audit: add ppc64 mach support

PATCH Applied Tony Jones 4 participants 10 messages Aug 29, 2014 – Dec 2, 2014

Subsystems (4)

PowerPC Library code ptrace support Audit

lore

Share & tools

lore

Tony Jones

author

2014-08-29 20:16 UTC #0 lore raw

PATCH 1/1 audit: add ppc64 mach support

Add support for ppc64le.

$ uname -a
Linux cabernet 3.12.26-3-default #1 SMP Mon Aug 18 15:07:30 UTC 2014 (d318f3a) ppc64le ppc64le ppc64le GNU/Linux

Without this, perf trace and auditctl fail. There is no 32 bit (ppcle).

Signed-off-by Tony Jones <[email protected]>

---

lib/libaudit.c +5 -0

Index: trunk/lib/libaudit.c
===================================================================
@@ -1195,6 +1195,11 @@
 				return -6;
 			break;
 #endif
+		case MACH_PPC64LE:
+			if (bits != __AUDIT_ARCH_64BIT)
+				return -6;
+			break;
+
 		case MACH_86_64: /* fallthrough */
 		case MACH_PPC64: /* fallthrough */
 		case MACH_S390X: /* fallthrough */

lib/libaudit.h +5 -1

Index: trunk/lib/libaudit.h
===================================================================
@@ -356,6 +356,9 @@
 #define AUDIT_ARCH_AARCH64	(EM_AARCH64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
 #endif
 
+#ifndef AUDIT_ARCH_PPC64LE
+#define AUDIT_ARCH_PPC64LE	(EM_PPC64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
+#endif
 
 //////////////////////////////////////////////////////
 // This is an external ABI. Any changes in here will

@@ -438,7 +441,8 @@
 	MACH_S390,
 	MACH_ALPHA,
 	MACH_ARM,
-	MACH_AARCH64
+	MACH_AARCH64,
+	MACH_PPC64LE
 } machine_t;
 
 /* These are the valid audit failure tunable enum values */

lib/lookup_table.c +3 -0

Index: trunk/lib/lookup_table.c
===================================================================
@@ -70,6 +70,7 @@
     { MACH_86_64,   AUDIT_ARCH_X86_64 },
     { MACH_IA64,    AUDIT_ARCH_IA64   },
     { MACH_PPC64,   AUDIT_ARCH_PPC64  },
+    { MACH_PPC64LE, AUDIT_ARCH_PPC64LE},
     { MACH_PPC,     AUDIT_ARCH_PPC    },
     { MACH_S390X,   AUDIT_ARCH_S390X  },
     { MACH_S390,    AUDIT_ARCH_S390   },

@@ -123,6 +124,7 @@
 			found = ia64_syscall_s2i(sc, &res);
 			break;
 		case MACH_PPC64:
+		case MACH_PPC64LE:
 		case MACH_PPC:
 			found = ppc_syscall_s2i(sc, &res);
 			break;

@@ -169,6 +171,7 @@
 		case MACH_IA64:
 			return ia64_syscall_i2s(sc);
 		case MACH_PPC64:
+		case MACH_PPC64LE:
 		case MACH_PPC:
 			return ppc_syscall_i2s(sc);
 		case MACH_S390X:

lib/machinetab.h +1 -0

Index: trunk/lib/machinetab.h
===================================================================
@@ -27,6 +27,7 @@
 _S(MACH_86_64,   "x86_64" )
 _S(MACH_IA64,    "ia64"   )
 _S(MACH_PPC64,   "ppc64"  )
+_S(MACH_PPC64LE, "ppc64le")
 _S(MACH_PPC,     "ppc"    )
 _S(MACH_S390X,   "s390x"  )
 _S(MACH_S390,    "s390"   )

Tony Jones

author

2014-08-29 20:24 UTC #1 lore raw

Sorry, typo in the Subject:

Should have been "[PATCH] audit: add ppc64le mach support"

Steve Grubb

Applied

2014-09-02 15:20 UTC #2 lore raw

In reply to Tony Jones

Quoted 10 lines · Tony Jones

Add support for ppc64le.
$ uname -a
Linux cabernet 3.12.26-3-default #1 SMP Mon Aug 18 15:07:30 UTC 2014
(d318f3a) ppc64le ppc64le ppc64le GNU/Linux
Without this, perf trace and auditctl fail. There is no 32 bit (ppcle).
Signed-off-by Tony Jones <[email protected]>
---

Thanks! Applied in commit 1013.

