* Possible bug while setting syscall="all"
@ 2016-09-28 1:35 Nathan Brown
2016-09-28 13:05 ` Steve Grubb
0 siblings, 1 reply; 2+ messages in thread
From: Nathan Brown @ 2016-09-28 1:35 UTC (permalink / raw)
To: linux-audit
[-- Attachment #1.1: Type: text/plain, Size: 379 bytes --]
I am trying to fully understand the ruledata struct. I've got most of it
figured out but I can't find a reason for the final 32 bits (last index) of
mask to not be flipped on when selecting all syscalls. In general it
appears that the final 32 bits are never used.
https://github.com/linux-audit/audit-userspace/blob/f588248775b4f8180b846bbc1681bc54e07871ed/lib/libaudit.c#L907
[-- Attachment #1.2: Type: text/html, Size: 564 bytes --]
[-- Attachment #2: Type: text/plain, Size: 0 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: Possible bug while setting syscall="all"
2016-09-28 1:35 Possible bug while setting syscall="all" Nathan Brown
@ 2016-09-28 13:05 ` Steve Grubb
0 siblings, 0 replies; 2+ messages in thread
From: Steve Grubb @ 2016-09-28 13:05 UTC (permalink / raw)
To: linux-audit
On Tuesday, September 27, 2016 6:35:28 PM EDT Nathan Brown wrote:
> I am trying to fully understand the ruledata struct. I've got most of it
> figured out but I can't find a reason for the final 32 bits (last index) of
> mask to not be flipped on when selecting all syscalls. In general it
> appears that the final 32 bits are never used.
>
> https://github.com/linux-audit/audit-userspace/blob/f588248775b4f8180b846bbc
> 1681bc54e07871ed/lib/libaudit.c#L907
Yes, this is a bug. Since there are nowhere near 2016 syscalls on any arch, it
hadn't really posed a problem. Fixed in svn commit 1397. Thanks for reporting
this.
-Steve
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2016-09-28 13:05 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-09-28 1:35 Possible bug while setting syscall="all" Nathan Brown
2016-09-28 13:05 ` Steve Grubb
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox