/* audit-records.h -- * Copyright 2023 Red Hat Inc. * All Rights Reserved. * * This library is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public * License as published by the Free Software Foundation; either * version 2.1 of the License, or (at your option) any later version. * * This library is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public * License along with this library; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA * * Authors: * Steve Grubb */ #ifndef _AUDIT_RECORDS_H #define _AUDIT_RECORDS_H #include #ifdef __cplusplus extern "C" { #endif /* Audit message types as of 5.0 kernel: * 1000 - 1099 are for commanding the audit system * 1100 - 1199 user space trusted application messages * 1200 - 1299 messages internal to the audit daemon * 1300 - 1399 audit event messages * 1400 - 1499 kernel SE Linux use * 1500 - 1599 AppArmor events * 1600 - 1699 kernel crypto events * 1700 - 1799 kernel anomaly records * 1800 - 1899 kernel integrity labels and related events * 1800 - 1999 future kernel use * 2001 - 2099 unused (kernel) * 2100 - 2199 user space anomaly records * 2200 - 2299 user space actions taken in response to anomalies * 2300 - 2399 user space generated LSPP events * 2400 - 2499 user space crypto events * 2500 - 2599 user space virtualization management events * 2600 - 2999 future user space (maybe integrity labels and related events) */ #define AUDIT_FIRST_USER_MSG 1100 /* First user space message */ #define AUDIT_LAST_USER_MSG 1199 /* Last user space message */ #define AUDIT_USER_AUTH 1100 /* User system access authentication */ #define AUDIT_USER_ACCT 1101 /* User system access authorization */ #define AUDIT_USER_MGMT 1102 /* User acct attribute change */ #define AUDIT_CRED_ACQ 1103 /* User credential acquired */ #define AUDIT_CRED_DISP 1104 /* User credential disposed */ #define AUDIT_USER_START 1105 /* User session start */ #define AUDIT_USER_END 1106 /* User session end */ #define AUDIT_USER_AVC 1107 /* User space avc message */ #define AUDIT_USER_CHAUTHTOK 1108 /* User acct password or pin changed */ #define AUDIT_USER_ERR 1109 /* User acct state error */ #define AUDIT_CRED_REFR 1110 /* User credential refreshed */ #define AUDIT_USYS_CONFIG 1111 /* User space system config change */ #define AUDIT_USER_LOGIN 1112 /* User has logged in */ #define AUDIT_USER_LOGOUT 1113 /* User has logged out */ #define AUDIT_ADD_USER 1114 /* User account added */ #define AUDIT_DEL_USER 1115 /* User account deleted */ #define AUDIT_ADD_GROUP 1116 /* Group account added */ #define AUDIT_DEL_GROUP 1117 /* Group account deleted */ #define AUDIT_DAC_CHECK 1118 /* User space DAC check results */ #define AUDIT_CHGRP_ID 1119 /* User space group ID changed */ #define AUDIT_TEST 1120 /* Used for test success messages */ #define AUDIT_TRUSTED_APP 1121 /* Trusted app msg - freestyle text */ #define AUDIT_USER_SELINUX_ERR 1122 /* SE Linux