-Steve

Steve Grubb

2014-12-01 22:09 UTC #3 lore raw

In reply to Tony Jones

Hi Tony,

Quoted 32 lines · Tony Jones

Add support for ppc64le.
$ uname -a
Linux cabernet 3.12.26-3-default #1 SMP Mon Aug 18 15:07:30 UTC 2014
(d318f3a) ppc64le ppc64le ppc64le GNU/Linux
Without this, perf trace and auditctl fail. There is no 32 bit (ppcle).
Signed-off-by Tony Jones <[email protected]>
---
Index: trunk/lib/libaudit.c
===================================================================
lib/libaudit.c +5 -0
@@ -1195,6 +1195,11 @@
 				return -6;
 			break;
 #endif
+		case MACH_PPC64LE:
+			if (bits != __AUDIT_ARCH_64BIT)
+				return -6;
+			break;
+
 		case MACH_86_64: /* fallthrough */
 		case MACH_PPC64: /* fallthrough */
 		case MACH_S390X: /* fallthrough */
Index: trunk/lib/libaudit.h
===================================================================

lib/libaudit.h line 356

Quoted 1 line

lib/libaudit.h +0 -0

@@ -356,6 +356,9 @@
 #define AUDIT_ARCH_AARCH64	(EM_AARCH64|__AUDIT_ARCH_64BIT|

__AUDIT_ARCH_LE)

lib/libaudit.h line 361

Quoted 5 lines

lib/libaudit.h +3 -0

 #endif
 
+#ifndef AUDIT_ARCH_PPC64LE
+#define AUDIT_ARCH_PPC64LE	(EM_PPC64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
+#endif

Is this ^^^ define upstream or in some public branch?

-Steve

Tony Jones

author

2014-12-01 23:58 UTC #4 lore raw

Quoted 39 lines · Steve Grubb

Hi Tony,
Quoted 32 lines · Tony Jones
Add support for ppc64le.
$ uname -a
Linux cabernet 3.12.26-3-default #1 SMP Mon Aug 18 15:07:30 UTC 2014
(d318f3a) ppc64le ppc64le ppc64le GNU/Linux
Without this, perf trace and auditctl fail. There is no 32 bit (ppcle).
Signed-off-by Tony Jones <[email protected]>
---
Index: trunk/lib/libaudit.c
===================================================================
lib/libaudit.c +5 -0
@@ -1195,6 +1195,11 @@
 				return -6;
 			break;
 #endif
+		case MACH_PPC64LE:
+			if (bits != __AUDIT_ARCH_64BIT)
+				return -6;
+			break;
+
 		case MACH_86_64: /* fallthrough */
 		case MACH_PPC64: /* fallthrough */
 		case MACH_S390X: /* fallthrough */
Index: trunk/lib/libaudit.h
===================================================================
lib/libaudit.h line 356
Quoted 1 line
lib/libaudit.h +0 -0
@@ -356,6 +356,9 @@
 #define AUDIT_ARCH_AARCH64	(EM_AARCH64|__AUDIT_ARCH_64BIT|
__AUDIT_ARCH_LE)
Quoted 2 lines
lib/libaudit.h +0 -0
 #endif
 

Quoted 7 lines

lib/libaudit.h line 361
Quoted 3 lines
lib/libaudit.h +3 -0
+#ifndef AUDIT_ARCH_PPC64LE
+#define AUDIT_ARCH_PPC64LE	(EM_PPC64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
+#endif
Is this ^^^ define upstream or in some public branch?
-Steve

Mainline kernel reports ppc64le (per a0588015deab1844261b27a67ae6f5b910fe2830) but there is no matching AUDIT_ARCH_PPC64LE. Eric just pinged me on irc about it. Fix to add it to include/uapi/linux/audit.h shoudld probably go upstream.

