in rule/rule.go [903:935]
func getDisplayArch(archID uint32) (string, error) {
runtimeArchStr, err := getRuntimeArch()
if err != nil {
return "", err
}
runtimeArchU32, ok := reverseArch[runtimeArchStr]
if !ok {
return "", errors.New("current architecture not supported")
}
runtimeArch := auparse.AuditArch(runtimeArchU32)
requestedArch := auparse.AuditArch(archID)
if requestedArch == runtimeArch {
switch requestedArch {
case auparse.AUDIT_ARCH_AARCH64, auparse.AUDIT_ARCH_X86_64, auparse.AUDIT_ARCH_PPC64, auparse.AUDIT_ARCH_S390X:
return "b64", nil
case auparse.AUDIT_ARCH_ARM, auparse.AUDIT_ARCH_I386, auparse.AUDIT_ARCH_PPC, auparse.AUDIT_ARCH_S390:
return "b32", nil
}
} else {
switch {
case runtimeArch == auparse.AUDIT_ARCH_AARCH64 && requestedArch == auparse.AUDIT_ARCH_ARM,
runtimeArch == auparse.AUDIT_ARCH_X86_64 && requestedArch == auparse.AUDIT_ARCH_I386,
runtimeArch == auparse.AUDIT_ARCH_PPC64 && requestedArch == auparse.AUDIT_ARCH_PPC,
runtimeArch == auparse.AUDIT_ARCH_S390X && requestedArch == auparse.AUDIT_ARCH_S390:
return "b32", nil
}
}
name, ok := auparse.AuditArchNames[requestedArch]
if !ok {
return "", fmt.Errorf("unsupported arch=%x in rule", requestedArch)
}
return name, nil
}