On Friday, July 15, 2016 7:49:22 PM EDT Roberts, William C wrote: > > I also asked some other questions. Is this the ioctl number? As in > > syscall arg a1? I need to know if its the same thing so that I can hook > > up its translation if so. > > Yes, per man ioctl, it's the "request number". Assuming a0 is the file > descriptor, then a1 is the Ioctlcmd value.
OK, great. I hooked this field up to the translator so that the ioctl name can be printed (if known). Thanks, -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
