7.2 Patterns and Descriptors

5 min read

Access is defined on named patterns, each standing for a category of observability data and each carrying a descriptor. The three data types have independent pattern namespaces:

7.2.1 Matching #

A pattern matches by dot-delimited prefix. The pattern kacs matches the exact string kacs and any string beginning kacs. — and matches neither kacs_extended nor kacsfoo, because the dot is the hierarchy separator and not a mere character.

* is the wildcard default and matches everything.

Ingestion constrains metric names to the identifier grammar and origins to that grammar plus a producer component (PSPU §3.7, §3.10), which is what keeps a producer from choosing a name containing the wildcard or a backslash — a name that would otherwise match a rule its producer was never meant to satisfy, or store its descriptor somewhere other than where the administrator who wrote it believes.

An origin naming a producer within a service — jellyfin/HealthCheck, jobs/<guid> — resolves from the part before the slash, so the matching above starts at jellyfin and at jobs. A service's hooks, reload commands and health checks therefore answer to the descriptor written against the service itself, and every submitted job's output answers to one descriptor at Logs\jobs. The slash never enters a descriptor path, which is what keeps it out of the registry namespace it would otherwise be a separator in.

7.2.2 Resolution #

For a concrete identifier, eventd resolves the applicable descriptor by walking up the hierarchy:

1. Look for an exact match on the full identifier, kacs.audit.access.checked.
2. Remove the last dot-separated component and look again, kacs.audit.access.
3. Repeat: kacs.audit, then kacs.
4. Fall back to the wildcard, *.

The first match wins; a more specific pattern overrides a less specific one.

7.2.3 Storage #

Descriptors are registry values under the eventd security subtree:

Machine\System\eventd\Security\Events\*
Machine\System\eventd\Security\Events\kacs
Machine\System\eventd\Security\Events\kacs.audit.access.checked
Machine\System\eventd\Security\Logs\*
Machine\System\eventd\Security\Logs\loregd
Machine\System\eventd\Security\Metrics\*
Machine\System\eventd\Security\Metrics\cpu
Machine\System\eventd\Security\Admin

Each type's wildcard default is load-bearing. If a default is missing, eventd denies access to all data of that type: resolution that reaches the end of the hierarchy without a match is a denial, not a grant (PSPU §3.28).

Storing them in the registry rather than in eventd's own databases means the registry's access control protects them, and an administrator edits them with the ordinary registry tools rather than through eventd.

7.2.3.1 Who may change them #

A descriptor is stored whole, as one value, SACL included. Whoever may write that value may therefore replace the SACL as well as the DACL, and removing a SACL this way needs no SeSecurityPrivilege: the registry checks the right to set the value, not the right to change audit policy. Write access to the Security subtree is therefore audit-policy authority, and only those trusted to change audit policy should hold it. A tool that edits a descriptor's DACL must write the SACL back unchanged.

eventd gives Machine\System\eventd\Security a protected DACL: SYSTEM and Administrators full control, Authenticated Users read, which is what eventd and its clients need to resolve descriptors. Protection stops a broader grant on Machine\System\eventd, such as one made to let someone tune eventd, from reaching the audit policy. eventd sets it only while the key's DACL is still wholly inherited, so an administrator's own choice there is never overwritten.

7.2.4 Defaults on first boot #

eventd creates the three wildcard keys, the descriptor for its own health metrics and the administrative descriptor if they do not exist:

Every one of the five also carries a SACL with one failure-audit ACE for Everyone, covering EVENTD_READ, EVENTD_ADMINISTER and EVENTD_PUBLISH, and nothing else: a check under a default descriptor that is denied any of them is audited, whoever made it, and a granted one is not (§7.4).

The asymmetry reflects sensitivity. Events include security audit data and are restricted to administrators; logs and metrics are operational data and are readable by any authenticated user. Publication is fail-closed for ordinary services until a more-specific pattern grants their service SID EVENTD_PUBLISH (§7.6). An administrator can tighten either side independently.

On upgrade, eventd replaces a stored descriptor only when its binary form exactly matches a default an earlier eventd shipped at that key: the Metrics wildcard's former read-only default, and each key's former default without a SACL. Those are replaced by the current default, SACL and all. A value an administrator changed is never treated as a default and never rewritten.

7.2.5 Conditional ACEs #

Descriptors on eventd security objects may carry conditional ACEs, and KACS evaluates them as it would anywhere.

eventd passes no eventd-specific local claims to AccessCheck: local_claims_ptr is null and local_claims_len is zero. Conditions referencing token claims that KACS itself supplies still evaluate; conditions referencing eventd-local claims observe them as absent.

A stable set of eventd-local claims — the event's type, the log's origin, the time of day — is a plausible later addition, and defining one is a commitment to keep those claim names meaningful thereafter.

7.2.6 The administrative descriptor #

INDEX (PSPU §3.23) is checked against Machine\System\eventd\Security\Admin, with EVENTD_ADMINISTER as the desired access. Its default grants SYSTEM and Administrators.

eventd refuses INDEX outright if no administrative descriptor exists, by the same fail-closed rule as the read path. Keeping it in the registry means the registry's own descriptor protects the policy and a recreated eventd-meta.db cannot reset it (§3.5).

Edit this page