From where ANOM_MK_EXEC , ANOM_ROOT_TRANS ,comes ?

[Lev Olshvang]

Hello list


There are particularly interesting for IDS evens , like  ANOM_MK_EXEC , ANOM_ROOT_TRANS
These audit events are listed in RHEL7 Security guide.

On my Ubuntu distro they are absent on user space level /usr/include/linux/audit.h 

I have RHEL7 kernel sourcel linux-3.10.0-514.16.1.el7  which I downloaded from Centos


 ANOM_MK_EXE,  ANOM_ROOT_TRANS does not appear there, neither in include

linux-3.10.0-514.16.1.el7/include/uapi/linux/audit.h  nor in c files


Please help me to unsderstand who sends these events ?


ThanX, 
Lev