[PATCH] selinux: print leading 0x on ioctlcmd audits

Steve Grubb sgrubb at redhat.com
Fri Jul 15 20:12:00 UTC 2016


On Friday, July 15, 2016 7:49:22 PM EDT Roberts, William C wrote:
> > I also asked some other questions.  Is this the ioctl number? As in
> > syscall arg a1? I need to know if its the same thing so that I can hook
> > up its translation if so.
>
> Yes, per man ioctl, it's the "request number".  Assuming a0 is the file
> descriptor, then a1 is the Ioctlcmd value.

OK, great. I hooked this field up to the translator so that the ioctl name can 
be printed (if known).

Thanks,
-Steve




More information about the Linux-audit mailing list