[+ Cc: Eric]
On 01/18/2014 12:05 AM, Will Deacon wrote:
On Fri, Jan 17, 2014 at 08:15:29AM +0000, AKASHI Takahiro wrote:
For 32-bit task auditing (-F arch=b32), internally-used machine type will
be overwritten to MACH_ARM[EB] in order to use a correct system call
lookup table.
Signed-off-by: AKASHI Takahiro <[email protected]>
---
lib/libaudit.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/lib/libaudit.c b/lib/libaudit.c
index 77b3f9b..df2af2a 100644
--- a/lib/libaudit.c
+++ b/lib/libaudit.c
@@ -1306,6 +1306,12 @@ int audit_rule_fieldpair_data(struct audit_rule_data
**rulep, const char *pair,
else if (bits == ~__AUDIT_ARCH_64BIT &&
machine == MACH_S390X)
machine = MACH_S390;
+ else if (bits == ~__AUDIT_ARCH_64BIT &&
+ machine == MACH_AARCH64)
+ machine = MACH_ARM;
+ else if (bits == ~__AUDIT_ARCH_64BIT &&
+ machine == MACH_AARCH64EB)
+ machine = MACH_ARMEB;
Why do you care about MACH_ARMEB? The syscall APIs are identical for either
endianness.
Yeah, I remember that you have already mentioned it before:
On 11/08/2013 11:34 PM, Will Deacon wrote:
> On Wed, Nov 06, 2013 at 10:25:42AM +0000, AKASHI Takahiro wrote:
>> * Userspace audit package
>> There are some missing syscall definitions in lib/aarch64_table.h.
>> There is no support for AUDIT_ARCH_ARM (I mean LE. armeb is BE).
>
> I did post something over a year ago... did it not get picked up?
>
> http://permalink.gmane.org/gmane.linux.ports.arm.kernel/165266
But since then, I've never got any follow-ups from audit folks (especially Eric)
and so just kept the code unchanged and made my changes compatible with it.
Once we all agree, I will be easily able to remove such a conditional.
-Takahiro AKASHI
Will
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
