endpoint_security 0.1.0-universal-darwin

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (49) hide show
  1. checksums.yaml +7 -0
  2. data/.rubocop.yml +44 -0
  3. data/LICENSE.txt +21 -0
  4. data/README.md +114 -0
  5. data/Rakefile +170 -0
  6. data/codegen/ast.rb +67 -0
  7. data/codegen/emit_c.rb +68 -0
  8. data/codegen/emit_ruby.rb +128 -0
  9. data/codegen/ir.rb +193 -0
  10. data/codegen/overlay/availability.yml +158 -0
  11. data/codegen/overlay/version_map.yml +92 -0
  12. data/codegen/run.rb +80 -0
  13. data/codegen/snapshots/26.5.json +5828 -0
  14. data/examples/eslogger_clone.rb +5 -0
  15. data/examples/execblock.rb +16 -0
  16. data/examples/filemon.rb +10 -0
  17. data/examples/procmon.rb +13 -0
  18. data/ext/endpoint_security/client.c +795 -0
  19. data/ext/endpoint_security/client.h +88 -0
  20. data/ext/endpoint_security/endpoint_security.c +17 -0
  21. data/ext/endpoint_security/extconf.rb +37 -0
  22. data/ext/endpoint_security/field.c +719 -0
  23. data/ext/endpoint_security/field.h +42 -0
  24. data/ext/endpoint_security/generated/es_schema.c +1233 -0
  25. data/ext/endpoint_security/message.c +426 -0
  26. data/ext/endpoint_security/message.h +13 -0
  27. data/ext/endpoint_security/mute.c +291 -0
  28. data/ext/endpoint_security/mute.h +8 -0
  29. data/ext/endpoint_security/queue.c +124 -0
  30. data/ext/endpoint_security/queue.h +46 -0
  31. data/ext/endpoint_security/watchdog.c +243 -0
  32. data/lib/endpoint_security/availability.rb +30 -0
  33. data/lib/endpoint_security/client.rb +280 -0
  34. data/lib/endpoint_security/diagnostics.rb +26 -0
  35. data/lib/endpoint_security/doctor.rb +35 -0
  36. data/lib/endpoint_security/errors.rb +42 -0
  37. data/lib/endpoint_security/generated/availability.rb +169 -0
  38. data/lib/endpoint_security/generated/enums.rb +409 -0
  39. data/lib/endpoint_security/generated/event_types.rb +520 -0
  40. data/lib/endpoint_security/message.rb +29 -0
  41. data/lib/endpoint_security/object_model.rb +170 -0
  42. data/lib/endpoint_security/recorder.rb +26 -0
  43. data/lib/endpoint_security/version.rb +6 -0
  44. data/lib/endpoint_security.rb +38 -0
  45. data/support/entitlements.plist +8 -0
  46. data/support/esmock/esmock.c +482 -0
  47. data/support/esmock/esmock.h +21 -0
  48. data/support/sign_ruby.sh +13 -0
  49. metadata +90 -0
data/ext/endpoint_security/generated/es_schema.c ADDED
@@ -0,0 +1,1233 @@
1
+ /* es_schema.c -- generated by codegen/run.rb. Do not edit. */
2
+ #include <EndpointSecurity/EndpointSecurity.h>
3
+ #include <stddef.h>
4
+ #include "field.h"
5
+
6
+
7
+ static const esrb_field_t fields_es_token_t[] = {
8
+ {"size", "unsigned long", offsetof(es_token_t, size), 1},
9
+ {"data", "const uint8_t *", offsetof(es_token_t, data), 1}
10
+ };
11
+
12
+ static const esrb_field_t fields_es_string_token_t[] = {
13
+ {"length", "unsigned long", offsetof(es_string_token_t, length), 1},
14
+ {"data", "const char *", offsetof(es_string_token_t, data), 1}
15
+ };
16
+
17
+ static const esrb_field_t fields_es_muted_path_t[] = {
18
+ {"type", "es_mute_path_type_t", offsetof(es_muted_path_t, type), 1},
19
+ {"event_count", "unsigned long", offsetof(es_muted_path_t, event_count), 1},
20
+ {"events", "const es_event_type_t *", offsetof(es_muted_path_t, events), 1},
21
+ {"path", "es_string_token_t", offsetof(es_muted_path_t, path), 1}
22
+ };
23
+
24
+ static const esrb_field_t fields_es_muted_paths_t[] = {
25
+ {"count", "unsigned long", offsetof(es_muted_paths_t, count), 1},
26
+ {"paths", "const es_muted_path_t *", offsetof(es_muted_paths_t, paths), 1}
27
+ };
28
+
29
+ static const esrb_field_t fields_es_muted_process_t[] = {
30
+ {"audit_token", "audit_token_t", offsetof(es_muted_process_t, audit_token), 1},
31
+ {"event_count", "unsigned long", offsetof(es_muted_process_t, event_count), 1},
32
+ {"events", "const es_event_type_t *", offsetof(es_muted_process_t, events), 1}
33
+ };
34
+
35
+ static const esrb_field_t fields_es_muted_processes_t[] = {
36
+ {"count", "unsigned long", offsetof(es_muted_processes_t, count), 1},
37
+ {"processes", "const es_muted_process_t *", offsetof(es_muted_processes_t, processes), 1}
38
+ };
39
+
40
+ static const esrb_field_t fields_es_signed_file_info_t[] = {
41
+ {"cdhash", "uint8_t[20]", offsetof(es_signed_file_info_t, cdhash), 1},
42
+ {"signing_id", "es_string_token_t", offsetof(es_signed_file_info_t, signing_id), 1},
43
+ {"team_id", "es_string_token_t", offsetof(es_signed_file_info_t, team_id), 1}
44
+ };
45
+
46
+ static const esrb_field_t fields_es_file_t[] = {
47
+ {"path", "es_string_token_t", offsetof(es_file_t, path), 1},
48
+ {"path_truncated", "bool", offsetof(es_file_t, path_truncated), 1},
49
+ {"stat", "struct stat", offsetof(es_file_t, stat), 1}
50
+ };
51
+
52
+ static const esrb_field_t fields_es_process_t[] = {
53
+ {"audit_token", "audit_token_t", offsetof(es_process_t, audit_token), 1},
54
+ {"ppid", "int", offsetof(es_process_t, ppid), 1},
55
+ {"original_ppid", "int", offsetof(es_process_t, original_ppid), 1},
56
+ {"group_id", "int", offsetof(es_process_t, group_id), 1},
57
+ {"session_id", "int", offsetof(es_process_t, session_id), 1},
58
+ {"codesigning_flags", "unsigned int", offsetof(es_process_t, codesigning_flags), 1},
59
+ {"is_platform_binary", "bool", offsetof(es_process_t, is_platform_binary), 1},
60
+ {"is_es_client", "bool", offsetof(es_process_t, is_es_client), 1},
61
+ {"cdhash", "uint8_t[20]", offsetof(es_process_t, cdhash), 1},
62
+ {"signing_id", "es_string_token_t", offsetof(es_process_t, signing_id), 1},
63
+ {"team_id", "es_string_token_t", offsetof(es_process_t, team_id), 1},
64
+ {"executable", "es_file_t *", offsetof(es_process_t, executable), 1},
65
+ {"tty", "es_file_t *", offsetof(es_process_t, tty), 2},
66
+ {"start_time", "struct timeval", offsetof(es_process_t, start_time), 3},
67
+ {"responsible_audit_token", "audit_token_t", offsetof(es_process_t, responsible_audit_token), 4},
68
+ {"parent_audit_token", "audit_token_t", offsetof(es_process_t, parent_audit_token), 4},
69
+ {"cs_validation_category", "es_cs_validation_category_t", offsetof(es_process_t, cs_validation_category), 10}
70
+ };
71
+
72
+ static const esrb_field_t fields_es_thread_t[] = {
73
+ {"thread_id", "unsigned long long", offsetof(es_thread_t, thread_id), 1}
74
+ };
75
+
76
+ static const esrb_field_t fields_es_thread_state_t[] = {
77
+ {"flavor", "int", offsetof(es_thread_state_t, flavor), 1},
78
+ {"state", "es_token_t", offsetof(es_thread_state_t, state), 1}
79
+ };
80
+
81
+ static const esrb_field_t fields_es_fd_t[] = {
82
+ {"fd", "int", offsetof(es_fd_t, fd), 1},
83
+ {"fdtype", "unsigned int", offsetof(es_fd_t, fdtype), 1},
84
+ {"pipe", "struct es_fd_t::(anonymous)", offsetof(es_fd_t, pipe), 1}
85
+ };
86
+
87
+ static const esrb_field_t fields_es_btm_launch_item_t[] = {
88
+ {"item_type", "es_btm_item_type_t", offsetof(es_btm_launch_item_t, item_type), 1},
89
+ {"legacy", "bool", offsetof(es_btm_launch_item_t, legacy), 1},
90
+ {"managed", "bool", offsetof(es_btm_launch_item_t, managed), 1},
91
+ {"uid", "unsigned int", offsetof(es_btm_launch_item_t, uid), 1},
92
+ {"item_url", "es_string_token_t", offsetof(es_btm_launch_item_t, item_url), 1},
93
+ {"app_url", "es_string_token_t", offsetof(es_btm_launch_item_t, app_url), 1}
94
+ };
95
+
96
+ static const esrb_field_t fields_es_profile_t[] = {
97
+ {"identifier", "es_string_token_t", offsetof(es_profile_t, identifier), 1},
98
+ {"uuid", "es_string_token_t", offsetof(es_profile_t, uuid), 1},
99
+ {"install_source", "es_profile_source_t", offsetof(es_profile_t, install_source), 1},
100
+ {"organization", "es_string_token_t", offsetof(es_profile_t, organization), 1},
101
+ {"display_name", "es_string_token_t", offsetof(es_profile_t, display_name), 1},
102
+ {"scope", "es_string_token_t", offsetof(es_profile_t, scope), 1}
103
+ };
104
+
105
+ static const esrb_field_t fields_es_event_exec_t[] = {
106
+ {"target", "es_process_t *", offsetof(es_event_exec_t, target), 1},
107
+ {"dyld_exec_path", "es_string_token_t", offsetof(es_event_exec_t, dyld_exec_path), 7},
108
+ {"script", "es_file_t *", offsetof(es_event_exec_t, script), 2},
109
+ {"cwd", "es_file_t *", offsetof(es_event_exec_t, cwd), 3},
110
+ {"last_fd", "int", offsetof(es_event_exec_t, last_fd), 4},
111
+ {"image_cputype", "int", offsetof(es_event_exec_t, image_cputype), 6},
112
+ {"image_cpusubtype", "int", offsetof(es_event_exec_t, image_cpusubtype), 6}
113
+ };
114
+
115
+ static const esrb_field_t fields_es_event_tcc_modify_t[] = {
116
+ {"service", "es_string_token_t", offsetof(es_event_tcc_modify_t, service), 1},
117
+ {"identity", "es_string_token_t", offsetof(es_event_tcc_modify_t, identity), 1},
118
+ {"identity_type", "es_tcc_identity_type_t", offsetof(es_event_tcc_modify_t, identity_type), 1},
119
+ {"update_type", "es_tcc_event_type_t", offsetof(es_event_tcc_modify_t, update_type), 1},
120
+ {"instigator_token", "audit_token_t", offsetof(es_event_tcc_modify_t, instigator_token), 1},
121
+ {"instigator", "es_process_t *", offsetof(es_event_tcc_modify_t, instigator), 1},
122
+ {"responsible_token", "audit_token_t *", offsetof(es_event_tcc_modify_t, responsible_token), 1},
123
+ {"responsible", "es_process_t *", offsetof(es_event_tcc_modify_t, responsible), 1},
124
+ {"right", "es_tcc_authorization_right_t", offsetof(es_event_tcc_modify_t, right), 1},
125
+ {"reason", "es_tcc_authorization_reason_t", offsetof(es_event_tcc_modify_t, reason), 1}
126
+ };
127
+
128
+ static const esrb_field_t fields_es_event_open_t[] = {
129
+ {"fflag", "int", offsetof(es_event_open_t, fflag), 1},
130
+ {"file", "es_file_t *", offsetof(es_event_open_t, file), 1}
131
+ };
132
+
133
+ static const esrb_field_t fields_es_event_kextload_t[] = {
134
+ {"identifier", "es_string_token_t", offsetof(es_event_kextload_t, identifier), 1}
135
+ };
136
+
137
+ static const esrb_field_t fields_es_event_kextunload_t[] = {
138
+ {"identifier", "es_string_token_t", offsetof(es_event_kextunload_t, identifier), 1}
139
+ };
140
+
141
+ static const esrb_field_t fields_es_event_unlink_t[] = {
142
+ {"target", "es_file_t *", offsetof(es_event_unlink_t, target), 1},
143
+ {"parent_dir", "es_file_t *", offsetof(es_event_unlink_t, parent_dir), 1}
144
+ };
145
+
146
+ static const esrb_field_t fields_es_event_mmap_t[] = {
147
+ {"protection", "int", offsetof(es_event_mmap_t, protection), 1},
148
+ {"max_protection", "int", offsetof(es_event_mmap_t, max_protection), 1},
149
+ {"flags", "int", offsetof(es_event_mmap_t, flags), 1},
150
+ {"file_pos", "unsigned long long", offsetof(es_event_mmap_t, file_pos), 1},
151
+ {"source", "es_file_t *", offsetof(es_event_mmap_t, source), 1}
152
+ };
153
+
154
+ static const esrb_field_t fields_es_event_link_t[] = {
155
+ {"source", "es_file_t *", offsetof(es_event_link_t, source), 1},
156
+ {"target_dir", "es_file_t *", offsetof(es_event_link_t, target_dir), 1},
157
+ {"target_filename", "es_string_token_t", offsetof(es_event_link_t, target_filename), 1}
158
+ };
159
+
160
+ static const esrb_field_t fields_es_event_mount_t[] = {
161
+ {"statfs", "struct statfs *", offsetof(es_event_mount_t, statfs), 1},
162
+ {"disposition", "es_mount_disposition_t", offsetof(es_event_mount_t, disposition), 8}
163
+ };
164
+
165
+ static const esrb_field_t fields_es_event_unmount_t[] = {
166
+ {"statfs", "struct statfs *", offsetof(es_event_unmount_t, statfs), 1}
167
+ };
168
+
169
+ static const esrb_field_t fields_es_event_remount_t[] = {
170
+ {"statfs", "struct statfs *", offsetof(es_event_remount_t, statfs), 1},
171
+ {"remount_flags", "unsigned long long", offsetof(es_event_remount_t, remount_flags), 8},
172
+ {"disposition", "es_mount_disposition_t", offsetof(es_event_remount_t, disposition), 8}
173
+ };
174
+
175
+ static const esrb_field_t fields_es_event_fork_t[] = {
176
+ {"child", "es_process_t *", offsetof(es_event_fork_t, child), 1}
177
+ };
178
+
179
+ static const esrb_field_t fields_es_event_mprotect_t[] = {
180
+ {"protection", "int", offsetof(es_event_mprotect_t, protection), 1},
181
+ {"address", "unsigned long long", offsetof(es_event_mprotect_t, address), 1},
182
+ {"size", "unsigned long long", offsetof(es_event_mprotect_t, size), 1}
183
+ };
