MIPS syscall auditing patches
Subsystems (4)
PATCH 1/1 MIPS syscall auditing patches
this is the first cut of the MIPS auditing patches. MIPS doesn't quite fit into the existing pattern of other architectures and I'd appreciate your comments and maybe even an Acked-by.
- MIPS syscalls return a success / error flag in register $7. If the flag is set then the return value in $2 is a *positive* error value. This means the existing AUDITSC_RESULT() macro does not work on MIPS and thus ptrace.c defines it's own version MIPS_AUDITSC_RESULT().
- Linux on MIPS extends the traditional syscall table used by older UNIX implementations. This is why 32-bit Linux syscalls are starting from 4000; the native 64-bit syscalls start from 5000 and the N32 compat ABI from 6000. The existing syscall bitmap is only large enough for at most 2048 syscalls, so I had to increase AUDIT_BITMASK_SIZE to 256 which provides enough space for 8192 syscalls. Because include/linux/audit.h and AUDIT_BITMASK_SIZE are exported to userspace I've used an #ifdef __mips__ for this.
- I've introduced a flag __AUDIT_ARCH_ALT to indicate an alternative ABI. The name of the flag is intentionally very generic to make the name hopefully fit other architectures' eventual need as well. On MIPS it indicates the 3rd ABI known as N32.
- To make matters worse, most MIPS processors can be configured to be big or little endian. Traditionally the the 64-bit little endian configuration is named mips64el, so I've changed references to MIPSEL64 in audit.h to MIPS64EL.
- The code treats the little endian MIPS architecture as separate from big endian. Combined with the 3 ABIs that's 6 combinations. I tried to sort of follow the example set by ARM which explicitly lists the (rare) big endian architecture variant - but it doesn't seem to very useful so I wonder if this could be squashed to just the three ABIs without consideration of endianess?
- Talking about flags; I've defined the the N32 architecture flags were defined
#define AUDIT_ARCH_MIPS64_N32 (EM_MIPS|__AUDIT_ARCH_ALT) #define AUDIT_ARCH_MIPS64EL_N32 (EM_MIPS|__AUDIT_ARCH_ALT|__AUDIT_ARCH_LE
N32 is a 32-bit ABI but one that only runs on 64-bit processors as it uses 64-bit registers for 64-bit integers. So I'm uncertain if the __AUDIT_ARCH_64BIT flags should be set or not.
Thanks in advance,
Signed-off-by Ralf Baechle <[email protected]>
--- arch/mips/Kconfig | 12 +++++ arch/mips/include/asm/abi.h | 1 + arch/mips/include/asm/unistd.h | 31 +++++++++---- arch/mips/kernel/Makefile | 4 ++ arch/mips/kernel/audit-n32.c | 58 ++++++++++++++++++++++++ arch/mips/kernel/audit-native.c | 92 +++++++++++++++++++++++++++++++++++++++ arch/mips/kernel/audit-o32.c | 60 +++++++++++++++++++++++++ arch/mips/kernel/ptrace.c | 24 ++++------ arch/mips/kernel/signal.c | 20 ++++++++- arch/mips/kernel/signal32.c | 10 ++++- arch/mips/kernel/signal_n32.c | 10 ++++- arch/mips/kernel/syscall.c | 2 + include/linux/audit.h | 21 ++++++++- init/Kconfig | 2 +- 14 files changed, 319 insertions(+), 28 deletions(-)
