On 2021-03-18 11:52, Christian Brauner wrote: > On Thu, Mar 18, 2021 at 11:48:45AM +0100, Christian Brauner wrote: > > On Wed, Mar 17, 2021 at 09:47:17PM -0400, Richard Guy Briggs wrote: > > > The openat2(2) syscall was added in kernel v5.6 with commit fddb5d430ad9 > > > ("open: introduce openat2(2) syscall") > > > Add the openat2(2) syscall to the audit syscall classifier. > > > See the github issue > > > https://github.com/linux-audit/audit-kernel/issues/67 > > > Signed-off-by: Richard Guy Briggs ... > And one more comment, why return a hard-coded integer from all of these > architectures instead of introducing an enum in a central place with > proper names idk: Oh, believe me, I tried hard to do that because I really don't like hard-coded magic values, but for expediency I continued the same approach until I could sort out the header file mess. There was an extra preparatory patch (attached) in this patchset with a different audit syscall perms patch (also attached). By including "#include " in each of the compat source files there were warnings of redefinitions of every __NR_* syscall number. The easiest way to get rid of it would have been to pull the new AUDITSC_* definitions into a new file and include that from and each of the arch/*/*/*audit.c (and lib/*audit.c) files. > enum audit_match_perm_t { > . > . > . > AUDIT_MATCH_PERM_EXECVE = 5, > AUDIT_MATCH_PERM_OPENAT2 = 6, > . > . > . > } > > Then you can drop these hard-coded comments too and it's way less > brittle overall. Totally agree. > Christian - RGB -- Richard Guy Briggs Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635