On Wed, Sep 02, 2026 at 11:43:34AM -0300, Ricardo Robaina wrote: > The SYSCALL record currently logs only four of the six syscall > arguments (a0-a3). The remaining two are captured but silently > discarded before reaching the audit context. This leads to the > need for auxiliary records when audit-relevant data lands in the > 5th or 6th argument of a syscall. > > Extend the SYSCALL record to log all six arguments, by adding > arguments a4 and a5 (5th and 6th syscall arguments respectively) > inline within the existing record. Also add the two new args to > the audit rules switch case, so audit rules can filter on them. > > Rather than plumbing two more register arguments through every > architecture's syscall entry path, change __audit_syscall_entry() > to take a pointer to pt_regs and use syscall_get_arguments() to > retrieve all six arguments. > > audit-testsuite# make test > audit-testsuite# ausearch -i -m SYSCALL > ... > type=SYSCALL ... syscall=sendto success=yes exit=1088 a0=0x4 > a1=0x7ffe43518b60 a2=0x440 a3=0x0 a4=7ffe43518b4c a5=c > type=SYSCALL ... syscall=openat2 success=yes exit=4 a0=0x3 > a1=0x7fffc74692c8 a2=0x7fffc7467390 a3=0x18 a4=0 a5=7fffc74674f8 > type=SYSCALL ... syscall=openat success=yes exit=3 a0=AT_FDCWD > a1=0x557ced4141a2 a2=O_RDWR|O_NONBLOCK a3=0x0 a4=0 a5=0 > ... > > Suggested-by: Will Deacon <[email protected]> > Link: > https://lore.kernel.org/audit/CAHC9VhSjEt_-Bsra4AEqWv+Daw5Ff=gqy7dx4ah11rvhdyc...@mail.gmail.com/T/#t > Signed-off-by: Ricardo Robaina <[email protected]> > --- > include/linux/audit.h | 13 ++++--------- > include/uapi/linux/audit.h | 2 ++ > kernel/audit.h | 2 +- > kernel/auditfilter.c | 2 ++ > kernel/auditsc.c | 19 ++++++++----------- > kernel/entry/syscall-common.c | 4 +--- > 6 files changed, 18 insertions(+), 24 deletions(-) > > diff --git a/include/linux/audit.h b/include/linux/audit.h > index 45abb3722d30..9ce5962bc537 100644 > --- a/include/linux/audit.h > +++ b/include/linux/audit.h > @@ -323,8 +323,7 @@ extern int audit_alloc(struct task_struct *task); > extern void __audit_free(struct task_struct *task); > extern void __audit_uring_entry(u8 op); > extern void __audit_uring_exit(int success, long code); > -extern void __audit_syscall_entry(int major, unsigned long a0, unsigned long > a1, > - unsigned long a2, unsigned long a3); > +extern void __audit_syscall_entry(int major, struct pt_regs *regs); > extern void __audit_syscall_exit(int ret_success, long ret_value); > extern void __audit_getname(struct filename *name); > extern void __audit_inode(struct filename *name, const struct dentry *dentry, > @@ -373,12 +372,10 @@ static inline void audit_uring_exit(int success, long > code) > if (unlikely(audit_context())) > __audit_uring_exit(success, code); > } > -static inline void audit_syscall_entry(int major, unsigned long a0, > - unsigned long a1, unsigned long a2, > - unsigned long a3) > +static inline void audit_syscall_entry(int major, struct pt_regs *regs) > { > if (unlikely(audit_context())) > - __audit_syscall_entry(major, a0, a1, a2, a3); > + __audit_syscall_entry(major, regs); > }
Won't this (temporarily) break the build? Maybe you need to introduce a new helper e.g. audit_syscall_entry_regs(), then convert everybody over to that, then rename it to audit_syscall_entry() at the end to keep the series bisectable. Will
