Skip to content

Commit ab074ad

Browse files
torvaldstorvalds
committed
Merge git://git.infradead.org/users/eparis/audit
Pull audit updates from Eric Paris: "So this change across a whole bunch of arches really solves one basic problem. We want to audit when seccomp is killing a process. seccomp hooks in before the audit syscall entry code. audit_syscall_entry took as an argument the arch of the given syscall. Since the arch is part of what makes a syscall number meaningful it's an important part of the record, but it isn't available when seccomp shoots the syscall... For most arch's we have a better way to get the arch (syscall_get_arch) So the solution was two fold: Implement syscall_get_arch() everywhere there is audit which didn't have it. Use syscall_get_arch() in the seccomp audit code. Having syscall_get_arch() everywhere meant it was a useless flag on the stack and we could get rid of it for the typical syscall entry. The other changes inside the audit system aren't grand, fixed some records that had invalid spaces. Better locking around the task comm field. Removing some dead functions and structs. Make some things static. Really minor stuff" * git://git.infradead.org/users/eparis/audit: (31 commits) audit: rename audit_log_remove_rule to disambiguate for trees audit: cull redundancy in audit_rule_change audit: WARN if audit_rule_change called illegally audit: put rule existence check in canonical order next: openrisc: Fix build audit: get comm using lock to avoid race in string printing audit: remove open_arg() function that is never used audit: correct AUDIT_GET_FEATURE return message type audit: set nlmsg_len for multicast messages. audit: use union for audit_field values since they are mutually exclusive audit: invalid op= values for rules audit: use atomic_t to simplify audit_serial() kernel/audit.c: use ARRAY_SIZE instead of sizeof/sizeof[0] audit: reduce scope of audit_log_fcaps audit: reduce scope of audit_net_id audit: arm64: Remove the audit arch argument to audit_syscall_entry arm64: audit: Add audit hook in syscall_trace_enter/exit() audit: x86: drop arch from __audit_syscall_entry() interface sparc: implement is_32bit_task sparc: properly conditionalize use of TIF_32BIT ...
2 parents 61ed53d + 2991dd2 commit ab074ad

File tree

43 files changed

+204
-180
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

43 files changed

+204
-180
lines changed

‎arch/alpha/include/asm/syscall.h

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
#ifndef _ASM_ALPHA_SYSCALL_H
2+
#define _ASM_ALPHA_SYSCALL_H
3+
4+
#include <uapi/linux/audit.h>
5+
6+
static inline int syscall_get_arch(void)
7+
{
8+
return AUDIT_ARCH_ALPHA;
9+
}
10+
11+
#endif /* _ASM_ALPHA_SYSCALL_H */

‎arch/alpha/kernel/ptrace.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -321,7 +321,7 @@ asmlinkage unsigned long syscall_trace_enter(void)
321321
if (test_thread_flag(TIF_SYSCALL_TRACE) &&
322322
tracehook_report_syscall_entry(current_pt_regs()))
323323
ret = -1UL;
324-
audit_syscall_entry(AUDIT_ARCH_ALPHA, regs->r0, regs->r16, regs->r17, regs->r18, regs->r19);
324+
audit_syscall_entry(regs->r0, regs->r16, regs->r17, regs->r18, regs->r19);
325325
return ret ?: current_pt_regs()->r0;
326326
}
327327

‎arch/arm/kernel/ptrace.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -949,8 +949,8 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs, int scno)
949949
if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
950950
trace_sys_enter(regs, scno);
951951

952-
audit_syscall_entry(AUDIT_ARCH_ARM, scno, regs->ARM_r0, regs->ARM_r1,
953-
regs->ARM_r2, regs->ARM_r3);
952+
audit_syscall_entry(scno, regs->ARM_r0, regs->ARM_r1, regs->ARM_r2,
953+
regs->ARM_r3);
954954

955955
return scno;
956956
}

‎arch/arm64/kernel/ptrace.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1120,8 +1120,8 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
11201120
if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
11211121
trace_sys_enter(regs, regs->syscallno);
11221122

