B.40 subject.*

13 min read

Every field the catalogue defines under subject, in path order. Each entry gives the field's definition and, under Carried by, every event type that writes it.

B.40.1 subject.job.activation-generation #

  • Type: uint
  • Asserted: no
  • Carried in: the payload
  • Defined in: peinit.evman

The activation generation of the service whose job sent a notification message, as object.job.activation-generation describes it. A message from an earlier run of a service carries an older generation.

Carried by:

B.40.2 subject.job.guid #

  • Type: bin.guid
  • Asserted: no
  • Carried in: the payload
  • Defined in: peinit.evman

The job whose process sent a notification message: the service's main process, or a submitted job.

Carried by:

B.40.3 subject.operation.guid #

  • Type: bin.guid
  • Asserted: no
  • Carried in: the payload
  • Defined in: peinit.evman

The peinit operation the sending job was serving when it sent a notification message, such as the start that a readiness message completes. Absent when the job serves none.

Carried by:

B.40.4 subject.pip.trust #

  • Type: uint
  • Asserted: yes
  • Carried in: the payload
  • Defined in: kernel.evman
  • In groups: subject

The PIP trust level in force for the access check. Compared for dominance: a caller whose trust does not dominate the target's is denied before the DACL is reached. Caller-influenced on ioctl-originated events, as subject.pip.type is.

Carried by:

B.40.5 subject.pip.type #

  • Type: uint.enum
  • Values: 0 None · 512 Protected · 1024 Isolated
  • Set: closed
  • Asserted: yes
  • Carried in: the payload
  • Defined in: kernel.evman
  • In groups: subject

The Protected Isolated Process type in force for the access check. Held in process state rather than on the token, and a caller of the access-check ioctl may supply its own value — so on ioctl-originated events this is caller-influenced, and kernel-observed everywhere else.

Carried by:

B.40.6 subject.process.executable #

  • Type: str.path
  • Asserted: no
  • Carried in: the payload
  • Defined in: kernel.evman

The executable of the process that acted, where that is not the emitter, resolved at exec with symbolic links followed.

Carried by:

No event carries this field yet.

B.40.7 subject.process.guid #

  • Type: bin.guid
  • Asserted: no
  • Carried in: the payload
  • Defined in: kernel.evman

The durable GUID of the process that acted, where that is not the emitter. Never reused, so it identifies the actor across PID reuse and after the process has exited.

Carried by:

No event carries this field yet.

B.40.8 subject.process.name #

  • Type: str
  • Asserted: no
  • Carried in: the payload
  • Defined in: kernel.evman

The kernel's name (comm) for the process that acted, where that is not the emitter. Lossy and truncated to 15 bytes; two processes can share a name.

Carried by:

No event carries this field yet.

B.40.9 subject.process.pid #

  • Type: uint
  • Asserted: no
  • Carried in: the payload
  • Defined in: kernel.evman

The process ID of the process that acted, where that is not the emitter: a daemon reporting what a client did names the client here and itself in emitter.process.pid. Same meaning and same caveat as emitter.process.pid — PIDs are reused, so correlate on subject.process.guid.

Carried by:

B.40.10 subject.service.name #

  • Type: str
  • Asserted: no
  • Carried in: the payload
  • Defined in: peinit.evman

The service whose job sent a notification message. The sender is authenticated by its process, so this is the service peinit established, not one the message claimed.

Carried by:

B.40.11 subject.token.auth-id #

  • Type: uint.luid
  • Asserted: no
  • Carried in: the payload
  • Defined in: kernel.evman
  • In groups: caller, subject

The LUID of the logon session the effective token belongs to. The join key to kacs.session.destroyed and to /sys/kernel/security/kacs/sessions, and the way to gather every event from one sign-on.

Carried by:

B.40.12 subject.token.capabilities #

  • Type: bin.sid[]
  • Asserted: no
  • Carried in: the payload
  • Defined in: kernel.evman

The confinement capability SIDs (S-1-15-3-…) the effective token carries. Access to an object from a confined token turns on these: a confined token reaches only what its capabilities, as well as its user and groups, are granted. Unrelated to Linux capabilities, which are linux.cap. Absent on an unconfined token.

Carried by:

No event carries this field yet.

B.40.13 subject.token.gid #

  • Type: uint
  • Asserted: no
  • Carried in: the payload
  • Defined in: kernel.evman

The Linux GID the effective token projects onto, for correlating with Linux-side data such as file ownership and /proc. A projection for interoperability, never the identity KACS decides on.

Carried by:

No event carries this field yet.

