* what does the arch= hex number represent?
@ 2012-01-18 18:54 Peter Moody
2012-01-20 14:26 ` Eric Paris
0 siblings, 1 reply; 2+ messages in thread
From: Peter Moody @ 2012-01-18 18:54 UTC (permalink / raw)
To: linux-audit
What does the hex number after arch= mean?
64bit seems to always be c000003e and 32bit seems to be 40000003, but
I'd feel a lot better setting up log monitoring if I knew what they
actually represented.
$ sudo auditctl -l
LIST_RULES: exit,always arch=3221225534 (0xc000003e) ...
Cheers,
peter
--
Peter Moody Google 1.650.253.7306
Security Engineer pgp:0xC3410038
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: what does the arch= hex number represent?
2012-01-18 18:54 what does the arch= hex number represent? Peter Moody
@ 2012-01-20 14:26 ` Eric Paris
0 siblings, 0 replies; 2+ messages in thread
From: Eric Paris @ 2012-01-20 14:26 UTC (permalink / raw)
To: Peter Moody; +Cc: linux-audit
On Wed, 2012-01-18 at 10:54 -0800, Peter Moody wrote:
> What does the hex number after arch= mean?
>
> 64bit seems to always be c000003e and 32bit seems to be 40000003, but
> I'd feel a lot better setting up log monitoring if I knew what they
> actually represented.
>
> $ sudo auditctl -l
> LIST_RULES: exit,always arch=3221225534 (0xc000003e) ...
If we look around the kernel source code we find
From: include/linux/audit.h
#define __AUDIT_ARCH_64BIT 0x80000000
#define __AUDIT_ARCH_LE 0x40000000
...
#define AUDIT_ARCH_I386 (EM_386|__AUDIT_ARCH_LE)
...
#define AUDIT_ARCH_X86_64 (EM_X86_64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
From: include/linux/elf-em.h
#define EM_386 3
...
#define EM_X86_64 62 /* AMD x86-64 */
So it is a combination of the elf architecture declaration, endian-ness,
and if it is a 64bit arch....
These should be stable values you can count on.
-Eric
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2012-01-20 14:26 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-01-18 18:54 what does the arch= hex number represent? Peter Moody
2012-01-20 14:26 ` Eric Paris
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox