B.1 access.*

7 min read

Every field the catalogue defines under access, in path order. Each entry gives the field's definition and, under Carried by, every event type that writes it.

B.1.1 access.audit-mask #

  • Type: uint.mask
  • Asserted: no
  • Carried in: the payload
  • Defined in: kernel.evman

The full continuous-audit mask cached on a handle, of which access.matched is the part this operation touched. Present so an operator can see what else on that handle would fire, which cannot be derived from the intersection alone.

Carried by:

B.1.2 access.bypass #

  • Type: str.enum
  • Values: priv · si-fromkernel
  • Set: closed
  • Asserted: no
  • Carried in: the payload
  • Defined in: kernel.evman

Why a signal was delivered with no access check at all. priv is a signal the kernel sent as itself (SEND_SIG_PRIV); si-fromkernel is one whose si_code marks it as kernel-originated. Either is a total bypass of the process-access model, keyed off the signal's origin, so a spoofed origin would be silent; absent when the signal was checked.

Carried by:

No event carries this field yet.

B.1.3 access.decided #

  • Type: uint.mask
  • Asserted: no
  • Carried in: the payload
  • Defined in: kernel.evman

The bits the DACL evaluation reached a conclusion on, granted or denied by an ACE. A requested bit outside this set was never mentioned by any ACE and was denied because nothing granted it — a different finding from an explicit deny, and one access.granted alone cannot show.

Carried by:

No event carries this field yet.

B.1.4 access.default-descriptor #

  • Type: bool
  • Asserted: no
  • Carried in: the payload
  • Defined in: kernel.evman

Whether an authorisation decision used the compiled-in default security descriptor rather than one an administrator configured. When true, the policy that decided was built into the kernel and is not visible anywhere in the registry. The case that produces it today is a write to the base layer when the base layer has no metadata row of its own.

Carried by:

No event carries this field yet.

B.1.5 access.denied-integrity #

  • Type: uint.mask
  • Asserted: no
  • Carried in: the payload
  • Defined in: kernel.evman

The bits mandatory integrity control denied: the rights the object's mandatory label withholds from a caller of lower integrity, whatever its DACL says. On an access-check record these are the requested bits, or every bit for a MAXIMUM_ALLOWED request, and the field is absent when there were none.

Carried by:

B.1.6 access.denied-trust #

  • Type: uint.mask
  • Asserted: no
  • Carried in: the payload
  • Defined in: kernel.evman

The bits the process-trust label denied: the rights the object's trust label withholds from a caller whose PIP does not dominate it. Read as access.denied-integrity is, and can be non-zero in the same evaluation.

Carried by:

B.1.7 access.disallowed #

  • Type: uint.mask
  • Asserted: no
  • Carried in: the payload
  • Defined in: kernel.evman

The requested bits that fall outside the set the operation permits at all, whatever the descriptor says. Such a request is refused before any access check.

Carried by:

No event carries this field yet.

B.1.8 access.granted #

  • Type: uint.mask
  • Asserted: no
  • Carried in: the payload
  • Defined in: kernel.evman

The access mask in force. What that means narrows per event — the rights this check granted, or the rights a handle was opened with — so read the event's own note.

Carried by:

B.1.9 access.granted-staged #

  • Type: uint.mask
  • Asserted: no
  • Carried in: the payload
  • Defined in: kernel.evman

What a staged central access policy, not yet in force, would have granted. Carried beside access.granted, the grant the policy in force produced; the two differing is the record of what a policy change will alter before it is made.

Carried by:

B.1.10 access.matched #

  • Type: uint.mask
  • Asserted: no
  • Carried in: the payload
  • Defined in: kernel.evman

The subset of the requested access that overlapped an audit mask and therefore caused the record to exist. The bits that triggered the audit, not the bits that were used.

Carried by:

B.1.11 access.maximum-allowed #

  • Type: bool
  • Asserted: no
  • Carried in: the payload
  • Defined in: kernel.evman

Whether the request was made in MAXIMUM_ALLOWED mode, asking for whatever the descriptor would grant rather than for named rights. Changes how SACL audit ACEs match, and such a request cannot fail, so it is needed to read both access.granted and outcome.success.

Carried by:

No event carries this field yet.

B.1.12 access.missing #

  • Type: uint.mask
  • Asserted: no
  • Carried in: the payload
  • Defined in: kernel.evman

The rights an operation needed that the handle did not have. Carried on a refusal of an operation on an already-open handle: the handle's access.granted, and what it lacked.

Carried by:

No event carries this field yet.

B.1.13 access.privileged #

  • Type: bool
  • Asserted: no
  • Carried in: the payload
  • Defined in: kernel.evman

Whether the check was satisfied by a privilege rather than by the descriptor. True on a descriptor written with SeRestorePrivilege over a missing or corrupt one, which is a complete bypass of the object's access control and not a decision the descriptor made.

Carried by:

No event carries this field yet.

B.1.14 access.ptrace-mode #

  • Type: uint.flags
  • Values: 0x1 PTRACE_MODE_READ · 0x2 PTRACE_MODE_ATTACH · 0x4 PTRACE_MODE_NOAUDIT · 0x8 PTRACE_MODE_FSCREDS · 0x10 PTRACE_MODE_REALCREDS · 0x20 PTRACE_MODE_GETFD · 0x40 PTRACE_MODE_PIDFD_OPEN · 0x80 PTRACE_MODE_PROC_QUERY_LIMITED · 0x100 PTRACE_MODE_PROC_QUERY_INFORMATION
  • Asserted: no
  • Carried in: the payload
  • Defined in: kernel.evman

The ptrace access mode of a cross-process check. The last four bits are Peios additions that let KACS tell a pidfd open, a descriptor theft and a /proc read apart from a generic ptrace check. The mode decides the process right required: PTRACE_MODE_GETFD, taking another process's file descriptor, needs PROCESS_DUP_HANDLE.

Carried by:

No event carries this field yet.

B.1.15 access.requested #

  • Type: uint.mask
  • Asserted: no
  • Carried in: the payload
  • Defined in: kernel.evman

The access mask the caller asked for, after generic bits have been mapped to type-specific ones. Generic bits never survive into an event.

Carried by:

B.1.16 access.requested-minimum #

  • Type: uint.mask
  • Asserted: no
  • Carried in: the payload
  • Defined in: kernel.evman

The smallest access a POSIX open genuinely needed, before the kernel widened the request for compatibility. Carried beside access.requested: the difference is access the caller was given without asking for it.

Carried by:

No event carries this field yet.

B.1.17 access.self #

  • Type: bool
  • Asserted: no
  • Carried in: the payload
  • Defined in: kernel.evman

Whether the operation targeted the caller itself. Several cross-process checks exempt a process acting on itself structurally — raise() must work even when a restricted token would fail its own process's descriptor — so true means no descriptor was consulted.

Carried by:

No event carries this field yet.

B.1.18 access.vfs-mask #

  • Type: uint.flags
  • Values: 0x1 MAY_EXEC · 0x2 MAY_WRITE · 0x4 MAY_READ · 0x8 MAY_APPEND · 0x10 MAY_ACCESS · 0x20 MAY_OPEN · 0x40 MAY_CHDIR · 0x80 MAY_NOT_BLOCK
  • Asserted: no
  • Carried in: the payload
  • Defined in: kernel.evman

The VFS permission mask the kernel passed to the check. A different vocabulary from access.requested, which is the KACS rights the mask was mapped to; a record carrying both shows the mapping.

Carried by:

No event carries this field yet.

Generated from kernel.evman by pkm/tools/gen-events-book.py. Edit the fragment, not this page.

Edit this page