Re: [PATCH_v8 0/2] arm64: Add audit support
On 04/28/2014 05:51 AM, AKASHI Takahiro wrote: Hi Don, Sorry for not responding to you soon: been there, done that! .. no problem.. On 04/12/2014 06:37 AM, Don Dutile wrote: On 03/15/2014 01:49 AM, AKASHI Takahiro wrote: (Please apply this patch after my ftrace patch to resolve some conflict on arm64/kernel/ptrace.c, functionally it doesn't depend on ftrace though) This patchset adds system call audit support on arm64. Both 32-bit (AUDIT_ARCH_ARM) and 64-bit tasks (AUDIT_ARCH_AARCH64) are supported. Since arm64 has the exact same set of system calls on LE and BE, we don't care about endianness (or more specifically __AUDIT_ARCH_64BIT bit in AUDIT_ARCH_*). There are some prerequisites for this patch to work correctly: * "audit: Add CONFIG_HAVE_ARCH_AUDITSYSCALL" patch * "audit: generic compat system call audit support" patch * "arm64: __NR_* definitions for compat syscalls" patch from Catalin * "arm64: make a single hook to syscall_trace() for all syscall features" patch * "arm64: split syscall_trace() into separate functions for enter/exit" patch * "arm64: Add regs_return_value() in syscall.h" patch * "arm64: is_compat_task is defined both in asm/compat.h and linux/compat.h" patch * userspace audit tool (v2.3.2 + my patch for arm64) and the 2/2 patch won't apply to arch/arm64/kernel/ptrace.c without the patch from [PATCH v7 7/7] arm64: ftrace: Add system call tracepoint; My question: do you need all 7 patches from arm64: Add ftrace support as well for this audit patch to work, or just this 7/7 patch ? Functionally, my audit patch should work without ftrace patchset, but as described in ftrace's [0/7] and audit's [0/2], audit's [2/2] assumes that ftrace patchset, especially [7/7], has been applied in order to avoid any conflict when making changes on the same line of ptrace.c. Thanks, -Takahiro AKASHI just a nit for others to see/know if they were having the same fun of backporting these patches to work on an existing kernel w/o ftrace patch set. Please review them as well for better understandings. This code was tested on both 32-bit and 64-bit LE userland in the following two ways: 1) basic operations with auditctl/autrace # auditctl -a exit,always -S openat -F path=/etc/inittab # auditctl -a exit,always -F dir=/tmp -F perm=rw # auditctl -a task,always # autrace /bin/ls by comparing output from autrace with one from strace 2) audit-test-code (+ my workarounds for arm/arm64) by running "audit-tool", "filter" and "syscalls" test categories. Changes v7 -> v8: * aligned with the change in "audit: generic compat system call audit support" v5 [1/2] * aligned with the change in "arm64: split syscall_trace() into separate functions for enter/exit" v5 [2/2] Changes v6 -> v7: * changed an include file in syscall.h from to [1/2] * aligned with the patch, "arm64: split syscall_trace() into separate functions for enter/exit" [2/2] Changes v5 -> v6: * removed and put "arm64: Add regs_return_value() in syscall.h" patch into a separate set * aligned with the change in "arm64: make a single hook to syscall_trace() for all syscall features" v3 [1/2] Changes v4 -> v5: * rebased to 3.14-rcX * added a guard against TIF_SYSCALL_AUDIT [3/3] * aligned with the change in "arm64: make a single hook to syscall_trace() for all syscall features" v2 [3/3] Changes v3 -> v4: * Modified to sync with the patch, "make a single hook to syscall_trace() for all syscall features" * aligned with "audit: Add CONFIG_HAVE_ARCH_AUDITSYSCALL" patch Changes v2 -> v3: * Remove asm/audit.h. See "generic compat syscall audit support" patch v4 * Remove endianness dependency, ie. AUDIT_ARCH_ARMEB/AARCH64EB. * Remove kernel/syscalls/Makefile which was used to create unistd32.h. See Catalin's "Add __NR_* definitions for compat syscalls" patch Changes v1 -> v2: * Modified to utilize "generic compat system call audit" [3/6, 4/6, 5/6] Please note that a required header, unistd_32.h, is automatically generated from unistd32.h. * Refer to regs->orig_x0 instead of regs->x0 as the first argument of system call in audit_syscall_entry() [6/6] * Include "Add regs_return_value() in syscall.h" patch [2/6], which was not intentionally included in v1 because it could be added by "kprobes support". AKASHI Takahiro (2): arm64: Add audit support arm64: audit: Add audit hook in syscall_trace_enter/exit() arch/arm64/Kconfig | 2 ++ arch/arm64/include/asm/syscall.h | 15 +++ arch/arm64/kernel/ptrace.c | 7 +++ include/uapi/linux/audit.h | 1 + 4 files changed, 25 insertions(+) -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/ -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a
