3.10 kacs.impersonation.reverted

3 min read

Event type: kacs.impersonation.reverted
Defined in: kacs.evman
Tier: verbose
Gating: none — every impersonation that ends is recorded
Cardinality: once per impersonation ended

The record that a thread stopped impersonating and acts as its own token again. The subject is the thread's token after the revert; the object is the impersonation token it gave up, which a kacs.impersonation.started record named.

Verbose, because it is bookkeeping. An API that impersonates per request reverts once per request too, and the start already carries the security decision.

Not every end is recorded. A thread that exits while impersonating writes nothing: its credentials are released where no record can be built. And installing a new primary token does not end an impersonation — the impersonation is put back over the new token — so it writes nothing either.

3.10.1 Fields #

Field	Type	Presence	Meaning
`subject.token.sid`	`bin.sid`	via `subject`	The user SID of the effective token the operation ran under.
`subject.token.groups`	`bin.sid[]`	via `subject`	The group SIDs carried by the effective token.
`subject.token.group-attributes`	`uint.flags[]`	via `subject`	Per-group attribute bitmasks, positionally parallel to `subject.token.groups`.
`subject.token.integrity`	`uint.integrity`	via `subject`	The integrity RID of the effective token.
`subject.token.id`	`uint.luid`	via `subject`	The token's own LUID, identifying this specific token rather than the logon session it belongs to.
`subject.token.auth-id`	`uint.luid`	via `subject`	The LUID of the logon session the effective token belongs to.
`subject.token.type`	`str.enum`	via `subject`	Whether the effective token is a primary token or an impersonation token.
`subject.token.impersonation`	`uint.enum`	via `subject`	The impersonation level of the effective token.
`subject.token.uid`	`uint`	via `subject`	The Linux UID this token projects onto, for correlating a Peios event with Linux-side audit data.
`emitter.process.pid`	`uint`	via `subject`	The process ID the record was written from.
`emitter.process.name`	`str`	via `subject`	The kernel's name for the emitting process, typically the executable's basename.
`emitter.process.executable`	`str.path`	via `subject`	The path the emitting process was executed from, resolved at exec with symbolic links already followed.
`subject.pip.type`	`uint.enum`	via `subject`	The Protected Isolated Process type in force for the access check.
`subject.pip.trust`	`uint`	via `subject`	The PIP trust level in force for the access check.
`emitter.thread.tid`	`uint`	required	The thread that wrote the record, where the operation is scoped to a thread rather than to its process.
`object.kind`	`str.enum`	required	Always `token`.
`object.token.guid`	`bin.guid`	required	The impersonation token given up.
`object.token.sid`	`bin.sid`	required	The user SID of the token the operation acted on.
`operation.name`	`str.enum`	required	`revert` is an explicit `kacs_revert`; `exec` the revert every exec performs before the new image runs; `replaced` the implicit end of one impersonation when the thread starts another. Values here (open set): `revert` · `exec` · `replaced`.
`outcome.success`	`bool`	required	Whether the operation succeeded.
`outcome.errno`	`int.errno`	when `outcome.success == false`	The error the operation failed with, as a negative errno.

Every record also carries the header fields of the envelope, which no payload repeats.

Generated from kacs.evman by pkm/tools/gen-events-book.py. Edit the fragment, not this page.

Edit this page