audit: log all six syscall arguments in the SYSCALL record

The SYSCALL record currently logs only four of the six syscall arguments (a0-a3), silently discarding the remaining two. This leads to the need for auxiliary records when audit-relevant data lands in the 5th or 6th argument of a syscall.

This series extends the SYSCALL record to log all six arguments, by adding arguments a4 and a5 inline within the existing record.

Rather than plumbing two more argument registers through every architecture's syscall entry path, audit_syscall_entry() now takes a struct pt_regs * and retrieves all six arguments itself via syscall_get_arguments(); the per-arch patches simply pass regs. The two new arguments are also wired into the audit filter, so rules can match on a4 and a5.

To keep the series bisectable, the new pt_regs-based helpers are added first (patch 1), each architecture is converted one per patch, and the final patch removes the legacy argument-register helpers and renames the new ones back to audit_syscall_entry(). Every commit builds on its own.

The audit testsuite runs successfully:

 # make test
 make -C tests test
 Running as   user    root
        with context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
        on   system  Fedora

amcast_joinpart/test ................. ok
backlog_wait_time_actual_reset/test .. ok
bpf/test ............................. ok
coredump/test ........................ ok
exec_execve/test ..................... ok
exec_name/test ....................... ok
fanotify/test ........................ ok
field_compare/test ................... ok
file_create/test ..................... ok
file_delete/test ..................... ok
file_permission/test ................. ok
file_rename/test ..................... ok
filter_device/test ................... ok
filter_exclude/test .................. ok
filter_exit/test ..................... ok
filter_inode/test .................... ok
filter_saddr_fam/test ................ ok
filter_sessionid/test ................ ok
io_uring/test ........................ ok
login_tty/test ....................... ok
lost_reset/test ...................... ok
netfilter_pkt/test ................... ok
signal/test .......................... ok
syscalls_file/test ................... ok
syscall_module/test .................. ok
syscall_socketcall/test .............. ok
time_change/test ..................... ok
user_msg/test ........................ ok
All tests successful.
Result: PASS

Changes in v3:
- Make the series bisectable, as requested by Will Deacon. Rather than changing __audit_syscall_entry()'s signature in place (which broke the build between the core patch and the per-arch conversions), patch 1 now adds audit_syscall_entry_regs()/__audit_syscall_entry_regs() alongside the existing helpers. The per-arch patches switch to the new helpers, and the final patch removes the legacy helpers and renames the new ones back to audit_syscall_entry().
- Drop the alpha conversion patch. Per Magnus Lindholm, alpha is being moved onto the generic entry framework, which removes its private syscall_trace_enter() and routes syscall auditing through syscall_enter_audit(); no alpha-specific change is needed once that series lands. This series should therefore be applied on top of it.
- Add "parisc: mask compat syscall arguments in syscall_get_arguments()" (new patch 8). Moving argument retrieval into syscall_get_arguments() would otherwise drop the low-32-bit masking parisc previously did inline in its compat audit path, exposing the upper 32 bits of the argument registers to audit (and seccomp) for 32-bit tasks. Mask in the helper instead, before the parisc conversion, so the series stays correct and bisectable.

Changes in v2:
- Rework the core change per Will Deacon's suggestion: instead of plumbing all six arguments through every architecture's syscall entry path, __audit_syscall_entry() now takes a struct pt_regs * and retrieves the arguments itself via syscall_get_arguments().
- Per-arch patches now simply pass regs instead of the individual argument registers.
- Fetch the arguments directly into context->argv, dropping the temporary array.

Ricardo Robaina (14):
audit: log all six syscall arguments in the SYSCALL record
arm: pass pt_regs to audit_syscall_entry()
arm64: pass pt_regs to audit_syscall_entry()
csky: pass pt_regs to audit_syscall_entry()
microblaze: pass pt_regs to audit_syscall_entry()
mips: pass pt_regs to audit_syscall_entry()
openrisc: pass pt_regs to audit_syscall_entry()
parisc: mask compat syscall arguments in syscall_get_arguments()
parisc: pass pt_regs to audit_syscall_entry()
sh: pass pt_regs to audit_syscall_entry()
sparc64: pass pt_regs to audit_syscall_entry()
um: pass pt_regs to audit_syscall_entry()
xtensa: pass pt_regs to audit_syscall_entry()
audit: rename audit_syscall_entry_regs() to audit_syscall_entry()

