syscall names are architecture independent

[Matthew Booth <mbooth@redhat.com>]

[-- Attachment #1.1: Type: text/plain, Size: 840 bytes --]

On RHEL 4 U5 x86_64, if you have the following rule:

-a entry,always -S removexattr

you'd expect the result to be that the removexattr call is audited. This
isn't quite the case. What this actually means is 'audit system call
197'. The effect of this is to audit 64 bit removexattr calls and 32 bit
fstat64 calls.

I can see why this is the case, however this is clearly both undesirable
and far from intuitive. I'm not entirely sure what the solution should
be, but a big warning in the man page might be a good start :) As a
general rule, this highlights that it's always essential to additionally
filter by architecture on x86_64.

Matt
-- 
Matthew Booth, RHCA, RHCSS
Red Hat, Global Professional Services

M:       +44 (0)7977 267231
GPG ID:  D33C3490
GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490

[-- Attachment #1.2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]