Re: Possible bug while setting syscall="all"
On Tuesday, September 27, 2016 6:35:28 PM EDT Nathan Brown wrote:
I am trying to fully understand the ruledata struct. I've got
most of it
figured out but I can't find a reason for the final 32 bits (last index) of
mask to not be flipped on when selecting all syscalls. In general it
appears that the final 32 bits are never used.
https://github.com/linux-audit/audit-userspace/blob/f588248775b4f8180b846bbc
1681bc54e07871ed/lib/libaudit.c#L907
Yes, this is a bug. Since there are nowhere near 2016 syscalls on any arch, it
hadn't really posed a problem. Fixed in svn commit 1397. Thanks for reporting
this.
-Steve