* [PATCH 3/4] ARCH: AUDIT: implement syscall_get_arch for all arches
[not found] <1395266643-3139-1-git-send-email-eparis@redhat.com>
@ 2014-03-19 22:04 ` Eric Paris
2014-03-19 22:19 ` Matt Turner
` (2 more replies)
2014-03-19 22:04 ` [PATCH 4/4] ARCH: AUDIT: audit_syscall_entry() should not require the arch Eric Paris
1 sibling, 3 replies; 7+ messages in thread
From: Eric Paris @ 2014-03-19 22:04 UTC (permalink / raw)
To: linux-audit
Cc: linux-mips, linux-ia64, linux-parisc, microblaze-uclinux, linux,
Eric Paris, sparclinux, linuxppc-dev
For all arches which support audit implement syscall_get_arch()
They are all pretty easy and straight forward, stolen from how the call
to audit_syscall_entry() determines the arch.
Signed-off-by: Eric Paris <eparis@redhat.com>
Cc: linux-ia64@vger.kernel.org
Cc: microblaze-uclinux@itee.uq.edu.au
Cc: linux-mips@linux-mips.org
Cc: linux@lists.openrisc.net
Cc: linux-parisc@vger.kernel.org
Cc: linuxppc-dev@lists.ozlabs.org
Cc: sparclinux@vger.kernel.org
---
arch/ia64/include/asm/syscall.h | 6 ++++++
arch/microblaze/include/asm/syscall.h | 5 +++++
arch/mips/include/asm/syscall.h | 2 +-
arch/openrisc/include/asm/syscall.h | 5 +++++
arch/parisc/include/asm/syscall.h | 11 +++++++++++
arch/powerpc/include/asm/syscall.h | 12 ++++++++++++
arch/sparc/include/asm/syscall.h | 8 ++++++++
include/uapi/linux/audit.h | 1 +
8 files changed, 49 insertions(+), 1 deletion(-)
diff --git a/arch/ia64/include/asm/syscall.h b/arch/ia64/include/asm/syscall.h
index a7ff1c6..1d0b875 100644
--- a/arch/ia64/include/asm/syscall.h
+++ b/arch/ia64/include/asm/syscall.h
@@ -13,6 +13,7 @@
#ifndef _ASM_SYSCALL_H
#define _ASM_SYSCALL_H 1
+#include <uapi/linux/audit.h>
#include <linux/sched.h>
#include <linux/err.h>
@@ -79,4 +80,9 @@ static inline void syscall_set_arguments(struct task_struct *task,
ia64_syscall_get_set_arguments(task, regs, i, n, args, 1);
}
+
+static inline int syscall_get_arch(void)
+{
+ return AUDIT_ARCH_IA64;
+}
#endif /* _ASM_SYSCALL_H */
diff --git a/arch/microblaze/include/asm/syscall.h b/arch/microblaze/include/asm/syscall.h
index 9bc4317..53cfaf3 100644
--- a/arch/microblaze/include/asm/syscall.h
+++ b/arch/microblaze/include/asm/syscall.h
@@ -1,6 +1,7 @@
#ifndef __ASM_MICROBLAZE_SYSCALL_H
#define __ASM_MICROBLAZE_SYSCALL_H
+#include <uapi/linux/audit.h>
#include <linux/kernel.h>
#include <linux/sched.h>
#include <asm/ptrace.h>
@@ -99,4 +100,8 @@ static inline void syscall_set_arguments(struct task_struct *task,
asmlinkage long do_syscall_trace_enter(struct pt_regs *regs);
asmlinkage void do_syscall_trace_leave(struct pt_regs *regs);
+static inline int syscall_get_arch(void)
+{
+ return AUDIT_ARCH_MICROBLAZE;
+}
#endif /* __ASM_MICROBLAZE_SYSCALL_H */
diff --git a/arch/mips/include/asm/syscall.h b/arch/mips/include/asm/syscall.h
index fc556d8..992b6ab 100644
--- a/arch/mips/include/asm/syscall.h
+++ b/arch/mips/include/asm/syscall.h
@@ -103,7 +103,7 @@ extern const unsigned long sysn32_call_table[];
static inline int syscall_get_arch(void)
{
- int arch = EM_MIPS;
+ int arch = AUDIT_ARCH_MIPS;
#ifdef CONFIG_64BIT
arch |= __AUDIT_ARCH_64BIT;
#endif
diff --git a/arch/openrisc/include/asm/syscall.h b/arch/openrisc/include/asm/syscall.h
index b752bb6..2db9f1c 100644
--- a/arch/openrisc/include/asm/syscall.h
+++ b/arch/openrisc/include/asm/syscall.h
@@ -19,6 +19,7 @@
#ifndef __ASM_OPENRISC_SYSCALL_H__
#define __ASM_OPENRISC_SYSCALL_H__
+#include <uapi/linux/audit.h>
#include <linux/err.h>
#include <linux/sched.h>
@@ -71,4 +72,8 @@ syscall_set_arguments(struct task_struct *task, struct pt_regs *regs,
memcpy(®s->gpr[3 + i], args, n * sizeof(args[0]));
}
+static inline int syscall_get_arch(void)
+{
+ return AUDIT_ARCH_OPENRISC;
+}
#endif
diff --git a/arch/parisc/include/asm/syscall.h b/arch/parisc/include/asm/syscall.h
index 8bdfd2c..a5eba95 100644
--- a/arch/parisc/include/asm/syscall.h
+++ b/arch/parisc/include/asm/syscall.h
@@ -3,6 +3,8 @@
#ifndef _ASM_PARISC_SYSCALL_H_
#define _ASM_PARISC_SYSCALL_H_
+#include <uapi/linux/audit.h>
+#include <linux/compat.h>
#include <linux/err.h>
#include <asm/ptrace.h>
@@ -37,4 +39,13 @@ static inline void syscall_get_arguments(struct task_struct *tsk,
}
}
+static inline int syscall_get_arch(void)
+{
+ int arch = AUDIT_ARCH_PARISC;
+#ifdef CONFIG_64BIT
+ if (!is_compat_task())
+ arch = AUDIT_ARCH_PARISC64;
+#endif
+ return arch;
+}
#endif /*_ASM_PARISC_SYSCALL_H_*/
diff --git a/arch/powerpc/include/asm/syscall.h b/arch/powerpc/include/asm/syscall.h
index b54b2ad..4271544 100644
--- a/arch/powerpc/include/asm/syscall.h
+++ b/arch/powerpc/include/asm/syscall.h
@@ -13,6 +13,8 @@
#ifndef _ASM_SYSCALL_H
#define _ASM_SYSCALL_H 1
+#include <uapi/linux/audit.h>
+#include <linux/compat.h>
#include <linux/sched.h>
/* ftrace syscalls requires exporting the sys_call_table */
@@ -86,4 +88,14 @@ static inline void syscall_set_arguments(struct task_struct *task,
memcpy(®s->gpr[3 + i], args, n * sizeof(args[0]));
}
+static inline int syscall_get_arch(void)
+{
+ int arch = AUDIT_ARCH_PPC;
+
+#ifdef CONFIG_PPC64
+ if (!is_32bit_task())
+ arch = AUDIT_ARCH_PPC64;
+#endif
+ return arch;
+}
#endif /* _ASM_SYSCALL_H */
