<?xml version="1.0" encoding="UTF-8" ?>

<!--
    Copyright 2002-2003 Sun Microsystems, Inc.  All rights reserved.
    Use is subject to license terms.

    ident	"@(#)adt_record.dtd.1	1.2	03/04/14 SMI"
-->


<!--Entity Definitions-->

<!-- timeattr 

Timestamp; the time/date to the second in strftime(3C) default format,
followed by milliseconds offset.

Example:	time="Mon May 06 12:10:18 2002" msec="750"

-->
<!ENTITY % timeattr	"time		CDATA #REQUIRED
			msec		CDATA #REQUIRED">

<!-- xinfo	Generic info for X related tokens.  -->
<!ENTITY % xinfo	"xid		CDATA #REQUIRED
			xcreator-uid	CDATA #REQUIRED">

<!-- reserved_toks 

This represents the set of "reserved" tokens whose placement is
fixed.

-->
<!ENTITY % reserved_toks	"(
			file			|
			record			|
			host			|
			sequence
			)
">

<!-- normaltoks 

This represents the set of all tokens other than the "reserved"
tokens.

-->
<!ENTITY % normaltoks	"(
			acl			|
			arbitrary		|
			argument		|
			attribute		|
			clearance		|
			cmd			|
			exit			|
			exec_args		|
			exec_env		|
			group			|
			information_label	|
			ip			|
			ip_address		|
			IPC			|
			IPC_perm		|
			ip_port			|
			liaison			|
			opaque			|
			path			|
			path_attr		|
			privilege		|
			process			|
			return			|
			sensitivity_label	|
			old_socket		|
			socket			|
			subject			|
			text			|
			use_of_authorization	|
			use_of_privilege	|
			X_atom			|
			X_client		|
			X_color_map		|
			X_cursor		|
			X_font			|
			X_graphic_context	|
			X_pixmap		|
			X_property		|
			X_selection		|
			X_window
			)
">

<!--Element Definitions-->

<!--

The main element, "audit", consists of a sequence of file & record tokens.

-->
<!ELEMENT audit (file | record)*>

<!-- file token -->
<!ELEMENT file		(#PCDATA)>
<!ATTLIST file		%timeattr;>


<!-- record token

Audit records will have this general layout of tokens after the
first token (which is the record token):
	(tokens),subject,group,(tokens),return,sequence,host

(all tokens after the record token are optional; host is TSOL only.)

-->
<!ELEMENT record (
		(%normaltoks;)*,
		sequence?,
		host?
	)
>
<!ATTLIST record
		version		CDATA #REQUIRED
		event		CDATA #REQUIRED
		modifier	CDATA #IMPLIED
		host		CDATA #IMPLIED
		%timeattr;
>

<!-- text token -->
<!ELEMENT text		(#PCDATA)>

<!-- path token -->
<!ELEMENT path		(#PCDATA)>

<!-- path_attr token -->
<!ELEMENT path_attr		(xattr*)>
<!ELEMENT xattr			(#PCDATA)>

<!-- host token -->
<!ELEMENT host		(#PCDATA)>

<!-- subject token -->
<!ELEMENT subject	EMPTY>
<!ATTLIST subject
		audit-uid	CDATA #REQUIRED
		uid		CDATA #REQUIRED
		gid		CDATA #REQUIRED
		ruid		CDATA #REQUIRED
		rgid		CDATA #REQUIRED
		pid		CDATA #REQUIRED
		sid		CDATA #REQUIRED
		tid		CDATA #REQUIRED
>

<!-- process token -->
<!ELEMENT process	EMPTY>
<!ATTLIST process
		audit-uid	CDATA #REQUIRED
		uid		CDATA #REQUIRED
		gid		CDATA #REQUIRED
		ruid		CDATA #REQUIRED
		rgid		CDATA #REQUIRED
		pid		CDATA #REQUIRED
		sid		CDATA #REQUIRED
		tid		CDATA #REQUIRED
>

<!-- return token -->
<!ELEMENT return		EMPTY>
<!ATTLIST return
		errval		CDATA #REQUIRED
		retval		CDATA #REQUIRED
>

<!-- exit token -->
<!ELEMENT exit			EMPTY>
<!ATTLIST exit
		errval		CDATA #REQUIRED
		retval		CDATA #REQUIRED
>

<!-- sequence token -->
<!ELEMENT sequence		EMPTY>
<!ATTLIST sequence
		seq-num		CDATA #REQUIRED
>

<!-- group token -->
<!ELEMENT group			(gid)*>
<!ELEMENT gid			(#PCDATA)>

<!-- opaque token -->
<!ELEMENT opaque		(#PCDATA)>

<!-- liaison token -->
<!-- (NOTE: liaison is obsolete and is no longer generated -->
<!ELEMENT liaison		(#PCDATA)>

<!-- argument token -->
<!ELEMENT argument		EMPTY>
<!ATTLIST argument
		arg-num		CDATA #REQUIRED
		value		CDATA #REQUIRED
		desc		CDATA #REQUIRED
>

<!-- attribute token -->
<!ELEMENT attribute		EMPTY>
<!ATTLIST attribute
		mode		CDATA #REQUIRED
		uid		CDATA #REQUIRED
		gid		CDATA #REQUIRED
		fsid		CDATA #REQUIRED
		nodeid		CDATA #REQUIRED
		device		CDATA #REQUIRED
>

