For 32-bit task auditing (-F arch=b32), internally-used machine type will be overwritten to MACH_ARM in order to use a correct system call lookup table.
Signed-off-by: AKASHI Takahiro <[email protected]> --- lib/libaudit.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/lib/libaudit.c b/lib/libaudit.c index 7dacd36..4ee6660 100644 --- a/lib/libaudit.c +++ b/lib/libaudit.c @@ -1306,6 +1306,9 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair, else if (bits == ~__AUDIT_ARCH_64BIT && machine == MACH_S390X) machine = MACH_S390; + else if (bits == ~__AUDIT_ARCH_64BIT && + machine == MACH_AARCH64) + machine = MACH_ARM; /* Check for errors - return -6 * We don't allow 32 bit machines to specify -- 1.7.9.5 -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