diff --git a/arch/sparc/include/asm/syscall.h b/arch/sparc/include/asm/syscall.h
index 025a02a..fed3d51 100644
--- a/arch/sparc/include/asm/syscall.h
+++ b/arch/sparc/include/asm/syscall.h
@@ -1,9 +1,11 @@
#ifndef __ASM_SPARC_SYSCALL_H
#define __ASM_SPARC_SYSCALL_H
+#include <uapi/linux/audit.h>
#include <linux/kernel.h>
#include <linux/sched.h>
#include <asm/ptrace.h>
+#include <asm/thread_info.h>
/*
* The syscall table always contains 32 bit pointers since we know that the
@@ -124,4 +126,10 @@ static inline void syscall_set_arguments(struct task_struct *task,
regs->u_regs[UREG_I0 + i + j] = args[j];
}
+static inline int syscall_get_arch(void)
+{
+ return test_thread_flag(TIF_32BIT) ? AUDIT_ARCH_SPARC
+ : AUDIT_ARCH_SPARC64;
+}
+
#endif /* __ASM_SPARC_SYSCALL_H */
diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
index 9af01d7..8496cfa 100644
--- a/include/uapi/linux/audit.h
+++ b/include/uapi/linux/audit.h
@@ -343,6 +343,7 @@ enum {
#define AUDIT_ARCH_IA64 (EM_IA_64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
#define AUDIT_ARCH_M32R (EM_M32R)
#define AUDIT_ARCH_M68K (EM_68K)
+#define AUDIT_ARCH_MICROBLAZE (EM_MICROBLAZE)
#define AUDIT_ARCH_MIPS (EM_MIPS)
#define AUDIT_ARCH_MIPSEL (EM_MIPS|__AUDIT_ARCH_LE)
#define AUDIT_ARCH_MIPS64 (EM_MIPS|__AUDIT_ARCH_64BIT)
--
1.8.5.3
^ permalink raw reply related [flat|nested] 7+ messages in thread
* [PATCH 4/4] ARCH: AUDIT: audit_syscall_entry() should not require the arch
[not found] <1395266643-3139-1-git-send-email-eparis@redhat.com>
2014-03-19 22:04 ` [PATCH 3/4] ARCH: AUDIT: implement syscall_get_arch for all arches Eric Paris
@ 2014-03-19 22:04 ` Eric Paris
2014-03-21 19:18 ` Richard Guy Briggs
1 sibling, 1 reply; 7+ messages in thread
From: Eric Paris @ 2014-03-19 22:04 UTC (permalink / raw)
To: linux-audit
Cc: linux-mips, x86, linux-ia64, user-mode-linux-devel, linux-parisc,
linux-s390, linux-xtensa, microblaze-uclinux, linux, linux-sh,
Eric Paris, linux-alpha, sparclinux, linuxppc-dev,
linux-arm-kernel
We have a function where the arch can be queried, syscall_get_arch().
So rather than have every single piece of arch specific code use and/or
duplicate syscall_get_arch(), just have the audit code use the
syscall_get_arch() code.
Signed-off-by: Eric Paris <eparis@redhat.com>
Cc: linux-alpha@vger.kernel.org
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-ia64@vger.kernel.org
Cc: microblaze-uclinux@itee.uq.edu.au
Cc: linux-mips@linux-mips.org
Cc: linux@lists.openrisc.net
Cc: linux-parisc@vger.kernel.org
Cc: linuxppc-dev@lists.ozlabs.org
Cc: linux-s390@vger.kernel.org
Cc: linux-sh@vger.kernel.org
Cc: sparclinux@vger.kernel.org
Cc: user-mode-linux-devel@lists.sourceforge.net
Cc: linux-xtensa@linux-xtensa.org
Cc: x86@kernel.org
---
arch/alpha/kernel/ptrace.c | 2 +-
arch/arm/kernel/ptrace.c | 4 ++--
arch/ia64/kernel/ptrace.c | 2 +-
arch/microblaze/kernel/ptrace.c | 3 +--
arch/mips/kernel/ptrace.c | 4 +---
arch/openrisc/kernel/ptrace.c | 3 +--
arch/parisc/kernel/ptrace.c | 9 +++------
arch/powerpc/kernel/ptrace.c | 7 ++-----
arch/s390/kernel/ptrace.c | 4 +---
arch/sh/kernel/ptrace_32.c | 14 +-------------
arch/sh/kernel/ptrace_64.c | 17 +----------------
arch/sparc/kernel/ptrace_64.c | 9 ++-------
arch/um/kernel/ptrace.c | 3 +--
arch/x86/kernel/ptrace.c | 8 ++------
arch/x86/um/asm/ptrace.h | 4 ----
arch/xtensa/kernel/ptrace.c | 2 +-
include/linux/audit.h | 7 ++++---
17 files changed, 25 insertions(+), 77 deletions(-)
diff --git a/arch/alpha/kernel/ptrace.c b/arch/alpha/kernel/ptrace.c
index 86d8351..d9ee817 100644
--- a/arch/alpha/kernel/ptrace.c
+++ b/arch/alpha/kernel/ptrace.c
@@ -321,7 +321,7 @@ asmlinkage unsigned long syscall_trace_enter(void)
if (test_thread_flag(TIF_SYSCALL_TRACE) &&
tracehook_report_syscall_entry(current_pt_regs()))
ret = -1UL;
- audit_syscall_entry(AUDIT_ARCH_ALPHA, regs->r0, regs->r16, regs->r17, regs->r18, regs->r19);
+ audit_syscall_entry(regs->r0, regs->r16, regs->r17, regs->r18, regs->r19);
return ret ?: current_pt_regs()->r0;
}
diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
index 0dd3b79..c9d2b34 100644
--- a/arch/arm/kernel/ptrace.c
+++ b/arch/arm/kernel/ptrace.c
@@ -943,8 +943,8 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs, int scno)
if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
trace_sys_enter(regs, scno);
- audit_syscall_entry(AUDIT_ARCH_ARM, scno, regs->ARM_r0, regs->ARM_r1,
- regs->ARM_r2, regs->ARM_r3);
+ audit_syscall_entry(scno, regs->ARM_r0, regs->ARM_r1, regs->ARM_r2,
+ regs->ARM_r3);
return scno;
}
diff --git a/arch/ia64/kernel/ptrace.c b/arch/ia64/kernel/ptrace.c
index b7a5fff..6f54d51 100644
--- a/arch/ia64/kernel/ptrace.c
+++ b/arch/ia64/kernel/ptrace.c
@@ -1219,7 +1219,7 @@ syscall_trace_enter (long arg0, long arg1, long arg2, long arg3,
ia64_sync_krbs();
- audit_syscall_entry(AUDIT_ARCH_IA64, regs.r15, arg0, arg1, arg2, arg3);
+ audit_syscall_entry(regs.r15, arg0, arg1, arg2, arg3);
return 0;
}
diff --git a/arch/microblaze/kernel/ptrace.c b/arch/microblaze/kernel/ptrace.c
index 39cf508..bb10637 100644
--- a/arch/microblaze/kernel/ptrace.c
+++ b/arch/microblaze/kernel/ptrace.c
