[Samba] HEX-value in log during audit

[Stefan Kania]

Am 05.04.22 um 19:08 schrieb Christof Schmitt:
> On Tue, Apr 05, 2022 at 04:39:20PM +0200, Stefan Kania via samba wrote:
>> Hi to all,
>>
>> short question:
>> If I activate auditing in smb.conf like this:
>> --------
>>     full_audit:failure = none
>>     full_audit:success = renameat create_file write
>>     full_audit:prefix = IP=%I|USER=%u|MACHINE=%m|VOLUME=%S
>>     full_audit:facility = local5
>>     full_audit:priority = NOTICE
>> --------
>> I see
>>
>> .....VOLUME=xxx|create_file|ok|0x100081|file|open|/xxx
>>
>> -------
>> What is the meaning of the HEX value "0x100081"
> 
> That is the "desired access" from the create request. In this case, the
> client is asking to open the file with READ_DATA and READ_ATTRIBUTES
> (and SYNCHRONIZE which is basically ignored).
Is there a list with all the used values? Or do I have to seach through
the source-code?
> 
> Christof