offsets for 64bit IPC mechanisms

Steve Grubb sgrubb at redhat.com
Wed Jan 10 16:13:07 UTC 2007


On Wednesday 10 January 2007 11:08, Linda Knippers wrote:
> > So the question is, should ausearch report the actual recorded register
> > value, or should it "and" the register with IPC_64 ?
>
> Since we're auditing syscalls, I think audit should report what the
> syscall sees.

OK, that's fine with me. But I wonder where all this should be documented so 
that we don't get bugzilla's opened by concerned users. Would any particular 
man page be better than others?

-Steve




More information about the Linux-audit mailing list