AUSYSCALL(8)

✨ AUSYSCALL(8) ✨

okay bestie, sit DOWN, because ausyscall is one of those lil system administration utilities from the ausyscall page (section 8, admin girlies) that is genuinely so useful and lowkey underrated. it's a program that lets you map syscall names ↔ numbers. that's the whole vibe. and honestly? slay.

---

💅 NAME 💅

ausyscall — a program that allows mapping syscall names and numbers 🦋

---

🎀 SYNOPSIS 🎀

ausyscall [arch] name | number | --dump | --exact

---

💖 DESCRIPTION 💖

so what does this icon actually DO? ausyscall prints out the mapping from syscall name to number, and the reverse, for whatever arch you give it. the arch can be literally anything that uname -m returns. if you don't give an arch at all, it'll just take a guess based on the running image — no thoughts, head empty, it just knows. OR, for convenience, you can pass b32 or b64 to use the current arch but with a specific ABI. bestie that's the good stuff.

you hand it a syscall name or a number and it finds the opposite for you. you can also just dump the entire table with the --dump option, like emptying out the whole drawer. 🫶

okay now here's the part that gets people: by default, a syscall name lookup is a substring match, meaning it will try to match all occurrences of the given name with syscalls. so if you give it the name chown, it will match both fchown and chown, plus any other syscall that has chown somewhere in its name. it's giving "find all my friends with this name". if that behavior is not what you want, pass the --exact flag and it'll do an exact string match instead. periodt.

the program also takes a special arch, uring, to denote that you want to specify io_uring operations. heads up tho: in that case the arch must be given, because otherwise it will just detect the underlying hardware instead. no cap.

---

🌈 the biarch glow-up 🌈

you can use this program to verify syscall numbers on a biarch platform for rule optimization. for example, suppose you had an auditctl rule:

-a always, exit -S open -F exit=-EPERM -k fail-open

if you wanted to verify that both 32 and 64 bit programs would be audited, run ausyscall i386 open and then ausyscall x86_64 open. (or use the b32 and b64 option.) look at the returned numbers. if they are different, you will have to write two auditctl rules to get complete coverage. two rules, two vibes, both iconic:

-a always,exit -F arch=b32 -S open -F exit=-EPERM -k fail-open
-a always,exit -F arch=b64 -S open -F exit=-EPERM -k fail-open

for more information about a specific syscall, use the man program and pass the number 2 as an argument to make sure that you get the syscall information rather than a shell script program or glibc function call of the same name. for example, if you wanted to learn about the open syscall, type: man 2 open. iykyk. 😌

---

✨ OPTIONS ✨

• --dump — print all syscalls for the given arch. the whole table, the full tea, everything. 🍓
• --exact — instead of doing a partial word match, match the given syscall name exactly. no extras, no strays, just the one. 💅

---

🔎 SEE ALSO 🔎

ausearch(8), auditctl(8).

---

👑 AUTHOR 👑

Steve Grubb

---

and that's the whole page bestie!! go map some syscalls, verify those numbers, and stay exact. 🧚

this lil beauty came to you from Red Hat, dated Feb 2023 — mwah, sending love, go forth and audit 💜