Hi, Thank you for the patch! Yet something to improve: [auto build test ERROR on pcmoore-audit/next] [also build test ERROR on v5.17 next-20220325] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch] url: https://github.com/intel-lab-lkp/linux/commits/cgel-zte-gmail-com/audit-d... base: https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit.git next config: alpha-allyesconfig (https://download.01.org/0day-ci/archive/20220327/202203270449.WBYQF9X3-lk...) compiler: alpha-linux-gcc (GCC) 11.2.0 reproduce (this is a W=1 build): wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross # https://github.com/intel-lab-lkp/linux/commit/052b1a11a0bec23358ecc22ad9b... git remote add linux-review https://github.com/intel-lab-lkp/linux git fetch --no-tags linux-review cgel-zte-gmail-com/audit-do-a-quick-exit-when-syscall-number-is-invalid/20220326-174904 git checkout 052b1a11a0bec23358ecc22ad9b085590efd3057 # save the config file to linux build tree mkdir build_dir COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-11.2.0 make.cross O=build_dir ARCH=alpha SHELL=/bin/bash If you fix the issue, kindly add following tag as appropriate Reported-by: kernel test robot <lkp(a)intel.com&gt; All errors (new ones prefixed by >>): In file included from include/linux/init.h:5, from kernel/auditsc.c:34: kernel/auditsc.c: In function '__audit_syscall_exit': 2081 | unlikely(context->major < 0 || context->major > NR_syscalls)) | ^~~~~~~~~~~ include/linux/compiler.h:78:45: note: in definition of macro 'unlikely' 78 | # define unlikely(x) __builtin_expect(!!(x), 0) | ^ kernel/auditsc.c:2081:61: note: each undeclared identifier is reported only once for each function it appears in 2081 | unlikely(context->major < 0 || context->major > NR_syscalls)) | ^~~~~~~~~~~ include/linux/compiler.h:78:45: note: in definition of macro 'unlikely' 78 | # define unlikely(x) __builtin_expect(!!(x), 0) | ^ vim +2081 kernel/auditsc.c 2063 2064 /** 2065 * __audit_syscall_exit - deallocate audit context after a system call 2066 * @success: success value of the syscall 2067 * @return_code: return value of the syscall 2068 * 2069 * Tear down after system call. If the audit context has been marked as 2070 * auditable (either because of the AUDIT_STATE_RECORD state from 2071 * filtering, or because some other part of the kernel wrote an audit 2072 * message), then write out the syscall information. In call cases, 2073 * free the names stored from getname(). 2074 */ 2075 void __audit_syscall_exit(int success, long return_code) 2076 { 2077 struct audit_context *context = audit_context(); 2078 2079 if (!context || context->dummy || 2080 context->context != AUDIT_CTX_SYSCALL || 2082 goto out; 2083 2084 /* this may generate CONFIG_CHANGE records */ 2085 if (!list_empty(&context->killed_trees)) 2086 audit_kill_trees(context); 2087 2088 /* run through both filters to ensure we set the filterkey properly */ 2089 audit_filter_syscall(current, context); 2090 audit_filter_inodes(current, context); 2091 if (context->current_state < AUDIT_STATE_RECORD) 2092 goto out; 2093 2094 audit_return_fixup(context, success, return_code); 2095 audit_log_exit(); 2096 2097 out: 2098 audit_reset_context(context); 2099 } 2100 -- 0-DAY CI Kernel Test Service https://01.org/lkp

On 03/29, CGEL wrote: Sorry, no experience either, but from a quick look at arch/alpha/include/asm/unistd.h shows that it's called NR_SYSCALLS for alpha arch, for whatever reason. HTH Enzo

On Mon, Mar 28, 2022 at 11:06:12PM -0400, Paul Moore wrote: Thanks for your reply. But syscall number less than 0 is even invalid for auditctl. So we will never hit this kind of audit rule. And invalid syscall number will always cause failure early in syscall handle. sh-4.2# auditctl -a always,exit -F arch=b64 -S -1 Syscall name unknown: -1

On Tue, Mar 29, 2022 at 09:11:19AM -0400, Paul Moore wrote: I have tried this, and execute program which call syscall number is -1, audit still didn't record it. It supports that there's no need for audit to handle syscall number less than 0. sh-4.2# auditctl -a exit,always sh-4.2# auditctl -l -a always,exit -S all

On Wed, Mar 30, 2022 at 10:48:12AM -0400, Paul Moore wrote: If we fix this bug, do you think audit invalid/ENOSYS syscalls better be forcible or be a rule that can be configure? I think configure is better.

On Thu, Mar 31, 2022 at 10:16:23AM -0400, Paul Moore wrote: Thanks, I try to make it more clear. We found that auditctl would only set rule with syscall number (>=0 && <2047). So if userspace using syscall whose number is (<0 || >=2047), there seems no meaning for kernel audit to handle it, since this kind of syscall will never hit any audit rule(this rule could not be set by auditctl). By the way it's a little strange for auditctl(using libaudit.c) to limit syscall number (>=0 && <2047)(see audit_rule_syscall_data()), especially we know NR_syscalls is the real limit in kernel, you can see how other kernel code to the similar thing in ftrace_syscall_enter(): static void ftrace_syscall_enter(void *data, struct pt_regs *regs, long id) { ... syscall_nr = trace_get_syscall_nr(current, regs); if (syscall_nr < 0 || syscall_nr >= NR_syscalls) return; ... } Thanks.

On Fri, Apr 1, 2022 at 9:39 AM Steve Grubb <sgrubb(a)redhat.com&gt; wrote: That is exactly why I wrote the warning below in my response ... -- paul-moore.com

On Sat, Apr 2, 2022 at 4:06 AM CGEL <cgel.zte(a)gmail.com&gt; wrote: I'm really not very clear on what you are proposing, but we can't change the kernel/userspace API in any way which would break compatibility with old/existing userspace tools. -- paul-moore.com

On Mon, Apr 04, 2022 at 11:58:50AM -0400, Richard Guy Briggs wrote: Much appreciate for your interpretation. Have you get any idea of how to solve the mismatched? From your viewpoint, I think it's better for kernel to not handle syscall of syscall number<0, because it's invaild of all arch, and has no value for attacker to probing for specific syscall numbers.

On Wed, Apr 06, 2022 at 12:49:54PM -0400, Richard Guy Briggs wrote: To reproduce "missing auditing invalid syscall": 1.add audit rule auditctl -a always,exit -F arch=b64 -S all 2.run program with invalid syscalls Code as below. Both syscall can not be audited. #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <string.h> #include <sys/types.h> #include <sys/time.h> #include <sys/stat.h> #include <sys/syscall.h> #include <fcntl.h> #include <errno.h> int main(int argc, char * argv[]) { int syscall_num = -1; syscall(syscall_num, 0, NULL); printf("syscall num is %d errno is %d, %s, %d\n",syscall_num, errno, __FILE__, __LINE__); syscall_num = 3000; syscall(syscall_num, 0, NULL); printf("syscall num is %d errno is %d, %s, %d\n",syscall_num, errno, __FILE__, __LINE__); return 1; }