Print this page
7029 want per-process exploit mitigation features (secflags)
7030 want basic address space layout randomization (aslr)
7031 noexec_user_stack should be a secflag
7032 want a means to forbid mappings around NULL.
| Split |
Close |
| Expand all |
| Collapse all |
--- old/usr/src/lib/libbsm/adt_record.dtd.1
+++ new/usr/src/lib/libbsm/adt_record.dtd.1
1 1 <?xml version="1.0" encoding="UTF-8" ?>
2 2
3 3 <!--
4 4 Copyright 2010 Sun Microsystems, Inc. All rights reserved.
5 5 Use is subject to license terms.
6 6
7 7 CDDL HEADER START
8 8
9 9 The contents of this file are subject to the terms of the
10 10 Common Development and Distribution License (the "License").
11 11 You may not use this file except in compliance with the License.
12 12
13 13 You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
14 14 or http://www.opensolaris.org/os/licensing.
15 15 See the License for the specific language governing permissions
16 16 and limitations under the License.
17 17
18 18 When distributing Covered Code, include this CDDL HEADER in each
19 19 file and include the License file at usr/src/OPENSOLARIS.LICENSE.
20 20 If applicable, add the following below this CDDL HEADER, with the
21 21 fields enclosed by brackets "[]" replaced with your own identifying
22 22 information: Portions Copyright [yyyy] [name of copyright owner]
23 23
24 24 CDDL HEADER END
25 25 -->
26 26
27 27
28 28 <!--Entity Definitions-->
29 29
30 30 <!-- timeattr or iso8601
31 31
32 32 timeattr:
33 33 the time/date to the second in strftime(3C) default format,
34 34 followed by milliseconds offset.
35 35
36 36 Example: time="Mon May 06 12:10:18 2002" msec="750"
37 37
38 38 iso8601:
39 39 ISO 8601 standard format date time and timezone;
40 40 YYYY-MM-DD HH:MM:SS.sss +/-HH:MM; year, month, day 24 hour time with
41 41 milliseconds + or - offset from Universal Time (UTC, aka GMT)
42 42
43 43 Example: iso8601="2003-09-17 16:47:41.831 -07:00"
44 44
45 45 -->
46 46 <!ENTITY % timeattr "time CDATA #IMPLIED
47 47 msec CDATA #IMPLIED">
48 48
49 49 <!ENTITY % iso8601 "iso8601 CDATA #IMPLIED">
50 50
51 51 <!-- xinfo Generic info for X related tokens. -->
52 52 <!ENTITY % xinfo "xid CDATA #REQUIRED
53 53 xcreator-uid CDATA #REQUIRED">
54 54
55 55 <!-- reserved_toks
56 56
57 57 This represents the set of "reserved" tokens whose placement is
58 58 fixed.
59 59
60 60 -->
61 61 <!ENTITY % reserved_toks "(
62 62 file |
63 63 record |
64 64 host |
65 65 sequence
66 66 )
67 67 ">
68 68
69 69 <!-- normaltoks
70 70
71 71 This represents the set of all tokens other than the "reserved"
72 72 tokens.
73 73
74 74 -->
75 75 <!ENTITY % normaltoks "(
76 76 acl |
77 77 arbitrary |
78 78 argument |
79 79 attribute |
80 80 cmd |
81 81 exit |
82 82 exec_args |
83 83 exec_env |
84 84 fmri |
85 85 group |
86 86 ip |
87 87 ip_address |
88 88 IPC |
89 89 IPC_perm |
90 90 ip_port |
91 91 liaison |
92 92 opaque |
93 93 path |
94 94 path_attr |
95 95 privilege |
96 96 process |
97 97 return |
98 98 sensitivity_label |
99 99 old_socket |
100 100 socket |
101 101 subject |
102 102 text |
103 103 user |
104 104 use_of_authorization |
105 105 use_of_privilege |
106 106 X_atom |
107 107 X_client |
108 108 X_color_map |
109 109 X_cursor |
110 110 X_font |
111 111 X_graphic_context |
112 112 X_pixmap |
113 113 X_property |
114 114 X_selection |
115 115 X_window |
116 116 zone
117 117 )
118 118 ">
119 119
120 120 <!--Element Definitions-->
121 121
122 122 <!--
123 123
124 124 The main element, "audit", consists of a sequence of file & record tokens.
