audit: generic compat system call support

(v1 was created mistakenly. Please igore it.)

lib/audit.c provides a generic definition for auditing system calls. lib/compat_audit.c similarly adds compat syscall support for bi-architectures (32/64-bit).

Each architecture must define audit_is_compat() in asm/audit.h.

Signed-off-by AKASHI Takahiro <[email protected]>

---
 include/linux/audit.h |    9 +++++++++
 lib/Makefile          |    3 +++
 lib/audit.c           |   17 +++++++++++++++++
 lib/compat_audit.c    |   51 +++++++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 80 insertions(+)
 create mode 100644 lib/compat_audit.c

include/linux/audit.h +9 -0

index 729a4d1..c49a312 100644
@@ -76,6 +76,15 @@ struct audit_field {
 extern int __init audit_register_class(int class, unsigned *list);
 extern int audit_classify_syscall(int abi, unsigned syscall);
 extern int audit_classify_arch(int arch);
+#if defined(CONFIG_AUDIT_GENERIC) && defined(CONFIG_COMPAT)
+extern unsigned compat_write_class[];
+extern unsigned compat_read_class[];
+extern unsigned compat_dir_class[];
+extern unsigned compat_chattr_class[];
+extern unsigned compat_signal_class[];
+
+extern int audit_classify_compat_syscall(int abi, unsigned syscall);
+#endif
 
 /* audit_names->type values */
 #define	AUDIT_TYPE_UNKNOWN	0	/* we don't know yet */

lib/Makefile +3 -0

index f3bb2cb..5bb185a 100644
@@ -96,6 +96,9 @@ obj-$(CONFIG_TEXTSEARCH_BM) += ts_bm.o
 obj-$(CONFIG_TEXTSEARCH_FSM) += ts_fsm.o
 obj-$(CONFIG_SMP) += percpu_counter.o
 obj-$(CONFIG_AUDIT_GENERIC) += audit.o
+ifeq ($(CONFIG_COMPAT),y)
+obj-$(CONFIG_AUDIT_GENERIC) += compat_audit.o
+endif
 
 obj-$(CONFIG_SWIOTLB) += swiotlb.o
 obj-$(CONFIG_IOMMU_HELPER) += iommu-helper.o

lib/audit.c +4 -0

index 76bbed4..3bf3858 100644
@@ -1,6 +1,7 @@
 #include <linux/init.h>
 #include <linux/types.h>
 #include <linux/audit.h>
+#include <asm/audit.h>
 #include <asm/unistd.h>
 
 static unsigned dir_class[] = {

@@ -30,11 +31,20 @@ static unsigned signal_class[] = {
 
 int audit_classify_arch(int arch)
 {
+#ifdef CONFIG_COMPAT
+	if (audit_is_compat(arch))
+		return 1;

Quoted 74 lines · AKASHI Takahiro

(v1 was created mistakenly. Please igore it.)

lib/audit.c provides a generic definition for auditing system calls. lib/compat_audit.c similarly adds compat syscall support for bi-architectures (32/64-bit).

Each architecture must define audit_is_compat() in asm/audit.h.

Signed-off-by AKASHI Takahiro <[email protected]>

---
  include/linux/audit.h |    9 +++++++++
  lib/Makefile          |    3 +++
  lib/audit.c           |   17 +++++++++++++++++
  lib/compat_audit.c    |   51 +++++++++++++++++++++++++++++++++++++++++++++++++
  4 files changed, 80 insertions(+)

create mode 100644 lib/compat_audit.c

include/linux/audit.h +9 -0

index 729a4d1..c49a312 100644
@@ -76,6 +76,15 @@ struct audit_field {
  extern int __init audit_register_class(int class, unsigned *list);
  extern int audit_classify_syscall(int abi, unsigned syscall);
  extern int audit_classify_arch(int arch);
+#if defined(CONFIG_AUDIT_GENERIC) && defined(CONFIG_COMPAT)
+extern unsigned compat_write_class[];
+extern unsigned compat_read_class[];
+extern unsigned compat_dir_class[];
+extern unsigned compat_chattr_class[];
+extern unsigned compat_signal_class[];
+
+extern int audit_classify_compat_syscall(int abi, unsigned syscall);
+#endif
 
