Constants
Add syscall rule – deprecated
Add syscall filtering rule
Generate audit record if rule matches
Process ended abnormally
Suspicious use of file links
Device changed promiscuous mode
SE Linux avc denial or grant
dentry, vfsmount pair from avc
Information about fcaps increasing perms
Record showing argument to sys_capset
Audit system configuration change
Current working directory
Daemon error stop record
Daemon config change
Daemon normal stop record
Daemon startup record
Delete syscall rule – deprecated
Delete syscall filtering rule
End of multi-record event
execve arguments
Fanotify access decision
audit record for pipe/socketpair
audit log listing feature changes
Apply rule at syscall entry
Apply rule at syscall exit
Apply rule at task creation (not syscall)
Apply rule at audit_log_start
Filter is unset
Apply rule to user-generated messages
Apply rule to file system watches
Userspace messages mostly uninteresting to kernel
More user space messages;
Get status
Get which features are enabled
Data integrity verification
Integrity HASH type
Metadata integrity verification
PCR invalidation msgs
policy rule
Integrity enable status
IPC record
IPC new permissions record type
For use by 3rd party modules
Kernel Module events
List syscall rules – deprecated
List syscall filtering rules
Define the login id and information
NetLabel: add CALIPSO DOI entry
NetLabel: del CALIPSO DOI entry
NetLabel: add CIPSOv4 DOI entry
NetLabel: del CIPSOv4 DOI entry
Changes to booleans
Not used
Not used
Not used
Not used
Audit an IPSec event
NetLabel: add LSM domain mapping
NetLabel: del LSM domain mapping
Policy file load
Changed enforcing,permissive,off
NetLabel: allow unlabeled traffic
NetLabel: add a static label
NetLabel: del a static label
Append to watched tree
Record showing descriptor and flags in mmap
POSIX MQ get/set attribute record type
POSIX MQ notify record type
POSIX MQ open record type
POSIX MQ send/receive record type
Netfilter chain modifications
Packets traversing netfilter chains
Do not build context if rule matches
Unused multicast group for audit
Multicast group to listen for audit events
Mask to get actual filter
ptrace target
Filename path information
Build context if rule matches
Proctitle emit event
Replace auditd if this packet unanswerd
Secure Computing event
Internal SE Linux Errors
Set status (enable/disable/auditd)
Turn an audit feature on or off
Get info about sender of signal to auditd
sockaddr copied as syscall arg
sys_socketcall arguments
Syscall event
Trim junk from watched tree
Input on an administrative TTY
Get TTY auditing status
Set TTY auditing status
Message from userspace – deprecated
We filter this differently
Non-ICANON TTY input meaning
Insert file/dir watch entry
List all file/dir watches
Remove file/dir watch entry
Link supports multicast routing
Driver supports setting media type (only used by ARM ethernet)
Link supports broadcasting
Tell driver to do debugging (currently unused)
Driver signals IFF_DORMANT
Dialup device with changing addresses (unused, BSD compatibility)
Echo sent packets (testing feature, CAN only)
Link loopback network
Link layer is operational
Master of a load balancer (bonding)
Link supports multicasting
ARP is not supported
Avoid use of trailers (unused, BSD compatibility)
u32erface is point-to-point link
Link selects port automatically (only used by ARM ethernet)
Receive all packets.
Link is up and carrier is OK (RFC2863 OPER_UP)
Slave of a load balancer
Link is up (administratively).
Auditing.
Kernel connector. See
Documentation/connector/* in the Linux kernel source tree for further information.Netlink interface to request information about ciphers registered with the kernel crypto
API as well as allow configuration of the kernel crypto API.
DECnet routing messages.
Access to FIB lookup from user space.
Transport IPv4 packets from netfilter to user space. Used by ip_queue kernel
module. After a long period of being declared obsolete (in favor of the more advanced
nfnetlink_queue feature), it was removed in Linux 3.5.
Generic netlink family for simplified netlink usage.
Transport IPv6 packets from netfilter to user space. Used by ip6_queue kernel module.
Open-iSCSI.
Kernel messages to user space.
Netfilter subsystem.
Netfilter/iptables ULOG.
Infiniband RDMA.
Receives routing and link updates and may be used to modify the routing tables (both IPv4
and IPv6), IP addresses, link parameters, neighbor setups, queueing disciplines, traffic
classes and packet classifiers (see rtnetlink(7)).
SCSI transpots
SELinux event notifications.
Query information about sockets of various protocol families from the kernel (see sock_diag(7)).
Reserved for user-mode socket protocols.
IPsec.
Identify the bits that represent the “nested” flag of a netlink attribute.
Identify the bits that represent the “byte order” flag of a netlink attribute.
Identify the bits that represent the type of a netlink attribute.
The message terminates a multipart message.
Data lost
The message signals an error and the payload contains a nlmsgerr structure. This can be looked
at as a NACK and typically it is from FEC to CPC.
The message is ignored.
Request for an acknowledgment on success. Typical direction of request is from user space
(CPC) to kernel space (FEC).
extended ACK TVLs were included
Add to the end of the object list.
Return an atomic snapshot of the table. Requires
CAP_NET_ADMIN capability or a effective UID
of 0.request was capped
Create object if it doesn’t already exist.
Dump was filtered as requested
Dump was inconsistent due to sequence change
Echo this request. Typical direction of request is from user space (CPC) to kernel space
(FEC).
Don’t replace if the object already exists.
Return all entries matching criteria passed in message content.
Indicates the message is part of a multipart message terminated by NLMSG_DONE
Do not delete recursively
Replace existing matching object.
Must be set on all request messages (typically from user space to kernel space)
Return the complete table instead of a single entry.
A local broadcast route (sent as a unicast)
A packet dropping route
A local broadcast route (sent as a broadcast)
A local interface route
A multicast route
A network address translation rule
A packet rejection route
Continue routing lookup in another table
A gateway or direct route
An unreachable destination
Unknown route
Refer to an external resolver (not implemented)
Route was learnt during boot
Route was learnt by the kernel
Route was learnt by an ICMP redirect
Route was set statically
Unknown
Route on the local host
Route on this link
Destination doesn’t exist
Interior route in the local autonomous system
Global route