audit 0.6.10 released
David Woodhouse
dwmw2 at infradead.org
Tue Apr 5 22:25:51 UTC 2005
On Tue, 2005-04-05 at 18:08 -0400, Steve Grubb wrote:
> There's more to it than including a header. Put yourself in auditctl's
> shoes. You just started running. What do you do to figure it out?
Oh, I see. Then you probably want to do it with uname(2) and a lookup
table telling you which syscall personalities are available on which
machine types.
'x86_64' --> AUDIT_ARCH_I386, AUDIT_ARCH_X86_64
'ia64' --> AUDIT_ARCH_I386, AUDIT_ARCH_IA64
'i?86' --> AUDIT_ARCH_I386
'ppc64' --> AUDIT_ARCH_PPC, AUDIT_ARCH_PPC64
etc.
--
dwmw2
More information about the Linux-audit
mailing list