OneGun Lee wrote: [Wed Aug 20 2008, 09:40:48PM EDT] The Linux kernel audit system is actually called Lightweight Audit Framework. The LAuS system was maintained for a while as an out-of-tree patch. At this point you want to enable the Lightweight Audit Framework for the ARM architecture. Unfortunately, there hasn't been a lot of public documentation written that I'm aware of. Here are a couple of things that were written early on in the project. http://lwn.net/Articles/73623/ and http://www.redhat.com/archives/linux-audit/2004-August/msg00000.html A lot of features have been added since then and some things may have been changed, but that should at least give you an overview of how it works. Those docs don't really cover the architecture-specific parts though. I did a little work on the ia64 audit code, so I'll try to write a bit about that. The two architecture-specific pieces are syscall interception and syscall classes. Syscall interception is implemented alongside syscall tracing. You'll need to: 1. Define the TIF_SYSCALL_AUDIT flag, which indicates that syscall auditing is active for a task. The flag is used to determine whether to call audit_syscall_entry, and also for any special handling required when the code doesn't follow the normal paths: e.g. signal handling, streamlined syscalls, etc. You'll also want to make sure the flag is properly preserved when a child is created. I'm not sure how fully syscall tracing has been implemented for ARM, but if the implementation is complete, the TIF_SYSCALL_TRACE flag should be a good indicator of where you need to add handling for TIF_SYSCALL_AUDIT. 2. Make calls to audit_syscall_entry() and audit_syscall_exit() at the beginning and end of syscall processing. audit_syscall_entry() requires certain parameters: architecture flag, syscall number and syscall args from the appropriate registers. audit_syscall_exit() requires an indication of operation success and syscall return value. Audit expects success values to be defined as 0=fail, 1=success. When the syscall operation failed, the return value should be the error code, represented as a negative number. 3. You'll also need to add AUDIT_ARCH to arch/arm/Kconfig to tell the build system that ARM has audit support. 4. Syscall classes let you specify certain sets of system calls in a single audit rule. They're somewhat involved, and since this is already getting long, it might be better to get the above parts working first and then look at syscall classes. You'll probably have to define a few stub functions and/or comment out some code to get things to build. But you should be able to test a lot of audit functionality without syscall classes. Looking at the other architectures' audit code is a good idea. I'm also cc'ing the linux-audit mailing list, which is a good place to ask questions and post patches. Here's the subscription information: http://www.redhat.com/mailman/listinfo/linux-audit Amy