@@ -147,8 +147,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
*/
ret = -1L;
- audit_syscall_entry(EM_MICROBLAZE, regs->r12, regs->r5, regs->r6,
- regs->r7, regs->r8);
+ audit_syscall_entry(regs->r12, regs->r5, regs->r6, regs->r7, regs->r8);
return ret ?: regs->r12;
}
diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
index 65ba622..c06bb82 100644
--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -671,9 +671,7 @@ asmlinkage void syscall_trace_enter(struct pt_regs *regs)
if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
trace_sys_enter(regs, regs->regs[2]);
- audit_syscall_entry(syscall_get_arch(),
- regs->regs[2],
- regs->regs[4], regs->regs[5],
+ audit_syscall_entry(regs->regs[2], regs->regs[4], regs->regs[5],
regs->regs[6], regs->regs[7]);
}
diff --git a/arch/openrisc/kernel/ptrace.c b/arch/openrisc/kernel/ptrace.c
index 71a2a0c..4f59fa4 100644
--- a/arch/openrisc/kernel/ptrace.c
+++ b/arch/openrisc/kernel/ptrace.c
@@ -187,8 +187,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
*/
ret = -1L;
- audit_syscall_entry(AUDIT_ARCH_OPENRISC, regs->gpr[11],
- regs->gpr[3], regs->gpr[4],
+ audit_syscall_entry(regs->gpr[11], regs->gpr[3], regs->gpr[4],
regs->gpr[5], regs->gpr[6]);
return ret ? : regs->gpr[11];
diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c
index e842ee2..7481457 100644
--- a/arch/parisc/kernel/ptrace.c
+++ b/arch/parisc/kernel/ptrace.c
@@ -276,14 +276,11 @@ long do_syscall_trace_enter(struct pt_regs *regs)
#ifdef CONFIG_64BIT
if (!is_compat_task())
- audit_syscall_entry(AUDIT_ARCH_PARISC64,
- regs->gr[20],
- regs->gr[26], regs->gr[25],
- regs->gr[24], regs->gr[23]);
+ audit_syscall_entry(regs->gr[20], regs->gr[26], regs->gr[25],
+ regs->gr[24], regs->gr[23]);
else
#endif
- audit_syscall_entry(AUDIT_ARCH_PARISC,
- regs->gr[20] & 0xffffffff,
+ audit_syscall_entry(regs->gr[20] & 0xffffffff,
regs->gr[26] & 0xffffffff,
regs->gr[25] & 0xffffffff,
regs->gr[24] & 0xffffffff,
diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
index 2e3d2bf..524a943 100644
--- a/arch/powerpc/kernel/ptrace.c
+++ b/arch/powerpc/kernel/ptrace.c
@@ -1788,14 +1788,11 @@ long do_syscall_trace_enter(struct pt_regs *regs)
#ifdef CONFIG_PPC64
if (!is_32bit_task())
- audit_syscall_entry(AUDIT_ARCH_PPC64,
- regs->gpr[0],
- regs->gpr[3], regs->gpr[4],
+ audit_syscall_entry(regs->gpr[0], regs->gpr[3], regs->gpr[4],
regs->gpr[5], regs->gpr[6]);
else
#endif
- audit_syscall_entry(AUDIT_ARCH_PPC,
- regs->gpr[0],
+ audit_syscall_entry(regs->gpr[0],
regs->gpr[3] & 0xffffffff,
regs->gpr[4] & 0xffffffff,
regs->gpr[5] & 0xffffffff,
diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
index e65c91c..2e2e7bb5 100644
--- a/arch/s390/kernel/ptrace.c
+++ b/arch/s390/kernel/ptrace.c
@@ -812,9 +812,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
trace_sys_enter(regs, regs->gprs[2]);
- audit_syscall_entry(is_compat_task() ?
- AUDIT_ARCH_S390 : AUDIT_ARCH_S390X,
- regs->gprs[2], regs->orig_gpr2,
+ audit_syscall_entry(regs->gprs[2], regs->orig_gpr2,
regs->gprs[3], regs->gprs[4],
regs->gprs[5]);
out:
diff --git a/arch/sh/kernel/ptrace_32.c b/arch/sh/kernel/ptrace_32.c
index 668c816..c1a6b89 100644
--- a/arch/sh/kernel/ptrace_32.c
+++ b/arch/sh/kernel/ptrace_32.c
@@ -484,17 +484,6 @@ long arch_ptrace(struct task_struct *child, long request,
return ret;
}
-static inline int audit_arch(void)
-{
- int arch = EM_SH;
-
-#ifdef CONFIG_CPU_LITTLE_ENDIAN
- arch |= __AUDIT_ARCH_LE;
-#endif
-
- return arch;
-}
-
asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
{
long ret = 0;
@@ -513,8 +502,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
trace_sys_enter(regs, regs->regs[0]);
- audit_syscall_entry(audit_arch(), regs->regs[3],
- regs->regs[4], regs->regs[5],
+ audit_syscall_entry(regs->regs[3], regs->regs[4], regs->regs[5],
regs->regs[6], regs->regs[7]);
return ret ?: regs->regs[0];
diff --git a/arch/sh/kernel/ptrace_64.c b/arch/sh/kernel/ptrace_64.c
index af90339..5cea973 100644
--- a/arch/sh/kernel/ptrace_64.c
+++ b/arch/sh/kernel/ptrace_64.c
@@ -504,20 +504,6 @@ asmlinkage int sh64_ptrace(long request, long pid,
return sys_ptrace(request, pid, addr, data);
}
-static inline int audit_arch(void)
-{
- int arch = EM_SH;
-
-#ifdef CONFIG_64BIT
- arch |= __AUDIT_ARCH_64BIT;
-#endif
-#ifdef CONFIG_CPU_LITTLE_ENDIAN
- arch |= __AUDIT_ARCH_LE;
-#endif
-
- return arch;
-}
-
asmlinkage long long do_syscall_trace_enter(struct pt_regs *regs)
{
long long ret = 0;
@@ -536,8 +522,7 @@ asmlinkage long long do_syscall_trace_enter(struct pt_regs *regs)
if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
trace_sys_enter(regs, regs->regs[9]);
- audit_syscall_entry(audit_arch(), regs->regs[1],
- regs->regs[2], regs->regs[3],
+ audit_syscall_entry(regs->regs[1], regs->regs[2], regs->regs[3],
regs->regs[4], regs->regs[5]);
return ret ?: regs->regs[9];
diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c
index c13c9f2..9ddc492 100644
--- a/arch/sparc/kernel/ptrace_64.c
+++ b/arch/sparc/kernel/ptrace_64.c
@@ -1076,13 +1076,8 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
trace_sys_enter(regs, regs->u_regs[UREG_G1]);
- audit_syscall_entry((test_thread_flag(TIF_32BIT) ?
