x86: audit syscalls based on type of syscall not type of binary

PATCH New Michael Davidson 1 participant 1 message Aug 7, 2008

Subsystems (2)

x86 ptrace support

lore

Share & tools

lore

Michael Davidson

author

2008-08-07 18:15 UTC #0 lore raw

PATCH 1/1 x86: audit syscalls based on type of syscall not type of binary

Fix syscall auditing to audit based on the actual type of system call that was made, not the type of binary that made it.

Signed-off-by Michael Davidson <[email protected]>

---

arch/x86/kernel/ptrace.c +1 -1

Index: linux-2.6.26.2/arch/x86/kernel/ptrace.c
===================================================================
@@ -1491,7 +1491,7 @@
 		syscall_trace(regs);
 
 	if (unlikely(current->audit_context)) {
-		if (test_thread_flag(TIF_IA32)) {
+		if (current_thread_info()->status & TS_COMPAT) {
 			audit_syscall_entry(AUDIT_ARCH_I386,
 					    regs->orig_ax,
 					    regs->bx, regs->cx,