Re: audit 0.6.10 released
On Tue, 2005-04-05 at 18:08 -0400, Steve Grubb wrote:
There's more to it than including a header. Put yourself in
auditctl's
shoes. You just started running. What do you do to figure it out?
Oh, I see. Then you probably want to do it with uname(2) and a lookup
table telling you which syscall personalities are available on which
machine types.
'x86_64' --> AUDIT_ARCH_I386, AUDIT_ARCH_X86_64
'ia64' --> AUDIT_ARCH_I386, AUDIT_ARCH_IA64
'i?86' --> AUDIT_ARCH_I386
'ppc64' --> AUDIT_ARCH_PPC, AUDIT_ARCH_PPC64
etc.
--
dwmw2