 arch/arm/kernel/ptrace.c          |  3 +--
 arch/arm64/kernel/ptrace.c        |  3 +--
 arch/csky/kernel/ptrace.c         |  2 +-
 arch/microblaze/kernel/ptrace.c   |  2 +-
 arch/mips/kernel/ptrace.c         |  4 +---
 arch/openrisc/kernel/ptrace.c     |  3 +--
 arch/parisc/include/asm/syscall.h | 18 ++++++++++++------
 arch/parisc/kernel/ptrace.c       |  9 ++-------
 arch/sh/kernel/ptrace_32.c        |  3 +--
 arch/sparc/kernel/ptrace_64.c     |  4 +---
 arch/um/kernel/ptrace.c           |  6 +-----
 arch/xtensa/kernel/ptrace.c       |  4 +---
 include/linux/audit.h             | 13 ++++---------
 include/uapi/linux/audit.h        |  2 ++
 kernel/audit.h                    |  2 +-
 kernel/auditfilter.c              |  2 ++
 kernel/auditsc.c                  | 19 ++++++++-----------
 kernel/entry/syscall-common.c     |  4 +---
 18 files changed, 42 insertions(+), 61 deletions(-)

2.55.0

The SYSCALL record currently logs only four of the six syscall arguments (a0-a3). The remaining two are captured but silently discarded before reaching the audit context. This leads to the need for auxiliary records when audit-relevant data lands in the 5th or 6th argument of a syscall.

Extend the SYSCALL record to log all six arguments, by adding arguments a4 and a5 (5th and 6th syscall arguments respectively) inline within the existing record. Also add the two new args to the audit rules switch case, so audit rules can filter on them.

Rather than plumbing two more register arguments through every architecture's syscall entry path, retrieve the arguments from pt_regs via syscall_get_arguments(). To keep the series bisectable, add new helpers audit_syscall_entry_regs() and __audit_syscall_entry_regs() that take a pointer to pt_regs, rather than modifying the existing ones in place. Later patches convert each architecture over to the new helpers, and a final patch removes the legacy helpers and renames the new ones back to the original naming.

audit-testsuite# make test
audit-testsuite# ausearch -i -m SYSCALL
...
type=SYSCALL ... syscall=sendto success=yes exit=1088 a0=0x4
a1=0x7ffe43518b60 a2=0x440 a3=0x0 a4=7ffe43518b4c a5=c
type=SYSCALL ... syscall=openat2 success=yes exit=4 a0=0x3
a1=0x7fffc74692c8 a2=0x7fffc7467390 a3=0x18 a4=0 a5=7fffc74674f8
type=SYSCALL ... syscall=openat success=yes exit=3 a0=AT_FDCWD
a1=0x557ced4141a2 a2=O_RDWR|O_NONBLOCK a3=0x0 a4=0 a5=0
...

---
 include/linux/audit.h         |  8 ++++++
 include/uapi/linux/audit.h    |  2 ++
 kernel/audit.h                |  2 +-
 kernel/auditfilter.c          |  2 ++
 kernel/auditsc.c              | 53 ++++++++++++++++++++++++++++++++++-
 kernel/entry/syscall-common.c |  4 +--
 6 files changed, 66 insertions(+), 5 deletions(-)

index 45abb3722d30..22ffad5b2060 100644
@@ -325,6 +325,7 @@ extern void __audit_uring_entry(u8 op);
 extern void __audit_uring_exit(int success, long code);
 extern void __audit_syscall_entry(int major, unsigned long a0, unsigned long a1,
 				  unsigned long a2, unsigned long a3);
+extern void __audit_syscall_entry_regs(int major, struct pt_regs *regs);
 extern void __audit_syscall_exit(int ret_success, long ret_value);
 extern void __audit_getname(struct filename *name);
 extern void __audit_inode(struct filename *name, const struct dentry *dentry,