- AUDIT_ARCH_SPARC :
- AUDIT_ARCH_SPARC64),
- regs->u_regs[UREG_G1],
- regs->u_regs[UREG_I0],
- regs->u_regs[UREG_I1],
- regs->u_regs[UREG_I2],
+ audit_syscall_entry(regs->u_regs[UREG_G1], regs->u_regs[UREG_I0],
+ regs->u_regs[UREG_I1], regs->u_regs[UREG_I2],
regs->u_regs[UREG_I3]);
return ret;
diff --git a/arch/um/kernel/ptrace.c b/arch/um/kernel/ptrace.c
index 694d551..62435ef 100644
--- a/arch/um/kernel/ptrace.c
+++ b/arch/um/kernel/ptrace.c
@@ -165,8 +165,7 @@ static void send_sigtrap(struct task_struct *tsk, struct uml_pt_regs *regs,
*/
void syscall_trace_enter(struct pt_regs *regs)
{
- audit_syscall_entry(HOST_AUDIT_ARCH,
- UPT_SYSCALL_NR(®s->regs),
+ audit_syscall_entry(UPT_SYSCALL_NR(®s->regs),
UPT_SYSCALL_ARG1(®s->regs),
UPT_SYSCALL_ARG2(®s->regs),
UPT_SYSCALL_ARG3(®s->regs),
diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
index 7461f50..46dfba6 100644
--- a/arch/x86/kernel/ptrace.c
+++ b/arch/x86/kernel/ptrace.c
@@ -1488,15 +1488,11 @@ long syscall_trace_enter(struct pt_regs *regs)
trace_sys_enter(regs, regs->orig_ax);
if (IS_IA32)
- audit_syscall_entry(AUDIT_ARCH_I386,
- regs->orig_ax,
- regs->bx, regs->cx,
+ audit_syscall_entry(regs->orig_ax, regs->bx, regs->cx,
regs->dx, regs->si);
#ifdef CONFIG_X86_64
else
- audit_syscall_entry(AUDIT_ARCH_X86_64,
- regs->orig_ax,
- regs->di, regs->si,
+ audit_syscall_entry(regs->orig_ax, regs->di, regs->si,
regs->dx, regs->r10);
#endif
diff --git a/arch/x86/um/asm/ptrace.h b/arch/x86/um/asm/ptrace.h
index 54f8102..e59eef2 100644
--- a/arch/x86/um/asm/ptrace.h
+++ b/arch/x86/um/asm/ptrace.h
@@ -47,8 +47,6 @@ struct user_desc;
#ifdef CONFIG_X86_32
-#define HOST_AUDIT_ARCH AUDIT_ARCH_I386
-
extern int ptrace_get_thread_area(struct task_struct *child, int idx,
struct user_desc __user *user_desc);
@@ -57,8 +55,6 @@ extern int ptrace_set_thread_area(struct task_struct *child, int idx,
#else
-#define HOST_AUDIT_ARCH AUDIT_ARCH_X86_64
-
#define PT_REGS_R8(r) UPT_R8(&(r)->regs)
#define PT_REGS_R9(r) UPT_R9(&(r)->regs)
#define PT_REGS_R10(r) UPT_R10(&(r)->regs)
diff --git a/arch/xtensa/kernel/ptrace.c b/arch/xtensa/kernel/ptrace.c
index 562fac6..4d54b48 100644
--- a/arch/xtensa/kernel/ptrace.c
+++ b/arch/xtensa/kernel/ptrace.c
@@ -342,7 +342,7 @@ void do_syscall_trace_enter(struct pt_regs *regs)
do_syscall_trace();
#if 0
- audit_syscall_entry(current, AUDIT_ARCH_XTENSA..);
+ audit_syscall_entry(...);
#endif
}
diff --git a/include/linux/audit.h b/include/linux/audit.h
index 4b2983e..62c9d98 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -26,6 +26,7 @@
#include <linux/sched.h>
#include <linux/ptrace.h>
#include <uapi/linux/audit.h>
+#include <asm/syscall.h>
struct audit_sig_info {
uid_t uid;
@@ -135,12 +136,12 @@ static inline void audit_free(struct task_struct *task)
if (unlikely(task->audit_context))
__audit_free(task);
}
-static inline void audit_syscall_entry(int arch, int major, unsigned long a0,
+static inline void audit_syscall_entry(int major, unsigned long a0,
unsigned long a1, unsigned long a2,
unsigned long a3)
{
if (unlikely(current->audit_context))
- __audit_syscall_entry(arch, major, a0, a1, a2, a3);
+ __audit_syscall_entry(syscall_get_arch(), major, a0, a1, a2, a3);
}
static inline void audit_syscall_exit(void *pt_regs)
{
@@ -316,7 +317,7 @@ static inline int audit_alloc(struct task_struct *task)
}
static inline void audit_free(struct task_struct *task)
{ }
-static inline void audit_syscall_entry(int arch, int major, unsigned long a0,
+static inline void audit_syscall_entry(int major, unsigned long a0,
unsigned long a1, unsigned long a2,
unsigned long a3)
{ }
--
1.8.5.3
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH 3/4] ARCH: AUDIT: implement syscall_get_arch for all arches
2014-03-19 22:04 ` [PATCH 3/4] ARCH: AUDIT: implement syscall_get_arch for all arches Eric Paris
@ 2014-03-19 22:19 ` Matt Turner
2014-03-19 23:02 ` Eric Paris
2014-03-21 19:13 ` Richard Guy Briggs
2014-04-22 3:09 ` Stephen Rothwell
2 siblings, 1 reply; 7+ messages in thread
From: Matt Turner @ 2014-03-19 22:19 UTC (permalink / raw)
To: Eric Paris
Cc: linux-mips@linux-mips.org, linux-ia64,
linux-parisc@vger.kernel.org, microblaze-uclinux, linux,
linux-audit, sparclinux, linuxppc-dev
On Wed, Mar 19, 2014 at 3:04 PM, Eric Paris <eparis@redhat.com> wrote:
> For all arches which support audit implement syscall_get_arch()
support audit -- is that AUDIT_ARCH? If so, alpha gained support
recently, so I think this patch needs to handle alpha too?
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH 3/4] ARCH: AUDIT: implement syscall_get_arch for all arches
2014-03-19 22:19 ` Matt Turner
@ 2014-03-19 23:02 ` Eric Paris
0 siblings, 0 replies; 7+ messages in thread
From: Eric Paris @ 2014-03-19 23:02 UTC (permalink / raw)
To: Matt Turner
Cc: linux-mips@linux-mips.org, linux-ia64,
linux-parisc@vger.kernel.org, microblaze-uclinux, linux,
linux-audit, sparclinux, linuxppc-dev
On Wed, 2014-03-19 at 15:19 -0700, Matt Turner wrote:
> On Wed, Mar 19, 2014 at 3:04 PM, Eric Paris <eparis@redhat.com> wrote:
> > For all arches which support audit implement syscall_get_arch()
>
> support audit -- is that AUDIT_ARCH? If so, alpha gained support
> recently, so I think this patch needs to handle alpha too?
Absolutely right. I broke Alpha (in the next patch). Will fix.
-Eric
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH 3/4] ARCH: AUDIT: implement syscall_get_arch for all arches
2014-03-19 22:04 ` [PATCH 3/4] ARCH: AUDIT: implement syscall_get_arch for all arches Eric Paris
2014-03-19 22:19 ` Matt Turner
@ 2014-03-21 19:13 ` Richard Guy Briggs
2014-04-22 3:09 ` Stephen Rothwell
2 siblings, 0 replies; 7+ messages in thread
From: Richard Guy Briggs @ 2014-03-21 19:13 UTC (permalink / raw)
To: Eric Paris
Cc: linux-mips, linux-ia64, linux-parisc, microblaze-uclinux, linux,
linux-audit, sparclinux, linuxppc-dev
On 14/03/19, Eric Paris wrote:
> For all arches which support audit implement syscall_get_arch()
> They are all pretty easy and straight forward, stolen from how the call
> to audit_syscall_entry() determines the arch.
