chmod32, lchmod32, etc?

chmod32, lchmod32, etc?

[leam hall]

[-- Attachment #1.1: Type: text/plain, Size: 664 bytes --]

Morning all! My first post to the list.

I'm getting errors on a RHEL 5 box when I add audit rules for chown32 and
lchown32.

Info on the box:

Linux myhost 2.6.18-348.6.1.el5 #1 SMP Fri Apr 26 09:21:26 EDT 2013 x86_64
x86_64 x86_64 GNU/Linux


Error:

service auditd restart
Stopping auditd:                                           [  OK  ]
Starting auditd:                                           [  OK  ]
Syscall name unknown: chown32
There was an error in line 215 of /etc/audit/audit.rules


Line 215:
-a exit,always -F arch=b64 -S chown32


What else can I look at to trouble-shoot?

Thanks!

Leam


-- 
Mind on a Mission <http://leamhall.blogspot.com/>

[-- Attachment #1.2: Type: text/html, Size: 1084 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: chmod32, lchmod32, etc?

[Steve Grubb]

On Monday, July 08, 2013 01:53:24 PM leam hall wrote:
> Morning all! My first post to the list.
> 
> I'm getting errors on a RHEL 5 box when I add audit rules for chown32 and
> lchown32.
> 
> Info on the box:
> 
> Linux myhost 2.6.18-348.6.1.el5 #1 SMP Fri Apr 26 09:21:26 EDT 2013 x86_64
> x86_64 x86_64 GNU/Linux
> 
> 
> Error:
> 
> service auditd restart
> Stopping auditd:                                           [  OK  ]
> Starting auditd:                                           [  OK  ]
> Syscall name unknown: chown32
> There was an error in line 215 of /etc/audit/audit.rules
> 
> 
> Line 215:
> -a exit,always -F arch=b64 -S chown32
> 
> 
> What else can I look at to trouble-shoot?

The ausyscall program was created just for troubleshooting things like this.

# ausyscall x86_64 chown32
Unknown syscall chown32 using x86_64 lookup table

# ausyscall i386 chown32
lchown32           198
fchown32           207
chown32            212

So, that means its only a 32bit syscall:
 -a exit,always -F arch=b32 -S chown32

On 64 bit machines, you normally should have rules for both the 64 bit and 32 
bit syscalls. Not all syscalls are on both interfaces.

-Steve