B.40.14 subject.token.group-attributes #

  • Type: uint.flags[]
  • Values: SE_GROUP_MANDATORY · SE_GROUP_ENABLED_BY_DEFAULT · SE_GROUP_ENABLED · SE_GROUP_OWNER · SE_GROUP_USE_FOR_DENY_ONLY · SE_GROUP_INTEGRITY · SE_GROUP_INTEGRITY_ENABLED · SE_GROUP_RESOURCE · SE_GROUP_LOGON_ID
  • Asserted: no
  • Carried in: the payload
  • Defined in: kernel.evman
  • In groups: subject

Per-group attribute bitmasks, positionally parallel to subject.token.groups. The two arrays are always the same length, and groups[i] is described by group-attributes[i].

SE_GROUP_INTEGRITY is present for ABI parity only — mandatory integrity control reads subject.token.integrity, never this flag.

The attributes are the token's as held, not as requested when the token was made: creation derives SE_GROUP_ENABLED from SE_GROUP_ENABLED_BY_DEFAULT.

Carried by:

B.40.15 subject.token.groups #

  • Type: bin.sid[]
  • Asserted: no
  • Carried in: the payload
  • Defined in: kernel.evman
  • In groups: subject

The group SIDs carried by the effective token. Access is frequently granted through one of these rather than to the user SID directly, so a search by principal that ignores them misses most of what that principal actually did.

Reconstructing membership as the access check sees it means applying the check's own rule: SE_GROUP_ENABLED set and SE_GROUP_USE_FOR_DENY_ONLY clear, for allow-side matching, read from subject.token.group-attributes.

Carried by:

B.40.16 subject.token.id #

  • Type: uint.luid
  • Asserted: no
  • Carried in: the payload
  • Defined in: kernel.evman
  • In groups: caller, subject

The token's own LUID, identifying this specific token rather than the logon session it belongs to. Correlates every event produced under one token.

Carried by:

B.40.17 subject.token.impersonation #

  • Type: uint.enum
  • Values: 0 Anonymous · 1 Identification · 2 Impersonation · 3 Delegation
  • Set: closed
  • Asserted: no
  • Carried in: the payload
  • Defined in: kernel.evman
  • In groups: caller, subject

The impersonation level of the effective token. A primary token also reports 0, so read subject.token.type before reading 0 as Anonymous. An impersonation token means subject.token and emitter.process describe different principals.

Carried by:

B.40.18 subject.token.integrity #

  • Type: uint.integrity
  • Values: 0 Untrusted · 4096 Low · 8192 Medium · 12288 High · 16384 System
  • Asserted: no
  • Carried in: the payload
  • Defined in: kernel.evman
  • In groups: caller, subject

The integrity RID of the effective token. Mandatory integrity control compares this against the object's integrity label before the DACL is consulted at all, so a denial here never reaches an ACE.

Carried by:

B.40.19 subject.token.privileges #

  • Type: uint.flags
  • Values: 0x4 KACS_SE_CREATE_TOKEN_PRIVILEGE · 0x8 KACS_SE_ASSIGN_PRIMARY_TOKEN_PRIVILEGE · 0x10 KACS_SE_LOCK_MEMORY_PRIVILEGE · 0x20 KACS_SE_INCREASE_QUOTA_PRIVILEGE · 0x80 KACS_SE_TCB_PRIVILEGE · 0x100 KACS_SE_SECURITY_PRIVILEGE · 0x200 KACS_SE_TAKE_OWNERSHIP_PRIVILEGE · 0x400 KACS_SE_LOAD_DRIVER_PRIVILEGE · 0x800 KACS_SE_SYSTEM_PROFILE_PRIVILEGE · 0x1000 KACS_SE_SYSTEMTIME_PRIVILEGE · 0x2000 KACS_SE_PROFILE_SINGLE_PROCESS_PRIVILEGE · 0x4000 KACS_SE_INCREASE_BASE_PRIORITY_PRIVILEGE · 0x20000 KACS_SE_BACKUP_PRIVILEGE · 0x40000 KACS_SE_RESTORE_PRIVILEGE · 0x80000 KACS_SE_SHUTDOWN_PRIVILEGE · 0x100000 KACS_SE_DEBUG_PRIVILEGE · 0x200000 KACS_SE_AUDIT_PRIVILEGE · 0x800000 KACS_SE_CHANGE_NOTIFY_PRIVILEGE · 0x1000000 KACS_SE_REMOTE_SHUTDOWN_PRIVILEGE · 0x10000000 KACS_SE_MANAGE_VOLUME_PRIVILEGE · 0x20000000 KACS_SE_IMPERSONATE_PRIVILEGE · 0x100000000 KACS_SE_RELABEL_PRIVILEGE · 0x800000000 KACS_SE_CREATE_SYMBOLIC_LINK_PRIVILEGE
  • Asserted: no
  • Carried in: the payload
  • Defined in: kernel.evman

The privileges the effective token holds, as the flags of its 64-bit privilege word from uapi/pkm/token.h: bit n is the privilege whose LUID is n, so SeDebugPrivilege is bit 20. Holding a privilege is not the same as using it; which are switched on is subject.token.privileges-enabled.

