# 3.12 kacs.mount.policy.changed

_Peios / Using Peios / Events / Access and Identity Events_

> The record that a filesystem's KACS mount policy was set: what happens to an object on it that has no stored descriptor.

- **Event type:** `kacs.mount.policy.changed`
- **Defined in:** `kacs.evman`
- **Tier:** essential
- **Gating:** none — every change a caller admitted by the volume-management gate makes is recorded
- **Cardinality:** once per change

The record that a filesystem's KACS mount policy was set: what happens to an
object on it that has no stored descriptor. `unmanaged` turns access control
off for the whole filesystem; `deny-missing` refuses such objects; the two
`synthesize` policies build a descriptor from the parent and the template
the caller supplies.

Setting a policy needs SeManageVolumePrivilege or SeTcbPrivilege. Every
other refusal comes before that check, so a record is always of a change
made.

**The record does not carry the template.** A synthesising policy's template
descriptor decides what every unlabelled object on the filesystem grants;
read it back with `kacs_get_mount_policy`.

## 3.12.1 Fields

| Field | Type | Presence | Meaning |
|---|---|---|---|
| [`subject.token.sid`](/peios/using-peios/events/field-index/fields-subject.md#subject.token.sid) | `bin.sid` | via [`subject`](/peios/using-peios/events/groups/group-subject.md) | The user SID of the effective token the operation ran under. |
| [`subject.token.groups`](/peios/using-peios/events/field-index/fields-subject.md#subject.token.groups) | `bin.sid[]` | via [`subject`](/peios/using-peios/events/groups/group-subject.md) | The group SIDs carried by the effective token. |
| [`subject.token.group-attributes`](/peios/using-peios/events/field-index/fields-subject.md#subject.token.group-attributes) | `uint.flags[]` | via [`subject`](/peios/using-peios/events/groups/group-subject.md) | Per-group attribute bitmasks, positionally parallel to `subject.token.groups`. |
| [`subject.token.integrity`](/peios/using-peios/events/field-index/fields-subject.md#subject.token.integrity) | `uint.integrity` | via [`subject`](/peios/using-peios/events/groups/group-subject.md) | The integrity RID of the effective token. |
| [`subject.token.id`](/peios/using-peios/events/field-index/fields-subject.md#subject.token.id) | `uint.luid` | via [`subject`](/peios/using-peios/events/groups/group-subject.md) | The token's own LUID, identifying this specific token rather than the logon session it belongs to. |
| [`subject.token.auth-id`](/peios/using-peios/events/field-index/fields-subject.md#subject.token.auth-id) | `uint.luid` | via [`subject`](/peios/using-peios/events/groups/group-subject.md) | The LUID of the logon session the effective token belongs to. |
| [`subject.token.type`](/peios/using-peios/events/field-index/fields-subject.md#subject.token.type) | `str.enum` | via [`subject`](/peios/using-peios/events/groups/group-subject.md) | Whether the effective token is a primary token or an impersonation token. |
| [`subject.token.impersonation`](/peios/using-peios/events/field-index/fields-subject.md#subject.token.impersonation) | `uint.enum` | via [`subject`](/peios/using-peios/events/groups/group-subject.md) | The impersonation level of the effective token. |
| [`subject.token.uid`](/peios/using-peios/events/field-index/fields-subject.md#subject.token.uid) | `uint` | via [`subject`](/peios/using-peios/events/groups/group-subject.md) | The Linux UID this token projects onto, for correlating a Peios event with Linux-side audit data. |
| [`emitter.process.pid`](/peios/using-peios/events/field-index/fields-emitter.md#emitter.process.pid) | `uint` | via [`subject`](/peios/using-peios/events/groups/group-subject.md) | The process ID the record was written from. |
| [`emitter.process.name`](/peios/using-peios/events/field-index/fields-emitter.md#emitter.process.name) | `str` | via [`subject`](/peios/using-peios/events/groups/group-subject.md) | The kernel's name for the emitting process, typically the executable's basename. |
| [`emitter.process.executable`](/peios/using-peios/events/field-index/fields-emitter.md#emitter.process.executable) | `str.path` | via [`subject`](/peios/using-peios/events/groups/group-subject.md) | The path the emitting process was executed from, resolved at exec with symbolic links already followed. |
| [`subject.pip.type`](/peios/using-peios/events/field-index/fields-subject.md#subject.pip.type) | `uint.enum` | via [`subject`](/peios/using-peios/events/groups/group-subject.md) | The Protected Isolated Process type in force for the access check. |
| [`subject.pip.trust`](/peios/using-peios/events/field-index/fields-subject.md#subject.pip.trust) | `uint` | via [`subject`](/peios/using-peios/events/groups/group-subject.md) | The PIP trust level in force for the access check. |
| [`object.mount.fs-type`](/peios/using-peios/events/field-index/fields-object.md#object.mount.fs-type) | `str` | optional | The filesystem's type, when the kernel knows it. |
| [`object.mount.policy`](/peios/using-peios/events/field-index/fields-object.md#object.mount.policy) | `str.enum` | required | The KACS mount policy in force, which decides what happens to an object with no stored descriptor. |
| [`object.mount.policy-previous`](/peios/using-peios/events/field-index/fields-object.md#object.mount.policy-previous) | `str.enum` | required | The mount policy a change replaced, beside `object.mount.policy`, the one it put in force. |
| [`object.mount.policy-generation`](/peios/using-peios/events/field-index/fields-object.md#object.mount.policy-generation) | `uint` | required | The generation the change began. Every descriptor cached under an older one is discarded on its next use. |
| [`outcome.success`](/peios/using-peios/events/field-index/fields-outcome.md#outcome.success) | `bool` | required | Always true: every refusal is decided before anything changes. |

Every record also carries the header fields of [the envelope](/peios/using-peios/events/introduction/the-envelope.md), which no payload repeats.

*Generated from `kacs.evman` by `pkm/tools/gen-events-book.py`. Edit the fragment, not this page.*