[PATCH 0/2] Update audit syscall classification for execve variants

David Drysdale drysdale at google.com
Fri Mar 6 15:40:36 UTC 2015


Add a couple of missing execve variants to the syscall
classification code in the audit system.

 - Patch 1 is potentially suitable for 3.19 stable.
 - Patch 2 need not be back-applied, as audit doesn't yet work
   with x32 syscalls in general.

David Drysdale (2):
  audit: add execveat to syscall classification
  audit,x86: add x32_execve[at] to syscall classification

 arch/x86/kernel/audit_64.c | 6 ++++++
 lib/compat_audit.c         | 3 +++
 2 files changed, 9 insertions(+)

--
1.9.1




More information about the Linux-audit mailing list