125 125
126 126 -->
127 127 <!ELEMENT audit (file | record)*>
128 128
129 129 <!-- file token -->
130 130 <!ELEMENT file (#PCDATA)>
131 131 <!ATTLIST file %iso8601;>
132 132
133 133
134 134 <!-- record token
135 135
136 136 Audit records will have this general layout of tokens after the
137 137 first token (which is the record token):
138 138 (tokens),subject,group,(tokens),return,sequence,host
139 139
140 140 (all tokens after the record token are optional; the host token is unused.)
141 141
142 142 -->
143 143 <!ELEMENT record (
144 144 (%normaltoks;)*,
145 145 sequence?,
146 146 host?
147 147 )
148 148 >
149 149 <!ATTLIST record
150 150 version CDATA #REQUIRED
151 151 event CDATA #REQUIRED
152 152 modifier CDATA #IMPLIED
153 153 host CDATA #IMPLIED
154 154 %iso8601;
155 155 >
156 156
157 157 <!-- text token -->
158 158 <!ELEMENT text (#PCDATA)>
159 159
160 160 <!-- user token -->
161 161 <!ELEMENT user EMPTY>
162 162 <!ATTLIST user
163 163 uid CDATA #REQUIRED
164 164 username CDATA #REQUIRED
165 165 >
166 166
167 167 <!-- path token -->
168 168 <!ELEMENT path (#PCDATA)>
169 169
170 170 <!-- path_attr token -->
171 171 <!ELEMENT path_attr (xattr*)>
172 172 <!ELEMENT xattr (#PCDATA)>
173 173
174 174 <!-- host token -->
175 175 <!ELEMENT host (#PCDATA)>
176 176
177 177 <!-- subject token -->
178 178 <!ELEMENT subject EMPTY>
179 179 <!ATTLIST subject
180 180 audit-uid CDATA #REQUIRED
181 181 uid CDATA #REQUIRED
182 182 gid CDATA #REQUIRED
183 183 ruid CDATA #REQUIRED
184 184 rgid CDATA #REQUIRED
185 185 pid CDATA #REQUIRED
186 186 sid CDATA #REQUIRED
187 187 tid CDATA #REQUIRED
188 188 >
189 189
190 190 <!-- process token -->
191 191 <!ELEMENT process EMPTY>
192 192 <!ATTLIST process
193 193 audit-uid CDATA #REQUIRED
194 194 uid CDATA #REQUIRED
195 195 gid CDATA #REQUIRED
196 196 ruid CDATA #REQUIRED
197 197 rgid CDATA #REQUIRED
198 198 pid CDATA #REQUIRED
199 199 sid CDATA #REQUIRED
200 200 tid CDATA #REQUIRED
201 201 >
202 202
203 203 <!-- return token -->
204 204 <!ELEMENT return EMPTY>
205 205 <!ATTLIST return
206 206 errval CDATA #REQUIRED
207 207 retval CDATA #REQUIRED
208 208 >
209 209
210 210 <!-- exit token -->
211 211 <!ELEMENT exit EMPTY>
212 212 <!ATTLIST exit
213 213 errval CDATA #REQUIRED
214 214 retval CDATA #REQUIRED
215 215 >
216 216
217 217 <!-- sequence token -->
218 218 <!ELEMENT sequence EMPTY>
219 219 <!ATTLIST sequence
220 220 seq-num CDATA #REQUIRED
221 221 >
222 222
223 223 <!-- fmri token -->
224 224 <!ELEMENT fmri (#PCDATA)>
225 225
226 226 <!-- group token -->
227 227 <!ELEMENT group (gid)*>
228 228 <!ELEMENT gid (#PCDATA)>
229 229
230 230 <!-- opaque token -->
231 231 <!ELEMENT opaque (#PCDATA)>
232 232
233 233 <!-- liaison token -->
234 234 <!-- (NOTE: liaison is obsolete and is no longer generated -->
