On 11/9/18 11:03 AM, Andy Lutomirski wrote: >> Does ptrace (or user of this API) need a unique value per arch. Otherwise >> instead >> of adding the boilerplate code to all arches, they could simply define >> AUDIT_ARCH >> and common code could return it. Also the EM_xxx are not there in >> include/uapi/linux/elf.h to begin with since libc elf.h already defines them. >> > A lot of architectures allow multiple audit_arches at runtime due to compat > support and similar features, so it really does want to be a function. The > goal of this patch set is to get it supported everywhere. >
I was wondering if we could have a common syscall_get_arch() simply returning an per-arch AUDIT_ARCH. But seems like the function itself needs to be per arch anyways due to the nuances above. -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit
