clone flags

John D. Ramsdell ramsdell at mitre.org
Fri Jul 20 11:07:57 UTC 2007


Eric Paris <eparis at redhat.com> writes:

> So I'd say change all your stuff to look only at a0 for clone and
> someone (sgrubb already knows) needs to fix auparse to look for the
> flags in a0 not in a2.

I notice the name of the getdents64 system call is printed as
getdents.  I'll carefully study the output of strace and autrace on
all the system calls I monitor, and supply a patch that fixes
discrepancies.  The code in auparse/interpret.c seems straightforward.

John




More information about the Linux-audit mailing list