184
+
185
+ static const esrb_field_t fields_es_event_signal_t[] = {
186
+ {"sig", "int", offsetof(es_event_signal_t, sig), 1},
187
+ {"target", "es_process_t *", offsetof(es_event_signal_t, target), 1},
188
+ {"instigator", "es_process_t *", offsetof(es_event_signal_t, instigator), 9}
189
+ };
190
+
191
+ static const esrb_field_t fields_es_event_rename_t[] = {
192
+ {"source", "es_file_t *", offsetof(es_event_rename_t, source), 1},
193
+ {"destination_type", "es_destination_type_t", offsetof(es_event_rename_t, destination_type), 1},
194
+ {"destination", "union es_event_rename_t::(anonymous)", offsetof(es_event_rename_t, destination), 1}
195
+ };
196
+
197
+ static const esrb_field_t fields_es_event_setextattr_t[] = {
198
+ {"target", "es_file_t *", offsetof(es_event_setextattr_t, target), 1},
199
+ {"extattr", "es_string_token_t", offsetof(es_event_setextattr_t, extattr), 1}
200
+ };
201
+
202
+ static const esrb_field_t fields_es_event_getextattr_t[] = {
203
+ {"target", "es_file_t *", offsetof(es_event_getextattr_t, target), 1},
204
+ {"extattr", "es_string_token_t", offsetof(es_event_getextattr_t, extattr), 1}
205
+ };
206
+
207
+ static const esrb_field_t fields_es_event_deleteextattr_t[] = {
208
+ {"target", "es_file_t *", offsetof(es_event_deleteextattr_t, target), 1},
209
+ {"extattr", "es_string_token_t", offsetof(es_event_deleteextattr_t, extattr), 1}
210
+ };
211
+
212
+ static const esrb_field_t fields_es_event_setmode_t[] = {
213
+ {"mode", "unsigned short", offsetof(es_event_setmode_t, mode), 1},
214
+ {"target", "es_file_t *", offsetof(es_event_setmode_t, target), 1}
215
+ };
216
+
217
+ static const esrb_field_t fields_es_event_setflags_t[] = {
218
+ {"flags", "unsigned int", offsetof(es_event_setflags_t, flags), 1},
219
+ {"target", "es_file_t *", offsetof(es_event_setflags_t, target), 1}
220
+ };
221
+
222
+ static const esrb_field_t fields_es_event_setowner_t[] = {
223
+ {"uid", "unsigned int", offsetof(es_event_setowner_t, uid), 1},
224
+ {"gid", "unsigned int", offsetof(es_event_setowner_t, gid), 1},
225
+ {"target", "es_file_t *", offsetof(es_event_setowner_t, target), 1}
226
+ };
227
+
228
+ static const esrb_field_t fields_es_event_close_t[] = {
229
+ {"modified", "bool", offsetof(es_event_close_t, modified), 1},
230
+ {"target", "es_file_t *", offsetof(es_event_close_t, target), 1},
231
+ {"was_mapped_writable", "bool", offsetof(es_event_close_t, was_mapped_writable), 6}
232
+ };
233
+
234
+ static const esrb_field_t fields_es_event_create_t[] = {
235
+ {"destination_type", "es_destination_type_t", offsetof(es_event_create_t, destination_type), 1},
236
+ {"destination", "union es_event_create_t::(anonymous)", offsetof(es_event_create_t, destination), 1},
237
+ {"acl", "struct _acl *", offsetof(es_event_create_t, acl), 2}
238
+ };
239
+
240
+ static const esrb_field_t fields_es_event_exit_t[] = {
241
+ {"stat", "int", offsetof(es_event_exit_t, stat), 1}
242
+ };
243
+
244
+ static const esrb_field_t fields_es_event_exchangedata_t[] = {
245
+ {"file1", "es_file_t *", offsetof(es_event_exchangedata_t, file1), 1},
246
+ {"file2", "es_file_t *", offsetof(es_event_exchangedata_t, file2), 1}
247
+ };
248
+
249
+ static const esrb_field_t fields_es_event_write_t[] = {
250
+ {"target", "es_file_t *", offsetof(es_event_write_t, target), 1}
251
+ };
252
+
253
+ static const esrb_field_t fields_es_event_truncate_t[] = {
254
+ {"target", "es_file_t *", offsetof(es_event_truncate_t, target), 1}
255
+ };
256
+
257
+ static const esrb_field_t fields_es_event_chdir_t[] = {
258
+ {"target", "es_file_t *", offsetof(es_event_chdir_t, target), 1}
259
+ };
260
+
261
+ static const esrb_field_t fields_es_event_stat_t[] = {
262
+ {"target", "es_file_t *", offsetof(es_event_stat_t, target), 1}
263
+ };
264
+
265
+ static const esrb_field_t fields_es_event_chroot_t[] = {
266
+ {"target", "es_file_t *", offsetof(es_event_chroot_t, target), 1}
267
+ };
268
+
269
+ static const esrb_field_t fields_es_event_listextattr_t[] = {
270
+ {"target", "es_file_t *", offsetof(es_event_listextattr_t, target), 1}
271
+ };
272
+
273
+ static const esrb_field_t fields_es_event_iokit_open_t[] = {
274
+ {"user_client_type", "unsigned int", offsetof(es_event_iokit_open_t, user_client_type), 1},
275
+ {"user_client_class", "es_string_token_t", offsetof(es_event_iokit_open_t, user_client_class), 1},
276
+ {"parent_registry_id", "unsigned long long", offsetof(es_event_iokit_open_t, parent_registry_id), 10},
277
+ {"parent_path", "es_string_token_t", offsetof(es_event_iokit_open_t, parent_path), 10}
278
+ };
279
+
280
+ static const esrb_field_t fields_es_event_get_task_t[] = {
281
+ {"target", "es_process_t *", offsetof(es_event_get_task_t, target), 1},
282
+ {"type", "es_get_task_type_t", offsetof(es_event_get_task_t, type), 5}
283
+ };
284
+
285
+ static const esrb_field_t fields_es_event_get_task_read_t[] = {
286
+ {"target", "es_process_t *", offsetof(es_event_get_task_read_t, target), 1},
287
+ {"type", "es_get_task_type_t", offsetof(es_event_get_task_read_t, type), 5}
288
+ };
289
+
290
+ static const esrb_field_t fields_es_event_get_task_inspect_t[] = {
291
+ {"target", "es_process_t *", offsetof(es_event_get_task_inspect_t, target), 1},
292
+ {"type", "es_get_task_type_t", offsetof(es_event_get_task_inspect_t, type), 5}
293
+ };
294
+
295
+ static const esrb_field_t fields_es_event_get_task_name_t[] = {
296
+ {"target", "es_process_t *", offsetof(es_event_get_task_name_t, target), 1},
297
+ {"type", "es_get_task_type_t", offsetof(es_event_get_task_name_t, type), 5}
298
+ };
299
+
300
+ static const esrb_field_t fields_es_event_getattrlist_t[] = {
301
+ {"attrlist", "struct attrlist", offsetof(es_event_getattrlist_t, attrlist), 1},
302
+ {"target", "es_file_t *", offsetof(es_event_getattrlist_t, target), 1}
303
+ };
304
+
305
+ static const esrb_field_t fields_es_event_setattrlist_t[] = {
306
+ {"attrlist", "struct attrlist", offsetof(es_event_setattrlist_t, attrlist), 1},
307
+ {"target", "es_file_t *", offsetof(es_event_setattrlist_t, target), 1}
308
+ };
309
+
310
+ static const esrb_field_t fields_es_event_file_provider_update_t[] = {
311
+ {"source", "es_file_t *", offsetof(es_event_file_provider_update_t, source), 1},
312
+ {"target_path", "es_string_token_t", offsetof(es_event_file_provider_update_t, target_path), 1}
313
+ };
314
+
315
+ static const esrb_field_t fields_es_event_file_provider_materialize_t[] = {
316
+ {"instigator", "es_process_t *", offsetof(es_event_file_provider_materialize_t, instigator), 1},
317
+ {"source", "es_file_t *", offsetof(es_event_file_provider_materialize_t, source), 1},
318
+ {"target", "es_file_t *", offsetof(es_event_file_provider_materialize_t, target), 1},
319
+ {"instigator_token", "audit_token_t", offsetof(es_event_file_provider_materialize_t, instigator_token), 8}
320
+ };
321
+
322
+ static const esrb_field_t fields_es_event_readlink_t[] = {
323
+ {"source", "es_file_t *", offsetof(es_event_readlink_t, source), 1}
324
+ };
325
+
326
+ static const esrb_field_t fields_es_event_lookup_t[] = {
327
+ {"source_dir", "es_file_t *", offsetof(es_event_lookup_t, source_dir), 1},
328
+ {"relative_target", "es_string_token_t", offsetof(es_event_lookup_t, relative_target), 1}
329
+ };
330
+
331
+ static const esrb_field_t fields_es_event_access_t[] = {
332
+ {"mode", "int", offsetof(es_event_access_t, mode), 1},
333
+ {"target", "es_file_t *", offsetof(es_event_access_t, target), 1}
334
+ };
335
+
336
+ static const esrb_field_t fields_es_event_utimes_t[] = {
337
+ {"target", "es_file_t *", offsetof(es_event_utimes_t, target), 1},
338
+ {"atime", "struct timespec", offsetof(es_event_utimes_t, atime), 1},
339
+ {"mtime", "struct timespec", offsetof(es_event_utimes_t, mtime), 1}
340
+ };
341
+
342
+ static const esrb_field_t fields_es_event_clone_t[] = {
343
+ {"source", "es_file_t *", offsetof(es_event_clone_t, source), 1},
344
+ {"target_dir", "es_file_t *", offsetof(es_event_clone_t, target_dir), 1},
345
+ {"target_name", "es_string_token_t", offsetof(es_event_clone_t, target_name), 1}
346
+ };
347
+
348
+ static const esrb_field_t fields_es_event_copyfile_t[] = {
349
+ {"source", "es_file_t *", offsetof(es_event_copyfile_t, source), 1},
350
+ {"target_file", "es_file_t *", offsetof(es_event_copyfile_t, target_file), 1},
351
+ {"target_dir", "es_file_t *", offsetof(es_event_copyfile_t, target_dir), 1},
352
+ {"target_name", "es_string_token_t", offsetof(es_event_copyfile_t, target_name), 1},
353
+ {"mode", "unsigned short", offsetof(es_event_copyfile_t, mode), 1},
354
+ {"flags", "int", offsetof(es_event_copyfile_t, flags), 1}
355
+ };
356
+
357
+ static const esrb_field_t fields_es_event_fcntl_t[] = {
358
+ {"target", "es_file_t *", offsetof(es_event_fcntl_t, target), 1},
359
+ {"cmd", "int", offsetof(es_event_fcntl_t, cmd), 1}
360
+ };
361
+
362
+ static const esrb_field_t fields_es_event_readdir_t[] = {
363
+ {"target", "es_file_t *", offsetof(es_event_readdir_t, target), 1}
364
+ };
365
+
366
+ static const esrb_field_t fields_es_event_fsgetpath_t[] = {
367
+ {"target", "es_file_t *", offsetof(es_event_fsgetpath_t, target), 1}
368
+ };
369
+
370
+
371
+ static const esrb_field_t fields_es_event_dup_t[] = {
372
+ {"target", "es_file_t *", offsetof(es_event_dup_t, target), 1}
373
+ };
374
+
375
+ static const esrb_field_t fields_es_event_uipc_bind_t[] = {
376
+ {"dir", "es_file_t *", offsetof(es_event_uipc_bind_t, dir), 1},
377
+ {"filename", "es_string_token_t", offsetof(es_event_uipc_bind_t, filename), 1},
378
+ {"mode", "unsigned short", offsetof(es_event_uipc_bind_t, mode), 1}
379
+ };
380
+
381
+ static const esrb_field_t fields_es_event_uipc_connect_t[] = {
382
+ {"file", "es_file_t *", offsetof(es_event_uipc_connect_t, file), 1},
383
+ {"domain", "int", offsetof(es_event_uipc_connect_t, domain), 1},
384
+ {"type", "int", offsetof(es_event_uipc_connect_t, type), 1},
385
+ {"protocol", "int", offsetof(es_event_uipc_connect_t, protocol), 1}
386
+ };
387
+
388
+ static const esrb_field_t fields_es_event_setacl_t[] = {
389
+ {"target", "es_file_t *", offsetof(es_event_setacl_t, target), 1},
390
+ {"set_or_clear", "es_set_or_clear_t", offsetof(es_event_setacl_t, set_or_clear), 1},
391
+ {"acl", "union es_event_setacl_t::(anonymous)", offsetof(es_event_setacl_t, acl), 1}
392
+ };
393
+
394
+ static const esrb_field_t fields_es_event_pty_grant_t[] = {
395
+ {"dev", "int", offsetof(es_event_pty_grant_t, dev), 1}
396
+ };
397
+
398
+ static const esrb_field_t fields_es_event_pty_close_t[] = {
399
+ {"dev", "int", offsetof(es_event_pty_close_t, dev), 1}
400
+ };
401
+
402
+ static const esrb_field_t fields_es_event_proc_check_t[] = {
403
+ {"target", "es_process_t *", offsetof(es_event_proc_check_t, target), 1},
404
+ {"type", "es_proc_check_type_t", offsetof(es_event_proc_check_t, type), 1},
405
+ {"flavor", "int", offsetof(es_event_proc_check_t, flavor), 1}
406
+ };
407
+
408
+ static const esrb_field_t fields_es_event_searchfs_t[] = {
409
+ {"attrlist", "struct attrlist", offsetof(es_event_searchfs_t, attrlist), 1},
410
+ {"target", "es_file_t *", offsetof(es_event_searchfs_t, target), 1}
411
+ };
412
+
413
+ static const esrb_field_t fields_es_event_proc_suspend_resume_t[] = {
414
+ {"target", "es_process_t *", offsetof(es_event_proc_suspend_resume_t, target), 1},
415
+ {"type", "es_proc_suspend_resume_type_t", offsetof(es_event_proc_suspend_resume_t, type), 1}
416
+ };
417
+
418
+
419
+ static const esrb_field_t fields_es_event_trace_t[] = {
420
+ {"target", "es_process_t *", offsetof(es_event_trace_t, target), 1}
421
+ };
422
+
423
+ static const esrb_field_t fields_es_event_remote_thread_create_t[] = {
424
+ {"target", "es_process_t *", offsetof(es_event_remote_thread_create_t, target), 1},
425
+ {"thread_state", "es_thread_state_t *", offsetof(es_event_remote_thread_create_t, thread_state), 1}
426
+ };
427
+
428
+ static const esrb_field_t fields_es_event_setuid_t[] = {
429
+ {"uid", "unsigned int", offsetof(es_event_setuid_t, uid), 1}
430
+ };
431
+
432
+ static const esrb_field_t fields_es_event_setgid_t[] = {
433
+ {"gid", "unsigned int", offsetof(es_event_setgid_t, gid), 1}
434
+ };
435
+
436
+ static const esrb_field_t fields_es_event_seteuid_t[] = {
437