Userspace emitters that report a caller's privileges by name today will carry this set instead.

Carried by:

B.40.20 subject.token.privileges-enabled #

  • Type: uint.flags
  • Values: 0x4 KACS_SE_CREATE_TOKEN_PRIVILEGE · 0x8 KACS_SE_ASSIGN_PRIMARY_TOKEN_PRIVILEGE · 0x10 KACS_SE_LOCK_MEMORY_PRIVILEGE · 0x20 KACS_SE_INCREASE_QUOTA_PRIVILEGE · 0x80 KACS_SE_TCB_PRIVILEGE · 0x100 KACS_SE_SECURITY_PRIVILEGE · 0x200 KACS_SE_TAKE_OWNERSHIP_PRIVILEGE · 0x400 KACS_SE_LOAD_DRIVER_PRIVILEGE · 0x800 KACS_SE_SYSTEM_PROFILE_PRIVILEGE · 0x1000 KACS_SE_SYSTEMTIME_PRIVILEGE · 0x2000 KACS_SE_PROFILE_SINGLE_PROCESS_PRIVILEGE · 0x4000 KACS_SE_INCREASE_BASE_PRIORITY_PRIVILEGE · 0x20000 KACS_SE_BACKUP_PRIVILEGE · 0x40000 KACS_SE_RESTORE_PRIVILEGE · 0x80000 KACS_SE_SHUTDOWN_PRIVILEGE · 0x100000 KACS_SE_DEBUG_PRIVILEGE · 0x200000 KACS_SE_AUDIT_PRIVILEGE · 0x800000 KACS_SE_CHANGE_NOTIFY_PRIVILEGE · 0x1000000 KACS_SE_REMOTE_SHUTDOWN_PRIVILEGE · 0x10000000 KACS_SE_MANAGE_VOLUME_PRIVILEGE · 0x20000000 KACS_SE_IMPERSONATE_PRIVILEGE · 0x100000000 KACS_SE_RELABEL_PRIVILEGE · 0x800000000 KACS_SE_CREATE_SYMBOLIC_LINK_PRIVILEGE
  • Asserted: no
  • Carried in: the payload
  • Defined in: kernel.evman

Which of the privileges in subject.token.privileges are enabled, as flags in the same bit layout. A privilege takes part in a decision only while enabled, so a privilege that is held but disabled here could not have been what allowed the operation.

Carried by:

B.40.21 subject.token.sid #

  • Type: bin.sid
  • Asserted: no
  • Carried in: the payload
  • Defined in: kernel.evman
  • In groups: caller, subject

The user SID of the effective token the operation ran under. Under impersonation this is the client's SID, not that of the process doing the work.

Carried by:

B.40.22 subject.token.type #

  • Type: str.enum
  • Values: primary · impersonation
  • Set: closed
  • Asserted: no
  • Carried in: the payload
  • Defined in: kernel.evman
  • In groups: caller, subject

Whether the effective token is a primary token or an impersonation token. Needed beside subject.token.impersonation, because a primary token and an Anonymous impersonation token both report level 0 there.

Carried by:

B.40.23 subject.token.uid #

  • Type: uint
  • Asserted: no
  • Carried in: the payload
  • Defined in: kernel.evman
  • In groups: subject

The Linux UID this token projects onto, for correlating a Peios event with Linux-side audit data. A projection for interoperability, never the identity KACS decides on.

Carried by:

B.40.24 subject.true-token.sid #

  • Type: bin.sid
  • Asserted: no
  • Carried in: the payload
  • Defined in: kernel.evman

The user SID of the acting thread's own token, before any impersonation. Carried on records about impersonation, where subject.token.sid is the client being impersonated and this is the server doing the impersonating. Equal to subject.token.sid when the thread is not impersonating.

Carried by:

No event carries this field yet.

Generated from kernel.evman, peinit.evman by pkm/tools/gen-events-book.py. Edit the fragment, not this page.

Edit this page