xtensa: add audit support
authorMax Filippov <jcmvbkbc@gmail.com>
Mon, 1 May 2017 13:17:47 +0000 (06:17 -0700)
committerMax Filippov <jcmvbkbc@gmail.com>
Tue, 28 Jul 2020 07:57:05 +0000 (00:57 -0700)
All bits needed for syscall audit are present on xtensa. Add
audit_syscall_entry and audit_syscall_exit calls and select
HAVE_ARCH_AUDITSYSCALL in Kconfig.

Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
arch/xtensa/Kconfig
arch/xtensa/include/asm/thread_info.h
arch/xtensa/kernel/ptrace.c

index 3a9f1e8..a7def09 100644 (file)
@@ -21,6 +21,7 @@ config XTENSA
        select GENERIC_PCI_IOMAP
        select GENERIC_SCHED_CLOCK
        select GENERIC_STRNCPY_FROM_USER if KASAN
+       select HAVE_ARCH_AUDITSYSCALL
        select HAVE_ARCH_JUMP_LABEL if !XIP_KERNEL
        select HAVE_ARCH_KASAN if MMU && !XIP_KERNEL
        select HAVE_ARCH_TRACEHOOK
index f092cc3..c49cc4a 100644 (file)
@@ -111,15 +111,17 @@ static inline struct thread_info *current_thread_info(void)
 #define TIF_RESTORE_SIGMASK    6       /* restore signal mask in do_signal() */
 #define TIF_NOTIFY_RESUME      7       /* callback before returning to user */
 #define TIF_DB_DISABLED                8       /* debug trap disabled for syscall */
+#define TIF_SYSCALL_AUDIT      9       /* syscall auditing active */
 
 #define _TIF_SYSCALL_TRACE     (1<<TIF_SYSCALL_TRACE)
 #define _TIF_SIGPENDING                (1<<TIF_SIGPENDING)
 #define _TIF_NEED_RESCHED      (1<<TIF_NEED_RESCHED)
 #define _TIF_SINGLESTEP                (1<<TIF_SINGLESTEP)
 #define _TIF_SYSCALL_TRACEPOINT        (1<<TIF_SYSCALL_TRACEPOINT)
+#define _TIF_SYSCALL_AUDIT     (1<<TIF_SYSCALL_AUDIT)
 
 #define _TIF_WORK_MASK         (_TIF_SYSCALL_TRACE | _TIF_SINGLESTEP | \
-                                _TIF_SYSCALL_TRACEPOINT)
+                                _TIF_SYSCALL_TRACEPOINT | _TIF_SYSCALL_AUDIT)
 
 #define THREAD_SIZE KERNEL_STACK_SIZE
 #define THREAD_SIZE_ORDER (KERNEL_STACK_SHIFT - PAGE_SHIFT)
index b4c07bd..0278d7d 100644 (file)
@@ -12,6 +12,7 @@
  * Marc Gauthier<marc@tensilica.com> <marc@alumni.uwaterloo.ca>
  */
 
+#include <linux/audit.h>
 #include <linux/errno.h>
 #include <linux/hw_breakpoint.h>
 #include <linux/kernel.h>
@@ -562,6 +563,9 @@ int do_syscall_trace_enter(struct pt_regs *regs)
        if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
                trace_sys_enter(regs, syscall_get_nr(current, regs));
 
+       audit_syscall_entry(regs->syscall, regs->areg[6],
+                           regs->areg[3], regs->areg[4],
+                           regs->areg[5]);
        return 1;
 }
 
@@ -569,6 +573,8 @@ void do_syscall_trace_leave(struct pt_regs *regs)
 {
        int step;
 
+       audit_syscall_exit(regs);
+
        if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
                trace_sys_exit(regs, regs_return_value(regs));