[PATCH 1/4] SH: define syscall_get_arch() for superh

[PATCH 1/4] SH: define syscall_get_arch() for superh

[Eric Paris]

This patch defines syscall_get_arch() for the superh platform.  It does
so in both syscall_32.h and syscall_64.h.  I'm not certain if the
implementation in syscall_64.h couldn't just be used in syscall.h as I
can't really track the setting of CONFIG_64BIT...

This way is safe, but we might be able to combine these if a superh
person were able to review...

Signed-off-by: Eric Paris <eparis@redhat.com>
Cc: linux-sh@vger.kernel.org
---
 arch/sh/include/asm/syscall_32.h | 10 ++++++++++
 arch/sh/include/asm/syscall_64.h | 14 ++++++++++++++
 2 files changed, 24 insertions(+)

diff --git a/arch/sh/include/asm/syscall_32.h b/arch/sh/include/asm/syscall_32.h
index 7d80df4..460e9c6 100644
--- a/arch/sh/include/asm/syscall_32.h
+++ b/arch/sh/include/asm/syscall_32.h
@@ -1,6 +1,7 @@
 #ifndef __ASM_SH_SYSCALL_32_H
 #define __ASM_SH_SYSCALL_32_H
 
+#include <uapi/linux/audit.h>
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <linux/err.h>
@@ -93,4 +94,13 @@ static inline void syscall_set_arguments(struct task_struct *task,
 	}
 }
 
+static inline int syscall_get_arch(void)
+{
+	int arch = EM_SH;
+
+#ifdef CONFIG_CPU_LITTLE_ENDIAN
+		arch |= __AUDIT_ARCH_LE;
+#endif
+	return arch;
+}
 #endif /* __ASM_SH_SYSCALL_32_H */
diff --git a/arch/sh/include/asm/syscall_64.h b/arch/sh/include/asm/syscall_64.h
index c3561ca..e03e77d 100644
--- a/arch/sh/include/asm/syscall_64.h
+++ b/arch/sh/include/asm/syscall_64.h
@@ -1,6 +1,7 @@
 #ifndef __ASM_SH_SYSCALL_64_H
 #define __ASM_SH_SYSCALL_64_H
 
+#include <uapi/linux/audit.h>
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <asm/ptrace.h>
@@ -61,4 +62,17 @@ static inline void syscall_set_arguments(struct task_struct *task,
 	memcpy(&regs->regs[2 + i], args, n * sizeof(args[0]));
 }
 
+static inline int syscall_get_arch(void)
+{
+	int arch = EM_SH;
+
+#ifdef CONFIG_64BIT
+	arch |= __AUDIT_ARCH_64BIT;
+#endif
+#ifdef CONFIG_CPU_LITTLE_ENDIAN
+	arch |= __AUDIT_ARCH_LE;
+#endif
+
+	return arch;
+}
 #endif /* __ASM_SH_SYSCALL_64_H */
-- 
1.8.5.3

[PATCH 1/4] SH: define syscall_get_arch() for superh

[Eric Paris]

This patch defines syscall_get_arch() for the superh platform.  It does
so in both syscall_32.h and syscall_64.h.  I'm not certain if the
implementation in syscall_64.h couldn't just be used in syscall.h as I
can't really track the setting of CONFIG_64BIT...

This way is safe, but we might be able to combine these if a superh
person were able to review...

Signed-off-by: Eric Paris <eparis@redhat.com>
Cc: linux-sh@vger.kernel.org
---
 arch/sh/include/asm/syscall_32.h | 10 ++++++++++
 arch/sh/include/asm/syscall_64.h | 14 ++++++++++++++
 2 files changed, 24 insertions(+)

diff --git a/arch/sh/include/asm/syscall_32.h b/arch/sh/include/asm/syscall_32.h
index 7d80df4..460e9c6 100644
--- a/arch/sh/include/asm/syscall_32.h
+++ b/arch/sh/include/asm/syscall_32.h
@@ -1,6 +1,7 @@
 #ifndef __ASM_SH_SYSCALL_32_H
 #define __ASM_SH_SYSCALL_32_H
 
+#include <uapi/linux/audit.h>
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <linux/err.h>
@@ -93,4 +94,13 @@ static inline void syscall_set_arguments(struct task_struct *task,
 	}
 }
 
+static inline int syscall_get_arch(void)
+{
+	int arch = EM_SH;
+
+#ifdef CONFIG_CPU_LITTLE_ENDIAN
+		arch |= __AUDIT_ARCH_LE;
+#endif
+	return arch;
+}
 #endif /* __ASM_SH_SYSCALL_32_H */
diff --git a/arch/sh/include/asm/syscall_64.h b/arch/sh/include/asm/syscall_64.h
index c3561ca..e03e77d 100644
--- a/arch/sh/include/asm/syscall_64.h
+++ b/arch/sh/include/asm/syscall_64.h
@@ -1,6 +1,7 @@
 #ifndef __ASM_SH_SYSCALL_64_H
 #define __ASM_SH_SYSCALL_64_H
 
+#include <uapi/linux/audit.h>
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <asm/ptrace.h>
@@ -61,4 +62,17 @@ static inline void syscall_set_arguments(struct task_struct *task,
 	memcpy(&regs->regs[2 + i], args, n * sizeof(args[0]));
 }
 
+static inline int syscall_get_arch(void)
+{
+	int arch = EM_SH;
+
+#ifdef CONFIG_64BIT
+	arch |= __AUDIT_ARCH_64BIT;
+#endif
+#ifdef CONFIG_CPU_LITTLE_ENDIAN
+	arch |= __AUDIT_ARCH_LE;
+#endif
+
+	return arch;
+}
 #endif /* __ASM_SH_SYSCALL_64_H */
-- 
1.8.5.3

[PATCH 2/4] UM: implement syscall_get_arch()

[Eric Paris]

SH: define syscall_get_arch() for superh

This patch defines syscall_get_arch() for the um platform.  It adds a
new syscall.h header file to define this.  It copies the HOST_AUDIT_ARCH
definition from ptrace.h.  (that definition will be removed when we
switch audit to use this new syscall_get_arch() function)

Signed-off-by: Eric Paris <eparis@redhat.com>
Cc: user-mode-linux-devel@lists.sourceforge.net
---
 arch/x86/um/asm/syscall.h | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 arch/x86/um/asm/syscall.h

diff --git a/arch/x86/um/asm/syscall.h b/arch/x86/um/asm/syscall.h
new file mode 100644
index 0000000..9fe77b7
--- /dev/null
+++ b/arch/x86/um/asm/syscall.h
@@ -0,0 +1,15 @@
+#ifndef __UM_ASM_SYSCALL_H
+#define __UM_ASM_SYSCALL_H
+
+#include <uapi/linux/audit.h>
+
+static inline int syscall_get_arch(void)
+{
+#ifdef CONFIG_X86_32
+	return AUDIT_ARCH_I386;
+#else
+	return AUDIT_ARCH_X86_64;
+#endif
+}
+
+#endif /* __UM_ASM_SYSCALL_H */
-- 
1.8.5.3

[uml-devel] [PATCH 2/4] UM: implement syscall_get_arch()

[Eric Paris]

SH: define syscall_get_arch() for superh

This patch defines syscall_get_arch() for the um platform.  It adds a
new syscall.h header file to define this.  It copies the HOST_AUDIT_ARCH
definition from ptrace.h.  (that definition will be removed when we
switch audit to use this new syscall_get_arch() function)

Signed-off-by: Eric Paris <eparis@redhat.com>
Cc: user-mode-linux-devel@lists.sourceforge.net
---
 arch/x86/um/asm/syscall.h | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 arch/x86/um/asm/syscall.h

diff --git a/arch/x86/um/asm/syscall.h b/arch/x86/um/asm/syscall.h
new file mode 100644
index 0000000..9fe77b7
--- /dev/null
+++ b/arch/x86/um/asm/syscall.h
@@ -0,0 +1,15 @@
+#ifndef __UM_ASM_SYSCALL_H
+#define __UM_ASM_SYSCALL_H
+
+#include <uapi/linux/audit.h>
+
+static inline int syscall_get_arch(void)
+{
+#ifdef CONFIG_X86_32
+	return AUDIT_ARCH_I386;
+#else
+	return AUDIT_ARCH_X86_64;
+#endif
+}
+
+#endif /* __UM_ASM_SYSCALL_H */
-- 
1.8.5.3


------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and their
applications. Written by three acclaimed leaders in the field,
this first edition is now available. Download your free book today!
http://p.sf.net/sfu/13534_NeoTech
_______________________________________________
User-mode-linux-devel mailing list
User-mode-linux-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel

[PATCH 3/4] ARCH: AUDIT: implement syscall_get_arch for all arches

[Eric Paris]

For all arches which support audit implement syscall_get_arch()
They are all pretty easy and straight forward, stolen from how the call
to audit_syscall_entry() determines the arch.

