From df5afa4fcd9725380f94ca6476248d4cc24f889a Mon Sep 17 00:00:00 2001 From: Ashlee Young Date: Sun, 29 Nov 2015 08:22:13 -0800 Subject: v2.4.4 audit sources Change-Id: I9315a7408817db51edf084fb4d27fbb492785084 Signed-off-by: Ashlee Young --- framework/src/audit/tools/ausyscall/ausyscall.8 | 34 +++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 framework/src/audit/tools/ausyscall/ausyscall.8 (limited to 'framework/src/audit/tools/ausyscall/ausyscall.8') diff --git a/framework/src/audit/tools/ausyscall/ausyscall.8 b/framework/src/audit/tools/ausyscall/ausyscall.8 new file mode 100644 index 00000000..16f9196e --- /dev/null +++ b/framework/src/audit/tools/ausyscall/ausyscall.8 @@ -0,0 +1,34 @@ +.TH AUSYSCALL: "8" "Nov 2008" "Red Hat" "System Administration Utilities" +.SH NAME +ausyscall \- a program that allows mapping syscall names and numbers +.SH SYNOPSIS +.B ausyscall [arch] name | number | \-\-dump | \-\-exact +.SH DESCRIPTION +\fBausyscall\fP is a program that prints out the mapping from syscall name to number and reverse for the given arch. The arch can be anything returned by `uname \-m`. If arch is not given, the program will take a guess based on the running image. You may give the syscall name or number and it will find the opposite. You can also dump the whole table with the \-\-dump option. By default a syscall name lookup will be a substring match meaning that it will try to match all occurrences of the given name with syscalls. So giving a name of chown will match both fchown and chown as any other syscall with chown in its name. If this behavior is not desired, pass the \-\-exact flag and it will do an exact string match. + +This program can be used to verify syscall numbers on a biarch platform for rule optimization. For example, suppose you had an auditctl rule: + +.B \-a always, exit \-S open \-F exit=\-EPERM \-k fail\-open + +If you wanted to verify that both 32 and 64 bit programs would be audited, run "ausyscall i386 open" and then "ausyscall x86_64 open". Look at the returned numbers. If they are different, you will have to write two auditctl rules to get complete coverage. + +.nf +.B \-a always,exit \-F arch=b32 \-S open \-F exit=\-EPERM \-k fail\-open +.B \-a always,exit \-F arch=b64 \-S open \-F exit=\-EPERM \-k fail\-open +.fi + +For more information about a specific syscall, use the man program and pass the number 2 as an argument to make sure that you get the syscall information rather than a shell script program or glibc function call of the same name. For example, if you wanted to learn about the open syscall, type: man 2 open. +.SH OPTIONS +.TP +.B \-\-dump +Print all syscalls for the given arch +.TP +.B \-\-exact +Instead of doing a partial word match, match the given syscall name exactly. + +.SH "SEE ALSO" +.BR ausearch (8), +.BR auditctl (8). + +.SH AUTHOR +Steve Grubb -- cgit 1.2.3-korg