For all arches which support audit implement syscall_get_arch() They are all pretty easy and straight forward, stolen from how the call to audit_syscall_entry() determines the arch.
Showing the changes to include/uapi/linux (1 of 8 files). Show all
Unified · Split
| @@ -351,6 +351,7 @@ enum { · 350 unmodified lines | |||
| 351 | #define AUDIT_ARCH_IA64 (EM_IA_64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE) | 351 | #define AUDIT_ARCH_IA64 (EM_IA_64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE) |
| 352 | #define AUDIT_ARCH_M32R (EM_M32R) | 352 | #define AUDIT_ARCH_M32R (EM_M32R) |
| 353 | #define AUDIT_ARCH_M68K (EM_68K) | 353 | #define AUDIT_ARCH_M68K (EM_68K) |
| 354 | #define AUDIT_ARCH_MICROBLAZE (EM_MICROBLAZE) | ||
| 354 | #define AUDIT_ARCH_MIPS (EM_MIPS) | 355 | #define AUDIT_ARCH_MIPS (EM_MIPS) |
| 355 | #define AUDIT_ARCH_MIPSEL (EM_MIPS|__AUDIT_ARCH_LE) | 356 | #define AUDIT_ARCH_MIPSEL (EM_MIPS|__AUDIT_ARCH_LE) |
| 356 | #define AUDIT_ARCH_MIPS64 (EM_MIPS|__AUDIT_ARCH_64BIT) | 357 | #define AUDIT_ARCH_MIPS64 (EM_MIPS|__AUDIT_ARCH_64BIT) |