arch/mips/Kconfig +12 -0
@@ -1,6 +1,7 @@ config MIPS bool default y + select AUDIT_ARCH select HAVE_GENERIC_DMA_COHERENT select HAVE_IDE select HAVE_OPROFILE
@@ -811,6 +812,15 @@ config ARC config ARCH_MAY_HAVE_PC_FDC bool +config AUDIT_ARCH + bool + +config AUDITSYSCALL_O32 + bool + +config AUDITSYSCALL_N32 + bool + config BOOT_RAW bool
@@ -2383,6 +2393,7 @@ config SYSVIPC_COMPAT config MIPS32_O32 bool "Kernel support for o32 binaries" depends on MIPS32_COMPAT + select AUDITSYSCALL_O32 if AUDITSYSCALL help Select this option if you want to run o32 binaries. These are pure 32-bit binaries as used by the 32-bit Linux/MIPS port. Most of
@@ -2393,6 +2404,7 @@ config MIPS32_O32 config MIPS32_N32 bool "Kernel support for n32 binaries" depends on MIPS32_COMPAT + select AUDITSYSCALL_N32 if AUDITSYSCALL help Select this option if you want to run n32 binaries. These are 64-bit binaries using 32-bit quantities for addressing and certain
arch/mips/include/asm/abi.h +1 -0
@@ -22,6 +22,7 @@ struct mips_abi { sigset_t *set, siginfo_t *info);const unsigned long rt_signal_return_offset;const unsigned long restart; + const int audit_arch; };#endif /* _ASM_ABI_H */
arch/mips/include/asm/unistd.h +22 -9
@@ -5,16 +5,15 @@* * Copyright (C) 1995, 96, 97, 98, 99, 2000 by Ralf Baechle * Copyright (C) 1999, 2000 Silicon Graphics, Inc. -* -* Changed system calls macros _syscall5 - _syscall7 to push args 5 to 7 onto -* the stack. Robin Farine for ACN S.A, Copyright (C) 1996 by ACN S.A */ #ifndef _ASM_UNISTD_H#define _ASM_UNISTD_H#include <asm/sgidefs.h> -#if _MIPS_SIM == _MIPS_SIM_ABI32 +#if (defined(__WANT_SYSCALL_NUMBERS) && \ + (__WANT_SYSCALL_NUMBERS == _MIPS_SIM_ABI32)) || \ + (!defined(__WANT_SYSCALL_NUMBERS) && _MIPS_SIM == _MIPS_SIM_ABI32)/* * Linux o32 style syscalls are in the range from 4000 to 4999.
@@ -369,12 +368,14 @@*/ #define __NR_Linux_syscalls 342 -#endif /* _MIPS_SIM == _MIPS_SIM_ABI32 */ +#endif /* Want O32 || _MIPS_SIM == _MIPS_SIM_ABI32 */ #define __NR_O32_Linux 4000#define __NR_O32_Linux_syscalls 342 -#if _MIPS_SIM == _MIPS_SIM_ABI64 +#if (defined(__WANT_SYSCALL_NUMBERS) && \ + (__WANT_SYSCALL_NUMBERS == _MIPS_SIM_ABI64)) || \ + (!defined(__WANT_SYSCALL_NUMBERS) && _MIPS_SIM == _MIPS_SIM_ABI64)/* * Linux 64-bit syscalls are in the range from 5000 to 5999.
@@ -688,12 +689,14 @@*/ #define __NR_Linux_syscalls 301 -#endif /* _MIPS_SIM == _MIPS_SIM_ABI64 */ +#endif /* Want N64 || _MIPS_SIM == _MIPS_SIM_ABI64 */ #define __NR_64_Linux 5000#define __NR_64_Linux_syscalls 301 -#if _MIPS_SIM == _MIPS_SIM_NABI32 +#if (defined(__WANT_SYSCALL_NUMBERS) && \ + (__WANT_SYSCALL_NUMBERS == _MIPS_SIM_NABI32)) || \ + (!defined(__WANT_SYSCALL_NUMBERS) && _MIPS_SIM == _MIPS_SIM_NABI32)/* * Linux N32 syscalls are in the range from 6000 to 6999.
