Handle ppc64 and ppc64le syscall lookups (elastic#72)

ppc64 and ppc64le use the same syscall table as ppc. But we were missing an entry
in the syscall table for these two architectures so lookups would fail if you tried to install
an audit rule with `-F arch=ppc64le` or if go-libaudit tried to enrich messages with
the syscall names while running on those arches.

CHANGELOG.md

@@ -9,6 +9,8 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 
 ### Changed
 
+- Fixed syscall lookup for ppc64 and ppc64le. [#71](https://github.com/elastic/go-libaudit/pull/71)
+
 ### Removed
 
 ### Deprecated

auparse/mk_audit_syscalls.pl

@@ -100,4 +100,14 @@ package auparse
 print <<EOF;
 }
 
+func init() {
+	// Add "aliases" to ppc for ppc64 and ppc64le. They share the same tables.
+	ppcTable, found := AuditSyscalls["ppc"]
+	if !found {
+		panic("missing ppc syscall table")
+	}
+	AuditSyscalls["ppc64"] = ppcTable
+	AuditSyscalls["ppc64le"] = ppcTable
+}
+
 EOF

rule/rule_test.go

@@ -133,6 +133,19 @@ func TestAddSyscall(t *testing.T) {
 			assert.EqualValues(t, openSyscallNum, rule.syscalls[0])
 		}
 	})
+
+	t.Run("open", func(t *testing.T) {
+		rule := &ruleData{
+			arch: "ppc64le",
+		}
+		if err := addSyscall(rule, "open"); err != nil {
+			t.Fatal(err)
+		}
+		if assert.Len(t, rule.syscalls, 1) {
+			const openSyscallNum = 5
+			assert.EqualValues(t, openSyscallNum, rule.syscalls[0])
+		}
+	})
 }
 
 func TestAddFilter(t *testing.T) {
@@ -335,6 +348,16 @@ func TestAddFilter(t *testing.T) {
 		assert.EqualValues(t, auparse.AUDIT_ARCH_X86_64, rule.values[0])
 	})
 
+	t.Run("arch_ppc64le", func(t *testing.T) {
+		rule := &ruleData{}
+		if err := addFilter(rule, "arch", "=", "ppc64le"); err != nil {
+			t.Fatalf("%+v", err)
+		}
+		assert.EqualValues(t, archField, rule.fields[0])
+		assert.EqualValues(t, equalOperator, rule.fieldFlags[0])
+		assert.EqualValues(t, auparse.AUDIT_ARCH_PPC64LE, rule.values[0])
+	})
+
 	t.Run("perm", func(t *testing.T) {
 		rule := &ruleData{flags: exitFilter}
 		if err := addFilter(rule, "perm", "=", "wa"); err != nil {