Paul Moore

maintainer

2014-12-02 20:18 UTC #5 lore raw

Quoted 4 lines · Tony Jones

Mainline kernel reports ppc64le (per a0588015deab1844261b27a67ae6f5b910fe2830) but there is no matching
AUDIT_ARCH_PPC64LE. Eric just pinged me on irc about it. Fix to add it
to include/uapi/linux/audit.h shoudld probably go upstream.

Untested, uncompiled too, but beyond the patch below, is there anything else we would need in the kernel to enable proper ppc64le support?

commit 853ff573b5e5d9d09d1dff579a4a8d6fe8ca698c

Author: Paul Moore <[email protected]>
Date:   Tue Dec 2 14:50:28 2014 -0500

audit: add basic support for PPC64LE

Signed-off-by Paul Moore <[email protected]>

(quoted diff) +0 -0

b/arch/powerpc/include/asm/syscall.h
index b54b2ad..b9d65c3 100644

arch/powerpc/include/asm/syscall.h +0 -0

@@ -86,4 +86,16 @@ static inline void syscall_set_arguments(struct task_struct

*task,
memcpy(&regs->gpr[3 + i], args, n * sizeof(args[0]));
}

+static inline int syscall_get_arch(void)
+{
+#ifdef CONFIG_PPC64
+#ifdef __LITTLE_ENDIAN__
+ return AUDIT_ARCH_PPC64LE;
+#else
+ return AUDIT_ARCH_PPC64;
+#endif /* __LITTLE_ENDIAN__ */
+#endif /* CONFIG_PPC64 */
+ return AUDIT_ARCH_PPC;
+}
+
#endif /* _ASM_SYSCALL_H */

arch/powerpc/kernel/ptrace.c +2 -2

index 2e3d2bf..6797a83 100644
@@ -1788,13 +1788,13 @@ long do_syscall_trace_enter(struct pt_regs *regs)
 
 #ifdef CONFIG_PPC64
 	if (!is_32bit_task())
-		audit_syscall_entry(AUDIT_ARCH_PPC64,
+		audit_syscall_entry(syscall_get_arch(),
 				    regs->gpr[0],
 				    regs->gpr[3], regs->gpr[4],
 				    regs->gpr[5], regs->gpr[6]);
 	else
 #endif
-		audit_syscall_entry(AUDIT_ARCH_PPC,
+		audit_syscall_entry(syscall_get_arch(),
 				    regs->gpr[0],
 				    regs->gpr[3] & 0xffffffff,
 				    regs->gpr[4] & 0xffffffff,

include/uapi/linux/audit.h +1 -0

index cf67147..c3997f4 100644
@@ -364,6 +364,7 @@ enum {
 #define AUDIT_ARCH_PARISC64	(EM_PARISC|__AUDIT_ARCH_64BIT)
 #define AUDIT_ARCH_PPC		(EM_PPC)
 #define AUDIT_ARCH_PPC64	(EM_PPC64|__AUDIT_ARCH_64BIT)
+#define AUDIT_ARCH_PPC64LE	(EM_PPC64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
 #define AUDIT_ARCH_S390		(EM_S390)
 #define AUDIT_ARCH_S390X	(EM_S390|__AUDIT_ARCH_64BIT)
 #define AUDIT_ARCH_SH		(EM_SH)

Signature · 2 lines

paul moore
www.paul-moore.com

Steve Grubb

2014-12-02 20:29 UTC #6 lore raw

Quoted 8 lines · Paul Moore

Quoted 4 lines · Tony Jones
Mainline kernel reports ppc64le (per a0588015deab1844261b27a67ae6f5b910fe2830) but there is no matching
AUDIT_ARCH_PPC64LE. Eric just pinged me on irc about it. Fix to add it
to include/uapi/linux/audit.h shoudld probably go upstream.
Untested, uncompiled too, but beyond the patch below, is there anything else we would need in the kernel to enable proper ppc64le support?

The only question I have is whether or not PPC LE is just 64 bit or if it has a 32 bit ABI also. The uname patch referenced above seems to show a ppcle and ppc64le return. The original patch accepted was only for 64 bit ABI.

