B.13 fields.*
Every field the catalogue defines under fields, in path order. Each entry gives the field's definition and, under Carried by, every event type that writes it.
B.13.1 fields.attestation.userspace #
- Type:
bool - Asserted: no
- Carried in: the payload
- Defined in:
kernel.evman
Set on a kernel-originated record that carries a value userspace supplied, and absent otherwise. Such a value is the supplying component's claim: it is what the component says it enforced, which the kernel copied but did not observe. The fields that can hold one are marked asserted in their definitions.
A userspace-originated record never carries this field, because its
emitter.class already says the whole payload is the emitter's word.
Carried by:
kacs.audit.access.checkedkacs.audit.privilege.usedkacs.caap.sacl.skippedkacs.caap.staging.diverged
Generated from kernel.evman by pkm/tools/gen-events-book.py. Edit the fragment, not this page.