Re: [PATCH_v8 0/2] arm64: Add audit support
Hi Don, Sorry for not responding to you soon: On 04/12/2014 06:37 AM, Don Dutile wrote: On 03/15/2014 01:49 AM, AKASHI Takahiro wrote: (Please apply this patch after my ftrace patch to resolve some conflict on arm64/kernel/ptrace.c, functionally it doesn't depend on ftrace though) This patchset adds system call audit support on arm64. Both 32-bit (AUDIT_ARCH_ARM) and 64-bit tasks (AUDIT_ARCH_AARCH64) are supported. Since arm64 has the exact same set of system calls on LE and BE, we don't care about endianness (or more specifically __AUDIT_ARCH_64BIT bit in AUDIT_ARCH_*). There are some prerequisites for this patch to work correctly: * "audit: Add CONFIG_HAVE_ARCH_AUDITSYSCALL" patch * "audit: generic compat system call audit support" patch * "arm64: __NR_* definitions for compat syscalls" patch from Catalin * "arm64: make a single hook to syscall_trace() for all syscall features" patch * "arm64: split syscall_trace() into separate functions for enter/exit" patch * "arm64: Add regs_return_value() in syscall.h" patch * "arm64: is_compat_task is defined both in asm/compat.h and linux/compat.h" patch * userspace audit tool (v2.3.2 + my patch for arm64) and the 2/2 patch won't apply to arch/arm64/kernel/ptrace.c without the patch from [PATCH v7 7/7] arm64: ftrace: Add system call tracepoint; My question: do you need all 7 patches from arm64: Add ftrace support as well for this audit patch to work, or just this 7/7 patch ? Functionally, my audit patch should work without ftrace patchset, but as described in ftrace's [0/7] and audit's [0/2], audit's [2/2] assumes that ftrace patchset, especially [7/7], has been applied in order to avoid any conflict when making changes on the same line of ptrace.c. Thanks, -Takahiro AKASHI Please review them as well for better understandings. This code was tested on both 32-bit and 64-bit LE userland in the following two ways: 1) basic operations with auditctl/autrace # auditctl -a exit,always -S openat -F path=/etc/inittab # auditctl -a exit,always -F dir=/tmp -F perm=rw # auditctl -a task,always # autrace /bin/ls by comparing output from autrace with one from strace 2) audit-test-code (+ my workarounds for arm/arm64) by running "audit-tool", "filter" and "syscalls" test categories. Changes v7 -> v8: * aligned with the change in "audit: generic compat system call audit support" v5 [1/2] * aligned with the change in "arm64: split syscall_trace() into separate functions for enter/exit" v5 [2/2] Changes v6 -> v7: * changed an include file in syscall.h from to [1/2] * aligned with the patch, "arm64: split syscall_trace() into separate functions for enter/exit" [2/2] Changes v5 -> v6: * removed and put "arm64: Add regs_return_value() in syscall.h" patch into a separate set * aligned with the change in "arm64: make a single hook to syscall_trace() for all syscall features" v3 [1/2] Changes v4 -> v5: * rebased to 3.14-rcX * added a guard against TIF_SYSCALL_AUDIT [3/3] * aligned with the change in "arm64: make a single hook to syscall_trace() for all syscall features" v2 [3/3] Changes v3 -> v4: * Modified to sync with the patch, "make a single hook to syscall_trace() for all syscall features" * aligned with "audit: Add CONFIG_HAVE_ARCH_AUDITSYSCALL" patch Changes v2 -> v3: * Remove asm/audit.h. See "generic compat syscall audit support" patch v4 * Remove endianness dependency, ie. AUDIT_ARCH_ARMEB/AARCH64EB. * Remove kernel/syscalls/Makefile which was used to create unistd32.h. See Catalin's "Add __NR_* definitions for compat syscalls" patch Changes v1 -> v2: * Modified to utilize "generic compat