From mboxrd@z Thu Jan  1 00:00:00 1970
From: Matthew Booth <mbooth@redhat.com>
Subject: syscall names are architecture independent
Date: Tue, 09 Oct 2007 17:08:29 +0100
Message-ID: <1191946109.5962.24.camel@localhost.localdomain>
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="===============1741744285=="
Return-path: <linux-audit-bounces@redhat.com>
Received: from [192.168.1.200] (sebastian-int.corp.redhat.com [172.16.52.221])
	by pobox.fab.redhat.com (8.13.1/8.13.1) with ESMTP id l99IqOUB017556
	for <linux-audit@redhat.com>; Tue, 9 Oct 2007 14:52:25 -0400
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit <linux-audit@redhat.com>
List-Id: linux-audit@redhat.com


--===============1741744285==
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature";
	boundary="=-xOfrd8ZIoS3vwRLpRlJ2"


--=-xOfrd8ZIoS3vwRLpRlJ2
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

On RHEL 4 U5 x86_64, if you have the following rule:

-a entry,always -S removexattr

you'd expect the result to be that the removexattr call is audited. This
isn't quite the case. What this actually means is 'audit system call
197'. The effect of this is to audit 64 bit removexattr calls and 32 bit
fstat64 calls.

I can see why this is the case, however this is clearly both undesirable
and far from intuitive. I'm not entirely sure what the solution should
be, but a big warning in the man page might be a good start :) As a
general rule, this highlights that it's always essential to additionally
filter by architecture on x86_64.

Matt
--=20
Matthew Booth, RHCA, RHCSS
Red Hat, Global Professional Services

M:       +44 (0)7977 267231
GPG ID:  D33C3490
GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490

--=-xOfrd8ZIoS3vwRLpRlJ2
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iD8DBQBHC6d9NEHqGdM8NJARAn4hAKCMAoG7SZcdI1jsWjqo5UN2rSzeoACgjkgp
YOGsL9nTmNQYBy355UxNqD0=
=xH/y
-----END PGP SIGNATURE-----

--=-xOfrd8ZIoS3vwRLpRlJ2--


--===============1741744285==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============1741744285==--