# 3.9 kacs.descriptor.rejected

_Peios / Using Peios / Events / Access and Identity Events_

> The record that KACS read an object's stored security descriptor, found it corrupt, and refused to use it.

- **Event type:** `kacs.descriptor.rejected`
- **Defined in:** `kacs.evman`
- **Tier:** standard
- **Gating:** none — every unreadable stored descriptor is recorded
- **Cardinality:** one record per occurrence

The record that KACS read an object's stored security descriptor, found it
corrupt, and refused to use it. The object is then treated as having a
descriptor nobody can satisfy, so every access to it is denied until the
descriptor is replaced by someone allowed to write one.

**This is often the only explanation for a sudden, universal denial.** A
file that everyone could open and nobody now can, with no change to its
descriptor anyone remembers making, is usually this: the stored bytes no
longer parse, whether from disk corruption, a tool writing the extended
attribute directly, or an interrupted write.

KACS records the event once per descriptor read, when the object's
descriptor cache is filled, not on every denied access that follows. The
subject is whoever's access made KACS read the descriptor: the first to
touch the file after it was cached, not whoever corrupted it.

## 3.9.1 Fields

| Field | Type | Presence | Meaning |
|---|---|---|---|
| [`subject.token.sid`](/peios/using-peios/events/field-index/fields-subject.md#subject.token.sid) | `bin.sid` | via [`subject`](/peios/using-peios/events/groups/group-subject.md) | The user SID of the effective token the operation ran under. |
| [`subject.token.groups`](/peios/using-peios/events/field-index/fields-subject.md#subject.token.groups) | `bin.sid[]` | via [`subject`](/peios/using-peios/events/groups/group-subject.md) | The group SIDs carried by the effective token. |
| [`subject.token.group-attributes`](/peios/using-peios/events/field-index/fields-subject.md#subject.token.group-attributes) | `uint.flags[]` | via [`subject`](/peios/using-peios/events/groups/group-subject.md) | Per-group attribute bitmasks, positionally parallel to `subject.token.groups`. |
| [`subject.token.integrity`](/peios/using-peios/events/field-index/fields-subject.md#subject.token.integrity) | `uint.integrity` | via [`subject`](/peios/using-peios/events/groups/group-subject.md) | The integrity RID of the effective token. |
| [`subject.token.id`](/peios/using-peios/events/field-index/fields-subject.md#subject.token.id) | `uint.luid` | via [`subject`](/peios/using-peios/events/groups/group-subject.md) | The token's own LUID, identifying this specific token rather than the logon session it belongs to. |
| [`subject.token.auth-id`](/peios/using-peios/events/field-index/fields-subject.md#subject.token.auth-id) | `uint.luid` | via [`subject`](/peios/using-peios/events/groups/group-subject.md) | The LUID of the logon session the effective token belongs to. |
| [`subject.token.type`](/peios/using-peios/events/field-index/fields-subject.md#subject.token.type) | `str.enum` | via [`subject`](/peios/using-peios/events/groups/group-subject.md) | Whether the effective token is a primary token or an impersonation token. |
| [`subject.token.impersonation`](/peios/using-peios/events/field-index/fields-subject.md#subject.token.impersonation) | `uint.enum` | via [`subject`](/peios/using-peios/events/groups/group-subject.md) | The impersonation level of the effective token. |
| [`subject.token.uid`](/peios/using-peios/events/field-index/fields-subject.md#subject.token.uid) | `uint` | via [`subject`](/peios/using-peios/events/groups/group-subject.md) | The Linux UID this token projects onto, for correlating a Peios event with Linux-side audit data. |
| [`emitter.process.pid`](/peios/using-peios/events/field-index/fields-emitter.md#emitter.process.pid) | `uint` | via [`subject`](/peios/using-peios/events/groups/group-subject.md) | The process ID the record was written from. |
| [`emitter.process.name`](/peios/using-peios/events/field-index/fields-emitter.md#emitter.process.name) | `str` | via [`subject`](/peios/using-peios/events/groups/group-subject.md) | The kernel's name for the emitting process, typically the executable's basename. |
| [`emitter.process.executable`](/peios/using-peios/events/field-index/fields-emitter.md#emitter.process.executable) | `str.path` | via [`subject`](/peios/using-peios/events/groups/group-subject.md) | The path the emitting process was executed from, resolved at exec with symbolic links already followed. |
| [`subject.pip.type`](/peios/using-peios/events/field-index/fields-subject.md#subject.pip.type) | `uint.enum` | via [`subject`](/peios/using-peios/events/groups/group-subject.md) | The Protected Isolated Process type in force for the access check. |
| [`subject.pip.trust`](/peios/using-peios/events/field-index/fields-subject.md#subject.pip.trust) | `uint` | via [`subject`](/peios/using-peios/events/groups/group-subject.md) | The PIP trust level in force for the access check. |
| [`object.kind`](/peios/using-peios/events/field-index/fields-object.md#object.kind) | `str.enum` | required | Always `file` today: file descriptors are the only stored descriptors KACS reads this way. |
| [`object.file.path`](/peios/using-peios/events/field-index/fields-object.md#object.file.path) | `str.path` | optional | Not carried today. The descriptor is read through an anchor that has no mount, so no absolute path can be resolved at that point. |
| [`object.file.inode`](/peios/using-peios/events/field-index/fields-object.md#object.file.inode) | `uint` | required | The inode number the object presents. |
| [`object.file.device`](/peios/using-peios/events/field-index/fields-object.md#object.file.device) | `uint` | required | With `object.file.inode`, what names the file in place of a path: find it with `find <mount> -xdev -inum <inode>` on the filesystem of that device. |
| [`object.sd.length`](/peios/using-peios/events/field-index/fields-object.md#object.sd.length) | `uint.bytes` | required | The length of the stored attribute that failed: 0 when it was empty, and more than 65,535 when it was too long to be a descriptor at all. |
| [`outcome.reason`](/peios/using-peios/events/field-index/fields-outcome.md#outcome.reason) | `str.enum` | required | Why the descriptor was refused. `corrupt` is the only reason today.<br><br>Values here (open set): `corrupt`. |

Every record also carries the header fields of [the envelope](/peios/using-peios/events/introduction/the-envelope.md), which no payload repeats.

*Generated from `kacs.evman` by `pkm/tools/gen-events-book.py`. Edit the fragment, not this page.*