Signed-off-by: Eric Paris <eparis@redhat.com>
Cc: linux-ia64@vger.kernel.org
Cc: microblaze-uclinux@itee.uq.edu.au
Cc: linux-mips@linux-mips.org
Cc: linux@lists.openrisc.net
Cc: linux-parisc@vger.kernel.org
Cc: linuxppc-dev@lists.ozlabs.org
Cc: sparclinux@vger.kernel.org
---
 arch/ia64/include/asm/syscall.h       |  6 ++++++
 arch/microblaze/include/asm/syscall.h |  5 +++++
 arch/mips/include/asm/syscall.h       |  2 +-
 arch/openrisc/include/asm/syscall.h   |  5 +++++
 arch/parisc/include/asm/syscall.h     | 11 +++++++++++
 arch/powerpc/include/asm/syscall.h    | 12 ++++++++++++
 arch/sparc/include/asm/syscall.h      |  8 ++++++++
 include/uapi/linux/audit.h            |  1 +
 8 files changed, 49 insertions(+), 1 deletion(-)

diff --git a/arch/ia64/include/asm/syscall.h b/arch/ia64/include/asm/syscall.h
index a7ff1c6..1d0b875 100644
--- a/arch/ia64/include/asm/syscall.h
+++ b/arch/ia64/include/asm/syscall.h
@@ -13,6 +13,7 @@
 #ifndef _ASM_SYSCALL_H
 #define _ASM_SYSCALL_H	1
 
+#include <uapi/linux/audit.h>
 #include <linux/sched.h>
 #include <linux/err.h>
 
@@ -79,4 +80,9 @@ static inline void syscall_set_arguments(struct task_struct *task,
 
 	ia64_syscall_get_set_arguments(task, regs, i, n, args, 1);
 }
+
+static inline int syscall_get_arch(void)
+{
+	return AUDIT_ARCH_IA64;
+}
 #endif	/* _ASM_SYSCALL_H */
diff --git a/arch/microblaze/include/asm/syscall.h b/arch/microblaze/include/asm/syscall.h
index 9bc4317..53cfaf3 100644
--- a/arch/microblaze/include/asm/syscall.h
+++ b/arch/microblaze/include/asm/syscall.h
@@ -1,6 +1,7 @@
 #ifndef __ASM_MICROBLAZE_SYSCALL_H
 #define __ASM_MICROBLAZE_SYSCALL_H
 
+#include <uapi/linux/audit.h>
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <asm/ptrace.h>
@@ -99,4 +100,8 @@ static inline void syscall_set_arguments(struct task_struct *task,
 asmlinkage long do_syscall_trace_enter(struct pt_regs *regs);
 asmlinkage void do_syscall_trace_leave(struct pt_regs *regs);
 
+static inline int syscall_get_arch(void)
+{
+	return AUDIT_ARCH_MICROBLAZE;
+}
 #endif /* __ASM_MICROBLAZE_SYSCALL_H */
diff --git a/arch/mips/include/asm/syscall.h b/arch/mips/include/asm/syscall.h
index fc556d8..992b6ab 100644
--- a/arch/mips/include/asm/syscall.h
+++ b/arch/mips/include/asm/syscall.h
@@ -103,7 +103,7 @@ extern const unsigned long sysn32_call_table[];
 
 static inline int syscall_get_arch(void)
 {
-	int arch = EM_MIPS;
+	int arch = AUDIT_ARCH_MIPS;
 #ifdef CONFIG_64BIT
 	arch |=  __AUDIT_ARCH_64BIT;
 #endif
diff --git a/arch/openrisc/include/asm/syscall.h b/arch/openrisc/include/asm/syscall.h
index b752bb6..2db9f1c 100644
--- a/arch/openrisc/include/asm/syscall.h
+++ b/arch/openrisc/include/asm/syscall.h
@@ -19,6 +19,7 @@
 #ifndef __ASM_OPENRISC_SYSCALL_H__
 #define __ASM_OPENRISC_SYSCALL_H__
 
+#include <uapi/linux/audit.h>
 #include <linux/err.h>
 #include <linux/sched.h>
 
@@ -71,4 +72,8 @@ syscall_set_arguments(struct task_struct *task, struct pt_regs *regs,
 	memcpy(&regs->gpr[3 + i], args, n * sizeof(args[0]));
 }
 
+static inline int syscall_get_arch(void)
+{
+	return AUDIT_ARCH_OPENRISC;
+}
 #endif
diff --git a/arch/parisc/include/asm/syscall.h b/arch/parisc/include/asm/syscall.h
index 8bdfd2c..a5eba95 100644
--- a/arch/parisc/include/asm/syscall.h
+++ b/arch/parisc/include/asm/syscall.h
@@ -3,6 +3,8 @@
 #ifndef _ASM_PARISC_SYSCALL_H_
 #define _ASM_PARISC_SYSCALL_H_
 
+#include <uapi/linux/audit.h>
+#include <linux/compat.h>
 #include <linux/err.h>
 #include <asm/ptrace.h>
 
@@ -37,4 +39,13 @@ static inline void syscall_get_arguments(struct task_struct *tsk,
 	}
 }
 
+static inline int syscall_get_arch(void)
+{
+	int arch = AUDIT_ARCH_PARISC;
+#ifdef CONFIG_64BIT
+	if (!is_compat_task())
+		arch = AUDIT_ARCH_PARISC64;
+#endif
+	return arch;
+}
 #endif /*_ASM_PARISC_SYSCALL_H_*/
diff --git a/arch/powerpc/include/asm/syscall.h b/arch/powerpc/include/asm/syscall.h
index b54b2ad..4271544 100644
--- a/arch/powerpc/include/asm/syscall.h
+++ b/arch/powerpc/include/asm/syscall.h
@@ -13,6 +13,8 @@
 #ifndef _ASM_SYSCALL_H
 #define _ASM_SYSCALL_H	1
 
+#include <uapi/linux/audit.h>
+#include <linux/compat.h>
 #include <linux/sched.h>
 
 /* ftrace syscalls requires exporting the sys_call_table */
@@ -86,4 +88,14 @@ static inline void syscall_set_arguments(struct task_struct *task,
 	memcpy(&regs->gpr[3 + i], args, n * sizeof(args[0]));
 }
 
+static inline int syscall_get_arch(void)
+{
+	int arch = AUDIT_ARCH_PPC;
+
+#ifdef CONFIG_PPC64
+	if (!is_32bit_task())
+		arch = AUDIT_ARCH_PPC64;
+#endif
+	return arch;
+}
 #endif	/* _ASM_SYSCALL_H */
diff --git a/arch/sparc/include/asm/syscall.h b/arch/sparc/include/asm/syscall.h
index 025a02a..fed3d51 100644
--- a/arch/sparc/include/asm/syscall.h
+++ b/arch/sparc/include/asm/syscall.h
@@ -1,9 +1,11 @@
 #ifndef __ASM_SPARC_SYSCALL_H
 #define __ASM_SPARC_SYSCALL_H
 
+#include <uapi/linux/audit.h>
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <asm/ptrace.h>
+#include <asm/thread_info.h>
 
 /*
  * The syscall table always contains 32 bit pointers since we know that the
@@ -124,4 +126,10 @@ static inline void syscall_set_arguments(struct task_struct *task,
 		regs->u_regs[UREG_I0 + i + j] = args[j];
 }
 
+static inline int syscall_get_arch(void)
+{
+	return test_thread_flag(TIF_32BIT) ? AUDIT_ARCH_SPARC
+					   : AUDIT_ARCH_SPARC64;
+}
+
 #endif /* __ASM_SPARC_SYSCALL_H */
diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
index 9af01d7..8496cfa 100644
--- a/include/uapi/linux/audit.h
+++ b/include/uapi/linux/audit.h
@@ -343,6 +343,7 @@ enum {
 #define AUDIT_ARCH_IA64		(EM_IA_64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
 #define AUDIT_ARCH_M32R		(EM_M32R)
 #define AUDIT_ARCH_M68K		(EM_68K)
+#define AUDIT_ARCH_MICROBLAZE	(EM_MICROBLAZE)
 #define AUDIT_ARCH_MIPS		(EM_MIPS)
 #define AUDIT_ARCH_MIPSEL	(EM_MIPS|__AUDIT_ARCH_LE)
 #define AUDIT_ARCH_MIPS64	(EM_MIPS|__AUDIT_ARCH_64BIT)
-- 
1.8.5.3

[PATCH 3/4] ARCH: AUDIT: implement syscall_get_arch for all arches

[Eric Paris]

For all arches which support audit implement syscall_get_arch()
They are all pretty easy and straight forward, stolen from how the call
to audit_syscall_entry() determines the arch.

Signed-off-by: Eric Paris <eparis@redhat.com>
Cc: linux-ia64@vger.kernel.org
Cc: microblaze-uclinux@itee.uq.edu.au
Cc: linux-mips@linux-mips.org
Cc: linux@lists.openrisc.net
Cc: linux-parisc@vger.kernel.org
Cc: linuxppc-dev@lists.ozlabs.org
Cc: sparclinux@vger.kernel.org
---
 arch/ia64/include/asm/syscall.h       |  6 ++++++
 arch/microblaze/include/asm/syscall.h |  5 +++++
 arch/mips/include/asm/syscall.h       |  2 +-
 arch/openrisc/include/asm/syscall.h   |  5 +++++
 arch/parisc/include/asm/syscall.h     | 11 +++++++++++
 arch/powerpc/include/asm/syscall.h    | 12 ++++++++++++
 arch/sparc/include/asm/syscall.h      |  8 ++++++++
 include/uapi/linux/audit.h            |  1 +
 8 files changed, 49 insertions(+), 1 deletion(-)

diff --git a/arch/ia64/include/asm/syscall.h b/arch/ia64/include/asm/syscall.h
index a7ff1c6..1d0b875 100644
--- a/arch/ia64/include/asm/syscall.h
+++ b/arch/ia64/include/asm/syscall.h
@@ -13,6 +13,7 @@
 #ifndef _ASM_SYSCALL_H
 #define _ASM_SYSCALL_H	1
 
+#include <uapi/linux/audit.h>
 #include <linux/sched.h>
 #include <linux/err.h>
 
@@ -79,4 +80,9 @@ static inline void syscall_set_arguments(struct task_struct *task,
 
 	ia64_syscall_get_set_arguments(task, regs, i, n, args, 1);
 }
+
+static inline int syscall_get_arch(void)
+{
+	return AUDIT_ARCH_IA64;
+}
 #endif	/* _ASM_SYSCALL_H */
diff --git a/arch/microblaze/include/asm/syscall.h b/arch/microblaze/include/asm/syscall.h
index 9bc4317..53cfaf3 100644
--- a/arch/microblaze/include/asm/syscall.h
+++ b/arch/microblaze/include/asm/syscall.h
@@ -1,6 +1,7 @@
 #ifndef __ASM_MICROBLAZE_SYSCALL_H
 #define __ASM_MICROBLAZE_SYSCALL_H
 
