Re: [PATCH v2 04/13] arm64: pass pt_regs to audit_syscall_entry()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Syscall argument filtering truncates 64-bit arguments to 32 bits, allowing audit filter bypass.
--

commit 32fa904a92560e78e9593b4944ee636ddfb88ea9
Author: Ricardo Robaina <rrobaina@redhat.com>

arm64: pass pt_regs to audit_syscall_entry()

This commit updates arm64 to pass a pointer to pt_regs directly to
audit_syscall_entry(), allowing the audit subsystem to extract the
syscall arguments itself.

> diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
> --- a/arch/arm64/kernel/ptrace.c
> +++ b/arch/arm64/kernel/ptrace.c
[ ... ]
> @@ -2476,8 +2476,7 @@ int syscall_trace_enter(struct pt_regs *regs)
>  	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
>  		trace_sys_enter(regs, regs->syscallno);
>  
> -	audit_syscall_entry(regs->syscallno, regs->orig_x0, regs->regs[1],
> -			    regs->regs[2], regs->regs[3]);
> +	audit_syscall_entry(regs->syscallno, regs);

[Severity: High]
This is a pre-existing issue, but does the underlying audit framework truncate
these 64-bit syscall arguments to 32 bits during filtering?

When the extracted 64-bit arguments are later evaluated in
kernel/auditsc.c:audit_filter_rules(), they are passed to
audit_comparator():

    result = audit_comparator(ctx->argv[f->type-AUDIT_ARG0], f->op, f->val);

However, looking at kernel/auditfilter.c, the signature of audit_comparator()
implicitly truncates the 64-bit argument to a u32:

    int audit_comparator(u32 left, u32 op, u32 right)

Can this allow an unprivileged user-space process to bypass audit filtering
rules (such as != or <) targeting 64-bit syscall arguments? By crafting
64-bit values whose lower 32 bits evade the 32-bit rule comparison, the full
64-bit value processed by the kernel could still execute normally while
evading audit logging.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1788351089.git.rrobaina@redhat.com?part=4