lkml.org 
[lkml]   [2007]   [Nov]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [patch] audit support for SH
Date
On Wednesday 07 November 2007 12:04:46 am Yuichi Nakamura wrote:
> I found syscall audit does not work on SH(SuperH).
> I made patch to support syscall audit for SH.

I think this is close, but it looks like you missed the syscall classification
piece. You can find an example here:

arch/x86_64/kernel/audit.c

Its used for determining which syscalls we are interested in for watches.

Also, IBM and HP both have released audit test suites. You should run the CAPP
tests at a minimum to see if you have hooked everything that is expected. If
you have SE Linux enabled for that platform, you may want to try the LSPP
tests but you would need have the MLS policy installed.

IBM's announcement is here:

https://www.redhat.com/archives/redhat-lspp/2007-August/msg00002.html

and HP's here:

https://www.redhat.com/archives/linux-audit/2007-August/msg00030.html

And...user space would need an update for the syscall table and arches so that
you can run the tests. Please send that patch to linux-audit mail list.

Thanks,
-Steve
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2007-11-07 16:19    [W:0.051 / U:0.460 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site