Relation of syscall names to System.map

Relation of syscall names to System.map

[Matthew Booth]

[-- Attachment #1.1: Type: text/plain, Size: 764 bytes --]

I was recently going through syscalls I'm auditing and matching them up
to symbols in System.map starting with 'sys_'. I noted that the two
don't appear to be completely related. The system in question is RHEL 4
x86_64. Specifically I noted:

* sys_stime is in System.map, but 'stime' is not recognised by auditctl
* sys_umount2 is not in System.map, but is recognised by auditctl

Am I looking for a relationship which doesn't exist? Is there a better
way to get a definitive, locally generated list of all auditable
syscalls on a particular machine?

Thanks,

Matt
-- 
Matthew Booth, RHCA, RHCSS
Red Hat, Global Professional Services

M:       +44 (0)7977 267231
GPG ID:  D33C3490
GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490

[-- Attachment #1.2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]