Fix a handful of audit-related issue

This is sort of a mix between a new feature and a bug fix. I've managed to screw up merging this patch set a handful of times but I think it's OK this time around. The main new feature here is audit support for RISC-V, with some fixes to audit-related bugs that cropped up along the way: * The addition of NR_syscalls into unistd.h, which is necessary for CONFIG_FTRACE_SYSCALLS. * The definition of CREATE_TRACE_POINTS so __tracepoint_sys_{enter,exit} get defined. * A fix for trace_sys_exit() so we can enable CONFIG_HAVE_SYSCALL_TRACEPOINTS.

Palmer Dabbelt committed 7 years ago

Commit 80100942 parents 2cffc95 5aeb1b38 files · +37 −3Browse files

Unified · Split

8 files

arch/riscv/Kconfig +2 −0
arch/riscv/include/asm/ptrace.h +5 −0
arch/riscv/include/asm/syscall.h +10 −0
arch/riscv/include/asm/thread_info.h +6 −0
arch/riscv/include/asm/unistd.h +2 −0
arch/riscv/kernel/entry.S +2 −2
arch/riscv/kernel/ptrace.c +8 −1
include/uapi/linux/audit.h +2 −0

arch/riscv/Kconfig+2−0

 	select GENERIC_STRNLEN_USER
 	select GENERIC_SMP_IDLE_THREAD
 	select GENERIC_ATOMIC64 if !64BIT || !RISCV_ISA_A
+	select HAVE_ARCH_AUDITSYSCALL
 	select HAVE_MEMBLOCK_NODE_MAP
 	select HAVE_DMA_CONTIGUOUS
 	select HAVE_FUTEX_CMPXCHG if FUTEX
 	select HAVE_GENERIC_DMA_COHERENT
 	select HAVE_PERF_EVENTS
+	select HAVE_SYSCALL_TRACEPOINTS
 	select IRQ_DOMAIN
 	select RISCV_ISA_A if SMP
 	select SPARSE_IRQ

arch/riscv/include/asm/ptrace.h+5−0

 	SET_FP(regs, val);
 }
+static inline unsigned long regs_return_value(struct pt_regs *regs)
+{
+	return regs->a0;
+}
 #endif /* __ASSEMBLY__ */
 #endif /* _ASM_RISCV_PTRACE_H */

arch/riscv/include/asm/syscall.h+10−0

 #ifndef _ASM_RISCV_SYSCALL_H
 #define _ASM_RISCV_SYSCALL_H
+#include <uapi/linux/audit.h>
 #include <linux/sched.h>
 #include <linux/err.h>
 	memcpy(&regs->a1 + i * sizeof(regs->a1), args, n * sizeof(regs->a0));
 }
+static inline int syscall_get_arch(void)
+{
+#ifdef CONFIG_64BIT
+	return AUDIT_ARCH_RISCV64;
+#else
+	return AUDIT_ARCH_RISCV32;
+#endif
+}
 #endif	/* _ASM_RISCV_SYSCALL_H */

arch/riscv/include/asm/thread_info.h+6−0

 #define TIF_RESTORE_SIGMASK	4	/* restore signal mask in do_signal() */
 #define TIF_MEMDIE		5	/* is terminating due to OOM killer */
 #define TIF_SYSCALL_TRACEPOINT  6       /* syscall tracepoint instrumentation */
+#define TIF_SYSCALL_AUDIT	7	/* syscall auditing */
 #define _TIF_SYSCALL_TRACE	(1 << TIF_SYSCALL_TRACE)
 #define _TIF_NOTIFY_RESUME	(1 << TIF_NOTIFY_RESUME)
 #define _TIF_SIGPENDING		(1 << TIF_SIGPENDING)
 #define _TIF_NEED_RESCHED	(1 << TIF_NEED_RESCHED)
+#define _TIF_SYSCALL_TRACEPOINT	(1 << TIF_SYSCALL_TRACEPOINT)
+#define _TIF_SYSCALL_AUDIT	(1 << TIF_SYSCALL_AUDIT)
 #define _TIF_WORK_MASK \
 	(_TIF_NOTIFY_RESUME | _TIF_SIGPENDING | _TIF_NEED_RESCHED)
+#define _TIF_SYSCALL_WORK \
+	(_TIF_SYSCALL_TRACE | _TIF_SYSCALL_TRACEPOINT | _TIF_SYSCALL_AUDIT)
 #endif /* _ASM_RISCV_THREAD_INFO_H */

