Handle ppc64 and ppc64le syscall lookups

CHANGELOG.md

@@ -9,6 +9,8 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 
 ### Changed
 
+- Fixed syscall lookup for ppc64 and ppc64le. [#71](https://github.com/elastic/go-libaudit/pull/71)
+
 ### Removed
 
 ### Deprecated

auparse/mk_audit_syscalls.pl

@@ -100,4 +100,14 @@ package auparse
 print <<EOF;
 }
 
+func init() {
+	// Add "aliases" to ppc for ppc64 and ppc64le. They share the same tables.
+	ppcTable, found := AuditSyscalls["ppc"]
+	if !found {
+		panic("missing ppc syscall table")
+	}
+	AuditSyscalls["ppc64"] = ppcTable
+	AuditSyscalls["ppc64le"] = ppcTable
+}
+
 EOF

rule/rule_test.go

@@ -133,6 +133,19 @@ func TestAddSyscall(t *testing.T) {
 			assert.EqualValues(t, openSyscallNum, rule.syscalls[0])
 		}
 	})
+
+	t.Run("open", func(t *testing.T) {
+		rule := &ruleData{
+			arch: "ppc64le",
+		}
+		if err := addSyscall(rule, "open"); err != nil {
+			t.Fatal(err)
+		}
+		if assert.Len(t, rule.syscalls, 1) {
+			const openSyscallNum = 5
+			assert.EqualValues(t, openSyscallNum, rule.syscalls[0])
+		}
+	})
 }
 
 func TestAddFilter(t *testing.T) {
@@ -335,6 +348,16 @@ func TestAddFilter(t *testing.T) {
 		assert.EqualValues(t, auparse.AUDIT_ARCH_X86_64, rule.values[0])
 	})
 
+	t.Run("arch_ppc64le", func(t *testing.T) {
+		rule := &ruleData{}
+		if err := addFilter(rule, "arch", "=", "ppc64le"); err != nil {
+			t.Fatalf("%+v", err)
+		}
+		assert.EqualValues(t, archField, rule.fields[0])
+		assert.EqualValues(t, equalOperator, rule.fieldFlags[0])
+		assert.EqualValues(t, auparse.AUDIT_ARCH_PPC64LE, rule.values[0])
+	})
+
 	t.Run("perm", func(t *testing.T) {
 		rule := &ruleData{flags: exitFilter}
 		if err := addFilter(rule, "perm", "=", "wa"); err != nil {