From mboxrd@z Thu Jan 1 00:00:00 1970 From: Eric Paris Subject: Re: clone flags Date: Thu, 19 Jul 2007 13:59:53 -0400 Message-ID: <1184867993.3544.26.camel@localhost.localdomain> References: Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: "John D. Ramsdell" Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Thu, 2007-07-19 at 09:24 -0400, John D. Ramsdell wrote: > [root@goo fork]# ausearch -i -p 1160 > autrace.txt > [root@goo fork]# grep clone strace.txt > clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb7efb708) = 1122 > [root@goo fork]# grep clone autrace.txt > type=SYSCALL msg=audit(07/19/2007 09:16:02.350:848) : arch=i386 syscall=clone success=yes exit=1161 a0=1200011 a1=0 a2=0 a3=0 items=0 ppid=1158 pid=1160 auid=ramsdell uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts2 comm=fork exe=/home/ramsdell/proj/fork/fork subj=user_u:system_r:unconfined_t:s0 key=(null) Actually it's a problem with mapping things. The flags are in a0. If you look at the clone man page they talk about sys_clone at the bottom (which is the actual call, whereas cone is just a library function on top of the call) and they state the the ordering for sys_clone is different. The kernel function is actually asmlinkage long sys_clone(unsigned long clone_flags, unsigned long newsp, void __user *parent_tid, void __user *child_tid, struct pt_regs *regs) So the flags are actually coming in the first argument. To verify check #define CLONE_CHILD_SETTID 0x01000000 #define CLONE_CHILD_CLEARTID 0x00200000 #define SIGCHLD 0x00000011 Which just so happens to be 0x01200011 and a0 just so happen to be 1200011 But it's just a difference between the library call 'clone' that the application makes and the actual syscall glibc translates that to sys_clone and the ordering of the flags. -Eric