+ {"euid", "unsigned int", offsetof(es_event_seteuid_t, euid), 1}
438
+ };
439
+
440
+ static const esrb_field_t fields_es_event_setegid_t[] = {
441
+ {"egid", "unsigned int", offsetof(es_event_setegid_t, egid), 1}
442
+ };
443
+
444
+ static const esrb_field_t fields_es_event_setreuid_t[] = {
445
+ {"ruid", "unsigned int", offsetof(es_event_setreuid_t, ruid), 1},
446
+ {"euid", "unsigned int", offsetof(es_event_setreuid_t, euid), 1}
447
+ };
448
+
449
+ static const esrb_field_t fields_es_event_setregid_t[] = {
450
+ {"rgid", "unsigned int", offsetof(es_event_setregid_t, rgid), 1},
451
+ {"egid", "unsigned int", offsetof(es_event_setregid_t, egid), 1}
452
+ };
453
+
454
+ static const esrb_field_t fields_es_event_authentication_od_t[] = {
455
+ {"instigator", "es_process_t *", offsetof(es_event_authentication_od_t, instigator), 1},
456
+ {"record_type", "es_string_token_t", offsetof(es_event_authentication_od_t, record_type), 1},
457
+ {"record_name", "es_string_token_t", offsetof(es_event_authentication_od_t, record_name), 1},
458
+ {"node_name", "es_string_token_t", offsetof(es_event_authentication_od_t, node_name), 1},
459
+ {"db_path", "es_string_token_t", offsetof(es_event_authentication_od_t, db_path), 1},
460
+ {"instigator_token", "audit_token_t", offsetof(es_event_authentication_od_t, instigator_token), 8}
461
+ };
462
+
463
+ static const esrb_field_t fields_es_event_authentication_touchid_t[] = {
464
+ {"instigator", "es_process_t *", offsetof(es_event_authentication_touchid_t, instigator), 1},
465
+ {"touchid_mode", "es_touchid_mode_t", offsetof(es_event_authentication_touchid_t, touchid_mode), 1},
466
+ {"has_uid", "bool", offsetof(es_event_authentication_touchid_t, has_uid), 1},
467
+ {"uid", "union es_event_authentication_touchid_t::(anonymous)", offsetof(es_event_authentication_touchid_t, uid), 1},
468
+ {"instigator_token", "audit_token_t", offsetof(es_event_authentication_touchid_t, instigator_token), 8}
469
+ };
470
+
471
+ static const esrb_field_t fields_es_event_authentication_token_t[] = {
472
+ {"instigator", "es_process_t *", offsetof(es_event_authentication_token_t, instigator), 1},
473
+ {"pubkey_hash", "es_string_token_t", offsetof(es_event_authentication_token_t, pubkey_hash), 1},
474
+ {"token_id", "es_string_token_t", offsetof(es_event_authentication_token_t, token_id), 1},
475
+ {"kerberos_principal", "es_string_token_t", offsetof(es_event_authentication_token_t, kerberos_principal), 1},
476
+ {"instigator_token", "audit_token_t", offsetof(es_event_authentication_token_t, instigator_token), 8}
477
+ };
478
+
479
+ static const esrb_field_t fields_es_event_authentication_auto_unlock_t[] = {
480
+ {"username", "es_string_token_t", offsetof(es_event_authentication_auto_unlock_t, username), 1},
481
+ {"type", "es_auto_unlock_type_t", offsetof(es_event_authentication_auto_unlock_t, type), 1}
482
+ };
483
+
484
+ static const esrb_field_t fields_es_event_authentication_t[] = {
485
+ {"success", "bool", offsetof(es_event_authentication_t, success), 1},
486
+ {"type", "es_authentication_type_t", offsetof(es_event_authentication_t, type), 1},
487
+ {"data", "union es_event_authentication_t::(anonymous)", offsetof(es_event_authentication_t, data), 1}
488
+ };
489
+
490
+ static const esrb_field_t fields_es_event_xp_malware_detected_t[] = {
491
+ {"signature_version", "es_string_token_t", offsetof(es_event_xp_malware_detected_t, signature_version), 1},
492
+ {"malware_identifier", "es_string_token_t", offsetof(es_event_xp_malware_detected_t, malware_identifier), 1},
493
+ {"incident_identifier", "es_string_token_t", offsetof(es_event_xp_malware_detected_t, incident_identifier), 1},
494
+ {"detected_path", "es_string_token_t", offsetof(es_event_xp_malware_detected_t, detected_path), 1},
495
+ {"detected_executable", "es_string_token_t", offsetof(es_event_xp_malware_detected_t, detected_executable), 10}
496
+ };
497
+
498
+ static const esrb_field_t fields_es_event_xp_malware_remediated_t[] = {
499
+ {"signature_version", "es_string_token_t", offsetof(es_event_xp_malware_remediated_t, signature_version), 1},
500
+ {"malware_identifier", "es_string_token_t", offsetof(es_event_xp_malware_remediated_t, malware_identifier), 1},
501
+ {"incident_identifier", "es_string_token_t", offsetof(es_event_xp_malware_remediated_t, incident_identifier), 1},
502
+ {"action_type", "es_string_token_t", offsetof(es_event_xp_malware_remediated_t, action_type), 1},
503
+ {"success", "bool", offsetof(es_event_xp_malware_remediated_t, success), 1},
504
+ {"result_description", "es_string_token_t", offsetof(es_event_xp_malware_remediated_t, result_description), 1},
505
+ {"remediated_path", "es_string_token_t", offsetof(es_event_xp_malware_remediated_t, remediated_path), 1},
506
+ {"remediated_process_audit_token", "audit_token_t *", offsetof(es_event_xp_malware_remediated_t, remediated_process_audit_token), 1}
507
+ };
508
+
509
+ static const esrb_field_t fields_es_event_lw_session_login_t[] = {
510
+ {"username", "es_string_token_t", offsetof(es_event_lw_session_login_t, username), 1},
511
+ {"graphical_session_id", "unsigned int", offsetof(es_event_lw_session_login_t, graphical_session_id), 1}
512
+ };
513
+
514
+ static const esrb_field_t fields_es_event_lw_session_logout_t[] = {
515
+ {"username", "es_string_token_t", offsetof(es_event_lw_session_logout_t, username), 1},
516
+ {"graphical_session_id", "unsigned int", offsetof(es_event_lw_session_logout_t, graphical_session_id), 1}
517
+ };
518
+
519
+ static const esrb_field_t fields_es_event_lw_session_lock_t[] = {
520
+ {"username", "es_string_token_t", offsetof(es_event_lw_session_lock_t, username), 1},
521
+ {"graphical_session_id", "unsigned int", offsetof(es_event_lw_session_lock_t, graphical_session_id), 1}
522
+ };
523
+
524
+ static const esrb_field_t fields_es_event_lw_session_unlock_t[] = {
525
+ {"username", "es_string_token_t", offsetof(es_event_lw_session_unlock_t, username), 1},
526
+ {"graphical_session_id", "unsigned int", offsetof(es_event_lw_session_unlock_t, graphical_session_id), 1}
527
+ };
528
+
529
+ static const esrb_field_t fields_es_event_screensharing_attach_t[] = {
530
+ {"success", "bool", offsetof(es_event_screensharing_attach_t, success), 1},
531
+ {"source_address_type", "es_address_type_t", offsetof(es_event_screensharing_attach_t, source_address_type), 1},
532
+ {"source_address", "es_string_token_t", offsetof(es_event_screensharing_attach_t, source_address), 1},
533
+ {"viewer_appleid", "es_string_token_t", offsetof(es_event_screensharing_attach_t, viewer_appleid), 1},
534
+ {"authentication_type", "es_string_token_t", offsetof(es_event_screensharing_attach_t, authentication_type), 1},
535
+ {"authentication_username", "es_string_token_t", offsetof(es_event_screensharing_attach_t, authentication_username), 1},
536
+ {"session_username", "es_string_token_t", offsetof(es_event_screensharing_attach_t, session_username), 1},
537
+ {"existing_session", "bool", offsetof(es_event_screensharing_attach_t, existing_session), 1},
538
+ {"graphical_session_id", "unsigned int", offsetof(es_event_screensharing_attach_t, graphical_session_id), 1}
539
+ };
540
+
541
+ static const esrb_field_t fields_es_event_screensharing_detach_t[] = {
542
+ {"source_address_type", "es_address_type_t", offsetof(es_event_screensharing_detach_t, source_address_type), 1},
543
+ {"source_address", "es_string_token_t", offsetof(es_event_screensharing_detach_t, source_address), 1},
544
+ {"viewer_appleid", "es_string_token_t", offsetof(es_event_screensharing_detach_t, viewer_appleid), 1},
545
+ {"graphical_session_id", "unsigned int", offsetof(es_event_screensharing_detach_t, graphical_session_id), 1}
546
+ };
547
+
548
+ static const esrb_field_t fields_es_event_openssh_login_t[] = {
549
+ {"success", "bool", offsetof(es_event_openssh_login_t, success), 1},
550
+ {"result_type", "es_openssh_login_result_type_t", offsetof(es_event_openssh_login_t, result_type), 1},
551
+ {"source_address_type", "es_address_type_t", offsetof(es_event_openssh_login_t, source_address_type), 1},
552
+ {"source_address", "es_string_token_t", offsetof(es_event_openssh_login_t, source_address), 1},
553
+ {"username", "es_string_token_t", offsetof(es_event_openssh_login_t, username), 1},
554
+ {"has_uid", "bool", offsetof(es_event_openssh_login_t, has_uid), 1},
555
+ {"uid", "union es_event_openssh_login_t::(anonymous)", offsetof(es_event_openssh_login_t, uid), 1}
556
+ };
557
+
558
+ static const esrb_field_t fields_es_event_openssh_logout_t[] = {
559
+ {"source_address_type", "es_address_type_t", offsetof(es_event_openssh_logout_t, source_address_type), 1},
560
+ {"source_address", "es_string_token_t", offsetof(es_event_openssh_logout_t, source_address), 1},
561
+ {"username", "es_string_token_t", offsetof(es_event_openssh_logout_t, username), 1},
562
+ {"uid", "unsigned int", offsetof(es_event_openssh_logout_t, uid), 1}
563
+ };
564
+
565
+ static const esrb_field_t fields_es_event_login_login_t[] = {
566
+ {"success", "bool", offsetof(es_event_login_login_t, success), 1},
567
+ {"failure_message", "es_string_token_t", offsetof(es_event_login_login_t, failure_message), 1},
568
+ {"username", "es_string_token_t", offsetof(es_event_login_login_t, username), 1},
569
+ {"has_uid", "bool", offsetof(es_event_login_login_t, has_uid), 1},
570
+ {"uid", "union es_event_login_login_t::(anonymous)", offsetof(es_event_login_login_t, uid), 1}
571
+ };
572
+
573
+ static const esrb_field_t fields_es_event_login_logout_t[] = {
574
+ {"username", "es_string_token_t", offsetof(es_event_login_logout_t, username), 1},
575
+ {"uid", "unsigned int", offsetof(es_event_login_logout_t, uid), 1}
576
+ };
577
+
578
+ static const esrb_field_t fields_es_event_btm_launch_item_add_t[] = {
579
+ {"instigator", "es_process_t *", offsetof(es_event_btm_launch_item_add_t, instigator), 1},
580
+ {"app", "es_process_t *", offsetof(es_event_btm_launch_item_add_t, app), 1},
581
+ {"item", "es_btm_launch_item_t *", offsetof(es_event_btm_launch_item_add_t, item), 1},
582
+ {"executable_path", "es_string_token_t", offsetof(es_event_btm_launch_item_add_t, executable_path), 1},
583
+ {"instigator_token", "audit_token_t *", offsetof(es_event_btm_launch_item_add_t, instigator_token), 8},
584
+ {"app_token", "audit_token_t *", offsetof(es_event_btm_launch_item_add_t, app_token), 8}
585
+ };
586
+
587
+ static const esrb_field_t fields_es_event_btm_launch_item_remove_t[] = {
588
+ {"instigator", "es_process_t *", offsetof(es_event_btm_launch_item_remove_t, instigator), 1},
589
+ {"app", "es_process_t *", offsetof(es_event_btm_launch_item_remove_t, app), 1},
590
+ {"item", "es_btm_launch_item_t *", offsetof(es_event_btm_launch_item_remove_t, item), 1},
591
+ {"instigator_token", "audit_token_t *", offsetof(es_event_btm_launch_item_remove_t, instigator_token), 8},
592
+ {"app_token", "audit_token_t *", offsetof(es_event_btm_launch_item_remove_t, app_token), 8}
593
+ };
594
+
595
+ static const esrb_field_t fields_es_event_su_t[] = {
596
+ {"success", "bool", offsetof(es_event_su_t, success), 1},
597
+ {"failure_message", "es_string_token_t", offsetof(es_event_su_t, failure_message), 1},
598
+ {"from_uid", "unsigned int", offsetof(es_event_su_t, from_uid), 1},
599
+ {"from_username", "es_string_token_t", offsetof(es_event_su_t, from_username), 1},
600
+ {"has_to_uid", "bool", offsetof(es_event_su_t, has_to_uid), 1},
601
+ {"to_uid", "union es_event_su_t::(anonymous)", offsetof(es_event_su_t, to_uid), 1},
602
+ {"to_username", "es_string_token_t", offsetof(es_event_su_t, to_username), 1},
603
+ {"shell", "es_string_token_t", offsetof(es_event_su_t, shell), 1},
604
+ {"argc", "unsigned long", offsetof(es_event_su_t, argc), 1},
605
+ {"argv", "es_string_token_t *", offsetof(es_event_su_t, argv), 1},
606
+ {"env_count", "unsigned long", offsetof(es_event_su_t, env_count), 1},
607
+ {"env", "es_string_token_t *", offsetof(es_event_su_t, env), 1}
608
+ };
609
+
610
+ static const esrb_field_t fields_es_sudo_reject_info_t[] = {
611
+ {"plugin_name", "es_string_token_t", offsetof(es_sudo_reject_info_t, plugin_name), 1},
612
+ {"plugin_type", "es_sudo_plugin_type_t", offsetof(es_sudo_reject_info_t, plugin_type), 1},
613