@@ -1012,7 +1015,7 @@*/ #define __NR_Linux_syscalls 306 -#endif /* _MIPS_SIM == _MIPS_SIM_NABI32 */ +#endif /* Want N32 || _MIPS_SIM == _MIPS_SIM_NABI32 */ #define __NR_N32_Linux 6000#define __NR_N32_Linux_syscalls 306
@@ -1075,5 +1078,15 @@*/ #define cond_syscall (x) asm(".weak\t" #x "\n" #x "\t=\tsys_ni_syscall") +#ifdef CONFIG_MIPS32_N32 +#define NR_syscalls (__NR_N32_Linux + __NR_N32_Linux_syscalls) +#elif defined(CONFIG_64BIT ) +#define NR_syscalls (__NR_64_Linux + __NR_64_Linux_syscalls) +#elif defined(CONFIG_32BIT ) +#define NR_syscalls (__NR_O32_Linux + __NR_O32_Linux_syscalls) +#else +#error Must know ABIs in use to define NR_syscalls +#endif +#endif /* __KERNEL__ */ #endif /* _ASM_UNISTD_H */
arch/mips/kernel/Makefile +4 -0
@@ -109,4 +109,8 @@ obj-$(CONFIG_HW_PERF_EVENTS) += perf_event.o obj-$(CONFIG_JUMP_LABEL) += jump_label.o +obj-$(CONFIG_AUDITSYSCALL_O32) += audit-o32.o +obj-$(CONFIG_AUDITSYSCALL_N32) += audit-n32.o +obj-$(CONFIG_AUDITSYSCALL) += audit-native.o + CPPFLAGS_vmlinux.lds := $(KBUILD_CFLAGS)
arch/mips/kernel/audit-n32.c new file +58 -0
58 lines not on this page · raw message
arch/mips/kernel/audit-native.c new file +92 -0
92 lines not on this page · raw message
arch/mips/kernel/audit-o32.c new file +60 -0
60 lines not on this page · raw message
arch/mips/kernel/ptrace.c +10 -14
@@ -26,6 +26,7 @@#include <linux/audit.h> #include <linux/seccomp.h> +#include <asm/abi.h> #include <asm/byteorder.h> #include <asm/cpu.h> #include <asm/dsp.h>
@@ -40,6 +41,12 @@#include <asm/reg.h> /* +* The standard AUDITSC_RESULT() assumes errno values < 0 indicate error +* but MIPS passes an error flag instead. +*/ +#define MIPS_AUDITSC_RESULT (x) ((x) ? AUDITSC_FAILURE : AUDITSC_SUCCESS) + +/* * Called by kernel/ptrace.c when detaching.. * * Make sure single step bits etc are not set.
@@ -517,18 +524,6 @@ long arch_ptrace(struct task_struct *child, long request,return ret; } -static inline int audit_arch (void ) -{ -int arch =EM_MIPS ; -#ifdef CONFIG_64BIT - arch |= __AUDIT_ARCH_64BIT; -#endif -#if defined(__LITTLE_ENDIAN) - arch |= __AUDIT_ARCH_LE; -#endif -return arch; -} -/* * Notification of system call entry/exit * - triggered by current->work.syscall_trace
@@ -540,7 +535,7 @@ asmlinkage void do_syscall_trace(struct pt_regs *regs, int entryexit)secure_computing (regs->regs[2 ]);if (unlikely (current->audit_context) && entryexit) -audit_syscall_exit (AUDITSC_RESULT (regs->regs[7 ]), +audit_syscall_exit (MIPS_AUDITSC_RESULT (regs->regs[7 ]), -regs->regs[2 ]);if (!(current->ptrace &PT_PTRACED ))
@@ -566,7 +561,8 @@ asmlinkage void do_syscall_trace(struct pt_regs *regs, int entryexit) out:if (unlikely (current->audit_context) && !entryexit) -audit_syscall_entry (audit_arch (), regs->regs[2 ], +audit_syscall_entry (current->thread.abi->audit_arch, + regs->regs[2 ], regs->regs[4 ], regs->regs[5 ], regs->regs[6 ], regs->regs[7 ]); }
arch/mips/kernel/signal.c +19 -1
