On Fri, Mar 20, 2015 at 9:29 PM, Paul Moore [off-list ref] wrote:
On Fri, Mar 20, 2015 at 12:55 AM, [off-list ref] wrote:
quoted
From: Li RongQing <redacted>
After 2f9783669 [ARM: 7412/1: audit: use only AUDIT_ARCH_ARM regardless
of endianness], no kernel user uses this macro;
Keeping this macro, only makes the compiling old version audit [before
changeset 931 Improve ARM and AARCH64 support] success, but the audit
program can not work with the kernel after 2f9783669 still,
since no syscall entry is enabled for AUDIT_ARCH_ARMEB in kernel.
so remove it to force to use the latest audit program
Signed-off-by: Li RongQing <redacted>
---
other workaround is to define AUDIT_ARCH_ARMEB as AUDIT_ARCH_ARM,
but it seems very strange
include/uapi/linux/audit.h | 1 -
1 file changed, 1 deletion(-)
Since this #define lives in the user visible headers I don't want to
remove it and risk causing a userspace breakage. Leaving the #define
in the header, even if it is unused by modern userspace, is harmless.
it is harm, when I compile the audit-2.3.2 for a arm machine, whose linux kernel
is 3.14; no compile error, but audit does not work; since the audit is
--
paul moore
www.paul-moore.com