Re: [PATCH v2 01/13] audit: log all six syscall arguments in the SYSCALL record

[sashiko-bot@kernel.org]

> The SYSCALL record currently logs only four of the six syscall
> arguments (a0-a3). The remaining two are captured but silently
> discarded before reaching the audit context. This leads to the
> need for auxiliary records when audit-relevant data lands in the
> 5th or 6th argument of a syscall.
> 
> Extend the SYSCALL record to log all six arguments, by adding
> arguments a4 and a5 (5th and 6th syscall arguments respectively)
> inline within the existing record. Also add the two new args to
> the audit rules switch case, so audit rules can filter on them.
> 
> Rather than plumbing two more register arguments through every
> architecture's syscall entry path, change __audit_syscall_entry()
> to take a pointer to pt_regs and use syscall_get_arguments() to
> retrieve all six arguments.
> 
>  audit-testsuite# make test
>  audit-testsuite# ausearch -i -m SYSCALL
>  ...
>  type=SYSCALL ... syscall=sendto success=yes exit=1088 a0=0x4
>   a1=0x7ffe43518b60 a2=0x440 a3=0x0 a4=7ffe43518b4c a5=c
>  type=SYSCALL ... syscall=openat2 success=yes exit=4 a0=0x3
>   a1=0x7fffc74692c8 a2=0x7fffc7467390 a3=0x18 a4=0 a5=7fffc74674f8
>  type=SYSCALL ... syscall=openat success=yes exit=3 a0=AT_FDCWD
>   a1=0x557ced4141a2 a2=O_RDWR|O_NONBLOCK a3=0x0 a4=0 a5=0
>  ...
> 
> Suggested-by: Will Deacon <will@kernel.org>
> Link: https://lore.kernel.org/audit/CAHC9VhSjEt_-Bsra4AEqWv+Daw5Ff=gqy7dX4Ah11RVhdyCBUQ@mail.gmail.com/T/#t
> Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1788351089.git.rrobaina@redhat.com?part=1