@@ -7,6 +7,7 @@* Copyright (C) 1994 - 2000 Ralf Baechle * Copyright (C) 1999, 2000 Silicon Graphics, Inc. */ +#include <linux/audit.h> #include <linux/cache.h> #include <linux/sched.h> #include <linux/mm.h>
@@ -537,7 +538,24 @@ struct mips_abi mips_abi = { .setup_rt_frame = setup_rt_frame, .rt_signal_return_offset = offsetof(struct mips_vdso, rt_signal_trampoline), - .restart = __NR_restart_syscall + .restart = __NR_restart_syscall, +#ifdef CONFIG_64BIT +# ifdef __BIG_ENDIAN + .audit_arch = AUDIT_ARCH_MIPS64, +# elif defined(__LITTLE_ENDIAN) + .audit_arch = AUDIT_ARCH_MIPS64EL, +# else +# error "Neither big nor little endian ???" +# endif +#else +# ifdef __BIG_ENDIAN + .audit_arch = AUDIT_ARCH_MIPS, +# elif defined(__LITTLE_ENDIAN) + .audit_arch = AUDIT_ARCH_MIPSEL, +# else +# error "Neither big nor little endian ???" +# endif +#endif }; static int handle_signal(unsigned long sig, siginfo_t *info,
arch/mips/kernel/signal32.c +9 -1
@@ -7,6 +7,7 @@* Copyright (C) 1994 - 2000, 2006 Ralf Baechle * Copyright (C) 1999, 2000 Silicon Graphics, Inc. */ +#include <linux/audit.h> #include <linux/cache.h> #include <linux/compat.h> #include <linux/sched.h>
@@ -683,7 +684,14 @@ struct mips_abi mips_abi_32 = { .setup_rt_frame = setup_rt_frame_32, .rt_signal_return_offset = offsetof(struct mips_vdso, o32_rt_signal_trampoline), - .restart = __NR_O32_restart_syscall + .restart = __NR_O32_restart_syscall, +#ifdef __BIG_ENDIAN + .audit_arch = AUDIT_ARCH_MIPS, +#elif defined(__LITTLE_ENDIAN) + .audit_arch = AUDIT_ARCH_MIPSEL, +#else +# error "Neither big nor little endian ???" +#endif }; SYSCALL_DEFINE4(32_rt_sigaction, int, sig,
arch/mips/kernel/signal_n32.c +9 -1
@@ -15,6 +15,7 @@* along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. */ +#include <linux/audit.h> #include <linux/cache.h> #include <linux/sched.h> #include <linux/mm.h>
@@ -226,5 +227,12 @@ struct mips_abi mips_abi_n32 = { .setup_rt_frame = setup_rt_frame_n32, .rt_signal_return_offset = offsetof(struct mips_vdso, n32_rt_signal_trampoline), - .restart = __NR_N32_restart_syscall + .restart = __NR_N32_restart_syscall, +#ifdef __BIG_ENDIAN + .audit_arch = AUDIT_ARCH_MIPS64_N32, +#elif defined(__LITTLE_ENDIAN) + .audit_arch = AUDIT_ARCH_MIPSEL64_N32, +#else +# error "Neither big nor little endian ???" +#endif };
arch/mips/kernel/syscall.c +2 -0
@@ -447,6 +447,8 @@ int kernel_execve(const char *filename, registerunsigned long __a3 asm("$7" );unsigned long __v0; + current->thread.abi = &mips_abi; + __asm__volatile (" \n" " .set noreorder \n" " li $2, %5 # __NR_execve \n"
include/linux/audit.h +20 -1
@@ -159,7 +159,11 @@* AUDIT_LIST commands must be implemented. */ #define AUDIT_MAX_FIELDS 64#define AUDIT_MAX_KEY_LEN 256 +#ifdef __mips__ +#define AUDIT_BITMASK_SIZE 256 +#else #define AUDIT_BITMASK_SIZE 64 +#endif #define AUDIT_WORD (nr) ((__u32)((nr)/32))#define AUDIT_BIT (nr) (1 << ((nr) - AUDIT_WORD(nr)*32))
