From mboxrd@z Thu Jan 1 00:00:00 1970 From: Klaus Weidner Subject: [PATCH] audit: fix broken class-based syscall audit Date: Wed, 16 May 2007 17:45:42 -0500 Message-ID: <20070516224542.GD11536@w-m-p.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Received: from mx1.redhat.com (mx1.redhat.com [172.16.48.31]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id l4GMjxxx009920 for ; Wed, 16 May 2007 18:45:59 -0400 Received: from mail.atsec.com (mail.atsec.com [195.30.252.105]) by mx1.redhat.com (8.13.1/8.13.1) with ESMTP id l4GMjuBA032755 for ; Wed, 16 May 2007 18:45:56 -0400 Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Linus Torvalds Cc: linux-audit@redhat.com, Al Viro List-Id: linux-audit@redhat.com Bug description: When I add an audit watch on a file with no arguments, I get perm=rwxa but on ia64, changes to the mode and context aren't audited. I get audit records on i386 and x86_64. (from https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=239887 ) The sanity check in audit_match_class() is wrong, AUDIT_BITMASK_SIZE is 64, providing space for 2048 syscalls in 64 * 32bit integers. The comparison only supports 256 syscalls (sizeof __u32 is 4), and silently returns "no match" for valid higher-numbered syscalls. This breaks class-based audit for all syscalls on ia64 since on that architecture syscall numbers start at 1024. It breaks some syscall audit on other architectures also, for example __NR_fchmodat is 306 on x86. I'd suggest adding a printk() in addition to returning 0 - you don't want to silently ignore unknown or unsupported syscalls when auditing. Signed-off-by: Klaus Weidner Followup discussion was on the linux-audit mailing list: https://www.redhat.com/archives/linux-audit/2007-May/msg00030.html Acked-by: Al Viro --- linux-2.6.18.i686/kernel/auditfilter.c.lspp.80 2007-05-11 17:06:08.000000000 -0500 +++ linux-2.6.18.i686/kernel/auditfilter.c 2007-05-11 17:09:37.000000000 -0500 @@ -306,7 +306,7 @@ int audit_match_class(int class, unsigned syscall) { - if (unlikely(syscall >= AUDIT_BITMASK_SIZE * sizeof(__u32))) + if (unlikely(syscall >= AUDIT_BITMASK_SIZE * 32)) return 0; if (unlikely(class >= AUDIT_SYSCALL_CLASSES || !classes[class])) return 0;