>
2546             <external opt="required" type="char *"/>
2547             <comment>Name of object being updated</comment>
2548         </entry>
2549         <entry id="return">
2550             <internal token="return"/>
2551             <external opt="none"/>
2552         </entry>
2553     </event>
2554 
2555     <event id="AUE_netcfg_remove" header="0" idNo="135" omit="JNI">
2556         <entry id="subject">
2557             <internal token="subject"/>
2558             <external opt="none"/>
2559         </entry>
2560         <entry id="parent_file">
2561             <internal token="text"/>
2562             <external opt="required" type="char *"/>
2563             <comment>Back-end data file being modified</comment>
2564         </entry>
2565         <entry id="object_name">
2566             <internal token="text"/>
2567             <external opt="required" type="char *"/>
2568             <comment>Name of object being removed</comment>
2569         </entry>
2570         <entry id="return">
2571             <internal token="return"/>
2572             <external opt="none"/>
2573         </entry>
2574     </event>
2575 
2576 <!-- add new events here with the next higher idNo -->
2577 <!-- Highest idNo is 135, so next is 136, then fix this comment -->
2578 <!-- end of C Only events -->
2579 
2580 <!--
2581      token definitions are partially implemented.  All they do for now
2582      is create a list of defined token names.  In the future they may
2583      become a way of describing token structure.
2584 -->
2585 
2586     <token id="acl">      
2587     </token>
2588     <token id="arbitrary">
2589     </token>
2590     <token id="arg">
2591     </token>
2592     <token id="attr">
2593     </token>
2594     <token id="command">
2595     </token>
2596     <token id="command_alt">
2597     </token>
2598     <token id="date">
2599     </token>
2600     <token id="exec_args">
2601     </token>
2602     <token id="exec_env">
2603     </token>
2604     <token id="exit">
2605     </token>
2606     <token id="file">
2607     </token>
2608     <token id="fmri">
2609     </token>
2610     <token id="groups">
2611     </token>
2612     <!--
2613         the iport token take a single argument of type uint16_t
2614         if there are any other tokens following it that have arguments
2615         the last of the iport tokens in the event description must
2616         be followed by a dummy iport token that is optional.
2617         This is to ensure proper structure alignment across all
2618         compliers and architectures.
2619     -->
2620     <token id="iport">
2621     </token>
2622     <!-- pseudo token; in_addr and in_port of peer -->
2623     <token id="in_peer">
2624     </token>
2625     <!-- pseudo token; specified in_addr -->
2626     <token id="in_remote">
2627     </token>
2628     <token id="ipc">
2629     </token>
2630     <token id="ipc_perm">
2631     </token>
2632     <token id="label">
2633     </token>
2634     <token id="newgroups">
2635     </token>
2636     <token id="opaque">
2637     </token>
2638     <token id="path">
2639     </token>
2640     <!-- pseudo token; path list generates 0 or more path tokens -->
2641     <token id="path_list">
2642     </token>
2643     <!--
2644         privilege token is implemented as one of the pseudo tokens
2645         priv_limit, priv_effective, or priv_inherit
2646 
2647     <token id="privilege">
2648     </token>
2649     -->
2650     <token id="priv_effective">
2651     </token>
2652     <token id="priv_inherit">
2653     </token>
2654     <token id="priv_limit">
2655     </token>
2656     <token id="process">
2657     </token>
2658     <token id="return">
2659     </token>
2660     <token id="seq">
2661     </token>
2662     <token id="socket">
2663     </token>
2664     <token id="socket-inet">
2665     </token>
2666     <token id="subject">
2667     </token>
2668     <token id="text">
2669     </token>
2670     <token id="tid">
2671     </token>
2672     <token id="uauth">
2673     </token>
2674     <token id="user">
2675     </token>
2676     <token id="zonename">
2677     </token>
2678 
2679 <!--
2680     error value list for return values with success/fail code of fail.
2681     These values start at 1000 so praudit can tell the difference
2682     between the libbsm/common/audit_*.c broken error values and
2683     the new adt_ error value list.  It is public so that praudit
2684     can find it.