+#include <uapi/linux/audit.h>
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <asm/ptrace.h>
@@ -99,4 +100,8 @@ static inline void syscall_set_arguments(struct task_struct *task,
 asmlinkage long do_syscall_trace_enter(struct pt_regs *regs);
 asmlinkage void do_syscall_trace_leave(struct pt_regs *regs);
 
+static inline int syscall_get_arch(void)
+{
+	return AUDIT_ARCH_MICROBLAZE;
+}
 #endif /* __ASM_MICROBLAZE_SYSCALL_H */
diff --git a/arch/mips/include/asm/syscall.h b/arch/mips/include/asm/syscall.h
index fc556d8..992b6ab 100644
--- a/arch/mips/include/asm/syscall.h
+++ b/arch/mips/include/asm/syscall.h
@@ -103,7 +103,7 @@ extern const unsigned long sysn32_call_table[];
 
 static inline int syscall_get_arch(void)
 {
-	int arch = EM_MIPS;
+	int arch = AUDIT_ARCH_MIPS;
 #ifdef CONFIG_64BIT
 	arch |=  __AUDIT_ARCH_64BIT;
 #endif
diff --git a/arch/openrisc/include/asm/syscall.h b/arch/openrisc/include/asm/syscall.h
index b752bb6..2db9f1c 100644
--- a/arch/openrisc/include/asm/syscall.h
+++ b/arch/openrisc/include/asm/syscall.h
@@ -19,6 +19,7 @@
 #ifndef __ASM_OPENRISC_SYSCALL_H__
 #define __ASM_OPENRISC_SYSCALL_H__
 
+#include <uapi/linux/audit.h>
 #include <linux/err.h>
 #include <linux/sched.h>
 
@@ -71,4 +72,8 @@ syscall_set_arguments(struct task_struct *task, struct pt_regs *regs,
 	memcpy(&regs->gpr[3 + i], args, n * sizeof(args[0]));
 }
 
+static inline int syscall_get_arch(void)
+{
+	return AUDIT_ARCH_OPENRISC;
+}
 #endif
diff --git a/arch/parisc/include/asm/syscall.h b/arch/parisc/include/asm/syscall.h
index 8bdfd2c..a5eba95 100644
--- a/arch/parisc/include/asm/syscall.h
+++ b/arch/parisc/include/asm/syscall.h
@@ -3,6 +3,8 @@
 #ifndef _ASM_PARISC_SYSCALL_H_
 #define _ASM_PARISC_SYSCALL_H_
 
+#include <uapi/linux/audit.h>
+#include <linux/compat.h>
 #include <linux/err.h>
 #include <asm/ptrace.h>
 
@@ -37,4 +39,13 @@ static inline void syscall_get_arguments(struct task_struct *tsk,
 	}
 }
 
+static inline int syscall_get_arch(void)
+{
+	int arch = AUDIT_ARCH_PARISC;
+#ifdef CONFIG_64BIT
+	if (!is_compat_task())
+		arch = AUDIT_ARCH_PARISC64;
+#endif
+	return arch;
+}
 #endif /*_ASM_PARISC_SYSCALL_H_*/
diff --git a/arch/powerpc/include/asm/syscall.h b/arch/powerpc/include/asm/syscall.h
index b54b2ad..4271544 100644
--- a/arch/powerpc/include/asm/syscall.h
+++ b/arch/powerpc/include/asm/syscall.h
@@ -13,6 +13,8 @@
 #ifndef _ASM_SYSCALL_H
 #define _ASM_SYSCALL_H	1
 
+#include <uapi/linux/audit.h>
+#include <linux/compat.h>
 #include <linux/sched.h>
 
 /* ftrace syscalls requires exporting the sys_call_table */
@@ -86,4 +88,14 @@ static inline void syscall_set_arguments(struct task_struct *task,
 	memcpy(&regs->gpr[3 + i], args, n * sizeof(args[0]));
 }
 
+static inline int syscall_get_arch(void)
+{
+	int arch = AUDIT_ARCH_PPC;
+
+#ifdef CONFIG_PPC64
+	if (!is_32bit_task())
+		arch = AUDIT_ARCH_PPC64;
+#endif
+	return arch;
+}
 #endif	/* _ASM_SYSCALL_H */
diff --git a/arch/sparc/include/asm/syscall.h b/arch/sparc/include/asm/syscall.h
index 025a02a..fed3d51 100644
--- a/arch/sparc/include/asm/syscall.h
+++ b/arch/sparc/include/asm/syscall.h
@@ -1,9 +1,11 @@
 #ifndef __ASM_SPARC_SYSCALL_H
 #define __ASM_SPARC_SYSCALL_H
 
+#include <uapi/linux/audit.h>
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <asm/ptrace.h>
+#include <asm/thread_info.h>
 
 /*
  * The syscall table always contains 32 bit pointers since we know that the
@@ -124,4 +126,10 @@ static inline void syscall_set_arguments(struct task_struct *task,
 		regs->u_regs[UREG_I0 + i + j] = args[j];
 }
 
+static inline int syscall_get_arch(void)
+{
+	return test_thread_flag(TIF_32BIT) ? AUDIT_ARCH_SPARC
+					   : AUDIT_ARCH_SPARC64;
+}
+
 #endif /* __ASM_SPARC_SYSCALL_H */
diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
index 9af01d7..8496cfa 100644
--- a/include/uapi/linux/audit.h
+++ b/include/uapi/linux/audit.h
@@ -343,6 +343,7 @@ enum {
 #define AUDIT_ARCH_IA64		(EM_IA_64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
 #define AUDIT_ARCH_M32R		(EM_M32R)
 #define AUDIT_ARCH_M68K		(EM_68K)
+#define AUDIT_ARCH_MICROBLAZE	(EM_MICROBLAZE)
 #define AUDIT_ARCH_MIPS		(EM_MIPS)
 #define AUDIT_ARCH_MIPSEL	(EM_MIPS|__AUDIT_ARCH_LE)
 #define AUDIT_ARCH_MIPS64	(EM_MIPS|__AUDIT_ARCH_64BIT)
-- 
1.8.5.3

[PATCH 3/4] ARCH: AUDIT: implement syscall_get_arch for all arches

[Eric Paris]

For all arches which support audit implement syscall_get_arch()
They are all pretty easy and straight forward, stolen from how the call
to audit_syscall_entry() determines the arch.

Signed-off-by: Eric Paris <eparis@redhat.com>
Cc: linux-ia64@vger.kernel.org
Cc: microblaze-uclinux@itee.uq.edu.au
Cc: linux-mips@linux-mips.org
Cc: linux@lists.openrisc.net
Cc: linux-parisc@vger.kernel.org
Cc: linuxppc-dev@lists.ozlabs.org
Cc: sparclinux@vger.kernel.org
---
 arch/ia64/include/asm/syscall.h       |  6 ++++++
 arch/microblaze/include/asm/syscall.h |  5 +++++
 arch/mips/include/asm/syscall.h       |  2 +-
 arch/openrisc/include/asm/syscall.h   |  5 +++++
 arch/parisc/include/asm/syscall.h     | 11 +++++++++++
 arch/powerpc/include/asm/syscall.h    | 12 ++++++++++++
 arch/sparc/include/asm/syscall.h      |  8 ++++++++
 include/uapi/linux/audit.h            |  1 +
 8 files changed, 49 insertions(+), 1 deletion(-)

diff --git a/arch/ia64/include/asm/syscall.h b/arch/ia64/include/asm/syscall.h
index a7ff1c6..1d0b875 100644
--- a/arch/ia64/include/asm/syscall.h
+++ b/arch/ia64/include/asm/syscall.h
@@ -13,6 +13,7 @@
 #ifndef _ASM_SYSCALL_H
 #define _ASM_SYSCALL_H	1
 
+#include <uapi/linux/audit.h>
 #include <linux/sched.h>
 #include <linux/err.h>
 
@@ -79,4 +80,9 @@ static inline void syscall_set_arguments(struct task_struct *task,
 
 	ia64_syscall_get_set_arguments(task, regs, i, n, args, 1);
 }
+
+static inline int syscall_get_arch(void)
+{
+	return AUDIT_ARCH_IA64;
+}
 #endif	/* _ASM_SYSCALL_H */
diff --git a/arch/microblaze/include/asm/syscall.h b/arch/microblaze/include/asm/syscall.h
index 9bc4317..53cfaf3 100644
--- a/arch/microblaze/include/asm/syscall.h
+++ b/arch/microblaze/include/asm/syscall.h
@@ -1,6 +1,7 @@
 #ifndef __ASM_MICROBLAZE_SYSCALL_H
 #define __ASM_MICROBLAZE_SYSCALL_H
 
+#include <uapi/linux/audit.h>
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <asm/ptrace.h>
@@ -99,4 +100,8 @@ static inline void syscall_set_arguments(struct task_struct *task,
 asmlinkage long do_syscall_trace_enter(struct pt_regs *regs);
 asmlinkage void do_syscall_trace_leave(struct pt_regs *regs);
 
+static inline int syscall_get_arch(void)
+{
+	return AUDIT_ARCH_MICROBLAZE;
+}
 #endif /* __ASM_MICROBLAZE_SYSCALL_H */
diff --git a/arch/mips/include/asm/syscall.h b/arch/mips/include/asm/syscall.h
index fc556d8..992b6ab 100644
--- a/arch/mips/include/asm/syscall.h
+++ b/arch/mips/include/asm/syscall.h
@@ -103,7 +103,7 @@ extern const unsigned long sysn32_call_table[];
 
 static inline int syscall_get_arch(void)
 {
-	int arch = EM_MIPS;
+	int arch = AUDIT_ARCH_MIPS;
 #ifdef CONFIG_64BIT
 	arch |=  __AUDIT_ARCH_64BIT;
 #endif
diff --git a/arch/openrisc/include/asm/syscall.h b/arch/openrisc/include/asm/syscall.h
index b752bb6..2db9f1c 100644
--- a/arch/openrisc/include/asm/syscall.h
+++ b/arch/openrisc/include/asm/syscall.h
@@ -19,6 +19,7 @@
 #ifndef __ASM_OPENRISC_SYSCALL_H__
 #define __ASM_OPENRISC_SYSCALL_H__
 