user space error */ #define AUDIT_USER_CMD 1123 /* User shell command and args */ #define AUDIT_USER_TTY 1124 /* Non-ICANON TTY input meaning */ #define AUDIT_CHUSER_ID 1125 /* Changed user ID supplemental data */ #define AUDIT_GRP_AUTH 1126 /* Authentication for group password */ #define AUDIT_SYSTEM_BOOT 1127 /* System boot */ #define AUDIT_SYSTEM_SHUTDOWN 1128 /* System shutdown */ #define AUDIT_SYSTEM_RUNLEVEL 1129 /* System runlevel change */ #define AUDIT_SERVICE_START 1130 /* Service (daemon) start */ #define AUDIT_SERVICE_STOP 1131 /* Service (daemon) stop */ #define AUDIT_GRP_MGMT 1132 /* Group account attr was modified */ #define AUDIT_GRP_CHAUTHTOK 1133 /* Group acct password or pin changed */ #define AUDIT_MAC_CHECK 1134 /* User space MAC decision results */ #define AUDIT_ACCT_LOCK 1135 /* User's account locked by admin */ #define AUDIT_ACCT_UNLOCK 1136 /* User's account unlocked by admin */ #define AUDIT_USER_DEVICE 1137 /* User space hotplug device changes */ #define AUDIT_SOFTWARE_UPDATE 1138 /* Software update event */ #define AUDIT_FIRST_DAEMON 1200 #define AUDIT_LAST_DAEMON 1299 #define AUDIT_DAEMON_RECONFIG 1204 /* Auditd should reconfigure */ #define AUDIT_DAEMON_ROTATE 1205 /* Auditd should rotate logs */ #define AUDIT_DAEMON_RESUME 1206 /* Auditd should resume logging */ #define AUDIT_DAEMON_ACCEPT 1207 /* Auditd accepted remote connection */ #define AUDIT_DAEMON_CLOSE 1208 /* Auditd closed remote connection */ #define AUDIT_DAEMON_ERR 1209 /* Auditd internal error */ #define AUDIT_FIRST_EVENT 1300 #define AUDIT_LAST_EVENT 1399 #define AUDIT_FIRST_SELINUX 1400 #define AUDIT_LAST_SELINUX 1499 #define AUDIT_FIRST_APPARMOR 1500 #define AUDIT_LAST_APPARMOR 1599 #ifndef AUDIT_AA #define AUDIT_AA 1500 /* Not upstream yet */ #define AUDIT_APPARMOR_AUDIT 1501 #define AUDIT_APPARMOR_ALLOWED 1502 #define AUDIT_APPARMOR_DENIED 1503 #define AUDIT_APPARMOR_HINT 1504 #define AUDIT_APPARMOR_STATUS 1505 #define AUDIT_APPARMOR_ERROR 1506 #define AUDIT_APPARMOR_KILL 1507 #endif #define AUDIT_FIRST_KERN_CRYPTO_MSG 1600 #define AUDIT_LAST_KERN_CRYPTO_MSG 1699 #define AUDIT_FIRST_KERN_ANOM_MSG 1700 #define AUDIT_LAST_KERN_ANOM_MSG 1799 #define AUDIT_INTEGRITY_FIRST_MSG 1800 #define AUDIT_INTEGRITY_LAST_MSG 1899 #ifndef AUDIT_INTEGRITY_DATA #define AUDIT_INTEGRITY_DATA 1800 /* Data integrity verification */ #define AUDIT_INTEGRITY_METADATA 1801 // Metadata integrity verification #define AUDIT_INTEGRITY_STATUS 1802 /* Integrity enable status */ #define AUDIT_INTEGRITY_HASH 1803 /* Integrity HASH type */ #define AUDIT_INTEGRITY_PCR 1804 /* PCR invalidation msgs */ #define AUDIT_INTEGRITY_RULE 1805 /* Policy rule */ #endif #ifndef AUDIT_INTEGRITY_EVM_XATTR #define AUDIT_INTEGRITY_EVM_XATTR 1806 /* New EVM-covered xattr */ #endif #ifndef AUDIT_INTEGRITY_POLICY_RULE #define AUDIT_INTEGRITY_POLICY_RULE 1807 /* Integrity Policy rule */ #endif #define