@@ -380,6 +381,11 @@ static inline void audit_syscall_entry(int major, unsigned long a0,
 	if (unlikely(audit_context()))
 		__audit_syscall_entry(major, a0, a1, a2, a3);
 }
+static inline void audit_syscall_entry_regs(int major, struct pt_regs *regs)
+{
+	if (unlikely(audit_context()))
+		__audit_syscall_entry_regs(major, regs);
+}
 static inline void audit_syscall_exit(void *pt_regs)
 {
 	if (unlikely(audit_context())) {

@@ -615,6 +621,8 @@ static inline void audit_syscall_entry(int major, unsigned long a0,
 				       unsigned long a1, unsigned long a2,
 				       unsigned long a3)
 { }
+static inline void audit_syscall_entry_regs(int major, struct pt_regs *regs)
+{ }
 static inline void audit_syscall_exit(void *pt_regs)
 { }
 static inline bool audit_dummy_context(void)

index e8f5ce677df7..6726059d6df1 100644
@@ -303,6 +303,8 @@
 #define AUDIT_ARG1      (AUDIT_ARG0+1)
 #define AUDIT_ARG2      (AUDIT_ARG0+2)
 #define AUDIT_ARG3      (AUDIT_ARG0+3)
+#define AUDIT_ARG4      (AUDIT_ARG0+4)
+#define AUDIT_ARG5      (AUDIT_ARG0+5)
 
 #define AUDIT_FILTERKEY	210
 

index 92d5e723d570..83011b14af18 100644
@@ -117,7 +117,7 @@ struct audit_context {
 	struct audit_stamp  stamp;	/* event identifier */
 	int		    major;      /* syscall number */
 	int		    uring_op;   /* uring operation */
-	unsigned long	    argv[4];    /* syscall arguments */
+	unsigned long	    argv[6];    /* syscall arguments */
 	long		    return_code;/* syscall return code */
 	u64		    prio;
 	int		    return_valid; /* return code is valid */

index f52645625214..cded3696e3c5 100644
@@ -358,6 +358,8 @@ static int audit_field_valid(struct audit_entry *entry, struct audit_field *f)
 	case AUDIT_ARG1:
 	case AUDIT_ARG2:
 	case AUDIT_ARG3:
+	case AUDIT_ARG4:
+	case AUDIT_ARG5:
 	case AUDIT_PERS: /* <uapi/linux/personality.h> */
 	case AUDIT_DEVMINOR:
 		/* all ops are valid */

index b8eac9efb6fd..70941008beb6 100644
@@ -22,9 +22,7 @@ void trace_syscall_exit(struct pt_regs *regs, long ret)
 void syscall_enter_audit(struct pt_regs *regs)
 {
 	long syscall = syscall_get_nr(current, regs);
-	unsigned long args[6];
 
-	syscall_get_arguments(current, regs, args);
-	__audit_syscall_entry(syscall, args[0], args[1], args[2], args[3]);
+	__audit_syscall_entry_regs(syscall, regs);
 }
 #endif

2.55.0

audit_syscall_entry() now takes a pointer to pt_regs and extracts the syscall arguments itself via syscall_get_arguments(). Drop the individual argument registers from the call and pass regs instead.

---
 arch/arm/kernel/ptrace.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

index ed7a2a87a670..3c5d7fd733ec 100644
@@ -868,8 +868,7 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
 	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
 		trace_sys_enter(regs, scno);
 
-	audit_syscall_entry(scno, regs->ARM_r0, regs->ARM_r1, regs->ARM_r2,
-			    regs->ARM_r3);
+	audit_syscall_entry_regs(scno, regs);
 
 	return scno;
 }

2.55.0

From an audit perspective I guess one could make arguments for both cases being correct. In one case you are logging what the user actually intended; in the other you are logging what is actually being executed. However, barring a deep dive into some requirement list, I think the best thing to do is to match the current behavior.

paul-moore.com

audit_syscall_entry() now takes a pointer to pt_regs and extracts the syscall arguments itself via syscall_get_arguments(). Drop the individual argument registers from the call and pass regs instead.

