9:40 a.m.
Add a couple of missing execve variants to the syscall
classification code in the audit system.
- Patch 1 is potentially suitable for 3.19 stable.
- Patch 2 need not be back-applied, as audit doesn't yet work
with x32 syscalls in general.
David Drysdale (2):
audit: add execveat to syscall classification
audit,x86: add x32_execve[at] to syscall classification
arch/x86/kernel/audit_64.c | 6 ++++++
lib/compat_audit.c | 3 +++
2 files changed, 9 insertions(+)
--
1.9.1
9:40 a.m.
New subject: [PATCH 1/2] audit: add execveat to syscall classification
New execveat syscall from v3.19 is missing from
audit_classify_compat_syscall().
Reported-by: Brian Gerst <brgerst(a)gmail.com>
Signed-off-by: David Drysdale <drysdale(a)google.com>
---
lib/compat_audit.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/lib/compat_audit.c b/lib/compat_audit.c
index 873f75b640ab..a49469f0511d 100644
--- a/lib/compat_audit.c
+++ b/lib/compat_audit.c
@@ -42,6 +42,9 @@ int audit_classify_compat_syscall(int abi, unsigned syscall)
case __NR_socketcall:
return 4;
#endif
+#ifdef __NR_execveat
+ case __NR_execveat:
+#endif
case __NR_execve:
return 5;
default:
--
1.9.1
11:45 a.m.
New subject: [PATCH 1/2] audit: add execveat to syscall classification
On Fri, Mar 06, 2015 at 03:40:37PM +0000, David Drysdale wrote:
New execveat syscall from v3.19 is missing from
audit_classify_compat_syscall().
Reported-by: Brian Gerst <brgerst(a)gmail.com>
Signed-off-by: David Drysdale <drysdale(a)google.com>
---
lib/compat_audit.c | 3 +++
1 file changed, 3 insertions(+)
<formletter>
This is not the correct way to submit patches for inclusion in the
stable kernel tree. Please read Documentation/stable_kernel_rules.txt
for how to do this properly.
</formletter>
9:40 a.m.
New subject: [PATCH 2/2] audit,x86: add x32_execve[at] to syscall classification
Treat x32 ABI variants of execve[at] the same as x86_64
variants.
Slightly speculative as the audit subsystem doesn't currently
work with x32 ABI syscalls. If and when audit+x32 does work,
this should correctly classify exec calls.
Signed-off-by: David Drysdale <drysdale(a)google.com>
---
arch/x86/kernel/audit_64.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/arch/x86/kernel/audit_64.c b/arch/x86/kernel/audit_64.c
index f3672508b249..0aec72d8d3c7 100644
--- a/arch/x86/kernel/audit_64.c
+++ b/arch/x86/kernel/audit_64.c
@@ -49,6 +49,12 @@ int audit_classify_syscall(int abi, unsigned syscall)
return 2;
case __NR_openat:
return 3;
+#ifdef __NR_x32_execve
+ case __NR_x32_execve:
+#endif
+#ifdef __NR_x32_execveat
+ case __NR_x32_execveat:
+#endif
case __NR_execve:
case __NR_execveat:
return 5;
--
1.9.1
11:45 a.m.
New subject: [PATCH 2/2] audit,x86: add x32_execve[at] to syscall classification
On Fri, Mar 06, 2015 at 03:40:38PM +0000, David Drysdale wrote:
Treat x32 ABI variants of execve[at] the same as x86_64
variants.
Slightly speculative as the audit subsystem doesn't currently
work with x32 ABI syscalls. If and when audit+x32 does work,
this should correctly classify exec calls.
Signed-off-by: David Drysdale <drysdale(a)google.com>
---
arch/x86/kernel/audit_64.c | 6 ++++++
1 file changed, 6 insertions(+)
<formletter>
Cc: stable <stable(a)vger.kernel.org>
This is not the correct way to submit patches for inclusion in the
stable kernel tree. Please read Documentation/stable_kernel_rules.txt
for how to do this properly.
</formletter>
4010
days inactive
4010
days old
linux-audit@lists.linux-audit.osci.io
4 comments
2 participants
participants (2)
-
David Drysdale -
Greg KH