>
> Signed-off-by: Eric Paris <eparis@redhat.com>
> Cc: linux-ia64@vger.kernel.org
> Cc: microblaze-uclinux@itee.uq.edu.au
> Cc: linux-mips@linux-mips.org
> Cc: linux@lists.openrisc.net
> Cc: linux-parisc@vger.kernel.org
> Cc: linuxppc-dev@lists.ozlabs.org
> Cc: sparclinux@vger.kernel.org
Acked-by: Richard Guy Briggs <rgb@redhat.com>
> ---
> arch/ia64/include/asm/syscall.h | 6 ++++++
> arch/microblaze/include/asm/syscall.h | 5 +++++
> arch/mips/include/asm/syscall.h | 2 +-
> arch/openrisc/include/asm/syscall.h | 5 +++++
> arch/parisc/include/asm/syscall.h | 11 +++++++++++
> arch/powerpc/include/asm/syscall.h | 12 ++++++++++++
> arch/sparc/include/asm/syscall.h | 8 ++++++++
> include/uapi/linux/audit.h | 1 +
> 8 files changed, 49 insertions(+), 1 deletion(-)
>
> diff --git a/arch/ia64/include/asm/syscall.h b/arch/ia64/include/asm/syscall.h
> index a7ff1c6..1d0b875 100644
> --- a/arch/ia64/include/asm/syscall.h
> +++ b/arch/ia64/include/asm/syscall.h
> @@ -13,6 +13,7 @@
> #ifndef _ASM_SYSCALL_H
> #define _ASM_SYSCALL_H 1
>
> +#include <uapi/linux/audit.h>
> #include <linux/sched.h>
> #include <linux/err.h>
>
> @@ -79,4 +80,9 @@ static inline void syscall_set_arguments(struct task_struct *task,
>
> ia64_syscall_get_set_arguments(task, regs, i, n, args, 1);
> }
> +
> +static inline int syscall_get_arch(void)
> +{
> + return AUDIT_ARCH_IA64;
> +}
> #endif /* _ASM_SYSCALL_H */
> diff --git a/arch/microblaze/include/asm/syscall.h b/arch/microblaze/include/asm/syscall.h
> index 9bc4317..53cfaf3 100644
> --- a/arch/microblaze/include/asm/syscall.h
> +++ b/arch/microblaze/include/asm/syscall.h
> @@ -1,6 +1,7 @@
> #ifndef __ASM_MICROBLAZE_SYSCALL_H
> #define __ASM_MICROBLAZE_SYSCALL_H
>
> +#include <uapi/linux/audit.h>
> #include <linux/kernel.h>
> #include <linux/sched.h>
> #include <asm/ptrace.h>
> @@ -99,4 +100,8 @@ static inline void syscall_set_arguments(struct task_struct *task,
> asmlinkage long do_syscall_trace_enter(struct pt_regs *regs);
> asmlinkage void do_syscall_trace_leave(struct pt_regs *regs);
>
> +static inline int syscall_get_arch(void)
> +{
> + return AUDIT_ARCH_MICROBLAZE;
> +}
> #endif /* __ASM_MICROBLAZE_SYSCALL_H */
> diff --git a/arch/mips/include/asm/syscall.h b/arch/mips/include/asm/syscall.h
> index fc556d8..992b6ab 100644
> --- a/arch/mips/include/asm/syscall.h
> +++ b/arch/mips/include/asm/syscall.h
> @@ -103,7 +103,7 @@ extern const unsigned long sysn32_call_table[];
>
> static inline int syscall_get_arch(void)
> {
> - int arch = EM_MIPS;
> + int arch = AUDIT_ARCH_MIPS;
> #ifdef CONFIG_64BIT
> arch |= __AUDIT_ARCH_64BIT;
> #endif
> diff --git a/arch/openrisc/include/asm/syscall.h b/arch/openrisc/include/asm/syscall.h
> index b752bb6..2db9f1c 100644
> --- a/arch/openrisc/include/asm/syscall.h
> +++ b/arch/openrisc/include/asm/syscall.h
> @@ -19,6 +19,7 @@
> #ifndef __ASM_OPENRISC_SYSCALL_H__
> #define __ASM_OPENRISC_SYSCALL_H__
>
> +#include <uapi/linux/audit.h>
> #include <linux/err.h>
> #include <linux/sched.h>
>
> @@ -71,4 +72,8 @@ syscall_set_arguments(struct task_struct *task, struct pt_regs *regs,
> memcpy(®s->gpr[3 + i], args, n * sizeof(args[0]));
> }
>
> +static inline int syscall_get_arch(void)
> +{
> + return AUDIT_ARCH_OPENRISC;
> +}
> #endif
> diff --git a/arch/parisc/include/asm/syscall.h b/arch/parisc/include/asm/syscall.h
> index 8bdfd2c..a5eba95 100644
> --- a/arch/parisc/include/asm/syscall.h
> +++ b/arch/parisc/include/asm/syscall.h
> @@ -3,6 +3,8 @@
> #ifndef _ASM_PARISC_SYSCALL_H_
> #define _ASM_PARISC_SYSCALL_H_
>
> +#include <uapi/linux/audit.h>
> +#include <linux/compat.h>
> #include <linux/err.h>
> #include <asm/ptrace.h>
>
> @@ -37,4 +39,13 @@ static inline void syscall_get_arguments(struct task_struct *tsk,
> }
> }
>
> +static inline int syscall_get_arch(void)
> +{
> + int arch = AUDIT_ARCH_PARISC;
> +#ifdef CONFIG_64BIT
> + if (!is_compat_task())
> + arch = AUDIT_ARCH_PARISC64;
> +#endif
> + return arch;
> +}
> #endif /*_ASM_PARISC_SYSCALL_H_*/
> diff --git a/arch/powerpc/include/asm/syscall.h b/arch/powerpc/include/asm/syscall.h
> index b54b2ad..4271544 100644
> --- a/arch/powerpc/include/asm/syscall.h
> +++ b/arch/powerpc/include/asm/syscall.h
> @@ -13,6 +13,8 @@
> #ifndef _ASM_SYSCALL_H
> #define _ASM_SYSCALL_H 1
>
> +#include <uapi/linux/audit.h>
> +#include <linux/compat.h>
> #include <linux/sched.h>
>
> /* ftrace syscalls requires exporting the sys_call_table */
> @@ -86,4 +88,14 @@ static inline void syscall_set_arguments(struct task_struct *task,
> memcpy(®s->gpr[3 + i], args, n * sizeof(args[0]));
> }
>
> +static inline int syscall_get_arch(void)
> +{
> + int arch = AUDIT_ARCH_PPC;
> +
> +#ifdef CONFIG_PPC64
> + if (!is_32bit_task())
> + arch = AUDIT_ARCH_PPC64;
> +#endif
> + return arch;
> +}
> #endif /* _ASM_SYSCALL_H */
> diff --git a/arch/sparc/include/asm/syscall.h b/arch/sparc/include/asm/syscall.h
> index 025a02a..fed3d51 100644
> --- a/arch/sparc/include/asm/syscall.h
> +++ b/arch/sparc/include/asm/syscall.h
> @@ -1,9 +1,11 @@
> #ifndef __ASM_SPARC_SYSCALL_H
> #define __ASM_SPARC_SYSCALL_H
>
> +#include <uapi/linux/audit.h>
> #include <linux/kernel.h>
> #include <linux/sched.h>
> #include <asm/ptrace.h>
> +#include <asm/thread_info.h>
>
> /*
> * The syscall table always contains 32 bit pointers since we know that the
> @@ -124,4 +126,10 @@ static inline void syscall_set_arguments(struct task_struct *task,
> regs->u_regs[UREG_I0 + i + j] = args[j];
> }
>
> +static inline int syscall_get_arch(void)
> +{
> + return test_thread_flag(TIF_32BIT) ? AUDIT_ARCH_SPARC
> + : AUDIT_ARCH_SPARC64;
> +}
> +
> #endif /* __ASM_SPARC_SYSCALL_H */
> diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
> index 9af01d7..8496cfa 100644
> --- a/include/uapi/linux/audit.h
> +++ b/include/uapi/linux/audit.h
> @@ -343,6 +343,7 @@ enum {
> #define AUDIT_ARCH_IA64 (EM_IA_64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
> #define AUDIT_ARCH_M32R (EM_M32R)
> #define AUDIT_ARCH_M68K (EM_68K)
> +#define AUDIT_ARCH_MICROBLAZE (EM_MICROBLAZE)
> #define AUDIT_ARCH_MIPS (EM_MIPS)
> #define AUDIT_ARCH_MIPSEL (EM_MIPS|__AUDIT_ARCH_LE)
> #define AUDIT_ARCH_MIPS64 (EM_MIPS|__AUDIT_ARCH_64BIT)
> --
> 1.8.5.3
>
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
- RGB
--
Richard Guy Briggs <rbriggs@redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH 4/4] ARCH: AUDIT: audit_syscall_entry() should not require the arch
2014-03-19 22:04 ` [PATCH 4/4] ARCH: AUDIT: audit_syscall_entry() should not require the arch Eric Paris
@ 2014-03-21 19:18 ` Richard Guy Briggs
0 siblings, 0 replies; 7+ messages in thread
From: Richard Guy Briggs @ 2014-03-21 19:18 UTC (permalink / raw)
To: Eric Paris
Cc: linux-mips, linux-ia64, linux-parisc, user-mode-linux-devel,
linux-s390, linux-sh, microblaze-uclinux, linux-xtensa, x86,
linux-audit, linux-alpha, sparclinux, linuxppc-dev, linux,
linux-arm-kernel
On 14/03/19, Eric Paris wrote:
> We have a function where the arch can be queried, syscall_get_arch().
