On 14/04/03, David Woodhouse wrote: > On Thu, 2014-04-03 at 11:32 +0200, Ralf Baechle wrote: > The __AUDIT_ARCH_64BIT flag does allow you to distinguish between 32-bit > and 64-bit system calls on architectures where you can't tell them apart > by syscall number alone (e.g. S390?). But even that isn't really needed > on MIPS because the syscall number tells you *everything* you need to > know, doesn't it?
That hadn't even occured to me. So, why not use O32, N32 and 64 flags and just take mod 1000 of the syscall number and use a 64-bit mask? Or drop the 3 arch flags and just identify the arch from the syscall number range alone? > David Woodhouse Open Source Technology Centre - RGB -- Richard Guy Briggs <[email protected]> Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat Remote, Ottawa, Canada Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545 -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
