Problem regards event fields a0-a3 in audit logs

[C.y]

Hi all,

I looked into audit log and find myself having difficultly in understanding
the event field a0-a3.

I tried to look for answer but couldn't get any references for the
following question:
  1. What are the initial value of a0-a3, and
  2. Is there any way to get 5-th and above arguments?

Audit system reference from redhat (https://access.redhat.com/doc
umentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_
Guide/app-Audit_Reference.html) did mentioned that the first four arguments
of system call are recorded, but didn't mentions what their initial value
are when there a system call required less than four arguments.
For example, what will the value of a1, a2, a3 be when the system call
'close' are invoked? ('close' only takes 1 argument
http://man7.org/linux/man-pages/man2/close.2.html)

At first I am guessing that they might contain the a1-a3's value from
previous syscall record, so I starting doing some experiment on the audit
log I have collected (https://drive.google.com/file
/d/0B85cIbQMuvqDSHVGSHdDVjRWdHc/view):

`$ ausyscall --dump | grep 6 | head -n 1 ` returns
6       close

and below are part of my audit log that contains 2 syscall records:
...
type=SYSCALL msg=audit(1479471647.440:197): arch=40000028 syscall=192
per=800000 success=yes exit=1995763712 a0=76f4f000 a1=1000 a2=3 a3=812
items=0 ppid=891 pid=907 auid=1001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=pts0 ses=3 comm="raspistill"
exe="/opt/vc/bin/raspistill" key=(null)
type=MMAP msg=audit(1479471647.440:197): fd=3 flags=0x812
type=PROCTITLE msg=audit(1479471647.440:197): proctitle="-bash"
type=SYSCALL msg=audit(1479471647.440:198): arch=40000028 syscall=6
per=800000 success=yes exit=0 a0=3 a1=5 a2=76f31000 a3=0 items=0 ppid=891
pid=907 auid=1001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
tty=pts0 ses=3 comm="raspistill" exe="/opt/vc/bin/raspistill" key=(null)
...

the second syscall record show that the a1's value are somehow modified,
which eventually proved that my guessing of that they will contain previous
invoked syscall a1's value(1000) is wrong. That's how I got myself confused
and write to seek for answer regards this question.

Second, I wonder if there are way for me to know the 5-th and above
argument of a particular system call, i.e _llseek that takes 5 arguments?

Thanks a lot for all your help in advance!


Cheers.
Ching-Yi Ng
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20161130/da1454a7/attachment.htm>