  /* audit_names->type values */
  #define	AUDIT_TYPE_UNKNOWN	0	/* we don't know yet */

lib/Makefile +3 -0

index f3bb2cb..5bb185a 100644
@@ -96,6 +96,9 @@ obj-$(CONFIG_TEXTSEARCH_BM) += ts_bm.o
  obj-$(CONFIG_TEXTSEARCH_FSM) += ts_fsm.o
  obj-$(CONFIG_SMP) += percpu_counter.o
  obj-$(CONFIG_AUDIT_GENERIC) += audit.o
+ifeq ($(CONFIG_COMPAT),y)
+obj-$(CONFIG_AUDIT_GENERIC) += compat_audit.o
+endif
 
  obj-$(CONFIG_SWIOTLB) += swiotlb.o
  obj-$(CONFIG_IOMMU_HELPER) += iommu-helper.o

lib/audit.c +5 -0

index 76bbed4..3bf3858 100644
@@ -1,6 +1,7 @@
  #include <linux/init.h>
  #include <linux/types.h>
  #include <linux/audit.h>
+#include <asm/audit.h>
  #include <asm/unistd.h>
 
  static unsigned dir_class[] = {

@@ -30,11 +31,20 @@ static unsigned signal_class[] = {
 
  int audit_classify_arch(int arch)
  {
+#ifdef CONFIG_COMPAT
+	if (audit_is_compat(arch))
+		return 1;
+#endif
  	return 0;
  }
 

lib/audit.c static unsigned signal_class[] = { · line 46

Quoted 6 lines

lib/audit.c +4 -0

  int audit_classify_syscall(int abi, unsigned syscall)
  {
+#ifdef CONFIG_COMPAT
+	if (audit_is_compat(abi))
+		return audit_classify_compat_syscall(abi, syscall);
+#endif

Hmm, I'm not sure this is the right way to solve this problem. Whether something is compat or not depends on the task to which it is associated. If this is always the current task for the audit cases, then you can just use something like is_compat_task. Otherwise, I think we need to get a handle on the task_struct here. An arch-callback feels like the wrong approach to me.

Will

Quoted 75 lines · Will Deacon

Quoted 74 lines · AKASHI Takahiro

(v1 was created mistakenly. Please igore it.)

lib/audit.c provides a generic definition for auditing system calls. lib/compat_audit.c similarly adds compat syscall support for bi-architectures (32/64-bit).

Each architecture must define audit_is_compat() in asm/audit.h.

Signed-off-by AKASHI Takahiro <[email protected]>

---
 include/linux/audit.h |    9 +++++++++
 lib/Makefile          |    3 +++
 lib/audit.c           |   17 +++++++++++++++++
 lib/compat_audit.c    |   51 +++++++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 80 insertions(+)
 create mode 100644 lib/compat_audit.c

include/linux/audit.h +9 -0

index 729a4d1..c49a312 100644
@@ -76,6 +76,15 @@ struct audit_field {
 extern int __init audit_register_class(int class, unsigned *list);
 extern int audit_classify_syscall(int abi, unsigned syscall);
 extern int audit_classify_arch(int arch);
+#if defined(CONFIG_AUDIT_GENERIC) && defined(CONFIG_COMPAT)
+extern unsigned compat_write_class[];
+extern unsigned compat_read_class[];
+extern unsigned compat_dir_class[];
+extern unsigned compat_chattr_class[];
+extern unsigned compat_signal_class[];
+
+extern int audit_classify_compat_syscall(int abi, unsigned syscall);
+#endif
 
 /* audit_names->type values */
 #define	AUDIT_TYPE_UNKNOWN	0	/* we don't know yet */

lib/Makefile +3 -0

index f3bb2cb..5bb185a 100644
@@ -96,6 +96,9 @@ obj-$(CONFIG_TEXTSEARCH_BM) += ts_bm.o
 obj-$(CONFIG_TEXTSEARCH_FSM) += ts_fsm.o
 obj-$(CONFIG_SMP) += percpu_counter.o
 obj-$(CONFIG_AUDIT_GENERIC) += audit.o
+ifeq ($(CONFIG_COMPAT),y)
+obj-$(CONFIG_AUDIT_GENERIC) += compat_audit.o
+endif
 
