AUSYSCALL - Online Linux Manual PageSection : 8
Updated : Feb 2023
Source : Red Hat
Note : System Administration Utilities

NAMEausyscall − a program that allows mapping syscall names and numbers

SYNOPSISausyscall [arch] name | number | −−dump | −−exact

DESCRIPTIONausyscall is a program that prints out the mapping from syscall name to number and reverse for the given arch. The arch can be anything returned by `uname −m`. If arch is not given, the program will take a guess based on the running image. Or for convenience, you can pass b32 or b64 to use the current arch but a specific ABI. You may give the syscall name or number and it will find the opposite. You can also dump the whole table with the −−dump option. By default a syscall name lookup will be a substring match meaning that it will try to match all occurrences of the given name with syscalls. So giving a name of chown will match both fchown and chown as any other syscall with chown in its name. If this behavior is not desired, pass the −−exact flag and it will do an exact string match. The program takes the special arch, uring, to denote that you want to specify io_uring operations. In this case, the arch must be given because it will otherwise detect the underlying harware. This program can be used to verify syscall numbers on a biarch platform for rule optimization. For example, suppose you had an auditctl rule: −a always, exit −S open −F exit=−EPERM −k fail−open If you wanted to verify that both 32 and 64 bit programs would be audited, run "ausyscall i386 open" and then "ausyscall x86_64 open". (Or use the b32 and b64 option.) Look at the returned numbers. If they are different, you will have to write two auditctl rules to get complete coverage. −a always,exit −F arch=b32 −S open −F exit=−EPERM −k fail−open −a always,exit −F arch=b64 −S open −F exit=−EPERM −k fail−openFor more information about a specific syscall, use the man program and pass the number 2 as an argument to make sure that you get the syscall information rather than a shell script program or glibc function call of the same name. For example, if you wanted to learn about the open syscall, type: man 2 open.

OPTIONS−−dump  Print all syscalls for the given arch −−exact  Instead of doing a partial word match, match the given syscall name exactly.

SEE ALSOausearch(8), auditctl(8).

AUTHORSteve Grubb
0
Johanes Gumabo
Data Size   :   5,769 byte
man-ausyscall.8Build   :   2024-12-05, 20:55   :  
Visitor Screen   :   x
Visitor Counter ( page / site )   :   5 / 181,917
Visitor ID   :     :  
Visitor IP   :   3.144.28.90   :  
Visitor Provider   :   AMAZON-02   :  
Provider Position ( lat x lon )   :   39.962500 x -83.006100   :   x
Provider Accuracy Radius ( km )   :   1000   :  
Provider City   :   Columbus   :  
Provider Province   :   Ohio ,   :   ,
Provider Country   :   United States   :  
Provider Continent   :   North America   :  
Visitor Recorder   :   Version   :  
Visitor Recorder   :   Library   :  
Online Linux Manual Page   :   Version   :   Online Linux Manual Page - Fedora.40 - march=x86-64 - mtune=generic - 24.12.05
Online Linux Manual Page   :   Library   :   lib_c - 24.10.03 - march=x86-64 - mtune=generic - Fedora.40
Online Linux Manual Page   :   Library   :   lib_m - 24.10.03 - march=x86-64 - mtune=generic - Fedora.40
Data Base   :   Version   :   Online Linux Manual Page Database - 24.04.13 - march=x86-64 - mtune=generic - fedora-38
Data Base   :   Library   :   lib_c - 23.02.07 - march=x86-64 - mtune=generic - fedora.36

Very long time ago, I have the best tutor, Wenzel Svojanovsky . If someone knows the email address of Wenzel Svojanovsky , please send an email to johanes_gumabo@yahoo.co.id .
If error, please print screen and send to johanes_gumabo@yahoo.co.id
Under development. Support me via PayPal.