AUDIT_FIRST_ANOM_MSG 2100 #define AUDIT_LAST_ANOM_MSG 2199 #define AUDIT_ANOM_LOGIN_FAILURES 2100 // Failed login limit reached #define AUDIT_ANOM_LOGIN_TIME 2101 // Login attempted at bad time #define AUDIT_ANOM_LOGIN_SESSIONS 2102 // Max concurrent sessions reached #define AUDIT_ANOM_LOGIN_ACCT 2103 // Login attempted to watched acct #define AUDIT_ANOM_LOGIN_LOCATION 2104 // Login from forbidden location #define AUDIT_ANOM_MAX_DAC 2105 // Max DAC failures reached #define AUDIT_ANOM_MAX_MAC 2106 // Max MAC failures reached #define AUDIT_ANOM_AMTU_FAIL 2107 // AMTU failure #define AUDIT_ANOM_RBAC_FAIL 2108 // RBAC self test failure #define AUDIT_ANOM_RBAC_INTEGRITY_FAIL 2109 // RBAC file integrity failure #define AUDIT_ANOM_CRYPTO_FAIL 2110 // Crypto system test failure #define AUDIT_ANOM_ACCESS_FS 2111 // Access of file or dir #define AUDIT_ANOM_EXEC 2112 // Execution of file #define AUDIT_ANOM_MK_EXEC 2113 // Make an executable #define AUDIT_ANOM_ADD_ACCT 2114 // Adding an acct #define AUDIT_ANOM_DEL_ACCT 2115 // Deleting an acct #define AUDIT_ANOM_MOD_ACCT 2116 // Changing an acct #define AUDIT_ANOM_ROOT_TRANS 2117 // User became root #define AUDIT_ANOM_LOGIN_SERVICE 2118 // Service acct attempted login #define AUDIT_ANOM_LOGIN_ROOT 2119 // Root login attempted #define AUDIT_ANOM_ORIGIN_FAILURES 2120 // Origin has too many failed login #define AUDIT_ANOM_SESSION 2121 // The user session is bad #define AUDIT_FIRST_ANOM_RESP 2200 #define AUDIT_LAST_ANOM_RESP 2299 #define AUDIT_RESP_ANOMALY 2200 /* Anomaly not reacted to */ #define AUDIT_RESP_ALERT 2201 /* Alert email was sent */ #define AUDIT_RESP_KILL_PROC 2202 /* Kill program */ #define AUDIT_RESP_TERM_ACCESS 2203 /* Terminate session */ #define AUDIT_RESP_ACCT_REMOTE 2204 /* Acct locked from remote access*/ #define AUDIT_RESP_ACCT_LOCK_TIMED 2205 /* User acct locked for time */ #define AUDIT_RESP_ACCT_UNLOCK_TIMED 2206 /* User acct unlocked from time */ #define AUDIT_RESP_ACCT_LOCK 2207 /* User acct was locked */ #define AUDIT_RESP_TERM_LOCK 2208 /* Terminal was locked */ #define AUDIT_RESP_SEBOOL 2209 /* Set an SE Linux boolean */ #define AUDIT_RESP_EXEC 2210 /* Execute a script */ #define AUDIT_RESP_SINGLE 2211 /* Go to single user mode */ #define AUDIT_RESP_HALT 2212 /* take the system down */ #define AUDIT_RESP_ORIGIN_BLOCK 2213 /* Address blocked by iptables */ #define AUDIT_RESP_ORIGIN_BLOCK_TIMED 2214 /* Address blocked for time */ #define AUDIT_RESP_ORIGIN_UNBLOCK_TIMED 2215 /* Address unblocked from timed */ #define AUDIT_FIRST_USER_LSPP_MSG 2300 #define AUDIT_LAST_USER_LSPP_MSG 2399 #define AUDIT_USER_ROLE_CHANGE 2300 /* User changed to a new role */ #define AUDIT_ROLE_ASSIGN 2301 /* Admin assigned user to role */ #define AUDIT_ROLE_REMOVE 2302 /* Admin removed user from role */ #define AUDIT_LABEL_OVERRIDE 2303 /* Admin is overriding a label */ #define AUDIT_LABEL_LEVEL_CHANGE 2304 /* Object's