From mboxrd@z Thu Jan  1 00:00:00 1970
From: "chuli" <chul@cn.fujitsu.com>
Subject: Question about max syscall number
Date: Thu, 31 Jul 2008 11:18:15 +0800
Message-ID: <001401c8f2bc$1279e150$958da70a@truly>
Return-path: <linux-audit-bounces@redhat.com>
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: 'Steve Grubb' <sgrubb@redhat.com>
Cc: 'linux-audit' <linux-audit@redhat.com>
List-Id: linux-audit@redhat.com

Hi,

  When I use "auditctl -a exit,always -S 2015" in x86 system, this rule can be 
added.
But I thought it would report error since there is not such syscall number "1000"
in x86, the max is 318. If I use "auditctl -a exit,always -S 2016" in x86 system, 
it will report " Syscall name unknown: 2016". And it is the same with x86_64 and 
ia64.
(syscalls in S390 and ppc syscall table is 1-318)

  Is there any special reason to set the limitation as "2015"?

Regards
Chu Li