---
 arch/arm64/kernel/ptrace.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

index f743cbec1c3a..2bcbeafe26a3 100644
@@ -2476,8 +2476,7 @@ int syscall_trace_enter(struct pt_regs *regs)
 	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
 		trace_sys_enter(regs, regs->syscallno);
 
-	audit_syscall_entry(regs->syscallno, regs->orig_x0, regs->regs[1],
-			    regs->regs[2], regs->regs[3]);
+	audit_syscall_entry_regs(regs->syscallno, regs);
 
 	return regs->syscallno;
 }

2.55.0

audit_syscall_entry() now takes a pointer to pt_regs and extracts the syscall arguments itself via syscall_get_arguments(). Drop the individual argument registers from the call and pass regs instead.

---
 arch/csky/kernel/ptrace.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index ee2867a1576e..e61b1408737c 100644
@@ -329,7 +329,7 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
 	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
 		trace_sys_enter(regs, syscall_get_nr(current, regs));
 
-	audit_syscall_entry(regs_syscallid(regs), regs->a0, regs->a1, regs->a2, regs->a3);
+	audit_syscall_entry_regs(regs_syscallid(regs), regs);
 	return 0;
 }
 

2.55.0

audit_syscall_entry() now takes a pointer to pt_regs and extracts the syscall arguments itself via syscall_get_arguments(). Drop the individual argument registers from the call and pass regs instead.

---
 arch/microblaze/kernel/ptrace.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 236264e932d6..d0a540b7370f 100644
@@ -147,7 +147,7 @@ asmlinkage unsigned long do_syscall_trace_enter(struct pt_regs *regs)
 		 */
 		ret = -1L;
 
-	audit_syscall_entry(regs->r12, regs->r5, regs->r6, regs->r7, regs->r8);
+	audit_syscall_entry_regs(regs->r12, regs);
 
 	return ret ?: regs->r12;
 }

2.55.0

audit_syscall_entry() now takes a pointer to pt_regs and extracts the syscall arguments itself via syscall_get_arguments(). Drop the individual argument registers from the call and pass regs instead.

---
 arch/mips/kernel/ptrace.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

index 17dc7249b8ca..c6f4e801cfae 100644
@@ -1338,9 +1338,7 @@ asmlinkage long syscall_trace_enter(struct pt_regs *regs)
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->regs[2]);
 
-	audit_syscall_entry(current_thread_info()->syscall,
-			    regs->regs[4], regs->regs[5],
-			    regs->regs[6], regs->regs[7]);
+	audit_syscall_entry_regs(current_thread_info()->syscall, regs);
 
 	/*
 	 * Negative syscall numbers are mistaken for rejected syscalls, but

2.55.0

audit_syscall_entry() now takes a pointer to pt_regs and extracts the syscall arguments itself via syscall_get_arguments(). Drop the individual argument registers from the call and pass regs instead.

---
 arch/openrisc/kernel/ptrace.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

index 287a9718f0c6..78294c84e4de 100644
@@ -301,8 +301,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 		 */
 		ret = -1L;
 
-	audit_syscall_entry(regs->gpr[11], regs->gpr[3], regs->gpr[4],
-			    regs->gpr[5], regs->gpr[6]);
+	audit_syscall_entry_regs(regs->gpr[11], regs);
 
 	return ret ? : regs->gpr[11];
 }

2.55.0

A 32-bit compat task may leave garbage in the upper 32 bits of the argument registers. Mask it off in syscall_get_arguments() so that in-kernel consumers such as seccomp and audit observe the same values the syscall actually used.

This previously happened for audit in the parisc do_syscall_trace_enter() compat path; do it in the helper so all callers benefit and to prepare for passing pt_regs to audit_syscall_entry().

---
 arch/parisc/include/asm/syscall.h | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

index c11222798ab2..9d10fada3b48 100644
@@ -28,12 +28,18 @@ static inline void syscall_get_arguments(struct task_struct *tsk,
 					 struct pt_regs *regs,
 					 unsigned long *args)
 {
-	args[5] = regs->gr[21];
-	args[4] = regs->gr[22];
-	args[3] = regs->gr[23];
-	args[2] = regs->gr[24];
-	args[1] = regs->gr[25];
-	args[0] = regs->gr[26];
+	unsigned long mask = -1UL;
+
+	/* Mask off garbage in the upper 32 bits for compat tasks. */
+	if (__is_compat_task(tsk))
+		mask = 0xffffffff;
+
+	args[5] = regs->gr[21] & mask;
+	args[4] = regs->gr[22] & mask;
+	args[3] = regs->gr[23] & mask;
+	args[2] = regs->gr[24] & mask;
+	args[1] = regs->gr[25] & mask;
+	args[0] = regs->gr[26] & mask;
 }
 
