[PATCH] audit: add missing syscalls to signal class

[PATCH] audit: add missing syscalls to signal class

[Jeffrey Bencteux]

The pidfd_send_signal(), rt_sigqueueinfo() and rt_tgsigqueueinfo()
system calls are missing from the AUDIT_CLASS_SIGNAL* class. It seems
to be used only in kernel/auditfilter.c to increment the audit_signals
counter.

This counter is used to determine if information related to a target
process of a syscall audit rule using signals, such as its pid,
should be logged (e54dc2431d740a79a6bd013babade99d71b1714f).

Information related to signals sent via these system calls are
currently not correctly logged. The current patch adds it to the
AUDIT_CLASS_SIGNAL* class.

Signed-off-by: Jeffrey Bencteux <jeff@bencteux.fr>
---
 include/asm-generic/audit_signal.h | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/include/asm-generic/audit_signal.h b/include/asm-generic/audit_signal.h
index 6feab7f18a53..65336a9aef7b 100644
--- a/include/asm-generic/audit_signal.h
+++ b/include/asm-generic/audit_signal.h
@@ -1,3 +1,12 @@
 __NR_kill,
 __NR_tgkill,
 __NR_tkill,
+#ifdef __NR_rt_sigqueueinfo
+__NR_rt_sigqueueinfo,
+#endif
+#ifdef __NR_rt_tgsigqueueinfo
+__NR_rt_tgsigqueueinfo,
+#endif
+#ifdef __NR_pidfd_send_signal
+__NR_pidfd_send_signal,
+#endif

base-commit: 6614d4c05c7a661a925b3d8dbf9c70faac3bd2da
-- 
2.56.0

Re: [PATCH] audit: add missing syscalls to signal class

[Arnd Bergmann]

On Wed, Nov 11, 2026, at 12:01, Jeffrey Bencteux wrote:
> diff --git a/include/asm-generic/audit_signal.h 
> b/include/asm-generic/audit_signal.h
> index 6feab7f18a53..65336a9aef7b 100644
> --- a/include/asm-generic/audit_signal.h
> +++ b/include/asm-generic/audit_signal.h
> @@ -1,3 +1,12 @@
>  __NR_kill,
>  __NR_tgkill,
>  __NR_tkill,
> +#ifdef __NR_rt_sigqueueinfo
> +__NR_rt_sigqueueinfo,
> +#endif
> +#ifdef __NR_rt_tgsigqueueinfo
> +__NR_rt_tgsigqueueinfo,
> +#endif
> +#ifdef __NR_pidfd_send_signal
> +__NR_pidfd_send_signal,
> +#endif

Why the #ifdef checks? These should be available on all architectures.

     Arnd

Re: [PATCH] audit: add missing syscalls to signal class

[Jeffrey Bencteux]

On Wed, Nov 11, 2026 at 12:18:01PM +0100, Arnd Bergmann wrote:
> Why the #ifdef checks? These should be available on all architectures.

I included them as convention, should they be removed?

Re: [PATCH] audit: add missing syscalls to signal class

[Arnd Bergmann]

On Wed, Nov 11, 2026, at 14:52, Jeffrey Bencteux wrote:
> On Wed, Nov 11, 2026 at 12:18:01PM +0100, Arnd Bergmann wrote:
>> Why the #ifdef checks? These should be available on all architectures.
>
> I included them as convention, should they be removed?

Not sure where the convention comes from, it just seemed
odd that you have the #ifdef checks for the newly added
entries but not the ones that are already in this file.

I had not checked the other files that have similar ones.

     Arnd

Re: [PATCH] audit: add missing syscalls to signal class

[Ricardo Robaina]

On Wed, Nov 11, 2026 at 11:31 AM Arnd Bergmann <arnd@arndb.de> wrote:
>
> On Wed, Nov 11, 2026, at 14:52, Jeffrey Bencteux wrote:
> > On Wed, Nov 11, 2026 at 12:18:01PM +0100, Arnd Bergmann wrote:
> >> Why the #ifdef checks? These should be available on all architectures.
> >
> > I included them as convention, should they be removed?
>
> Not sure where the convention comes from, it just seemed
> odd that you have the #ifdef checks for the newly added
> entries but not the ones that are already in this file.
>
> I had not checked the other files that have similar ones.
>
>      Arnd
>

Hello everyone!

It's not a convention. Arnd is right, ifdef checks should only be used
for the ones that are not available on all architectures.

Jeffrey, please take a look in this commit c0d73c09381e ("audit: add
missing syscalls to PERM class tables"). Note that '__NR_statx' is not
guarded by a ifdef.

I hope it helps.

-Ricardo

Re: [PATCH] audit: add missing syscalls to signal class

[Jeffrey Bencteux]

On Wed, Nov 11, 2026 at 11:50:48AM -0300, Ricardo Robaina wrote:
> On Wed, Nov 11, 2026 at 11:31 AM Arnd Bergmann <arnd@arndb.de> wrote:
> >
> > On Wed, Nov 11, 2026, at 14:52, Jeffrey Bencteux wrote:
> > > On Wed, Nov 11, 2026 at 12:18:01PM +0100, Arnd Bergmann wrote:
> > >> Why the #ifdef checks? These should be available on all architectures.
> > >
> > > I included them as convention, should they be removed?
> >
> > Not sure where the convention comes from, it just seemed
> > odd that you have the #ifdef checks for the newly added
> > entries but not the ones that are already in this file.
> >
> > I had not checked the other files that have similar ones.
> >
> >      Arnd
> >
> 
> Hello everyone!
> 
> It's not a convention. Arnd is right, ifdef checks should only be used
> for the ones that are not available on all architectures.
> 
> Jeffrey, please take a look in this commit c0d73c09381e ("audit: add
> missing syscalls to PERM class tables"). Note that '__NR_statx' is not
> guarded by a ifdef.
> 

Arnd, Ricardo,

Thanks, it is now clear to me these are always available.

Re: [PATCH] audit: add missing syscalls to signal class

[sashiko-bot]

> The pidfd_send_signal(), rt_sigqueueinfo() and rt_tgsigqueueinfo()
> system calls are missing from the AUDIT_CLASS_SIGNAL* class. It seems
> to be used only in kernel/auditfilter.c to increment the audit_signals
> counter.
> 
> This counter is used to determine if information related to a target
> process of a syscall audit rule using signals, such as its pid,
> should be logged (e54dc2431d740a79a6bd013babade99d71b1714f).
> 
> Information related to signals sent via these system calls are
> currently not correctly logged. The current patch adds it to the
> AUDIT_CLASS_SIGNAL* class.
> 
> Signed-off-by: Jeffrey Bencteux <jeff@bencteux.fr>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111110200.30415-1-jeff@bencteux.fr?part=1