Hello Steve, When execute "autrace -r /bin/ls" in i386, The error message "Error inserting audit rule for pid=349" will be outputed. When execute "ausyscall i386 connect", The error message "Unknown syscall connect using i386 lookup table" will be outputed. After apply the patch, The output of "ausyscall i386 connect" is "socketcall 102". The output of "autrace -r /bin/ls" should be OK. Signed-off-by: Peng Haitao <penght(a)cn.fujitsu.com&gt; --- lib/lookup_table.c | 36 ++++++++++++++++++++++++++++++++++++ tools/ausyscall/ausyscall.c | 36 ++++++++++++++++++++++++++++++++++++ 2 files changed, 72 insertions(+), 0 deletions(-) diff --git a/lib/lookup_table.c b/lib/lookup_table.c index b0abe07..c6f892f 100755 --- a/lib/lookup_table.c +++ b/lib/lookup_table.c @@ -29,6 +29,7 @@ #include <stdlib.h> #include <ctype.h> #include <errno.h> +#include <linux/net.h> #include "libaudit.h" #include "gen_tables.h" @@ -96,6 +97,33 @@ const char *audit_field_to_name(int field) return field_i2s(field); } +/* This is the name/value pair used by search tables */ +struct nv_pair { + int value; + const char *name; +}; + +static struct nv_pair socktab[] = { + {SYS_SOCKET, "socket"}, + {SYS_BIND, "bind"}, + {SYS_CONNECT, "connect"}, + {SYS_LISTEN, "listen"}, + {SYS_ACCEPT, "accept"}, + {SYS_GETSOCKNAME, "getsockname"}, + {SYS_GETPEERNAME, "getpeername"}, + {SYS_SOCKETPAIR, "socketpair"}, + {SYS_SEND, "send"}, + {SYS_RECV, "recv"}, + {SYS_SENDTO, "sendto"}, + {SYS_RECVFROM, "recvfrom"}, + {SYS_SHUTDOWN, "shutdown"}, + {SYS_SETSOCKOPT, "setsockopt"}, + {SYS_GETSOCKOPT, "getsockopt"}, + {SYS_SENDMSG, "sendmsg"}, + {SYS_RECVMSG, "recvmsg"} +}; +#define SOCK_NAMES (sizeof(socktab)/sizeof(socktab[0])) + int audit_name_to_syscall(const char *sc, int machine) { int res, found; @@ -104,6 +132,14 @@ int audit_name_to_syscall(const char *sc, int machine) { case MACH_X86: found = i386_syscall_s2i(sc, &res); + if (!found) { + int i; + for(i = 0; i < SOCK_NAMES; i++) + if (strcmp(socktab[i].name, sc) == 0) { + sc = "socketcall"; + found = i386_syscall_s2i(sc, &res); + } + } break; case MACH_86_64: found = x86_64_syscall_s2i(sc, &res); diff --git a/tools/ausyscall/ausyscall.c b/tools/ausyscall/ausyscall.c index 565336f..772aa00 100755 --- a/tools/ausyscall/ausyscall.c +++ b/tools/ausyscall/ausyscall.c @@ -25,10 +25,38 @@ #include <string.h> #include <stdlib.h> #include <ctype.h> +#include <linux/net.h> #include "libaudit.h" #define LAST_SYSCALL 1400 // IA64 is in the 1300's right now +/* This is the name/value pair used by search tables */ +struct nv_pair { + int value; + const char *name; +}; + +static struct nv_pair socktab[] = { + {SYS_SOCKET, "socket"}, + {SYS_BIND, "bind"}, + {SYS_CONNECT, "connect"}, + {SYS_LISTEN, "listen"}, + {SYS_ACCEPT, "accept"}, + {SYS_GETSOCKNAME, "getsockname"}, + {SYS_GETPEERNAME, "getpeername"}, + {SYS_SOCKETPAIR, "socketpair"}, + {SYS_SEND, "send"}, + {SYS_RECV, "recv"}, + {SYS_SENDTO, "sendto"}, + {SYS_RECVFROM, "recvfrom"}, + {SYS_SHUTDOWN, "shutdown"}, + {SYS_SETSOCKOPT, "setsockopt"}, + {SYS_GETSOCKOPT, "getsockopt"}, + {SYS_SENDMSG, "sendmsg"}, + {SYS_RECVMSG, "recvmsg"} +}; +#define SOCK_NAMES (sizeof(socktab)/sizeof(socktab[0])) + void usage(void) { fprintf(stderr, "usage: ausyscall [arch] name | number | --dump | --exact\n"); @@ -119,6 +147,14 @@ int main(int argc, char *argv[]) if (n && strcasestr(n, name)) { found = 1; printf("%-18s %d\n", n, i); + } else if (n && strcmp(n, "socketcall") == 0) { + int j = 0; + for (j = 0; j < SOCK_NAMES; j++) + if (strcmp(socktab[j].name, name) == 0) { + found = 1; + printf("%-18s %d\n", n, i); + break; + } } } if (!found) {