235 235 <!ELEMENT liaison (#PCDATA)>
236 236
237 237 <!-- argument token -->
238 238 <!ELEMENT argument EMPTY>
239 239 <!ATTLIST argument
240 240 arg-num CDATA #REQUIRED
241 241 value CDATA #REQUIRED
242 242 desc CDATA #REQUIRED
243 243 >
244 244
245 245 <!-- attribute token -->
246 246 <!ELEMENT attribute EMPTY>
247 247 <!ATTLIST attribute
248 248 mode CDATA #REQUIRED
249 249 uid CDATA #REQUIRED
250 250 gid CDATA #REQUIRED
251 251 fsid CDATA #REQUIRED
252 252 nodeid CDATA #REQUIRED
253 253 device CDATA #REQUIRED
254 254 >
255 255
256 256 <!-- cmd token -->
257 257 <!ELEMENT cmd (argv*, arge*)>
258 258 <!ELEMENT argv (#PCDATA)>
259 259 <!ELEMENT arge (#PCDATA)>
260 260
261 261 <!-- exec_args token -->
262 262 <!ELEMENT exec_args (arg*)>
263 263 <!ELEMENT arg (#PCDATA)>
264 264
265 265 <!-- exec_env token -->
266 266 <!ELEMENT exec_env (env*)>
267 267 <!ELEMENT env (#PCDATA)>
268 268
269 269 <!-- arbitrary token -->
270 270 <!ELEMENT arbitrary (#PCDATA)>
271 271 <!ATTLIST arbitrary
272 272 print CDATA #REQUIRED
|
↓ open down ↓ |
272 lines elided |
↑ open up ↑ |
273 273 type CDATA #REQUIRED
274 274 count CDATA #REQUIRED
275 275 >
276 276
277 277 <!-- privilege token -->
278 278 <!ELEMENT privilege (#PCDATA)>
279 279 <!ATTLIST privilege
280 280 set-type CDATA #REQUIRED
281 281 >
282 282
283 +<!-- secflags token -->
284 +<!ELEMENT secflags (#PCDATA)>
285 +<!ATTLIST secflags
286 + set-type CDATA #REQUIRED
287 +>
288 +
289 +
283 290 <!-- use_of_privilege token -->
284 291 <!ELEMENT use_of_privilege (#PCDATA)>
285 292 <!ATTLIST use_of_privilege
286 293 result CDATA #REQUIRED
287 294 >
288 295
289 296 <!-- sensitivity_label token -->
290 297 <!ELEMENT sensitivity_label (#PCDATA)>
291 298
292 299 <!-- use_of_authorization token -->
293 300 <!ELEMENT use_of_authorization (#PCDATA)>
294 301
295 302 <!-- IPC token -->
296 303 <!ELEMENT IPC EMPTY>
297 304 <!ATTLIST IPC
298 305 ipc-type CDATA #REQUIRED
299 306 ipc-id CDATA #REQUIRED
300 307 >
301 308
302 309 <!-- IPC_perm token -->
303 310 <!ELEMENT IPC_perm EMPTY>
304 311 <!ATTLIST IPC_perm
305 312 uid CDATA #REQUIRED
306 313 gid CDATA #REQUIRED
307 314 creator-uid CDATA #REQUIRED
308 315 creator-gid CDATA #REQUIRED
309 316 mode CDATA #REQUIRED
310 317 seq CDATA #REQUIRED
311 318 key CDATA #REQUIRED
312 319 >
313 320
314 321 <!-- ip_address token -->
315 322 <!ELEMENT ip_address (#PCDATA)>
316 323
317 324 <!-- ip_port token -->
318 325 <!-- (NOTE: ip_port is obsolete and is no longer generated -->
319 326 <!ELEMENT ip_port (#PCDATA)>
320 327
321 328 <!-- ip token -->
322 329 <!-- (NOTE: ip is obsolete and is no longer generated -->
323 330 <!ELEMENT ip EMPTY>
324 331 <!ATTLIST ip
325 332 version CDATA #REQUIRED
326 333 service_type CDATA #REQUIRED
327 334 len CDATA #REQUIRED
328 335 id CDATA #REQUIRED
329 336 offset CDATA #REQUIRED
