[03/08] fix ia64 syscall auditing

[03/08] fix ia64 syscall auditing

[Greg KH]

-stable review patch.  If anyone has any objections, please let us know.

------------------

Attached is a patch against David's audit.17 kernel that adds checks
for the TIF_SYSCALL_AUDIT thread flag to the ia64 system call and
signal handling code paths.  The patch enables auditing of system
calls set up via fsys_bubble_down, as well as ensuring that
audit_syscall_exit() is called on return from sigreturn.

Neglecting to check for TIF_SYSCALL_AUDIT at these points results in
incorrect information in audit_context, causing frequent system panics
when system call auditing is enabled on an ia64 system.

I have tested this patch and have seen no problems with it.

[Original patch from Amy Griffis ported to current kernel by David Woodhouse]

From: Amy Griffis <amy.griffis@hp.com>
From: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

--- 1.34/arch/ia64/kernel/fsys.S	2005-01-22 22:19:11 +00:00
+++ edited/arch/ia64/kernel/fsys.S	2005-04-01 00:20:32 +01:00
@@ -611,8 +611,10 @@
 	movl r2=ia64_ret_from_syscall
 	;;
 	mov rp=r2				// set the real return addr
-	tbit.z p8,p0=r3,TIF_SYSCALL_TRACE
+	and r3=_TIF_SYSCALL_TRACEAUDIT,r3
 	;;
+	cmp.eq p8,p0=r3,r0
+
 (p10)	br.cond.spnt.many ia64_ret_from_syscall	// p10=true means out registers are more than 8
 (p8)	br.call.sptk.many b6¶		// ignore this return addr
 	br.cond.sptk ia64_trace_syscall
=== arch/ia64/kernel/signal.c 1.49 vs edited ==--- 1.49/arch/ia64/kernel/signal.c	2005-01-25 20:23:45 +00:00
+++ edited/arch/ia64/kernel/signal.c	2005-04-01 00:18:29 +01:00
@@ -224,7 +224,8 @@
 	 * could be corrupted.
 	 */
 	retval = (long) &ia64_leave_kernel;
-	if (test_thread_flag(TIF_SYSCALL_TRACE))
+	if (test_thread_flag(TIF_SYSCALL_TRACE) 
+	    || test_thread_flag(TIF_SYSCALL_AUDIT))
 		/*
 		 * strace expects to be notified after sigreturn returns even though the
 		 * context to which we return may not be in the middle of a syscall.

Re: [03/08] fix ia64 syscall auditing

[David Mosberger]

>>>>> On Tue, 5 Apr 2005 09:46:48 -0700, Greg KH <gregkh@suse.de> said:

  Greg> -stable review patch.  If anyone has any objections, please
  Greg> let us know.

Nitpick: the patch introduces trailing whitespace.

Why doesn't everybody use emacs and enable show-trailing-whitespace? ;-)

	--david

Re: [03/08] fix ia64 syscall auditing

[Greg KH]

On Tue, 2005-04-05 at 13:27 -0700, David Mosberger wrote:
> >>>>> On Tue, 5 Apr 2005 09:46:48 -0700, Greg KH <gregkh@suse.de> said:
> 
>   Greg> -stable review patch.  If anyone has any objections, please
>   Greg> let us know.
> 
> Nitpick: the patch introduces trailing whitespace.

Sorry about that, I've removed it from the patch now.

> Why doesn't everybody use emacs and enable show-trailing-whitespace? ;-)

Because some of us use vim and ":set list" to see it, when we remember
to... :)

thanks,

greg k-h

Re: [03/08] fix ia64 syscall auditing

[Randy.Dunlap]

Greg KH wrote:
> On Tue, 2005-04-05 at 13:27 -0700, David Mosberger wrote:
> 
>>>>>>>On Tue, 5 Apr 2005 09:46:48 -0700, Greg KH <gregkh@suse.de> said:
>>
>>  Greg> -stable review patch.  If anyone has any objections, please
>>  Greg> let us know.
>>
>>Nitpick: the patch introduces trailing whitespace.
> 
> 
> Sorry about that, I've removed it from the patch now.
> 
> 
>>Why doesn't everybody use emacs and enable show-trailing-whitespace? ;-)
> 
> 
> Because some of us use vim and ":set list" to see it, when we remember
> to... :)

others check received patches with a script instead of....
no, let's not debate $EDITOR.

-- 
~Randy

Re: [03/08] fix ia64 syscall auditing

[Ryan Anderson]

On Tue, Apr 05, 2005 at 01:49:18PM -0700, Greg KH wrote:
> On Tue, 2005-04-05 at 13:27 -0700, David Mosberger wrote:
> > >>>>> On Tue, 5 Apr 2005 09:46:48 -0700, Greg KH <gregkh@suse.de> said:
> > 
> >   Greg> -stable review patch.  If anyone has any objections, please
> >   Greg> let us know.
> > 
> > Nitpick: the patch introduces trailing whitespace.
> 
> Sorry about that, I've removed it from the patch now.
> 
> > Why doesn't everybody use emacs and enable show-trailing-whitespace? ;-)
> 
> Because some of us use vim and ":set list" to see it, when we remember
> to... :)

Try adding this to your .vimrc:

highlight WhitespaceEOL ctermbg=red guibg=red
match WhitespaceEOL /\s\+$/

Then you'll have to resist the urge to fix whitespace issues instead of
not seeing them at all.

-- 

Ryan Anderson
  sometimes Pug Majere

Re: [03/08] fix ia64 syscall auditing

[Greg KH]

On Tue, 2005-04-05 at 19:46 -0400, Ryan Anderson wrote:
> highlight WhitespaceEOL ctermbg=red guibg=red
> match WhitespaceEOL /\s\+$/

Very nice, thanks a lot for that.

greg k-h

Re: [03/08] fix ia64 syscall auditing

[Dave Jones]

On Tue, Apr 05, 2005 at 05:05:04PM -0700, Greg KH wrote:
 > On Tue, 2005-04-05 at 19:46 -0400, Ryan Anderson wrote:
 > > highlight WhitespaceEOL ctermbg=red guibg=red
 > > match WhitespaceEOL /\s\+$/
 > 
 > Very nice, thanks a lot for that.
 
let c_space_errors=1  also works great.

		Dave

Re: [03/08] fix ia64 syscall auditing

[Andrew Morton]

Ryan Anderson <ryan@michonline.com> wrote:
>
> On Tue, Apr 05, 2005 at 01:49:18PM -0700, Greg KH wrote:
> > On Tue, 2005-04-05 at 13:27 -0700, David Mosberger wrote:
> > > >>>>> On Tue, 5 Apr 2005 09:46:48 -0700, Greg KH <gregkh@suse.de> said:
> > > 
> > >   Greg> -stable review patch.  If anyone has any objections, please
> > >   Greg> let us know.
> > > 
> > > Nitpick: the patch introduces trailing whitespace.
> > 
> > Sorry about that, I've removed it from the patch now.
> > 
> > > Why doesn't everybody use emacs and enable show-trailing-whitespace? ;-)
> > 
> > Because some of us use vim and ":set list" to see it, when we remember
> > to... :)
> 
> Try adding this to your .vimrc:
> 
> highlight WhitespaceEOL ctermbg=red guibg=red
> match WhitespaceEOL /\s\+$/
> 
> Then you'll have to resist the urge to fix whitespace issues instead of
> not seeing them at all.
> 

Yeah, that's a risk.  But gratuitous trailing whitespace changes shouldn't
cause a lot of downstream problems due to `patch -l'.

What I do is to ensure that we never _add_ trailing whitespace.  So
anything which matches

	^+.*[tab or space]$

gets trimmed.  My theory is that after 10 years of this, all the trailing
whitespace will be gone.  Problem is, I also see the hundreds of lines of
code in the bk patches which add trailing whitespace :(

Larry sent me a little bk script which would spam the user if they tried to
commit something which adds trailing whitespace, but maybe that's a bit
academic right now.