+ {"failure_message", "es_string_token_t", offsetof(es_sudo_reject_info_t, failure_message), 1}
614
+ };
615
+
616
+ static const esrb_field_t fields_es_event_sudo_t[] = {
617
+ {"success", "bool", offsetof(es_event_sudo_t, success), 1},
618
+ {"reject_info", "es_sudo_reject_info_t *", offsetof(es_event_sudo_t, reject_info), 1},
619
+ {"has_from_uid", "bool", offsetof(es_event_sudo_t, has_from_uid), 1},
620
+ {"from_uid", "union es_event_sudo_t::(anonymous)", offsetof(es_event_sudo_t, from_uid), 1},
621
+ {"from_username", "es_string_token_t", offsetof(es_event_sudo_t, from_username), 1},
622
+ {"has_to_uid", "bool", offsetof(es_event_sudo_t, has_to_uid), 1},
623
+ {"to_uid", "union es_event_sudo_t::(anonymous)", offsetof(es_event_sudo_t, to_uid), 1},
624
+ {"to_username", "es_string_token_t", offsetof(es_event_sudo_t, to_username), 1},
625
+ {"command", "es_string_token_t", offsetof(es_event_sudo_t, command), 1}
626
+ };
627
+
628
+ static const esrb_field_t fields_es_event_profile_add_t[] = {
629
+ {"instigator", "es_process_t *", offsetof(es_event_profile_add_t, instigator), 1},
630
+ {"is_update", "bool", offsetof(es_event_profile_add_t, is_update), 1},
631
+ {"profile", "es_profile_t *", offsetof(es_event_profile_add_t, profile), 1},
632
+ {"instigator_token", "audit_token_t", offsetof(es_event_profile_add_t, instigator_token), 8}
633
+ };
634
+
635
+ static const esrb_field_t fields_es_event_profile_remove_t[] = {
636
+ {"instigator", "es_process_t *", offsetof(es_event_profile_remove_t, instigator), 1},
637
+ {"profile", "es_profile_t *", offsetof(es_event_profile_remove_t, profile), 1},
638
+ {"instigator_token", "audit_token_t", offsetof(es_event_profile_remove_t, instigator_token), 8}
639
+ };
640
+
641
+ static const esrb_field_t fields_es_event_authorization_petition_t[] = {
642
+ {"instigator", "es_process_t *", offsetof(es_event_authorization_petition_t, instigator), 1},
643
+ {"petitioner", "es_process_t *", offsetof(es_event_authorization_petition_t, petitioner), 1},
644
+ {"flags", "unsigned int", offsetof(es_event_authorization_petition_t, flags), 1},
645
+ {"right_count", "unsigned long", offsetof(es_event_authorization_petition_t, right_count), 1},
646
+ {"rights", "es_string_token_t *", offsetof(es_event_authorization_petition_t, rights), 1},
647
+ {"instigator_token", "audit_token_t", offsetof(es_event_authorization_petition_t, instigator_token), 8},
648
+ {"petitioner_token", "audit_token_t", offsetof(es_event_authorization_petition_t, petitioner_token), 8}
649
+ };
650
+
651
+ static const esrb_field_t fields_es_authorization_result_t[] = {
652
+ {"right_name", "es_string_token_t", offsetof(es_authorization_result_t, right_name), 1},
653
+ {"rule_class", "es_authorization_rule_class_t", offsetof(es_authorization_result_t, rule_class), 1},
654
+ {"granted", "bool", offsetof(es_authorization_result_t, granted), 1}
655
+ };
656
+
657
+ static const esrb_field_t fields_es_event_authorization_judgement_t[] = {
658
+ {"instigator", "es_process_t *", offsetof(es_event_authorization_judgement_t, instigator), 1},
659
+ {"petitioner", "es_process_t *", offsetof(es_event_authorization_judgement_t, petitioner), 1},
660
+ {"return_code", "int", offsetof(es_event_authorization_judgement_t, return_code), 1},
661
+ {"result_count", "unsigned long", offsetof(es_event_authorization_judgement_t, result_count), 1},
662
+ {"results", "es_authorization_result_t *", offsetof(es_event_authorization_judgement_t, results), 1},
663
+ {"instigator_token", "audit_token_t", offsetof(es_event_authorization_judgement_t, instigator_token), 8},
664
+ {"petitioner_token", "audit_token_t", offsetof(es_event_authorization_judgement_t, petitioner_token), 8}
665
+ };
666
+
667
+ static const esrb_field_t fields_es_od_member_id_t[] = {
668
+ {"member_type", "es_od_member_type_t", offsetof(es_od_member_id_t, member_type), 1},
669
+ {"member_value", "union es_od_member_id_t::(anonymous)", offsetof(es_od_member_id_t, member_value), 1}
670
+ };
671
+
672
+ static const esrb_field_t fields_es_event_od_group_add_t[] = {
673
+ {"instigator", "es_process_t *", offsetof(es_event_od_group_add_t, instigator), 1},
674
+ {"error_code", "int", offsetof(es_event_od_group_add_t, error_code), 1},
675
+ {"group_name", "es_string_token_t", offsetof(es_event_od_group_add_t, group_name), 1},
676
+ {"member", "es_od_member_id_t *", offsetof(es_event_od_group_add_t, member), 1},
677
+ {"node_name", "es_string_token_t", offsetof(es_event_od_group_add_t, node_name), 1},
678
+ {"db_path", "es_string_token_t", offsetof(es_event_od_group_add_t, db_path), 1},
679
+ {"instigator_token", "audit_token_t", offsetof(es_event_od_group_add_t, instigator_token), 8}
680
+ };
681
+
682
+ static const esrb_field_t fields_es_event_od_group_remove_t[] = {
683
+ {"instigator", "es_process_t *", offsetof(es_event_od_group_remove_t, instigator), 1},
684
+ {"error_code", "int", offsetof(es_event_od_group_remove_t, error_code), 1},
685
+ {"group_name", "es_string_token_t", offsetof(es_event_od_group_remove_t, group_name), 1},
686
+ {"member", "es_od_member_id_t *", offsetof(es_event_od_group_remove_t, member), 1},
687
+ {"node_name", "es_string_token_t", offsetof(es_event_od_group_remove_t, node_name), 1},
688
+ {"db_path", "es_string_token_t", offsetof(es_event_od_group_remove_t, db_path), 1},
689
+ {"instigator_token", "audit_token_t", offsetof(es_event_od_group_remove_t, instigator_token), 8}
690
+ };
691
+
692
+ static const esrb_field_t fields_es_od_member_id_array_t[] = {
693
+ {"member_type", "es_od_member_type_t", offsetof(es_od_member_id_array_t, member_type), 1},
694
+ {"member_count", "unsigned long", offsetof(es_od_member_id_array_t, member_count), 1},
695
+ {"member_array", "union es_od_member_id_array_t::(anonymous)", offsetof(es_od_member_id_array_t, member_array), 1}
696
+ };
697
+
698
+ static const esrb_field_t fields_es_event_od_group_set_t[] = {
699
+ {"instigator", "es_process_t *", offsetof(es_event_od_group_set_t, instigator), 1},
700
+ {"error_code", "int", offsetof(es_event_od_group_set_t, error_code), 1},
701
+ {"group_name", "es_string_token_t", offsetof(es_event_od_group_set_t, group_name), 1},
702
+ {"members", "es_od_member_id_array_t *", offsetof(es_event_od_group_set_t, members), 1},
703
+ {"node_name", "es_string_token_t", offsetof(es_event_od_group_set_t, node_name), 1},
704
+ {"db_path", "es_string_token_t", offsetof(es_event_od_group_set_t, db_path), 1},
705
+ {"instigator_token", "audit_token_t", offsetof(es_event_od_group_set_t, instigator_token), 8}
706
+ };
707
+
708
+ static const esrb_field_t fields_es_event_od_modify_password_t[] = {
709
+ {"instigator", "es_process_t *", offsetof(es_event_od_modify_password_t, instigator), 1},
710
+ {"error_code", "int", offsetof(es_event_od_modify_password_t, error_code), 1},
711
+ {"account_type", "es_od_account_type_t", offsetof(es_event_od_modify_password_t, account_type), 1},
712
+ {"account_name", "es_string_token_t", offsetof(es_event_od_modify_password_t, account_name), 1},
713
+ {"node_name", "es_string_token_t", offsetof(es_event_od_modify_password_t, node_name), 1},
714
+ {"db_path", "es_string_token_t", offsetof(es_event_od_modify_password_t, db_path), 1},
715
+ {"instigator_token", "audit_token_t", offsetof(es_event_od_modify_password_t, instigator_token), 8}
716
+ };
717
+
718
+ static const esrb_field_t fields_es_event_od_disable_user_t[] = {
719
+ {"instigator", "es_process_t *", offsetof(es_event_od_disable_user_t, instigator), 1},
720
+ {"error_code", "int", offsetof(es_event_od_disable_user_t, error_code), 1},
721
+ {"user_name", "es_string_token_t", offsetof(es_event_od_disable_user_t, user_name), 1},
722
+ {"node_name", "es_string_token_t", offsetof(es_event_od_disable_user_t, node_name), 1},
723
+ {"db_path", "es_string_token_t", offsetof(es_event_od_disable_user_t, db_path), 1},
724
+ {"instigator_token", "audit_token_t", offsetof(es_event_od_disable_user_t, instigator_token), 8}
725
+ };
726
+
727
+ static const esrb_field_t fields_es_event_od_enable_user_t[] = {
728
+ {"instigator", "es_process_t *", offsetof(es_event_od_enable_user_t, instigator), 1},
729
+ {"error_code", "int", offsetof(es_event_od_enable_user_t, error_code), 1},
730
+ {"user_name", "es_string_token_t", offsetof(es_event_od_enable_user_t, user_name), 1},
731
+ {"node_name", "es_string_token_t", offsetof(es_event_od_enable_user_t, node_name), 1},
732
+ {"db_path", "es_string_token_t", offsetof(es_event_od_enable_user_t, db_path), 1},
733
+ {"instigator_token", "audit_token_t", offsetof(es_event_od_enable_user_t, instigator_token), 8}
734
+ };
735
+
736
+ static const esrb_field_t fields_es_event_od_attribute_value_add_t[] = {
737
+ {"instigator", "es_process_t *", offsetof(es_event_od_attribute_value_add_t, instigator), 1},
738
+ {"error_code", "int", offsetof(es_event_od_attribute_value_add_t, error_code), 1},
739
+ {"record_type", "es_od_record_type_t", offsetof(es_event_od_attribute_value_add_t, record_type), 1},
740
+ {"record_name", "es_string_token_t", offsetof(es_event_od_attribute_value_add_t, record_name), 1},
741
+ {"attribute_name", "es_string_token_t", offsetof(es_event_od_attribute_value_add_t, attribute_name), 1},
742
+ {"attribute_value", "es_string_token_t", offsetof(es_event_od_attribute_value_add_t, attribute_value), 1},
743
+ {"node_name", "es_string_token_t", offsetof(es_event_od_attribute_value_add_t, node_name), 1},
744
+ {"db_path", "es_string_token_t", offsetof(es_event_od_attribute_value_add_t, db_path), 1},
745
+ {"instigator_token", "audit_token_t", offsetof(es_event_od_attribute_value_add_t, instigator_token), 8}
746
+ };
747
+
748
+ static const esrb_field_t fields_es_event_od_attribute_value_remove_t[] = {
749
+ {"instigator", "es_process_t *", offsetof(es_event_od_attribute_value_remove_t, instigator), 1},
750
+ {"error_code", "int", offsetof(es_event_od_attribute_value_remove_t, error_code), 1},
751
+ {"record_type", "es_od_record_type_t", offsetof(es_event_od_attribute_value_remove_t, record_type), 1},
752
+ {"record_name", "es_string_token_t", offsetof(es_event_od_attribute_value_remove_t, record_name), 1},
753
+ {"attribute_name", "es_string_token_t", offsetof(es_event_od_attribute_value_remove_t, attribute_name), 1},
754
+ {"attribute_value", "es_string_token_t", offsetof(es_event_od_attribute_value_remove_t, attribute_value), 1},
755
+ {"node_name", "es_string_token_t", offsetof(es_event_od_attribute_value_remove_t, node_name), 1},
756
+ {"db_path", "es_string_token_t", offsetof(es_event_od_attribute_value_remove_t, db_path), 1},
757
+ {"instigator_token", "audit_token_t", offsetof(es_event_od_attribute_value_remove_t, instigator_token), 8}
758
+ };
759
+
760
+ static const esrb_field_t fields_es_event_od_attribute_set_t[] = {
761
+ {"instigator", "es_process_t *", offsetof(es_event_od_attribute_set_t, instigator), 1},
762
+ {"error_code", "int", offsetof(es_event_od_attribute_set_t, error_code), 1},
763
+ {"record_type", "es_od_record_type_t", offsetof(es_event_od_attribute_set_t, record_type), 1},
764
+ {"record_name", "es_string_token_t", offsetof(es_event_od_attribute_set_t, record_name), 1},
765
+ {"attribute_name", "es_string_token_t", offsetof(es_event_od_attribute_set_t, attribute_name), 1},
766
+ {"attribute_value_count", "unsigned long", offsetof(es_event_od_attribute_set_t, attribute_value_count), 1},
767
+ {"attribute_values", "es_string_token_t *", offsetof(es_event_od_attribute_set_t, attribute_values), 1},
768
+ {"node_name", "es_string_token_t", offsetof(es_event_od_attribute_set_t, node_name), 1},
769
+ {"db_path", "es_string_token_t", offsetof(es_event_od_attribute_set_t, db_path), 1},
770
+ {"instigator_token", "audit_token_t", offsetof(es_event_od_attribute_set_t, instigator_token), 8}
771
+ };
772
+
773
+ static const esrb_field_t fields_es_event_od_create_user_t[] = {
774
+ {"instigator", "es_process_t *", offsetof(es_event_od_create_user_t, instigator), 1},
775
+ {"error_code", "int", offsetof(es_event_od_create_user_t, error_code), 1},
776
+ {"user_name", "es_string_token_t", offsetof(es_event_od_create_user_t, user_name), 1},
777
+ {"node_name", "es_string_token_t", offsetof(es_event_od_create_user_t, node_name), 1},
778