2685 
2686     praudit outputs "failure" %s" for these strings, so there is
2687     no need to use words such as "failed" in the message.
2688 
2689     ** Add to the end only to maintain validity across versions of
2690     the audit log. **
2691 -->
2692 
2693     <msg_list id="fail_value" header="0" start="1000" public="true">
2694         <msg id="PW_ATTR">Attribute update</msg>
2695         <msg id="PW">Password update</msg>
2696         <msg id="USERNAME">bad username</msg>
2697         <msg id="AUTH">authorization failed</msg>
2698         <msg id="UID">bad uid</msg>
2699         <msg id="UNKNOWN">unknown failure</msg>
2700         <msg id="EXPIRED">password expired</msg>
2701         <msg id="ACCOUNT_LOCKED">Account is locked</msg>
2702         <msg id="BAD_DIALUP">Bad dial up</msg>
2703         <msg id="BAD_ID">Invalid ID</msg>
2704         <msg id="BAD_PW">Invalid password</msg>
2705         <msg id="CONSOLE">Not on console</msg>
2706         <msg id="MAX_TRIES">Too many failed attempts</msg>
2707         <msg id="PROTOCOL_FAILURE">Protocol failure</msg>
2708         <msg id="EXCLUDED_USER">Excluded user</msg>
2709         <msg id="ANON_USER">No anonymous</msg>
2710         <msg id="BAD_CMD">Invalid command</msg>
2711         <msg id="BAD_TTY">Standard input not a tty line</msg>
2712         <msg id="PROGRAM">Program failure</msg>
2713         <msg id="CHDIR_FAILED">chdir to home directory</msg>
2714         <msg id="INPUT_OVERFLOW">Input line too long.</msg>
2715         <msg id="DEVICE_PERM">login device override</msg>
2716         <msg id="AUTH_BYPASS">authorization bypass</msg>
2717         <msg id="LOGIN_DISABLED">login disabled</msg>
2718     </msg_list>
2719 
2720 <!--
2721         The following empty list is used for PAM errors; the "start"
2722         value is used by praudit to know to use the PAM infrastructure
2723         for generating error strings
2724 -->
2725     <msg_list id="fail_pam" header="0" start="2000" public="true">
2726     </msg_list>
2727 
2728 <!--
2729      This is still in use by SMC.  See AUE_generic_login.  When
2730      either SMC is fixed to stop using this, or SMC goes away.
2731      REMOVE this stuff and the corresponding AUE_generic_login
2732      message field.
2733 
2734      Message list for the various authentication events, such
2735      as AUE_login and AUE_admin_authenticate.  Add new entries
2736      at the end.  The order of msg_list entries and the order
2737      of msg entries both affect the names in adt.h and the value
2738      of the associated enumerated types.
2739 
2740      Each of these messages except NO_MSG is also in the failure_attribute
2741      list; the difference is that the messages below use a text token
2742      in the audit record, while the failure_attribute messages are
2743      associated with the return value of the return token.
2744 
2745      This list is deprecated; please don't use text tokens for error
2746      messages.
