AUE_CHROOT

Changement de racine

Le journal de changement de racine est généré lorsqu’un processus effectue un appel pour déplacer son répertoire racine vers un nouvel emplacement.

Log Level (Niveau du journal)

1

Requiert l’option Verbose (Détaillé)

Non

AUE_CHROOT Example

Exemple de journal de télémétrie pour un changement de racine.

{
  "attributes": {
    "device": 0,
    "owner_group_name": "sys",
    "owner_user_id": 0,
    "owner_user_name": "root",
    "file_system_id": 16777224,
    "file_access_mode": 16877,
    "node_id": 977878,
    "owner_group_id": 3
  },
  "exec_chain": {
    "uuid": "49449E26-B564-41B5-8CF8-47D44E311428"
  },
  "exec_chain_child": {
    "parent_path": "/usr/sbin/sshd",
    "parent_pid": 1770,
    "parent_uuid": "66EC21CC-CF99-4E1D-B7FC-0D0BBF854CA9"
  },
  "header": {
    "time_seconds_epoch": 1657906217,
    "time_milliseconds_offset": 860,
    "version": 11,
    "event_modifier": 0,
    "event_id": 24,
    "event_name": "AUE_CHROOT"
  },
  "host_info": {
    "serial_number": "C03WG0H4HDTS",
    "host_name": "Test_MacBook_Pro",
    "osversion": "Version 12.4 (Build 21F79)",
    "host_uuid": "8891C1E2-0AC0-4E4A-844B-EA491B14D115"
  },
  "identity": {
    "signer_id": "com.apple.sshd",
    "team_id_truncated": false,
    "signer_id_truncated": false,
    "cd_hash": "29a77f01454fa21febed72b99bcd11251ab4a703",
    "team_id": "",
    "signer_type": 1
  },
  "key": "A50F9BD9-A971-4DCD-A862-3F2BE3A36549",
  "path": [
    "/var/empty",
    "/private/var/empty"
  ],
  "return": {
    "error": 0,
    "description": "success",
    "return_value": 0
  },
  "subject": {
    "session_id": 100000,
    "group_id": 0,
    "process_name": "/usr/sbin/sshd",
    "parent_pid": 1770,
    "effective_user_name": "root",
    "user_id": 0,
    "group_name": "wheel",
    "parent_uuid": "66EC21CC-CF99-4E1D-B7FC-0D0BBF854CA9",
    "uuid": "49449E26-B564-41B5-8CF8-47D44E311428",
    "effective_group_id": 0,
    "process_hash": "4a0c08cd4acfa971a9e9d3a07edc86214b38e334",
    "audit_id": 4294967295,
    "responsible_process_id": 1770,
    "parent_path": "/usr/sbin/sshd",
    "process_id": 1771,
    "effective_group_name": "wheel",
    "audit_user_name": "",
    "effective_user_id": 0,
    "terminal_id": {
      "type": 4,
      "ip_address": "0.0.0.0",
      "port": 0
    },
    "responsible_process_name": "/usr/sbin/sshd",
    "user_name": "root"
  }
}