@@ -175,6 +179,18 @@#define AUDIT_CLASS_SIGNAL 8#define AUDIT_CLASS_SIGNAL_32 9 +/* +* WARNING: Not officially assigned by upstream yet; the names of these +* constants might change breaking source compatibility. The values might +* change breaking binary compatibility. With the audit package being the +* only known user at this time the potencial problem is small +*/ +#define AUDIT_CLASS_DIR_WRITE_N32 10 +#define AUDIT_CLASS_CHATTR_N32 11 +#define AUDIT_CLASS_READ_N32 12 +#define AUDIT_CLASS_WRITE_N32 13 +#define AUDIT_CLASS_SIGNAL_N32 14 +/* This bitmask is used to validate user input. It represents all bits that * are currently used in an audit field constant understood by the kernel. * If you are adding a new #define AUDIT_<whatever>, please ensure that
@@ -284,6 +300,7 @@ enum {/* distinguish syscall tables */ #define __AUDIT_ARCH_64BIT 0x80000000#define __AUDIT_ARCH_LE 0x40000000 +#define __AUDIT_ARCH_ALT 0x20000000/* indicates alternative ABI */ #define AUDIT_ARCH_ALPHA (EM_ALPHA|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)#define AUDIT_ARCH_ARM (EM_ARM|__AUDIT_ARCH_LE)#define AUDIT_ARCH_ARMEB (EM_ARM)
@@ -297,7 +314,9 @@ enum {#define AUDIT_ARCH_MIPS (EM_MIPS)#define AUDIT_ARCH_MIPSEL (EM_MIPS|__AUDIT_ARCH_LE)#define AUDIT_ARCH_MIPS64 (EM_MIPS|__AUDIT_ARCH_64BIT) -#define AUDIT_ARCH_MIPSEL64 (EM_MIPS|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE) +#define AUDIT_ARCH_MIPS64EL (EM_MIPS|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE) +#define AUDIT_ARCH_MIPS64_N32 (EM_MIPS|__AUDIT_ARCH_ALT) +#define AUDIT_ARCH_MIPS64EL_N32 (EM_MIPS|__AUDIT_ARCH_ALT|__AUDIT_ARCH_LE)#define AUDIT_ARCH_PARISC (EM_PARISC)#define AUDIT_ARCH_PARISC64 (EM_PARISC|__AUDIT_ARCH_64BIT)#define AUDIT_ARCH_PPC (EM_PPC)
init/Kconfig +1 -1
@@ -347,7 +347,7 @@ config AUDIT config AUDITSYSCALL bool "Enable system-call auditing support" - depends on AUDIT && (X86 || PPC || S390 || IA64 || UML || SPARC64 || SUPERH) + depends on AUDIT && (X86 || PPC || S390 || IA64 || UML || SPARC64 || SUPERH || MIPS) default y if SECURITY_SELINUX help Enable low-overhead system-call auditing infrastructure that
PATCH 1/1 MIPS audit userland patches
These are the userland patches to go along with the recently posted kernel patches. Many of the comments posted along with those also apply here, in particular wrt. to the ABI situation.
Signed-off-by Ralf Baechle <[email protected]>
--- lib/Makefile.am | 23 +++- lib/libaudit.c | 37 ++++-- lib/libaudit.h | 58 ++++++++ lib/lookup_table.c | 42 +++++-- lib/machinetab.h | 2 + lib/mips_n32_table.h | 325 +++++++++++++++++++++++++++++++++++++++++++ lib/mips_n64_table.h | 320 ++++++++++++++++++++++++++++++++++++++++++ lib/mips_o32_table.h | 361 ++++++++++++++++++++++++++++++++++++++++++++++++ lib/syscall-update.txt | 1 + lib/test/lookup_test.c | 51 +++++++ swig/audit.py | 7 + 11 files changed, 1206 insertions(+), 21 deletions(-)
lib/Makefile.am +20 -3