+ {"db_path", "es_string_token_t", offsetof(es_event_od_create_user_t, db_path), 1},
779
+ {"instigator_token", "audit_token_t", offsetof(es_event_od_create_user_t, instigator_token), 8}
780
+ };
781
+
782
+ static const esrb_field_t fields_es_event_od_create_group_t[] = {
783
+ {"instigator", "es_process_t *", offsetof(es_event_od_create_group_t, instigator), 1},
784
+ {"error_code", "int", offsetof(es_event_od_create_group_t, error_code), 1},
785
+ {"group_name", "es_string_token_t", offsetof(es_event_od_create_group_t, group_name), 1},
786
+ {"node_name", "es_string_token_t", offsetof(es_event_od_create_group_t, node_name), 1},
787
+ {"db_path", "es_string_token_t", offsetof(es_event_od_create_group_t, db_path), 1},
788
+ {"instigator_token", "audit_token_t", offsetof(es_event_od_create_group_t, instigator_token), 8}
789
+ };
790
+
791
+ static const esrb_field_t fields_es_event_od_delete_user_t[] = {
792
+ {"instigator", "es_process_t *", offsetof(es_event_od_delete_user_t, instigator), 1},
793
+ {"error_code", "int", offsetof(es_event_od_delete_user_t, error_code), 1},
794
+ {"user_name", "es_string_token_t", offsetof(es_event_od_delete_user_t, user_name), 1},
795
+ {"node_name", "es_string_token_t", offsetof(es_event_od_delete_user_t, node_name), 1},
796
+ {"db_path", "es_string_token_t", offsetof(es_event_od_delete_user_t, db_path), 1},
797
+ {"instigator_token", "audit_token_t", offsetof(es_event_od_delete_user_t, instigator_token), 8}
798
+ };
799
+
800
+ static const esrb_field_t fields_es_event_od_delete_group_t[] = {
801
+ {"instigator", "es_process_t *", offsetof(es_event_od_delete_group_t, instigator), 1},
802
+ {"error_code", "int", offsetof(es_event_od_delete_group_t, error_code), 1},
803
+ {"group_name", "es_string_token_t", offsetof(es_event_od_delete_group_t, group_name), 1},
804
+ {"node_name", "es_string_token_t", offsetof(es_event_od_delete_group_t, node_name), 1},
805
+ {"db_path", "es_string_token_t", offsetof(es_event_od_delete_group_t, db_path), 1},
806
+ {"instigator_token", "audit_token_t", offsetof(es_event_od_delete_group_t, instigator_token), 8}
807
+ };
808
+
809
+ static const esrb_field_t fields_es_event_xpc_connect_t[] = {
810
+ {"service_name", "es_string_token_t", offsetof(es_event_xpc_connect_t, service_name), 1},
811
+ {"service_domain_type", "es_xpc_domain_type_t", offsetof(es_event_xpc_connect_t, service_domain_type), 1}
812
+ };
813
+
814
+ static const esrb_field_t fields_es_event_gatekeeper_user_override_t[] = {
815
+ {"file_type", "es_gatekeeper_user_override_file_type_t", offsetof(es_event_gatekeeper_user_override_t, file_type), 1},
816
+ {"file", "union es_event_gatekeeper_user_override_t::(anonymous)", offsetof(es_event_gatekeeper_user_override_t, file), 1},
817
+ {"sha256", "es_sha256_t *", offsetof(es_event_gatekeeper_user_override_t, sha256), 1},
818
+ {"signing_info", "es_signed_file_info_t *", offsetof(es_event_gatekeeper_user_override_t, signing_info), 1}
819
+ };
820
+
821
+ static const esrb_field_t fields_es_events_t[] = {
822
+ {"access", "es_event_access_t", offsetof(es_events_t, access), 1},
823
+ {"chdir", "es_event_chdir_t", offsetof(es_events_t, chdir), 1},
824
+ {"chroot", "es_event_chroot_t", offsetof(es_events_t, chroot), 1},
825
+ {"clone", "es_event_clone_t", offsetof(es_events_t, clone), 1},
826
+ {"close", "es_event_close_t", offsetof(es_events_t, close), 1},
827
+ {"copyfile", "es_event_copyfile_t", offsetof(es_events_t, copyfile), 1},
828
+ {"create", "es_event_create_t", offsetof(es_events_t, create), 1},
829
+ {"cs_invalidated", "es_event_cs_invalidated_t", offsetof(es_events_t, cs_invalidated), 1},
830
+ {"deleteextattr", "es_event_deleteextattr_t", offsetof(es_events_t, deleteextattr), 1},
831
+ {"dup", "es_event_dup_t", offsetof(es_events_t, dup), 1},
832
+ {"exchangedata", "es_event_exchangedata_t", offsetof(es_events_t, exchangedata), 1},
833
+ {"exec", "es_event_exec_t", offsetof(es_events_t, exec), 1},
834
+ {"exit", "es_event_exit_t", offsetof(es_events_t, exit), 1},
835
+ {"file_provider_materialize", "es_event_file_provider_materialize_t", offsetof(es_events_t, file_provider_materialize), 1},
836
+ {"file_provider_update", "es_event_file_provider_update_t", offsetof(es_events_t, file_provider_update), 1},
837
+ {"fcntl", "es_event_fcntl_t", offsetof(es_events_t, fcntl), 1},
838
+ {"fork", "es_event_fork_t", offsetof(es_events_t, fork), 1},
839
+ {"fsgetpath", "es_event_fsgetpath_t", offsetof(es_events_t, fsgetpath), 1},
840
+ {"get_task", "es_event_get_task_t", offsetof(es_events_t, get_task), 1},
841
+ {"get_task_read", "es_event_get_task_read_t", offsetof(es_events_t, get_task_read), 1},
842
+ {"get_task_inspect", "es_event_get_task_inspect_t", offsetof(es_events_t, get_task_inspect), 1},
843
+ {"get_task_name", "es_event_get_task_name_t", offsetof(es_events_t, get_task_name), 1},
844
+ {"getattrlist", "es_event_getattrlist_t", offsetof(es_events_t, getattrlist), 1},
845
+ {"getextattr", "es_event_getextattr_t", offsetof(es_events_t, getextattr), 1},
846
+ {"iokit_open", "es_event_iokit_open_t", offsetof(es_events_t, iokit_open), 1},
847
+ {"kextload", "es_event_kextload_t", offsetof(es_events_t, kextload), 1},
848
+ {"kextunload", "es_event_kextunload_t", offsetof(es_events_t, kextunload), 1},
849
+ {"link", "es_event_link_t", offsetof(es_events_t, link), 1},
850
+ {"listextattr", "es_event_listextattr_t", offsetof(es_events_t, listextattr), 1},
851
+ {"lookup", "es_event_lookup_t", offsetof(es_events_t, lookup), 1},
852
+ {"mmap", "es_event_mmap_t", offsetof(es_events_t, mmap), 1},
853
+ {"mount", "es_event_mount_t", offsetof(es_events_t, mount), 1},
854
+ {"mprotect", "es_event_mprotect_t", offsetof(es_events_t, mprotect), 1},
855
+ {"open", "es_event_open_t", offsetof(es_events_t, open), 1},
856
+ {"proc_check", "es_event_proc_check_t", offsetof(es_events_t, proc_check), 1},
857
+ {"proc_suspend_resume", "es_event_proc_suspend_resume_t", offsetof(es_events_t, proc_suspend_resume), 1},
858
+ {"pty_close", "es_event_pty_close_t", offsetof(es_events_t, pty_close), 1},
859
+ {"pty_grant", "es_event_pty_grant_t", offsetof(es_events_t, pty_grant), 1},
860
+ {"readdir", "es_event_readdir_t", offsetof(es_events_t, readdir), 1},
861
+ {"readlink", "es_event_readlink_t", offsetof(es_events_t, readlink), 1},
862
+ {"remote_thread_create", "es_event_remote_thread_create_t", offsetof(es_events_t, remote_thread_create), 1},
863
+ {"remount", "es_event_remount_t", offsetof(es_events_t, remount), 1},
864
+ {"rename", "es_event_rename_t", offsetof(es_events_t, rename), 1},
865
+ {"searchfs", "es_event_searchfs_t", offsetof(es_events_t, searchfs), 1},
866
+ {"setacl", "es_event_setacl_t", offsetof(es_events_t, setacl), 1},
867
+ {"setattrlist", "es_event_setattrlist_t", offsetof(es_events_t, setattrlist), 1},
868
+ {"setextattr", "es_event_setextattr_t", offsetof(es_events_t, setextattr), 1},
869
+ {"setflags", "es_event_setflags_t", offsetof(es_events_t, setflags), 1},
870
+ {"setmode", "es_event_setmode_t", offsetof(es_events_t, setmode), 1},
871
+ {"setowner", "es_event_setowner_t", offsetof(es_events_t, setowner), 1},
872
+ {"settime", "es_event_settime_t", offsetof(es_events_t, settime), 1},
873
+ {"setuid", "es_event_setuid_t", offsetof(es_events_t, setuid), 1},
874
+ {"setgid", "es_event_setgid_t", offsetof(es_events_t, setgid), 1},
875
+ {"seteuid", "es_event_seteuid_t", offsetof(es_events_t, seteuid), 1},
876
+ {"setegid", "es_event_setegid_t", offsetof(es_events_t, setegid), 1},
877
+ {"setreuid", "es_event_setreuid_t", offsetof(es_events_t, setreuid), 1},
878
+ {"setregid", "es_event_setregid_t", offsetof(es_events_t, setregid), 1},
879
+ {"signal", "es_event_signal_t", offsetof(es_events_t, signal), 1},
880
+ {"stat", "es_event_stat_t", offsetof(es_events_t, stat), 1},
881
+ {"trace", "es_event_trace_t", offsetof(es_events_t, trace), 1},
882
+ {"truncate", "es_event_truncate_t", offsetof(es_events_t, truncate), 1},
883
+ {"uipc_bind", "es_event_uipc_bind_t", offsetof(es_events_t, uipc_bind), 1},
884
+ {"uipc_connect", "es_event_uipc_connect_t", offsetof(es_events_t, uipc_connect), 1},
885
+ {"unlink", "es_event_unlink_t", offsetof(es_events_t, unlink), 1},
886
+ {"unmount", "es_event_unmount_t", offsetof(es_events_t, unmount), 1},
887
+ {"utimes", "es_event_utimes_t", offsetof(es_events_t, utimes), 1},
888
+ {"write", "es_event_write_t", offsetof(es_events_t, write), 1},
889
+ {"authentication", "es_event_authentication_t *", offsetof(es_events_t, authentication), 1},
890
+ {"xp_malware_detected", "es_event_xp_malware_detected_t *", offsetof(es_events_t, xp_malware_detected), 1},
891
+ {"xp_malware_remediated", "es_event_xp_malware_remediated_t *", offsetof(es_events_t, xp_malware_remediated), 1},
892
+ {"lw_session_login", "es_event_lw_session_login_t *", offsetof(es_events_t, lw_session_login), 1},
893
+ {"lw_session_logout", "es_event_lw_session_logout_t *", offsetof(es_events_t, lw_session_logout), 1},
894
+ {"lw_session_lock", "es_event_lw_session_lock_t *", offsetof(es_events_t, lw_session_lock), 1},
895
+ {"lw_session_unlock", "es_event_lw_session_unlock_t *", offsetof(es_events_t, lw_session_unlock), 1},
896
+ {"screensharing_attach", "es_event_screensharing_attach_t *", offsetof(es_events_t, screensharing_attach), 1},
897
+ {"screensharing_detach", "es_event_screensharing_detach_t *", offsetof(es_events_t, screensharing_detach), 1},
898
+ {"openssh_login", "es_event_openssh_login_t *", offsetof(es_events_t, openssh_login), 1},
899
+ {"openssh_logout", "es_event_openssh_logout_t *", offsetof(es_events_t, openssh_logout), 1},
900
+ {"login_login", "es_event_login_login_t *", offsetof(es_events_t, login_login), 1},
901
+ {"login_logout", "es_event_login_logout_t *", offsetof(es_events_t, login_logout), 1},
902
+ {"btm_launch_item_add", "es_event_btm_launch_item_add_t *", offsetof(es_events_t, btm_launch_item_add), 1},
903
+ {"btm_launch_item_remove", "es_event_btm_launch_item_remove_t *", offsetof(es_events_t, btm_launch_item_remove), 1},
904
+ {"profile_add", "es_event_profile_add_t *", offsetof(es_events_t, profile_add), 1},
905
+ {"profile_remove", "es_event_profile_remove_t *", offsetof(es_events_t, profile_remove), 1},
906
+ {"su", "es_event_su_t *", offsetof(es_events_t, su), 1},
907
+ {"authorization_petition", "es_event_authorization_petition_t *", offsetof(es_events_t, authorization_petition), 1},
908
+ {"authorization_judgement", "es_event_authorization_judgement_t *", offsetof(es_events_t, authorization_judgement), 1},
909
+ {"sudo", "es_event_sudo_t *", offsetof(es_events_t, sudo), 1},
910
+ {"od_group_add", "es_event_od_group_add_t *", offsetof(es_events_t, od_group_add), 1},
911
+ {"od_group_remove", "es_event_od_group_remove_t *", offsetof(es_events_t, od_group_remove), 1},
912
+ {"od_group_set", "es_event_od_group_set_t *", offsetof(es_events_t, od_group_set), 1},
913
+ {"od_modify_password", "es_event_od_modify_password_t *", offsetof(es_events_t, od_modify_password), 1},
914
+ {"od_disable_user", "es_event_od_disable_user_t *", offsetof(es_events_t, od_disable_user), 1},
915
+ {"od_enable_user", "es_event_od_enable_user_t *", offsetof(es_events_t, od_enable_user), 1},
916
+ {"od_attribute_value_add", "es_event_od_attribute_value_add_t *", offsetof(es_events_t, od_attribute_value_add), 1},
917
+ {"od_attribute_value_remove", "es_event_od_attribute_value_remove_t *", offsetof(es_events_t, od_attribute_value_remove), 1},
918
+ {"od_attribute_set", "es_event_od_attribute_set_t *", offsetof(es_events_t, od_attribute_set), 1},
919
+ {"od_create_user", "es_event_od_create_user_t *", offsetof(es_events_t, od_create_user), 1},
920
+ {"od_create_group", "es_event_od_create_group_t *", offsetof(es_events_t, od_create_group), 1},
921
+ {"od_delete_user", "es_event_od_delete_user_t *", offsetof(es_events_t, od_delete_user), 1},
922
+ {"od_delete_group", "es_event_od_delete_group_t *", offsetof(es_events_t, od_delete_group), 1},
923
+ {"xpc_connect", "es_event_xpc_connect_t *", offsetof(es_events_t, xpc_connect), 1},
924
+ {"gatekeeper_user_override", "es_event_gatekeeper_user_override_t *", offsetof(es_events_t, gatekeeper_user_override), 1},
925
+ {"tcc_modify", "es_event_tcc_modify_t *", offsetof(es_events_t, tcc_modify), 1}
