linux-kernel - Re: [linux-audit/audit-kernel] BUG: audit_classify_syscall() fails to properly handle 64-bit syscalls when executing as 32-bit application on ARM (#131)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 7 Jul 2021 14:54:28 -0400
From:   Paul Moore <paul@...l-moore.com>
To:     Yury Norov <yury.norov@...il.com>
Cc:     Andreas Schwab <schwab@...e.de>,
        Catalin Marinas <catalin.marinas@....com>,
        Arnd Bergmann <arnd@...db.de>,
        "linux-audit/audit-kernel" 
        <reply+ADSN7RXLQ62LNLD2MK5HFHF65GIU3EVBNHHDPMBXHU@...ly.github.com>,
        "linux-audit/audit-kernel" <audit-kernel@...eply.github.com>,
        Mention <mention@...eply.github.com>,
        Xiongfeng Wang <wangxiongfeng2@...wei.com>,
        bobo.shaobowang@...wei.com,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-arm-kernel@...ts.infradead.org" 
        <linux-arm-kernel@...ts.infradead.org>,
        "linux-doc@...r.kernel.org" <linux-doc@...r.kernel.org>,
        "linux-arch@...r.kernel.org" <linux-arch@...r.kernel.org>,
        "linux-api@...r.kernel.org" <linux-api@...r.kernel.org>,
        Adam Borowski <kilobyte@...band.pl>,
        Alexander Graf <agraf@...e.de>,
        Alexey Klimov <klimov.linux@...il.com>,
        Andrew Pinski <pinskia@...il.com>,
        Bamvor Zhangjian <bamv2005@...il.com>,
        Chris Metcalf <cmetcalf@...lanox.com>,
        Christoph Muellner <christoph.muellner@...obroma-systems.com>,
        Dave Martin <Dave.Martin@....com>,
        "David S . Miller" <davem@...emloft.net>,
        Florian Weimer <fweimer@...hat.com>,
        Geert Uytterhoeven <geert@...ux-m68k.org>,
        Heiko Carstens <heiko.carstens@...ibm.com>,
        James Hogan <james.hogan@...tec.com>,
        James Morse <james.morse@....com>,
        Joseph Myers <joseph@...esourcery.com>,
        Lin Yongting <linyongting@...wei.com>,
        Manuel Montezelo <manuel.montezelo@...il.com>,
        Mark Brown <broonie@...nel.org>,
        Martin Schwidefsky <schwidefsky@...ibm.com>,
        Maxim Kuvyrkov <maxim.kuvyrkov@...aro.org>,
        Nathan_Lynch <Nathan_Lynch@...tor.com>,
        Philipp Tomsich <philipp.tomsich@...obroma-systems.com>,
        Prasun Kapoor <Prasun.Kapoor@...iumnetworks.com>,
        Ramana Radhakrishnan <ramana.gcc@...glemail.com>,
        Steve Ellcey <sellcey@...iumnetworks.com>,
        Szabolcs Nagy <szabolcs.nagy@....com>
Subject: Re: [linux-audit/audit-kernel] BUG: audit_classify_syscall() fails to
 properly handle 64-bit syscalls when executing as 32-bit application on ARM (#131)

On Wed, Jul 7, 2021 at 2:44 PM Yury Norov <yury.norov@...il.com> wrote:
> On Mon, Jul 05, 2021 at 12:48:42PM +0200, Andreas Schwab wrote:
> > On Jul 02 2021, Yury Norov wrote:
> >
> > > At least Marvell, Samsung, Huawei, Cisco and Weiyuchen's employer
> > > actively use and develop arm64/ilp32.
> >
> > This is good to know.  Where can I get the uptodate kernel patches for
> > ILP32?
> >
> > Andreas.
>
> The latest kernel supported by me is 5.2:
> https://github.com/norov/linux/commits/ilp32-5.2
>
> I know about working ports of ILP32 on 5.7 and 5.10, but didn't see
> the code and testing results. Hopefully Paul Moore and Weiyuchen will
> share more details.

To be clear, I have not done any work with ILP32 nor do I have any
immediate plans to do so (other tasks are higher priority).  I am not
sure what details you are looking for, but there are several
arches/ABIs in the kernel, including regular aarch64, that can serve
as examples on how to enable syscall auditing (presumably that is what
you are interested in with this thread).  There may be some
interesting challenges with ILP32 due to overlap with aarch64
syscalls, but I haven't looked closely enough at ILP32 to say that
with any certainty.

-- 
paul moore
www.paul-moore.com