@@ -39,8 +39,9 @@ nodist_libaudit_la_SOURCES = $(BUILT_SOURCES) BUILT_SOURCES = actiontabs.h errtabs.h fieldtabs.h flagtabs.h \ ftypetabs.h i386_tables.h ia64_tables.h machinetabs.h \ - msg_typetabs.h optabs.h ppc_tables.h s390_tables.h \ - s390x_tables.h x86_64_tables.h + msg_typetabs.h optabs.h mips_o32_tables.h mips_n32_tables.h \ + mips_n64_tables.h ppc_tables.h s390_tables.h s390x_tables.h \ + x86_64_tables.h if USE_ALPHA BUILT_SOURCES += alpha_tables.h endif
@@ -50,7 +51,8 @@ endif noinst_PROGRAMS = gen_actiontabs_h gen_errtabs_h gen_fieldtabs_h \ gen_flagtabs_h gen_ftypetabs_h gen_i386_tables_h \ gen_ia64_tables_h gen_machinetabs_h gen_msg_typetabs_h \ - gen_optabs_h gen_ppc_tables_h gen_s390_tables_h \ + gen_optabs_h gen_mips_o32_tables_h gen_mips_n32_tables_h \ + gen_mips_n64_tables_h gen_ppc_tables_h gen_s390_tables_h \ gen_s390x_tables_h gen_x86_64_tables_h if USE_ALPHA noinst_PROGRAMS += gen_alpha_tables_h
@@ -124,6 +126,21 @@ gen_optabs_h_CFLAGS = $(AM_CFLAGS) '-DTABLE_H="optab.h"' optabs.h: gen_optabs_h Makefile ./gen_optabs_h --i2s op > $@ +gen_mips_o32_tables_h_SOURCES = gen_tables.c gen_tables.h mips_o32_table.h +gen_mips_o32_tables_h_CFLAGS = $(AM_CFLAGS) '-DTABLE_H="mips_o32_table.h"' +mips_o32_tables.h: gen_mips_o32_tables_h Makefile + ./gen_mips_o32_tables_h --lowercase --i2s --s2i mips_o32_syscall > $@ + +gen_mips_n32_tables_h_SOURCES = gen_tables.c gen_tables.h mips_n32_table.h +gen_mips_n32_tables_h_CFLAGS = $(AM_CFLAGS) '-DTABLE_H="mips_n32_table.h"' +mips_n32_tables.h: gen_mips_n32_tables_h Makefile + ./gen_mips_n32_tables_h --lowercase --i2s --s2i mips_n32_syscall > $@ + +gen_mips_n64_tables_h_SOURCES = gen_tables.c gen_tables.h mips_n64_table.h +gen_mips_n64_tables_h_CFLAGS = $(AM_CFLAGS) '-DTABLE_H="mips_n64_table.h"' +mips_n64_tables.h: gen_mips_n64_tables_h Makefile + ./gen_mips_n64_tables_h --lowercase --i2s --s2i mips_n64_syscall > $@ + gen_ppc_tables_h_SOURCES = gen_tables.c gen_tables.h ppc_table.h gen_ppc_tables_h_CFLAGS = $(AM_CFLAGS) '-DTABLE_H="ppc_table.h"' ppc_tables.h: gen_ppc_tables_h Makefile
lib/libaudit.c +28 -9
@@ -995,8 +995,10 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair, }else if (strcasecmp ("b32" , arch) ==0 ) { bits = ~__AUDIT_ARCH_64BIT; machine =audit_detect_machine (); - } -else + }else if (strcasecmp ("n32" , arch) ==0 ) { + bits = __AUDIT_ARCH_64BIT; + machine =MACH_MIPS64_N32 ; + }else machine =audit_name_to_machine (arch);if (machine <0 )
@@ -1009,6 +1011,9 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair, machine == MACH_86_64) machine =MACH_X86 ; else if (bits == ~__AUDIT_ARCH_64BIT && + machine == MACH_MIPS64) + machine =MACH_MIPS ; + else if (bits == ~__AUDIT_ARCH_64BIT && machine == MACH_PPC64) machine =MACH_PPC ; else if (bits == ~__AUDIT_ARCH_64BIT &&
@@ -1028,6 +1033,10 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair,if (bits == ~__AUDIT_ARCH_64BIT)return -6 ;break ; +case MACH_MIPS : +if (bits == __AUDIT_ARCH_64BIT) +return -6 ; +break ;case MACH_PPC :if (bits == __AUDIT_ARCH_64BIT)return -6 ;
