lkml.org 
[lkml]   [2014]   [Feb]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH v4 0/3] arm64: Add audit support
On 14/02/07, AKASHI Takahiro wrote:
> This patchset adds system call audit support on arm64.
> Both 32-bit (AUDIT_ARCH_ARM) and 64-bit tasks (AUDIT_ARCH_AARCH64)
> are supported. Since arm64 has the exact same set of system calls
> on LE and BE, we don't care about endianness (or more specifically
> __AUDIT_ARCH_64BIT bit in AUDIT_ARCH_*).
>
> There are some prerequisites for this patch to work correctly:
> * "generic compat system call audit support" patch
> * "correct a type mismatch in audit_syscall_exit()" patch
> (already accepted and queued in 3.14)
> * "Modify a set of system calls in audit class" patch
> (already accepted and queued in 3.14)
> * "__NR_* definitions for compat syscalls" patch from Catalin
> * "make a single hook to syscall_trace() for all syscall features" patch
> * userspace audit tool (v2.3.2 + my patch for arm64)
>
> Please review them as well for better understandings.
>
> This code was tested on both 32-bit and 64-bit LE userland
> in the following two ways:
> 1) basic operations with auditctl/autrace
> # auditctl -a exit,always -S openat -F path=/etc/inittab
> # auditctl -a exit,always -F dir=/tmp -F perm=rw
> # auditctl -a task,always
> # autrace /bin/ls
> by comparing output from autrace with one from strace
>
> 2) audit-test-code (+ my workarounds for arm/arm64)
> by running "audit-tool", "filter" and "syscalls" test categories.
>
> Changes v1 -> v2:
> * Modified to utilize "generic compat system call audit" [3/6, 4/6, 5/6]
> Please note that a required header, unistd_32.h, is automatically
> generated from unistd32.h.
> * Refer to regs->orig_x0 instead of regs->x0 as the first argument of
> system call in audit_syscall_entry() [6/6]
> * Include "Add regs_return_value() in syscall.h" patch [2/6],
> which was not intentionally included in v1 because it could be added
> by "kprobes support".
>
> Changes v2 -> v3:
> * Remove asm/audit.h.
> See "generic compat syscall audit support" patch v4
> * Remove endianness dependency, ie. AUDIT_ARCH_ARMEB/AARCH64EB.
> * Remove kernel/syscalls/Makefile which was used to create unistd32.h.
> See Catalin's "Add __NR_* definitions for compat syscalls" patch
>
> Changes v3 -> v4:
> * Modified to sync with the patch, "make a single hook to syscall_trace()
> for all syscall features"
>
>
> AKASHI Takahiro (3):
> arm64: Add regs_return_value() in syscall.h
> arm64: Add audit support
> arm64: audit: Add audit hook in ptrace/syscall_trace
>
> arch/arm64/Kconfig | 1 +
> arch/arm64/include/asm/ptrace.h | 5 +++++
> arch/arm64/include/asm/syscall.h | 15 +++++++++++++++
> arch/arm64/kernel/ptrace.c | 7 +++++++
> include/uapi/linux/audit.h | 1 +
> 5 files changed, 29 insertions(+)

Compile and regression tested on: ppc s390 x86_64 ppc64 i686 s390x.

Acked-by: Richard Guy Briggs <rgb@redhat.com>

> --
> 1.7.9.5
>
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit

- RGB

--
Richard Guy Briggs <rbriggs@redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545


\
 
 \ /
  Last update: 2014-02-11 16:01    [W:0.279 / U:0.528 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site