> So rather than have every single piece of arch specific code use and/or
> duplicate syscall_get_arch(), just have the audit code use the
> syscall_get_arch() code.
>
> Signed-off-by: Eric Paris <eparis@redhat.com>
> Cc: linux-alpha@vger.kernel.org
> Cc: linux-arm-kernel@lists.infradead.org
> Cc: linux-ia64@vger.kernel.org
> Cc: microblaze-uclinux@itee.uq.edu.au
> Cc: linux-mips@linux-mips.org
> Cc: linux@lists.openrisc.net
> Cc: linux-parisc@vger.kernel.org
> Cc: linuxppc-dev@lists.ozlabs.org
> Cc: linux-s390@vger.kernel.org
> Cc: linux-sh@vger.kernel.org
> Cc: sparclinux@vger.kernel.org
> Cc: user-mode-linux-devel@lists.sourceforge.net
> Cc: linux-xtensa@linux-xtensa.org
> Cc: x86@kernel.org
Acked-by: Richard Guy Briggs <rgb@redhat.com>
> ---
> arch/alpha/kernel/ptrace.c | 2 +-
> arch/arm/kernel/ptrace.c | 4 ++--
> arch/ia64/kernel/ptrace.c | 2 +-
> arch/microblaze/kernel/ptrace.c | 3 +--
> arch/mips/kernel/ptrace.c | 4 +---
> arch/openrisc/kernel/ptrace.c | 3 +--
> arch/parisc/kernel/ptrace.c | 9 +++------
> arch/powerpc/kernel/ptrace.c | 7 ++-----
> arch/s390/kernel/ptrace.c | 4 +---
> arch/sh/kernel/ptrace_32.c | 14 +-------------
> arch/sh/kernel/ptrace_64.c | 17 +----------------
> arch/sparc/kernel/ptrace_64.c | 9 ++-------
> arch/um/kernel/ptrace.c | 3 +--
> arch/x86/kernel/ptrace.c | 8 ++------
> arch/x86/um/asm/ptrace.h | 4 ----
> arch/xtensa/kernel/ptrace.c | 2 +-
> include/linux/audit.h | 7 ++++---
> 17 files changed, 25 insertions(+), 77 deletions(-)
>
> diff --git a/arch/alpha/kernel/ptrace.c b/arch/alpha/kernel/ptrace.c
> index 86d8351..d9ee817 100644
> --- a/arch/alpha/kernel/ptrace.c
> +++ b/arch/alpha/kernel/ptrace.c
> @@ -321,7 +321,7 @@ asmlinkage unsigned long syscall_trace_enter(void)
> if (test_thread_flag(TIF_SYSCALL_TRACE) &&
> tracehook_report_syscall_entry(current_pt_regs()))
> ret = -1UL;
> - audit_syscall_entry(AUDIT_ARCH_ALPHA, regs->r0, regs->r16, regs->r17, regs->r18, regs->r19);
> + audit_syscall_entry(regs->r0, regs->r16, regs->r17, regs->r18, regs->r19);
> return ret ?: current_pt_regs()->r0;
> }
>
> diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
> index 0dd3b79..c9d2b34 100644
> --- a/arch/arm/kernel/ptrace.c
> +++ b/arch/arm/kernel/ptrace.c
> @@ -943,8 +943,8 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs, int scno)
> if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
> trace_sys_enter(regs, scno);
>
> - audit_syscall_entry(AUDIT_ARCH_ARM, scno, regs->ARM_r0, regs->ARM_r1,
> - regs->ARM_r2, regs->ARM_r3);
> + audit_syscall_entry(scno, regs->ARM_r0, regs->ARM_r1, regs->ARM_r2,
> + regs->ARM_r3);
>
> return scno;
> }
> diff --git a/arch/ia64/kernel/ptrace.c b/arch/ia64/kernel/ptrace.c
> index b7a5fff..6f54d51 100644
> --- a/arch/ia64/kernel/ptrace.c
> +++ b/arch/ia64/kernel/ptrace.c
> @@ -1219,7 +1219,7 @@ syscall_trace_enter (long arg0, long arg1, long arg2, long arg3,
> ia64_sync_krbs();
>
>
> - audit_syscall_entry(AUDIT_ARCH_IA64, regs.r15, arg0, arg1, arg2, arg3);
> + audit_syscall_entry(regs.r15, arg0, arg1, arg2, arg3);
>
> return 0;
> }
> diff --git a/arch/microblaze/kernel/ptrace.c b/arch/microblaze/kernel/ptrace.c
> index 39cf508..bb10637 100644
> --- a/arch/microblaze/kernel/ptrace.c
> +++ b/arch/microblaze/kernel/ptrace.c
> @@ -147,8 +147,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
> */
> ret = -1L;
>
> - audit_syscall_entry(EM_MICROBLAZE, regs->r12, regs->r5, regs->r6,
> - regs->r7, regs->r8);
> + audit_syscall_entry(regs->r12, regs->r5, regs->r6, regs->r7, regs->r8);
>
> return ret ?: regs->r12;
> }
> diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
> index 65ba622..c06bb82 100644
> --- a/arch/mips/kernel/ptrace.c
> +++ b/arch/mips/kernel/ptrace.c
> @@ -671,9 +671,7 @@ asmlinkage void syscall_trace_enter(struct pt_regs *regs)
> if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
> trace_sys_enter(regs, regs->regs[2]);
>
> - audit_syscall_entry(syscall_get_arch(),
> - regs->regs[2],
> - regs->regs[4], regs->regs[5],
> + audit_syscall_entry(regs->regs[2], regs->regs[4], regs->regs[5],
> regs->regs[6], regs->regs[7]);
> }
>
> diff --git a/arch/openrisc/kernel/ptrace.c b/arch/openrisc/kernel/ptrace.c
> index 71a2a0c..4f59fa4 100644
> --- a/arch/openrisc/kernel/ptrace.c
> +++ b/arch/openrisc/kernel/ptrace.c
> @@ -187,8 +187,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
> */
> ret = -1L;
>
> - audit_syscall_entry(AUDIT_ARCH_OPENRISC, regs->gpr[11],
> - regs->gpr[3], regs->gpr[4],