system call audit" [3/6, 4/6, 5/6] Please note that a required header, unistd_32.h, is automatically generated from unistd32.h. * Refer to regs->orig_x0 instead of regs->x0 as the first argument of system call in audit_syscall_entry() [6/6] * Include "Add regs_return_value() in syscall.h" patch [2/6], which was not intentionally included in v1 because it could be added by "kprobes support". AKASHI Takahiro (2): arm64: Add audit support arm64: audit: Add audit hook in syscall_trace_enter/exit() arch/arm64/Kconfig | 2 ++ arch/arm64/include/asm/syscall.h | 15 +++ arch/arm64/kernel/ptrace.c | 7 +++ include/uapi/linux/audit.h | 1 + 4 files changed, 25 insertions(+) -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Re: [PATCH_v8 0/2] arm64: Add audit support
Hi Don, Sorry for not responding to you soon: On 04/12/2014 06:37 AM, Don Dutile wrote: On 03/15/2014 01:49 AM, AKASHI Takahiro wrote: (Please apply this patch after my ftrace patch to resolve some conflict on arm64/kernel/ptrace.c, functionally it doesn't depend on ftrace though) This patchset adds system call audit support on arm64. Both 32-bit (AUDIT_ARCH_ARM) and 64-bit tasks (AUDIT_ARCH_AARCH64) are supported. Since arm64 has the exact same set of system calls on LE and BE, we don't care about endianness (or more specifically __AUDIT_ARCH_64BIT bit in AUDIT_ARCH_*). There are some prerequisites for this patch to work correctly: * audit: Add CONFIG_HAVE_ARCH_AUDITSYSCALL patch * audit: generic compat system call audit support patch * arm64: __NR_* definitions for compat syscalls patch from Catalin * arm64: make a single hook to syscall_trace() for all syscall features patch * arm64: split syscall_trace() into separate functions for enter/exit patch * arm64: Add regs_return_value() in syscall.h patch * arm64: is_compat_task is defined both in asm/compat.h and linux/compat.h patch * userspace audit tool (v2.3.2 + my patch for arm64) and the 2/2 patch won't apply to arch/arm64/kernel/ptrace.c without the patch from [PATCH v7 7/7] arm64: ftrace: Add system call tracepoint; My question: do you need all 7 patches from arm64: Add ftrace support as well for this audit patch to work, or just this 7/7 patch ? Functionally, my audit patch should work without ftrace patchset, but as described in ftrace's [0/7] and audit's [0/2], audit's [2/2] assumes that ftrace patchset, especially [7/7], has been applied in order to avoid any conflict when making changes on the same line of ptrace.c. Thanks, -Takahiro AKASHI Please review them as well for better understandings. This code was tested on both 32-bit and 64-bit LE userland in the following two ways: 1) basic operations with auditctl/autrace # auditctl -a exit,always -S openat -F path=/etc/inittab # auditctl -a exit,always -F dir=/tmp -F perm=rw # auditctl -a task,always # autrace /bin/ls by comparing output from autrace with one from strace 2) audit-test-code (+ my workarounds for arm/arm64) by running audit-tool, filter and syscalls test categories. Changes v7 - v8: * aligned with the change in audit: generic compat system call audit support v5 [1/2] * aligned with the change in arm64: split syscall_trace() into separate functions for enter/exit v5 [2/2] Changes v6 - v7: * changed an include file in syscall.h from linux/audit.h to uapi/linux/audit.h [1/2] * aligned with the patch, arm64: split syscall_trace() into separate functions for enter/exit [2/2] Changes v5 - v6: * removed and put arm64: Add regs_return_value() in syscall.h patch into a separate set * aligned with the change in arm64: make a single hook to syscall_trace() for all syscall features v3 [1/2] Changes v4 - v5: * rebased to 3.14-rcX * added a guard against TIF_SYSCALL_AUDIT [3/3] * aligned with the change in arm64: make a single hook to syscall_trace() for all syscall features v2 [3/3] Changes v3 - v4: * Modified to sync with the patch, make a single hook to syscall_trace() for all syscall features * aligned with audit: Add CONFIG_HAVE_ARCH_AUDITSYSCALL patch Changes v2 - v3: * Remove asm/audit.h. See generic compat syscall audit support patch v4 * Remove endianness dependency, ie. AUDIT_ARCH_ARMEB/AARCH64EB. * Remove kernel/syscalls/Makefile which was used to create unistd32.h. See Catalin's Add __NR_* definitions for compat syscalls patch Changes v1 - v2: * Modified to utilize generic compat system call audit [3/6, 4/6, 5/6] Please note that a required header, unistd_32.h, is automatically generated from unistd32.h. * Refer to regs-orig_x0 instead of regs-x0 as the first argument of system call in audit_syscall_entry() [6/6] * Include Add regs_return_value() in syscall.h patch [2/6], which was not intentionally included in v1 because it could be added by kprobes support. AKASHI Takahiro (2): arm64: Add audit support arm64: audit: Add audit hook in syscall_trace_enter/exit() arch/arm64/Kconfig | 2 ++ arch/arm64/include/asm/syscall.h | 15 +++ arch/arm64/kernel/ptrace.c | 7 +++ include/uapi/linux/audit.h | 1 + 4 files changed, 25 insertions(+) -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Re: [PATCH_v8 0/2] arm64: Add audit support
On 04/28/2014 05:51 AM, AKASHI Takahiro wrote: Hi Don, Sorry for not responding to you soon: been there, done that! .. no problem.. On 04/12/2014 06:37 AM, Don Dutile wrote: On 03/15/2014 01:49 AM, AKASHI Takahiro wrote: (Please apply this patch after my ftrace patch to resolve some conflict on arm64/kernel/ptrace.c, functionally it doesn't depend on ftrace though) This patchset adds system call audit support on arm64. Both 32-bit (AUDIT_ARCH_ARM) and 64-bit tasks (AUDIT_ARCH_AARCH64) are supported. Since arm64 has the exact same set of system calls on LE and BE, we don't care about endianness (or more specifically __AUDIT_ARCH_64BIT bit in AUDIT_ARCH_*). There are some prerequisites for this patch to work correctly: * audit: Add CONFIG_HAVE_ARCH_AUDITSYSCALL patch * audit: generic compat system call audit support patch * arm64: __NR_* definitions for compat syscalls patch from Catalin * arm64: make a single hook to syscall_trace() for all syscall features patch * arm64: split syscall_trace() into separate functions for enter/exit patch * arm64: Add regs_return_value() in syscall.h patch * arm64: is_compat_task is defined both in asm/compat.h and linux/compat.h patch * userspace audit tool (v2.3.2 + my patch for arm64) and the 2/2 patch won't apply to arch/arm64/kernel/ptrace.c without the patch from [PATCH v7 7/7] arm64: ftrace: Add system call tracepoint; My question: do you need all 7 patches from arm64: Add ftrace support as well for this audit patch to work, or just this 7/7 patch ? Functionally, my audit patch should work without ftrace patchset, but as described in ftrace's [0/7] and audit's [0/2], audit's [2/2] assumes that ftrace patchset, especially [7/7], has been applied in order to avoid any conflict when making changes on the same line of ptrace.c. Thanks, -Takahiro AKASHI just a nit for others to see/know if they were having the same fun of backporting these patches to work on an existing kernel w/o ftrace patch set. Please review them as well for better understandings. This code was tested on both 32-bit and 64-bit LE userland in the following two ways: 1) basic operations with auditctl/autrace # auditctl -a exit,always -S openat -F path=/etc/inittab # auditctl -a exit,always -F dir=/tmp -F perm=rw # auditctl -a task,always # autrace /bin/ls by comparing output from autrace with one from strace 2) audit-test-code (+ my workarounds for arm/arm64) by running audit-tool, filter and syscalls test categories. Changes v7 - v8: * aligned with the change in audit: generic compat system call audit support v5 [1/2] * aligned with the change in arm64: split syscall_trace() into separate functions for enter/exit v5 [2/2] Changes v6 - v7: * changed an include file in syscall.h from linux/audit.h to uapi/linux/audit.h [1/2] * aligned with the patch, arm64: split syscall_trace() into separate functions for enter/exit [2/2] Changes v5 - v6: * removed and put arm64: Add regs_return_value() in syscall.h patch into a separate set * aligned with the change in arm64: make a single hook to syscall_trace() for all syscall features v3 [1/2] Changes v4 - v5: * rebased to 3.14-rcX * added a guard against TIF_SYSCALL_AUDIT [3/3] * aligned