I'm attempting to cross-compile the 2.8 maintenance branch with petalinux, which uses bitbake yocto under the hood to build it, and I run it on a system V target which is a 64 bit arm architecture. I'm seeing some errors when I attempt to load rules for system some calls (like open, creat, rename, link, etc) with auditctl, and I'm not sure how critical these errors are. This is my first encounter with linux auditing, and I'll apologize in advance because I'm sure this is something easy, but I could not find a way to search the mailing list archives. These are some of my errors from auditctl's output: > Syscall name unknown: creat > There was an error in line 14 of /etc/audit/audit.rules > Syscall name unknown: link > There was an error in line 15 of /etc/audit/audit.rules > Syscall name unknown: open > There was an error in line 16 of /etc/audit/audit.rules > Syscall name unknown: open > There was an error in line 17 of /etc/audit/audit.rules > Syscall name unknown: rename > There was an error in line 19 of /etc/audit/audit.rules > Syscall name unknown: rename > There was an error in line 20 of /etc/audit/audit.rules Those lines are below in an excerpt from my rules file (with line numbers prepended for easy reading): 13 -w /etc/hostname -p wa -k system-locale 14 -a always,exit -F arch=b64 -S creat,link,mknod,mkdir,symlink,mknodat,linkat,symlinkat -F exit=-EACCES -F key=creation 15 -a always,exit -F arch=b64 -S link,mkdir,symlink,mkdirat -F exit=-EPERM -F key=creation 16 -a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F exit=-EACCES -F key=open 17 -a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F exit=-EPERM -F key=open 18 -a always,exit -F arch=b64 -S close -F exit=-EIO -F key=close 19 -a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EACCES -F key=mods 20 -a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EPERM -F key=mods The startup script and rules I'm repurposing had rules for open, create, link, unlink, rename, and others, and it seems like those would be part of a reasonable auditing security plan, but these system calls do not appear to be auditable on my system.

My target platform is a 64 bit arm architecture. I have a bitbake recipe which uses the --with-aarch64. I build the kernel with auditing support (CONFIG_AUDIT and others like it), and I pass the audit=1 argument on the kernel boot command line. Are there other incantations I am missing? Any help would be greatly appreciated.