lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Fri, 17 Jan 2014 17:13:13 +0900 From: AKASHI Takahiro <takahiro.akashi@...aro.org> To: viro@...iv.linux.org.uk, eparis@...hat.com, rgb@...hat.com, catalin.marinas@....com, will.deacon@....com Cc: arndb@...db.de, linux-arm-kernel@...ts.infradead.org, linaro-kernel@...ts.linaro.org, linux-kernel@...r.kernel.org, linux-audit@...hat.com, patches@...aro.org, AKASHI Takahiro <takahiro.akashi@...aro.org> Subject: [PATCH v2 0/6] arm64: Add audit support This patchset adds system call audit support on arm64. Both 32-bit (AUIDT_ARCH_ARM[EB]) and 64-bit tasks (AUDIT_ARCH_AARCH64[EB]) are supported, but presuming 32-LE on 64-LE or 32-BE on 64-BE. There are some prerequisites for this patch to work correctly: * "generic compat system call audit support" patch * "correct a type mismatch in audit_syscall_exit()" patch (already accepted and queued in 3.14) * "Modify a set of system calls in audit class" patch * userspace audit tool (v2.3.2 + my patch for arm64) All those were already or will be soon posted separately. Please review them as well for better understandings. This code was tested on both 32-bit and 64-bit LE userland in the following two ways: 1) basic operations with auditctl/autrace # auditctl -a exit,always -S openat -F path=/etc/inittab # auditctl -a exit,always -F dir=/tmp -F perm=rw # auditctl -a task,always # autrace /bin/ls by comparing output from autrace with one from strace 2) audit-test-code (+ my workarounds for arm/arm64) by running "audit-tool", "filter" and "syscalls" test categories. Changes v1 -> v2: * Modified to utilize "generic compat system call audit" [3/6, 4/6, 5/6] Please note that a required header, unistd_32.h, is automatically generated from unistd32.h. * Refer to regs->orig_x0 instead of regs->x0 as the first argument of system call in audit_syscall_entry() [6/6] * Include "Add regs_return_value() in syscall.h" patch [2/6], which was not intentionally included in v1 because it could be added by "kprobes support". AKASHI Takahiro (6): audit: Enable arm64 support arm64: Add regs_return_value() in syscall.h arm64: Add audit support arm64: audit: Add 32-bit (compat) syscall support arm64: audit: Add makefile rule to create unistd_32.h for compat syscalls arm64: audit: Add audit hook in ptrace/syscall_trace arch/arm64/Makefile | 4 ++++ arch/arm64/include/asm/audit.h | 20 ++++++++++++++++++++ arch/arm64/include/asm/ptrace.h | 5 +++++ arch/arm64/include/asm/syscall.h | 22 ++++++++++++++++++++++ arch/arm64/include/asm/thread_info.h | 1 + arch/arm64/kernel/entry.S | 3 +++ arch/arm64/kernel/ptrace.c | 12 ++++++++++++ arch/arm64/kernel/syscalls/Makefile | 20 ++++++++++++++++++++ include/uapi/linux/audit.h | 2 ++ init/Kconfig | 2 +- 10 files changed, 90 insertions(+), 1 deletion(-) create mode 100644 arch/arm64/include/asm/audit.h create mode 100644 arch/arm64/kernel/syscalls/Makefile -- 1.7.9.5 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists