From: Eric Paris <eparis@redhat.com>
To: Peter Moody <pmoody@google.com>
Cc: linux-audit@redhat.com
Subject: Re: what does the arch= hex number represent?
Date: Fri, 20 Jan 2012 09:26:12 -0500 [thread overview]
Message-ID: <1327069572.14949.3.camel@localhost> (raw)
In-Reply-To: <CALnj_=6VV-Tyij2i4r7bC71WEPFtrne7oTtbp78whahfp8XVYg@mail.gmail.com>
On Wed, 2012-01-18 at 10:54 -0800, Peter Moody wrote:
> What does the hex number after arch= mean?
>
> 64bit seems to always be c000003e and 32bit seems to be 40000003, but
> I'd feel a lot better setting up log monitoring if I knew what they
> actually represented.
>
> $ sudo auditctl -l
> LIST_RULES: exit,always arch=3221225534 (0xc000003e) ...
If we look around the kernel source code we find
From: include/linux/audit.h
#define __AUDIT_ARCH_64BIT 0x80000000
#define __AUDIT_ARCH_LE 0x40000000
...
#define AUDIT_ARCH_I386 (EM_386|__AUDIT_ARCH_LE)
...
#define AUDIT_ARCH_X86_64 (EM_X86_64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
From: include/linux/elf-em.h
#define EM_386 3
...
#define EM_X86_64 62 /* AMD x86-64 */
So it is a combination of the elf architecture declaration, endian-ness,
and if it is a 64bit arch....
These should be stable values you can count on.
-Eric
prev parent reply other threads:[~2012-01-20 14:26 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-01-18 18:54 what does the arch= hex number represent? Peter Moody
2012-01-20 14:26 ` Eric Paris [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1327069572.14949.3.camel@localhost \
--to=eparis@redhat.com \
--cc=linux-audit@redhat.com \
--cc=pmoody@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.