 static inline void syscall_set_arguments(struct task_struct *tsk,

2.55.0

audit_syscall_entry() now takes a pointer to pt_regs and extracts the syscall arguments itself via syscall_get_arguments(). Drop the individual argument registers from the call and pass regs instead.

Per-argument compat masking is now handled in syscall_get_arguments() (see the preceding patch), so it is dropped here; the syscall number still needs masking for compat tasks and is left in place.

---
 arch/parisc/kernel/ptrace.c | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

index 1d9e210702e1..4e62d6bd6466 100644
@@ -359,15 +359,10 @@ long do_syscall_trace_enter(struct pt_regs *regs)
 
 #ifdef CONFIG_64BIT
 	if (!is_compat_task())
-		audit_syscall_entry(regs->gr[20], regs->gr[26], regs->gr[25],
-				    regs->gr[24], regs->gr[23]);
+		audit_syscall_entry_regs(regs->gr[20], regs);
 	else
 #endif
-		audit_syscall_entry(regs->gr[20] & 0xffffffff,
-			regs->gr[26] & 0xffffffff,
-			regs->gr[25] & 0xffffffff,
-			regs->gr[24] & 0xffffffff,
-			regs->gr[23] & 0xffffffff);
+		audit_syscall_entry_regs(regs->gr[20] & 0xffffffff, regs);
 
 	/*
 	 * Sign extend the syscall number to 64bit since it may have been

2.55.0

audit_syscall_entry() now takes a pointer to pt_regs and extracts the syscall arguments itself via syscall_get_arguments(). Drop the individual argument registers from the call and pass regs instead.

---
 arch/sh/kernel/ptrace_32.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

index 8794081483fb..c82d336611ef 100644
@@ -466,8 +466,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->regs[0]);
 
-	audit_syscall_entry(regs->regs[3], regs->regs[4], regs->regs[5],
-			    regs->regs[6], regs->regs[7]);
+	audit_syscall_entry_regs(regs->regs[3], regs);
 
 	return 0;
 }

2.55.0

audit_syscall_entry() now takes a pointer to pt_regs and extracts the syscall arguments itself via syscall_get_arguments(). Drop the individual argument registers from the call and pass regs instead.

---
 arch/sparc/kernel/ptrace_64.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

index 825ddf55fece..6197de10b45c 100644
@@ -1098,9 +1098,7 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->u_regs[UREG_G1]);
 
-	audit_syscall_entry(regs->u_regs[UREG_G1], regs->u_regs[UREG_I0],
-			    regs->u_regs[UREG_I1], regs->u_regs[UREG_I2],
-			    regs->u_regs[UREG_I3]);
+	audit_syscall_entry_regs(regs->u_regs[UREG_G1], regs);
 
 	return ret;
 }

2.55.0

audit_syscall_entry() now takes a pointer to pt_regs and extracts the syscall arguments itself via syscall_get_arguments(). Drop the individual argument registers from the call and pass regs instead.

---
 arch/um/kernel/ptrace.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

index 7da0a5223aa6..17c285e49ddc 100644
@@ -123,11 +123,7 @@ static void send_sigtrap(struct uml_pt_regs *regs, int error_code)
  */
 int syscall_trace_enter(struct pt_regs *regs)
 {
-	audit_syscall_entry(UPT_SYSCALL_NR(&regs->regs),
-			    UPT_SYSCALL_ARG1(&regs->regs),
-			    UPT_SYSCALL_ARG2(&regs->regs),
-			    UPT_SYSCALL_ARG3(&regs->regs),
-			    UPT_SYSCALL_ARG4(&regs->regs));
+	audit_syscall_entry_regs(UPT_SYSCALL_NR(&regs->regs), regs);
 
 	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
 		trace_sys_enter(regs, UPT_SYSCALL_NR(&regs->regs));

2.55.0

audit_syscall_entry() now takes a pointer to pt_regs and extracts the syscall arguments itself via syscall_get_arguments(). Drop the individual argument registers from the call and pass regs instead.

