linux-kernel - Re: [PATCH_v8 0/2] arm64: Add audit support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <53486087.9060304@redhat.com>
Date:	Fri, 11 Apr 2014 17:37:11 -0400
From:	Don Dutile <ddutile@...hat.com>
To:	AKASHI Takahiro <takahiro.akashi@...aro.org>
CC:	viro@...iv.linux.org.uk, eparis@...hat.com, rgb@...hat.com,
	catalin.marinas@....com, will.deacon@....com,
	linaro-kernel@...ts.linaro.org, arndb@...db.de,
	linux-kernel@...r.kernel.org, dsaxena@...aro.org,
	linux-audit@...hat.com, linux-arm-kernel@...ts.infradead.org
Subject: Re: [PATCH_v8 0/2] arm64: Add audit support

On 03/15/2014 01:49 AM, AKASHI Takahiro wrote:
> (Please apply this patch after my ftrace patch to resolve some conflict
> on arm64/kernel/ptrace.c, functionally it doesn't depend on ftrace though)
>
> This patchset adds system call audit support on arm64.
> Both 32-bit (AUDIT_ARCH_ARM) and 64-bit tasks (AUDIT_ARCH_AARCH64)
> are supported. Since arm64 has the exact same set of system calls
> on LE and BE, we don't care about endianness (or more specifically
> __AUDIT_ARCH_64BIT bit in AUDIT_ARCH_*).
>
> There are some prerequisites for this patch to work correctly:
> * "audit: Add CONFIG_HAVE_ARCH_AUDITSYSCALL" patch
> * "audit: generic compat system call audit support" patch
> * "arm64: __NR_* definitions for compat syscalls" patch from Catalin
> * "arm64: make a single hook to syscall_trace() for all syscall features" patch
> * "arm64: split syscall_trace() into separate functions for enter/exit" patch
> * "arm64: Add regs_return_value() in syscall.h" patch
> * "arm64: is_compat_task is defined both in asm/compat.h and
>     linux/compat.h" patch
> * userspace audit tool (v2.3.2 + my patch for arm64)
>
and the 2/2 patch won't apply to arch/arm64/kernel/ptrace.c
without the patch from  [PATCH v7 7/7] arm64: ftrace: Add system call tracepoint;
My question: do you need all 7 patches from arm64: Add ftrace support
as well for this audit patch to work, or just this 7/7 patch ?


> Please review them as well for better understandings.
>
> This code was tested on both 32-bit and 64-bit LE userland
> in the following two ways:
> 1) basic operations with auditctl/autrace
>    # auditctl -a exit,always -S openat -F path=/etc/inittab
>    # auditctl -a exit,always -F dir=/tmp -F perm=rw
>    # auditctl -a task,always
>    # autrace /bin/ls
>      by comparing output from autrace with one from strace
>
> 2) audit-test-code (+ my workarounds for arm/arm64)
>    by running "audit-tool", "filter" and "syscalls" test categories.
>
> Changes v7 -> v8:
> * aligned with the change in "audit: generic compat system call audit
>    support" v5 [1/2]
> * aligned with the change in "arm64: split syscall_trace() into separate
>    functions for enter/exit" v5 [2/2]
>
> Changes v6 -> v7:
> * changed an include file in syscall.h from <linux/audit.h> to
>    <uapi/linux/audit.h> [1/2]
> * aligned with the patch, "arm64: split syscall_trace() into separate
>    functions for enter/exit" [2/2]
>
> Changes v5 -> v6:
> * removed and put "arm64: Add regs_return_value() in syscall.h" patch into
>    a separate set
> * aligned with the change in "arm64: make a single hook to syscall_trace()
>    for all syscall features" v3 [1/2]
>
> Changes v4 -> v5:
> * rebased to 3.14-rcX
> * added a guard against TIF_SYSCALL_AUDIT [3/3]
> * aligned with the change in "arm64: make a single hook to syscall_trace()
>    for all syscall features" v2 [3/3]
>
> Changes v3 -> v4:
> * Modified to sync with the patch, "make a single hook to syscall_trace()
>    for all syscall features"
> * aligned with "audit: Add CONFIG_HAVE_ARCH_AUDITSYSCALL" patch
>
> Changes v2 -> v3:
> * Remove asm/audit.h.
>    See "generic compat syscall audit support" patch v4
> * Remove endianness dependency, ie. AUDIT_ARCH_ARMEB/AARCH64EB.
> * Remove kernel/syscalls/Makefile which was used to create unistd32.h.
>    See Catalin's "Add __NR_* definitions for compat syscalls" patch
>
> Changes v1 -> v2:
> * Modified to utilize "generic compat system call audit" [3/6, 4/6, 5/6]
>    Please note that a required header, unistd_32.h, is automatically
>    generated from unistd32.h.
> * Refer to regs->orig_x0 instead of regs->x0 as the first argument of
>    system call in audit_syscall_entry() [6/6]
> * Include "Add regs_return_value() in syscall.h" patch [2/6],
>    which was not intentionally included in v1 because it could be added
>    by "kprobes support".
>
> AKASHI Takahiro (2):
>    arm64: Add audit support
>    arm64: audit: Add audit hook in syscall_trace_enter/exit()
>
>   arch/arm64/Kconfig               |  2 ++
>   arch/arm64/include/asm/syscall.h | 15 +++++++++++++++
>   arch/arm64/kernel/ptrace.c       |  7 +++++++
>   include/uapi/linux/audit.h       |  1 +
>   4 files changed, 25 insertions(+)
>

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/