arch/riscv/include/asm/unistd.h+2−0

@@ -19,3 +19,5 @@ · 18 unmodified lines
19	#define __ARCH_WANT_SYS_CLONE	19	#define __ARCH_WANT_SYS_CLONE
20		20
21	#include <uapi/asm/unistd.h>	21	#include <uapi/asm/unistd.h>
		22
		23	#define NR_syscalls (__NR_syscalls)

arch/riscv/kernel/entry.S+2−2

@@ -201,7 +201,7 @@ handle_syscall: · 200 unmodified lines
201	REG_S s2, PT_SEPC(sp)	201	REG_S s2, PT_SEPC(sp)
202	/* Trace syscalls, but only if requested by the user. */	202	/* Trace syscalls, but only if requested by the user. */
203	REG_L t0, TASK_TI_FLAGS(tp)	203	REG_L t0, TASK_TI_FLAGS(tp)
204	andi t0, t0, _TIF_SYSCALL_TRACE	204	andi t0, t0, _TIF_SYSCALL_WORK
205	bnez t0, handle_syscall_trace_enter	205	bnez t0, handle_syscall_trace_enter
206	check_syscall_nr:	206	check_syscall_nr:
207	/* Check to make sure we don't jump to a bogus syscall number. */	207	/* Check to make sure we don't jump to a bogus syscall number. */
@@ -221,7 +221,7 @@ ret_from_syscall: · 13 unmodified lines
221	REG_S a0, PT_A0(sp)	221	REG_S a0, PT_A0(sp)
222	/* Trace syscalls, but only if requested by the user. */	222	/* Trace syscalls, but only if requested by the user. */
223	REG_L t0, TASK_TI_FLAGS(tp)	223	REG_L t0, TASK_TI_FLAGS(tp)
224	andi t0, t0, _TIF_SYSCALL_TRACE	224	andi t0, t0, _TIF_SYSCALL_WORK
225	bnez t0, handle_syscall_trace_exit	225	bnez t0, handle_syscall_trace_exit
226		226
227	ret_from_exception:	227	ret_from_exception:

arch/riscv/kernel/ptrace.c+8−1

 #include <asm/ptrace.h>
 #include <asm/syscall.h>
 #include <asm/thread_info.h>
+#include <linux/audit.h>
 #include <linux/ptrace.h>
 #include <linux/elf.h>
 #include <linux/regset.h>
 #include <linux/sched.h>
 #include <linux/sched/task_stack.h>
 #include <linux/tracehook.h>
+#define CREATE_TRACE_POINTS
 #include <trace/events/syscalls.h>
 enum riscv_regset {
 	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
 		trace_sys_enter(regs, syscall_get_nr(current, regs));
 #endif
+	audit_syscall_entry(regs->a7, regs->a0, regs->a1, regs->a2, regs->a3);
 }
 void do_syscall_trace_exit(struct pt_regs *regs)
 {
+	audit_syscall_exit(regs);
 	if (test_thread_flag(TIF_SYSCALL_TRACE))
 		tracehook_report_syscall_exit(regs, 0);
 #ifdef CONFIG_HAVE_SYSCALL_TRACEPOINTS
 	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
-		trace_sys_exit(regs, regs->regs[0]);
+		trace_sys_exit(regs, regs_return_value(regs));
 #endif
 }

include/uapi/linux/audit.h+2−0

 /* do not define AUDIT_ARCH_PPCLE since it is not supported by audit */
 #define AUDIT_ARCH_PPC64	(EM_PPC64|__AUDIT_ARCH_64BIT)
 #define AUDIT_ARCH_PPC64LE	(EM_PPC64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
+#define AUDIT_ARCH_RISCV32	(EM_RISCV|__AUDIT_ARCH_LE)
+#define AUDIT_ARCH_RISCV64	(EM_RISCV|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
 #define AUDIT_ARCH_S390		(EM_S390)
 #define AUDIT_ARCH_S390X	(EM_S390|__AUDIT_ARCH_64BIT)
 #define AUDIT_ARCH_SH		(EM_SH)