---
 arch/xtensa/kernel/ptrace.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

index 364e4fdabb00..86e4679b5869 100644
@@ -561,9 +561,7 @@ int do_syscall_trace_enter(struct pt_regs *regs)
 	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
 		trace_sys_enter(regs, syscall_get_nr(current, regs));
 
-	audit_syscall_entry(regs->syscall, regs->areg[6],
-			    regs->areg[3], regs->areg[4],
-			    regs->areg[5]);
+	audit_syscall_entry_regs(regs->syscall, regs);
 	return 1;
 }
 

2.55.0

Now that every architecture has been converted to the pt_regs-based audit_syscall_entry_regs(), the legacy audit_syscall_entry() and __audit_syscall_entry() helpers that took the individual syscall argument registers (a0-a3) no longer have any callers.

Remove those legacy helpers and rename audit_syscall_entry_regs() and __audit_syscall_entry_regs() back to audit_syscall_entry() and __audit_syscall_entry(), restoring the original naming.

The _regs variants were introduced separately, and the architectures converted one per patch, specifically so this final rename is the only step that removes the old prototype. That keeps the series bisectable:
every commit builds, and no caller is ever left referencing a helper that has been removed.

---
 arch/arm/kernel/ptrace.c        |  2 +-
 arch/arm64/kernel/ptrace.c      |  2 +-
 arch/csky/kernel/ptrace.c       |  2 +-
 arch/microblaze/kernel/ptrace.c |  2 +-
 arch/mips/kernel/ptrace.c       |  2 +-
 arch/openrisc/kernel/ptrace.c   |  2 +-
 arch/parisc/kernel/ptrace.c     |  4 +--
 arch/sh/kernel/ptrace_32.c      |  2 +-
 arch/sparc/kernel/ptrace_64.c   |  2 +-
 arch/um/kernel/ptrace.c         |  2 +-
 arch/xtensa/kernel/ptrace.c     |  2 +-
 include/linux/audit.h           | 21 +++---------
 kernel/auditsc.c                | 58 ++-------------------------------
 kernel/entry/syscall-common.c   |  2 +-
 14 files changed, 19 insertions(+), 86 deletions(-)

index 3c5d7fd733ec..e103ec2661cd 100644
@@ -868,7 +868,7 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
 	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
 		trace_sys_enter(regs, scno);
 
-	audit_syscall_entry_regs(scno, regs);
+	audit_syscall_entry(scno, regs);
 
 	return scno;
 }

index 2bcbeafe26a3..65532b2a8cd4 100644
@@ -2476,7 +2476,7 @@ int syscall_trace_enter(struct pt_regs *regs)
 	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
 		trace_sys_enter(regs, regs->syscallno);
 
-	audit_syscall_entry_regs(regs->syscallno, regs);
+	audit_syscall_entry(regs->syscallno, regs);
 
 	return regs->syscallno;
 }

index e61b1408737c..5c3051bcd78c 100644
@@ -329,7 +329,7 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
 	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
 		trace_sys_enter(regs, syscall_get_nr(current, regs));
 
-	audit_syscall_entry_regs(regs_syscallid(regs), regs);
+	audit_syscall_entry(regs_syscallid(regs), regs);
 	return 0;
 }
 

index d0a540b7370f..5fe9e3a150f4 100644
@@ -147,7 +147,7 @@ asmlinkage unsigned long do_syscall_trace_enter(struct pt_regs *regs)
 		 */
 		ret = -1L;
 
-	audit_syscall_entry_regs(regs->r12, regs);
+	audit_syscall_entry(regs->r12, regs);
 
 	return ret ?: regs->r12;
 }

index c6f4e801cfae..7a09b4671a54 100644
@@ -1338,7 +1338,7 @@ asmlinkage long syscall_trace_enter(struct pt_regs *regs)
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->regs[2]);
 
-	audit_syscall_entry_regs(current_thread_info()->syscall, regs);
+	audit_syscall_entry(current_thread_info()->syscall, regs);
 
 	/*
 	 * Negative syscall numbers are mistaken for rejected syscalls, but

index 78294c84e4de..eca613b84ff8 100644
@@ -301,7 +301,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 		 */
 		ret = -1L;
 
-	audit_syscall_entry_regs(regs->gpr[11], regs);
+	audit_syscall_entry(regs->gpr[11], regs);
 
 	return ret ? : regs->gpr[11];
 }

index 4e62d6bd6466..948e0cf29ba4 100644
@@ -359,10 +359,10 @@ long do_syscall_trace_enter(struct pt_regs *regs)
 
 #ifdef CONFIG_64BIT
 	if (!is_compat_task())
-		audit_syscall_entry_regs(regs->gr[20], regs);
+		audit_syscall_entry(regs->gr[20], regs);
 	else
 #endif
-		audit_syscall_entry_regs(regs->gr[20] & 0xffffffff, regs);
+		audit_syscall_entry(regs->gr[20] & 0xffffffff, regs);
 
 	/*
 	 * Sign extend the syscall number to 64bit since it may have been

index c82d336611ef..e138f529ee7e 100644
@@ -466,7 +466,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->regs[0]);
 
-	audit_syscall_entry_regs(regs->regs[3], regs);
+	audit_syscall_entry(regs->regs[3], regs);
 
 	return 0;
 }

index 6197de10b45c..b162585b4a74 100644
@@ -1098,7 +1098,7 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->u_regs[UREG_G1]);
 
-	audit_syscall_entry_regs(regs->u_regs[UREG_G1], regs);
+	audit_syscall_entry(regs->u_regs[UREG_G1], regs);
 
 	return ret;
 }

index 17c285e49ddc..bdc1b18bb342 100644
@@ -123,7 +123,7 @@ static void send_sigtrap(struct uml_pt_regs *regs, int error_code)
  */
 int syscall_trace_enter(struct pt_regs *regs)
 {
-	audit_syscall_entry_regs(UPT_SYSCALL_NR(&regs->regs), regs);
+	audit_syscall_entry(UPT_SYSCALL_NR(&regs->regs), regs);
 
 	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
 		trace_sys_enter(regs, UPT_SYSCALL_NR(&regs->regs));

index 86e4679b5869..327e00c2ebde 100644
@@ -561,7 +561,7 @@ int do_syscall_trace_enter(struct pt_regs *regs)
 	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
 		trace_sys_enter(regs, syscall_get_nr(current, regs));
 
-	audit_syscall_entry_regs(regs->syscall, regs);
+	audit_syscall_entry(regs->syscall, regs);
 	return 1;
 }
 

index 22ffad5b2060..9ce5962bc537 100644
@@ -323,9 +323,7 @@ extern int  audit_alloc(struct task_struct *task);
 extern void __audit_free(struct task_struct *task);
 extern void __audit_uring_entry(u8 op);
 extern void __audit_uring_exit(int success, long code);
-extern void __audit_syscall_entry(int major, unsigned long a0, unsigned long a1,
-				  unsigned long a2, unsigned long a3);
-extern void __audit_syscall_entry_regs(int major, struct pt_regs *regs);
+extern void __audit_syscall_entry(int major, struct pt_regs *regs);
 extern void __audit_syscall_exit(int ret_success, long ret_value);
 extern void __audit_getname(struct filename *name);
 extern void __audit_inode(struct filename *name, const struct dentry *dentry,

@@ -374,17 +372,10 @@ static inline void audit_uring_exit(int success, long code)
 	if (unlikely(audit_context()))
 		__audit_uring_exit(success, code);
 }
-static inline void audit_syscall_entry(int major, unsigned long a0,
-				       unsigned long a1, unsigned long a2,
-				       unsigned long a3)
+static inline void audit_syscall_entry(int major, struct pt_regs *regs)
 {
 	if (unlikely(audit_context()))
-		__audit_syscall_entry(major, a0, a1, a2, a3);
-}
-static inline void audit_syscall_entry_regs(int major, struct pt_regs *regs)
-{
-	if (unlikely(audit_context()))
-		__audit_syscall_entry_regs(major, regs);
+		__audit_syscall_entry(major, regs);
 }
 static inline void audit_syscall_exit(void *pt_regs)
 {

