/**
@file si_templates.h
@brief Common templates used in SI events
@details Copyright (c) 2024 Acronis International GmbH
@author Denis Kopyrin (denis.kopyrin@acronis.com)
@since $Id: $
*/
#pragma once
#include "si_fp_properties.h"
#define SI_CONTAINER_NAME_LIMIT 128
// Currently all events have at least the following fields
// Might be revised at the future but currently all of those are used by userspace
#define SI_COMMON_FIELDS \
FP_SI_PI_EVENT_UID, \
FP_SI_PI_THREAD_ID, \
FP_SI_PI_PROCESS_ID, \
FP_SI_PI_EVENT_TIMESTAMP, \
FP_SI_PI_PROCESS_ID_VERSION
#define SI_COMMON_FS_FIELDS SI_COMMON_FIELDS, \
FP_SI_PI_FSUID, \
FP_SI_PI_FSGID
#define SI_COMMON_CRED_FIELDS \
FP_SI_PI_USER_ID, \
FP_SI_PI_GROUP_ID, \
FP_SI_PI_EFFECTIVE_USER_ID, \
FP_SI_PI_EFFECTIVE_GROUP_ID, \
FP_SI_PI_SAVED_USER_ID, \
FP_SI_PI_SAVED_GROUP_ID, \
FP_SI_PI_AUDIT_SESSION_ID, \
FP_SI_PI_AUDIT_USER_ID
#define SI_COMMON_OBJECT_FILE_IDS_FIELDS \
FP_SI_PI_OBJECT_ID, \
FP_SI_PI_OBJECT_FILE_GENERATION, \
FP_SI_PI_OBJECT_FILE_PTR, \
FP_SI_PI_OBJECT_FILE_HANDLE, \
FP_SI_PI_OBJECT_FILE_MOUNT_ID, \
FP_SI_PI_FILE_ATTRIBUTES, \
FP_SI_PI_FILE_MODE, \
FP_SI_PI_FILE_SIZE, \
FP_SI_PI_FILE_UID, \
FP_SI_PI_FILE_GID, \
FP_SI_PI_FILE_CHANGE_TIME, \
FP_SI_PI_FILE_BIRTH_TIME, \
FP_SI_PI_FILE_ACCESS_TIME, \
FP_SI_PI_FILE_MODIFICATION_TIME, \
FP_SI_PI_VOLUME_ID_HIGH, \
FP_SI_PI_VOLUME_ID_LOW, \
FP_SI_PI_VOLUME_MAGIC
#define SI_COMMON_OBJECT_FILE_FIELDS \
FP_SI_PI_OBJECT_NAME, \
SI_COMMON_OBJECT_FILE_IDS_FIELDS
#define SI_COMMON_IMAGE_NAME_FIELDS \
FP_SI_PI_IMAGE_FILE_NAME, \
FP_SI_PI_PROCESS_FILE_NAME_IS_NOT_PATH
#define SI_COMMON_EXE_FILE_FIELDS \
SI_COMMON_IMAGE_NAME_FIELDS, \
SI_COMMON_OBJECT_FILE_IDS_FIELDS
#define SI_COMMON_TARGET_FILE_FIELDS \
FP_SI_PI_TARGET_NAME, \
FP_SI_PI_TARGET_ID, \
FP_SI_PI_TARGET_FILE_GENERATION, \
FP_SI_PI_TARGET_FILE_PTR, \
FP_SI_PI_TARGET_FILE_HANDLE, \
FP_SI_PI_TARGET_FILE_MOUNT_ID, \
FP_SI_PI_TARGET_FILE_ATTRIBUTES, \
FP_SI_PI_TARGET_FILE_MODE, \
FP_SI_PI_TARGET_FILE_SIZE, \
FP_SI_PI_TARGET_FILE_UID, \
FP_SI_PI_TARGET_FILE_GID, \
FP_SI_PI_TARGET_FILE_CHANGE_TIME, \
FP_SI_PI_TARGET_FILE_BIRTH_TIME, \
FP_SI_PI_TARGET_FILE_ACCESS_TIME, \
FP_SI_PI_TARGET_FILE_MODIFICATION_TIME
#define SI_COMMON_OBJECT_MINI_FILE_FIELDS \
FP_SI_PI_OBJECT_ID, \
FP_SI_PI_OBJECT_FILE_GENERATION, \
FP_SI_PI_OBJECT_FILE_PTR
|