Red Hat Bugzilla – Bug 221663
LSPP: The auidt record for some ipc system calls add 0x100 to the cmd argument audited.
Last modified: 2007-11-30 17:07:39 EST
Description of problem:
The auidt record for some ipc system calls add 0x100 to the last argument
audited. Specifically calls to semctl and msgctl demonstrate this.
semctl(id, 0, IPC_RMID);
Expected argument: a0 = SEMCTL, a1 = id, a2 = 0, a3 = 0 (IPC_RMID)
Actual arguments seen in the audit log: a0 = SEMCTL, a1 = id, a2 = 0, a3 = 0x100
msgctl(id, IPC_STAT, &buf)
Expected argument: a0 = MSGCTL, a1 = id, a2 = 2 (IPC_STAT)
Actual arguments seen in the audit log: a0 = MSGCTL, a1 = id, a2 = 0x102
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. Setup auditing to audit the ipc system call
2. Perform a semctl or msgctl as described above
3. Look at the audit log.
See the a3 argument for semctl or a2 argument for msgctl is actually equal to
the value input + 0x100
See the a3 argument for semctl or a2 argument for msgctl be equal to the value
input (such as IPC_RMID or IPC_STAT)
* Version flags for semctl, msgctl, and shmctl commands
* These are passed as bitflags or-ed with the actual command
#define IPC_OLD 0 /* Old version (no 32-bit UID support on many
#define IPC_64 0x0100 /* New version (support 32-bit UIDs, bigger
message sizes, etc. */
Looks like userspace will or the value with IPC_64 to indicate the version it
supports. I believe for all arches we deal with it will happen for everything.
I think this just needs to be documented in the same place as the last similar
QE ack for RHEL5 . . . granted, it's after the patch submission deadline as well
as the RC kernel freeze, so not sure what this does to us, but appears this
change is necessary for LSPP.
I'm closing this as 'not a bug' the |= 0x100 you see in the result is simply
userspace telling the kernel the version it supports. I would suggest that all
automated audit tests simply &= ~0x100 (or something along those lines) before
checking the result. This is not a bug and is working as intended.