[Audit-test-developer] [PATCH 18/19] filter: specify arch= for auditctl

[Jiri J. <jja...@re...>]

This fixes the following warning:
WARNING - 32/64 bit syscall mismatch, you should specify an arch

Signed-off-by: Jiri Jaburek <jja...@re...>
---
 audit-test/filter/tests/test_auid.bash      | 4 ++--
 audit-test/filter/tests/test_dev_inode.bash | 8 ++++----
 audit-test/filter/tests/test_success.bash   | 2 +-
 audit-test/filter/tests/test_syscall.bash   | 2 +-
 audit-test/filter/tests/test_type.bash      | 4 ++--
 5 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/audit-test/filter/tests/test_auid.bash b/audit-test/filter/tests/test_auid.bash
index 297ebbf..c165cf3 100755
--- a/audit-test/filter/tests/test_auid.bash
+++ b/audit-test/filter/tests/test_auid.bash
@@ -33,8 +33,8 @@ do_open_file $tmp1
 augrok --seek=$log_mark "name==$tmp1" "auid==$user_auid" \
     && exit_error "Unexpected record found."
 
-auditctl -a exit,always -S open -F auid=$user_auid
-prepend_cleanup "auditctl -d exit,always -S open -F auid=$user_auid"
+auditctl -a exit,always -F arch=b$MODE -S open -F auid=$user_auid
+prepend_cleanup "auditctl -d exit,always -F arch=b$MODE -S open -F auid=$user_auid"
 
 # audit log marker
 log_mark=$(stat -c %s $audit_log)
diff --git a/audit-test/filter/tests/test_dev_inode.bash b/audit-test/filter/tests/test_dev_inode.bash
index ae818c6..30ea580 100755
--- a/audit-test/filter/tests/test_dev_inode.bash
+++ b/audit-test/filter/tests/test_dev_inode.bash
@@ -34,12 +34,12 @@ minor=$((0x$minor))
 event_obj=$(get_event_obj $1)
 [[ $event_obj != $tmp1 ]] && prepend_cleanup "rm -f $event_obj"
 
-auditctl -a exit,always -S open -F key=$tmp1 -F inode=$inode \
-    -F devmajor=$major -F devminor=$minor
+auditctl -a exit,always -F arch=b$MODE -S open -F key=$tmp1 \
+    -F inode=$inode -F devmajor=$major -F devminor=$minor
 
 prepend_cleanup "
-    auditctl -d exit,always -S open -F key=$tmp1 -F inode=$inode \
--F devmajor=$major -F devminor=$minor"
+auditctl -d exit,always -F arch=b$MODE -S open -F key=$tmp1 \
+    -F inode=$inode -F devmajor=$major -F devminor=$minor"
 
 log_mark=$(stat -c %s $audit_log)
 
diff --git a/audit-test/filter/tests/test_success.bash b/audit-test/filter/tests/test_success.bash
index aa8d1b4..497959b 100755
--- a/audit-test/filter/tests/test_success.bash
+++ b/audit-test/filter/tests/test_success.bash
@@ -37,7 +37,7 @@ case $op in
         ;;
     *) exit_fail "unknown test operation" ;;
 esac
-filter_rule="exit,always -S open"
+filter_rule="exit,always -F arch=b$MODE -S open"
 
 auditctl -a $filter_rule $filter_field
 prepend_cleanup "auditctl -d $filter_rule $filter_field"
diff --git a/audit-test/filter/tests/test_syscall.bash b/audit-test/filter/tests/test_syscall.bash
index 3c96628..8159b92 100755
--- a/audit-test/filter/tests/test_syscall.bash
+++ b/audit-test/filter/tests/test_syscall.bash
@@ -27,7 +27,7 @@ syscall_num=$(augrok --resolve $syscall_name) \
 
 op=$1
 case $op in
-    name)   filter_rule="exit,always -S open" ;;
+    name)   filter_rule="exit,always -F arch=b$MODE -S open" ;;
     number) filter_rule="exit,always -S $syscall_num";;
     *) exit_fail "unknown test operation" ;;
 esac
diff --git a/audit-test/filter/tests/test_type.bash b/audit-test/filter/tests/test_type.bash
index 4318428..16c63f4 100755
--- a/audit-test/filter/tests/test_type.bash
+++ b/audit-test/filter/tests/test_type.bash
@@ -29,8 +29,8 @@ source filter_functions.bash || exit 2
 user_auid=$(cat /proc/self/loginuid)
 
 # setup auditctl
-auditctl -a exit,always -S open -F auid=$user_auid
-prepend_cleanup "auditctl -d exit,always -S open -F auid=$user_auid"
+auditctl -a exit,always -F arch=b$MODE -S open -F auid=$user_auid
+prepend_cleanup "auditctl -d exit,always -F arch=b$MODE -S open -F auid=$user_auid"
 
 # audit log marker
 log_mark=$(stat -c %s $audit_log)
-- 
1.8.3.1