926
+ };
927
+
928
+ static const esrb_field_t fields_es_result_t[] = {
929
+ {"result_type", "es_result_type_t", offsetof(es_result_t, result_type), 1},
930
+ {"result", "union es_result_t::(anonymous)", offsetof(es_result_t, result), 1}
931
+ };
932
+
933
+ static const esrb_field_t fields_es_message_t[] = {
934
+ {"version", "unsigned int", offsetof(es_message_t, version), 1},
935
+ {"time", "struct timespec", offsetof(es_message_t, time), 1},
936
+ {"mach_time", "unsigned long long", offsetof(es_message_t, mach_time), 1},
937
+ {"deadline", "unsigned long long", offsetof(es_message_t, deadline), 1},
938
+ {"process", "es_process_t *", offsetof(es_message_t, process), 1},
939
+ {"seq_num", "unsigned long long", offsetof(es_message_t, seq_num), 2},
940
+ {"action_type", "es_action_type_t", offsetof(es_message_t, action_type), 1},
941
+ {"action", "union es_message_t::(anonymous)", offsetof(es_message_t, action), 1},
942
+ {"event_type", "es_event_type_t", offsetof(es_message_t, event_type), 1},
943
+ {"event", "es_events_t", offsetof(es_message_t, event), 1},
944
+ {"thread", "es_thread_t *", offsetof(es_message_t, thread), 4},
945
+ {"global_seq_num", "unsigned long long", offsetof(es_message_t, global_seq_num), 4},
946
+ {"opaque", "uint64_t[]", offsetof(es_message_t, opaque), 1}
947
+ };
948
+
949
+ const esrb_schema_t esrb_schemas[] = {
950
+ {"es_event_id_t", NULL, 0},
951
+ {"es_token_t", fields_es_token_t, sizeof(fields_es_token_t) / sizeof(fields_es_token_t[0])},
952
+ {"es_string_token_t", fields_es_string_token_t, sizeof(fields_es_string_token_t) / sizeof(fields_es_string_token_t[0])},
953
+ {"es_muted_path_t", fields_es_muted_path_t, sizeof(fields_es_muted_path_t) / sizeof(fields_es_muted_path_t[0])},
954
+ {"es_muted_paths_t", fields_es_muted_paths_t, sizeof(fields_es_muted_paths_t) / sizeof(fields_es_muted_paths_t[0])},
955
+ {"es_muted_process_t", fields_es_muted_process_t, sizeof(fields_es_muted_process_t) / sizeof(fields_es_muted_process_t[0])},
956
+ {"es_muted_processes_t", fields_es_muted_processes_t, sizeof(fields_es_muted_processes_t) / sizeof(fields_es_muted_processes_t[0])},
957
+ {"es_signed_file_info_t", fields_es_signed_file_info_t, sizeof(fields_es_signed_file_info_t) / sizeof(fields_es_signed_file_info_t[0])},
958
+ {"es_file_t", fields_es_file_t, sizeof(fields_es_file_t) / sizeof(fields_es_file_t[0])},
959
+ {"es_process_t", fields_es_process_t, sizeof(fields_es_process_t) / sizeof(fields_es_process_t[0])},
960
+ {"es_thread_t", fields_es_thread_t, sizeof(fields_es_thread_t) / sizeof(fields_es_thread_t[0])},
961
+ {"es_thread_state_t", fields_es_thread_state_t, sizeof(fields_es_thread_state_t) / sizeof(fields_es_thread_state_t[0])},
962
+ {"es_fd_t", fields_es_fd_t, sizeof(fields_es_fd_t) / sizeof(fields_es_fd_t[0])},
963
+ {"es_btm_launch_item_t", fields_es_btm_launch_item_t, sizeof(fields_es_btm_launch_item_t) / sizeof(fields_es_btm_launch_item_t[0])},
964
+ {"es_profile_t", fields_es_profile_t, sizeof(fields_es_profile_t) / sizeof(fields_es_profile_t[0])},
965
+ {"es_event_exec_t", fields_es_event_exec_t, sizeof(fields_es_event_exec_t) / sizeof(fields_es_event_exec_t[0])},
966
+ {"es_event_tcc_modify_t", fields_es_event_tcc_modify_t, sizeof(fields_es_event_tcc_modify_t) / sizeof(fields_es_event_tcc_modify_t[0])},
967
+ {"es_event_open_t", fields_es_event_open_t, sizeof(fields_es_event_open_t) / sizeof(fields_es_event_open_t[0])},
968
+ {"es_event_kextload_t", fields_es_event_kextload_t, sizeof(fields_es_event_kextload_t) / sizeof(fields_es_event_kextload_t[0])},
969
+ {"es_event_kextunload_t", fields_es_event_kextunload_t, sizeof(fields_es_event_kextunload_t) / sizeof(fields_es_event_kextunload_t[0])},
970
+ {"es_event_unlink_t", fields_es_event_unlink_t, sizeof(fields_es_event_unlink_t) / sizeof(fields_es_event_unlink_t[0])},
971
+ {"es_event_mmap_t", fields_es_event_mmap_t, sizeof(fields_es_event_mmap_t) / sizeof(fields_es_event_mmap_t[0])},
972
+ {"es_event_link_t", fields_es_event_link_t, sizeof(fields_es_event_link_t) / sizeof(fields_es_event_link_t[0])},
973
+ {"es_event_mount_t", fields_es_event_mount_t, sizeof(fields_es_event_mount_t) / sizeof(fields_es_event_mount_t[0])},
974
+ {"es_event_unmount_t", fields_es_event_unmount_t, sizeof(fields_es_event_unmount_t) / sizeof(fields_es_event_unmount_t[0])},
975
+ {"es_event_remount_t", fields_es_event_remount_t, sizeof(fields_es_event_remount_t) / sizeof(fields_es_event_remount_t[0])},
976
+ {"es_event_fork_t", fields_es_event_fork_t, sizeof(fields_es_event_fork_t) / sizeof(fields_es_event_fork_t[0])},
977
+ {"es_event_mprotect_t", fields_es_event_mprotect_t, sizeof(fields_es_event_mprotect_t) / sizeof(fields_es_event_mprotect_t[0])},
978
+ {"es_event_signal_t", fields_es_event_signal_t, sizeof(fields_es_event_signal_t) / sizeof(fields_es_event_signal_t[0])},
979
+ {"es_event_rename_t", fields_es_event_rename_t, sizeof(fields_es_event_rename_t) / sizeof(fields_es_event_rename_t[0])},
980
+ {"es_event_setextattr_t", fields_es_event_setextattr_t, sizeof(fields_es_event_setextattr_t) / sizeof(fields_es_event_setextattr_t[0])},
981
+ {"es_event_getextattr_t", fields_es_event_getextattr_t, sizeof(fields_es_event_getextattr_t) / sizeof(fields_es_event_getextattr_t[0])},
982
+ {"es_event_deleteextattr_t", fields_es_event_deleteextattr_t, sizeof(fields_es_event_deleteextattr_t) / sizeof(fields_es_event_deleteextattr_t[0])},
983
+ {"es_event_setmode_t", fields_es_event_setmode_t, sizeof(fields_es_event_setmode_t) / sizeof(fields_es_event_setmode_t[0])},
984
+ {"es_event_setflags_t", fields_es_event_setflags_t, sizeof(fields_es_event_setflags_t) / sizeof(fields_es_event_setflags_t[0])},
985
+ {"es_event_setowner_t", fields_es_event_setowner_t, sizeof(fields_es_event_setowner_t) / sizeof(fields_es_event_setowner_t[0])},
986
+ {"es_event_close_t", fields_es_event_close_t, sizeof(fields_es_event_close_t) / sizeof(fields_es_event_close_t[0])},
987
+ {"es_event_create_t", fields_es_event_create_t, sizeof(fields_es_event_create_t) / sizeof(fields_es_event_create_t[0])},
988
+ {"es_event_exit_t", fields_es_event_exit_t, sizeof(fields_es_event_exit_t) / sizeof(fields_es_event_exit_t[0])},
989
+ {"es_event_exchangedata_t", fields_es_event_exchangedata_t, sizeof(fields_es_event_exchangedata_t) / sizeof(fields_es_event_exchangedata_t[0])},
990
+ {"es_event_write_t", fields_es_event_write_t, sizeof(fields_es_event_write_t) / sizeof(fields_es_event_write_t[0])},
991
+ {"es_event_truncate_t", fields_es_event_truncate_t, sizeof(fields_es_event_truncate_t) / sizeof(fields_es_event_truncate_t[0])},
992
+ {"es_event_chdir_t", fields_es_event_chdir_t, sizeof(fields_es_event_chdir_t) / sizeof(fields_es_event_chdir_t[0])},
993
+ {"es_event_stat_t", fields_es_event_stat_t, sizeof(fields_es_event_stat_t) / sizeof(fields_es_event_stat_t[0])},
994
+ {"es_event_chroot_t", fields_es_event_chroot_t, sizeof(fields_es_event_chroot_t) / sizeof(fields_es_event_chroot_t[0])},
995
+ {"es_event_listextattr_t", fields_es_event_listextattr_t, sizeof(fields_es_event_listextattr_t) / sizeof(fields_es_event_listextattr_t[0])},
996
+ {"es_event_iokit_open_t", fields_es_event_iokit_open_t, sizeof(fields_es_event_iokit_open_t) / sizeof(fields_es_event_iokit_open_t[0])},
997
+ {"es_event_get_task_t", fields_es_event_get_task_t, sizeof(fields_es_event_get_task_t) / sizeof(fields_es_event_get_task_t[0])},
998
+ {"es_event_get_task_read_t", fields_es_event_get_task_read_t, sizeof(fields_es_event_get_task_read_t) / sizeof(fields_es_event_get_task_read_t[0])},
999
+ {"es_event_get_task_inspect_t", fields_es_event_get_task_inspect_t, sizeof(fields_es_event_get_task_inspect_t) / sizeof(fields_es_event_get_task_inspect_t[0])},
1000
+ {"es_event_get_task_name_t", fields_es_event_get_task_name_t, sizeof(fields_es_event_get_task_name_t) / sizeof(fields_es_event_get_task_name_t[0])},
1001
+ {"es_event_getattrlist_t", fields_es_event_getattrlist_t, sizeof(fields_es_event_getattrlist_t) / sizeof(fields_es_event_getattrlist_t[0])},
1002
+ {"es_event_setattrlist_t", fields_es_event_setattrlist_t, sizeof(fields_es_event_setattrlist_t) / sizeof(fields_es_event_setattrlist_t[0])},
1003
+ {"es_event_file_provider_update_t", fields_es_event_file_provider_update_t, sizeof(fields_es_event_file_provider_update_t) / sizeof(fields_es_event_file_provider_update_t[0])},
1004
+ {"es_event_file_provider_materialize_t", fields_es_event_file_provider_materialize_t, sizeof(fields_es_event_file_provider_materialize_t) / sizeof(fields_es_event_file_provider_materialize_t[0])},
1005
+ {"es_event_readlink_t", fields_es_event_readlink_t, sizeof(fields_es_event_readlink_t) / sizeof(fields_es_event_readlink_t[0])},
1006
+ {"es_event_lookup_t", fields_es_event_lookup_t, sizeof(fields_es_event_lookup_t) / sizeof(fields_es_event_lookup_t[0])},
1007
+ {"es_event_access_t", fields_es_event_access_t, sizeof(fields_es_event_access_t) / sizeof(fields_es_event_access_t[0])},
1008
+ {"es_event_utimes_t", fields_es_event_utimes_t, sizeof(fields_es_event_utimes_t) / sizeof(fields_es_event_utimes_t[0])},
1009
+ {"es_event_clone_t", fields_es_event_clone_t, sizeof(fields_es_event_clone_t) / sizeof(fields_es_event_clone_t[0])},
1010
+ {"es_event_copyfile_t", fields_es_event_copyfile_t, sizeof(fields_es_event_copyfile_t) / sizeof(fields_es_event_copyfile_t[0])},
1011
+ {"es_event_fcntl_t", fields_es_event_fcntl_t, sizeof(fields_es_event_fcntl_t) / sizeof(fields_es_event_fcntl_t[0])},
1012
+ {"es_event_readdir_t", fields_es_event_readdir_t, sizeof(fields_es_event_readdir_t) / sizeof(fields_es_event_readdir_t[0])},
1013
+ {"es_event_fsgetpath_t", fields_es_event_fsgetpath_t, sizeof(fields_es_event_fsgetpath_t) / sizeof(fields_es_event_fsgetpath_t[0])},
1014
+ {"es_event_settime_t", NULL, 0},
1015
+ {"es_event_dup_t", fields_es_event_dup_t, sizeof(fields_es_event_dup_t) / sizeof(fields_es_event_dup_t[0])},
1016
+ {"es_event_uipc_bind_t", fields_es_event_uipc_bind_t, sizeof(fields_es_event_uipc_bind_t) / sizeof(fields_es_event_uipc_bind_t[0])},
1017
+ {"es_event_uipc_connect_t", fields_es_event_uipc_connect_t, sizeof(fields_es_event_uipc_connect_t) / sizeof(fields_es_event_uipc_connect_t[0])},
1018
+ {"es_event_setacl_t", fields_es_event_setacl_t, sizeof(fields_es_event_setacl_t) / sizeof(fields_es_event_setacl_t[0])},
1019
+ {"es_event_pty_grant_t", fields_es_event_pty_grant_t, sizeof(fields_es_event_pty_grant_t) / sizeof(fields_es_event_pty_grant_t[0])},
1020
+ {"es_event_pty_close_t", fields_es_event_pty_close_t, sizeof(fields_es_event_pty_close_t) / sizeof(fields_es_event_pty_close_t[0])},
1021
+ {"es_event_proc_check_t", fields_es_event_proc_check_t, sizeof(fields_es_event_proc_check_t) / sizeof(fields_es_event_proc_check_t[0])},
1022
+ {"es_event_searchfs_t", fields_es_event_searchfs_t, sizeof(fields_es_event_searchfs_t) / sizeof(fields_es_event_searchfs_t[0])},
1023
+ {"es_event_proc_suspend_resume_t", fields_es_event_proc_suspend_resume_t, sizeof(fields_es_event_proc_suspend_resume_t) / sizeof(fields_es_event_proc_suspend_resume_t[0])},
1024
+ {"es_event_cs_invalidated_t", NULL, 0},
1025
+ {"es_event_trace_t", fields_es_event_trace_t, sizeof(fields_es_event_trace_t) / sizeof(fields_es_event_trace_t[0])},
1026
+ {"es_event_remote_thread_create_t", fields_es_event_remote_thread_create_t, sizeof(fields_es_event_remote_thread_create_t) / sizeof(fields_es_event_remote_thread_create_t[0])},
1027
+ {"es_event_setuid_t", fields_es_event_setuid_t, sizeof(fields_es_event_setuid_t) / sizeof(fields_es_event_setuid_t[0])},
1028
+ {"es_event_setgid_t", fields_es_event_setgid_t, sizeof(fields_es_event_setgid_t) / sizeof(fields_es_event_setgid_t[0])},
1029
+ {"es_event_seteuid_t", fields_es_event_seteuid_t, sizeof(fields_es_event_seteuid_t) / sizeof(fields_es_event_seteuid_t[0])},
1030
+ {"es_event_setegid_t", fields_es_event_setegid_t, sizeof(fields_es_event_setegid_t) / sizeof(fields_es_event_setegid_t[0])},
1031
+ {"es_event_setreuid_t", fields_es_event_setreuid_t, sizeof(fields_es_event_setreuid_t) / sizeof(fields_es_event_setreuid_t[0])},
1032
+ {"es_event_setregid_t", fields_es_event_setregid_t, sizeof(fields_es_event_setregid_t) / sizeof(fields_es_event_setregid_t[0])},
1033
+ {"es_event_authentication_od_t", fields_es_event_authentication_od_t, sizeof(fields_es_event_authentication_od_t) / sizeof(fields_es_event_authentication_od_t[0])},
1034
+ {"es_event_authentication_touchid_t", fields_es_event_authentication_touchid_t, sizeof(fields_es_event_authentication_touchid_t) / sizeof(fields_es_event_authentication_touchid_t[0])},
1035
+ {"es_event_authentication_token_t", fields_es_event_authentication_token_t, sizeof(fields_es_event_authentication_token_t) / sizeof(fields_es_event_authentication_token_t[0])},
1036
+ {"es_event_authentication_auto_unlock_t", fields_es_event_authentication_auto_unlock_t, sizeof(fields_es_event_authentication_auto_unlock_t) / sizeof(fields_es_event_authentication_auto_unlock_t[0])},
1037
+ {"es_event_authentication_t", fields_es_event_authentication_t, sizeof(fields_es_event_authentication_t) / sizeof(fields_es_event_authentication_t[0])},
1038
+ {"es_event_xp_malware_detected_t", fields_es_event_xp_malware_detected_t, sizeof(fields_es_event_xp_malware_detected_t) / sizeof(fields_es_event_xp_malware_detected_t[0])},
1039
+ {"es_event_xp_malware_remediated_t", fields_es_event_xp_malware_remediated_t, sizeof(fields_es_event_xp_malware_remediated_t) / sizeof(fields_es_event_xp_malware_remediated_t[0])},
1040
+ {"es_event_lw_session_login_t", fields_es_event_lw_session_login_t, sizeof(fields_es_event_lw_session_login_t) / sizeof(fields_es_event_lw_session_login_t[0])},
1041
+ {"es_event_lw_session_logout_t", fields_es_event_lw_session_logout_t, sizeof(fields_es_event_lw_session_logout_t) / sizeof(fields_es_event_lw_session_logout_t[0])},
1042
+ {"es_event_lw_session_lock_t", fields_es_event_lw_session_lock_t, sizeof(fields_es_event_lw_session_lock_t) / sizeof(fields_es_event_lw_session_lock_t[0])},
1043
+ {"es_event_lw_session_unlock_t", fields_es_event_lw_session_unlock_t, sizeof(fields_es_event_lw_session_unlock_t) / sizeof(fields_es_event_lw_session_unlock_t[0])},
1044
+ {"es_event_screensharing_attach_t", fields_es_event_screensharing_attach_t, sizeof(fields_es_event_screensharing_attach_t) / sizeof(fields_es_event_screensharing_attach_t[0])},
1045
+ {"es_event_screensharing_detach_t", fields_es_event_screensharing_detach_t, sizeof(fields_es_event_screensharing_detach_t) / sizeof(fields_es_event_screensharing_detach_t[0])},
1046
+ {"es_event_openssh_login_t", fields_es_event_openssh_login_t, sizeof(fields_es_event_openssh_login_t) / sizeof(fields_es_event_openssh_login_t[0])},
1047
+ {"es_event_openssh_logout_t", fields_es_event_openssh_logout_t, sizeof(fields_es_event_openssh_logout_t) / sizeof(fields_es_event_openssh_logout_t[0])},
1048
+ {"es_event_login_login_t", fields_es_event_login_login_t, sizeof(fields_es_event_login_login_t) / sizeof(fields_es_event_login_login_t[0])},
1049
+ {"es_event_login_logout_t", fields_es_event_login_logout_t, sizeof(fields_es_event_login_logout_t) / sizeof(fields_es_event_login_logout_t[0])},
1050
+ {"es_event_btm_launch_item_add_t", fields_es_event_btm_launch_item_add_t, sizeof(fields_es_event_btm_launch_item_add_t) / sizeof(fields_es_event_btm_launch_item_add_t[0])},
1051
+ {"es_event_btm_launch_item_remove_t", fields_es_event_btm_launch_item_remove_t, sizeof(fields_es_event_btm_launch_item_remove_t) / sizeof(fields_es_event_btm_launch_item_remove_t[0])},
1052
+ {"es_event_su_t", fields_es_event_su_t, sizeof(fields_es_event_su_t) / sizeof(fields_es_event_su_t[0])},
1053
+ {"es_sudo_reject_info_t", fields_es_sudo_reject_info_t, sizeof(fields_es_sudo_reject_info_t) / sizeof(fields_es_sudo_reject_info_t[0])},
1054
+ {"es_event_sudo_t", fields_es_event_sudo_t, sizeof(fields_es_event_sudo_t) / sizeof(fields_es_event_sudo_t[0])},
1055
+ {"es_event_profile_add_t", fields_es_event_profile_add_t, sizeof(fields_es_event_profile_add_t) / sizeof(fields_es_event_profile_add_t[0])},
1056
+ {"es_event_profile_remove_t", fields_es_event_profile_remove_t, sizeof(fields_es_event_profile_remove_t) / sizeof(fields_es_event_profile_remove_t[0])},
1057
+ {"es_event_authorization_petition_t", fields_es_event_authorization_petition_t, sizeof(fields_es_event_authorization_petition_t) / sizeof(fields_es_event_authorization_petition_t[0])},
1058
+ {"es_authorization_result_t", fields_es_authorization_result_t, sizeof(fields_es_authorization_result_t) / sizeof(fields_es_authorization_result_t[0])},
1059
+ {"es_event_authorization_judgement_t", fields_es_event_authorization_judgement_t, sizeof(fields_es_event_authorization_judgement_t) / sizeof(fields_es_event_authorization_judgement_t[0])},
1060
+ {"es_od_member_id_t", fields_es_od_member_id_t, sizeof(fields_es_od_member_id_t) / sizeof(fields_es_od_member_id_t[0])},
1061
+ {"es_event_od_group_add_t", fields_es_event_od_group_add_t, sizeof(fields_es_event_od_group_add_t) / sizeof(fields_es_event_od_group_add_t[0])},
1062
+ {"es_event_od_group_remove_t", fields_es_event_od_group_remove_t, sizeof(fields_es_event_od_group_remove_t) / sizeof(fields_es_event_od_group_remove_t[0])},
1063
+ {"es_od_member_id_array_t", fields_es_od_member_id_array_t, sizeof(fields_es_od_member_id_array_t) / sizeof(fields_es_od_member_id_array_t[0])},
1064
+ {"es_event_od_group_set_t", fields_es_event_od_group_set_t, sizeof(fields_es_event_od_group_set_t) / sizeof(fields_es_event_od_group_set_t[0])},
1065
+ {"es_event_od_modify_password_t", fields_es_event_od_modify_password_t, sizeof(fields_es_event_od_modify_password_t) / sizeof(fields_es_event_od_modify_password_t[0])},
1066
+ {"es_event_od_disable_user_t", fields_es_event_od_disable_user_t, sizeof(fields_es_event_od_disable_user_t) / sizeof(fields_es_event_od_disable_user_t[0])},
1067
+ {"es_event_od_enable_user_t", fields_es_event_od_enable_user_t, sizeof(fields_es_event_od_enable_user_t) / sizeof(fields_es_event_od_enable_user_t[0])},
1068
+ {"es_event_od_attribute_value_add_t", fields_es_event_od_attribute_value_add_t, sizeof(fields_es_event_od_attribute_value_add_t) / sizeof(fields_es_event_od_attribute_value_add_t[0])},
1069
+ {"es_event_od_attribute_value_remove_t", fields_es_event_od_attribute_value_remove_t, sizeof(fields_es_event_od_attribute_value_remove_t) / sizeof(fields_es_event_od_attribute_value_remove_t[0])},
1070
+ {"es_event_od_attribute_set_t", fields_es_event_od_attribute_set_t, sizeof(fields_es_event_od_attribute_set_t) / sizeof(fields_es_event_od_attribute_set_t[0])},
1071
+ {"es_event_od_create_user_t", fields_es_event_od_create_user_t, sizeof(fields_es_event_od_create_user_t) / sizeof(fields_es_event_od_create_user_t[0])},
1072
+ {"es_event_od_create_group_t", fields_es_event_od_create_group_t, sizeof(fields_es_event_od_create_group_t) / sizeof(fields_es_event_od_create_group_t[0])},
1073
+ {"es_event_od_delete_user_t", fields_es_event_od_delete_user_t, sizeof(fields_es_event_od_delete_user_t) / sizeof(fields_es_event_od_delete_user_t[0])},
1074
+ {"es_event_od_delete_group_t", fields_es_event_od_delete_group_t, sizeof(fields_es_event_od_delete_group_t) / sizeof(fields_es_event_od_delete_group_t[0])},
1075
+ {"es_event_xpc_connect_t", fields_es_event_xpc_connect_t, sizeof(fields_es_event_xpc_connect_t) / sizeof(fields_es_event_xpc_connect_t[0])},
1076
+ {"es_event_gatekeeper_user_override_t", fields_es_event_gatekeeper_user_override_t, sizeof(fields_es_event_gatekeeper_user_override_t) / sizeof(fields_es_event_gatekeeper_user_override_t[0])},
1077
+ {"es_events_t", fields_es_events_t, sizeof(fields_es_events_t) / sizeof(fields_es_events_t[0])},
1078
+ {"es_result_t", fields_es_result_t, sizeof(fields_es_result_t) / sizeof(fields_es_result_t[0])},
1079
+ {"es_message_t", fields_es_message_t, sizeof(fields_es_message_t) / sizeof(fields_es_message_t[0])}
1080
+ };
1081
+ const size_t esrb_schema_count = sizeof(esrb_schemas) / sizeof(esrb_schemas[0]);
1082
+
1083
+ const esrb_event_schema_t esrb_event_schemas[] = {
1084
+ {0, offsetof(es_events_t, exec), "es_event_exec_t", sizeof(es_event_exec_t), false},
1085
+ {1, offsetof(es_events_t, open), "es_event_open_t", sizeof(es_event_open_t), false},
1086
+ {2, offsetof(es_events_t, kextload), "es_event_kextload_t", sizeof(es_event_kextload_t), false},
1087
+ {3, offsetof(es_events_t, mmap), "es_event_mmap_t", sizeof(es_event_mmap_t), false},
1088
+ {4, offsetof(es_events_t, mprotect), "es_event_mprotect_t", sizeof(es_event_mprotect_t), false},
1089
+ {5, offsetof(es_events_t, mount), "es_event_mount_t", sizeof(es_event_mount_t), false},
1090
+ {6, offsetof(es_events_t, rename), "es_event_rename_t", sizeof(es_event_rename_t), false},
1091
+ {7, offsetof(es_events_t, signal), "es_event_signal_t", sizeof(es_event_signal_t), false},
1092
+ {8, offsetof(es_events_t, unlink), "es_event_unlink_t", sizeof(es_event_unlink_t), false},
1093
+ {9, offsetof(es_events_t, exec), "es_event_exec_t", sizeof(es_event_exec_t), false},
1094
+ {10, offsetof(es_events_t, open), "es_event_open_t", sizeof(es_event_open_t), false},
1095
+ {11, offsetof(es_events_t, fork), "es_event_fork_t", sizeof(es_event_fork_t), false},
1096
+ {12, offsetof(es_events_t, close), "es_event_close_t", sizeof(es_event_close_t), false},
1097
+ {13, offsetof(es_events_t, create), "es_event_create_t", sizeof(es_event_create_t), false},
1098
+ {14, offsetof(es_events_t, exchangedata), "es_event_exchangedata_t", sizeof(es_event_exchangedata_t), false},
1099
+ {15, offsetof(es_events_t, exit), "es_event_exit_t", sizeof(es_event_exit_t), false},
1100
+ {16, offsetof(es_events_t, get_task), "es_event_get_task_t", sizeof(es_event_get_task_t), false},
1101
+ {17, offsetof(es_events_t, kextload), "es_event_kextload_t", sizeof(es_event_kextload_t), false},
1102
+ {18, offsetof(es_events_t, kextunload), "es_event_kextunload_t", sizeof(es_event_kextunload_t), false},
1103
+ {19, offsetof(es_events_t, link), "es_event_link_t", sizeof(es_event_link_t), false},
1104
+ {20, offsetof(es_events_t, mmap), "es_event_mmap_t", sizeof(es_event_mmap_t), false},
1105
+ {21, offsetof(es_events_t, mprotect), "es_event_mprotect_t", sizeof(es_event_mprotect_t), false},
1106
+ {22, offsetof(es_events_t, mount), "es_event_mount_t", sizeof(es_event_mount_t), false},
1107
+ {23, offsetof(es_events_t, unmount), "es_event_unmount_t", sizeof(es_event_unmount_t), false},
1108
+ {24, offsetof(es_events_t, iokit_open), "es_event_iokit_open_t", sizeof(es_event_iokit_open_t), false},
1109
+ {25, offsetof(es_events_t, rename), "es_event_rename_t", sizeof(es_event_rename_t), false},
1110
+ {26, offsetof(es_events_t, setattrlist), "es_event_setattrlist_t", sizeof(es_event_setattrlist_t), false},
1111
+ {27, offsetof(es_events_t, setextattr), "es_event_setextattr_t", sizeof(es_event_setextattr_t), false},
1112
+ {28, offsetof(es_events_t, setflags), "es_event_setflags_t", sizeof(es_event_setflags_t), false},
1113
+ {29, offsetof(es_events_t, setmode), "es_event_setmode_t", sizeof(es_event_setmode_t), false},
1114
+ {30, offsetof(es_events_t, setowner), "es_event_setowner_t", sizeof(es_event_setowner_t), false},
1115
+ {31, offsetof(es_events_t, signal), "es_event_signal_t", sizeof(es_event_signal_t), false},
1116
+ {32, offsetof(es_events_t, unlink), "es_event_unlink_t", sizeof(es_event_unlink_t), false},
1117
+ {33, offsetof(es_events_t, write), "es_event_write_t", sizeof(es_event_write_t), false},
1118
+ {34, offsetof(es_events_t, file_provider_materialize), "es_event_file_provider_materialize_t", sizeof(es_event_file_provider_materialize_t), false},
1119
+ {35, offsetof(es_events_t, file_provider_materialize), "es_event_file_provider_materialize_t", sizeof(es_event_file_provider_materialize_t), false},
1120
+ {36, offsetof(es_events_t, file_provider_update), "es_event_file_provider_update_t", sizeof(es_event_file_provider_update_t), false},
1121
+ {37, offsetof(es_events_t, file_provider_update), "es_event_file_provider_update_t", sizeof(es_event_file_provider_update_t), false},
1122
+ {38, offsetof(es_events_t, readlink), "es_event_readlink_t", sizeof(es_event_readlink_t), false},
1123
+ {39, offsetof(es_events_t, readlink), "es_event_readlink_t", sizeof(es_event_readlink_t), false},
1124
+ {40, offsetof(es_events_t, truncate), "es_event_truncate_t", sizeof(es_event_truncate_t), false},
1125
+ {41, offsetof(es_events_t, truncate), "es_event_truncate_t", sizeof(es_event_truncate_t), false},
1126
