RE: [PATCH] selinux: print leading 0x on ioctlcmd audits
-----Original Message-----
From: Steve Grubb [mailto:sgrubb@redhat.com]
Sent: Friday, July 15, 2016 12:42 PM
To: Roberts, William C <william.c.roberts(a)intel.com>
Cc: Paul Moore <pmoore(a)redhat.com>; William Roberts
<bill.c.roberts(a)gmail.com>; seandroid-list(a)tycho.nsa.gov;
selinux(a)tycho.nsa.gov; linux-audit(a)redhat.com
Subject: Re: [PATCH] selinux: print leading 0x on ioctlcmd audits
On Friday, July 15, 2016 7:33:09 PM EDT Roberts, William C wrote:
> <snip>
>
> > > This is important so that people don't make up new ones that do
> > > the same thing. The ioctlcmd field name should be recorded. Are
> > > there more that need documenting?
> >
> > Steve/William, one of you want to send a patch/PR for the field
> > dictionary?
>
> I'll send it over.
I also asked some other questions. Is this the ioctl number? As in syscall arg a1? I
need to know if its the same thing so that I can hook up its translation if so.
Yes, per man ioctl, it's the "request number". Assuming a0 is the file
descriptor, then a1 is the
Ioctlcmd value.
Thanks,
-Steve