330 337 time_to_live CDATA #REQUIRED
331 338 protocol CDATA #REQUIRED
332 339 cksum CDATA #REQUIRED
333 340 src_addr CDATA #REQUIRED
334 341 dest_addr CDATA #REQUIRED
335 342 >
336 343
337 344 <!-- old_socket token -->
338 345 <!ELEMENT old_socket EMPTY>
339 346 <!ATTLIST old_socket
340 347 type CDATA #REQUIRED
341 348 port CDATA #REQUIRED
342 349 addr CDATA #REQUIRED
343 350 >
344 351
345 352 <!-- socket token -->
346 353 <!ELEMENT socket EMPTY>
347 354 <!ATTLIST socket
348 355 sock_domain CDATA #REQUIRED
349 356 sock_type CDATA #REQUIRED
350 357 lport CDATA #REQUIRED
351 358 laddr CDATA #REQUIRED
352 359 fport CDATA #REQUIRED
353 360 faddr CDATA #REQUIRED
354 361 >
355 362
356 363 <!-- acl token -->
357 364 <!ELEMENT acl EMPTY>
358 365 <!ATTLIST acl
359 366 type CDATA #IMPLIED
360 367 value CDATA #IMPLIED
361 368 mode CDATA #IMPLIED
362 369 flags CDATA #IMPLIED
363 370 id CDATA #IMPLIED
364 371 access_mask CDATA #IMPLIED
365 372 >
366 373
367 374 <!-- tid token -->
368 375 <!-- future intent: contain one of ipadr | MTUadr | device -->
369 376 <!ELEMENT tid (ipadr*)>
370 377 <!ATTLIST tid
371 378 type CDATA #REQUIRED
372 379 >
373 380
374 381 <!-- ipadr content of tid token -->
375 382 <!ELEMENT ipadr EMPTY>
376 383 <!ATTLIST ipadr
377 384 local-port CDATA #REQUIRED
378 385 remote-port CDATA #REQUIRED
379 386 host CDATA #REQUIRED
380 387 >
381 388
382 389 <!-- X_atom token -->
383 390 <!ELEMENT X_atom (#PCDATA)>
384 391
385 392 <!-- X_color_map token -->
386 393 <!ELEMENT X_color_map EMPTY>
387 394 <!ATTLIST X_color_map %xinfo;>
388 395
389 396 <!-- X_cursor token -->
390 397 <!ELEMENT X_cursor EMPTY>
391 398 <!ATTLIST X_cursor %xinfo;>
392 399
393 400 <!-- X_font token -->
394 401 <!ELEMENT X_font EMPTY>
395 402 <!ATTLIST X_font %xinfo;>
396 403
397 404 <!-- X_graphic_context token -->
398 405 <!ELEMENT X_graphic_context EMPTY>
399 406 <!ATTLIST X_graphic_context %xinfo;>
400 407
401 408 <!-- X_pixmap token -->
402 409 <!ELEMENT X_pixmap EMPTY>
403 410 <!ATTLIST X_pixmap %xinfo;>
404 411
405 412 <!-- X_window token -->
406 413 <!ELEMENT X_window EMPTY>
407 414 <!ATTLIST X_window %xinfo;>
408 415
409 416 <!-- X_property token -->
410 417 <!ELEMENT X_property (#PCDATA)>
411 418 <!ATTLIST X_property %xinfo;>
412 419
413 420 <!-- X_client token -->
414 421 <!ELEMENT X_client (#PCDATA)>
415 422
416 423 <!-- X_selection token -->
417 424 <!ELEMENT X_selection (xsel_text, xsel_type, xsel_data)>
418 425 <!ELEMENT x_sel_text (#PCDATA)>
419 426 <!ELEMENT x_sel_type (#PCDATA)>
420 427 <!ELEMENT x_sel_data (#PCDATA)>
421 428
422 429 <!-- zonename token -->
423 430 <!ELEMENT zone EMPTY>
424 431 <!ATTLIST zone
425 432 name CDATA #REQUIRED
426 433 >
|
↓ open down ↓ |
134 lines elided |
↑ open up ↑ |
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX