From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: listen & accept sycalls not present in b32 ?
Date: Thu, 15 Jan 2015 12:15 -0500
Message-ID: <5435909.YIfZJDsvq9@x2>
References: <898451c9c5da703102eaec8c33f98693@thefroid.net>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <898451c9c5da703102eaec8c33f98693@thefroid.net>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com
Cc: hsultan@thefroid.net
List-Id: linux-audit@redhat.com

On Tuesday, January 13, 2015 12:13:16 PM hsultan@thefroid.net wrote:
> sudo auditctl -a exit,always -F arch=b32 -S listen -S connect
> Syscall name unknown: listen
> 
> however with b64 it works
> 
> Same with the accept syscall.
> 
> Is that expected ? How can I grab the 32bit calls then ?

This is expected. The 32 bit ABI for x86 is very old. For whatever reason, 
they decided that dedicating a syscall to each networking call was 
unreasonable and its all done through the socketcall(2) system call. To audit 
those calls, you would have to look up the define for each one 

include/linux/net.h

and use that number for arg0.

-Steve