 obj-$(CONFIG_SWIOTLB) += swiotlb.o
 obj-$(CONFIG_IOMMU_HELPER) += iommu-helper.o

lib/audit.c +5 -0

index 76bbed4..3bf3858 100644
@@ -1,6 +1,7 @@
 #include <linux/init.h>
 #include <linux/types.h>
 #include <linux/audit.h>
+#include <asm/audit.h>
 #include <asm/unistd.h>
 
 static unsigned dir_class[] = {

@@ -30,11 +31,20 @@ static unsigned signal_class[] = {
 
 int audit_classify_arch(int arch)
 {
+#ifdef CONFIG_COMPAT
+	if (audit_is_compat(arch))
+		return 1;
+#endif
 	return 0;
 }
 

Quoted 12 lines

lib/audit.c static unsigned signal_class[] = { · line 46

Quoted 6 lines

lib/audit.c +4 -0

 int audit_classify_syscall(int abi, unsigned syscall)
 {
+#ifdef CONFIG_COMPAT
+	if (audit_is_compat(abi))
+		return audit_classify_compat_syscall(abi, syscall);
+#endif

Hmm, I'm not sure this is the right way to solve this problem. Whether something is compat or not depends on the task to which it is associated. If this is always the current task for the audit cases, then you can just use something like is_compat_task. Otherwise, I think we need to get a handle on the task_struct here. An arch-callback feels like the wrong approach to me.

You are completely right. In my current (v3 prototype) implementation, "abi" argument, which can be AUDIT_ARCH_ARM(EB) or AUDIT_ARCH_AARCH64(EB), passed to audit_classify_syscall() is determined per-task using is_compat_thread() when audit_syscall_entry() is executed in syscall_trace().
(Obviously audit_is_compat() is true only in case of AUDIT_ARCH_ARM.)

V3 based on this patch is working for 32-bit and 64-bit userland. I can submit v3 patch if you want.

Thanks,
-Takahiro AKASHI

Quoted 1 line

Will

lib/audit.c provides a generic definition for auditing system calls. This patch extends it for compat syscall support on bi-architectures (32/64-bit) by adding lib/compat_audit.c when CONFIG_COMPAT enabled.

Each architecture that wants to use this must define audit_is_compat() in asm/audit.h.

Signed-off-by AKASHI Takahiro <[email protected]>

include/linux/audit.h +9 -0

index bf1ef22..3d71949 100644
@@ -78,6 +78,15 @@ extern int is_audit_feature_set(int which);
 extern int __init audit_register_class(int class, unsigned *list);
 extern int audit_classify_syscall(int abi, unsigned syscall);
 extern int audit_classify_arch(int arch);
+#if defined(CONFIG_AUDIT_GENERIC) && defined(CONFIG_COMPAT)
+extern unsigned compat_write_class[];
+extern unsigned compat_read_class[];
+extern unsigned compat_dir_class[];
+extern unsigned compat_chattr_class[];
+extern unsigned compat_signal_class[];
+
+extern int audit_classify_compat_syscall(int abi, unsigned syscall);
+#endif
 
 /* audit_names->type values */
 #define	AUDIT_TYPE_UNKNOWN	0	/* we don't know yet */

lib/Makefile +0 -0

index a459c31..73ea908 100644

lib/audit.c +1 -0

@@ -1,6 +1,7 @@
 #include <linux/init.h>
 #include <linux/types.h>
 #include <linux/audit.h>
+#include <asm/audit.h>
 #include <asm/unistd.h>
 
 static unsigned dir_class[] = {

lib/compat_audit.c new file +11 -0

+int audit_classify_compat_syscall(int abi, unsigned syscall)
+{
+	switch (syscall) {
+#ifdef __NR_open
+	case __NR_open:
+		return 2;
+#endif
+#ifdef __NR_openat
+	case __NR_openat:
+		return 3;
+#endif

Quoted 8 lines · AKASHI Takahiro

lib/audit.c provides a generic definition for auditing system calls. This patch extends it for compat syscall support on bi-architectures (32/64-bit) by adding lib/compat_audit.c when CONFIG_COMPAT enabled.

