Fix a handful of audit-related issue

This is sort of a mix between a new feature and a bug fix. I've managed to screw up merging this patch set a handful of times but I think it's OK this time around. The main new feature here is audit support for RISC-V, with some fixes to audit-related bugs that cropped up along the way: * The addition of NR_syscalls into unistd.h, which is necessary for CONFIG_FTRACE_SYSCALLS. * The definition of CREATE_TRACE_POINTS so __tracepoint_sys_{enter,exit} get defined. * A fix for trace_sys_exit() so we can enable CONFIG_HAVE_SYSCALL_TRACEPOINTS.

Palmer Dabbelt committed 7 years ago

Commit 80100942 parents 2cffc95 5aeb1b38 files · +37 −3Browse files

Unified · Split

8 files

arch/riscv/Kconfig +2 −0
arch/riscv/include/asm/ptrace.h +5 −0
arch/riscv/include/asm/syscall.h +10 −0
arch/riscv/include/asm/thread_info.h +6 −0
arch/riscv/include/asm/unistd.h +2 −0
arch/riscv/kernel/entry.S +2 −2
arch/riscv/kernel/ptrace.c +8 −1
include/uapi/linux/audit.h +2 −0

arch/riscv/Kconfig+2−0

@@ -28,11 +28,13 @@ config RISCV · 27 unmodified lines
28	28	select GENERIC_STRNLEN_USER
29	29	select GENERIC_SMP_IDLE_THREAD
30	30	select GENERIC_ATOMIC64 if !64BIT \|\| !RISCV_ISA_A
	31	+ select HAVE_ARCH_AUDITSYSCALL
31	32	select HAVE_MEMBLOCK_NODE_MAP
32	33	select HAVE_DMA_CONTIGUOUS
33	34	select HAVE_FUTEX_CMPXCHG if FUTEX
34	35	select HAVE_GENERIC_DMA_COHERENT
35	36	select HAVE_PERF_EVENTS
	37	+ select HAVE_SYSCALL_TRACEPOINTS
36	38	select IRQ_DOMAIN
37	39	select RISCV_ISA_A if SMP
38	40	select SPARSE_IRQ

arch/riscv/include/asm/ptrace.h+5−0

@@ -113,6 +113,11 @@ static inline void frame_pointer_set(struct pt_regs *regs, · 112 unmodified lines
113	113	SET_FP(regs, val);
114	114	}
115	115
	116	+static inline unsigned long regs_return_value(struct pt_regs *regs)
	117	+{
	118	+ return regs->a0;
	119	+}
	120	+
116	121	#endif /* __ASSEMBLY__ */
117	122
118	123	#endif /* _ASM_RISCV_PTRACE_H */

arch/riscv/include/asm/syscall.h+10−0

@@ -18,6 +18,7 @@ · 17 unmodified lines
18	18	#ifndef _ASM_RISCV_SYSCALL_H
19	19	#define _ASM_RISCV_SYSCALL_H
20	20
	21	+#include <uapi/linux/audit.h>
21	22	#include <linux/sched.h>
22	23	#include <linux/err.h>
23	24
@@ -99,4 +100,13 @@ static inline void syscall_set_arguments(struct task_struct *task, · 75 unmodified lines
99	100	memcpy(&regs->a1 + i * sizeof(regs->a1), args, n * sizeof(regs->a0));
100	101	}
101	102
	103	+static inline int syscall_get_arch(void)
	104	+{
	105	+#ifdef CONFIG_64BIT
	106	+ return AUDIT_ARCH_RISCV64;
	107	+#else
	108	+ return AUDIT_ARCH_RISCV32;
	109	+#endif
	110	+}
	111	+
102	112	#endif /* _ASM_RISCV_SYSCALL_H */

arch/riscv/include/asm/thread_info.h+6−0

@@ -80,13 +80,19 @@ struct thread_info { · 79 unmodified lines
80	80	#define TIF_RESTORE_SIGMASK 4 /* restore signal mask in do_signal() */
81	81	#define TIF_MEMDIE 5 /* is terminating due to OOM killer */
82	82	#define TIF_SYSCALL_TRACEPOINT 6 /* syscall tracepoint instrumentation */
	83	+#define TIF_SYSCALL_AUDIT 7 /* syscall auditing */
83	84
84	85	#define _TIF_SYSCALL_TRACE (1 << TIF_SYSCALL_TRACE)
85	86	#define _TIF_NOTIFY_RESUME (1 << TIF_NOTIFY_RESUME)
86	87	#define _TIF_SIGPENDING (1 << TIF_SIGPENDING)
87	88	#define _TIF_NEED_RESCHED (1 << TIF_NEED_RESCHED)
	89	+#define _TIF_SYSCALL_TRACEPOINT (1 << TIF_SYSCALL_TRACEPOINT)
	90	+#define _TIF_SYSCALL_AUDIT (1 << TIF_SYSCALL_AUDIT)
88	91
89	92	#define _TIF_WORK_MASK \
90	93	(_TIF_NOTIFY_RESUME \| _TIF_SIGPENDING \| _TIF_NEED_RESCHED)
91	94
	95	+#define _TIF_SYSCALL_WORK \
	96	+ (_TIF_SYSCALL_TRACE \| _TIF_SYSCALL_TRACEPOINT \| _TIF_SYSCALL_AUDIT)
	97	+
92	98	#endif /* _ASM_RISCV_THREAD_INFO_H */