1123-
audit_syscall_entry(syscall_get_arch(), regs->syscallno,
1124-
regs->orig_x0, regs->regs[1], regs->regs[2], regs->regs[3]);
1123+
audit_syscall_entry(regs->syscallno, regs->orig_x0, regs->regs[1],
1124+
regs->regs[2], regs->regs[3]);
11251125

11261126
return regs->syscallno;
11271127
}

‎arch/ia64/include/asm/syscall.h

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
#ifndef _ASM_SYSCALL_H
1414
#define _ASM_SYSCALL_H 1
1515

16+
#include <uapi/linux/audit.h>
1617
#include <linux/sched.h>
1718
#include <linux/err.h>
1819

@@ -79,4 +80,9 @@ static inline void syscall_set_arguments(struct task_struct *task,
7980

8081
ia64_syscall_get_set_arguments(task, regs, i, n, args, 1);
8182
}
83+
84+
static inline int syscall_get_arch(void)
85+
{
86+
return AUDIT_ARCH_IA64;
87+
}
8288
#endif /* _ASM_SYSCALL_H */

‎arch/ia64/kernel/ptrace.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1219,7 +1219,7 @@ syscall_trace_enter (long arg0, long arg1, long arg2, long arg3,
12191219
ia64_sync_krbs();
12201220

12211221

1222-
audit_syscall_entry(AUDIT_ARCH_IA64, regs.r15, arg0, arg1, arg2, arg3);
1222+
audit_syscall_entry(regs.r15, arg0, arg1, arg2, arg3);
12231223

12241224
return 0;
12251225
}

‎arch/microblaze/include/asm/syscall.h

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
#ifndef __ASM_MICROBLAZE_SYSCALL_H
22
#define __ASM_MICROBLAZE_SYSCALL_H
33

4+
#include <uapi/linux/audit.h>
45
#include <linux/kernel.h>
56
#include <linux/sched.h>
67
#include <asm/ptrace.h>
@@ -99,4 +100,8 @@ static inline void syscall_set_arguments(struct task_struct *task,
99100
asmlinkage long do_syscall_trace_enter(struct pt_regs *regs);
100101
asmlinkage void do_syscall_trace_leave(struct pt_regs *regs);
101102

103+
static inline int syscall_get_arch(void)
104+
{
105+
return AUDIT_ARCH_MICROBLAZE;
106+
}
102107
#endif /* __ASM_MICROBLAZE_SYSCALL_H */

‎arch/microblaze/kernel/ptrace.c

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -147,8 +147,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
147147
*/
148148
ret = -1L;
149149

150-
audit_syscall_entry(EM_MICROBLAZE, regs->r12, regs->r5, regs->r6,
151-
regs->r7, regs->r8);
150+
audit_syscall_entry(regs->r12, regs->r5, regs->r6, regs->r7, regs->r8);
152151

153152
return ret ?: regs->r12;
154153
}

‎arch/mips/include/asm/syscall.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -129,7 +129,7 @@ extern const unsigned long sysn32_call_table[];
129129

130130
static inline int syscall_get_arch(void)
131131
{
132-
int arch = EM_MIPS;
132+
int arch = AUDIT_ARCH_MIPS;
133133
#ifdef CONFIG_64BIT
134134
if (!test_thread_flag(TIF_32BIT_REGS)) {
135135
arch |= __AUDIT_ARCH_64BIT;

‎arch/mips/kernel/ptrace.c

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -780,9 +780,7 @@ asmlinkage long syscall_trace_enter(struct pt_regs *regs, long syscall)
780780
if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
781781
trace_sys_enter(regs, regs->regs[2]);
782782

783-
audit_syscall_entry(syscall_get_arch(),
784-
syscall,
785-
regs->regs[4], regs->regs[5],
783+
audit_syscall_entry(syscall, regs->regs[4], regs->regs[5],
786784
regs->regs[6], regs->regs[7]);
787785
return syscall;
788786
}

‎arch/openrisc/include/asm/syscall.h

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
#ifndef __ASM_OPENRISC_SYSCALL_H__
2020
#define __ASM_OPENRISC_SYSCALL_H__
2121

