From mboxrd@z Thu Jan 1 00:00:00 1970 From: Richard Guy Briggs Subject: Re: [RESEND PATCH 1/2] MIPS syscall auditing patches Date: Thu, 3 Apr 2014 11:13:36 -0400 Message-ID: <20140403151336.GA24821@madcap2.tricolour.ca> References: <1396433596-612624-1-git-send-email-manuel.lauss@gmail.com> <1396433596-612624-2-git-send-email-manuel.lauss@gmail.com> <20140402155519.GA749@madcap2.tricolour.ca> <20140403093257.GO17197@linux-mips.org> <1396532936.3615.124.camel@i7.infradead.org> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline In-Reply-To: <1396532936.3615.124.camel@i7.infradead.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: David Woodhouse Cc: Linux-MIPS , linux-audit@redhat.com, Manuel Lauss List-Id: linux-audit@redhat.com On 14/04/03, David Woodhouse wrote: > On Thu, 2014-04-03 at 11:32 +0200, Ralf Baechle wrote: > The __AUDIT_ARCH_64BIT flag does allow you to distinguish between 32-bit > and 64-bit system calls on architectures where you can't tell them apart > by syscall number alone (e.g. S390?). But even that isn't really needed > on MIPS because the syscall number tells you *everything* you need to > know, doesn't it? That hadn't even occured to me. So, why not use O32, N32 and 64 flags and just take mod 1000 of the syscall number and use a 64-bit mask? Or drop the 3 arch flags and just identify the arch from the syscall number range alone? > David Woodhouse Open Source Technology Centre - RGB -- Richard Guy Briggs Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat Remote, Ottawa, Canada Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545