Each architecture that wants to use this must define audit_is_compat() in asm/audit.h.

Signed-off-by AKASHI Takahiro <[email protected]>

I'm not familiar with the audit subsystem but I have some (cosmetic) comments below.

Quoted 18 lines

include/linux/audit.h +9 -0

index bf1ef22..3d71949 100644
@@ -78,6 +78,15 @@ extern int is_audit_feature_set(int which);
  extern int __init audit_register_class(int class, unsigned *list);
  extern int audit_classify_syscall(int abi, unsigned syscall);
  extern int audit_classify_arch(int arch);
+#if defined(CONFIG_AUDIT_GENERIC) && defined(CONFIG_COMPAT)
+extern unsigned compat_write_class[];
+extern unsigned compat_read_class[];
+extern unsigned compat_dir_class[];
+extern unsigned compat_chattr_class[];
+extern unsigned compat_signal_class[];
+
+extern int audit_classify_compat_syscall(int abi, unsigned syscall);
+#endif
 

lib/Makefile obj-$(CONFIG_TEXTSEARCH_BM) += ts_bm.o · line 98

Quoted 13 lines

include/linux/audit.h +0 -0

  /* audit_names->type values */
  #define	AUDIT_TYPE_UNKNOWN	0	/* we don't know yet */

lib/Makefile +3 -0

index a459c31..73ea908 100644
@@ -93,6 +93,9 @@ obj-$(CONFIG_TEXTSEARCH_BM) += ts_bm.o
  obj-$(CONFIG_TEXTSEARCH_FSM) += ts_fsm.o
  obj-$(CONFIG_SMP) += percpu_counter.o
  obj-$(CONFIG_AUDIT_GENERIC) += audit.o
+ifeq ($(CONFIG_COMPAT),y)
+obj-$(CONFIG_AUDIT_GENERIC) += compat_audit.o
+endif

You could use a CONFIG_AUDIT_COMPAT_GENERIC and simplify other #ifdefs as well.

Quoted 12 lines

lib/audit.c +1 -0

@@ -1,6 +1,7 @@
  #include <linux/init.h>
  #include <linux/types.h>
  #include <linux/audit.h>
+#include <asm/audit.h>
  #include <asm/unistd.h>
 
  static unsigned dir_class[] = {

@@ -30,11 +31,20 @@ static unsigned signal_class[] = {
 

lib/audit.c static unsigned signal_class[] = { · line 39

Quoted 8 lines

lib/audit.c +4 -0

  int audit_classify_arch(int arch)
  {
+#ifdef CONFIG_COMPAT
+	if (audit_is_compat(arch))
+		return 1;
+#endif
  	return 0;
  }

Here and in other places, just define a default audit_is_compat() functions which returns false when !CONFIG_COMPAT to avoid the #ifdefs.

Quoted 4 lines

lib/compat_audit.c new file +0 -1

new file mode 100644
index 0000000..94f6480
--- /dev/null

lib/compat_audit.c line 4

Quoted 6 lines

+++ b/lib/compat_audit.c

lib/compat_audit.c new file +4 -0

@@ -0,0 +1,51 @@
+#include <linux/init.h>
+#include <linux/types.h>
+/* FIXME: this might be architecture dependent */
+#include <asm/unistd_32.h>

It most likely is architecture dependent.

Quoted 17 lines

lib/compat_audit.c new file +17 -0

+int audit_classify_compat_syscall(int abi, unsigned syscall)
+{
+	switch (syscall) {
+#ifdef __NR_open
+	case __NR_open:
+		return 2;
+#endif
+#ifdef __NR_openat
+	case __NR_openat:
+		return 3;
+#endif
+#ifdef __NR_socketcall
+	case __NR_socketcall:
+		return 4;
+#endif
+	case __NR_execve:
+		return 5;

lib/compat_audit.c line 51

Quoted 4 lines

lib/compat_audit.c new file +4 -0

+	default:
+		return 1;
+	}
+}

BTW, since they aren't many, you could get the arch code to define __NR_compat_open etc. explicitly and use these. On arm64 we have a few of these defined to avoid name collision in signal handling code.

