To whom it may concern,

Hi,  

           I am a CS research assistant currently working at Lahore University of Management Sciences (LUMS), Pakistan. The project I am working on involves understanding and working with the Linux Audit Kernel.

As you know, linux-audit logs all the syscall arguments as a1, a2, a3, a4 as unsigned longs. In the case of some syscall, such as WRITE, the second argument, a2, stores the pointer to a buffer, where the buffer contains the content being written. I have been trying to deference the buffer from its address stored in a2. I am dereferencing the buffer currently in kernel/auditsc.c and dumping the dereferenced contents of a2 to printk. However, after building the customized kernel, auditd fails probably due to invalid pointer dereferencing.

                I am confused regarding the scope of that pointer variable stored in a2. I have two questions:

1) Is it possible to deference the syscall arguments in the Linux kernel, given the buffer was initially sent by the process that initiated the syscall?

2) If it is possible to do so, what is the right way to go about it. What is the right file to work if the goal is to dereference the address stored in one of the SYSCALL arguments?

Really looking forward to hearing back from you.

Best Regards,

Adil