<html><body> <tt>linux-audit-bounces@redhat.com wrote on 04/05/2005 04:05:34 PM: > On Tuesday 05 April 2005 16:47, David Woodhouse wrote: > > 0x80000000 is a flag for '64-bit' > > 0x40000000 is a flag for 'little-endian' </tt> <tt>> How would people want this to work? Like Debbie suggested? </tt> <tt>I'm partial to:</tt> <tt>auditctl -a entry,always -S chmod -F arch=64</tt> <tt>auditctl -a entry,always -S chmod -F arch=32</tt> <tt>or if you think it's more user friendly, this is okay too:</tt> <tt>auditctl -a entry,always -S chmod -F arch=64BIT</tt> <tt>auditctl -a entry,always -S chmod -F arch=32BIT</tt> <tt>Something like 0x800000000 would be okay, if:</tt> <tt>1. we document it in the man page what each value means</tt> <tt>2. auditctl is smart enough to understand that 0x8000 is the same as 0x800000000.</tt> <tt>The main thing is that whatever value means 64bit compiled or 32bit compiled, it is the same for all the platforms.</tt> <tt>I'd like to be able to put statements such as this in my test cases:</tt> <tt>#if defined(__MODE_32)</tt> <tt> auditctl -a entry,always -S chmod -F arch=32</tt> <tt>#else</tt> <tt> auditctl -a entry,always -S chmod -F arch=64</tt> <tt>#endif</tt> <tt>And not have to complicate with platform specific statements like:</tt> <tt>#if defined(__X86_64) && !defined(__MODE_32)</tt> <tt>Also, we need to decide what the default behavior should be.</tt> <tt>For our tests, there would be considerably less impact if:</tt> <tt>"auditctl -a entry,always -S chmod"</tt> <tt>would result in two rules being added:</tt> <tt> auditctl -a entry,always -S chmod -F arch=32</tt> <tt> auditctl -a entry,always -S chmod -F arch=64</tt> <tt>Also from the user point of view, if they want to audit chmod syscalls, they more likely want to audit all of them, not just 32bit or 64bit versions of them.</tt> <tt>For the case: "auditctl -a entry,always -S 15"</tt> <tt> My first thought is that only adding one rule would be okay.</tt> <tt>-debbie</tt></body></html>