<!-- cmd token -->
<!ELEMENT cmd			(argv*, arge*)>
<!ELEMENT argv			(#PCDATA)>
<!ELEMENT arge			(#PCDATA)>

<!-- exec_args token -->
<!ELEMENT exec_args		(arg*)>
<!ELEMENT arg			(#PCDATA)>

<!-- exec_env token -->
<!ELEMENT exec_env		(env*)>
<!ELEMENT env			(#PCDATA)>

<!-- arbitrary token -->
<!ELEMENT arbitrary		(#PCDATA)>
<!ATTLIST arbitrary
		print		CDATA #REQUIRED
		type		CDATA #REQUIRED
		count		CDATA #REQUIRED
>

<!-- clearance token -->
<!ELEMENT clearance		(#PCDATA)>

<!-- privilege token -->
<!ELEMENT privilege		(#PCDATA)>
<!ATTLIST privilege
		set-type	CDATA #REQUIRED
>

<!-- use_of_privilege token -->
<!ELEMENT use_of_privilege	(#PCDATA)>
<!ATTLIST use_of_privilege
		result		CDATA #REQUIRED
>

<!-- sensitivity_label token -->
<!ELEMENT sensitivity_label	(#PCDATA)>

<!-- information_label token -->
<!ELEMENT information_label	(#PCDATA)>

<!-- use_of_authorization token -->
<!ELEMENT use_of_authorization	(#PCDATA)>

<!-- IPC token -->
<!ELEMENT IPC			EMPTY>
<!ATTLIST IPC
		ipc-type	CDATA #REQUIRED
		ipc-id		CDATA #REQUIRED
>

<!-- IPC_perm token -->
<!ELEMENT IPC_perm		EMPTY>
<!ATTLIST IPC_perm
		uid		CDATA #REQUIRED
		gid		CDATA #REQUIRED
		creator-uid	CDATA #REQUIRED
		creator-gid	CDATA #REQUIRED
		mode		CDATA #REQUIRED
		seq		CDATA #REQUIRED
		key		CDATA #REQUIRED
>

<!-- ip_address token -->
<!ELEMENT ip_address		(#PCDATA)>

<!-- ip_port token -->
<!-- (NOTE: ip_port is obsolete and is no longer generated -->
<!ELEMENT ip_port		(#PCDATA)>

<!-- ip token -->
<!-- (NOTE: ip is obsolete and is no longer generated -->
<!ELEMENT ip			EMPTY>
<!ATTLIST ip
		version		CDATA #REQUIRED
		service_type	CDATA #REQUIRED
		len		CDATA #REQUIRED
		id		CDATA #REQUIRED
		offset		CDATA #REQUIRED
		time_to_live	CDATA #REQUIRED
		protocol	CDATA #REQUIRED
		cksum		CDATA #REQUIRED
		src_addr	CDATA #REQUIRED
		dest_addr	CDATA #REQUIRED
>

<!-- old_socket token -->
<!ELEMENT old_socket		EMPTY>
<!ATTLIST old_socket
		type		CDATA #REQUIRED
		port		CDATA #REQUIRED
		addr		CDATA #REQUIRED
>

<!-- socket token -->
<!ELEMENT socket		EMPTY>
<!ATTLIST socket
		sock_domain	CDATA #REQUIRED
		sock_type	CDATA #REQUIRED
		lport		CDATA #REQUIRED
		laddr		CDATA #REQUIRED
		fport		CDATA #REQUIRED
		faddr		CDATA #REQUIRED
>

<!-- acl token -->
<!ELEMENT acl			EMPTY>
<!ATTLIST acl
		type		CDATA #REQUIRED
		value		CDATA #REQUIRED
		mode		CDATA #REQUIRED
>

<!-- X_atom token -->
<!ELEMENT X_atom		(#PCDATA)>

<!-- X_color_map token -->
<!ELEMENT X_color_map		EMPTY>
<!ATTLIST X_color_map		%xinfo;>

<!-- X_cursor token -->
<!ELEMENT X_cursor		EMPTY>
<!ATTLIST X_cursor		%xinfo;>

<!-- X_font token -->
<!ELEMENT X_font		EMPTY>
<!ATTLIST X_font		%xinfo;>

<!-- X_graphic_context token -->
<!ELEMENT X_graphic_context	EMPTY>
<!ATTLIST X_graphic_context	%xinfo;>

<!-- X_pixmap token -->
<!ELEMENT X_pixmap		EMPTY>
<!ATTLIST X_pixmap		%xinfo;>

<!-- X_window token -->
<!ELEMENT X_window		EMPTY>
<!ATTLIST X_window		%xinfo;>

<!-- X_property token -->
<!ELEMENT X_property		(#PCDATA)>
<!ATTLIST X_property		%xinfo;>

<!-- X_client token -->
<!ELEMENT X_client		(#PCDATA)>

<!-- X_selection token -->
<!ELEMENT X_selection		(xsel_text, xsel_type, xsel_data)>
<!ELEMENT x_sel_text		(#PCDATA)>
<!ELEMENT x_sel_type		(#PCDATA)>
<!ELEMENT x_sel_data		(#PCDATA)>
