linux-kernel - Re: [PATCH v2 3/3] audit: Use syscall_get_return_value to get syscall return code in audit_syscall

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 11 May 2021 10:51:21 -0400
From:   Paul Moore <paul@...l-moore.com>
To:     He Zhe <zhe.he@...driver.com>
Cc:     oleg@...hat.com, catalin.marinas@....com, will@...nel.org,
        linux-arm-kernel@...ts.infradead.org,
        Eric Paris <eparis@...hat.com>, linux-audit@...hat.com,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 3/3] audit: Use syscall_get_return_value to get syscall
 return code in audit_syscall_exit

On Mon, May 10, 2021 at 11:19 PM He Zhe <zhe.he@...driver.com> wrote:
> On 5/11/21 6:38 AM, Paul Moore wrote:
> > On Fri, Apr 23, 2021 at 6:36 AM He Zhe <zhe.he@...driver.com> wrote:
> >> regs_return_value for some architectures like arm64 simply retrieve
> >> register value from pt_regs without sign extension in 32-bit compatible
> >> case and cause audit to have false syscall return code. For example,
> >> 32-bit -13 would be treated as 4294967283 below.
> >>
> >> type=SYSCALL msg=audit(1611110715.887:582): arch=40000028 syscall=322
> >> success=yes exit=4294967283
> >>
> >> We just added proper sign extension in syscall_get_return_value which
> >> should be used instead.
> >>
> >> Signed-off-by: He Zhe <zhe.he@...driver.com>
> >> ---
> >> v1 to v2: No change
> >>
> >>  include/linux/audit.h | 2 +-
> >>  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > Perhaps I missed it but did you address the compile error that was
> > found by the kernel test robot?
>
> I sent a patch adding syscall_get_return_value for alpha to fix this bot warning.
> https://lore.kernel.org/lkml/20210426091629.45020-1-zhe.he@windriver.com/
> which can be found in this mail thread.

At the very least you should respin the patchset with the alpha fix
included in the patchset; it's a bit messy otherwise.

> >> diff --git a/include/linux/audit.h b/include/linux/audit.h
> >> index 82b7c1116a85..135adbe22c19 100644
> >> --- a/include/linux/audit.h
> >> +++ b/include/linux/audit.h
> >> @@ -334,7 +334,7 @@ static inline void audit_syscall_exit(void *pt_regs)
> >>  {
> >>         if (unlikely(audit_context())) {
> >>                 int success = is_syscall_success(pt_regs);
> >
> > Since we are shifting to use syscall_get_return_value() below, would
> > it also make sense to shift to using syscall_get_error() here instead
> > of is_syscall_success()?
>
> In [PATCH v2 1/3], is_syscall_success calls syscall_get_return_value to take
> care of the sign extension issue. Keeping using is_syscall_success is to not
> potentially changing other architectures' behavior.

That was only for aarch64, right?  What about all the other
architectures?  The comment block for syscall_get_return_value()
advises that syscall_get_error() should be used and that appears to be
what is done in the ptrace code.

-- 
paul moore
www.paul-moore.com