AUSYSCALL - Online Linux Manual PageSection : 8
Updated : Feb 2023
Source : Red Hat
Note : System Administration Utilities
NAMEausyscall − a program that allows mapping syscall names and numbers
SYNOPSISausyscall [arch] name | number | −−dump | −−exact
DESCRIPTIONausyscall is a program that prints out the mapping from syscall name to number and reverse for the given arch. The arch can be anything returned by `uname −m`. If arch is not given, the program will take a guess based on the running image. Or for convenience, you can pass b32 or b64 to use the current arch but a specific ABI. You may give the syscall name or number and it will find the opposite. You can also dump the whole table with the −−dump option. By default a syscall name lookup will be a substring match meaning that it will try to match all occurrences of the given name with syscalls. So giving a name of chown will match both fchown and chown as any other syscall with chown in its name. If this behavior is not desired, pass the −−exact flag and it will do an exact string match. The program takes the special arch, uring, to denote that you want to specify io_uring operations. In this case, the arch must be given because it will otherwise detect the underlying harware. This program can be used to verify syscall numbers on a biarch platform for rule optimization. For example, suppose you had an auditctl rule: −a always, exit −S open −F exit=−EPERM −k fail−open If you wanted to verify that both 32 and 64 bit programs would be audited, run "ausyscall i386 open" and then "ausyscall x86_64 open". (Or use the b32 and b64 option.) Look at the returned numbers. If they are different, you will have to write two auditctl rules to get complete coverage. −a always,exit −F arch=b32 −S open −F exit=−EPERM −k fail−open
−a always,exit −F arch=b64 −S open −F exit=−EPERM −k fail−openFor more information about a specific syscall, use the man program and pass the number 2 as an argument to make sure that you get the syscall information rather than a shell script program or glibc function call of the same name. For example, if you wanted to learn about the open syscall, type: man 2 open.
OPTIONS−−dump Print all syscalls for the given arch −−exact Instead of doing a partial word match, match the given syscall name exactly.
SEE ALSOausearch(8), auditctl(8).
AUTHORSteve Grubb 0
Johanes Gumabo
Data Size : 5,769 byte
man-ausyscall.8Build : 2024-12-05, 20:55 :
Visitor Screen : x
Visitor Counter ( page / site ) : 5 / 181,917
Visitor ID : :
Visitor IP : 3.144.28.90 :
Visitor Provider : AMAZON-02 :
Provider Position ( lat x lon ) : 39.962500 x -83.006100 : x
Provider Accuracy Radius ( km ) : 1000 :
Provider City : Columbus :
Provider Province : Ohio , : ,
Provider Country : United States :
Provider Continent : North America :
Visitor Recorder : Version :
Visitor Recorder : Library :
Online Linux Manual Page : Version : Online Linux Manual Page - Fedora.40 - march=x86-64 - mtune=generic - 24.12.05
Online Linux Manual Page : Library : lib_c - 24.10.03 - march=x86-64 - mtune=generic - Fedora.40
Online Linux Manual Page : Library : lib_m - 24.10.03 - march=x86-64 - mtune=generic - Fedora.40
Data Base : Version : Online Linux Manual Page Database - 24.04.13 - march=x86-64 - mtune=generic - fedora-38
Data Base : Library : lib_c - 23.02.07 - march=x86-64 - mtune=generic - fedora.36
Very long time ago, I have the best tutor, Wenzel Svojanovsky . If someone knows the email address of Wenzel Svojanovsky , please send an email to johanes_gumabo@yahoo.co.id .
If error, please print screen and send to johanes_gumabo@yahoo.co.id
Under development. Support me via PayPal.