[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: Incorrect value of ptrace's 4th argument on zSeries

linux-audit-bounces redhat com wrote on 02/15/2006 10:56:36 AM:

> Hey all,
> I've found an issue with the logging of the value of the 4th
> argument of the ptrace syscall.
> The call is: ptrace(PTRACE_TRACEME,0,0,0)   and  ptrace(PTRACE_KILL,
> 1,0,0) the value of the 4th argument, that is the 0, is logged as
> the following:
> type=SYSCALL msg=audit(1140022035.377:246959): arch=16 syscall=26
> success=yes exit=0 a0=0 a1=0 a2=0 a3=20000000000 items=0 pid=5236
> auid=500 uid=501 gid=501 euid=501 suid=0 fsuid=501 egid=501 sgid=0
> fsgid=501 comm="ptrace_test" exe="/rhcc/lspp/tests/LTP/ltp-
> merged/testcases/audit/syscalls/ptrace_test"
> As you can see, a3 is logged as "a3=20000000000".
> I am not sure if this extends to other syscalls, but this issue
> makes logging with specific argument values challenging at best.

Adendum: This seems to be happening for all syscalls's 4th argument field. There is a padding of 200 going on, regardless of the value of the inital value provided to the system call. I assume it is an issue with the bit-mode, as the execution is happening under 32-bit mode, and the system is a native 64-bit.

> Mike--
> Linux-audit mailing list
> Linux-audit redhat com
> https://www.redhat.com/mailman/listinfo/linux-audit

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]