32bit and 64bit syscall issues

Klaus Weidner klaus at atsec.com
Tue Mar 15 20:17:33 UTC 2005


On Mon, Mar 14, 2005 at 03:12:26PM -0500, Steve Grubb wrote:
> On Monday 14 March 2005 14:49, Debora Velarde wrote:
> > I believe Klaus said he got the info in the file he sent me from the kernel
> > syscall table.
> 
> I think those are function names, but not the syscall names. For example,  
> __NR_chown is chown  and __NR_chown32 is chown32. What function implements 
> them is internal to the kernel. User space knows it only by the __NR_ 
> notation.

Yes, the data I have was extracted by a script from the kernel syscall
tables and uses the kernel function names as used to build the tables.

There are some differences in the naming scheme but I haven't noticed
anything major other than the numbering schemes and some "old"/"new"
prefix or suffix differences.

The problem with the userspace headers is that they are not always in
sync with the syscalls the kernel actually implements...

-Klaus




More information about the Linux-audit mailing list