[PATCH] selinux: print leading 0x on ioctlcmd audits
Steve Grubb
sgrubb at redhat.com
Fri Jul 15 20:12:00 UTC 2016
On Friday, July 15, 2016 7:49:22 PM EDT Roberts, William C wrote:
> > I also asked some other questions. Is this the ioctl number? As in
> > syscall arg a1? I need to know if its the same thing so that I can hook
> > up its translation if so.
>
> Yes, per man ioctl, it's the "request number". Assuming a0 is the file
> descriptor, then a1 is the Ioctlcmd value.
OK, great. I hooked this field up to the translator so that the ioctl name can
be printed (if known).
Thanks,
-Steve
More information about the Linux-audit
mailing list