My environment:
CPU: Kunpeng 910
arch: aarch64
system: Kylin Linux Advanced Server release V10 (Tercel)
kernel: 4.19.90-23.6.v2101.ky10.aarch64
auditd version:
audit-libs-3.0-5.se.06.ky10.aarch64
audit-3.0-5.se.06.ky10.aarch64
python3-audit-3.0-5.se.06.ky10.aarch64
Auditd process uses an increasi
Hi everyone,
there does not seem to be a way to access the AUDIT_ARCH_ constant that matches
the currently visible syscall numbers (__NR_...) from the kernel uapi headers.
Background:
I am writing a seccomp BPF filter using the syscall constants to get the
correct syscall numbers for the target
On Mon, Jun 28, 2021 at 9:25 AM Thomas Weißschuh wrote:
>
> Hi everyone,
>
> there does not seem to be a way to access the AUDIT_ARCH_ constant that
> matches
> the currently visible syscall numbers (__NR_...) from the kernel uapi headers.
Looking at Linus' current tree I see the AUDIT_ARCH_* de
Hi Paul,
thanks for your response!
On Mo, 2021-06-28T12:59-0400, Paul Moore wrote:
> On Mon, Jun 28, 2021 at 9:25 AM Thomas Weißschuh wrote:
> >
> > Hi everyone,
> >
> > there does not seem to be a way to access the AUDIT_ARCH_ constant that
> > matches
> > the currently visible syscall numbers
On Mon, Jun 28, 2021 at 1:13 PM Thomas Weißschuh wrote:
>
> Hi Paul,
>
> thanks for your response!
Hi :)
> On Mo, 2021-06-28T12:59-0400, Paul Moore wrote:
> > On Mon, Jun 28, 2021 at 9:25 AM Thomas Weißschuh
> > wrote:
> > >
> > > Hi everyone,
> > >
> > > there does not seem to be a way to acc
Hi again!
On Mo, 2021-06-28T13:34-0400, Paul Moore wrote:
> On Mon, Jun 28, 2021 at 1:13 PM Thomas Weißschuh wrote:
> > On Mo, 2021-06-28T12:59-0400, Paul Moore wrote:
> > > On Mon, Jun 28, 2021 at 9:25 AM Thomas Weißschuh
> > > wrote:
> > > >
> > > > Hi everyone,
> > > >
> > > > there does not
On Mon, Jun 28, 2021 at 1:58 PM Thomas Weißschuh wrote:
>
> Hi again!
!!! :)
> On Mo, 2021-06-28T13:34-0400, Paul Moore wrote:
> > On Mon, Jun 28, 2021 at 1:13 PM Thomas Weißschuh
> > wrote:
> > > On Mo, 2021-06-28T12:59-0400, Paul Moore wrote:
> > > > On Mon, Jun 28, 2021 at 9:25 AM Thomas We