arch question in rules
Q: Should I remove the arch=b32 audit rules if all machines are 64-bit? Previously we had both; loaded same ruleset everywhere.
Thx,
LCB.
Signature · 2 lines
LC (Lenny) Bruzenak [email protected]
Quoted 2 lines · LC Bruzenak
Q: Should I remove the arch=b32 audit rules if all machines are 64-bit? Previously we had both; loaded same ruleset everywhere.
If you had a i386, you could drop the b64 rules. However, x86_64 has both 32 and 64 bit syscalls. So you need both for full coverage.
-Steve