+ {42, offsetof(es_events_t, link), "es_event_link_t", sizeof(es_event_link_t), false},
1127
+ {43, offsetof(es_events_t, lookup), "es_event_lookup_t", sizeof(es_event_lookup_t), false},
1128
+ {44, offsetof(es_events_t, create), "es_event_create_t", sizeof(es_event_create_t), false},
1129
+ {45, offsetof(es_events_t, setattrlist), "es_event_setattrlist_t", sizeof(es_event_setattrlist_t), false},
1130
+ {46, offsetof(es_events_t, setextattr), "es_event_setextattr_t", sizeof(es_event_setextattr_t), false},
1131
+ {47, offsetof(es_events_t, setflags), "es_event_setflags_t", sizeof(es_event_setflags_t), false},
1132
+ {48, offsetof(es_events_t, setmode), "es_event_setmode_t", sizeof(es_event_setmode_t), false},
1133
+ {49, offsetof(es_events_t, setowner), "es_event_setowner_t", sizeof(es_event_setowner_t), false},
1134
+ {50, offsetof(es_events_t, chdir), "es_event_chdir_t", sizeof(es_event_chdir_t), false},
1135
+ {51, offsetof(es_events_t, chdir), "es_event_chdir_t", sizeof(es_event_chdir_t), false},
1136
+ {52, offsetof(es_events_t, getattrlist), "es_event_getattrlist_t", sizeof(es_event_getattrlist_t), false},
1137
+ {53, offsetof(es_events_t, getattrlist), "es_event_getattrlist_t", sizeof(es_event_getattrlist_t), false},
1138
+ {54, offsetof(es_events_t, stat), "es_event_stat_t", sizeof(es_event_stat_t), false},
1139
+ {55, offsetof(es_events_t, access), "es_event_access_t", sizeof(es_event_access_t), false},
1140
+ {56, offsetof(es_events_t, chroot), "es_event_chroot_t", sizeof(es_event_chroot_t), false},
1141
+ {57, offsetof(es_events_t, chroot), "es_event_chroot_t", sizeof(es_event_chroot_t), false},
1142
+ {58, offsetof(es_events_t, utimes), "es_event_utimes_t", sizeof(es_event_utimes_t), false},
1143
+ {59, offsetof(es_events_t, utimes), "es_event_utimes_t", sizeof(es_event_utimes_t), false},
1144
+ {60, offsetof(es_events_t, clone), "es_event_clone_t", sizeof(es_event_clone_t), false},
1145
+ {61, offsetof(es_events_t, clone), "es_event_clone_t", sizeof(es_event_clone_t), false},
1146
+ {62, offsetof(es_events_t, fcntl), "es_event_fcntl_t", sizeof(es_event_fcntl_t), false},
1147
+ {63, offsetof(es_events_t, getextattr), "es_event_getextattr_t", sizeof(es_event_getextattr_t), false},
1148
+ {64, offsetof(es_events_t, getextattr), "es_event_getextattr_t", sizeof(es_event_getextattr_t), false},
1149
+ {65, offsetof(es_events_t, listextattr), "es_event_listextattr_t", sizeof(es_event_listextattr_t), false},
1150
+ {66, offsetof(es_events_t, listextattr), "es_event_listextattr_t", sizeof(es_event_listextattr_t), false},
1151
+ {67, offsetof(es_events_t, readdir), "es_event_readdir_t", sizeof(es_event_readdir_t), false},
1152
+ {68, offsetof(es_events_t, readdir), "es_event_readdir_t", sizeof(es_event_readdir_t), false},
1153
+ {69, offsetof(es_events_t, deleteextattr), "es_event_deleteextattr_t", sizeof(es_event_deleteextattr_t), false},
1154
+ {70, offsetof(es_events_t, deleteextattr), "es_event_deleteextattr_t", sizeof(es_event_deleteextattr_t), false},
1155
+ {71, offsetof(es_events_t, fsgetpath), "es_event_fsgetpath_t", sizeof(es_event_fsgetpath_t), false},
1156
+ {72, offsetof(es_events_t, fsgetpath), "es_event_fsgetpath_t", sizeof(es_event_fsgetpath_t), false},
1157
+ {73, offsetof(es_events_t, dup), "es_event_dup_t", sizeof(es_event_dup_t), false},
1158
+ {74, offsetof(es_events_t, settime), "es_event_settime_t", sizeof(es_event_settime_t), false},
1159
+ {75, offsetof(es_events_t, settime), "es_event_settime_t", sizeof(es_event_settime_t), false},
1160
+ {76, offsetof(es_events_t, uipc_bind), "es_event_uipc_bind_t", sizeof(es_event_uipc_bind_t), false},
1161
+ {77, offsetof(es_events_t, uipc_bind), "es_event_uipc_bind_t", sizeof(es_event_uipc_bind_t), false},
1162
+ {78, offsetof(es_events_t, uipc_connect), "es_event_uipc_connect_t", sizeof(es_event_uipc_connect_t), false},
1163
+ {79, offsetof(es_events_t, uipc_connect), "es_event_uipc_connect_t", sizeof(es_event_uipc_connect_t), false},
1164
+ {80, offsetof(es_events_t, exchangedata), "es_event_exchangedata_t", sizeof(es_event_exchangedata_t), false},
1165
+ {81, offsetof(es_events_t, setacl), "es_event_setacl_t", sizeof(es_event_setacl_t), false},
1166
+ {82, offsetof(es_events_t, setacl), "es_event_setacl_t", sizeof(es_event_setacl_t), false},
1167
+ {83, offsetof(es_events_t, pty_grant), "es_event_pty_grant_t", sizeof(es_event_pty_grant_t), false},
1168
+ {84, offsetof(es_events_t, pty_close), "es_event_pty_close_t", sizeof(es_event_pty_close_t), false},
1169
+ {85, offsetof(es_events_t, proc_check), "es_event_proc_check_t", sizeof(es_event_proc_check_t), false},
1170
+ {86, offsetof(es_events_t, proc_check), "es_event_proc_check_t", sizeof(es_event_proc_check_t), false},
1171
+ {87, offsetof(es_events_t, get_task), "es_event_get_task_t", sizeof(es_event_get_task_t), false},
1172
+ {88, offsetof(es_events_t, searchfs), "es_event_searchfs_t", sizeof(es_event_searchfs_t), false},
1173
+ {89, offsetof(es_events_t, searchfs), "es_event_searchfs_t", sizeof(es_event_searchfs_t), false},
1174
+ {90, offsetof(es_events_t, fcntl), "es_event_fcntl_t", sizeof(es_event_fcntl_t), false},
1175
+ {91, offsetof(es_events_t, iokit_open), "es_event_iokit_open_t", sizeof(es_event_iokit_open_t), false},
1176
+ {92, offsetof(es_events_t, proc_suspend_resume), "es_event_proc_suspend_resume_t", sizeof(es_event_proc_suspend_resume_t), false},
1177
+ {93, offsetof(es_events_t, proc_suspend_resume), "es_event_proc_suspend_resume_t", sizeof(es_event_proc_suspend_resume_t), false},
1178
+ {94, offsetof(es_events_t, cs_invalidated), "es_event_cs_invalidated_t", sizeof(es_event_cs_invalidated_t), false},
1179
+ {95, offsetof(es_events_t, get_task_name), "es_event_get_task_name_t", sizeof(es_event_get_task_name_t), false},
1180
+ {96, offsetof(es_events_t, trace), "es_event_trace_t", sizeof(es_event_trace_t), false},
1181
+ {97, offsetof(es_events_t, remote_thread_create), "es_event_remote_thread_create_t", sizeof(es_event_remote_thread_create_t), false},
1182
+ {98, offsetof(es_events_t, remount), "es_event_remount_t", sizeof(es_event_remount_t), false},
1183
+ {99, offsetof(es_events_t, remount), "es_event_remount_t", sizeof(es_event_remount_t), false},
1184
+ {100, offsetof(es_events_t, get_task_read), "es_event_get_task_read_t", sizeof(es_event_get_task_read_t), false},
1185
+ {101, offsetof(es_events_t, get_task_read), "es_event_get_task_read_t", sizeof(es_event_get_task_read_t), false},
1186
+ {102, offsetof(es_events_t, get_task_inspect), "es_event_get_task_inspect_t", sizeof(es_event_get_task_inspect_t), false},
1187
+ {103, offsetof(es_events_t, setuid), "es_event_setuid_t", sizeof(es_event_setuid_t), false},
1188
+ {104, offsetof(es_events_t, setgid), "es_event_setgid_t", sizeof(es_event_setgid_t), false},
1189
+ {105, offsetof(es_events_t, seteuid), "es_event_seteuid_t", sizeof(es_event_seteuid_t), false},
1190
+ {106, offsetof(es_events_t, setegid), "es_event_setegid_t", sizeof(es_event_setegid_t), false},
1191
+ {107, offsetof(es_events_t, setreuid), "es_event_setreuid_t", sizeof(es_event_setreuid_t), false},
1192
+ {108, offsetof(es_events_t, setregid), "es_event_setregid_t", sizeof(es_event_setregid_t), false},
1193
+ {109, offsetof(es_events_t, copyfile), "es_event_copyfile_t", sizeof(es_event_copyfile_t), false},
1194
+ {110, offsetof(es_events_t, copyfile), "es_event_copyfile_t", sizeof(es_event_copyfile_t), false},
1195
+ {111, offsetof(es_events_t, authentication), "es_event_authentication_t", sizeof(es_event_authentication_t), true},
1196
+ {112, offsetof(es_events_t, xp_malware_detected), "es_event_xp_malware_detected_t", sizeof(es_event_xp_malware_detected_t), true},
1197
+ {113, offsetof(es_events_t, xp_malware_remediated), "es_event_xp_malware_remediated_t", sizeof(es_event_xp_malware_remediated_t), true},
1198
+ {114, offsetof(es_events_t, lw_session_login), "es_event_lw_session_login_t", sizeof(es_event_lw_session_login_t), true},
1199
+ {115, offsetof(es_events_t, lw_session_logout), "es_event_lw_session_logout_t", sizeof(es_event_lw_session_logout_t), true},
1200
+ {116, offsetof(es_events_t, lw_session_lock), "es_event_lw_session_lock_t", sizeof(es_event_lw_session_lock_t), true},
1201
+ {117, offsetof(es_events_t, lw_session_unlock), "es_event_lw_session_unlock_t", sizeof(es_event_lw_session_unlock_t), true},
1202
+ {118, offsetof(es_events_t, screensharing_attach), "es_event_screensharing_attach_t", sizeof(es_event_screensharing_attach_t), true},
1203
+ {119, offsetof(es_events_t, screensharing_detach), "es_event_screensharing_detach_t", sizeof(es_event_screensharing_detach_t), true},
1204
+ {120, offsetof(es_events_t, openssh_login), "es_event_openssh_login_t", sizeof(es_event_openssh_login_t), true},
1205
+ {121, offsetof(es_events_t, openssh_logout), "es_event_openssh_logout_t", sizeof(es_event_openssh_logout_t), true},
1206
+ {122, offsetof(es_events_t, login_login), "es_event_login_login_t", sizeof(es_event_login_login_t), true},
1207
+ {123, offsetof(es_events_t, login_logout), "es_event_login_logout_t", sizeof(es_event_login_logout_t), true},
1208
+ {124, offsetof(es_events_t, btm_launch_item_add), "es_event_btm_launch_item_add_t", sizeof(es_event_btm_launch_item_add_t), true},
1209
+ {125, offsetof(es_events_t, btm_launch_item_remove), "es_event_btm_launch_item_remove_t", sizeof(es_event_btm_launch_item_remove_t), true},
1210
+ {126, offsetof(es_events_t, profile_add), "es_event_profile_add_t", sizeof(es_event_profile_add_t), true},
1211
+ {127, offsetof(es_events_t, profile_remove), "es_event_profile_remove_t", sizeof(es_event_profile_remove_t), true},
1212
+ {128, offsetof(es_events_t, su), "es_event_su_t", sizeof(es_event_su_t), true},
1213
+ {129, offsetof(es_events_t, authorization_petition), "es_event_authorization_petition_t", sizeof(es_event_authorization_petition_t), true},
1214
+ {130, offsetof(es_events_t, authorization_judgement), "es_event_authorization_judgement_t", sizeof(es_event_authorization_judgement_t), true},
1215
+ {131, offsetof(es_events_t, sudo), "es_event_sudo_t", sizeof(es_event_sudo_t), true},
1216
+ {132, offsetof(es_events_t, od_group_add), "es_event_od_group_add_t", sizeof(es_event_od_group_add_t), true},
1217
+ {133, offsetof(es_events_t, od_group_remove), "es_event_od_group_remove_t", sizeof(es_event_od_group_remove_t), true},
1218
+ {134, offsetof(es_events_t, od_group_set), "es_event_od_group_set_t", sizeof(es_event_od_group_set_t), true},
1219
+ {135, offsetof(es_events_t, od_modify_password), "es_event_od_modify_password_t", sizeof(es_event_od_modify_password_t), true},
1220
+ {136, offsetof(es_events_t, od_disable_user), "es_event_od_disable_user_t", sizeof(es_event_od_disable_user_t), true},
1221
+ {137, offsetof(es_events_t, od_enable_user), "es_event_od_enable_user_t", sizeof(es_event_od_enable_user_t), true},
1222
+ {138, offsetof(es_events_t, od_attribute_value_add), "es_event_od_attribute_value_add_t", sizeof(es_event_od_attribute_value_add_t), true},
1223
+ {139, offsetof(es_events_t, od_attribute_value_remove), "es_event_od_attribute_value_remove_t", sizeof(es_event_od_attribute_value_remove_t), true},
1224
+ {140, offsetof(es_events_t, od_attribute_set), "es_event_od_attribute_set_t", sizeof(es_event_od_attribute_set_t), true},
1225
+ {141, offsetof(es_events_t, od_create_user), "es_event_od_create_user_t", sizeof(es_event_od_create_user_t), true},
1226
+ {142, offsetof(es_events_t, od_create_group), "es_event_od_create_group_t", sizeof(es_event_od_create_group_t), true},
1227
+ {143, offsetof(es_events_t, od_delete_user), "es_event_od_delete_user_t", sizeof(es_event_od_delete_user_t), true},
1228
+ {144, offsetof(es_events_t, od_delete_group), "es_event_od_delete_group_t", sizeof(es_event_od_delete_group_t), true},
1229
+ {145, offsetof(es_events_t, xpc_connect), "es_event_xpc_connect_t", sizeof(es_event_xpc_connect_t), true},
1230
+ {146, offsetof(es_events_t, gatekeeper_user_override), "es_event_gatekeeper_user_override_t", sizeof(es_event_gatekeeper_user_override_t), true},
1231
+ {147, offsetof(es_events_t, tcc_modify), "es_event_tcc_modify_t", sizeof(es_event_tcc_modify_t), true}
1232
+ };
1233
+ const size_t esrb_event_schema_count = sizeof(esrb_event_schemas) / sizeof(esrb_event_schemas[0]);