Re: [PATCH v3 02/14] arm: pass pt_regs to audit_syscall_entry()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] arm/audit: audit bypass via ptrace syscall argument spoofing
--

commit 28f5bb87ea29cfbc21629b2a96c32dff55652268
Author: Ricardo Robaina <rrobaina@redhat.com>

arm: pass pt_regs to audit_syscall_entry()

audit_syscall_entry() now takes a pointer to pt_regs and extracts
the syscall arguments itself via syscall_get_arguments(). Drop the
individual argument registers from the call and pass regs instead.

> diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
> index ed7a2a87a6707..3c5d7fd733ec1 100644
> --- a/arch/arm/kernel/ptrace.c
> +++ b/arch/arm/kernel/ptrace.c
> @@ -868,8 +868,7 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
>  	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
>  		trace_sys_enter(regs, scno);
>  
> -	audit_syscall_entry(scno, regs->ARM_r0, regs->ARM_r1, regs->ARM_r2,
> -			    regs->ARM_r3);
> +	audit_syscall_entry_regs(scno, regs);

[Severity: High]
Does this change introduce an audit bypass via ptrace syscall argument spoofing?

By switching to audit_syscall_entry_regs(), argument extraction is now
delegated to syscall_get_arguments(), which reads the first syscall argument
from regs->ARM_ORIG_r0:

arch/arm/include/asm/syscall.h:syscall_get_arguments() {
    ...
    args[0] = regs->ARM_ORIG_r0;
    ...
}

If a tracer intercepts execution using PTRACE_SYSCALL_ENTER and modifies
the first syscall argument via PTRACE_POKEUSER on ARM_r0, regs->ARM_r0 gets
updated but regs->ARM_ORIG_r0 remains unchanged.

Because of this change, audit will now log the original argument from
ARM_ORIG_r0. However, when execution resumes, the system call will execute
using the modified argument from ARM_r0. 

Could this allow a tracer to execute a modified payload while the audit
subsystem logs a different, benign one?

>  
>  	return scno;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1790088067.git.rrobaina@redhat.com?part=2