[PATCH 0/4] arm64: Add audit support

[AKASHI Takahiro]

On 11/08/2013 11:34 PM, Will Deacon wrote:
> On Wed, Nov 06, 2013 at 10:25:42AM +0000, AKASHI Takahiro wrote:
>> This patchset adds audit support on arm64.
>> The implementation is just like in other architectures,
>> and so I think little explanation is needed.
>
> That doesn't mean you can just omit the commit messages!

I will include some commit messages in the next version.

>> I'd like to discuss about the following issues:
>> (issues)
>> * AUDIT_ARCH_*
>>    Why do we need to distiguish big-endian and little-endian? [2/4]
>
> We don't. This is only the case if the syscall ABIs differ between them (for
> AArch32, people mistakenly thought __ARMEB__ was related to AEABI.

I guessed so, but ...

>> * Userspace audit package
>>    There are some missing syscall definitions in lib/aarch64_table.h.
>>    There is no support for AUDIT_ARCH_ARM (I mean LE. armeb is BE).
>
> I did post something over a year ago... did it not get picked up?
>
>    http://permalink.gmane.org/gmane.linux.ports.arm.kernel/165266

Sounds great, but the reality is that AUDIT_ARCH_ARMEB is still used
in the latest v2.3.2, and due to this, ausearch cannot pretty-print
the architecture name in the audit log for LE.

I will ask this in linux-audit ML.

-Takahiro AKASHI

> Will
>