Skip to contentSkip to conversation

Fix a bug of "autrace -r /bin/ls" in i386

PATCH In review Peng Haitao 2 participants 3 messages Nov 5, 2010 – Dec 21, 2010 Library code

lore
Share & tools
lore

Peng Haitao

author
#0 lore raw

PATCH 1/1 Fix a bug of "autrace -r /bin/ls" in i386

Hello Steve,

When execute "autrace -r /bin/ls" in i386, The error message "Error inserting audit rule for pid=349" will be outputed.

When execute "ausyscall i386 connect", The error message "Unknown syscall connect using i386 lookup table" will be outputed.

After apply the patch,
The output of "ausyscall i386 connect" is "socketcall 102".
The output of "autrace -r /bin/ls" should be OK.

Signed-off-by Peng Haitao <[email protected]>
---
 lib/lookup_table.c          |   36 ++++++++++++++++++++++++++++++++++++
 tools/ausyscall/ausyscall.c |   36 ++++++++++++++++++++++++++++++++++++
 2 files changed, 72 insertions(+), 0 deletions(-)
lib/lookup_table.c +36 -0
index b0abe07..c6f892f 100755
@@ -29,6 +29,7 @@
 #include <stdlib.h>
 #include <ctype.h>
 #include <errno.h>
+#include <linux/net.h>
 
 #include "libaudit.h"
 #include "gen_tables.h"

@@ -96,6 +97,33 @@ const char *audit_field_to_name(int field)
 	return field_i2s(field);
 }
 
+/* This is the name/value pair used by search tables */
+struct nv_pair {
+	int        value;
+	const char *name;
+};
+
+static struct nv_pair socktab[] = {
+	{SYS_SOCKET, "socket"},
+	{SYS_BIND, "bind"},
+	{SYS_CONNECT, "connect"},
+	{SYS_LISTEN, "listen"},
+	{SYS_ACCEPT, "accept"},
+	{SYS_GETSOCKNAME, "getsockname"},
+	{SYS_GETPEERNAME, "getpeername"},
+	{SYS_SOCKETPAIR, "socketpair"},
+	{SYS_SEND, "send"},
+	{SYS_RECV, "recv"},
+	{SYS_SENDTO, "sendto"},
+	{SYS_RECVFROM, "recvfrom"},
+	{SYS_SHUTDOWN, "shutdown"},
+	{SYS_SETSOCKOPT, "setsockopt"},
+	{SYS_GETSOCKOPT, "getsockopt"},
+	{SYS_SENDMSG, "sendmsg"},
+	{SYS_RECVMSG, "recvmsg"}
+};
+#define SOCK_NAMES (sizeof(socktab)/sizeof(socktab[0]))
+
 int audit_name_to_syscall(const char *sc, int machine)
 {
 	int res, found;

@@ -104,6 +132,14 @@ int audit_name_to_syscall(const char *sc, int machine)
 	{
 		case MACH_X86:
 			found = i386_syscall_s2i(sc, &res);
+			if (!found) {
+				int i;
+				for(i = 0; i < SOCK_NAMES; i++)
+					if (strcmp(socktab[i].name, sc) == 0) {
+						sc = "socketcall";
+						found = i386_syscall_s2i(sc, &res);
+					}
+			}
 			break;
 		case MACH_86_64:
 			found = x86_64_syscall_s2i(sc, &res);
tools/ausyscall/ausyscall.c +36 -0
index 565336f..772aa00 100755
@@ -25,10 +25,38 @@
 #include <string.h>
 #include <stdlib.h>
 #include <ctype.h>
+#include <linux/net.h>
 #include "libaudit.h"
 
 #define LAST_SYSCALL 1400	// IA64 is in the 1300's right now
 
+/* This is the name/value pair used by search tables */
+struct nv_pair {
+	int        value;
+	const char *name;
+};
+
+static struct nv_pair socktab[] = {
+	{SYS_SOCKET, "socket"},
+	{SYS_BIND, "bind"},
+	{SYS_CONNECT, "connect"},
+	{SYS_LISTEN, "listen"},
+	{SYS_ACCEPT, "accept"},
+	{SYS_GETSOCKNAME, "getsockname"},
+	{SYS_GETPEERNAME, "getpeername"},
+	{SYS_SOCKETPAIR, "socketpair"},
+	{SYS_SEND, "send"},
+	{SYS_RECV, "recv"},
+	{SYS_SENDTO, "sendto"},
+	{SYS_RECVFROM, "recvfrom"},
+	{SYS_SHUTDOWN, "shutdown"},
+	{SYS_SETSOCKOPT, "setsockopt"},
+	{SYS_GETSOCKOPT, "getsockopt"},
+	{SYS_SENDMSG, "sendmsg"},
+	{SYS_RECVMSG, "recvmsg"}
+};
+#define SOCK_NAMES (sizeof(socktab)/sizeof(socktab[0]))
+
 void usage(void)
 {
 	fprintf(stderr, "usage: ausyscall [arch] name | number | --dump | --exact\n");