Catalin and audit maintainers,

Quoted 13 lines · Catalin Marinas

lib/compat_audit.c line 4

Quoted 10 lines · AKASHI Takahiro

lib/compat_audit.c new file +4 -0

new file mode 100644
index 0000000..94f6480
@@ -0,0 +1,51 @@
+#include <linux/init.h>
+#include <linux/types.h>
+/* FIXME: this might be architecture dependent */
+#include <asm/unistd_32.h>

It most likely is architecture dependent.

I'm wondering what name is the most appropriate in this case. Most archictures have __NR_xyz definitions in "unistd_32.h", but arm64 doesn't have it, instead "unistd32." which contains only __SYSCALL(xyz, NO). Confusing?

Quoted 17 lines

Quoted 17 lines

lib/compat_audit.c new file +17 -0

+int audit_classify_compat_syscall(int abi, unsigned syscall)
+{
+	switch (syscall) {
+#ifdef __NR_open
+	case __NR_open:
+		return 2;
+#endif
+#ifdef __NR_openat
+	case __NR_openat:
+		return 3;
+#endif
+#ifdef __NR_socketcall
+	case __NR_socketcall:
+		return 4;
+#endif
+	case __NR_execve:
+		return 5;

Quoted 8 lines

lib/compat_audit.c line 51

Quoted 4 lines

lib/compat_audit.c new file +4 -0

+	default:
+		return 1;
+	}
+}

BTW, since they aren't many, you could get the arch code to define __NR_compat_open etc. explicitly and use these. On arm64 we have a few of these defined to avoid name collision in signal handling code.

Again, most architecture have their own unistd32.h for compat system calls, and use __NR_open-like naming.
It's unlikely for these archs to migrate to "generic compat" auditing, but I believe that '__NR_open'-like naming is better because we may be able to avoid arch-specific changes even for future(?) syscall-related enhancements in audit.

Quoted 17 lines · AKASHI Takahiro

Catalin and audit maintainers,

Quoted 13 lines · Catalin Marinas

lib/compat_audit.c line 4

Quoted 10 lines · AKASHI Takahiro

lib/compat_audit.c new file +4 -0

new file mode 100644
index 0000000..94f6480
@@ -0,0 +1,51 @@
+#include <linux/init.h>
+#include <linux/types.h>
+/* FIXME: this might be architecture dependent */
+#include <asm/unistd_32.h>

It most likely is architecture dependent.

Quoted 4 lines

I'm wondering what name is the most appropriate in this case. Most archictures have __NR_xyz definitions in "unistd_32.h", but arm64 doesn't have it, instead "unistd32." which contains only __SYSCALL(xyz, NO). Confusing?

I don't think we should introduce a new file (or at least it should be named something containing "audit" to make it clearer).

Quoted 31 lines

Quoted 17 lines

Quoted 17 lines

lib/compat_audit.c new file +17 -0

+int audit_classify_compat_syscall(int abi, unsigned syscall)
+{
+	switch (syscall) {
+#ifdef __NR_open
+	case __NR_open:
+		return 2;
+#endif
+#ifdef __NR_openat
+	case __NR_openat:
+		return 3;
+#endif
+#ifdef __NR_socketcall
+	case __NR_socketcall:
+		return 4;
+#endif
+	case __NR_execve:
+		return 5;

Quoted 8 lines

lib/compat_audit.c line 51

Quoted 4 lines

lib/compat_audit.c new file +4 -0

+	default:
+		return 1;
+	}
+}

BTW, since they aren't many, you could get the arch code to define __NR_compat_open etc. explicitly and use these. On arm64 we have a few of these defined to avoid name collision in signal handling code.

Again, most architecture have their own unistd32.h for compat system calls, and use __NR_open-like naming.
It's unlikely for these archs to migrate to "generic compat" auditing, but I believe that '__NR_open'-like naming is better because we may be able to avoid arch-specific changes even for future(?) syscall-related enhancements in audit.

My preference is as above, a few __NR_compat_* (just those required by audit) defined in unistd.h but I'm not an audit maintainer.

