lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 11 Feb 2014 08:51:27 -0500 From: Richard Guy Briggs <rgb@...hat.com> To: AKASHI Takahiro <takahiro.akashi@...aro.org> Cc: viro@...iv.linux.org.uk, eparis@...hat.com, catalin.marinas@....com, will.deacon@....com, linaro-kernel@...ts.linaro.org, patches@...aro.org, arndb@...db.de, linux-kernel@...r.kernel.org, linux-audit@...hat.com, linux-arm-kernel@...ts.infradead.org Subject: Re: [PATCH v4 0/3] arm64: Add audit support On 14/02/07, AKASHI Takahiro wrote: > This patchset adds system call audit support on arm64. > Both 32-bit (AUDIT_ARCH_ARM) and 64-bit tasks (AUDIT_ARCH_AARCH64) > are supported. Since arm64 has the exact same set of system calls > on LE and BE, we don't care about endianness (or more specifically > __AUDIT_ARCH_64BIT bit in AUDIT_ARCH_*). > > There are some prerequisites for this patch to work correctly: > * "generic compat system call audit support" patch > * "correct a type mismatch in audit_syscall_exit()" patch > (already accepted and queued in 3.14) > * "Modify a set of system calls in audit class" patch > (already accepted and queued in 3.14) > * "__NR_* definitions for compat syscalls" patch from Catalin > * "make a single hook to syscall_trace() for all syscall features" patch > * userspace audit tool (v2.3.2 + my patch for arm64) > > Please review them as well for better understandings. > > This code was tested on both 32-bit and 64-bit LE userland > in the following two ways: > 1) basic operations with auditctl/autrace > # auditctl -a exit,always -S openat -F path=/etc/inittab > # auditctl -a exit,always -F dir=/tmp -F perm=rw > # auditctl -a task,always > # autrace /bin/ls > by comparing output from autrace with one from strace > > 2) audit-test-code (+ my workarounds for arm/arm64) > by running "audit-tool", "filter" and "syscalls" test categories. > > Changes v1 -> v2: > * Modified to utilize "generic compat system call audit" [3/6, 4/6, 5/6] > Please note that a required header, unistd_32.h, is automatically > generated from unistd32.h. > * Refer to regs->orig_x0 instead of regs->x0 as the first argument of > system call in audit_syscall_entry() [6/6] > * Include "Add regs_return_value() in syscall.h" patch [2/6], > which was not intentionally included in v1 because it could be added > by "kprobes support". > > Changes v2 -> v3: > * Remove asm/audit.h. > See "generic compat syscall audit support" patch v4 > * Remove endianness dependency, ie. AUDIT_ARCH_ARMEB/AARCH64EB. > * Remove kernel/syscalls/Makefile which was used to create unistd32.h. > See Catalin's "Add __NR_* definitions for compat syscalls" patch > > Changes v3 -> v4: > * Modified to sync with the patch, "make a single hook to syscall_trace() > for all syscall features" > > > AKASHI Takahiro (3): > arm64: Add regs_return_value() in syscall.h > arm64: Add audit support > arm64: audit: Add audit hook in ptrace/syscall_trace > > arch/arm64/Kconfig | 1 + > arch/arm64/include/asm/ptrace.h | 5 +++++ > arch/arm64/include/asm/syscall.h | 15 +++++++++++++++ > arch/arm64/kernel/ptrace.c | 7 +++++++ > include/uapi/linux/audit.h | 1 + > 5 files changed, 29 insertions(+) Compile and regression tested on: ppc s390 x86_64 ppc64 i686 s390x. Acked-by: Richard Guy Briggs <rgb@...hat.com> > -- > 1.7.9.5 > > -- > Linux-audit mailing list > Linux-audit@...hat.com > https://www.redhat.com/mailman/listinfo/linux-audit - RGB -- Richard Guy Briggs <rbriggs@...hat.com> Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat Remote, Ottawa, Canada Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists