32bit and 64bit syscall issues
Klaus Weidner
klaus at atsec.com
Tue Mar 15 20:17:33 UTC 2005
On Mon, Mar 14, 2005 at 03:12:26PM -0500, Steve Grubb wrote:
> On Monday 14 March 2005 14:49, Debora Velarde wrote:
> > I believe Klaus said he got the info in the file he sent me from the kernel
> > syscall table.
>
> I think those are function names, but not the syscall names. For example,
> __NR_chown is chown and __NR_chown32 is chown32. What function implements
> them is internal to the kernel. User space knows it only by the __NR_
> notation.
Yes, the data I have was extracted by a script from the kernel syscall
tables and uses the kernel function names as used to build the tables.
There are some differences in the naming scheme but I haven't noticed
anything major other than the numbering schemes and some "old"/"new"
prefix or suffix differences.
The problem with the userspace headers is that they are not always in
sync with the syscalls the kernel actually implements...
-Klaus
More information about the Linux-audit
mailing list