Re: [PATCH v2 03/13] arm: pass pt_regs to audit_syscall_entry()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The transition to using `syscall_get_arguments()` for audit logging causes the first syscall argument to be read from `regs->ARM_ORIG_r0` instead of `regs->ARM_r0`. This allows tracers to bypass audit logging by spoofing arguments, as the audit subsystem logs the unmodified argument while the kernel executes the modified one.
--

commit 2a794057248ff5b9ad0444e2a1b1392a156db536
Author: Ricardo Robaina <rrobaina@redhat.com>

arm: pass pt_regs to audit_syscall_entry()

This commit updates syscall_trace_enter() on ARM to pass the pt_regs
structure directly to audit_syscall_entry() instead of individual arguments.
The audit logging subsystem now extracts the arguments itself via
syscall_get_arguments().

> diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
> index ed7a2a87a6707..e103ec2661cd4 100644
> --- a/arch/arm/kernel/ptrace.c
> +++ b/arch/arm/kernel/ptrace.c
> @@ -868,8 +868,7 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
>  	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
>  		trace_sys_enter(regs, scno);
>  
> -	audit_syscall_entry(scno, regs->ARM_r0, regs->ARM_r1, regs->ARM_r2,
> -			    regs->ARM_r3);
> +	audit_syscall_entry(scno, regs);

[Severity: High]
Does this change allow tracers to bypass audit logging by spoofing syscall
arguments?

By delegating argument extraction to the helper, the first syscall argument
is now extracted via syscall_get_arguments(), which reads from
regs->ARM_ORIG_r0. The previous code directly passed regs->ARM_r0.

If a user-space process intercepts the syscall at PTRACE_SYSCALL_ENTER and
modifies the first argument via PTRACE_POKEUSR to write to regs->ARM_r0,
the audit subsystem will log the unmodified argument from regs->ARM_ORIG_r0.
However, the syscall dispatcher will subsequently reload r0 from
regs->ARM_r0, causing the kernel to execute the modified argument while the
benign one is logged.

Can we ensure the audit subsystem logs the active argument that will
actually be executed?

>  
>  	return scno;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1788351089.git.rrobaina@redhat.com?part=3