+#include <uapi/linux/audit.h>
 #include <linux/err.h>
 #include <linux/sched.h>
 
@@ -71,4 +72,8 @@ syscall_set_arguments(struct task_struct *task, struct pt_regs *regs,
 	memcpy(&regs->gpr[3 + i], args, n * sizeof(args[0]));
 }
 
+static inline int syscall_get_arch(void)
+{
+	return AUDIT_ARCH_OPENRISC;
+}
 #endif
diff --git a/arch/parisc/include/asm/syscall.h b/arch/parisc/include/asm/syscall.h
index 8bdfd2c..a5eba95 100644
--- a/arch/parisc/include/asm/syscall.h
+++ b/arch/parisc/include/asm/syscall.h
@@ -3,6 +3,8 @@
 #ifndef _ASM_PARISC_SYSCALL_H_
 #define _ASM_PARISC_SYSCALL_H_
 
+#include <uapi/linux/audit.h>
+#include <linux/compat.h>
 #include <linux/err.h>
 #include <asm/ptrace.h>
 
@@ -37,4 +39,13 @@ static inline void syscall_get_arguments(struct task_struct *tsk,
 	}
 }
 
+static inline int syscall_get_arch(void)
+{
+	int arch = AUDIT_ARCH_PARISC;
+#ifdef CONFIG_64BIT
+	if (!is_compat_task())
+		arch = AUDIT_ARCH_PARISC64;
+#endif
+	return arch;
+}
 #endif /*_ASM_PARISC_SYSCALL_H_*/
diff --git a/arch/powerpc/include/asm/syscall.h b/arch/powerpc/include/asm/syscall.h
index b54b2ad..4271544 100644
--- a/arch/powerpc/include/asm/syscall.h
+++ b/arch/powerpc/include/asm/syscall.h
@@ -13,6 +13,8 @@
 #ifndef _ASM_SYSCALL_H
 #define _ASM_SYSCALL_H	1
 
+#include <uapi/linux/audit.h>
+#include <linux/compat.h>
 #include <linux/sched.h>
 
 /* ftrace syscalls requires exporting the sys_call_table */
@@ -86,4 +88,14 @@ static inline void syscall_set_arguments(struct task_struct *task,
 	memcpy(&regs->gpr[3 + i], args, n * sizeof(args[0]));
 }
 
+static inline int syscall_get_arch(void)
+{
+	int arch = AUDIT_ARCH_PPC;
+
+#ifdef CONFIG_PPC64
+	if (!is_32bit_task())
+		arch = AUDIT_ARCH_PPC64;
+#endif
+	return arch;
+}
 #endif	/* _ASM_SYSCALL_H */
diff --git a/arch/sparc/include/asm/syscall.h b/arch/sparc/include/asm/syscall.h
index 025a02a..fed3d51 100644
--- a/arch/sparc/include/asm/syscall.h
+++ b/arch/sparc/include/asm/syscall.h
@@ -1,9 +1,11 @@
 #ifndef __ASM_SPARC_SYSCALL_H
 #define __ASM_SPARC_SYSCALL_H
 
+#include <uapi/linux/audit.h>
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <asm/ptrace.h>
+#include <asm/thread_info.h>
 
 /*
  * The syscall table always contains 32 bit pointers since we know that the
@@ -124,4 +126,10 @@ static inline void syscall_set_arguments(struct task_struct *task,
 		regs->u_regs[UREG_I0 + i + j] = args[j];
 }
 
+static inline int syscall_get_arch(void)
+{
+	return test_thread_flag(TIF_32BIT) ? AUDIT_ARCH_SPARC
+					   : AUDIT_ARCH_SPARC64;
+}
+
 #endif /* __ASM_SPARC_SYSCALL_H */
diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
index 9af01d7..8496cfa 100644
--- a/include/uapi/linux/audit.h
+++ b/include/uapi/linux/audit.h
@@ -343,6 +343,7 @@ enum {
 #define AUDIT_ARCH_IA64		(EM_IA_64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
 #define AUDIT_ARCH_M32R		(EM_M32R)
 #define AUDIT_ARCH_M68K		(EM_68K)
+#define AUDIT_ARCH_MICROBLAZE	(EM_MICROBLAZE)
 #define AUDIT_ARCH_MIPS		(EM_MIPS)
 #define AUDIT_ARCH_MIPSEL	(EM_MIPS|__AUDIT_ARCH_LE)
 #define AUDIT_ARCH_MIPS64	(EM_MIPS|__AUDIT_ARCH_64BIT)
-- 
1.8.5.3

[PATCH 4/4] ARCH: AUDIT: audit_syscall_entry() should not require the arch

[Eric Paris]

We have a function where the arch can be queried, syscall_get_arch().
So rather than have every single piece of arch specific code use and/or
duplicate syscall_get_arch(), just have the audit code use the
syscall_get_arch() code.

Signed-off-by: Eric Paris <eparis@redhat.com>
Cc: linux-alpha@vger.kernel.org
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-ia64@vger.kernel.org
Cc: microblaze-uclinux@itee.uq.edu.au
Cc: linux-mips@linux-mips.org
Cc: linux@lists.openrisc.net
Cc: linux-parisc@vger.kernel.org
Cc: linuxppc-dev@lists.ozlabs.org
Cc: linux-s390@vger.kernel.org
Cc: linux-sh@vger.kernel.org
Cc: sparclinux@vger.kernel.org
Cc: user-mode-linux-devel@lists.sourceforge.net
Cc: linux-xtensa@linux-xtensa.org
Cc: x86@kernel.org
---
 arch/alpha/kernel/ptrace.c      |  2 +-
 arch/arm/kernel/ptrace.c        |  4 ++--
 arch/ia64/kernel/ptrace.c       |  2 +-
 arch/microblaze/kernel/ptrace.c |  3 +--
 arch/mips/kernel/ptrace.c       |  4 +---
 arch/openrisc/kernel/ptrace.c   |  3 +--
 arch/parisc/kernel/ptrace.c     |  9 +++------
 arch/powerpc/kernel/ptrace.c    |  7 ++-----
 arch/s390/kernel/ptrace.c       |  4 +---
 arch/sh/kernel/ptrace_32.c      | 14 +-------------
 arch/sh/kernel/ptrace_64.c      | 17 +----------------
 arch/sparc/kernel/ptrace_64.c   |  9 ++-------
 arch/um/kernel/ptrace.c         |  3 +--
 arch/x86/kernel/ptrace.c        |  8 ++------
 arch/x86/um/asm/ptrace.h        |  4 ----
 arch/xtensa/kernel/ptrace.c     |  2 +-
 include/linux/audit.h           |  7 ++++---
 17 files changed, 25 insertions(+), 77 deletions(-)

diff --git a/arch/alpha/kernel/ptrace.c b/arch/alpha/kernel/ptrace.c
index 86d8351..d9ee817 100644
--- a/arch/alpha/kernel/ptrace.c
+++ b/arch/alpha/kernel/ptrace.c
@@ -321,7 +321,7 @@ asmlinkage unsigned long syscall_trace_enter(void)
 	if (test_thread_flag(TIF_SYSCALL_TRACE) &&
 	    tracehook_report_syscall_entry(current_pt_regs()))
 		ret = -1UL;
-	audit_syscall_entry(AUDIT_ARCH_ALPHA, regs->r0, regs->r16, regs->r17, regs->r18, regs->r19);
+	audit_syscall_entry(regs->r0, regs->r16, regs->r17, regs->r18, regs->r19);
 	return ret ?: current_pt_regs()->r0;
 }
 
diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
index 0dd3b79..c9d2b34 100644
--- a/arch/arm/kernel/ptrace.c
+++ b/arch/arm/kernel/ptrace.c
@@ -943,8 +943,8 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs, int scno)
 	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
 		trace_sys_enter(regs, scno);
 
-	audit_syscall_entry(AUDIT_ARCH_ARM, scno, regs->ARM_r0, regs->ARM_r1,
-			    regs->ARM_r2, regs->ARM_r3);
+	audit_syscall_entry(scno, regs->ARM_r0, regs->ARM_r1, regs->ARM_r2,
+			    regs->ARM_r3);
 
 	return scno;
 }
diff --git a/arch/ia64/kernel/ptrace.c b/arch/ia64/kernel/ptrace.c
index b7a5fff..6f54d51 100644
--- a/arch/ia64/kernel/ptrace.c
+++ b/arch/ia64/kernel/ptrace.c
@@ -1219,7 +1219,7 @@ syscall_trace_enter (long arg0, long arg1, long arg2, long arg3,
 		ia64_sync_krbs();
 
 
-	audit_syscall_entry(AUDIT_ARCH_IA64, regs.r15, arg0, arg1, arg2, arg3);
+	audit_syscall_entry(regs.r15, arg0, arg1, arg2, arg3);
 
 	return 0;
 }
diff --git a/arch/microblaze/kernel/ptrace.c b/arch/microblaze/kernel/ptrace.c
index 39cf508..bb10637 100644
--- a/arch/microblaze/kernel/ptrace.c
+++ b/arch/microblaze/kernel/ptrace.c
@@ -147,8 +147,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 		 */
 		ret = -1L;
 
-	audit_syscall_entry(EM_MICROBLAZE, regs->r12, regs->r5, regs->r6,
-			    regs->r7, regs->r8);
+	audit_syscall_entry(regs->r12, regs->r5, regs->r6, regs->r7, regs->r8);
 
 	return ret ?: regs->r12;
 }
diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
index 65ba622..c06bb82 100644
--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -671,9 +671,7 @@ asmlinkage void syscall_trace_enter(struct pt_regs *regs)
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->regs[2]);
 