with the change in arm64: make a single hook to syscall_trace() for all syscall features v2 [3/3] Changes v3 - v4: * Modified to sync with the patch, make a single hook to syscall_trace() for all syscall features * aligned with audit: Add CONFIG_HAVE_ARCH_AUDITSYSCALL patch Changes v2 - v3: * Remove asm/audit.h. See generic compat syscall audit support patch v4 * Remove endianness dependency, ie. AUDIT_ARCH_ARMEB/AARCH64EB. * Remove kernel/syscalls/Makefile which was used to create unistd32.h. See Catalin's Add __NR_* definitions for compat syscalls patch Changes v1 - v2: * Modified to utilize generic compat system call audit [3/6, 4/6, 5/6] Please note that a required header, unistd_32.h, is automatically generated from unistd32.h. * Refer to regs-orig_x0 instead of regs-x0 as the first argument of system call in audit_syscall_entry() [6/6] * Include Add regs_return_value() in syscall.h patch [2/6], which was not intentionally included in v1 because it could be added by kprobes support. AKASHI Takahiro (2): arm64: Add audit support arm64: audit: Add audit hook in syscall_trace_enter/exit() arch/arm64/Kconfig | 2 ++ arch/arm64/include/asm/syscall.h | 15 +++ arch/arm64/kernel/ptrace.c | 7 +++ include/uapi/linux/audit.h | 1 + 4 files changed, 25 insertions(+) -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/ -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to
Re: [PATCH_v8 0/2] arm64: Add audit support
On 03/15/2014 01:49 AM, AKASHI Takahiro wrote: (Please apply this patch after my ftrace patch to resolve some conflict on arm64/kernel/ptrace.c, functionally it doesn't depend on ftrace though) This patchset adds system call audit support on arm64. Both 32-bit (AUDIT_ARCH_ARM) and 64-bit tasks (AUDIT_ARCH_AARCH64) are supported. Since arm64 has the exact same set of system calls on LE and BE, we don't care about endianness (or more specifically __AUDIT_ARCH_64BIT bit in AUDIT_ARCH_*). There are some prerequisites for this patch to work correctly: * "audit: Add CONFIG_HAVE_ARCH_AUDITSYSCALL" patch * "audit: generic compat system call audit support" patch * "arm64: __NR_* definitions for compat syscalls" patch from Catalin * "arm64: make a single hook to syscall_trace() for all syscall features" patch * "arm64: split syscall_trace() into separate functions for enter/exit" patch * "arm64: Add regs_return_value() in syscall.h" patch * "arm64: is_compat_task is defined both in asm/compat.h and linux/compat.h" patch * userspace audit tool (v2.3.2 + my patch for arm64) and the 2/2 patch won't apply to arch/arm64/kernel/ptrace.c without the patch from [PATCH v7 7/7] arm64: ftrace: Add system call tracepoint; My question: do you need all 7 patches from arm64: Add ftrace support as well for this audit patch to work, or just this 7/7 patch ? Please review them as well for better understandings. This code was tested on both 32-bit and 64-bit LE userland in the following two ways: 1) basic operations with auditctl/autrace # auditctl -a exit,always -S openat -F path=/etc/inittab # auditctl -a exit,always -F dir=/tmp -F perm=rw # auditctl -a task,always # autrace /bin/ls by comparing output from autrace with one from strace 2) audit-test-code (+ my workarounds for arm/arm64) by running "audit-tool", "filter" and "syscalls" test categories. Changes v7 -> v8: * aligned with the change in "audit: generic compat system call audit support" v5 [1/2] * aligned with the change in "arm64: split syscall_trace() into separate functions for enter/exit" v5 [2/2] Changes v6 -> v7: * changed an include file in syscall.h from to [1/2] * aligned with the patch, "arm64: split syscall_trace() into separate functions for enter/exit" [2/2] Changes v5 -> v6: * removed and put "arm64: Add regs_return_value() in syscall.h" patch into a separate set * aligned with the change in "arm64: make a single hook to syscall_trace() for all syscall features" v3 [1/2] Changes v4 -> v5: * rebased to 3.14-rcX * added a guard against TIF_SYSCALL_AUDIT [3/3] * aligned with the change in "arm64: make a single hook to syscall_trace() for all syscall features" v2 [3/3] Changes v3 -> v4: * Modified to