Automatically generated do not edit!
| As defined in #include<linux/provenance_types.h> | string in configuration file and CLI | Description |
|---|---|---|
| RL_UNKNOWN | unknown | unknown relation should not happen |
| RL_READ | read | read to inode |
| RL_READ_IOCTL | read_ioctl | ioctl read |
| RL_WRITE | write | write to inode |
| RL_WRITE_IOCTL | write_ioctl | ioctl write |
| RL_CLONE_MEM | clone_mem | memory copy on clone |
| RL_MSG_CREATE | msg_create | create msg |
| RL_SOCKET_CREATE | socket_create | create socket |
| RL_SOCKET_PAIR_CREATE | socket_pair_create | create socket pair |
| RL_INODE_CREATE | inode_create | create inode |
| RL_SETUID | setuid | setuid |
| RL_SETGID | setpgid | setpgid |
| RL_GETGID | getpgid | getpgid |
| RL_SH_WRITE | sh_write | writing to shared state |
| RL_PROC_WRITE | memory_write | writing to process memory |
| RL_BIND | bind | socket bind operation |
| RL_CONNECT | connect | socket connection operation |
| RL_CONNECT_UNIX_STREAM | connect_unix_stream | unix stream socket connection operation |
| RL_LISTEN | listen | socket listen operation |
| RL_ACCEPT | accept | socket accept operation |
| RL_OPEN | open | file open operation |
| RL_FILE_RCV | file_rcv | open file descriptor recevied through IPC |
| RL_FILE_LOCK | file_lock | represent file lock operation |
| RL_FILE_SIGIO | file_sigio | represent IO signal |
| RL_VERSION | version_entity | connect version of entity object |
| RL_LINK | link | create a link |
| RL_RENAME | rename | rename inode |
| RL_UNLINK | unlink | delete a link |
| RL_SYMLINK | symlink | create a symlink |
| RL_SPLICE_OUT | splice_out | pipe splice operation to out file |
| RL_SETATTR | setattr | setattr operation |
| RL_SETATTR_INODE | setattr_inode | setattr operation |
| RL_ACCEPT_SOCKET | accept_socket | accept operation |
| RL_SETXATTR | setxattr | setxattr operation |
| RL_SETXATTR_INODE | setxattr_inode | setxattr operation |
| RL_RMVXATTR | removexattr | remove xattr operation |
| RL_RMVXATTR_INODE | removexattr_inode | remove xattr operation |
| RL_NAMED | named | connect path to inode |
| RL_ADDRESSED | addressed | connect address to inode |
| RL_EXEC | exec | exec operation |
| RL_EXEC_TASK | exec_task | exec operation |
| RL_PCK_CNT | packet_content | connect netwrok packet to its content |
| RL_CLONE | clone | clone operation |
| RL_VERSION_TASK | version_activity | connection two versions of an activity |
| RL_SEARCH | search | search operation on directory |
| RL_GETATTR | getattr | getattr operation |
| RL_GETXATTR | getxattr | getxattr operation |
| RL_GETXATTR_INODE | getxattr_inode | getxattr operation |
| RL_LSTXATTR | listxattr | listxattr operation |
| RL_READ_LINK | read_link | readlink operation |
| RL_MMAP | mmap | mmap mountings |
| RL_MMAP_PRIVATE | mmap_private | mmap private mounting |
| RL_SH_READ | sh_read | sh_read operation |
| RL_PROC_READ | memory_read | read from process memory |
| RL_SND | send | send over socket |
| RL_SND_PACKET | send_packet | connect socket to packet on send operation |
| RL_SND_UNIX | send_unix | send over unix socket |
| RL_SND_MSG | send_msg | send message |
| RL_SND_MSG_Q | send_msg_queue | send message to queue |
| RL_RCV | receive | receive socket operation |
| RL_RCV_PACKET | receive_packet | connect packet to socket on receive operation |
| RL_RCV_UNIX | receive_unix | receive on unix socket |
| RL_RCV_MSG | receive_msg | receive message |
| RL_RCV_MSG_Q | receive_msg_queue | receive message from queue |
| RL_PERM | perm_check | check permission |
| RL_TERMINATE_TASK | terminate_task | created when task data structure is freed |
| RL_TERMINATE_PROC | terminate_proc | created when cred data structure is freed |
| RL_FREED | free | created when an inode is freed |
| RL_ARG | arg | connect arg value to process |
| RL_ENV | env | connect env value to process |
| RL_LOG | log | connect string to task |
| RL_SH_ATTACH | sh_attach | attach sh |
| RL_SH_CREATE | sh_create | sh create perm |
| RL_LOAD_FILE | load_file | load file into kernel |
| RL_RAN_ON | ran_on | task run on this machine |
| RL_LOAD_UNKNOWN | load_unknown | load file into kernel |
| RL_LOAD_FIRMWARE | load_firmware | load file into kernel |
| RL_LOAD_MODULE | load_module | load file into kernel |
| RL_LOAD_KEXEC_IMAGE | load_kexec_image | load file into kernel |
| RL_LOAD_KEXEC_INITRAMFS | load_kexec_initramfs | load file into kernel |
| RL_LOAD_POLICY | load_policy | load file into kernel |
| RL_LOAD_CERTIFICATE | load_certificate | load file into kernel |
| RL_LOAD_UNDEFINED | load_undefined | load file into kernel |
| RL_PTRACE_ATTACH | ptrace_attach | ptrace attach effect on memory |
| RL_PTRACE_READ | ptrace_read | ptrace read from mem |
| RL_PTRACE_ATTACH_TASK | ptrace_attach_task | write info via ptrace effect on task |
| RL_PTRACE_READ_TASK | ptrace_read_task | read info via ptrace effect on task |
| RL_PTRACE_TRACEME | ptrace_traceme | track ptrace_traceme |
| RL_DERIVED_DISC | derived_disc | disclosed type |
| RL_GENERATED_DISC | generated_disc | disclosed type |
| RL_USED_DISC | used_disc | disclosed type |
| RL_INFORMED_DISC | informed_disc | disclosed type |
| RL_INFLUENCED_DISC | influenced_disc | disclosed type |
| RL_ASSOCIATED_DISC | associated_disc | disclosed type |