lib/aarch64_table.h: Does the audit not support chmod syscall with aarch64 ?

[csqshz]

I find there is no line " _S(xx, "chmod") " in lib/aarch64_table.h.
Is chmod not supported by audit-userspace with aarch64？

[stevegrubb]

The aarch syscalls are defined here:

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/include/uapi/asm-generic/unistd.h?h=v5.0.7

There doesn't appear to be one.

[csqshz]

The aarch syscalls are defined here:

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/include/uapi/asm-generic/unistd.h?h=v5.0.7

There doesn't appear to be one.

Ah,
I mean audit-userspace does not support chmod, linux kernel support chmod certainly.
The file lib/aarch64_table.h is under audit-userspace.

[stevegrubb]

The file lib/aarch64_table.h is built from the kernel file mentioned above. If the kernel does not support it, then user space does not support it.

[stevegrubb]

You might try using strace against some program to see what it's using and then adjust your rules accordingly.

[stevegrubb]

Closing out this issue. There is no chmod syscall in the aarch64 syscall table.