Linux-ARM-Kernel Archive on lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH v2 00/13] audit: log all six syscall arguments in the SYSCALL record
@ 2026-09-02 14:43 Ricardo Robaina
  2026-09-02 14:43 ` [PATCH v2 01/13] " Ricardo Robaina
                   ` (12 more replies)
  0 siblings, 13 replies; 16+ messages in thread
From: Ricardo Robaina @ 2026-09-02 14:43 UTC (permalink / raw)
  To: audit, linux-kernel, linux-alpha, linux-arm-kernel, linux-csky,
	linux-mips, linux-openrisc, linux-parisc, linux-sh, sparclinux,
	linux-um, bpf
  Cc: paul, eparis, sgrubb, oleg, richard.henderson, mattst88, linmag7,
	linux, catalin.marinas, will, guoren, monstr, tsbogend, jonas,
	stefan.kristiansson, shorne, James.Bottomley, deller, ysato,
	dalias, glaubitz, davem, andreas, richard, anton.ivanov, johannes,
	chris, jcmvbkbc, tglx, peterz, luto, Ricardo Robaina

The SYSCALL record currently logs only four of the six syscall
arguments (a0-a3), silently discarding the remaining two. This
leads to the need for auxiliary records when audit-relevant
data lands in the 5th or 6th argument of a syscall.

This series extends the SYSCALL record to log all six arguments,
by adding arguments a4 and a5 inline within the existing record.

The audit testsuite runs successfully:

 # make test
 make -C tests test
 Running as   user    root
        with context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
        on   system  Fedora

 amcast_joinpart/test ................. ok
 backlog_wait_time_actual_reset/test .. ok
 bpf/test ............................. ok
 coredump/test ........................ ok
 exec_execve/test ..................... ok
 exec_name/test ....................... ok
 fanotify/test ........................ ok
 field_compare/test ................... ok
 file_create/test ..................... ok
 file_delete/test ..................... ok
 file_permission/test ................. ok
 file_rename/test ..................... ok
 filter_device/test ................... ok
 filter_exclude/test .................. ok
 filter_exit/test ..................... ok
 filter_inode/test .................... ok
 filter_saddr_fam/test ................ ok
 filter_sessionid/test ................ ok
 io_uring/test ........................ ok
 login_tty/test ....................... ok
 lost_reset/test ...................... ok
 netfilter_pkt/test ................... ok
 signal/test .......................... ok
 syscalls_file/test ................... ok
 syscall_module/test .................. ok
 syscall_socketcall/test .............. ok
 time_change/test ..................... ok
 user_msg/test ........................ ok
 All tests successful.
 Result: PASS

Changes in v2:
 - Rework the core change per Will Deacon's suggestion: instead of
   plumbing all six arguments through every architecture's syscall
   entry path, __audit_syscall_entry() now takes a struct pt_regs *
   and retrieves the arguments itself via syscall_get_arguments().
 - Per-arch patches now simply pass regs instead of the individual
   argument registers.
 - Fetch the arguments directly into context->argv, dropping the
   temporary array.

Ricardo Robaina (13):
  audit: log all six syscall arguments in the SYSCALL record
  alpha: pass pt_regs to audit_syscall_entry()
  arm: pass pt_regs to audit_syscall_entry()
  arm64: pass pt_regs to audit_syscall_entry()
  csky: pass pt_regs to audit_syscall_entry()
  microblaze: pass pt_regs to audit_syscall_entry()
  mips: pass pt_regs to audit_syscall_entry()
  openrisc: pass pt_regs to audit_syscall_entry()
  parisc: pass pt_regs to audit_syscall_entry()
  sh: pass pt_regs to audit_syscall_entry()
  sparc64: pass pt_regs to audit_syscall_entry()
  um: pass pt_regs to audit_syscall_entry()
  xtensa: pass pt_regs to audit_syscall_entry()

 arch/alpha/kernel/ptrace.c      |  3 +--
 arch/arm/kernel/ptrace.c        |  3 +--
 arch/arm64/kernel/ptrace.c      |  3 +--
 arch/csky/kernel/ptrace.c       |  2 +-
 arch/microblaze/kernel/ptrace.c |  2 +-
 arch/mips/kernel/ptrace.c       |  4 +---
 arch/openrisc/kernel/ptrace.c   |  3 +--
 arch/parisc/kernel/ptrace.c     |  9 ++-------
 arch/sh/kernel/ptrace_32.c      |  3 +--
 arch/sparc/kernel/ptrace_64.c   |  4 +---
 arch/um/kernel/ptrace.c         |  6 +-----
 arch/xtensa/kernel/ptrace.c     |  4 +---
 include/linux/audit.h           | 13 ++++---------
 include/uapi/linux/audit.h      |  2 ++
 kernel/audit.h                  |  2 +-
 kernel/auditfilter.c            |  2 ++
 kernel/auditsc.c                | 19 ++++++++-----------
 kernel/entry/syscall-common.c   |  4 +---
 18 files changed, 31 insertions(+), 57 deletions(-)

-- 
2.55.0



^ permalink raw reply	[flat|nested] 16+ messages in thread
end of thread, other threads:[~2026-09-03  8:22 UTC | newest]

Thread overview: 16+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-02 14:43 [PATCH v2 00/13] audit: log all six syscall arguments in the SYSCALL record Ricardo Robaina
2026-09-02 14:43 ` [PATCH v2 01/13] " Ricardo Robaina
2026-09-03  8:21   ` Will Deacon
2026-09-02 14:43 ` [PATCH v2 02/13] alpha: pass pt_regs to audit_syscall_entry() Ricardo Robaina
2026-09-02 14:43 ` [PATCH v2 03/13] arm: " Ricardo Robaina
2026-09-02 14:43 ` [PATCH v2 04/13] arm64: " Ricardo Robaina
2026-09-03  8:22   ` Will Deacon
2026-09-02 14:43 ` [PATCH v2 05/13] csky: " Ricardo Robaina
2026-09-02 14:43 ` [PATCH v2 06/13] microblaze: " Ricardo Robaina
2026-09-02 14:43 ` [PATCH v2 07/13] mips: " Ricardo Robaina
2026-09-02 14:43 ` [PATCH v2 08/13] openrisc: " Ricardo Robaina
2026-09-02 14:43 ` [PATCH v2 09/13] parisc: " Ricardo Robaina
2026-09-02 14:43 ` [PATCH v2 10/13] sh: " Ricardo Robaina
2026-09-02 14:43 ` [PATCH v2 11/13] sparc64: " Ricardo Robaina
2026-09-02 14:43 ` [PATCH v2 12/13] um: " Ricardo Robaina
2026-09-02 14:43 ` [PATCH v2 13/13] xtensa: " Ricardo Robaina

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox