From mboxrd@z Thu Jan  1 00:00:00 1970
From: hsultan@thefroid.net
Subject: listen & accept sycalls not present in b32 =?UTF-8?Q?=3F?=
Date: Tue, 13 Jan 2015 12:13:16 -0800
Message-ID: <898451c9c5da703102eaec8c33f98693@thefroid.net>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; Format="flowed"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
Received: from mx1.redhat.com (ext-mx11.extmail.prod.ext.phx2.redhat.com
	[10.5.110.16])
	by int-mx11.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP
	id t0DKDKxb006348
	for <linux-audit@redhat.com>; Tue, 13 Jan 2015 15:13:20 -0500
Received: from homiemail-a47.g.dreamhost.com (sub5.mail.dreamhost.com
	[208.113.200.129])
	by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id t0DKDIs1001562
	for <linux-audit@redhat.com>; Tue, 13 Jan 2015 15:13:18 -0500
Received: from homiemail-a47.g.dreamhost.com (localhost [127.0.0.1])
	by homiemail-a47.g.dreamhost.com (Postfix) with ESMTP id 1A29228406C
	for <linux-audit@redhat.com>; Tue, 13 Jan 2015 12:13:18 -0800 (PST)
Received: from webmail.thefroid.net (caiajhbihbdd.dreamhost.com
	[208.97.187.133]) (Authenticated sender: hsultan@thefroid.net)
	by homiemail-a47.g.dreamhost.com (Postfix) with ESMTPA id 0C94028405B
	for <linux-audit@redhat.com>; Tue, 13 Jan 2015 12:13:18 -0800 (PST)
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Ubuntu 14.04 LTS I get :

sudo auditctl -a exit,always -F arch=b32 -S listen -S connect
Syscall name unknown: listen

however with b64 it works

Same with the accept syscall.

Is that expected ? How can I grab the 32bit calls then ?

Thanks,

Hassan