@@ -617,11 +608,7 @@ static inline void audit_uring_entry(u8 op)
 { }
 static inline void audit_uring_exit(int success, long code)
 { }
-static inline void audit_syscall_entry(int major, unsigned long a0,
-				       unsigned long a1, unsigned long a2,
-				       unsigned long a3)
-{ }
-static inline void audit_syscall_entry_regs(int major, struct pt_regs *regs)
+static inline void audit_syscall_entry(int major, struct pt_regs *regs)
 { }
 static inline void audit_syscall_exit(void *pt_regs)
 { }

index 70941008beb6..471db2a8e09d 100644
@@ -23,6 +23,6 @@ void syscall_enter_audit(struct pt_regs *regs)
 {
 	long syscall = syscall_get_nr(current, regs);
 
-	__audit_syscall_entry_regs(syscall, regs);
+	__audit_syscall_entry(syscall, regs);
 }
 #endif

2.55.0

Thanks Ricardo, this looks great!

There are a few things in some of the individual patches which I reply to in a minute, but there are a couple of "global" things that I wanted to mention:

* As pointed out by Sashiko, when you were converting all of the arches, it looks like you missed alpha. I took a quick look and it appears that it should be a pretty straightforward conversion like most of the others.

* We need to get ACKs from all the various arch maintainers. Aside from the parisc changes all of your arch specific patches are trivial (and cleaner than the existing code IMO) so I don't expect anyone to complain, but getting ACKs will likely take some time. Even the parisc patches aren't that bad, and arguably they fix a problem for seccomp so that should make asking for ACKs easier :)

Since I expect chasing down all the various maintainers for ACKs will take a little while, and I'd like to start getting this patchset some basic testing, I'm going to merge it into dev-staging now. While the dev-staging branch doesn't feed into linux-next (this isn't likely to land in the next merge window) it is one of the branches that gets tested automatically and included in my kernel-secnext RPM builds. This also means you won't need to worry about keeping this patchset up-to-date with rebasing, as I rebase dev-staging as needed (it intentionally isn't a stable branch). Going forward, if there are any minor changes to this patchset, e.g. a few line change in one of two patches, please just send a fixup patchset based against audit/dev-staging and I'll squash it into the relevant patch in the series. However, in the unlikely event that a major rewrite is needed, just send a new patchset ... but I'll be very surprised if that happens here :)

paul-moore.com

Thanks, Paul!

I've actually dropped the alpha patch as per Magnus's request [1].

[1] https://lore.kernel.org/audit/CA+=Fv5T4826T2sd0Gbh-nfZsqcWK_phdBKy4BLWOvDTt92t5Eg@mail.gmail.com/

Sounds good!

-Ricardo

...

The problem is that as things stand, this patchset breaks the build on Alpha. Perhaps this gets resolved during the current merge window, but as you know we can't break the kernel build ...

https://lore.kernel.org/oe-kbuild-all/[email protected]

paul-moore.com

Of course, you're absolutely right that we can't break the build. I was afraid that this dependency might cause trouble.

I noticed Magnus posted a pull request a few days ago containing the "alpha: enable GENERIC_ENTRY" series [1]. It seems this will get resolved during the current merge window.

For future reference, what's the best way to handle dependencies on other subsystem changes like this?

[1] https://lore.kernel.org/linux-alpha/[email protected]/

-Ricardo

... and it has, or at least it appears to me to be resolved. I rebased the audit/dev-staging branch against v7.4-rc1 and Alpha does indeed appear to be using the generic syscall entry/exit code in v7.4. I think we should be all set here wrt Alpha, thanks.

Generally speaking communication and coordination :) Talk with the subsystem devs/maintainers to understand what they are doing, let them know what you want to do, and find the best way to order things so that it all lands in Linus' tree without making a mess. In this particular case, with the syscall arg audit patchset not being ready (missing maintainer ACKs) and the Alpha changes going into v7.4 it turns out to be quite easy, which is an important lesson: sometimes it is better to defer a new feature for a release just to ease the coordination burden, enable better testing, etc.

paul-moore.com

I'm happy to hear it.

Thanks, Paul!