22+
#include <uapi/linux/audit.h>
2223
#include <linux/err.h>
2324
#include <linux/sched.h>
2425

@@ -71,4 +72,8 @@ syscall_set_arguments(struct task_struct *task, struct pt_regs *regs,
7172
memcpy(&regs->gpr[3 + i], args, n * sizeof(args[0]));
7273
}
7374

75+
static inline int syscall_get_arch(void)
76+
{
77+
return AUDIT_ARCH_OPENRISC;
78+
}
7479
#endif

‎arch/openrisc/include/uapi/asm/elf.h

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -55,9 +55,8 @@ typedef elf_greg_t elf_gregset_t[ELF_NGREG];
5555
/* A placeholder; OR32 does not have fp support yes, so no fp regs for now. */
5656
typedef unsigned long elf_fpregset_t;
5757

58-
/* This should be moved to include/linux/elf.h */
58+
/* EM_OPENRISC is defined in linux/elf-em.h */
5959
#define EM_OR32 0x8472
60-
#define EM_OPENRISC 92 /* OpenRISC 32-bit embedded processor */
6160

6261
/*
6362
* These are used to set parameters in the core dumps.

‎arch/openrisc/kernel/ptrace.c

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -187,8 +187,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
187187
*/
188188
ret = -1L;
189189

190-
audit_syscall_entry(AUDIT_ARCH_OPENRISC, regs->gpr[11],
191-
regs->gpr[3], regs->gpr[4],
190+
audit_syscall_entry(regs->gpr[11], regs->gpr[3], regs->gpr[4],
192191
regs->gpr[5], regs->gpr[6]);
193192

194193
return ret ? : regs->gpr[11];

‎arch/parisc/include/asm/syscall.h

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@
33
#ifndef _ASM_PARISC_SYSCALL_H_
44
#define _ASM_PARISC_SYSCALL_H_
55

6+
#include <uapi/linux/audit.h>
7+
#include <linux/compat.h>
68
#include <linux/err.h>
79
#include <asm/ptrace.h>
810

@@ -37,4 +39,13 @@ static inline void syscall_get_arguments(struct task_struct *tsk,
3739
}
3840
}
3941

42+
static inline int syscall_get_arch(void)
43+
{
44+
int arch = AUDIT_ARCH_PARISC;
45+
#ifdef CONFIG_64BIT
46+
if (!is_compat_task())
47+
arch = AUDIT_ARCH_PARISC64;
48+
#endif
49+
return arch;
50+
}
4051
#endif /*_ASM_PARISC_SYSCALL_H_*/

‎arch/parisc/kernel/ptrace.c

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -280,14 +280,11 @@ long do_syscall_trace_enter(struct pt_regs *regs)
280280

281281
#ifdef CONFIG_64BIT
282282
if (!is_compat_task())
283-
audit_syscall_entry(AUDIT_ARCH_PARISC64,
284-
regs->gr[20],
285-
regs->gr[26], regs->gr[25],
286-
regs->gr[24], regs->gr[23]);
283+
audit_syscall_entry(regs->gr[20], regs->gr[26], regs->gr[25],
284+
regs->gr[24], regs->gr[23]);
287285
else
288286
#endif
289-
audit_syscall_entry(AUDIT_ARCH_PARISC,
290-
regs->gr[20] & 0xffffffff,
287+
audit_syscall_entry(regs->gr[20] & 0xffffffff,
291288
regs->gr[26] & 0xffffffff,
292289
regs->gr[25] & 0xffffffff,
293290
regs->gr[24] & 0xffffffff,

‎arch/powerpc/include/asm/syscall.h

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,9 @@
1313
#ifndef _ASM_SYSCALL_H
1414
#define _ASM_SYSCALL_H 1
1515

16+
#include <uapi/linux/audit.h>
1617
#include <linux/sched.h>
18+
#include <linux/thread_info.h>
1719

1820
/* ftrace syscalls requires exporting the sys_call_table */
1921
#ifdef CONFIG_FTRACE_SYSCALLS
@@ -86,4 +88,8 @@ static inline void syscall_set_arguments(struct task_struct *task,
8688
memcpy(&regs->gpr[3 + i], args, n * sizeof(args[0]));
8789
}
8890

