IBM 10 SP1 EAL4 manual Task Structure, Audit context fields

Figure 5-71: Task Structure

5.6.1.1.5Audit context fields

•Login ID: Login ID is the user ID of the logged-in user. It remains unchanged through the setuid() or seteuid() system calls. Login ID is required by the Controlled Access Protection Profile to irrefutably associate a user with that user’s actions, even across su() calls or use of setuid binaries.

•state: state represents the audit state that controls the creation of per-task audit context and filling of system call specifics in the audit context. It can take the following values:

AUDIT_DISABLED

AUDIT_SETUP_CONTEXT

AUDIT_BUILD_CONTEXT

AUDIT_RECORD_CONTEXT

Table 5-1: Audit Context States

Do not create per-task audit_context. No syscall specific audit records will be generated for the task

Create the per task audit_context, but don't necessarily fill it in a syscall entry time (i.e., filter instead).

Create the per task audit_context, and always fill it in at syscall entry time. This makes a full syscall record available if some other part of the kernel decides it should be recorded.

Create the per task audit_context, always fill it in at syscall entry time, and always write out the audit record at syscall exit time.

•in_syscall: States whether the process is running in a syscall versus in an interrupt.

134