From: Steve Grubb <sgrubb@redhat.com>
To: chuli <chul@cn.fujitsu.com>
Cc: 'linux-audit' <linux-audit@redhat.com>
Subject: Re: Question about max syscall number
Date: Mon, 4 Aug 2008 15:46:11 -0400 [thread overview]
Message-ID: <200808041546.12397.sgrubb@redhat.com> (raw)
In-Reply-To: <001401c8f2bc$1279e150$958da70a@truly>
On Wednesday 30 July 2008 23:18:15 chuli wrote:
> When I use "auditctl -a exit,always -S 2015" in x86 system, this rule can
> be added. But I thought it would report error since there is not such
> syscall number "1000" in x86, the max is 318.
We allow this because its possible that someone could write a kernel module
(maybe not in Linus tree) that adds syscall numbers. While we wouldn't have
a text interpretation for what it means, we thought that if this occurs that
we would like to allow people to audit these new syscalls if they existed.
Its otherwise harmless if you don't consider the performance hit.
-Steve
next prev parent reply other threads:[~2008-08-04 19:46 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-07-31 3:18 Question about max syscall number chuli
2008-08-04 3:06 ` [PATCH]Fix the bug about checking the " chuli
2008-08-04 19:46 ` Steve Grubb [this message]
2008-08-05 7:13 ` Question about max " chuli
2008-08-05 13:58 ` Steve Grubb
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200808041546.12397.sgrubb@redhat.com \
--to=sgrubb@redhat.com \
--cc=chul@cn.fujitsu.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox