Re: audit syscall information

Then this patch is already on the system I am testing on. But the a0, a1, a2, and a3 values for the IPC syscalls are still not matching the expected values when compiled and run in 32bit mode on a 64bit system. This is particularly important for the ipc syscalls because a0 is used to indicate a particular IPC syscall. For example: when semget is executed in 32bit mode on a 64bit system, instead of a0=2 (value for SEMGET in ipc.h), I am seeing a0=0. Not only is the record incorrect, but I am also not able to audit only a particular ipc syscall in 32bit mode. If I want to only audit semget 32bit syscalls, I should be able to do this with: auditctl -a entry,always -F arch=b32 -S ipc -F a0=2 But this doesn't generate any audit records. The only way I can capture them is by using: auditctl -a entry,always -F arch=b32 -S ipc This audits ALL 32bit ipc syscalls Note, "auditctl -a entry,always -F arch=b64 -S ipc -F a0=2" does have correct behavior. -debbie