> + audit_syscall_entry(regs->gpr[11], regs->gpr[3], regs->gpr[4],
> regs->gpr[5], regs->gpr[6]);
>
> return ret ? : regs->gpr[11];
> diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c
> index e842ee2..7481457 100644
> --- a/arch/parisc/kernel/ptrace.c
> +++ b/arch/parisc/kernel/ptrace.c
> @@ -276,14 +276,11 @@ long do_syscall_trace_enter(struct pt_regs *regs)
>
> #ifdef CONFIG_64BIT
> if (!is_compat_task())
> - audit_syscall_entry(AUDIT_ARCH_PARISC64,
> - regs->gr[20],
> - regs->gr[26], regs->gr[25],
> - regs->gr[24], regs->gr[23]);
> + audit_syscall_entry(regs->gr[20], regs->gr[26], regs->gr[25],
> + regs->gr[24], regs->gr[23]);
> else
> #endif
> - audit_syscall_entry(AUDIT_ARCH_PARISC,
> - regs->gr[20] & 0xffffffff,
> + audit_syscall_entry(regs->gr[20] & 0xffffffff,
> regs->gr[26] & 0xffffffff,
> regs->gr[25] & 0xffffffff,
> regs->gr[24] & 0xffffffff,
> diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
> index 2e3d2bf..524a943 100644
> --- a/arch/powerpc/kernel/ptrace.c
> +++ b/arch/powerpc/kernel/ptrace.c
> @@ -1788,14 +1788,11 @@ long do_syscall_trace_enter(struct pt_regs *regs)
>
> #ifdef CONFIG_PPC64
> if (!is_32bit_task())
> - audit_syscall_entry(AUDIT_ARCH_PPC64,
> - regs->gpr[0],
> - regs->gpr[3], regs->gpr[4],
> + audit_syscall_entry(regs->gpr[0], regs->gpr[3], regs->gpr[4],
> regs->gpr[5], regs->gpr[6]);
> else
> #endif
> - audit_syscall_entry(AUDIT_ARCH_PPC,
> - regs->gpr[0],
> + audit_syscall_entry(regs->gpr[0],
> regs->gpr[3] & 0xffffffff,
> regs->gpr[4] & 0xffffffff,
> regs->gpr[5] & 0xffffffff,
> diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
> index e65c91c..2e2e7bb5 100644
> --- a/arch/s390/kernel/ptrace.c
> +++ b/arch/s390/kernel/ptrace.c
> @@ -812,9 +812,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
> if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
> trace_sys_enter(regs, regs->gprs[2]);
>
> - audit_syscall_entry(is_compat_task() ?
> - AUDIT_ARCH_S390 : AUDIT_ARCH_S390X,
> - regs->gprs[2], regs->orig_gpr2,
> + audit_syscall_entry(regs->gprs[2], regs->orig_gpr2,
> regs->gprs[3], regs->gprs[4],
> regs->gprs[5]);
> out:
> diff --git a/arch/sh/kernel/ptrace_32.c b/arch/sh/kernel/ptrace_32.c
> index 668c816..c1a6b89 100644
> --- a/arch/sh/kernel/ptrace_32.c
> +++ b/arch/sh/kernel/ptrace_32.c
> @@ -484,17 +484,6 @@ long arch_ptrace(struct task_struct *child, long request,
> return ret;
> }
>
> -static inline int audit_arch(void)
> -{
> - int arch = EM_SH;
> -
> -#ifdef CONFIG_CPU_LITTLE_ENDIAN
> - arch |= __AUDIT_ARCH_LE;
> -#endif
> -
> - return arch;
> -}
> -
> asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
> {
> long ret = 0;
> @@ -513,8 +502,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
> if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
> trace_sys_enter(regs, regs->regs[0]);
>
> - audit_syscall_entry(audit_arch(), regs->regs[3],
> - regs->regs[4], regs->regs[5],
> + audit_syscall_entry(regs->regs[3], regs->regs[4], regs->regs[5],
> regs->regs[6], regs->regs[7]);
>
> return ret ?: regs->regs[0];
> diff --git a/arch/sh/kernel/ptrace_64.c b/arch/sh/kernel/ptrace_64.c
> index af90339..5cea973 100644
> --- a/arch/sh/kernel/ptrace_64.c
> +++ b/arch/sh/kernel/ptrace_64.c
> @@ -504,20 +504,6 @@ asmlinkage int sh64_ptrace(long request, long pid,
> return sys_ptrace(request, pid, addr, data);
> }
>
> -static inline int audit_arch(void)
> -{
> - int arch = EM_SH;
> -
> -#ifdef CONFIG_64BIT
> - arch |= __AUDIT_ARCH_64BIT;
> -#endif
> -#ifdef CONFIG_CPU_LITTLE_ENDIAN
> - arch |= __AUDIT_ARCH_LE;
> -#endif
> -
> - return arch;
> -}
> -
> asmlinkage long long do_syscall_trace_enter(struct pt_regs *regs)
> {
> long long ret = 0;
> @@ -536,8 +522,7 @@ asmlinkage long long do_syscall_trace_enter(struct pt_regs *regs)
> if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
> trace_sys_enter(regs, regs->regs[9]);
>
> - audit_syscall_entry(audit_arch(), regs->regs[1],
> - regs->regs[2], regs->regs[3],
> + audit_syscall_entry(regs->regs[1], regs->regs[2], regs->regs[3],
> regs->regs[4], regs->regs[5]);
>
> return ret ?: regs->regs[9];
> diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c
> index c13c9f2..9ddc492 100644
> --- a/arch/sparc/kernel/ptrace_64.c
> +++ b/arch/sparc/kernel/ptrace_64.c
> @@ -1076,13 +1076,8 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
> if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
> trace_sys_enter(regs, regs->u_regs[UREG_G1]);
>
> - audit_syscall_entry((test_thread_flag(TIF_32BIT) ?
