Possible bug while setting syscall="all"

Possible bug while setting syscall="all"

[Nathan Brown]

[-- Attachment #1.1: Type: text/plain, Size: 379 bytes --]

I am trying to fully understand the ruledata struct. I've got most of it
figured out but I can't find a reason for the final 32 bits (last index) of
mask to not be flipped on when selecting all syscalls. In general it
appears that the final 32 bits are never used.

https://github.com/linux-audit/audit-userspace/blob/f588248775b4f8180b846bbc1681bc54e07871ed/lib/libaudit.c#L907

[-- Attachment #1.2: Type: text/html, Size: 564 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: Possible bug while setting syscall="all"

[Steve Grubb]

On Tuesday, September 27, 2016 6:35:28 PM EDT Nathan Brown wrote:
> I am trying to fully understand the ruledata struct. I've got most of it
> figured out but I can't find a reason for the final 32 bits (last index) of
> mask to not be flipped on when selecting all syscalls. In general it
> appears that the final 32 bits are never used.
> 
> https://github.com/linux-audit/audit-userspace/blob/f588248775b4f8180b846bbc
> 1681bc54e07871ed/lib/libaudit.c#L907

Yes, this is a bug. Since there are nowhere near 2016 syscalls on any arch, it 
hadn't really posed a problem. Fixed in svn commit 1397. Thanks for reporting 
this.

-Steve