-	audit_syscall_entry(syscall_get_arch(),
-			    regs->regs[2],
-			    regs->regs[4], regs->regs[5],
+	audit_syscall_entry(regs->regs[2], regs->regs[4], regs->regs[5],
 			    regs->regs[6], regs->regs[7]);
 }
 
diff --git a/arch/openrisc/kernel/ptrace.c b/arch/openrisc/kernel/ptrace.c
index 71a2a0c..4f59fa4 100644
--- a/arch/openrisc/kernel/ptrace.c
+++ b/arch/openrisc/kernel/ptrace.c
@@ -187,8 +187,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 		 */
 		ret = -1L;
 
-	audit_syscall_entry(AUDIT_ARCH_OPENRISC, regs->gpr[11],
-			    regs->gpr[3], regs->gpr[4],
+	audit_syscall_entry(regs->gpr[11], regs->gpr[3], regs->gpr[4],
 			    regs->gpr[5], regs->gpr[6]);
 
 	return ret ? : regs->gpr[11];
diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c
index e842ee2..7481457 100644
--- a/arch/parisc/kernel/ptrace.c
+++ b/arch/parisc/kernel/ptrace.c
@@ -276,14 +276,11 @@ long do_syscall_trace_enter(struct pt_regs *regs)
 
 #ifdef CONFIG_64BIT
 	if (!is_compat_task())
-		audit_syscall_entry(AUDIT_ARCH_PARISC64,
-			regs->gr[20],
-			regs->gr[26], regs->gr[25],
-			regs->gr[24], regs->gr[23]);
+		audit_syscall_entry(regs->gr[20], regs->gr[26], regs->gr[25],
+				    regs->gr[24], regs->gr[23]);
 	else
 #endif
-		audit_syscall_entry(AUDIT_ARCH_PARISC,
-			regs->gr[20] & 0xffffffff,
+		audit_syscall_entry(regs->gr[20] & 0xffffffff,
 			regs->gr[26] & 0xffffffff,
 			regs->gr[25] & 0xffffffff,
 			regs->gr[24] & 0xffffffff,
diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
index 2e3d2bf..524a943 100644
--- a/arch/powerpc/kernel/ptrace.c
+++ b/arch/powerpc/kernel/ptrace.c
@@ -1788,14 +1788,11 @@ long do_syscall_trace_enter(struct pt_regs *regs)
 
 #ifdef CONFIG_PPC64
 	if (!is_32bit_task())
-		audit_syscall_entry(AUDIT_ARCH_PPC64,
-				    regs->gpr[0],
-				    regs->gpr[3], regs->gpr[4],
+		audit_syscall_entry(regs->gpr[0], regs->gpr[3], regs->gpr[4],
 				    regs->gpr[5], regs->gpr[6]);
 	else
 #endif
-		audit_syscall_entry(AUDIT_ARCH_PPC,
-				    regs->gpr[0],
+		audit_syscall_entry(regs->gpr[0],
 				    regs->gpr[3] & 0xffffffff,
 				    regs->gpr[4] & 0xffffffff,
 				    regs->gpr[5] & 0xffffffff,
diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
index e65c91c..2e2e7bb5 100644
--- a/arch/s390/kernel/ptrace.c
+++ b/arch/s390/kernel/ptrace.c
@@ -812,9 +812,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->gprs[2]);
 
-	audit_syscall_entry(is_compat_task() ?
-				AUDIT_ARCH_S390 : AUDIT_ARCH_S390X,
-			    regs->gprs[2], regs->orig_gpr2,
+	audit_syscall_entry(regs->gprs[2], regs->orig_gpr2,
 			    regs->gprs[3], regs->gprs[4],
 			    regs->gprs[5]);
 out:
diff --git a/arch/sh/kernel/ptrace_32.c b/arch/sh/kernel/ptrace_32.c
index 668c816..c1a6b89 100644
--- a/arch/sh/kernel/ptrace_32.c
+++ b/arch/sh/kernel/ptrace_32.c
@@ -484,17 +484,6 @@ long arch_ptrace(struct task_struct *child, long request,
 	return ret;
 }
 
-static inline int audit_arch(void)
-{
-	int arch = EM_SH;
-
-#ifdef CONFIG_CPU_LITTLE_ENDIAN
-	arch |= __AUDIT_ARCH_LE;
-#endif
-
-	return arch;
-}
-
 asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 {
 	long ret = 0;
@@ -513,8 +502,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->regs[0]);
 
-	audit_syscall_entry(audit_arch(), regs->regs[3],
-			    regs->regs[4], regs->regs[5],
+	audit_syscall_entry(regs->regs[3], regs->regs[4], regs->regs[5],
 			    regs->regs[6], regs->regs[7]);
 
 	return ret ?: regs->regs[0];
diff --git a/arch/sh/kernel/ptrace_64.c b/arch/sh/kernel/ptrace_64.c
index af90339..5cea973 100644
--- a/arch/sh/kernel/ptrace_64.c
+++ b/arch/sh/kernel/ptrace_64.c
@@ -504,20 +504,6 @@ asmlinkage int sh64_ptrace(long request, long pid,
 	return sys_ptrace(request, pid, addr, data);
 }
 
-static inline int audit_arch(void)
-{
-	int arch = EM_SH;
-
-#ifdef CONFIG_64BIT
-	arch |= __AUDIT_ARCH_64BIT;
-#endif
-#ifdef CONFIG_CPU_LITTLE_ENDIAN
-	arch |= __AUDIT_ARCH_LE;
-#endif
-
-	return arch;
-}
-
 asmlinkage long long do_syscall_trace_enter(struct pt_regs *regs)
 {
 	long long ret = 0;
@@ -536,8 +522,7 @@ asmlinkage long long do_syscall_trace_enter(struct pt_regs *regs)
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->regs[9]);
 
-	audit_syscall_entry(audit_arch(), regs->regs[1],
-			    regs->regs[2], regs->regs[3],
+	audit_syscall_entry(regs->regs[1], regs->regs[2], regs->regs[3],
 			    regs->regs[4], regs->regs[5]);
 
 	return ret ?: regs->regs[9];
diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c
index c13c9f2..9ddc492 100644
--- a/arch/sparc/kernel/ptrace_64.c
+++ b/arch/sparc/kernel/ptrace_64.c
@@ -1076,13 +1076,8 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->u_regs[UREG_G1]);
 
-	audit_syscall_entry((test_thread_flag(TIF_32BIT) ?
-			     AUDIT_ARCH_SPARC :
-			     AUDIT_ARCH_SPARC64),
-			    regs->u_regs[UREG_G1],
-			    regs->u_regs[UREG_I0],
-			    regs->u_regs[UREG_I1],
-			    regs->u_regs[UREG_I2],
+	audit_syscall_entry(regs->u_regs[UREG_G1], regs->u_regs[UREG_I0],
+			    regs->u_regs[UREG_I1], regs->u_regs[UREG_I2],
 			    regs->u_regs[UREG_I3]);
 
 	return ret;
diff --git a/arch/um/kernel/ptrace.c b/arch/um/kernel/ptrace.c
index 694d551..62435ef 100644
--- a/arch/um/kernel/ptrace.c
+++ b/arch/um/kernel/ptrace.c
@@ -165,8 +165,7 @@ static void send_sigtrap(struct task_struct *tsk, struct uml_pt_regs *regs,
  */
 void syscall_trace_enter(struct pt_regs *regs)
 {
-	audit_syscall_entry(HOST_AUDIT_ARCH,
-			    UPT_SYSCALL_NR(&regs->regs),
+	audit_syscall_entry(UPT_SYSCALL_NR(&regs->regs),
 			    UPT_SYSCALL_ARG1(&regs->regs),
 			    UPT_SYSCALL_ARG2(&regs->regs),
 			    UPT_SYSCALL_ARG3(&regs->regs),
diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
index 7461f50..46dfba6 100644
--- a/arch/x86/kernel/ptrace.c
+++ b/arch/x86/kernel/ptrace.c
@@ -1488,15 +1488,11 @@ long syscall_trace_enter(struct pt_regs *regs)
 		trace_sys_enter(regs, regs->orig_ax);
 
 	if (IS_IA32)
-		audit_syscall_entry(AUDIT_ARCH_I386,
-				    regs->orig_ax,
-				    regs->bx, regs->cx,
+		audit_syscall_entry(regs->orig_ax, regs->bx, regs->cx,
 				    regs->dx, regs->si);
 #ifdef CONFIG_X86_64
 	else
-		audit_syscall_entry(AUDIT_ARCH_X86_64,
-				    regs->orig_ax,
-				    regs->di, regs->si,
+		audit_syscall_entry(regs->orig_ax, regs->di, regs->si,
 				    regs->dx, regs->r10);
 #endif
 
diff --git a/arch/x86/um/asm/ptrace.h b/arch/x86/um/asm/ptrace.h
index 54f8102..e59eef2 100644
--- a/arch/x86/um/asm/ptrace.h
+++ b/arch/x86/um/asm/ptrace.h
@@ -47,8 +47,6 @@ struct user_desc;
 
 #ifdef CONFIG_X86_32
 
-#define HOST_AUDIT_ARCH AUDIT_ARCH_I386
-
 extern int ptrace_get_thread_area(struct task_struct *child, int idx,
                                   struct user_desc __user *user_desc);
 
@@ -57,8 +55,6 @@ extern int ptrace_set_thread_area(struct task_struct *child, int idx,
 
 #else
 
-#define HOST_AUDIT_ARCH AUDIT_ARCH_X86_64
-
 #define PT_REGS_R8(r) UPT_R8(&(r)->regs)
 #define PT_REGS_R9(r) UPT_R9(&(r)->regs)
 #define PT_REGS_R10(r) UPT_R10(&(r)->regs)
diff --git a/arch/xtensa/kernel/ptrace.c b/arch/xtensa/kernel/ptrace.c
index 562fac6..4d54b48 100644
--- a/arch/xtensa/kernel/ptrace.c
+++ b/arch/xtensa/kernel/ptrace.c
@@ -342,7 +342,7 @@ void do_syscall_trace_enter(struct pt_regs *regs)
 		do_syscall_trace();
 
