From mboxrd@z Thu Jan 1 00:00:00 1970 From: Eric Paris Subject: Re: [PATCH] Audit: EINTR instead of kernel private return codes in audit records Date: Sun, 18 Nov 2007 11:52:56 -0500 Message-ID: <1195404776.2924.134.camel@localhost.localdomain> References: <1195071728.2924.40.camel@localhost.localdomain> <200711141618.00090.sgrubb@redhat.com> <1195351113.2924.120.camel@localhost.localdomain> <200711180558.16921.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <200711180558.16921.sgrubb@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: linux-audit@redhat.com, pmoore@hp.com List-Id: linux-audit@redhat.com On Sun, 2007-11-18 at 05:58 -0500, Steve Grubb wrote: > On Saturday 17 November 2007 08:58:33 pm Eric Paris wrote: > > It would be absolutely wrong for the audit system to translate > > even ENOIOCTLCMD to anything else if this is what was actually returned > > to the process. > > The point is, none of the errnos in that file should *ever* go to user space. > glibc has no translation (strerror()) for them because they are internal to > the kernel. So, they need to get translated to something. My only question is > would these extra ones ever get picked up in this code path? They "should not" get returned to userspace. I agree. That doesn't mean they don't. All occurences of these error codes being returned to userspace are bugs, but that has nothing at all to do with this conversation. My patch is correct, complete, and the right thing to do. All syscalls are going to come through here and if they have an 'invalid' return code we need to just audit it, not audit the wrong thing and then return the 'real' retval to userspace. Remember this patch isn't changing what goes back to userspace, its just changing what we put in the audit log. Look in any arch/signal.c to see why the 4 I am dealing with are special and why it is right to audit EINTR even when at this point it looks like ERESTART*. The 4 return codes I am dealing with are changed to be EINTR before they get back to userspace, thus we should audit EINTR, not ERESTART*. If the kernel has a bug which returns ETOOSMALL to userspace the audit system needs to audit ETOOSMALL, its as simple as that. A crusade to clean up all of the issues with the 6 things I mentioned in the last e-mail which may be slipping back to userspace would be a good thing, heck, I even cleanup up the issue in the audit/selinux system when they missused ENOTSUPP in a seperate patch, but lying about any of the 'invalid' return codes in the audit wrong, even if it is a bug they are there in the first place is flat wrong. Make sense? -Eric