@@ -119,6 +147,14 @@ int main(int argc, char *argv[])
 				if (n && strcasestr(n, name)) {
 					found = 1;
 					printf("%-18s %d\n", n, i);
+				} else if (n && strcmp(n, "socketcall") == 0) {
+					int j = 0;
+					for (j = 0; j < SOCK_NAMES; j++)
+						if (strcmp(socktab[j].name, name) == 0) {
+							found = 1;
+							printf("%-18s %d\n", n, i);
+							break;
+						}
 				}
 			}
 			if (!found) {
Signature · 6 lines
1.7.0.1


-- 
Best Regards,
Peng Haitao
author
#1 lore raw

Hello Steve,

When execute "autrace -r /bin/ls" in i386, The error message "Error inserting audit rule for pid=349" will be outputed.

After apply the patch,
When the target system is a i386 processor, autrace will not trace socket system calls.

Signed-off-by Peng Haitao <[email protected]>
---
 src/autrace.c |   15 ++++++++++-----
 1 files changed, 10 insertions(+), 5 deletions(-)
src/autrace.c +10 -5
index e1ff695..ed7ae22 100755
@@ -84,11 +84,16 @@ static int insert_rule(int audit_fd, const char *field)
 		rc |= audit_rule_syscallbyname_data(rule, "readlink");
 		rc |= audit_rule_syscallbyname_data(rule, "readlinkat");
 		rc |= audit_rule_syscallbyname_data(rule, "execve");
-		rc |= audit_rule_syscallbyname_data(rule, "connect");
-		rc |= audit_rule_syscallbyname_data(rule, "bind");
-		rc |= audit_rule_syscallbyname_data(rule, "accept");
-		rc |= audit_rule_syscallbyname_data(rule, "sendto");
-		rc |= audit_rule_syscallbyname_data(rule, "recvfrom");
+
+		int machine = audit_detect_machine();
+		if (machine != MACH_X86) {
+			rc |= audit_rule_syscallbyname_data(rule, "connect");
+			rc |= audit_rule_syscallbyname_data(rule, "bind");
+			rc |= audit_rule_syscallbyname_data(rule, "accept");
+			rc |= audit_rule_syscallbyname_data(rule, "sendto");
+			rc |= audit_rule_syscallbyname_data(rule, "recvfrom");
+		}
+
 		rc |= audit_rule_syscallbyname_data(rule, "sendfile");
 	} else
 		rc = audit_rule_syscallbyname_data(rule, "all");
Signature · 4 lines
1.7.0.1


Peng Haitao said the following on 2010-11-5 18:36:
Quoted 137 lines

Hello Steve,

When execute "autrace -r /bin/ls" in i386, The error message "Error inserting audit rule for pid=349" will be outputed.

When execute "ausyscall i386 connect", The error message "Unknown syscall connect using i386 lookup table" will be outputed.

After apply the patch,
The output of "ausyscall i386 connect" is "socketcall 102".
The output of "autrace -r /bin/ls" should be OK.

Signed-off-by Peng Haitao <[email protected]>
---
 lib/lookup_table.c          |   36 ++++++++++++++++++++++++++++++++++++
 tools/ausyscall/ausyscall.c |   36 ++++++++++++++++++++++++++++++++++++
 2 files changed, 72 insertions(+), 0 deletions(-)
lib/lookup_table.c +36 -0
index b0abe07..c6f892f 100755
@@ -29,6 +29,7 @@
 #include <stdlib.h>
 #include <ctype.h>
 #include <errno.h>
+#include <linux/net.h>
 
 #include "libaudit.h"
 #include "gen_tables.h"

@@ -96,6 +97,33 @@ const char *audit_field_to_name(int field)
 	return field_i2s(field);
 }
 
+/* This is the name/value pair used by search tables */
+struct nv_pair {
+	int        value;
+	const char *name;
+};
+
+static struct nv_pair socktab[] = {
+	{SYS_SOCKET, "socket"},
+	{SYS_BIND, "bind"},
+	{SYS_CONNECT, "connect"},
+	{SYS_LISTEN, "listen"},
+	{SYS_ACCEPT, "accept"},
+	{SYS_GETSOCKNAME, "getsockname"},
+	{SYS_GETPEERNAME, "getpeername"},
+	{SYS_SOCKETPAIR, "socketpair"},
+	{SYS_SEND, "send"},
+	{SYS_RECV, "recv"},
+	{SYS_SENDTO, "sendto"},
+	{SYS_RECVFROM, "recvfrom"},
+	{SYS_SHUTDOWN, "shutdown"},
+	{SYS_SETSOCKOPT, "setsockopt"},
+	{SYS_GETSOCKOPT, "getsockopt"},
+	{SYS_SENDMSG, "sendmsg"},
+	{SYS_RECVMSG, "recvmsg"}
+};
+#define SOCK_NAMES (sizeof(socktab)/sizeof(socktab[0]))
+
 int audit_name_to_syscall(const char *sc, int machine)
 {
 	int res, found;

@@ -104,6 +132,14 @@ int audit_name_to_syscall(const char *sc, int machine)
 	{
 		case MACH_X86:
 			found = i386_syscall_s2i(sc, &res);
+			if (!found) {
+				int i;
+				for(i = 0; i < SOCK_NAMES; i++)
+					if (strcmp(socktab[i].name, sc) == 0) {
+						sc = "socketcall";
+						found = i386_syscall_s2i(sc, &res);
+					}
+			}
 			break;
 		case MACH_86_64:
 			found = x86_64_syscall_s2i(sc, &res);
tools/ausyscall/ausyscall.c +36 -0
index 565336f..772aa00 100755
@@ -25,10 +25,38 @@
 #include <string.h>
 #include <stdlib.h>
 #include <ctype.h>
+#include <linux/net.h>
 #include "libaudit.h"
 
 #define LAST_SYSCALL 1400	// IA64 is in the 1300's right now
 
+/* This is the name/value pair used by search tables */
+struct nv_pair {
+	int        value;
+	const char *name;
+};
+
+static struct nv_pair socktab[] = {
+	{SYS_SOCKET, "socket"},
+	{SYS_BIND, "bind"},
+	{SYS_CONNECT, "connect"},
+	{SYS_LISTEN, "listen"},
+	{SYS_ACCEPT, "accept"},
+	{SYS_GETSOCKNAME, "getsockname"},
+	{SYS_GETPEERNAME, "getpeername"},
+	{SYS_SOCKETPAIR, "socketpair"},
+	{SYS_SEND, "send"},
+	{SYS_RECV, "recv"},
+	{SYS_SENDTO, "sendto"},
+	{SYS_RECVFROM, "recvfrom"},
+	{SYS_SHUTDOWN, "shutdown"},
+	{SYS_SETSOCKOPT, "setsockopt"},
+	{SYS_GETSOCKOPT, "getsockopt"},
+	{SYS_SENDMSG, "sendmsg"},
+	{SYS_RECVMSG, "recvmsg"}
+};
+#define SOCK_NAMES (sizeof(socktab)/sizeof(socktab[0]))
+
 void usage(void)
 {
 	fprintf(stderr, "usage: ausyscall [arch] name | number | --dump | --exact\n");

@@ -119,6 +147,14 @@ int main(int argc, char *argv[])
 				if (n && strcasestr(n, name)) {
 					found = 1;
 					printf("%-18s %d\n", n, i);
+				} else if (n && strcmp(n, "socketcall") == 0) {
+					int j = 0;
+					for (j = 0; j < SOCK_NAMES; j++)
+						if (strcmp(socktab[j].name, name) == 0) {
+							found = 1;
+							printf("%-18s %d\n", n, i);
+							break;
+						}
 				}
 			}
 			if (!found) {
Signature · 13 lines
Best Regards,
Peng Haitao
--------------------------------------------------
Peng Haitao
Development Dept.I
Nanjing Fujitsu Nanda Software Tech. Co., Ltd.(FNST)
No.6 Wenzhu Road, Nanjing, 210012, China 
TEL: +86+25-86630566-8513
FUJITSU INTERNAL: 7998-8513
FAX: +86+25-83317685
EMail: [email protected]
--------------------------------------------------
This communication is for use by the intended recipient(s) only and may contain information that is privileged, confidential and exempt from disclosure under applicable law. If you are not an intended recipient of this communication, you are hereby notified that any dissemination, distribution or copying hereof is strictly prohibited.  If you have received this communication in error, please notify me by reply e-mail, permanently delete this communication from your system, and destroy any hard copies you may have printed
#2 lore raw
Quoted 10 lines · Peng Haitao

Hello Steve,

When execute "autrace -r /bin/ls" in i386, The error message "Error inserting audit rule for pid=349" will be outputed.

After apply the patch,
When the target system is a i386 processor, autrace will not trace socket system calls.

Signed-off-by Peng Haitao <[email protected]>

Applied with some adjustments. Thanks.

-Steve