On 03/15/2014 01:49 AM, AKASHI Takahiro wrote:
(Please apply this patch after my ftrace patch to resolve some conflict
on arm64/kernel/ptrace.c, functionally it doesn't depend on ftrace though)

This patchset adds system call audit support on arm64.
Both 32-bit (AUDIT_ARCH_ARM) and 64-bit tasks (AUDIT_ARCH_AARCH64)
are supported. Since arm64 has the exact same set of system calls
on LE and BE, we don't care about endianness (or more specifically
__AUDIT_ARCH_64BIT bit in AUDIT_ARCH_*).

There are some prerequisites for this patch to work correctly:
* "audit: Add CONFIG_HAVE_ARCH_AUDITSYSCALL" patch
* "audit: generic compat system call audit support" patch
* "arm64: __NR_* definitions for compat syscalls" patch from Catalin
* "arm64: make a single hook to syscall_trace() for all syscall features" patch
* "arm64: split syscall_trace() into separate functions for enter/exit" patch
* "arm64: Add regs_return_value() in syscall.h" patch
* "arm64: is_compat_task is defined both in asm/compat.h and
    linux/compat.h" patch
* userspace audit tool (v2.3.2 + my patch for arm64)

and the 2/2 patch won't apply to arch/arm64/kernel/ptrace.c
without the patch from  [PATCH v7 7/7] arm64: ftrace: Add system call 
tracepoint;
My question: do you need all 7 patches from arm64: Add ftrace support
as well for this audit patch to work, or just this 7/7 patch ?


Please review them as well for better understandings.

This code was tested on both 32-bit and 64-bit LE userland
in the following two ways:
1) basic operations with auditctl/autrace
   # auditctl -a exit,always -S openat -F path=/etc/inittab
   # auditctl -a exit,always -F dir=/tmp -F perm=rw
   # auditctl -a task,always
   # autrace /bin/ls
     by comparing output from autrace with one from strace

2) audit-test-code (+ my workarounds for arm/arm64)
   by running "audit-tool", "filter" and "syscalls" test categories.

Changes v7 -> v8:
* aligned with the change in "audit: generic compat system call audit
   support" v5 [1/2]
* aligned with the change in "arm64: split syscall_trace() into separate
   functions for enter/exit" v5 [2/2]

Changes v6 -> v7:
* changed an include file in syscall.h from <linux/audit.h> to
   <uapi/linux/audit.h> [1/2]
* aligned with the patch, "arm64: split syscall_trace() into separate
   functions for enter/exit" [2/2]

Changes v5 -> v6:
* removed and put "arm64: Add regs_return_value() in syscall.h" patch into
   a separate set
* aligned with the change in "arm64: make a single hook to syscall_trace()
   for all syscall features" v3 [1/2]

Changes v4 -> v5:
* rebased to 3.14-rcX
* added a guard against TIF_SYSCALL_AUDIT [3/3]
* aligned with the change in "arm64: make a single hook to syscall_trace()
   for all syscall features" v2 [3/3]

Changes v3 -> v4:
* Modified to sync with the patch, "make a single hook to syscall_trace()
   for all syscall features"
* aligned with "audit: Add CONFIG_HAVE_ARCH_AUDITSYSCALL" patch

Changes v2 -> v3:
* Remove asm/audit.h.
   See "generic compat syscall audit support" patch v4
* Remove endianness dependency, ie. AUDIT_ARCH_ARMEB/AARCH64EB.
* Remove kernel/syscalls/Makefile which was used to create unistd32.h.
   See Catalin's "Add __NR_* definitions for compat syscalls" patch

Changes v1 -> v2:
* Modified to utilize "generic compat system call audit" [3/6, 4/6, 5/6]
   Please note that a required header, unistd_32.h, is automatically
   generated from unistd32.h.
* Refer to regs->orig_x0 instead of regs->x0 as the first argument of
   system call in audit_syscall_entry() [6/6]
* Include "Add regs_return_value() in syscall.h" patch [2/6],
   which was not intentionally included in v1 because it could be added
   by "kprobes support".

AKASHI Takahiro (2):
   arm64: Add audit support
   arm64: audit: Add audit hook in syscall_trace_enter/exit()

  arch/arm64/Kconfig               |  2 ++
  arch/arm64/include/asm/syscall.h | 15 +++++++++++++++
  arch/arm64/kernel/ptrace.c       |  7 +++++++
  include/uapi/linux/audit.h       |  1 +
  4 files changed, 25 insertions(+)


--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit

Reply via email to