x32 + audit status?

David Drysdale drysdale at google.com
Fri Mar 6 09:52:13 UTC 2015


On Fri, Mar 6, 2015 at 7:28 AM, Paul Moore <paul at paul-moore.com> wrote:
> On Thu, Mar 5, 2015 at 6:07 PM, Andy Lutomirski <luto at amacapital.net> wrote:
>> On Mar 5, 2015 10:32 AM, "David Drysdale" <drysdale at google.com> wrote:
>>>
>>> Hi,
>>>
>>> Do we currently expect the audit system to work with x32 syscalls?
>>>
>>> I was playing with the audit system for the first time today (on
>>> v4.0-rc2, due to [1]), and it didn't seem to work for me.  (Tweaking
>>> ptrace.c like the patch below seemed to help, but I may just have
>>> configured something wrong.)
>>>
>>> I know there was a bunch of activity around this area in mid-2014,
>>> but I'm not sure what the final position was...
>>
>> It's totally broken, and it needs ABI work.  I think it should keep
>> the high syscall numbers, which means that both userspace and the
>> audit core need to learn how to deal with it.
>
> What Andy said.  It's on the list of things to fix, but to be brutally
> honest, it's not very high on the list due to lack of interest from
> people asking for audit/x32 support.

Fair enough -- thanks for letting me know.




More information about the Linux-audit mailing list