arch/riscv/include/asm/unistd.h+2−0

@@ -19,3 +19,5 @@ · 18 unmodified lines
19	19	#define __ARCH_WANT_SYS_CLONE
20	20
21	21	#include <uapi/asm/unistd.h>
	22	+
	23	+#define NR_syscalls (__NR_syscalls)

arch/riscv/kernel/entry.S+2−2

@@ -201,7 +201,7 @@ handle_syscall: · 200 unmodified lines
201	201	REG_S s2, PT_SEPC(sp)
202	202	/* Trace syscalls, but only if requested by the user. */
203	203	REG_L t0, TASK_TI_FLAGS(tp)
204		− andi t0, t0, _TIF_SYSCALL_TRACE
	204	+ andi t0, t0, _TIF_SYSCALL_WORK
205	205	bnez t0, handle_syscall_trace_enter
206	206	check_syscall_nr:
207	207	/* Check to make sure we don't jump to a bogus syscall number. */
@@ -221,7 +221,7 @@ ret_from_syscall: · 13 unmodified lines
221	221	REG_S a0, PT_A0(sp)
222	222	/* Trace syscalls, but only if requested by the user. */
223	223	REG_L t0, TASK_TI_FLAGS(tp)
224		− andi t0, t0, _TIF_SYSCALL_TRACE
	224	+ andi t0, t0, _TIF_SYSCALL_WORK
225	225	bnez t0, handle_syscall_trace_exit
226	226
227	227	ret_from_exception:

arch/riscv/kernel/ptrace.c+8−1

@@ -18,12 +18,15 @@ · 17 unmodified lines
18	18	#include <asm/ptrace.h>
19	19	#include <asm/syscall.h>
20	20	#include <asm/thread_info.h>
	21	+#include <linux/audit.h>
21	22	#include <linux/ptrace.h>
22	23	#include <linux/elf.h>
23	24	#include <linux/regset.h>
24	25	#include <linux/sched.h>
25	26	#include <linux/sched/task_stack.h>
26	27	#include <linux/tracehook.h>
	28	+
	29	+#define CREATE_TRACE_POINTS
27	30	#include <trace/events/syscalls.h>
28	31
29	32	enum riscv_regset {
@@ -163,15 +166,19 @@ void do_syscall_trace_enter(struct pt_regs *regs) · 133 unmodified lines
163	166	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
164	167	trace_sys_enter(regs, syscall_get_nr(current, regs));
165	168	#endif
	169	+
	170	+ audit_syscall_entry(regs->a7, regs->a0, regs->a1, regs->a2, regs->a3);
166	171	}
167	172
168	173	void do_syscall_trace_exit(struct pt_regs *regs)
169	174	{
	175	+ audit_syscall_exit(regs);
	176	+
170	177	if (test_thread_flag(TIF_SYSCALL_TRACE))
171	178	tracehook_report_syscall_exit(regs, 0);
172	179
173	180	#ifdef CONFIG_HAVE_SYSCALL_TRACEPOINTS
174	181	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
175		− trace_sys_exit(regs, regs->regs[0]);
	182	+ trace_sys_exit(regs, regs_return_value(regs));
176	183	#endif
177	184	}

include/uapi/linux/audit.h+2−0

@@ -400,6 +400,8 @@ enum { · 399 unmodified lines
400	400	/* do not define AUDIT_ARCH_PPCLE since it is not supported by audit */
401	401	#define AUDIT_ARCH_PPC64 (EM_PPC64\|__AUDIT_ARCH_64BIT)
402	402	#define AUDIT_ARCH_PPC64LE (EM_PPC64\|__AUDIT_ARCH_64BIT\|__AUDIT_ARCH_LE)
	403	+#define AUDIT_ARCH_RISCV32 (EM_RISCV\|__AUDIT_ARCH_LE)
	404	+#define AUDIT_ARCH_RISCV64 (EM_RISCV\|__AUDIT_ARCH_64BIT\|__AUDIT_ARCH_LE)
403	405	#define AUDIT_ARCH_S390 (EM_S390)
404	406	#define AUDIT_ARCH_S390X (EM_S390\|__AUDIT_ARCH_64BIT)
405	407	#define AUDIT_ARCH_SH (EM_SH)