diff options
| author | Alexander Pyhalov <apyhalov@gmail.com> | 2017-06-08 16:53:28 +0300 |
|---|---|---|
| committer | Robert Mustacchi <rm@joyent.com> | 2017-06-27 22:43:19 +0000 |
| commit | 73177167911de9eef96901d8f6d3cb6be7c67574 (patch) | |
| tree | 597fd58200c8b5038db3974135d583f18eb2aaa1 /usr/src | |
| parent | b4203d757c7c247e39c94c09a94021a3a8121062 (diff) | |
| download | illumos-joyent-73177167911de9eef96901d8f6d3cb6be7c67574.tar.gz | |
8309 libbsm should support AUE_sudo audit event
Reviewed by: Gordon Ross <gordon.w.ross@gmail.com>
Reviewed by: Toomas Soome <tsoome@me.com>
Approved by: Robert Mustacchi <rm@joyent.com>
Diffstat (limited to 'usr/src')
| -rw-r--r-- | usr/src/cmd/auditrecord/audit_record_attr.txt | 5 | ||||
| -rw-r--r-- | usr/src/lib/libbsm/audit_event.txt | 5 |
2 files changed, 10 insertions, 0 deletions
diff --git a/usr/src/cmd/auditrecord/audit_record_attr.txt b/usr/src/cmd/auditrecord/audit_record_attr.txt index 79dfe52e68..011f2aa153 100644 --- a/usr/src/cmd/auditrecord/audit_record_attr.txt +++ b/usr/src/cmd/auditrecord/audit_record_attr.txt @@ -722,6 +722,11 @@ label=AUE_PFEXEC comment=process if ruid, euid, rgid or egid is changed: comment=output if arge policy is set +label=AUE_sudo + format=exec_args1:[text]2 + comment=command args: + comment=error message (failure only) + label=AUE_EXIT format=arg1:[text]2 comment=1, exit status, "exit status": diff --git a/usr/src/lib/libbsm/audit_event.txt b/usr/src/lib/libbsm/audit_event.txt index 1e87e1a21a..242aab3703 100644 --- a/usr/src/lib/libbsm/audit_event.txt +++ b/usr/src/lib/libbsm/audit_event.txt @@ -565,6 +565,11 @@ 6501:AUE_hotplug_set:set hotplug bus private options:ss # +# sudo event +# +6650:AUE_sudo:sudo(1m):lo,ua,as + +# # Trusted Extensions events: # 9035:AUE_sl_change:Workspace label change:ap |