Hello Steve, When I use "autrace -r" or "auditctl -a exit,always -S connect" on "ia32" machine, it report some error. I found in some platforms, "connect", "bind", "accept", "sendto", "recvfrom", "sendfile" isnot supported to call directly. They are used by syscall "socketcall". I think when the socket calls are supported, we should insert "socketcall" instead of them. Do you agree with me? Signed-off-by: Zhang Xiliang <zhangxiliang(a)cn.fujitsu.com&gt; --- lib/deprecated.c | 7 +++++++ lib/libaudit.c | 6 ++++++ 2 files changed, 13 insertions(+), 0 deletions(-) diff --git a/lib/deprecated.c b/lib/deprecated.c index 4f0c14e..ced4c62 100644 --- a/lib/deprecated.c +++ b/lib/deprecated.c @@ -160,6 +160,13 @@ int audit_rule_syscallbyname(struct audit_rule *rule, if (nr < 0) { if (isdigit(scall[0])) nr = strtol(scall, NULL, 0); + if(strcmp(scall, "connect") || strcmp(scall, "bind") + || strcmp(scall, "accept") || strcmp(scall, "sendto") + || strcmp(scall, "recvfrom") || strcmp(scall, "sendfile")) { + scall = "socketcall"; + nr = audit_name_to_syscall(scall, machine); + } + } if (nr >= 0) return audit_rule_syscall(rule, nr); diff --git a/lib/libaudit.c b/lib/libaudit.c index 0588537..36baff1 100644 --- a/lib/libaudit.c +++ b/lib/libaudit.c @@ -761,6 +761,12 @@ int audit_rule_syscallbyname_data(struct audit_rule_data *rule, if (nr < 0) { if (isdigit(scall[0])) nr = strtol(scall, NULL, 0); + if(strcmp(scall, "connect") || strcmp(scall, "bind") + || strcmp(scall, "accept") || strcmp(scall, "sendto") + || strcmp(scall, "recvfrom") || strcmp(scall, "sendfile")) { + scall = "socketcall"; + nr = audit_name_to_syscall(scall, machine); + } } if (nr >= 0) return audit_rule_syscall_data(rule, nr); -- 1.5.4.2 -- Regards Zhang Xiliang