[PATCH 0/2] Update audit syscall classification for execve variants

[PATCH 0/2] Update audit syscall classification for execve variants

[David Drysdale]

Add a couple of missing execve variants to the syscall
classification code in the audit system.

 - Patch 1 is potentially suitable for 3.19 stable.
 - Patch 2 need not be back-applied, as audit doesn't yet work
   with x32 syscalls in general.

David Drysdale (2):
  audit: add execveat to syscall classification
  audit,x86: add x32_execve[at] to syscall classification

 arch/x86/kernel/audit_64.c | 6 ++++++
 lib/compat_audit.c         | 3 +++
 2 files changed, 9 insertions(+)

--
1.9.1

[PATCH 1/2] audit: add execveat to syscall classification

[David Drysdale]

New execveat syscall from v3.19 is missing from
audit_classify_compat_syscall().

Reported-by: Brian Gerst <brgerst@gmail.com>
Signed-off-by: David Drysdale <drysdale@google.com>
---
 lib/compat_audit.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/compat_audit.c b/lib/compat_audit.c
index 873f75b640ab..a49469f0511d 100644
--- a/lib/compat_audit.c
+++ b/lib/compat_audit.c
@@ -42,6 +42,9 @@ int audit_classify_compat_syscall(int abi, unsigned syscall)
 	case __NR_socketcall:
 		return 4;
 #endif
+#ifdef __NR_execveat
+	case __NR_execveat:
+#endif
 	case __NR_execve:
 		return 5;
 	default:
-- 
1.9.1

Re: [PATCH 1/2] audit: add execveat to syscall classification

[Greg KH]

On Fri, Mar 06, 2015 at 03:40:37PM +0000, David Drysdale wrote:
> New execveat syscall from v3.19 is missing from
> audit_classify_compat_syscall().
> 
> Reported-by: Brian Gerst <brgerst@gmail.com>
> Signed-off-by: David Drysdale <drysdale@google.com>
> ---
>  lib/compat_audit.c | 3 +++
>  1 file changed, 3 insertions(+)

<formletter>

This is not the correct way to submit patches for inclusion in the
stable kernel tree.  Please read Documentation/stable_kernel_rules.txt
for how to do this properly.

</formletter>

[PATCH 2/2] audit,x86: add x32_execve[at] to syscall classification

[David Drysdale]

Treat x32 ABI variants of execve[at] the same as x86_64
variants.

Slightly speculative as the audit subsystem doesn't currently
work with x32 ABI syscalls.  If and when audit+x32 does work,
this should correctly classify exec calls.

Signed-off-by: David Drysdale <drysdale@google.com>
---
 arch/x86/kernel/audit_64.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/arch/x86/kernel/audit_64.c b/arch/x86/kernel/audit_64.c
index f3672508b249..0aec72d8d3c7 100644
--- a/arch/x86/kernel/audit_64.c
+++ b/arch/x86/kernel/audit_64.c
@@ -49,6 +49,12 @@ int audit_classify_syscall(int abi, unsigned syscall)
 		return 2;
 	case __NR_openat:
 		return 3;
+#ifdef __NR_x32_execve
+	case __NR_x32_execve:
+#endif
+#ifdef __NR_x32_execveat
+	case __NR_x32_execveat:
+#endif
 	case __NR_execve:
 	case __NR_execveat:
 		return 5;
-- 
1.9.1

Re: [PATCH 2/2] audit,x86: add x32_execve[at] to syscall classification

[Greg KH]

On Fri, Mar 06, 2015 at 03:40:38PM +0000, David Drysdale wrote:
> Treat x32 ABI variants of execve[at] the same as x86_64
> variants.
> 
> Slightly speculative as the audit subsystem doesn't currently
> work with x32 ABI syscalls.  If and when audit+x32 does work,
> this should correctly classify exec calls.
> 
> Signed-off-by: David Drysdale <drysdale@google.com>
> ---
>  arch/x86/kernel/audit_64.c | 6 ++++++
>  1 file changed, 6 insertions(+)

<formletter>
Cc: stable <stable@vger.kernel.org>

This is not the correct way to submit patches for inclusion in the
stable kernel tree.  Please read Documentation/stable_kernel_rules.txt
for how to do this properly.

</formletter>