Thanks,
-Steve

Quoted 63 lines

commit 853ff573b5e5d9d09d1dff579a4a8d6fe8ca698c

Author: Paul Moore <[email protected]>
Date:   Tue Dec 2 14:50:28 2014 -0500

audit: add basic support for PPC64LE

Signed-off-by Paul Moore <[email protected]>

arch/powerpc/include/asm/syscall.h +12 -0

index b54b2ad..b9d65c3 100644
@@ -86,4 +86,16 @@ static inline void syscall_set_arguments(struct
 task_struct *task,
 	memcpy(&regs->gpr[3 + i], args, n * sizeof(args[0]));
 }
 
+static inline int syscall_get_arch(void)
+{
+#ifdef CONFIG_PPC64
+#ifdef __LITTLE_ENDIAN__
+	return AUDIT_ARCH_PPC64LE;
+#else
+	return AUDIT_ARCH_PPC64;
+#endif /* __LITTLE_ENDIAN__ */
+#endif /* CONFIG_PPC64 */
+	return AUDIT_ARCH_PPC;
+}
+

#endif /* _ASM_SYSCALL_H */

arch/powerpc/kernel/ptrace.c +2 -2

index 2e3d2bf..6797a83 100644
@@ -1788,13 +1788,13 @@ long do_syscall_trace_enter(struct pt_regs *regs)
 
 #ifdef CONFIG_PPC64
 	if (!is_32bit_task())
-		audit_syscall_entry(AUDIT_ARCH_PPC64,
+		audit_syscall_entry(syscall_get_arch(),
 				    regs->gpr[0],
 				    regs->gpr[3], regs->gpr[4],
 				    regs->gpr[5], regs->gpr[6]);
 	else
 #endif
-		audit_syscall_entry(AUDIT_ARCH_PPC,
+		audit_syscall_entry(syscall_get_arch(),
 				    regs->gpr[0],
 				    regs->gpr[3] & 0xffffffff,
 				    regs->gpr[4] & 0xffffffff,

include/uapi/linux/audit.h +1 -0

index cf67147..c3997f4 100644
@@ -364,6 +364,7 @@ enum {
 #define AUDIT_ARCH_PARISC64	(EM_PARISC|__AUDIT_ARCH_64BIT)
 #define AUDIT_ARCH_PPC		(EM_PPC)
 #define AUDIT_ARCH_PPC64	(EM_PPC64|__AUDIT_ARCH_64BIT)
+#define AUDIT_ARCH_PPC64LE	(EM_PPC64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
 #define AUDIT_ARCH_S390		(EM_S390)
 #define AUDIT_ARCH_S390X	(EM_S390|__AUDIT_ARCH_64BIT)
 #define AUDIT_ARCH_SH		(EM_SH)

Tony Jones

author

2014-12-02 21:27 UTC #7 lore raw

Quoted 10 lines · Steve Grubb

Quoted 8 lines · Paul Moore
Quoted 4 lines · Tony Jones
Mainline kernel reports ppc64le (per a0588015deab1844261b27a67ae6f5b910fe2830) but there is no matching
AUDIT_ARCH_PPC64LE. Eric just pinged me on irc about it. Fix to add it
to include/uapi/linux/audit.h shoudld probably go upstream.
Untested, uncompiled too, but beyond the patch below, is there anything else we would need in the kernel to enable proper ppc64le support?

Quoted 6 lines

The only question I have is whether or not PPC LE is just 64 bit or if it has a 32 bit ABI also. The uname patch referenced above seems to show a ppcle and ppc64le return. The original patch accepted was only for 64 bit ABI.
Thanks,
-Steve

Hmmn, initially when I ran into the problem it was due to perf trace (which uses the audit libs) failing. I didn't notice any other kernel issues, I'll have to look closer (wrt Pauls patch). As far as 32bit,
I was told by our IBM liason that LE is 64 bit only.

Tony

Richard Guy Briggs

2014-12-02 21:27 UTC #8 lore raw

In reply to Paul Moore

Quoted 8 lines · Paul Moore

Quoted 4 lines · Tony Jones
Mainline kernel reports ppc64le (per a0588015deab1844261b27a67ae6f5b910fe2830) but there is no matching
AUDIT_ARCH_PPC64LE. Eric just pinged me on irc about it. Fix to add it
to include/uapi/linux/audit.h shoudld probably go upstream.
Untested, uncompiled too, but beyond the patch below, is there anything else we would need in the kernel to enable proper ppc64le support?

