3.12 kacs.mount.policy.changed
- Event type:
kacs.mount.policy.changed - Defined in:
kacs.evman - Tier: essential
- Gating: none — every change a caller admitted by the volume-management gate makes is recorded
- Cardinality: once per change
The record that a filesystem's KACS mount policy was set: what happens to an
object on it that has no stored descriptor. unmanaged turns access control
off for the whole filesystem; deny-missing refuses such objects; the two
synthesize policies build a descriptor from the parent and the template
the caller supplies.
Setting a policy needs SeManageVolumePrivilege or SeTcbPrivilege. Every other refusal comes before that check, so a record is always of a change made.
The record does not carry the template. A synthesising policy's template
descriptor decides what every unlabelled object on the filesystem grants;
read it back with kacs_get_mount_policy.
3.12.1 Fields #
| Field | Type | Presence | Meaning |
|---|---|---|---|
subject.token.sid | bin.sid | via subject | The user SID of the effective token the operation ran under. |
subject.token.groups | bin.sid[] | via subject | The group SIDs carried by the effective token. |
subject.token.group-attributes | uint.flags[] | via subject | Per-group attribute bitmasks, positionally parallel to subject.token.groups. |
subject.token.integrity | uint.integrity | via subject | The integrity RID of the effective token. |
subject.token.id | uint.luid | via subject | The token's own LUID, identifying this specific token rather than the logon session it belongs to. |
subject.token.auth-id | uint.luid | via subject | The LUID of the logon session the effective token belongs to. |
subject.token.type | str.enum | via subject | Whether the effective token is a primary token or an impersonation token. |
subject.token.impersonation | uint.enum | via subject | The impersonation level of the effective token. |
subject.token.uid | uint | via subject | The Linux UID this token projects onto, for correlating a Peios event with Linux-side audit data. |
emitter.process.pid | uint | via subject | The process ID the record was written from. |
emitter.process.name | str | via subject | The kernel's name for the emitting process, typically the executable's basename. |
emitter.process.executable | str.path | via subject | The path the emitting process was executed from, resolved at exec with symbolic links already followed. |
subject.pip.type | uint.enum | via subject | The Protected Isolated Process type in force for the access check. |
subject.pip.trust | uint | via subject | The PIP trust level in force for the access check. |
object.mount.fs-type | str | optional | The filesystem's type, when the kernel knows it. |
object.mount.policy | str.enum | required | The KACS mount policy in force, which decides what happens to an object with no stored descriptor. |
object.mount.policy-previous | str.enum | required | The mount policy a change replaced, beside object.mount.policy, the one it put in force. |
object.mount.policy-generation | uint | required | The generation the change began. Every descriptor cached under an older one is discarded on its next use. |
outcome.success | bool | required | Always true: every refusal is decided before anything changes. |
Every record also carries the header fields of the envelope, which no payload repeats.
Generated from kacs.evman by pkm/tools/gen-events-book.py. Edit the fragment, not this page.