91+
static inline int syscall_get_arch(void)
92+
{
93+
return is_32bit_task() ? AUDIT_ARCH_PPC : AUDIT_ARCH_PPC64;
94+
}
8995
#endif /* _ASM_SYSCALL_H */

‎arch/powerpc/kernel/ptrace.c

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1788,14 +1788,11 @@ long do_syscall_trace_enter(struct pt_regs *regs)
17881788

17891789
#ifdef CONFIG_PPC64
17901790
if (!is_32bit_task())
1791-
audit_syscall_entry(AUDIT_ARCH_PPC64,
1792-
regs->gpr[0],
1793-
regs->gpr[3], regs->gpr[4],
1791+
audit_syscall_entry(regs->gpr[0], regs->gpr[3], regs->gpr[4],
17941792
regs->gpr[5], regs->gpr[6]);
17951793
else
17961794
#endif
1797-
audit_syscall_entry(AUDIT_ARCH_PPC,
1798-
regs->gpr[0],
1795+
audit_syscall_entry(regs->gpr[0],
17991796
regs->gpr[3] & 0xffffffff,
18001797
regs->gpr[4] & 0xffffffff,
18011798
regs->gpr[5] & 0xffffffff,

‎arch/s390/kernel/ptrace.c

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -834,9 +834,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
834834
if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
835835
trace_sys_enter(regs, regs->gprs[2]);
836836

837-
audit_syscall_entry(is_compat_task() ?
838-
AUDIT_ARCH_S390 : AUDIT_ARCH_S390X,
839-
regs->gprs[2], regs->orig_gpr2,
837+
audit_syscall_entry(regs->gprs[2], regs->orig_gpr2,
840838
regs->gprs[3], regs->gprs[4],
841839
regs->gprs[5]);
842840
out:

‎arch/sh/include/asm/syscall_32.h

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
#ifndef __ASM_SH_SYSCALL_32_H
22
#define __ASM_SH_SYSCALL_32_H
33

4+
#include <uapi/linux/audit.h>
45
#include <linux/kernel.h>
56
#include <linux/sched.h>
67
#include <linux/err.h>
@@ -93,4 +94,13 @@ static inline void syscall_set_arguments(struct task_struct *task,
9394
}
9495
}
9596

97+
static inline int syscall_get_arch(void)
98+
{
99+
int arch = AUDIT_ARCH_SH;
100+
101+
#ifdef CONFIG_CPU_LITTLE_ENDIAN
102+
arch |= __AUDIT_ARCH_LE;
103+
#endif
104+
return arch;
105+
}
96106
#endif /* __ASM_SH_SYSCALL_32_H */

‎arch/sh/include/asm/syscall_64.h

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
#ifndef __ASM_SH_SYSCALL_64_H
22
#define __ASM_SH_SYSCALL_64_H
33

4+
#include <uapi/linux/audit.h>
45
#include <linux/kernel.h>
56
#include <linux/sched.h>
67
#include <asm/ptrace.h>
@@ -61,4 +62,17 @@ static inline void syscall_set_arguments(struct task_struct *task,
6162
memcpy(&regs->regs[2 + i], args, n * sizeof(args[0]));
6263
}
6364

65+
static inline int syscall_get_arch(void)
66+
{
67+
int arch = AUDIT_ARCH_SH;
68+
69+
#ifdef CONFIG_64BIT
70+
arch |= __AUDIT_ARCH_64BIT;
71+
#endif
72+
#ifdef CONFIG_CPU_LITTLE_ENDIAN
73+
arch |= __AUDIT_ARCH_LE;
74+
#endif
75+
76+
return arch;
77+
}
6478
#endif /* __ASM_SH_SYSCALL_64_H */

‎arch/sh/kernel/ptrace_32.c

Lines changed: 1 addition & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -484,17 +484,6 @@ long arch_ptrace(struct task_struct *child, long request,
484484
return ret;
485485
}
486486

