1 files changed, 201 insertions, 0 deletions
diff --git a/usr/src/man/man4/audit_class.4 b/usr/src/man/man4/audit_class.4
new file mode 100644
index 0000000000..23a87b535c
--- /dev/null
+++ b/usr/src/man/man4/audit_class.4
@@ -0,0 +1,201 @@
+'\" te
+.\" Copyright (c) 2008, Sun Microsystems, Inc.
+.\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
+.\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
+.\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
+.TH audit_class 4 "26 Jun 2008" "SunOS 5.11" "File Formats"
+.SH NAME
+audit_class \- audit class definitions
+.SH SYNOPSIS
+.LP
+.nf
+\fB/etc/security/audit_class\fR
+.fi
+
+.SH DESCRIPTION
+.sp
+.LP
+\fB/etc/security/audit_class\fR is a user-configurable ASCII system file that
+stores class definitions used in the audit system. Audit events in
+\fBaudit_event\fR(4) are mapped to one or more of the defined audit classes.
+\fBaudit_event\fR can be updated in conjunction with changes to
+\fBaudit_class\fR. See \fBaudit_control\fR(4) and \fBaudit_user\fR(4) for
+information about changing the preselection of audit classes in the audit
+system. Programs can use the \fBgetauclassent\fR(3BSM) routines to access audit
+class information.
+.sp
+.LP
+The fields for each class entry are separated by colons. Each class entry is a
+bitmap and is separated from each other by a newline.
+.sp
+.LP
+Each entry in the \fBaudit_class\fR file has the form:
+.sp
+.in +2
+.nf
+\fImask\fR:\fIname\fR:\fIdescription\fR
+.fi
+.in -2
+
+.sp
+.LP
+The fields are defined as follows:
+.sp
+.ne 2
+.mk
+.na
+\fB\fImask\fR\fR
+.ad
+.RS 15n
+.rt  
+class mask
+.RE
+
+.sp
+.ne 2
+.mk
+.na
+\fB\fIname\fR\fR
+.ad
+.RS 15n
+.rt  
+class name
+.RE
+
+.sp
+.ne 2
+.mk
+.na
+\fB\fIdescription\fR\fR
+.ad
+.RS 15n
+.rt  
+class description
+.RE
+
+.sp
+.LP
+Each class is represented as a bit in the class mask which is an unsigned
+integer. Thus, there are 32 different classes available. Meta-classes can also
+be defined. These are supersets composed of multiple base classes, and thus
+will have more than 1 bit in its mask. See Examples. Two special meta-classes
+are also pre-defined: \fBall\fR, and \fBno\fR.
+.sp
+.ne 2
+.mk
+.na
+\fB\fBall\fR\fR
+.ad
+.RS 7n
+.rt  
+Represents a conjunction of all allowed classes, and is provided as a shorthand
+method of specifying all classes.
+.RE
+
+.sp
+.ne 2
+.mk
+.na
+\fB\fBno\fR\fR
+.ad
+.RS 7n
+.rt  
+Is the invalid class, and any event mapped solely to this class will not be
+audited. Turning auditing on to the \fBall\fR meta class will not cause events
+mapped solely to the \fBno\fR class to be written to the audit trail. This
+class is also used to map obsolete events which are no longer generated.
+Obsolete events are retained to process old audit trails files.
+.RE
+
+.SH EXAMPLES
+.LP
+\fBExample 1 \fRUsing an \fBaudit_class\fR File
+.sp
+.LP
+The following is an example of an \fBaudit_class\fR file:
+
+.sp
+.in +2
+.nf
+0x00000000:no:invalid class
+0x00000001:fr:file read
+0x00000002:fw:file write
+0x00000004:fa:file attribute access
+0x00000008:fm:file attribute modify
+0x00000010:fc:file create
+0x00000020:fd:file delete
+0x00000040:cl:file close
+0x00000100:nt:network
+0x00000200:ip:ipc
+0x00000400:na:non-attribute
+0x00001000:lo:login or logout
+0x00004000:ap:application
+0x000f0000:ad:old administrative (meta-class)
+0x00070000:am:administrative (meta-class)
+0x00010000:ss:change system state
+0x00020000:as:system-wide administration
+0x00040000:ua:user administration
+0x00080000:aa:audit utilization
+0x00300000:pc:process (meta-class)
+0x00100000:ps:process start/stop
+0x00200000:pm:process modify
+0x20000000:io:ioctl
+0x40000000:ex:exec
+0x80000000:ot:other
+0xffffffff:all:all classes (meta-class)
+.fi
+.in -2
+.sp
+
+.SH FILES
+.sp
+.ne 2
+.mk
+.na
+\fB\fB/etc/security/audit_class\fR\fR
+.ad
+.RS 29n
+.rt  
+ 
+.RE
+
+.SH ATTRIBUTES
+.sp
+.LP
+See \fBattributes\fR(5) for descriptions of the following attributes:
+.sp
+
+.sp
+.TS
+tab() box;
+cw(2.75i) |cw(2.75i) 
+lw(2.75i) |lw(2.75i) 
+.
+ATTRIBUTE TYPEATTRIBUTE VALUE
+_
+Interface Stability  See below.
+.TE
+
+.sp
+.LP
+The file format stability is Committed. The file content is Uncommitted.
+.SH SEE ALSO
+.sp
+.LP
+\fBbsmconv\fR(1M), \fBau_preselect\fR(3BSM), \fBgetauclassent\fR(3BSM),
+\fBaudit_control\fR(4), \fBaudit_event\fR(4), \fBaudit_user\fR(4),
+\fBattributes\fR(5)
+.sp
+.LP
+Part\ VII, \fISolaris Auditing,\fR in \fISystem Administration Guide: Security
+Services\fR
+.SH NOTES
+.sp
+.LP
+It is possible to deliberately turn on the \fBno\fR class in the kernel, in
+which case the audit trail will be flooded with records for the audit event
+\fBAUE_NULL\fR.
+.sp
+.LP
+This functionality is available only if  Solaris Auditing has been enabled. See
+\fBbsmconv\fR(1M) for more information.