From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: Clone and fcntl64 flags patch
Date: Tue, 24 Jul 2007 17:36:45 -0400
Message-ID: <200707241736.46328.sgrubb@redhat.com>
References: <ogtzm1nz6mt.fsf_-_@oolong.mitre.org>
Mime-Version: 1.0
Content-Type: text/plain;
  charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <ogtzm1nz6mt.fsf_-_@oolong.mitre.org>
Content-Disposition: inline
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: "John D. Ramsdell" <ramsdell@mitre.org>
Cc: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Monday 23 July 2007 07:44:42 am John D. Ramsdell wrote:
> Enclosed is a patch for auparse/interpret.c that makes it so that
> a0 is interpreted for clone flags, not a2. =C2=A0

Thanks...will appy.

> It also fixes two problems with interpreting the fcntl system call. =C2=
=A0The
> name of the system call is fcntl64, but the original code looked for th=
e
> name fcntl.

It was doing: strncmp(sys, "fcntl", 5) =3D=3D 0), which is not a full str=
ing=20
compare. I think this is correct.


> I have  also added a case so that a2 is printed as FD_CLOEXEC whenever =
a1 is
> F_SETFD and a2 is 1.

Thanks...merging this piece.

-Steve