2747 -->
2748 
2749     <msg_list id="login_text" header="0" deprecated="true">
2750         <msg id="NO_MSG"></msg>
2751         <msg id="ACCOUNT_LOCKED">Account is locked</msg>
2752         <msg id="BAD_DIALUP">Bad dial up</msg>
2753         <msg id="BAD_ID">Invalid ID</msg>
2754         <msg id="BAD_PW">Invalid password</msg>
2755         <msg id="CONSOLE">Not on console</msg>
2756         <msg id="MAX_TRIES">Too many failed attempts</msg>
2757         <msg id="PROTOCOL_FAILURE">Protocol failure</msg>
2758         <msg id="EXCLUDED_USER">Excluded user</msg>
2759         <msg id="ANON_USER">No anonymous</msg>
2760     </msg_list>
2761 
2762 <!-- msg list for uadmin(1m) fcn argument (next action, see uadmin(2)) -->
2763     <msg_list id="uadmin_fcn" header="0" start="3000" public="true">
2764         <msg id="AD_HALT">Halt the processor(s)</msg>
2765         <msg id="AD_POWEROFF">Halt the processor(s) and turn off the power</msg>
2766         <msg id="AD_BOOT">Reboot the system using the kernel file</msg>
2767         <msg id="AD_IBOOT">Interactive reboot</msg>
2768         <msg id="AD_SUSPEND_TO_DISK">Save the system state to the state file</msg>
2769         <msg id="AD_CHECK_SUSPEND_TO_DISK">Check if system supports suspend to disk</msg>
2770         <msg id="AD_FORCE">Force suspend to disk even when threads of user
2771         applications are not suspendable</msg>
2772         <msg id="AD_SUSPEND_TO_RAM">Save the system state to memory</msg>
2773         <msg id="AD_CHECK_SUSPEND_TO_RAM">Check if system supports suspend to memory</msg>
2774         <msg id="AD_SBOOT">Single-user reboot</msg>
2775         <msg id="AD_SIBOOT">Single-user interactive reboot</msg>
2776         <msg id="AD_NOSYNC">Do not sync filesystems on next A_DUMP</msg>
2777         <msg id="AD_FASTREBOOT">Reboot bypassing BIOS and boot loader</msg>
2778         <msg id="AD_FASTREBOOT_DRYRUN">Check if system supports reboot bypassing BIOS and boot loader</msg>
2779         <msg id="AD_UPDATE_BOOT_CONFIG">Update boot configuration parameters</msg>
2780         <msg id="AD_REUSEINIT">Prepare for AD_REUSABLE</msg>
2781         <msg id="AD_REUSABLE">Create reusable statefile</msg>
2782         <msg id="AD_REUSEFINI">Revert to normal CPR mode (not reusable)</msg>
2783         <msg id="AD_FTRACE_START">ftrace start</msg>
2784         <msg id="AD_FTRACE_STOP">ftrace stop</msg>
2785     </msg_list>
2786 
2787 <!--
2788       msg list for TPM errors that will be reported by tcsd(8).
2789       This list must match the order of the TPM_E_* error codes defined
2790       in /usr/include/tss/tpm_error.h (SUNWtss package)
2791 -->
2792     <msg_list id="tpm_e" header="0" start="4000" public="true">
2793         <msg id="AUTHFAIL">Authentication failed</msg>
2794         <msg id="BADINDEX">The index to a PCR, DIR or other register is incorrect</msg>
2795         <msg id="BAD_PARAMETER">One or more parameter is bad</msg>
2796         <msg id="AUDITFAILURE">auditing of the operation failed.</msg>
2797         <msg id="CLEAR_DISABLED">clear operations now physical access</msg>
2798         <msg id="DEACTIVATED">The TPM is deactivated</msg>
2799         <msg id="DISABLED">The TPM is disabled</msg>
2800         <msg id="DISABLED_CMD">The target command has been disabled</msg>
2801         <msg id="FAIL">The operation failed</msg>
2802         <msg id="BAD_ORDINAL">The ordinal was unknown or inconsistent</msg>
2803         <msg id="INSTALL_DISABLED">The ability to install an owner is disabled</msg>
2804         <msg id="INVALID_KEYHANDLE">The key handle can not be interpreted</msg>
2805         <msg id="KEYNOTFOUND">The key handle points to an invalid key</msg>
2806         <msg id="INAPPROPRIATE_ENC">Unacceptable encryption scheme</msg>
2807         <msg id="MIGRATEFAIL">Migration authorization failed</msg>
