Re: [PATCH 1/2] audit: add support for the openat2 syscall
On 2021-03-18 11:52, Christian Brauner wrote:
On Thu, Mar 18, 2021 at 11:48:45AM +0100, Christian Brauner wrote:
> On Wed, Mar 17, 2021 at 09:47:17PM -0400, Richard Guy Briggs wrote:
> > The openat2(2) syscall was added in kernel v5.6 with commit fddb5d430ad9
> > ("open: introduce openat2(2) syscall")
> > Add the openat2(2) syscall to the audit syscall classifier.
> > See the github issue
> > https://github.com/linux-audit/audit-kernel/issues/67
> > Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com>
...
And one more comment, why return a hard-coded integer from all of
these
architectures instead of introducing an enum in a central place with
proper names idk:
Oh, believe me, I tried hard to do that because I really don't like
hard-coded magic values, but for expediency I continued the same
approach until I could sort out the header file mess. There was an
extra preparatory patch (attached) in this patchset with a different
audit syscall perms patch (also attached). By including "#include
<linux/audit.h>" in each of the compat source files there were warnings
of redefinitions of every __NR_* syscall number. The easiest way to get
rid of it would have been to pull the new AUDITSC_* definitions into a
new <linux/auditsc.h> file and include that from <linux/audit.h> and
each of the arch/*/*/*audit.c (and lib/*audit.c) files.
enum audit_match_perm_t {
.
.
.
AUDIT_MATCH_PERM_EXECVE = 5,
AUDIT_MATCH_PERM_OPENAT2 = 6,
.
.
.
}
Then you can drop these hard-coded comments too and it's way less
brittle overall.
Totally agree.
Christian
- RGB
--
Richard Guy Briggs <rgb(a)redhat.com>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635
Attachments:
- 0002-audit-add-support-for-the-openat2-syscall.patch (text/plain — 7.8 KB)
- 0001-audit-replace-magic-audit-syscall-class-numbers-with.patch (text/plain — 11.9 KB)