Quoted 28 lines · Catalin Marinas

Quoted 27 lines · AKASHI Takahiro

Quoted 25 lines · Catalin Marinas

Quoted 11 lines

(quoted diff) +11 -0

+int audit_classify_compat_syscall(int abi, unsigned syscall)
+{
+	switch (syscall) {
+#ifdef __NR_open
+	case __NR_open:
+		return 2;
+#endif
+#ifdef __NR_openat
+	case __NR_openat:
+		return 3;
+#endif

Review

Quoted 10 lines

(quoted diff) +10 -0

+#ifdef __NR_socketcall
+	case __NR_socketcall:
+		return 4;
+#endif
+	case __NR_execve:
+		return 5;
+	default:
+		return 1;
+	}
+}

BTW, since they aren't many, you could get the arch code to define __NR_compat_open etc. explicitly and use these. On arm64 we have a few of these defined to avoid name collision in signal handling code.

Quoted 5 lines

Quoted 5 lines

Again, most architecture have their own unistd32.h for compat system calls, and use __NR_open-like naming.
It's unlikely for these archs to migrate to "generic compat" auditing, but I believe that '__NR_open'-like naming is better because we may be able to avoid arch-specific changes even for future(?) syscall-related enhancements in audit.

In my compat_audit.c, all the entries in audit classes are derived from asm-generic/audit_*.h, where __NR_xyz are used to list the system calls. So it is not possible to use __NR_compat_xyz as far as we re-use those generic files.
(Obviously we don't want to duplicate those header files, that is, audit_compat_*.h.)

From 462506af19400ab4000be827321a130ca2bdade2 Mon Sep 17 00:00:00 2001

lib/audit.c provides a generic function for auditing system calls. This patch extends it for compat syscall support on bi-architectures (32/64-bit) by adding lib/compat_audit.c.
What is required to support this feature are:
* add asm/unistd32.h for compat system call names
* select CONFIG_AUDIT_ARCH_COMPAT_GENERIC

Signed-off-by AKASHI Takahiro <[email protected]>

---
 include/linux/audit.h      |  8 ++++++++
 include/uapi/linux/audit.h |  6 ++++++
 lib/Kconfig                |  9 +++++++++
 lib/Makefile               |  1 +
 lib/audit.c                | 15 +++++++++++++-
 lib/compat_audit.c         | 50 ++++++++++++++++++++++++++++++++++++++++++++++
 6 files changed, 88 insertions(+), 1 deletion(-)
 create mode 100644 lib/compat_audit.c

include/linux/audit.h +8 -0

index aa865a9..85f0503 100644
@@ -78,6 +78,14 @@ extern int is_audit_feature_set(int which);
 extern int __init audit_register_class(int class, unsigned *list);
 extern int audit_classify_syscall(int abi, unsigned syscall);
 extern int audit_classify_arch(int arch);
+/* only for compat system calls */
+extern unsigned compat_write_class[];
+extern unsigned compat_read_class[];
+extern unsigned compat_dir_class[];
+extern unsigned compat_chattr_class[];
+extern unsigned compat_signal_class[];
+
+extern int __weak audit_classify_compat_syscall(int abi, unsigned syscall);
 
 /* audit_names->type values */
 #define	AUDIT_TYPE_UNKNOWN	0	/* we don't know yet */

include/uapi/linux/audit.h +6 -0

index 2d48fe1..624df43 100644
@@ -361,6 +361,12 @@ enum {
 #define AUDIT_ARCH_SPARC64	(EM_SPARCV9|__AUDIT_ARCH_64BIT)
 #define AUDIT_ARCH_X86_64	(EM_X86_64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
 
+#ifdef CONFIG_COMPAT
+#define audit_is_compat(arch)	(!((arch) & __AUDIT_ARCH_64BIT))
+#else
+#define audit_is_compat(arch)	false
+#endif
+
 #define AUDIT_PERM_EXEC		1
 #define AUDIT_PERM_WRITE	2
 #define AUDIT_PERM_READ		4

lib/Kconfig +9 -0

index 991c98b..1e80cb3 100644
@@ -182,6 +182,15 @@ config AUDIT_GENERIC
 	depends on AUDIT && !AUDIT_ARCH
 	default y
 
