func getDisplayArch()

in rule/rule.go [903:935]


func getDisplayArch(archID uint32) (string, error) {
	runtimeArchStr, err := getRuntimeArch()
	if err != nil {
		return "", err
	}
	runtimeArchU32, ok := reverseArch[runtimeArchStr]
	if !ok {
		return "", errors.New("current architecture not supported")
	}
	runtimeArch := auparse.AuditArch(runtimeArchU32)
	requestedArch := auparse.AuditArch(archID)
	if requestedArch == runtimeArch {
		switch requestedArch {
		case auparse.AUDIT_ARCH_AARCH64, auparse.AUDIT_ARCH_X86_64, auparse.AUDIT_ARCH_PPC64, auparse.AUDIT_ARCH_S390X:
			return "b64", nil
		case auparse.AUDIT_ARCH_ARM, auparse.AUDIT_ARCH_I386, auparse.AUDIT_ARCH_PPC, auparse.AUDIT_ARCH_S390:
			return "b32", nil
		}
	} else {
		switch {
		case runtimeArch == auparse.AUDIT_ARCH_AARCH64 && requestedArch == auparse.AUDIT_ARCH_ARM,
			runtimeArch == auparse.AUDIT_ARCH_X86_64 && requestedArch == auparse.AUDIT_ARCH_I386,
			runtimeArch == auparse.AUDIT_ARCH_PPC64 && requestedArch == auparse.AUDIT_ARCH_PPC,
			runtimeArch == auparse.AUDIT_ARCH_S390X && requestedArch == auparse.AUDIT_ARCH_S390:
			return "b32", nil
		}
	}
	name, ok := auparse.AuditArchNames[requestedArch]
	if !ok {
		return "", fmt.Errorf("unsupported arch=%x in rule", requestedArch)
	}
	return name, nil
}