* Definitive guide for audit message types
@ 2014-10-10 16:58 William Roberts
2014-10-11 22:01 ` Steve Grubb
0 siblings, 1 reply; 2+ messages in thread
From: William Roberts @ 2014-10-10 16:58 UTC (permalink / raw)
To: linux-audit@redhat.com
For audit log records, the type field can be something like 1400 for
an AVC event. I know on the desktop it formats these all to the pretty
names IIRC, however I am on Android and were not quite as advanced
yet. Is their a definitive guide for each number what they correspond
to besides cracking open the header files?
Thanks.
--
Respectfully,
William C Roberts
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: Definitive guide for audit message types
2014-10-10 16:58 Definitive guide for audit message types William Roberts
@ 2014-10-11 22:01 ` Steve Grubb
0 siblings, 0 replies; 2+ messages in thread
From: Steve Grubb @ 2014-10-11 22:01 UTC (permalink / raw)
To: William Roberts; +Cc: linux-audit@redhat.com
On Fri, 10 Oct 2014 09:58:48 -0700
William Roberts <bill.c.roberts@gmail.com> wrote:
> For audit log records, the type field can be something like 1400 for
> an AVC event. I know on the desktop it formats these all to the pretty
> names IIRC, however I am on Android and were not quite as advanced
> yet. Is their a definitive guide for each number what they correspond
> to besides cracking open the header files?
The kernel headers and libaudit headers are the literal definitive
source. They can be seen here:
https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/tree/include/uapi/linux/audit.h?id=refs/tags/v3.16.5#n30
and
https://fedorahosted.org/audit/browser/trunk/lib/libaudit.h#L40
-Steve
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2014-10-11 22:01 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-10-10 16:58 Definitive guide for audit message types William Roberts
2014-10-11 22:01 ` Steve Grubb
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox