audit 0.6.10 released

David Woodhouse dwmw2 at infradead.org
Tue Apr 5 22:25:51 UTC 2005


On Tue, 2005-04-05 at 18:08 -0400, Steve Grubb wrote:
> There's more to it than including a header. Put yourself in auditctl's
> shoes. You just started running. What do you do to figure it out?

Oh, I see. Then you probably want to do it with uname(2) and a lookup
table telling you which syscall personalities are available on which
machine types.

 'x86_64' --> AUDIT_ARCH_I386, AUDIT_ARCH_X86_64
 'ia64'   --> AUDIT_ARCH_I386, AUDIT_ARCH_IA64
 'i?86'   --> AUDIT_ARCH_I386
 'ppc64'  --> AUDIT_ARCH_PPC, AUDIT_ARCH_PPC64

 etc.


-- 
dwmw2




More information about the Linux-audit mailing list