@@ -1036,9 +1045,11 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair,if (bits == __AUDIT_ARCH_64BIT)return -6 ;break ; -case MACH_86_64 :/* fallthrough */ -case MACH_PPC64 :/* fallthrough */ -case MACH_S390X :/* fallthrough */ +case MACH_86_64 :/* fallthrough */ +case MACH_MIPS64_N32 :/* fallthrough */ +case MACH_MIPS64 :/* fallthrough */ +case MACH_PPC64 :/* fallthrough */ +case MACH_S390X :/* fallthrough */ break ;default :return -6 ;
@@ -1176,10 +1187,18 @@ static int audit_name_to_gid(const char *name, gid_t *gid)int audit_detect_machine (void ) {struct utsname uts; -if (uname (&uts) ==0 ) -// strcpy(uts.machine, "x86_64"); -return audit_name_to_machine (uts.machine); -return -1 ; +int little_endian; + +if (uname (&uts) ==-1 ) +return -1 ; + +// strcpy(uts.machine, "x86_64"); +if (!strcmp (uts.machine,"mips64" ) && little_endian) +strcpy (uts.machine,"mips64el" ); +else if (!strcmp (uts.machine,"mips" ) && little_endian) +strcpy (uts.machine,"mipsel" ); + +return audit_name_to_machine (uts.machine); }hidden_def (audit_detect_machine)
lib/libaudit.h +58 -0
70 lines not on this page · raw message
lib/lookup_table.c +33 -9
69 lines not on this page · raw message
lib/machinetab.h +2 -0
@@ -26,6 +26,8 @@ _S(MACH_X86, "i586" ) _S(MACH_X86, "i686" ) _S(MACH_86_64, "x86_64" ) _S(MACH_IA64, "ia64" ) +_S(MACH_MIPS64, "mips64" ) +_S(MACH_MIPS, "mips" ) _S(MACH_PPC64, "ppc64" ) _S(MACH_PPC, "ppc" )_S (MACH_S390X ,"s390x" )
lib/mips_n32_table.h new file +325 -0
325 lines not on this page · raw message
lib/mips_n64_table.h new file +320 -0
320 lines not on this page · raw message
lib/mips_o32_table.h new file +361 -0
361 lines not on this page · raw message
lib/syscall-update.txt +1 -0
@@ -2,6 +2,7 @@ The place where syscall information is gathered is: arch/x86/include/asm/unistd_32.h arch/x86/include/asm/unistd_64.h +arch/mips/include/asm/unistd.h arch/s390/include/asm/unistd.h arch/powerpc/include/asm/unistd.h arch/ia64/include/asm/unistd.h
lib/test/lookup_test.c +51 -0
63 lines not on this page · raw message
swig/audit.py +7 -0
@@ -236,6 +236,7 @@ AUDIT_FAIL_PRINTK = _audit.AUDIT_FAIL_PRINTK AUDIT_FAIL_PANIC = _audit.AUDIT_FAIL_PANIC __AUDIT_ARCH_64BIT = _audit.__AUDIT_ARCH_64BIT __AUDIT_ARCH_LE = _audit.__AUDIT_ARCH_LE +__AUDIT_ARCH_ALT = _audit.__AUDIT_ARCH_ALT AUDIT_PERM_EXEC = _audit.AUDIT_PERM_EXEC AUDIT_PERM_WRITE = _audit.AUDIT_PERM_WRITE AUDIT_PERM_READ = _audit.AUDIT_PERM_READ
@@ -647,6 +648,12 @@ AUDISP_PROTOCOL_VER = _audit.AUDISP_PROTOCOL_VER MACH_X86 = _audit.MACH_X86 MACH_86_64 = _audit.MACH_86_64 MACH_IA64 = _audit.MACH_IA64 +MACH_MIPS = _audit.MACH_MIPS +MACH_MIPSEL = _audit.MACH_MIPSEL +MACH_MIPS64 = _audit.MACH_MIPS64 +MACH_MIPS64EL = _audit.MACH_MIPS64EL +MACH_MIPS64_N32 = _audit.MACH_MIPS64_N32 +MACH_MIPS64EL_N32 = _audit.MACH_MIPS64EL_N32 MACH_PPC64 = _audit.MACH_PPC64 MACH_PPC = _audit.MACH_PPC MACH_S390X = _audit.MACH_S390X