OK, that's fine with me. But I wonder where all this should be
documented so
that we don't get bugzilla's opened by concerned users. Would any particular
man page be better than others?
Perhaps the auditctl manpage should be clear (if it isn't already) that
its auditing the kernel arguments so they may be different than what was
passed into a library routine of the same name. Maybe give an example.
This specific one is documented in the Notes section of the semctl(2)
and msgctl(2) manpages, which I think is the right place for the
details. If someone wants to audit a specific syscall, they should
make sure they understand how the syscall works.
-- ljk