3.9 kacs.descriptor.rejected
- Event type:
kacs.descriptor.rejected - Defined in:
kacs.evman - Tier: standard
- Gating: none — every unreadable stored descriptor is recorded
- Cardinality: one record per occurrence
The record that KACS read an object's stored security descriptor, found it corrupt, and refused to use it. The object is then treated as having a descriptor nobody can satisfy, so every access to it is denied until the descriptor is replaced by someone allowed to write one.
This is often the only explanation for a sudden, universal denial. A file that everyone could open and nobody now can, with no change to its descriptor anyone remembers making, is usually this: the stored bytes no longer parse, whether from disk corruption, a tool writing the extended attribute directly, or an interrupted write.
KACS records the event once per descriptor read, when the object's descriptor cache is filled, not on every denied access that follows. The subject is whoever's access made KACS read the descriptor: the first to touch the file after it was cached, not whoever corrupted it.
3.9.1 Fields #
| Field | Type | Presence | Meaning |
|---|---|---|---|
subject.token.sid | bin.sid | via subject | The user SID of the effective token the operation ran under. |
subject.token.groups | bin.sid[] | via subject | The group SIDs carried by the effective token. |
subject.token.group-attributes | uint.flags[] | via subject | Per-group attribute bitmasks, positionally parallel to subject.token.groups. |
subject.token.integrity | uint.integrity | via subject | The integrity RID of the effective token. |
subject.token.id | uint.luid | via subject | The token's own LUID, identifying this specific token rather than the logon session it belongs to. |
subject.token.auth-id | uint.luid | via subject | The LUID of the logon session the effective token belongs to. |
subject.token.type | str.enum | via subject | Whether the effective token is a primary token or an impersonation token. |
subject.token.impersonation | uint.enum | via subject | The impersonation level of the effective token. |
subject.token.uid | uint | via subject | The Linux UID this token projects onto, for correlating a Peios event with Linux-side audit data. |
emitter.process.pid | uint | via subject | The process ID the record was written from. |
emitter.process.name | str | via subject | The kernel's name for the emitting process, typically the executable's basename. |
emitter.process.executable | str.path | via subject | The path the emitting process was executed from, resolved at exec with symbolic links already followed. |
subject.pip.type | uint.enum | via subject | The Protected Isolated Process type in force for the access check. |
subject.pip.trust | uint | via subject | The PIP trust level in force for the access check. |
object.kind | str.enum | required | Always file today: file descriptors are the only stored descriptors KACS reads this way. |
object.file.path | str.path | optional | Not carried today. The descriptor is read through an anchor that has no mount, so no absolute path can be resolved at that point. |
object.file.inode | uint | required | The inode number the object presents. |
object.file.device | uint | required | With object.file.inode, what names the file in place of a path: find it with find <mount> -xdev -inum <inode> on the filesystem of that device. |
object.sd.length | uint.bytes | required | The length of the stored attribute that failed: 0 when it was empty, and more than 65,535 when it was too long to be a descriptor at all. |
outcome.reason | str.enum | required | Why the descriptor was refused. corrupt is the only reason today.Values here (open set): corrupt. |
Every record also carries the header fields of the envelope, which no payload repeats.
Generated from kacs.evman by pkm/tools/gen-events-book.py. Edit the fragment, not this page.