3.5 kacs.caap.policy.changed
- Event type:
kacs.caap.policy.changed - Defined in:
kacs.evman - Tier: essential
- Gating: none — every change a caller holding SeTcbPrivilege makes is recorded
- Cardinality: once per kacs_set_caap call that passed the privilege gate
The record that a central access policy was installed, replaced or removed. A policy decides access to every object whose SACL names it, alongside that object's own DACL, so one change here can widen or narrow access across the whole system without touching any object.
Only a caller holding SeTcbPrivilege, enabled, may change a policy; a call refused for want of it is not recorded. A call that passed the gate is recorded whether or not it applied: a malformed specification leaves the old policy in force and the record says so.
The record names the policy, not its rules. Compare two records' effects by the access records that follow them.
3.5.1 Fields #
| Field | Type | Presence | Meaning |
|---|---|---|---|
subject.token.sid | bin.sid | via subject | The user SID of the effective token the operation ran under. |
subject.token.groups | bin.sid[] | via subject | The group SIDs carried by the effective token. |
subject.token.group-attributes | uint.flags[] | via subject | Per-group attribute bitmasks, positionally parallel to subject.token.groups. |
subject.token.integrity | uint.integrity | via subject | The integrity RID of the effective token. |
subject.token.id | uint.luid | via subject | The token's own LUID, identifying this specific token rather than the logon session it belongs to. |
subject.token.auth-id | uint.luid | via subject | The LUID of the logon session the effective token belongs to. |
subject.token.type | str.enum | via subject | Whether the effective token is a primary token or an impersonation token. |
subject.token.impersonation | uint.enum | via subject | The impersonation level of the effective token. |
subject.token.uid | uint | via subject | The Linux UID this token projects onto, for correlating a Peios event with Linux-side audit data. |
emitter.process.pid | uint | via subject | The process ID the record was written from. |
emitter.process.name | str | via subject | The kernel's name for the emitting process, typically the executable's basename. |
emitter.process.executable | str.path | via subject | The path the emitting process was executed from, resolved at exec with symbolic links already followed. |
subject.pip.type | uint.enum | via subject | The Protected Isolated Process type in force for the access check. |
subject.pip.trust | uint | via subject | The PIP trust level in force for the access check. |
caap.policy.sid | bin.sid | required | The SID identifying a central access policy. |
operation.name | str.enum | required | set installs a policy, or replaces the one of the same SID whole; remove takes it away, after which objects naming it are decided by the recovery policy.Values here (closed set): set · remove. |
outcome.success | bool | required | Whether the operation succeeded. |
outcome.errno | int.errno | when outcome.success == false | The error the operation failed with, as a negative errno. |
Every record also carries the header fields of the envelope, which no payload repeats.
Generated from kacs.evman by pkm/tools/gen-events-book.py. Edit the fragment, not this page.