Re: chmod32, lchmod32, etc?
On Monday, July 08, 2013 01:53:24 PM leam hall wrote:
Morning all! My first post to the list.
I'm getting errors on a RHEL 5 box when I add audit rules for chown32 and
lchown32.
Info on the box:
Linux myhost 2.6.18-348.6.1.el5 #1 SMP Fri Apr 26 09:21:26 EDT 2013 x86_64
x86_64 x86_64 GNU/Linux
Error:
service auditd restart
Stopping auditd: [ OK ]
Starting auditd: [ OK ]
Syscall name unknown: chown32
There was an error in line 215 of /etc/audit/audit.rules
Line 215:
-a exit,always -F arch=b64 -S chown32
What else can I look at to trouble-shoot?
The ausyscall program was created just for troubleshooting things like this.
# ausyscall x86_64 chown32
Unknown syscall chown32 using x86_64 lookup table
# ausyscall i386 chown32
lchown32 198
fchown32 207
chown32 212
So, that means its only a 32bit syscall:
-a exit,always -F arch=b32 -S chown32
On 64 bit machines, you normally should have rules for both the 64 bit and 32
bit syscalls. Not all syscalls are on both interfaces.
-Steve