487-
static inline int audit_arch(void)
488-
{
489-
int arch = EM_SH;
490-
491-
#ifdef CONFIG_CPU_LITTLE_ENDIAN
492-
arch |= __AUDIT_ARCH_LE;
493-
#endif
494-
495-
return arch;
496-
}
497-
498487
asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
499488
{
500489
long ret = 0;
@@ -513,8 +502,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
513502
if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
514503
trace_sys_enter(regs, regs->regs[0]);
515504

516-
audit_syscall_entry(audit_arch(), regs->regs[3],
517-
regs->regs[4], regs->regs[5],
505+
audit_syscall_entry(regs->regs[3], regs->regs[4], regs->regs[5],
518506
regs->regs[6], regs->regs[7]);
519507

520508
return ret ?: regs->regs[0];

‎arch/sh/kernel/ptrace_64.c

Lines changed: 1 addition & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -504,20 +504,6 @@ asmlinkage int sh64_ptrace(long request, long pid,
504504
return sys_ptrace(request, pid, addr, data);
505505
}
506506

507-
static inline int audit_arch(void)
508-
{
509-
int arch = EM_SH;
510-
511-
#ifdef CONFIG_64BIT
512-
arch |= __AUDIT_ARCH_64BIT;
513-
#endif
514-
#ifdef CONFIG_CPU_LITTLE_ENDIAN
515-
arch |= __AUDIT_ARCH_LE;
516-
#endif
517-
518-
return arch;
519-
}
520-
521507
asmlinkage long long do_syscall_trace_enter(struct pt_regs *regs)
522508
{
523509
long long ret = 0;
@@ -536,8 +522,7 @@ asmlinkage long long do_syscall_trace_enter(struct pt_regs *regs)
536522
if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
537523
trace_sys_enter(regs, regs->regs[9]);
538524

539-
audit_syscall_entry(audit_arch(), regs->regs[1],
540-
regs->regs[2], regs->regs[3],
525+
audit_syscall_entry(regs->regs[1], regs->regs[2], regs->regs[3],
541526
regs->regs[4], regs->regs[5]);
542527

543528
return ret ?: regs->regs[9];

‎arch/sparc/include/asm/syscall.h

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
#ifndef __ASM_SPARC_SYSCALL_H
22
#define __ASM_SPARC_SYSCALL_H
33

4+
#include <uapi/linux/audit.h>
45
#include <linux/kernel.h>
56
#include <linux/sched.h>
67
#include <asm/ptrace.h>
8+
#include <asm/thread_info.h>
79

810
/*
911
* The syscall table always contains 32 bit pointers since we know that the
@@ -124,4 +126,9 @@ static inline void syscall_set_arguments(struct task_struct *task,
124126
regs->u_regs[UREG_I0 + i + j] = args[j];
125127
}
126128

129+
static inline int syscall_get_arch(void)
130+
{
131+
return is_32bit_task() ? AUDIT_ARCH_SPARC : AUDIT_ARCH_SPARC64;
132+
}
133+
127134
#endif /* __ASM_SPARC_SYSCALL_H */

‎arch/sparc/include/asm/thread_info_32.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -130,6 +130,8 @@ register struct thread_info *current_thread_info_reg asm("g6");
130130
#define _TIF_DO_NOTIFY_RESUME_MASK (_TIF_NOTIFY_RESUME | \
131131
_TIF_SIGPENDING)
132132

133+
#define is_32bit_task() (1)
134+
133135
#endif /* __KERNEL__ */
134136

135137
#endif /* _ASM_THREAD_INFO_H */

‎arch/sparc/include/asm/thread_info_64.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -221,6 +221,8 @@ register struct thread_info *current_thread_info_reg asm("g6");
221221
_TIF_NEED_RESCHED)
222222
#define _TIF_DO_NOTIFY_RESUME_MASK (_TIF_NOTIFY_RESUME | _TIF_SIGPENDING)
223223

224+
#define is_32bit_task() (test_thread_flag(TIF_32BIT))
225+
224226
/*
225227
* Thread-synchronous status.
226228
*

0 commit comments

Comments
 (0)