3.6 kacs.caap.sacl.skipped
- Event type:
kacs.caap.sacl.skipped - Defined in:
kacs.evman - Tier: standard
- Gating: an access check that evaluates a central access policy rule whose SACL cannot be used
- Cardinality: once per rule whose SACL failed
The record that a central access policy rule's SACL could not be parsed or evaluated, so the audit it asked for was skipped. The access decision is unaffected — a rule's SACL only adds audit records — but the records that rule should have produced for this access do not exist.
This is the only evidence of the missing audit. An administrator who put an audit ACE in a policy rule expects records from every object the policy covers; while the rule's SACL is broken, none arrive, and nothing else says so.
A failure in a rule's staged SACL (caap.phase is staged-sacl) is
recorded too. It changes nothing in force, and is the warning that
promoting the staged policy would install a SACL that does not work.
3.6.1 Fields #
| Field | Type | Presence | Meaning |
|---|---|---|---|
subject.token.sid | bin.sid | via subject | The user SID of the effective token the operation ran under. |
subject.token.groups | bin.sid[] | via subject | The group SIDs carried by the effective token. |
subject.token.group-attributes | uint.flags[] | via subject | Per-group attribute bitmasks, positionally parallel to subject.token.groups. |
subject.token.integrity | uint.integrity | via subject | The integrity RID of the effective token. |
subject.token.id | uint.luid | via subject | The token's own LUID, identifying this specific token rather than the logon session it belongs to. |
subject.token.auth-id | uint.luid | via subject | The LUID of the logon session the effective token belongs to. |
subject.token.type | str.enum | via subject | Whether the effective token is a primary token or an impersonation token. |
subject.token.impersonation | uint.enum | via subject | The impersonation level of the effective token. |
subject.token.uid | uint | via subject | The Linux UID this token projects onto, for correlating a Peios event with Linux-side audit data. |
emitter.process.pid | uint | via subject | The process ID the record was written from. |
emitter.process.name | str | via subject | The kernel's name for the emitting process, typically the executable's basename. |
emitter.process.executable | str.path | via subject | The path the emitting process was executed from, resolved at exec with symbolic links already followed. |
subject.pip.type | uint.enum | via subject | The Protected Isolated Process type in force for the access check. |
subject.pip.trust | uint | via subject | The PIP trust level in force for the access check. |
object.kind | str.enum | required | What sort of thing the operation acted on. |
object.file.path | str.path | when object.kind == file | The absolute path of the file the operation acted on, resolved at the enforcement point. |
object.process.pid | uint | when object.kind == process | The process ID of the process the operation acted on. |
object.process.guid | bin.guid | when object.kind == process | The durable GUID of the process the operation acted on. |
object.token.id | uint.luid | when object.kind == token | The LUID of the token the operation acted on, for token-open and token-adjust checks. |
object.token.guid | bin.guid | when object.kind == token | The durable GUID of the token the operation acted on. |
caap.policy.sid | bin.sid | required | The SID identifying a central access policy. |
caap.rule.index | uint | required | The zero-based position of a rule within the central access policy named by caap.policy.sid. |
caap.phase | str.enum | required | Which phase of a central access policy's audit evaluation a CAAP diagnostic describes. |
outcome.reason | str.enum | required | invalid-caap-sacl means the SACL would not parse; caap-sacl-evaluation-error means it parsed and evaluating it failed.Values here (open set): invalid-caap-sacl · caap-sacl-evaluation-error. |
access.requested | uint.mask | required | The access mask the caller asked for, after generic bits have been mapped to type-specific ones. |
access.granted | uint.mask | required | The effective grant of the check the rule was evaluated in. |
access.granted-staged | uint.mask | required | What a staged central access policy, not yet in force, would have granted. |
fields.attestation.userspace | bool | optional | Set on every record of the AccessCheck syscall, and on no other. There the descriptor, and with it trigger.ace, is always the caller's, as are any audit context and PIP state it passes. |
Every record also carries the header fields of the envelope, which no payload repeats.
Generated from kacs.evman by pkm/tools/gen-events-book.py. Edit the fragment, not this page.