On Wed, Nov 07, 2018 at 04:27:51AM +0100, Elvira Khabirova wrote: [...] > The structure was chosen according to [2], except for two changes. > First: instead of an arch field with a value of AUDIT_ARCH_*, a boolean > is_compat value is returned, because a) not all arches have an AUDIT_ARCH_* > defined for them,
To be more specific, here is the list of arch subtrees in v4.20-rc1 that invoke tracehook_report_syscall_entry() but do not provide syscall_get_arch(): arch/arc arch/c6x arch/h8300 arch/hexagon arch/m68k arch/nds32 arch/nios2 arch/riscv arch/um arch/xtensa Among these trees only m68k has its AUDIT_ARCH_M68K constant defined. -- ldv