2808         <msg id="INVALID_PCR_INFO">PCR information could not be interpreted</msg>
2809         <msg id="NOSPACE">No room to load key.</msg>
2810         <msg id="NOSRK">There is no SRK set</msg>
2811         <msg id="NOTSEALED_BLOB">An encrypted blob is invalid or was 
2812         not created by this TPM</msg>
2813         <msg id="OWNER_SET">There is already an Owner </msg>
2814         <msg id="RESOURCES">The TPM has insufficient internal resources</msg>
2815         <msg id="SHORTRANDOM">A random string was too short</msg>
2816         <msg id="SIZE">The TPM does not have the space to perform the operation.</msg>
2817         <msg id="WRONGPCRVAL">The named PCR value does not match the current PCR value.</msg>
2818         <msg id="BAD_PARAM_SIZE">The paramSize argument has the incorrect value </msg>
2819         <msg id="SHA_THREAD">There is no existing SHA-1 thread.</msg>
2820         <msg id="SHA_ERROR">SHA-1 thread encountered an error.</msg>
2821         <msg id="FAILEDSELFTEST">Self-test has failed and the TPM has shutdown.</msg>
2822         <msg id="AUTH2FAIL">The auth for the second key failed authorization</msg>
2823         <msg id="BADTAG">The tag value sent to for a command is invalid</msg>
2824         <msg id="IOERROR">An IO error occurred transmitting information to the TPM</msg>
2825         <msg id="ENCRYPT_ERROR">The encryption process had a problem.</msg>
2826         <msg id="DECRYPT_ERROR">The decryption process did not complete.</msg>
2827         <msg id="INVALID_AUTHHANDLE">An invalid handle was used.</msg>
2828         <msg id="NO_ENDORSEMENT">The TPM does not a EK installed</msg>
2829         <msg id="INVALID_KEYUSAGE">The usage of a key is not allowed</msg>
2830         <msg id="WRONG_ENTITYTYPE">The submitted entity type is not allowed</msg>
2831         <msg id="INVALID_POSTINIT">The command was received in the wrong sequence</msg>
2832         <msg id="INAPPROPRIATE_SIG">Signed data cannot include additional DER information</msg>
2833         <msg id="BAD_KEY_PROPERTY">The key properties are not supported by this TPM</msg>
2834         <msg id="BAD_MIGRATION">The migration properties of this key are incorrect.</msg>
2835         <msg id="BAD_SCHEME">Incorrect signature or encryption scheme</msg>
2836         <msg id="BAD_DATASIZE">The size of the data parameter is bad</msg>
2837         <msg id="BAD_MODE">A mode parameter is bad</msg>
2838         <msg id="BAD_PRESENCE">physicalPresence or physicalPresenceLock bits have wrong value</msg>
2839         <msg id="BAD_VERSION">The TPM cannot perform this version of the capability</msg>
2840         <msg id="NO_WRAP_TRANSPORT">The TPM does not allow for wrapped transport sessions</msg>
2841         <msg id="AUDITFAIL_UNSUCCESSFUL">TPM audit construction failed for failed command</msg>
2842         <msg id="AUDITFAIL_SUCCESSFUL">TPM audit construction failed for successful command</msg>
2843         <msg id="NOTRESETABLE">PCR register does not have the resettable attribute</msg>
2844         <msg id="NOTLOCAL">PCR register requires locality</msg>
2845         <msg id="BAD_TYPE">Make identity blob not properly typed</msg>
2846         <msg id="INVALID_RESOURCE">Resource type does not match actual resource</msg>
2847         <msg id="NOTFIPS">Command only available when TPM is in FIPS mode</msg>
2848         <msg id="INVALID_FAMILY">The command is attempting to use an invalid family ID</msg>
2849         <msg id="NO_NV_PERMISSION">The permission to manipulate the NV storage is not available</msg>
2850         <msg id="REQUIRES_SIGN">The operation requires a signed command</msg>
2851         <msg id="KEY_NOTSUPPORTED">Wrong operation to load an NV key</msg>
2852         <msg id="AUTH_CONFLICT">NV_LoadKey blob requires both owner and blob authorization</msg>
2853         <msg id="AREA_LOCKED">The NV area is locked and not writable</msg>