Which kernel are you using? syscall_get_arch() already exists on powerpc. audit_syscall_entry() lost its first argument recently...

What if it is in compatibility mode?

Quoted 72 lines

commit 853ff573b5e5d9d09d1dff579a4a8d6fe8ca698c

Author: Paul Moore <[email protected]>
Date:   Tue Dec 2 14:50:28 2014 -0500

audit: add basic support for PPC64LE

Signed-off-by Paul Moore <[email protected]>

arch/powerpc/include/asm/syscall.h +12 -0

index b54b2ad..b9d65c3 100644
@@ -86,4 +86,16 @@ static inline void syscall_set_arguments(struct task_struct 
 *task,
 	memcpy(&regs->gpr[3 + i], args, n * sizeof(args[0]));
 }
 
+static inline int syscall_get_arch(void)
+{
+#ifdef CONFIG_PPC64
+#ifdef __LITTLE_ENDIAN__
+	return AUDIT_ARCH_PPC64LE;
+#else
+	return AUDIT_ARCH_PPC64;
+#endif /* __LITTLE_ENDIAN__ */
+#endif /* CONFIG_PPC64 */
+	return AUDIT_ARCH_PPC;
+}
+

#endif /* _ASM_SYSCALL_H */

arch/powerpc/kernel/ptrace.c +2 -2

index 2e3d2bf..6797a83 100644
@@ -1788,13 +1788,13 @@ long do_syscall_trace_enter(struct pt_regs *regs)
 
 #ifdef CONFIG_PPC64
 	if (!is_32bit_task())
-		audit_syscall_entry(AUDIT_ARCH_PPC64,
+		audit_syscall_entry(syscall_get_arch(),
 				    regs->gpr[0],
 				    regs->gpr[3], regs->gpr[4],
 				    regs->gpr[5], regs->gpr[6]);
 	else
 #endif
-		audit_syscall_entry(AUDIT_ARCH_PPC,
+		audit_syscall_entry(syscall_get_arch(),
 				    regs->gpr[0],
 				    regs->gpr[3] & 0xffffffff,
 				    regs->gpr[4] & 0xffffffff,

include/uapi/linux/audit.h +1 -0

index cf67147..c3997f4 100644
@@ -364,6 +364,7 @@ enum {
 #define AUDIT_ARCH_PARISC64	(EM_PARISC|__AUDIT_ARCH_64BIT)
 #define AUDIT_ARCH_PPC		(EM_PPC)
 #define AUDIT_ARCH_PPC64	(EM_PPC64|__AUDIT_ARCH_64BIT)
+#define AUDIT_ARCH_PPC64LE	(EM_PPC64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
 #define AUDIT_ARCH_S390		(EM_S390)
 #define AUDIT_ARCH_S390X	(EM_S390|__AUDIT_ARCH_64BIT)
 #define AUDIT_ARCH_SH		(EM_SH)

Signature · 8 lines

-- 
paul moore
www.paul-moore.com

--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit

- RGB

--
Richard Guy Briggs <[email protected]>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545

Paul Moore

maintainer

2014-12-02 23:19 UTC #9 lore raw

Quoted 8 lines · Richard Guy Briggs

Quoted 7 lines · Paul Moore
Quoted 5 lines · Tony Jones
Mainline kernel reports ppc64le (per a0588015deab1844261b27a67ae6f5b910fe2830) but there is no matching
AUDIT_ARCH_PPC64LE. Eric just pinged me on irc about it. Fix to add
it
to include/uapi/linux/audit.h shoudld probably go upstream.

Quoted 5 lines

Quoted 2 lines
Untested, uncompiled too, but beyond the patch below, is there anything else we would need in the kernel to enable proper ppc64le support?
Which kernel are you using? syscall_get_arch() already exists on powerpc. audit_syscall_entry() lost its first argument recently...

That patch was on top of the linux-audit tree, it's based on v3.16 so I imagine there have been some changes upstream over the past few months.

Quoted 1 line

What if it is in compatibility mode?

/me shrugs ... that's why I posted it asking for feedback ;) I just wanted to get the ball rolling on a fix.

Signature · 2 lines

paul moore
www.paul-moore.com