sync with the patch, "make a single hook to syscall_trace() for all syscall features" * aligned with "audit: Add CONFIG_HAVE_ARCH_AUDITSYSCALL" patch Changes v2 -> v3: * Remove asm/audit.h. See "generic compat syscall audit support" patch v4 * Remove endianness dependency, ie. AUDIT_ARCH_ARMEB/AARCH64EB. * Remove kernel/syscalls/Makefile which was used to create unistd32.h. See Catalin's "Add __NR_* definitions for compat syscalls" patch Changes v1 -> v2: * Modified to utilize "generic compat system call audit" [3/6, 4/6, 5/6] Please note that a required header, unistd_32.h, is automatically generated from unistd32.h. * Refer to regs->orig_x0 instead of regs->x0 as the first argument of system call in audit_syscall_entry() [6/6] * Include "Add regs_return_value() in syscall.h" patch [2/6], which was not intentionally included in v1 because it could be added by "kprobes support". AKASHI Takahiro (2): arm64: Add audit support arm64: audit: Add audit hook in syscall_trace_enter/exit() arch/arm64/Kconfig | 2 ++ arch/arm64/include/asm/syscall.h | 15 +++ arch/arm64/kernel/ptrace.c | 7 +++ include/uapi/linux/audit.h | 1 + 4 files changed, 25 insertions(+) -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Re: [PATCH_v8 0/2] arm64: Add audit support
On 03/15/2014 01:49 AM, AKASHI Takahiro wrote: (Please apply this patch after my ftrace patch to resolve some conflict on arm64/kernel/ptrace.c, functionally it doesn't depend on ftrace though) This patchset adds system call audit support on arm64. Both 32-bit (AUDIT_ARCH_ARM) and 64-bit tasks (AUDIT_ARCH_AARCH64) are supported. Since arm64 has the exact same set of system calls on LE and BE, we don't care about endianness (or more specifically __AUDIT_ARCH_64BIT bit in AUDIT_ARCH_*). There are some prerequisites for this patch to work correctly: * audit: Add CONFIG_HAVE_ARCH_AUDITSYSCALL patch * audit: generic compat system call audit support patch * arm64: __NR_* definitions for compat syscalls patch from Catalin * arm64: make a single hook to syscall_trace() for all syscall features patch * arm64: split syscall_trace() into separate functions for enter/exit patch * arm64: Add regs_return_value() in syscall.h patch * arm64: is_compat_task is defined both in asm/compat.h and linux/compat.h patch * userspace audit tool (v2.3.2 + my patch for arm64) and the 2/2 patch won't apply to arch/arm64/kernel/ptrace.c without the patch from [PATCH v7 7/7] arm64: ftrace: Add system call tracepoint; My question: do you need all 7 patches from arm64: Add ftrace support as well for this audit patch to work, or just this 7/7 patch ? Please review them as well for better understandings. This code was tested on both 32-bit and 64-bit LE userland in the following two ways: 1) basic operations with auditctl/autrace # auditctl -a exit,always -S openat -F path=/etc/inittab # auditctl -a exit,always -F dir=/tmp -F perm=rw # auditctl -a task,always # autrace /bin/ls by comparing output from autrace with one from strace 2) audit-test-code (+ my workarounds for arm/arm64) by running audit-tool, filter and syscalls test categories. Changes v7 - v8: * aligned with the change in audit: generic compat system call audit support v5 [1/2] * aligned with the change in arm64: split syscall_trace() into separate functions for enter/exit v5 [2/2] Changes v6 - v7: * changed an include file in syscall.h from linux/audit.h to uapi/linux/audit.h [1/2] * aligned with the patch, arm64: split syscall_trace() into separate functions for enter/exit [2/2] Changes v5 - v6: * removed and put arm64: Add regs_return_value() in syscall.h patch into a separate set * aligned with the change in arm64: make a single hook to syscall_trace() for all syscall features v3 [1/2] Changes v4 - v5: * rebased to 3.14-rcX * added a guard against TIF_SYSCALL_AUDIT [3/3] * aligned with the change in arm64: make a single hook to syscall_trace() for all syscall features v2 [3/3] Changes v3 - v4: * Modified to sync with the patch, make a single hook to syscall_trace() for all syscall features * aligned with audit: Add CONFIG_HAVE_ARCH_AUDITSYSCALL patch Changes v2 - v3: * Remove asm/audit.h. See