listen & accept sycalls not present in b32 ?

[Steve Grubb]

On Tuesday, January 13, 2015 12:13:16 PM hsultan at thefroid.net wrote:
> sudo auditctl -a exit,always -F arch=b32 -S listen -S connect
> Syscall name unknown: listen
> 
> however with b64 it works
> 
> Same with the accept syscall.
> 
> Is that expected ? How can I grab the 32bit calls then ?

This is expected. The 32 bit ABI for x86 is very old. For whatever reason, 
they decided that dedicating a syscall to each networking call was 
unreasonable and its all done through the socketcall(2) system call. To audit 
those calls, you would have to look up the define for each one 

include/linux/net.h

and use that number for arg0.

-Steve