level was changed */ #define AUDIT_USER_LABELED_EXPORT 2305 /* Object exported with label */ #define AUDIT_USER_UNLABELED_EXPORT 2306 /* Object exported without label */ #define AUDIT_DEV_ALLOC 2307 /* Device was allocated */ #define AUDIT_DEV_DEALLOC 2308 /* Device was deallocated */ #define AUDIT_FS_RELABEL 2309 /* Filesystem relabeled */ #define AUDIT_USER_MAC_POLICY_LOAD 2310 /* Userspc daemon loaded policy */ #define AUDIT_ROLE_MODIFY 2311 /* Admin modified a role */ #define AUDIT_USER_MAC_CONFIG_CHANGE 2312 /* Change made to MAC policy */ #define AUDIT_USER_MAC_STATUS 2313 /* Userspc daemon enforcing change */ #define AUDIT_FIRST_CRYPTO_MSG 2400 #define AUDIT_CRYPTO_TEST_USER 2400 /* Crypto test results */ #define AUDIT_CRYPTO_PARAM_CHANGE_USER 2401 /* Crypto attribute change */ #define AUDIT_CRYPTO_LOGIN 2402 /* Logged in as crypto officer */ #define AUDIT_CRYPTO_LOGOUT 2403 /* Logged out from crypto */ #define AUDIT_CRYPTO_KEY_USER 2404 /* Create,delete,negotiate */ #define AUDIT_CRYPTO_FAILURE_USER 2405 /* Fail decrypt,encrypt,randomiz */ #define AUDIT_CRYPTO_REPLAY_USER 2406 /* Crypto replay detected */ #define AUDIT_CRYPTO_SESSION 2407 /* Record parameters set during TLS session establishment */ #define AUDIT_CRYPTO_IKE_SA 2408 /* Record parameters related to IKE SA */ #define AUDIT_CRYPTO_IPSEC_SA 2409 /* Record parameters related to IPSEC SA */ #define AUDIT_LAST_CRYPTO_MSG 2499 /* Events for both VMs and container orchestration software */ #define AUDIT_FIRST_VIRT_MSG 2500 #define AUDIT_VIRT_CONTROL 2500 /* Start,Pause,Stop VM/container */ #define AUDIT_VIRT_RESOURCE 2501 /* Resource assignment */ #define AUDIT_VIRT_MACHINE_ID 2502 /* Binding of label to VM/cont */ #define AUDIT_VIRT_INTEGRITY_CHECK 2503 /* Guest integrity results */ #define AUDIT_VIRT_CREATE 2504 /* Creation of guest image */ #define AUDIT_VIRT_DESTROY 2505 /* Destruction of guest image */ #define AUDIT_VIRT_MIGRATE_IN 2506 /* Inbound guest migration info */ #define AUDIT_VIRT_MIGRATE_OUT 2507 /* Outbound guest migration info */ #define AUDIT_LAST_VIRT_MSG 2599 #ifndef AUDIT_FIRST_USER_MSG2 #define AUDIT_FIRST_USER_MSG2 2100 /* More userspace messages */ #define AUDIT_LAST_USER_MSG2 2999 #endif /* New kernel event definitions since 5.0 */ #ifndef AUDIT_BPF #define AUDIT_BPF 1334 /* BPF load/unload */ #endif #ifndef AUDIT_EVENT_LISTENER #define AUDIT_EVENT_LISTENER 1335 /* audit mcast sock join/part */ #endif #ifndef AUDIT_URINGOP #define AUDIT_URINGOP 1336 /* io_uring operations */ #endif #ifndef AUDIT_OPENAT2 #define AUDIT_OPENAT2 1337 /* openat2 open_how flags */ #endif #ifndef AUDIT_DM_CTRL #define AUDIT_DM_CTRL 1338 /* Device Mapper target control */ #endif #ifndef AUDIT_DM_EVENT #define AUDIT_DM_EVENT 1339 /* Device Mapper events */ #endif #ifndef AUDIT_ANOM_CREAT #define AUDIT_ANOM_CREAT 1703 /* Suspicious file creation */ #endif #ifdef __cplusplus } #endif #endif