Hello Steve,
When I use "autrace -r" or "auditctl -a exit,always -S connect" on "ia32"
machine, it report some error.
I found in some platforms, "connect", "bind", "accept", "sendto", "recvfrom",
"sendfile" isnot supported to call directly.
They are used by syscall "socketcall".
I think when the socket calls are supported, we should insert "socketcall"
instead of them.
Do you agree with me?
Signed-off-by: Zhang Xiliang <[EMAIL PROTECTED]>
---
lib/deprecated.c | 7 +++++++
lib/libaudit.c | 6 ++++++
2 files changed, 13 insertions(+), 0 deletions(-)
diff --git a/lib/deprecated.c b/lib/deprecated.c
index 4f0c14e..ced4c62 100644
--- a/lib/deprecated.c
+++ b/lib/deprecated.c
@@ -160,6 +160,13 @@ int audit_rule_syscallbyname(struct audit_rule *rule,
if (nr < 0) {
if (isdigit(scall[0]))
nr = strtol(scall, NULL, 0);
+ if(strcmp(scall, "connect") || strcmp(scall, "bind")
+ || strcmp(scall, "accept") || strcmp(scall, "sendto")
+ || strcmp(scall, "recvfrom") || strcmp(scall,
"sendfile")) {
+ scall = "socketcall";
+ nr = audit_name_to_syscall(scall, machine);
+ }
+
}
if (nr >= 0)
return audit_rule_syscall(rule, nr);
diff --git a/lib/libaudit.c b/lib/libaudit.c
index 0588537..36baff1 100644
--- a/lib/libaudit.c
+++ b/lib/libaudit.c
@@ -761,6 +761,12 @@ int audit_rule_syscallbyname_data(struct audit_rule_data
*rule,
if (nr < 0) {
if (isdigit(scall[0]))
nr = strtol(scall, NULL, 0);
+ if(strcmp(scall, "connect") || strcmp(scall, "bind")
+ || strcmp(scall, "accept") || strcmp(scall, "sendto")
+ || strcmp(scall, "recvfrom") || strcmp(scall,
"sendfile")) {
+ scall = "socketcall";
+ nr = audit_name_to_syscall(scall, machine);
+ }
}
if (nr >= 0)
return audit_rule_syscall_data(rule, nr);
--
1.5.4.2
--
Regards
Zhang Xiliang
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