2854         <msg id="BAD_LOCALITY">The locality is incorrect for the attempted operation</msg>
2855         <msg id="READ_ONLY">The NV area is read only and can't be written to</msg>
2856         <msg id="PER_NOWRITE">There is no protection on the write to the NV area</msg>
2857         <msg id="FAMILYCOUNT">The family count value does not match</msg>
2858         <msg id="WRITE_LOCKED">The NV area has already been written to</msg>
2859         <msg id="BAD_ATTRIBUTES">The NV area attributes conflict</msg>
2860         <msg id="INVALID_STRUCTURE">The tag and version are invalid or inconsistent</msg>
2861         <msg id="KEY_OWNER_CONTROL">The key evicted by the TPM Owner.</msg>
2862         <msg id="BAD_COUNTER">The counter handle is incorrect</msg>
2863         <msg id="NOT_FULLWRITE">The write is not a complete write of the area</msg>
2864         <msg id="CONTEXT_GAP">The gap between saved context counts is too large</msg>
2865         <msg id="MAXNVWRITES">Max number of NV writes without owner has been exceeded</msg>
2866         <msg id="NOOPERATOR">No operator AuthData value is set</msg>
2867         <msg id="RESOURCEMISSING">The resource pointed to by context is not loaded</msg>
2868         <msg id="DELEGATE_LOCK">The delegate administration is locked</msg>
2869         <msg id="DELEGATE_FAMILY">Attempt to manage a family other then the delegated family</msg>
2870         <msg id="DELEGATE_ADMIN">Delegation table management not enabled</msg>
2871         <msg id="TRANSPORT_NOTEXCLUSIVE">Command executed outside of exclusive transport session</msg>
2872         <msg id="OWNER_CONTROL">Attempt to context save a owner evict controlled key</msg>
2873         <msg id="DAA_RESOURCES">DAA command has no resources available to execute the command</msg>
2874         <msg id="DAA_INPUT_DATA0">The consistency check on DAA parameter inputData0 has failed.</msg>
2875         <msg id="DAA_INPUT_DATA1">The consistency check on DAA parameter inputData1 has failed.</msg>
2876         <msg id="DAA_ISSUER_SETTINGS">The consistency check on DAA_issuerSettings has failed.</msg>
2877         <msg id="DAA_TPM_SETTINGS">The consistency check on DAA_tpmSpecific has failed.</msg>
2878         <msg id="DAA_STAGE">Atomic process indicated by DAA command is not the expected process.</msg>
2879         <msg id="DAA_ISSUER_VALIDITY">Inconsistent issuer validity</msg>
2880         <msg id="DAA_WRONG_W">The consistency check on w has failed.</msg>
2881         <msg id="BAD_HANDLE">The handle is incorrect</msg>
2882         <msg id="BAD_DELEGATE">Delegation is not correct</msg>
2883         <msg id="BADCONTEXT">The context blob is invalid</msg>
2884         <msg id="TOOMANYCONTEXTS">Too many contexts held by the TPM</msg>
2885         <msg id="MA_TICKET_SIGNATURE">Migration authority signature validation failure</msg>
2886         <msg id="MA_DESTINATION">Migration destination not authenticated</msg>
2887         <msg id="MA_SOURCE">Migration source incorrect</msg>
2888         <msg id="MA_AUTHORITY">Incorrect migration authority</msg>
2889         <msg id="PERMANENTEK">Attempt to revoke the EK and the EK is not revocable</msg>
2890         <msg id="BAD_SIGNATURE">Bad signature of CMK ticket</msg>
2891         <msg id="NOCONTEXTSPACE">There is no room in the context list for additional contexts</msg>
2892         <msg id="RETRY">The TPM is too busy to respond to the command immediately</msg>
2893         <msg id="NEEDS_SELFTEST">SelfTestFull has not been run</msg>
2894         <msg id="DOING_SELFTEST">The TPM is currently executing a full selftest</msg>
2895         <msg id="DEFEND_LOCK_RUNNING">TPM is defending against dictionary attacks</msg>
2896         <msg id="NO_MSG"></msg>
2897         <!-- End TPM failure codes -->
2898     </msg_list>
2899 </specification>