On Wednesday 07 November 2007 12:04:46 am Yuichi Nakamura wrote:
> I found syscall audit does not work on SH(SuperH).
> I made patch to support syscall audit for SH.
I think this is close, but it looks like you missed the syscall classification
piece. You can find an example here:
arch/x86_64/kernel/audit.c
Its used for determining which syscalls we are interested in for watches.
Also, IBM and HP both have released audit test suites. You should run the CAPP
tests at a minimum to see if you have hooked everything that is expected. If
you have SE Linux enabled for that platform, you may want to try the LSPP
tests but you would need have the MLS policy installed.
IBM's announcement is here:
https://www.redhat.com/archives/redhat-lspp/2007-August/msg00002.html
and HP's here:
https://www.redhat.com/archives/linux-audit/2007-August/msg00030.html
And...user space would need an update for the syscall table and arches so that
you can run the tests. Please send that patch to linux-audit mail list.
Thanks,
-Steve
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