> - AUDIT_ARCH_SPARC :
> - AUDIT_ARCH_SPARC64),
> - regs->u_regs[UREG_G1],
> - regs->u_regs[UREG_I0],
> - regs->u_regs[UREG_I1],
> - regs->u_regs[UREG_I2],
> + audit_syscall_entry(regs->u_regs[UREG_G1], regs->u_regs[UREG_I0],
> + regs->u_regs[UREG_I1], regs->u_regs[UREG_I2],
> regs->u_regs[UREG_I3]);
>
> return ret;
> diff --git a/arch/um/kernel/ptrace.c b/arch/um/kernel/ptrace.c
> index 694d551..62435ef 100644
> --- a/arch/um/kernel/ptrace.c
> +++ b/arch/um/kernel/ptrace.c
> @@ -165,8 +165,7 @@ static void send_sigtrap(struct task_struct *tsk, struct uml_pt_regs *regs,
> */
> void syscall_trace_enter(struct pt_regs *regs)
> {
> - audit_syscall_entry(HOST_AUDIT_ARCH,
> - UPT_SYSCALL_NR(®s->regs),
> + audit_syscall_entry(UPT_SYSCALL_NR(®s->regs),
> UPT_SYSCALL_ARG1(®s->regs),
> UPT_SYSCALL_ARG2(®s->regs),
> UPT_SYSCALL_ARG3(®s->regs),
> diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
> index 7461f50..46dfba6 100644
> --- a/arch/x86/kernel/ptrace.c
> +++ b/arch/x86/kernel/ptrace.c
> @@ -1488,15 +1488,11 @@ long syscall_trace_enter(struct pt_regs *regs)
> trace_sys_enter(regs, regs->orig_ax);
>
> if (IS_IA32)
> - audit_syscall_entry(AUDIT_ARCH_I386,
> - regs->orig_ax,
> - regs->bx, regs->cx,
> + audit_syscall_entry(regs->orig_ax, regs->bx, regs->cx,
> regs->dx, regs->si);
> #ifdef CONFIG_X86_64
> else
> - audit_syscall_entry(AUDIT_ARCH_X86_64,
> - regs->orig_ax,
> - regs->di, regs->si,
> + audit_syscall_entry(regs->orig_ax, regs->di, regs->si,
> regs->dx, regs->r10);
> #endif
>
> diff --git a/arch/x86/um/asm/ptrace.h b/arch/x86/um/asm/ptrace.h
> index 54f8102..e59eef2 100644
> --- a/arch/x86/um/asm/ptrace.h
> +++ b/arch/x86/um/asm/ptrace.h
> @@ -47,8 +47,6 @@ struct user_desc;
>
> #ifdef CONFIG_X86_32
>
> -#define HOST_AUDIT_ARCH AUDIT_ARCH_I386
> -
> extern int ptrace_get_thread_area(struct task_struct *child, int idx,
> struct user_desc __user *user_desc);
>
> @@ -57,8 +55,6 @@ extern int ptrace_set_thread_area(struct task_struct *child, int idx,
>
> #else
>
> -#define HOST_AUDIT_ARCH AUDIT_ARCH_X86_64
> -
> #define PT_REGS_R8(r) UPT_R8(&(r)->regs)
> #define PT_REGS_R9(r) UPT_R9(&(r)->regs)
> #define PT_REGS_R10(r) UPT_R10(&(r)->regs)
> diff --git a/arch/xtensa/kernel/ptrace.c b/arch/xtensa/kernel/ptrace.c
> index 562fac6..4d54b48 100644
> --- a/arch/xtensa/kernel/ptrace.c
> +++ b/arch/xtensa/kernel/ptrace.c
> @@ -342,7 +342,7 @@ void do_syscall_trace_enter(struct pt_regs *regs)
> do_syscall_trace();
>
> #if 0
> - audit_syscall_entry(current, AUDIT_ARCH_XTENSA..);
> + audit_syscall_entry(...);
> #endif
> }
>
> diff --git a/include/linux/audit.h b/include/linux/audit.h
> index 4b2983e..62c9d98 100644
> --- a/include/linux/audit.h
> +++ b/include/linux/audit.h
> @@ -26,6 +26,7 @@
> #include <linux/sched.h>
> #include <linux/ptrace.h>
> #include <uapi/linux/audit.h>
> +#include <asm/syscall.h>
>
> struct audit_sig_info {
> uid_t uid;
> @@ -135,12 +136,12 @@ static inline void audit_free(struct task_struct *task)
> if (unlikely(task->audit_context))
> __audit_free(task);
> }
> -static inline void audit_syscall_entry(int arch, int major, unsigned long a0,
> +static inline void audit_syscall_entry(int major, unsigned long a0,
> unsigned long a1, unsigned long a2,
> unsigned long a3)
> {
> if (unlikely(current->audit_context))
> - __audit_syscall_entry(arch, major, a0, a1, a2, a3);
> + __audit_syscall_entry(syscall_get_arch(), major, a0, a1, a2, a3);
> }
> static inline void audit_syscall_exit(void *pt_regs)
> {
> @@ -316,7 +317,7 @@ static inline int audit_alloc(struct task_struct *task)
> }
> static inline void audit_free(struct task_struct *task)
> { }
> -static inline void audit_syscall_entry(int arch, int major, unsigned long a0,
> +static inline void audit_syscall_entry(int major, unsigned long a0,
> unsigned long a1, unsigned long a2,
> unsigned long a3)
> { }
> --
> 1.8.5.3
>
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
- RGB
--
Richard Guy Briggs <rbriggs@redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH 3/4] ARCH: AUDIT: implement syscall_get_arch for all arches
2014-03-19 22:04 ` [PATCH 3/4] ARCH: AUDIT: implement syscall_get_arch for all arches Eric Paris
2014-03-19 22:19 ` Matt Turner
2014-03-21 19:13 ` Richard Guy Briggs
@ 2014-04-22 3:09 ` Stephen Rothwell
2 siblings, 0 replies; 7+ messages in thread
From: Stephen Rothwell @ 2014-04-22 3:09 UTC (permalink / raw)
To: Eric Paris
Cc: linux-mips, linux-ia64, linux-parisc, microblaze-uclinux, linux,
linux-audit, sparclinux, linuxppc-dev
[-- Attachment #1: Type: text/plain, Size: 1310 bytes --]
Hi Eric,
[I just noticed that this turned up in linux-next ...]
On Wed, 19 Mar 2014 18:04:02 -0400 Eric Paris <eparis@redhat.com> wrote:
>
> diff --git a/arch/powerpc/include/asm/syscall.h b/arch/powerpc/include/asm/syscall.h
> index b54b2ad..4271544 100644
> --- a/arch/powerpc/include/asm/syscall.h
> +++ b/arch/powerpc/include/asm/syscall.h
> @@ -13,6 +13,8 @@
> #ifndef _ASM_SYSCALL_H
> #define _ASM_SYSCALL_H 1
>
> +#include <uapi/linux/audit.h>
> +#include <linux/compat.h>
You don't need linux/compat.h, I think, but you do need to include
linux/thread_info.h for is_32bit_task() below.
> #include <linux/sched.h>
>
> /* ftrace syscalls requires exporting the sys_call_table */
> @@ -86,4 +88,14 @@ static inline void syscall_set_arguments(struct task_struct *task,
> memcpy(®s->gpr[3 + i], args, n * sizeof(args[0]));
> }
>
> +static inline int syscall_get_arch(void)
> +{
> + int arch = AUDIT_ARCH_PPC;
> +
> +#ifdef CONFIG_PPC64
> + if (!is_32bit_task())
> + arch = AUDIT_ARCH_PPC64;
> +#endif
> + return arch;
This could just be
return is_32bit_task() ? AUDIT_ARCH_PPC : AUDIT_ARCH_PPC64;
as is_32bit_task() is always defined (and is (1) for !CONFIG_PPC64).
--
Cheers,
Stephen Rothwell sfr@canb.auug.org.au
[-- Attachment #2: Type: application/pgp-signature, Size: 836 bytes --]
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2014-04-22 3:09 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <1395266643-3139-1-git-send-email-eparis@redhat.com>
2014-03-19 22:04 ` [PATCH 3/4] ARCH: AUDIT: implement syscall_get_arch for all arches Eric Paris
2014-03-19 22:19 ` Matt Turner
2014-03-19 23:02 ` Eric Paris
2014-03-21 19:13 ` Richard Guy Briggs
2014-04-22 3:09 ` Stephen Rothwell
2014-03-19 22:04 ` [PATCH 4/4] ARCH: AUDIT: audit_syscall_entry() should not require the arch Eric Paris
2014-03-21 19:18 ` Richard Guy Briggs
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).