[GH-ISSUE #6440] build: error: 'AUDIT_ARCH_AARCH64' undeclared on Linux <3.17 #3272

New issue

Open

opened 2026-05-05 09:52:45 -06:00 by gitea-mirror · 0 comments

gitea-mirror commented

2026-05-05 09:52:45 -06:00

Owner

Originally created by @snakethatlovesstaticlibs on GitHub (Aug 20, 2024).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6440

Description

On e8b693c814/src/include/seccomp.h (L115), firejail uses AUDIT_ARCH_AARCH64, however this symbol is only defined starting linux version 3.17: 875cbf3e46 (see the Github tag views)

Steps to Reproduce

Try to build the latest version of firejail / seccomp on a platform with a kernel version of 3.10, see that it fails with:

../include/seccomp.h:114:25: error: 'AUDIT_ARCH_AARCH64' undeclared (first use in this function); did you mean 'AUDIT_ARCH_SPARC64'?
  114 | # define ARCH_NR        AUDIT_ARCH_AARCH64
      |                         ^~~~~~~~~~~~~~~~~~
../include/seccomp.h:198:38: note: in expansion of macro 'ARCH_NR'
  198 |      BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ARCH_NR, 1, 0), \
      |                                      ^~~~~~~
sbox.c:113:25: note: in expansion of macro 'VALIDATE_ARCHITECTURE'
  113 |                         VALIDATE_ARCHITECTURE,
      |                         ^~~~~~~~~~~~~~~~~~~~~
../include/seccomp.h:114:25: note: each undeclared identifier is reported only once for each function it appears in
  114 | # define ARCH_NR        AUDIT_ARCH_AARCH64
      |                         ^~~~~~~~~~~~~~~~~~
../include/seccomp.h:198:38: note: in expansion of macro 'ARCH_NR'
  198 |      BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ARCH_NR, 1, 0), \
      |                                      ^~~~~~~
sbox.c:113:25: note: in expansion of macro 'VALIDATE_ARCHITECTURE'
  113 |                         VALIDATE_ARCHITECTURE,
      |                         ^~~~~~~~~~~~~~~~~~~~~

Additional context

This is probably not a showstopper for us, I am slightly concerned though that we need to use newer kernel header versions when targeting an older kernel version

Environment

Name/version/arch of the Linux kernel (e.g. the output of uname -srm) Kernel version 3.10
Name/version of the Linux distribution (e.g. "Ubuntu 20.04" or "Arch Linux") Centos 7
Name/version of the C compiler (e.g. "gcc 14.1.1-1") gcc-13
Name/version of the libc (e.g. "glibc 2.40-1") glibc 2.17
Version of the Linux API headers (e.g. "linux-api-headers 6.10-1" on Arch Linux) 3.10
Version of the source code being built (e.g. the output of git rev-parse HEAD) 0.9.72

Originally created by @snakethatlovesstaticlibs on GitHub (Aug 20, 2024). Original GitHub issue: https://github.com/netblue30/firejail/issues/6440  ### Description On https://github.com/netblue30/firejail/blob/e8b693c814a4e157bcae6f5c60d1624d185d8837/src/include/seccomp.h#L115, firejail uses `AUDIT_ARCH_AARCH64`, however this symbol is only defined starting linux version 3.17: https://github.com/torvalds/linux/commit/875cbf3e4614cfdcc7f65033e25292aec80f09c0 (see the Github tag views) ### Steps to Reproduce Try to build the latest version of firejail / seccomp on a platform with a kernel version of 3.10, see that it fails with: ``` ../include/seccomp.h:114:25: error: 'AUDIT_ARCH_AARCH64' undeclared (first use in this function); did you mean 'AUDIT_ARCH_SPARC64'? 114 | # define ARCH_NR AUDIT_ARCH_AARCH64 | ^~~~~~~~~~~~~~~~~~ ../include/seccomp.h:198:38: note: in expansion of macro 'ARCH_NR' 198 | BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ARCH_NR, 1, 0), \ | ^~~~~~~ sbox.c:113:25: note: in expansion of macro 'VALIDATE_ARCHITECTURE' 113 | VALIDATE_ARCHITECTURE, | ^~~~~~~~~~~~~~~~~~~~~ ../include/seccomp.h:114:25: note: each undeclared identifier is reported only once for each function it appears in 114 | # define ARCH_NR AUDIT_ARCH_AARCH64 | ^~~~~~~~~~~~~~~~~~ ../include/seccomp.h:198:38: note: in expansion of macro 'ARCH_NR' 198 | BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ARCH_NR, 1, 0), \ | ^~~~~~~ sbox.c:113:25: note: in expansion of macro 'VALIDATE_ARCHITECTURE' 113 | VALIDATE_ARCHITECTURE, | ^~~~~~~~~~~~~~~~~~~~~ ``` ### Additional context - This is probably not a showstopper for us, I am slightly concerned though that we need to use newer kernel header versions when targeting an older kernel version ### Environment - Name/version/arch of the Linux kernel (e.g. the output of `uname -srm`) Kernel version 3.10 - Name/version of the Linux distribution (e.g. "Ubuntu 20.04" or "Arch Linux") Centos 7 - Name/version of the C compiler (e.g. "gcc 14.1.1-1") gcc-13 - Name/version of the libc (e.g. "glibc 2.40-1") glibc 2.17 - Version of the Linux API headers (e.g. "linux-api-headers 6.10-1" on Arch Linux) 3.10 - Version of the source code being built (e.g. the output of `git rev-parse HEAD`) 0.9.72