Skip to content

Commit

Permalink
Update some syscall argument interpretations
Browse files Browse the repository at this point in the history
  • Loading branch information
RH-steve-grubb committed Mar 11, 2021
1 parent e6b199c commit fd3d39d
Show file tree
Hide file tree
Showing 2 changed files with 9 additions and 2 deletions.
1 change: 1 addition & 0 deletions ChangeLog
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
3.0.2
- In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen)
- Optionally interpret auid in auditctl -l
- Update some syscall argument interpretations

3.0.1
- Update syscall table to the 5.11 kernel
Expand Down
10 changes: 8 additions & 2 deletions auparse/interpret.c
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
/*
* interpret.c - Lookup values to something more readable
* Copyright (c) 2007-09,2011-16,2018-19 Red Hat Inc., Durham, North Carolina.
* All Rights Reserved.
* Copyright (c) 2007-09,2011-16,2018-21 Red Hat Inc.
* All Rights Reserved.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
Expand Down Expand Up @@ -2289,6 +2289,10 @@ static const char *print_a0(const char *val, const idata *id)
return print_dirfd(val);
else if (strcmp(sys, "openat") == 0)
return print_dirfd(val);
else if (strcmp(sys, "openat2") == 0)
return print_dirfd(val);
else if (strcmp(sys, "name_to_handle_at") == 0)
return print_dirfd(val);
else if (strcmp(sys, "ipccall") == 0)
return print_ipccall(val, 16);
else if (strncmp(sys, "exit", 4) == 0)
Expand Down Expand Up @@ -2423,6 +2427,8 @@ static const char *print_a2(const char *val, const idata *id)
return print_open_flags(val);
if ((strcmp(sys, "open") == 0) && (id->a1 & O_CREAT))
return print_mode_short(val, 16);
if (strcmp(sys, "open_by_handle_at") == 0)
return print_open_flags(val);
} else if (*sys == 'f') {
if (strcmp(sys, "fchmodat") == 0)
return print_mode_short(val, 16);
Expand Down

0 comments on commit fd3d39d

Please sign in to comment.