generic compat syscall audit support patch v4 * Remove endianness dependency, ie. AUDIT_ARCH_ARMEB/AARCH64EB. * Remove kernel/syscalls/Makefile which was used to create unistd32.h. See Catalin's Add __NR_* definitions for compat syscalls patch Changes v1 - v2: * Modified to utilize generic compat system call audit [3/6, 4/6, 5/6] Please note that a required header, unistd_32.h, is automatically generated from unistd32.h. * Refer to regs-orig_x0 instead of regs-x0 as the first argument of system call in audit_syscall_entry() [6/6] * Include Add regs_return_value() in syscall.h patch [2/6], which was not intentionally included in v1 because it could be added by kprobes support. AKASHI Takahiro (2): arm64: Add audit support arm64: audit: Add audit hook in syscall_trace_enter/exit() arch/arm64/Kconfig | 2 ++ arch/arm64/include/asm/syscall.h | 15 +++ arch/arm64/kernel/ptrace.c | 7 +++ include/uapi/linux/audit.h | 1 + 4 files changed, 25 insertions(+) -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH_v8 0/2] arm64: Add audit support
(Please apply this patch after my ftrace patch to resolve some conflict on arm64/kernel/ptrace.c, functionally it doesn't depend on ftrace though) This patchset adds system call audit support on arm64. Both 32-bit (AUDIT_ARCH_ARM) and 64-bit tasks (AUDIT_ARCH_AARCH64) are supported. Since arm64 has the exact same set of system calls on LE and BE, we don't care about endianness (or more specifically __AUDIT_ARCH_64BIT bit in AUDIT_ARCH_*). There are some prerequisites for this patch to work correctly: * "audit: Add CONFIG_HAVE_ARCH_AUDITSYSCALL" patch * "audit: generic compat system call audit support" patch * "arm64: __NR_* definitions for compat syscalls" patch from Catalin * "arm64: make a single hook to syscall_trace() for all syscall features" patch * "arm64: split syscall_trace() into separate functions for enter/exit" patch * "arm64: Add regs_return_value() in syscall.h" patch * "arm64: is_compat_task is defined both in asm/compat.h and linux/compat.h" patch * userspace audit tool (v2.3.2 + my patch for arm64) Please review them as well for better understandings. This code was tested on both 32-bit and 64-bit LE userland in the following two ways: 1) basic operations with auditctl/autrace # auditctl -a exit,always -S openat -F path=/etc/inittab # auditctl -a exit,always -F dir=/tmp -F perm=rw # auditctl -a task,always # autrace /bin/ls by comparing output from autrace with one from strace 2) audit-test-code (+ my workarounds for arm/arm64) by running "audit-tool", "filter" and "syscalls" test categories. Changes v7 -> v8: * aligned with the change in "audit: generic compat system call audit support" v5 [1/2] * aligned with the change in "arm64: split syscall_trace() into separate functions for enter/exit" v5 [2/2] Changes v6 -> v7: * changed an include file in syscall.h from to [1/2] * aligned with the patch, "arm64: split syscall_trace() into separate functions for enter/exit" [2/2] Changes v5 -> v6: * removed and put "arm64: Add regs_return_value() in syscall.h" patch into a separate set * aligned with the change in "arm64: make a single hook to syscall_trace() for all syscall features" v3 [1/2] Changes v4 -> v5: * rebased to 3.14-rcX * added a guard against TIF_SYSCALL_AUDIT [3/3] * aligned with the change in "arm64: make a single hook to syscall_trace() for all syscall features" v2 [3/3] Changes v3 -> v4: * Modified to sync with the patch, "make a single hook to syscall_trace() for all syscall features" * aligned with "audit: Add CONFIG_HAVE_ARCH_AUDITSYSCALL" patch Changes v2 -> v3: * Remove asm/audit.h. See "generic compat syscall audit support" patch v4 * Remove endianness dependency, ie. AUDIT_ARCH_ARMEB/AARCH64EB. * Remove kernel/syscalls/Makefile which was used to create unistd32.h. See Catalin's "Add __NR_* definitions for compat syscalls" patch Changes v1 -> v2: * Modified to utilize "generic compat system call audit" [3/6, 4/6, 5/6] Please note that a required header, unistd_32.h, is automatically generated from unistd32.h. * Refer to regs->orig_x0 instead of regs->x0 as the first argument of system call in audit_syscall_entry() [6/6] * Include "Add regs_return_value() in syscall.h" patch [2/6], which was not intentionally included in v1 because it could be added by "kprobes support". AKASHI Takahiro (2): arm64: Add audit support arm64: audit: Add audit hook in syscall_trace_enter/exit() arch/arm64/Kconfig | 2 ++ arch/arm64/include/asm/syscall.h | 15 +++ arch/arm64/kernel/ptrace.c | 7 +++ include/uapi/linux/audit.h | 1 + 4 files changed, 25 insertions(+) -- 1.8.3.2 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH_v8 0/2] arm64: Add audit support
