Back to main site | Back to man page index

AUSYSCALL:(8)                              System Administration Utilities                              AUSYSCALL:(8)



NAME
       ausyscall - a program that allows mapping syscall names and numbers

SYNOPSIS
       ausyscall [arch] name | number | --dump | --exact

DESCRIPTION
       ausyscall is a program that prints out the mapping from syscall name to number and reverse for the given arch.
       The arch can be anything returned by `uname -m`. If arch is not given, the program will take a guess based  on
       the  running  image.  You may give the syscall name or number and it will find the opposite. You can also dump
       the whole table with the --dump option. By default a syscall name lookup will be  a  substring  match  meaning
       that  it  will  try  to  match all occurrences of the given name with syscalls. So giving a name of chown will
       match both fchown and chown as any other syscall with chown in its name. If this behavior is not desired, pass
       the --exact flag and it will do an exact string match.

       This  program  can  be used to verify syscall numbers on a biarch platform for rule optimization. For example,
       suppose you had an auditctl rule:

       -a always, exit -S open -F exit=-EPERM -k fail-open

       If you wanted to verify that both 32 and 64 bit programs would be audited, run "ausyscall i386 open" and  then
       "ausyscall  x86_64  open".  Look  at  the  returned numbers. If they are different, you will have to write two
       auditctl rules to get complete coverage.

       -a always,exit -F arch=b32 -S open -F exit=-EPERM -k fail-open
       -a always,exit -F arch=b64 -S open -F exit=-EPERM -k fail-open

       For more information about a specific syscall, use the man program and pass the number 2  as  an  argument  to
       make  sure  that  you get the syscall information rather than a shell script program or glibc function call of
       the same name. For example, if you wanted to learn about the open syscall, type: man 2 open.

OPTIONS
       --dump Print all syscalls for the given arch

       --exact
              Instead of doing a partial word match, match the given syscall name exactly.


SEE ALSO
       ausearch(8), auditctl(8).


AUTHOR
       Steve Grubb



Red Hat                                                Nov 2008                                         AUSYSCALL:(8)