+config AUDIT_ARCH_COMPAT_GENERIC
+	bool
+	default n
+
+config AUDIT_COMPAT_GENERIC
+	bool
+	depends on AUDIT_GENERIC && AUDIT_ARCH_COMPAT_GENERIC && COMPAT
+	default y
+
 config RANDOM32_SELFTEST
 	bool "PRNG perform self test on init"
 	default n

lib/Makefile +1 -0

index 48140e3..0cd7b68 100644
@@ -96,6 +96,7 @@ obj-$(CONFIG_TEXTSEARCH_BM) += ts_bm.o
 obj-$(CONFIG_TEXTSEARCH_FSM) += ts_fsm.o
 obj-$(CONFIG_SMP) += percpu_counter.o
 obj-$(CONFIG_AUDIT_GENERIC) += audit.o
+obj-$(CONFIG_AUDIT_COMPAT_GENERIC) += compat_audit.o
 
 obj-$(CONFIG_SWIOTLB) += swiotlb.o
 obj-$(CONFIG_IOMMU_HELPER) += iommu-helper.o

lib/audit.c +14 -1

index 76bbed4..1d726a2 100644
@@ -30,11 +30,17 @@ static unsigned signal_class[] = {
 
 int audit_classify_arch(int arch)
 {
-	return 0;
+	if (audit_is_compat(arch))
+		return 1;
+	else
+		return 0;
 }
 
 int audit_classify_syscall(int abi, unsigned syscall)
 {
+	if (audit_is_compat(abi))
+		return audit_classify_compat_syscall(abi, syscall);
+
 	switch(syscall) {
 #ifdef __NR_open
 	case __NR_open:

@@ -57,6 +63,13 @@ int audit_classify_syscall(int abi, unsigned syscall)
 
 static int __init audit_classes_init(void)
 {
+#ifdef CONFIG_AUDIT_COMPAT_GENERIC
+	audit_register_class(AUDIT_CLASS_WRITE_32, compat_write_class);
+	audit_register_class(AUDIT_CLASS_READ_32, compat_read_class);
+	audit_register_class(AUDIT_CLASS_DIR_WRITE_32, compat_dir_class);
+	audit_register_class(AUDIT_CLASS_CHATTR_32, compat_chattr_class);
+	audit_register_class(AUDIT_CLASS_SIGNAL_32, compat_signal_class);
+#endif
 	audit_register_class(AUDIT_CLASS_WRITE, write_class);
 	audit_register_class(AUDIT_CLASS_READ, read_class);
 	audit_register_class(AUDIT_CLASS_DIR_WRITE, dir_class);

lib/compat_audit.c new file +50 -0

new file mode 100644
index 0000000..873f75b
@@ -0,0 +1,50 @@
+#include <linux/init.h>
+#include <linux/types.h>
+#include <asm/unistd32.h>
+
+unsigned compat_dir_class[] = {
+#include <asm-generic/audit_dir_write.h>
+~0U
+};
+
+unsigned compat_read_class[] = {
+#include <asm-generic/audit_read.h>
+~0U
+};
+
+unsigned compat_write_class[] = {
+#include <asm-generic/audit_write.h>
+~0U
+};
+
+unsigned compat_chattr_class[] = {
+#include <asm-generic/audit_change_attr.h>
+~0U
+};
+
+unsigned compat_signal_class[] = {
+#include <asm-generic/audit_signal.h>
+~0U
+};
+
+int audit_classify_compat_syscall(int abi, unsigned syscall)
+{
+	switch (syscall) {
+#ifdef __NR_open
+	case __NR_open:
+		return 2;
+#endif
+#ifdef __NR_openat
+	case __NR_openat:
+		return 3;
+#endif
+#ifdef __NR_socketcall
+	case __NR_socketcall:
+		return 4;
+#endif
+	case __NR_execve:
+		return 5;
+	default:
+		return 1;
+	}
+}

Signature · 1 line

1.8.3.2

lib/audit.c provides a generic definition for auditing system calls. lib/compat_audit.c similarly adds compat syscall support for bi-architectures (32/64-bit).

Each architecture must define audit_is_compat() in asm/audit.h.