(Please apply this patch after my ftrace patch to resolve some conflict on arm64/kernel/ptrace.c, functionally it doesn't depend on ftrace though) This patchset adds system call audit support on arm64. Both 32-bit (AUDIT_ARCH_ARM) and 64-bit tasks (AUDIT_ARCH_AARCH64) are supported. Since arm64 has the exact same set of system calls on LE and BE, we don't care about endianness (or more specifically __AUDIT_ARCH_64BIT bit in AUDIT_ARCH_*). There are some prerequisites for this patch to work correctly: * audit: Add CONFIG_HAVE_ARCH_AUDITSYSCALL patch * audit: generic compat system call audit support patch * arm64: __NR_* definitions for compat syscalls patch from Catalin * arm64: make a single hook to syscall_trace() for all syscall features patch * arm64: split syscall_trace() into separate functions for enter/exit patch * arm64: Add regs_return_value() in syscall.h patch * arm64: is_compat_task is defined both in asm/compat.h and linux/compat.h patch * userspace audit tool (v2.3.2 + my patch for arm64) Please review them as well for better understandings. This code was tested on both 32-bit and 64-bit LE userland in the following two ways: 1) basic operations with auditctl/autrace # auditctl -a exit,always -S openat -F path=/etc/inittab # auditctl -a exit,always -F dir=/tmp -F perm=rw # auditctl -a task,always # autrace /bin/ls by comparing output from autrace with one from strace 2) audit-test-code (+ my workarounds for arm/arm64) by running audit-tool, filter and syscalls test categories. Changes v7 - v8: * aligned with the change in audit: generic compat system call audit support v5 [1/2] * aligned with the change in arm64: split syscall_trace() into separate functions for enter/exit v5 [2/2] Changes v6 - v7: * changed an include file in syscall.h from linux/audit.h to uapi/linux/audit.h [1/2] * aligned with the patch, arm64: split syscall_trace() into separate functions for enter/exit [2/2] Changes v5 - v6: * removed and put arm64: Add regs_return_value() in syscall.h patch into a separate set * aligned with the change in arm64: make a single hook to syscall_trace() for all syscall features v3 [1/2] Changes v4 - v5: * rebased to 3.14-rcX * added a guard against TIF_SYSCALL_AUDIT [3/3] * aligned with the change in arm64: make a single hook to syscall_trace() for all syscall features v2 [3/3] Changes v3 - v4: * Modified to sync with the patch, make a single hook to syscall_trace() for all syscall features * aligned with audit: Add CONFIG_HAVE_ARCH_AUDITSYSCALL patch Changes v2 - v3: * Remove asm/audit.h. See generic compat syscall audit support patch v4 * Remove endianness dependency, ie. AUDIT_ARCH_ARMEB/AARCH64EB. * Remove kernel/syscalls/Makefile which was used to create unistd32.h. See Catalin's Add __NR_* definitions for compat syscalls patch Changes v1 - v2: * Modified to utilize generic compat system call audit [3/6, 4/6, 5/6] Please note that a required header, unistd_32.h, is automatically generated from unistd32.h. * Refer to regs-orig_x0 instead of regs-x0 as the first argument of system call in audit_syscall_entry() [6/6] * Include Add regs_return_value() in syscall.h patch [2/6], which was not intentionally included in v1 because it could be added by kprobes support. AKASHI Takahiro (2): arm64: Add audit support arm64: audit: Add audit hook in syscall_trace_enter/exit() arch/arm64/Kconfig | 2 ++ arch/arm64/include/asm/syscall.h | 15 +++ arch/arm64/kernel/ptrace.c | 7 +++ include/uapi/linux/audit.h | 1 + 4 files changed, 25 insertions(+) -- 1.8.3.2 -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