 #if 0
-	audit_syscall_entry(current, AUDIT_ARCH_XTENSA..);
+	audit_syscall_entry(...);
 #endif
 }
 
diff --git a/include/linux/audit.h b/include/linux/audit.h
index 4b2983e..62c9d98 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -26,6 +26,7 @@
 #include <linux/sched.h>
 #include <linux/ptrace.h>
 #include <uapi/linux/audit.h>
+#include <asm/syscall.h>
 
 struct audit_sig_info {
 	uid_t		uid;
@@ -135,12 +136,12 @@ static inline void audit_free(struct task_struct *task)
 	if (unlikely(task->audit_context))
 		__audit_free(task);
 }
-static inline void audit_syscall_entry(int arch, int major, unsigned long a0,
+static inline void audit_syscall_entry(int major, unsigned long a0,
 				       unsigned long a1, unsigned long a2,
 				       unsigned long a3)
 {
 	if (unlikely(current->audit_context))
-		__audit_syscall_entry(arch, major, a0, a1, a2, a3);
+		__audit_syscall_entry(syscall_get_arch(), major, a0, a1, a2, a3);
 }
 static inline void audit_syscall_exit(void *pt_regs)
 {
@@ -316,7 +317,7 @@ static inline int audit_alloc(struct task_struct *task)
 }
 static inline void audit_free(struct task_struct *task)
 { }
-static inline void audit_syscall_entry(int arch, int major, unsigned long a0,
+static inline void audit_syscall_entry(int major, unsigned long a0,
 				       unsigned long a1, unsigned long a2,
 				       unsigned long a3)
 { }
-- 
1.8.5.3

[PATCH 4/4] ARCH: AUDIT: audit_syscall_entry() should not require the arch

[Eric Paris]

We have a function where the arch can be queried, syscall_get_arch().
So rather than have every single piece of arch specific code use and/or
duplicate syscall_get_arch(), just have the audit code use the
syscall_get_arch() code.

Signed-off-by: Eric Paris <eparis@redhat.com>
Cc: linux-alpha@vger.kernel.org
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-ia64@vger.kernel.org
Cc: microblaze-uclinux@itee.uq.edu.au
Cc: linux-mips@linux-mips.org
Cc: linux@lists.openrisc.net
Cc: linux-parisc@vger.kernel.org
Cc: linuxppc-dev@lists.ozlabs.org
Cc: linux-s390@vger.kernel.org
Cc: linux-sh@vger.kernel.org
Cc: sparclinux@vger.kernel.org
Cc: user-mode-linux-devel@lists.sourceforge.net
Cc: linux-xtensa@linux-xtensa.org
Cc: x86@kernel.org
---
 arch/alpha/kernel/ptrace.c      |  2 +-
 arch/arm/kernel/ptrace.c        |  4 ++--
 arch/ia64/kernel/ptrace.c       |  2 +-
 arch/microblaze/kernel/ptrace.c |  3 +--
 arch/mips/kernel/ptrace.c       |  4 +---
 arch/openrisc/kernel/ptrace.c   |  3 +--
 arch/parisc/kernel/ptrace.c     |  9 +++------
 arch/powerpc/kernel/ptrace.c    |  7 ++-----
 arch/s390/kernel/ptrace.c       |  4 +---
 arch/sh/kernel/ptrace_32.c      | 14 +-------------
 arch/sh/kernel/ptrace_64.c      | 17 +----------------
 arch/sparc/kernel/ptrace_64.c   |  9 ++-------
 arch/um/kernel/ptrace.c         |  3 +--
 arch/x86/kernel/ptrace.c        |  8 ++------
 arch/x86/um/asm/ptrace.h        |  4 ----
 arch/xtensa/kernel/ptrace.c     |  2 +-
 include/linux/audit.h           |  7 ++++---
 17 files changed, 25 insertions(+), 77 deletions(-)

diff --git a/arch/alpha/kernel/ptrace.c b/arch/alpha/kernel/ptrace.c
index 86d8351..d9ee817 100644
--- a/arch/alpha/kernel/ptrace.c
+++ b/arch/alpha/kernel/ptrace.c
@@ -321,7 +321,7 @@ asmlinkage unsigned long syscall_trace_enter(void)
 	if (test_thread_flag(TIF_SYSCALL_TRACE) &&
 	    tracehook_report_syscall_entry(current_pt_regs()))
 		ret = -1UL;
-	audit_syscall_entry(AUDIT_ARCH_ALPHA, regs->r0, regs->r16, regs->r17, regs->r18, regs->r19);
+	audit_syscall_entry(regs->r0, regs->r16, regs->r17, regs->r18, regs->r19);
 	return ret ?: current_pt_regs()->r0;
 }
 
diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
index 0dd3b79..c9d2b34 100644
--- a/arch/arm/kernel/ptrace.c
+++ b/arch/arm/kernel/ptrace.c
@@ -943,8 +943,8 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs, int scno)
 	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
 		trace_sys_enter(regs, scno);
 
-	audit_syscall_entry(AUDIT_ARCH_ARM, scno, regs->ARM_r0, regs->ARM_r1,
-			    regs->ARM_r2, regs->ARM_r3);
+	audit_syscall_entry(scno, regs->ARM_r0, regs->ARM_r1, regs->ARM_r2,
+			    regs->ARM_r3);
 
 	return scno;
 }
diff --git a/arch/ia64/kernel/ptrace.c b/arch/ia64/kernel/ptrace.c
index b7a5fff..6f54d51 100644
--- a/arch/ia64/kernel/ptrace.c
+++ b/arch/ia64/kernel/ptrace.c
@@ -1219,7 +1219,7 @@ syscall_trace_enter (long arg0, long arg1, long arg2, long arg3,
 		ia64_sync_krbs();
 
 
-	audit_syscall_entry(AUDIT_ARCH_IA64, regs.r15, arg0, arg1, arg2, arg3);
+	audit_syscall_entry(regs.r15, arg0, arg1, arg2, arg3);
 
 	return 0;
 }
diff --git a/arch/microblaze/kernel/ptrace.c b/arch/microblaze/kernel/ptrace.c
index 39cf508..bb10637 100644
--- a/arch/microblaze/kernel/ptrace.c
+++ b/arch/microblaze/kernel/ptrace.c
@@ -147,8 +147,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 		 */
 		ret = -1L;
 
-	audit_syscall_entry(EM_MICROBLAZE, regs->r12, regs->r5, regs->r6,
-			    regs->r7, regs->r8);
+	audit_syscall_entry(regs->r12, regs->r5, regs->r6, regs->r7, regs->r8);
 
 	return ret ?: regs->r12;
 }
diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
index 65ba622..c06bb82 100644
--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -671,9 +671,7 @@ asmlinkage void syscall_trace_enter(struct pt_regs *regs)
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->regs[2]);
 
-	audit_syscall_entry(syscall_get_arch(),
-			    regs->regs[2],
-			    regs->regs[4], regs->regs[5],
+	audit_syscall_entry(regs->regs[2], regs->regs[4], regs->regs[5],
 			    regs->regs[6], regs->regs[7]);
 }
 
diff --git a/arch/openrisc/kernel/ptrace.c b/arch/openrisc/kernel/ptrace.c
index 71a2a0c..4f59fa4 100644
--- a/arch/openrisc/kernel/ptrace.c
+++ b/arch/openrisc/kernel/ptrace.c
@@ -187,8 +187,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 		 */
 		ret = -1L;
 
-	audit_syscall_entry(AUDIT_ARCH_OPENRISC, regs->gpr[11],
-			    regs->gpr[3], regs->gpr[4],
+	audit_syscall_entry(regs->gpr[11], regs->gpr[3], regs->gpr[4],
 			    regs->gpr[5], regs->gpr[6]);
 
 	return ret ? : regs->gpr[11];
diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c
index e842ee2..7481457 100644
--- a/arch/parisc/kernel/ptrace.c
+++ b/arch/parisc/kernel/ptrace.c
@@ -276,14 +276,11 @@ long do_syscall_trace_enter(struct pt_regs *regs)
 
 #ifdef CONFIG_64BIT
 	if (!is_compat_task())
-		audit_syscall_entry(AUDIT_ARCH_PARISC64,
-			regs->gr[20],
-			regs->gr[26], regs->gr[25],
-			regs->gr[24], regs->gr[23]);
+		audit_syscall_entry(regs->gr[20], regs->gr[26], regs->gr[25],
+				    regs->gr[24], regs->gr[23]);
 	else
 #endif
-		audit_syscall_entry(AUDIT_ARCH_PARISC,
-			regs->gr[20] & 0xffffffff,
+		audit_syscall_entry(regs->gr[20] & 0xffffffff,
 			regs->gr[26] & 0xffffffff,
 			regs->gr[25] & 0xffffffff,
 			regs->gr[24] & 0xffffffff,
diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
index 2e3d2bf..524a943 100644
--- a/arch/powerpc/kernel/ptrace.c
+++ b/arch/powerpc/kernel/ptrace.c
@@ -1788,14 +1788,11 @@ long do_syscall_trace_enter(struct pt_regs *regs)
 
 #ifdef CONFIG_PPC64
 	if (!is_32bit_task())
-		audit_syscall_entry(AUDIT_ARCH_PPC64,
-				    regs->gpr[0],
-				    regs->gpr[3], regs->gpr[4],
+		audit_syscall_entry(regs->gpr[0], regs->gpr[3], regs->gpr[4],
 				    regs->gpr[5], regs->gpr[6]);
 	else
 #endif
-		audit_syscall_entry(AUDIT_ARCH_PPC,
-				    regs->gpr[0],
+		audit_syscall_entry(regs->gpr[0],
 				    regs->gpr[3] & 0xffffffff,
 				    regs->gpr[4] & 0xffffffff,
 				    regs->gpr[5] & 0xffffffff,
diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
index e65c91c..2e2e7bb5 100644
--- a/arch/s390/kernel/ptrace.c
+++ b/arch/s390/kernel/ptrace.c
@@ -812,9 +812,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->gprs[2]);
 
-	audit_syscall_entry(is_compat_task() ?
-				AUDIT_ARCH_S390 : AUDIT_ARCH_S390X,
-			    regs->gprs[2], regs->orig_gpr2,
+	audit_syscall_entry(regs->gprs[2], regs->orig_gpr2,
 			    regs->gprs[3], regs->gprs[4],
 			    regs->gprs[5]);
 out:
diff --git a/arch/sh/kernel/ptrace_32.c b/arch/sh/kernel/ptrace_32.c
index 668c816..c1a6b89 100644
--- a/arch/sh/kernel/ptrace_32.c
+++ b/arch/sh/kernel/ptrace_32.c
@@ -484,17 +484,6 @@ long arch_ptrace(struct task_struct *child, long request,
 	return ret;
 }
 
-static inline int audit_arch(void)
-{
-	int arch = EM_SH;
-
-#ifdef CONFIG_CPU_LITTLE_ENDIAN
-	arch |= __AUDIT_ARCH_LE;
-#endif
-
-	return arch;
-}
-
 asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 {
 	long ret = 0;
@@ -513,8 +502,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->regs[0]);
 
-	audit_syscall_entry(audit_arch(), regs->regs[3],
-			    regs->regs[4], regs->regs[5],
+	audit_syscall_entry(regs->regs[3], regs->regs[4], regs->regs[5],
 			    regs->regs[6], regs->regs[7]);
 
 	return ret ?: regs->regs[0];
diff --git a/arch/sh/kernel/ptrace_64.c b/arch/sh/kernel/ptrace_64.c
index af90339..5cea973 100644
--- a/arch/sh/kernel/ptrace_64.c
+++ b/arch/sh/kernel/ptrace_64.c
@@ -504,20 +504,6 @@ asmlinkage int sh64_ptrace(long request, long pid,
 	return sys_ptrace(request, pid, addr, data);
 }
 
-static inline int audit_arch(void)
-{
-	int arch = EM_SH;
-
-#ifdef CONFIG_64BIT
-	arch |= __AUDIT_ARCH_64BIT;
-#endif
-#ifdef CONFIG_CPU_LITTLE_ENDIAN
-	arch |= __AUDIT_ARCH_LE;
-#endif
-
-	return arch;
-}
-
 asmlinkage long long do_syscall_trace_enter(struct pt_regs *regs)
 {
 	long long ret = 0;
@@ -536,8 +522,7 @@ asmlinkage long long do_syscall_trace_enter(struct pt_regs *regs)
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->regs[9]);
 
-	audit_syscall_entry(audit_arch(), regs->regs[1],
-			    regs->regs[2], regs->regs[3],
+	audit_syscall_entry(regs->regs[1], regs->regs[2], regs->regs[3],
 			    regs->regs[4], regs->regs[5]);
 
 	return ret ?: regs->regs[9];
diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c
index c13c9f2..9ddc492 100644
--- a/arch/sparc/kernel/ptrace_64.c
+++ b/arch/sparc/kernel/ptrace_64.c
@@ -1076,13 +1076,8 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->u_regs[UREG_G1]);
 
-	audit_syscall_entry((test_thread_flag(TIF_32BIT) ?
-			     AUDIT_ARCH_SPARC :
-			     AUDIT_ARCH_SPARC64),
-			    regs->u_regs[UREG_G1],
-			    regs->u_regs[UREG_I0],
-			    regs->u_regs[UREG_I1],
-			    regs->u_regs[UREG_I2],
+	audit_syscall_entry(regs->u_regs[UREG_G1], regs->u_regs[UREG_I0],
+			    regs->u_regs[UREG_I1], regs->u_regs[UREG_I2],
 			    regs->u_regs[UREG_I3]);
 
 	return ret;
diff --git a/arch/um/kernel/ptrace.c b/arch/um/kernel/ptrace.c
index 694d551..62435ef 100644
--- a/arch/um/kernel/ptrace.c
+++ b/arch/um/kernel/ptrace.c
@@ -165,8 +165,7 @@ static void send_sigtrap(struct task_struct *tsk, struct uml_pt_regs *regs,
  */
 void syscall_trace_enter(struct pt_regs *regs)
 {
-	audit_syscall_entry(HOST_AUDIT_ARCH,
-			    UPT_SYSCALL_NR(&regs->regs),
+	audit_syscall_entry(UPT_SYSCALL_NR(&regs->regs),
 			    UPT_SYSCALL_ARG1(&regs->regs),
 			    UPT_SYSCALL_ARG2(&regs->regs),
 			    UPT_SYSCALL_ARG3(&regs->regs),
diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
index 7461f50..46dfba6 100644
--- a/arch/x86/kernel/ptrace.c
+++ b/arch/x86/kernel/ptrace.c
@@ -1488,15 +1488,11 @@ long syscall_trace_enter(struct pt_regs *regs)
 		trace_sys_enter(regs, regs->orig_ax);
 
 	if (IS_IA32)
-		audit_syscall_entry(AUDIT_ARCH_I386,
-				    regs->orig_ax,
-				    regs->bx, regs->cx,
+		audit_syscall_entry(regs->orig_ax, regs->bx, regs->cx,
 				    regs->dx, regs->si);
 #ifdef CONFIG_X86_64
 	else
-		audit_syscall_entry(AUDIT_ARCH_X86_64,
-				    regs->orig_ax,
-				    regs->di, regs->si,
+		audit_syscall_entry(regs->orig_ax, regs->di, regs->si,
 				    regs->dx, regs->r10);
 #endif
 
diff --git a/arch/x86/um/asm/ptrace.h b/arch/x86/um/asm/ptrace.h
index 54f8102..e59eef2 100644
--- a/arch/x86/um/asm/ptrace.h
+++ b/arch/x86/um/asm/ptrace.h
@@ -47,8 +47,6 @@ struct user_desc;
 
 #ifdef CONFIG_X86_32
 
-#define HOST_AUDIT_ARCH AUDIT_ARCH_I386
-
 extern int ptrace_get_thread_area(struct task_struct *child, int idx,
                                   struct user_desc __user *user_desc);
 
@@ -57,8 +55,6 @@ extern int ptrace_set_thread_area(struct task_struct *child, int idx,
 
 #else
 
-#define HOST_AUDIT_ARCH AUDIT_ARCH_X86_64
-
 #define PT_REGS_R8(r) UPT_R8(&(r)->regs)
 #define PT_REGS_R9(r) UPT_R9(&(r)->regs)
 #define PT_REGS_R10(r) UPT_R10(&(r)->regs)
diff --git a/arch/xtensa/kernel/ptrace.c b/arch/xtensa/kernel/ptrace.c
index 562fac6..4d54b48 100644
--- a/arch/xtensa/kernel/ptrace.c
+++ b/arch/xtensa/kernel/ptrace.c
@@ -342,7 +342,7 @@ void do_syscall_trace_enter(struct pt_regs *regs)
 		do_syscall_trace();
 
 #if 0
-	audit_syscall_entry(current, AUDIT_ARCH_XTENSA..);
+	audit_syscall_entry(...);
 #endif
 }
 
diff --git a/include/linux/audit.h b/include/linux/audit.h
index 4b2983e..62c9d98 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -26,6 +26,7 @@
 #include <linux/sched.h>
 #include <linux/ptrace.h>
 #include <uapi/linux/audit.h>
+#include <asm/syscall.h>
 
 struct audit_sig_info {
 	uid_t		uid;
@@ -135,12 +136,12 @@ static inline void audit_free(struct task_struct *task)
 	if (unlikely(task->audit_context))
 		__audit_free(task);
 }
-static inline void audit_syscall_entry(int arch, int major, unsigned long a0,
+static inline void audit_syscall_entry(int major, unsigned long a0,
 				       unsigned long a1, unsigned long a2,
 				       unsigned long a3)
 {
 	if (unlikely(current->audit_context))
-		__audit_syscall_entry(arch, major, a0, a1, a2, a3);
+		__audit_syscall_entry(syscall_get_arch(), major, a0, a1, a2, a3);
 }
 static inline void audit_syscall_exit(void *pt_regs)
 {
@@ -316,7 +317,7 @@ static inline int audit_alloc(struct task_struct *task)
 }
 static inline void audit_free(struct task_struct *task)
 { }
-static inline void audit_syscall_entry(int arch, int major, unsigned long a0,
+static inline void audit_syscall_entry(int major, unsigned long a0,
 				       unsigned long a1, unsigned long a2,
 				       unsigned long a3)
 { }
-- 
1.8.5.3

[PATCH 4/4] ARCH: AUDIT: audit_syscall_entry() should not require the arch

[Eric Paris]

We have a function where the arch can be queried, syscall_get_arch().
So rather than have every single piece of arch specific code use and/or
duplicate syscall_get_arch(), just have the audit code use the
syscall_get_arch() code.