Signed-off-by AKASHI Takahiro <[email protected]>

---
  include/linux/audit.h |    3 +++
  lib/Makefile          |    3 +++
  lib/audit.c           |   10 ++++++++
  lib/compat_audit.c    |   64 +++++++++++++++++++++++++++++++++++++++++++++++++
  4 files changed, 80 insertions(+)

create mode 100644 lib/compat_audit.c

include/linux/audit.h +3 -0

index 729a4d1..f6c8d18 100644
@@ -75,6 +75,9 @@ struct audit_field {
 
  extern int __init audit_register_class(int class, unsigned *list);
  extern int audit_classify_syscall(int abi, unsigned syscall);
+#ifdef CONFIG_COMPAT
+extern int audit_classify_compat_syscall(int abi, unsigned syscall);
+#endif
  extern int audit_classify_arch(int arch);
 
  /* audit_names->type values */

lib/Makefile +3 -0

index f3bb2cb..5bb185a 100644
@@ -96,6 +96,9 @@ obj-$(CONFIG_TEXTSEARCH_BM) += ts_bm.o
  obj-$(CONFIG_TEXTSEARCH_FSM) += ts_fsm.o
  obj-$(CONFIG_SMP) += percpu_counter.o
  obj-$(CONFIG_AUDIT_GENERIC) += audit.o
+ifeq ($(CONFIG_COMPAT),y)
+obj-$(CONFIG_AUDIT_GENERIC) += compat_audit.o
+endif
 
  obj-$(CONFIG_SWIOTLB) += swiotlb.o
  obj-$(CONFIG_IOMMU_HELPER) += iommu-helper.o

lib/audit.c +10 -0

index 76bbed4..fa373bd 100644
@@ -1,6 +1,7 @@
  #include <linux/init.h>
  #include <linux/types.h>
  #include <linux/audit.h>
+#include <asm/audit.h>
  #include <asm/unistd.h>
 
  static unsigned dir_class[] = {

@@ -30,11 +31,20 @@ static unsigned signal_class[] = {
 
  int audit_classify_arch(int arch)
  {
+#ifdef CONFIG_COMPAT
+	if (audit_is_compat(arch))
+		return 1;
+#endif
  	return 0;
  }
 
  int audit_classify_syscall(int abi, unsigned syscall)
  {
+#ifdef CONFIG_COMPAT
+	if (audit_is_compat(abi))
+		return audit_classify_compat_syscall(abi, syscall);
+#endif
+
  	switch(syscall) {
  #ifdef __NR_open
  	case __NR_open:

lib/compat_audit.c new file +64 -0

new file mode 100644
index 0000000..837a6e6
@@ -0,0 +1,64 @@
+#include <linux/init.h>
+#include <linux/types.h>
+#include <linux/audit.h>
+/* FIXME: this might be architecture dependent */
+#include <asm/unistd_32.h>
+
+static unsigned compat_dir_class[] = {
+#include <asm-generic/audit_dir_write.h>
+~0U
+};
+
+static unsigned compat_read_class[] = {
+#include <asm-generic/audit_read.h>
+~0U
+};
+
+static unsigned compat_write_class[] = {
+#include <asm-generic/audit_write.h>
+~0U
+};
+
+static unsigned compat_chattr_class[] = {
+#include <asm-generic/audit_change_attr.h>
+~0U
+};
+
+static unsigned compat_signal_class[] = {
+#include <asm-generic/audit_signal.h>
+~0U
+};
+
+int audit_classify_compat_syscall(int abi, unsigned syscall)
+{
+	switch(syscall) {
+#ifdef __NR_open
+	case __NR_open:
+		return 2;
+#endif
+#ifdef __NR_openat
+	case __NR_openat:
+		return 3;
+#endif
+#ifdef __NR_socketcall
+	case __NR_socketcall:
+		return 4;
+#endif
+	case __NR_execve:
+		return 5;
+	default:
+		return 1;
+	}
+}
+
+static int __init audit_compat_classes_init(void)
+{
+	audit_register_class(AUDIT_CLASS_WRITE, compat_write_class);
+	audit_register_class(AUDIT_CLASS_READ, compat_read_class);
+	audit_register_class(AUDIT_CLASS_DIR_WRITE, compat_dir_class);
+	audit_register_class(AUDIT_CLASS_CHATTR, compat_chattr_class);
+	audit_register_class(AUDIT_CLASS_SIGNAL, compat_signal_class);
+	return 0;
+}
+
+__initcall(audit_compat_classes_init);