On RISC-V (riscv) audit is supported through generic lib/audit.c. The patch adds required arch specific definitions.
Unified · Split
| @@ -28,6 +28,7 @@ config RISCV · 27 unmodified lines | ||
| 28 | 28 | select GENERIC_STRNLEN_USER |
| 29 | 29 | select GENERIC_SMP_IDLE_THREAD |
| 30 | 30 | select GENERIC_ATOMIC64 if !64BIT || !RISCV_ISA_A |
| 31 | + select HAVE_ARCH_AUDITSYSCALL | |
| 31 | 32 | select HAVE_MEMBLOCK_NODE_MAP |
| 32 | 33 | select HAVE_DMA_CONTIGUOUS |
| 33 | 34 | select HAVE_FUTEX_CMPXCHG if FUTEX |
| @@ -113,6 +113,11 @@ static inline void frame_pointer_set(struct pt_regs *regs, · 112 unmodified lines | ||
| 113 | 113 | SET_FP(regs, val); |
| 114 | 114 | } |
| 115 | 115 | |
| 116 | +static inline unsigned long regs_return_value(struct pt_regs *regs) | |
| 117 | +{ | |
| 118 | + return regs->a0; | |
| 119 | +} | |
| 120 | + | |
| 116 | 121 | #endif /* __ASSEMBLY__ */ |
| 117 | 122 | |
| 118 | 123 | #endif /* _ASM_RISCV_PTRACE_H */ |
| @@ -18,6 +18,7 @@ · 17 unmodified lines | ||
| 18 | 18 | #ifndef _ASM_RISCV_SYSCALL_H |
| 19 | 19 | #define _ASM_RISCV_SYSCALL_H |
| 20 | 20 | |
| 21 | +#include <uapi/linux/audit.h> | |
| 21 | 22 | #include <linux/sched.h> |
| 22 | 23 | #include <linux/err.h> |
| 23 | 24 | |
| @@ -99,4 +100,13 @@ static inline void syscall_set_arguments(struct task_struct *task, · 75 unmodified lines | ||
| 99 | 100 | memcpy(®s->a1 + i * sizeof(regs->a1), args, n * sizeof(regs->a0)); |
| 100 | 101 | } |
| 101 | 102 | |
| 103 | +static inline int syscall_get_arch(void) | |
| 104 | +{ | |
| 105 | +#ifdef CONFIG_64BIT | |
| 106 | + return AUDIT_ARCH_RISCV64; | |
| 107 | +#else | |
| 108 | + return AUDIT_ARCH_RISCV32; | |
| 109 | +#endif | |
| 110 | +} | |
| 111 | + | |
| 102 | 112 | #endif /* _ASM_RISCV_SYSCALL_H */ |
| @@ -80,13 +80,19 @@ struct thread_info { · 79 unmodified lines | ||
| 80 | 80 | #define TIF_RESTORE_SIGMASK 4 /* restore signal mask in do_signal() */ |
| 81 | 81 | #define TIF_MEMDIE 5 /* is terminating due to OOM killer */ |
| 82 | 82 | #define TIF_SYSCALL_TRACEPOINT 6 /* syscall tracepoint instrumentation */ |
| 83 | +#define TIF_SYSCALL_AUDIT 7 /* syscall auditing */ | |
| 83 | 84 | |
| 84 | 85 | #define _TIF_SYSCALL_TRACE (1 << TIF_SYSCALL_TRACE) |
| 85 | 86 | #define _TIF_NOTIFY_RESUME (1 << TIF_NOTIFY_RESUME) |
| 86 | 87 | #define _TIF_SIGPENDING (1 << TIF_SIGPENDING) |
| 87 | 88 | #define _TIF_NEED_RESCHED (1 << TIF_NEED_RESCHED) |
| 89 | +#define _TIF_SYSCALL_TRACEPOINT (1 << TIF_SYSCALL_TRACEPOINT) | |
| 90 | +#define _TIF_SYSCALL_AUDIT (1 << TIF_SYSCALL_AUDIT) | |
| 88 | 91 | |
| 89 | 92 | #define _TIF_WORK_MASK \ |
| 90 | 93 | (_TIF_NOTIFY_RESUME | _TIF_SIGPENDING | _TIF_NEED_RESCHED) |
| 91 | 94 | |
| 95 | +#define _TIF_SYSCALL_WORK \ | |
| 96 | + (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_TRACEPOINT | _TIF_SYSCALL_AUDIT) | |
| 97 | + | |
| 92 | 98 | #endif /* _ASM_RISCV_THREAD_INFO_H */ |
| @@ -201,7 +201,7 @@ handle_syscall: · 200 unmodified lines | ||
| 201 | 201 | REG_S s2, PT_SEPC(sp) |
| 202 | 202 | /* Trace syscalls, but only if requested by the user. */ |
| 203 | 203 | REG_L t0, TASK_TI_FLAGS(tp) |
| 204 | − andi t0, t0, _TIF_SYSCALL_TRACE | |
| 204 | + andi t0, t0, _TIF_SYSCALL_WORK | |
| 205 | 205 | bnez t0, handle_syscall_trace_enter |
| 206 | 206 | check_syscall_nr: |
| 207 | 207 | /* Check to make sure we don't jump to a bogus syscall number. */ |
| @@ -221,7 +221,7 @@ ret_from_syscall: · 13 unmodified lines | ||
| 221 | 221 | REG_S a0, PT_A0(sp) |
| 222 | 222 | /* Trace syscalls, but only if requested by the user. */ |
| 223 | 223 | REG_L t0, TASK_TI_FLAGS(tp) |
| 224 | − andi t0, t0, _TIF_SYSCALL_TRACE | |
| 224 | + andi t0, t0, _TIF_SYSCALL_WORK | |
| 225 | 225 | bnez t0, handle_syscall_trace_exit |
| 226 | 226 | |
| 227 | 227 | ret_from_exception: |
| @@ -399,6 +399,8 @@ enum { · 398 unmodified lines | ||
| 399 | 399 | /* do not define AUDIT_ARCH_PPCLE since it is not supported by audit */ |
| 400 | 400 | #define AUDIT_ARCH_PPC64 (EM_PPC64|__AUDIT_ARCH_64BIT) |
| 401 | 401 | #define AUDIT_ARCH_PPC64LE (EM_PPC64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE) |
| 402 | +#define AUDIT_ARCH_RISCV32 (EM_RISCV|__AUDIT_ARCH_LE) | |
| 403 | +#define AUDIT_ARCH_RISCV64 (EM_RISCV|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE) | |
| 402 | 404 | #define AUDIT_ARCH_S390 (EM_S390) |
| 403 | 405 | #define AUDIT_ARCH_S390X (EM_S390|__AUDIT_ARCH_64BIT) |
| 404 | 406 | #define AUDIT_ARCH_SH (EM_SH) |