Signed-off-by: Eric Paris <eparis@redhat.com>
Cc: linux-alpha@vger.kernel.org
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-ia64@vger.kernel.org
Cc: microblaze-uclinux@itee.uq.edu.au
Cc: linux-mips@linux-mips.org
Cc: linux@lists.openrisc.net
Cc: linux-parisc@vger.kernel.org
Cc: linuxppc-dev@lists.ozlabs.org
Cc: linux-s390@vger.kernel.org
Cc: linux-sh@vger.kernel.org
Cc: sparclinux@vger.kernel.org
Cc: user-mode-linux-devel@lists.sourceforge.net
Cc: linux-xtensa@linux-xtensa.org
Cc: x86@kernel.org
---
 arch/alpha/kernel/ptrace.c      |  2 +-
 arch/arm/kernel/ptrace.c        |  4 ++--
 arch/ia64/kernel/ptrace.c       |  2 +-
 arch/microblaze/kernel/ptrace.c |  3 +--
 arch/mips/kernel/ptrace.c       |  4 +---
 arch/openrisc/kernel/ptrace.c   |  3 +--
 arch/parisc/kernel/ptrace.c     |  9 +++------
 arch/powerpc/kernel/ptrace.c    |  7 ++-----
 arch/s390/kernel/ptrace.c       |  4 +---
 arch/sh/kernel/ptrace_32.c      | 14 +-------------
 arch/sh/kernel/ptrace_64.c      | 17 +----------------
 arch/sparc/kernel/ptrace_64.c   |  9 ++-------
 arch/um/kernel/ptrace.c         |  3 +--
 arch/x86/kernel/ptrace.c        |  8 ++------
 arch/x86/um/asm/ptrace.h        |  4 ----
 arch/xtensa/kernel/ptrace.c     |  2 +-
 include/linux/audit.h           |  7 ++++---
 17 files changed, 25 insertions(+), 77 deletions(-)

diff --git a/arch/alpha/kernel/ptrace.c b/arch/alpha/kernel/ptrace.c
index 86d8351..d9ee817 100644
--- a/arch/alpha/kernel/ptrace.c
+++ b/arch/alpha/kernel/ptrace.c
@@ -321,7 +321,7 @@ asmlinkage unsigned long syscall_trace_enter(void)
 	if (test_thread_flag(TIF_SYSCALL_TRACE) &&
 	    tracehook_report_syscall_entry(current_pt_regs()))
 		ret = -1UL;
-	audit_syscall_entry(AUDIT_ARCH_ALPHA, regs->r0, regs->r16, regs->r17, regs->r18, regs->r19);
+	audit_syscall_entry(regs->r0, regs->r16, regs->r17, regs->r18, regs->r19);
 	return ret ?: current_pt_regs()->r0;
 }
 
diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
index 0dd3b79..c9d2b34 100644
--- a/arch/arm/kernel/ptrace.c
+++ b/arch/arm/kernel/ptrace.c
@@ -943,8 +943,8 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs, int scno)
 	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
 		trace_sys_enter(regs, scno);
 
-	audit_syscall_entry(AUDIT_ARCH_ARM, scno, regs->ARM_r0, regs->ARM_r1,
-			    regs->ARM_r2, regs->ARM_r3);
+	audit_syscall_entry(scno, regs->ARM_r0, regs->ARM_r1, regs->ARM_r2,
+			    regs->ARM_r3);
 
 	return scno;
 }
diff --git a/arch/ia64/kernel/ptrace.c b/arch/ia64/kernel/ptrace.c
index b7a5fff..6f54d51 100644
--- a/arch/ia64/kernel/ptrace.c
+++ b/arch/ia64/kernel/ptrace.c
@@ -1219,7 +1219,7 @@ syscall_trace_enter (long arg0, long arg1, long arg2, long arg3,
 		ia64_sync_krbs();
 
 
-	audit_syscall_entry(AUDIT_ARCH_IA64, regs.r15, arg0, arg1, arg2, arg3);
+	audit_syscall_entry(regs.r15, arg0, arg1, arg2, arg3);
 
 	return 0;
 }
diff --git a/arch/microblaze/kernel/ptrace.c b/arch/microblaze/kernel/ptrace.c
index 39cf508..bb10637 100644
--- a/arch/microblaze/kernel/ptrace.c
+++ b/arch/microblaze/kernel/ptrace.c
@@ -147,8 +147,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 		 */
 		ret = -1L;
 
-	audit_syscall_entry(EM_MICROBLAZE, regs->r12, regs->r5, regs->r6,
-			    regs->r7, regs->r8);
+	audit_syscall_entry(regs->r12, regs->r5, regs->r6, regs->r7, regs->r8);
 
 	return ret ?: regs->r12;
 }
diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
index 65ba622..c06bb82 100644
--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -671,9 +671,7 @@ asmlinkage void syscall_trace_enter(struct pt_regs *regs)
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->regs[2]);
 
-	audit_syscall_entry(syscall_get_arch(),
-			    regs->regs[2],
-			    regs->regs[4], regs->regs[5],
+	audit_syscall_entry(regs->regs[2], regs->regs[4], regs->regs[5],
 			    regs->regs[6], regs->regs[7]);
 }
 
diff --git a/arch/openrisc/kernel/ptrace.c b/arch/openrisc/kernel/ptrace.c
index 71a2a0c..4f59fa4 100644
--- a/arch/openrisc/kernel/ptrace.c
+++ b/arch/openrisc/kernel/ptrace.c
@@ -187,8 +187,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 		 */
 		ret = -1L;
 
-	audit_syscall_entry(AUDIT_ARCH_OPENRISC, regs->gpr[11],
-			    regs->gpr[3], regs->gpr[4],
+	audit_syscall_entry(regs->gpr[11], regs->gpr[3], regs->gpr[4],
 			    regs->gpr[5], regs->gpr[6]);
 
 	return ret ? : regs->gpr[11];
diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c
index e842ee2..7481457 100644
--- a/arch/parisc/kernel/ptrace.c
+++ b/arch/parisc/kernel/ptrace.c
@@ -276,14 +276,11 @@ long do_syscall_trace_enter(struct pt_regs *regs)
 
 #ifdef CONFIG_64BIT
 	if (!is_compat_task())
-		audit_syscall_entry(AUDIT_ARCH_PARISC64,
-			regs->gr[20],
-			regs->gr[26], regs->gr[25],
-			regs->gr[24], regs->gr[23]);
+		audit_syscall_entry(regs->gr[20], regs->gr[26], regs->gr[25],
+				    regs->gr[24], regs->gr[23]);
 	else
 #endif
-		audit_syscall_entry(AUDIT_ARCH_PARISC,
-			regs->gr[20] & 0xffffffff,
+		audit_syscall_entry(regs->gr[20] & 0xffffffff,
 			regs->gr[26] & 0xffffffff,
 			regs->gr[25] & 0xffffffff,
 			regs->gr[24] & 0xffffffff,
diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
index 2e3d2bf..524a943 100644
--- a/arch/powerpc/kernel/ptrace.c
+++ b/arch/powerpc/kernel/ptrace.c
@@ -1788,14 +1788,11 @@ long do_syscall_trace_enter(struct pt_regs *regs)
 
 #ifdef CONFIG_PPC64
 	if (!is_32bit_task())
-		audit_syscall_entry(AUDIT_ARCH_PPC64,
-				    regs->gpr[0],
-				    regs->gpr[3], regs->gpr[4],
+		audit_syscall_entry(regs->gpr[0], regs->gpr[3], regs->gpr[4],
 				    regs->gpr[5], regs->gpr[6]);
 	else
 #endif
-		audit_syscall_entry(AUDIT_ARCH_PPC,
-				    regs->gpr[0],
+		audit_syscall_entry(regs->gpr[0],
 				    regs->gpr[3] & 0xffffffff,
 				    regs->gpr[4] & 0xffffffff,
 				    regs->gpr[5] & 0xffffffff,
diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
index e65c91c..2e2e7bb5 100644
--- a/arch/s390/kernel/ptrace.c
+++ b/arch/s390/kernel/ptrace.c
@@ -812,9 +812,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->gprs[2]);
 
-	audit_syscall_entry(is_compat_task() ?
-				AUDIT_ARCH_S390 : AUDIT_ARCH_S390X,
-			    regs->gprs[2], regs->orig_gpr2,
+	audit_syscall_entry(regs->gprs[2], regs->orig_gpr2,
 			    regs->gprs[3], regs->gprs[4],
 			    regs->gprs[5]);
 out:
diff --git a/arch/sh/kernel/ptrace_32.c b/arch/sh/kernel/ptrace_32.c
index 668c816..c1a6b89 100644
--- a/arch/sh/kernel/ptrace_32.c
+++ b/arch/sh/kernel/ptrace_32.c
@@ -484,17 +484,6 @@ long arch_ptrace(struct task_struct *child, long request,
 	return ret;
 }
 
-static inline int audit_arch(void)
-{
-	int arch = EM_SH;
-
-#ifdef CONFIG_CPU_LITTLE_ENDIAN
-	arch |= __AUDIT_ARCH_LE;
-#endif
-
-	return arch;
-}
-
 asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 {
 	long ret = 0;
@@ -513,8 +502,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->regs[0]);
 
-	audit_syscall_entry(audit_arch(), regs->regs[3],
-			    regs->regs[4], regs->regs[5],
+	audit_syscall_entry(regs->regs[3], regs->regs[4], regs->regs[5],
 			    regs->regs[6], regs->regs[7]);
 
 	return ret ?: regs->regs[0];
diff --git a/arch/sh/kernel/ptrace_64.c b/arch/sh/kernel/ptrace_64.c
index af90339..5cea973 100644
--- a/arch/sh/kernel/ptrace_64.c
+++ b/arch/sh/kernel/ptrace_64.c
@@ -504,20 +504,6 @@ asmlinkage int sh64_ptrace(long request, long pid,
 	return sys_ptrace(request, pid, addr, data);
 }
 
-static inline int audit_arch(void)
-{
-	int arch = EM_SH;
-
-#ifdef CONFIG_64BIT
-	arch |= __AUDIT_ARCH_64BIT;
-#endif
-#ifdef CONFIG_CPU_LITTLE_ENDIAN
-	arch |= __AUDIT_ARCH_LE;
-#endif
-
-	return arch;
-}
-
 asmlinkage long long do_syscall_trace_enter(struct pt_regs *regs)
 {
 	long long ret = 0;
@@ -536,8 +522,7 @@ asmlinkage long long do_syscall_trace_enter(struct pt_regs *regs)
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->regs[9]);
 
-	audit_syscall_entry(audit_arch(), regs->regs[1],
-			    regs->regs[2], regs->regs[3],
+	audit_syscall_entry(regs->regs[1], regs->regs[2], regs->regs[3],
 			    regs->regs[4], regs->regs[5]);
 
 	return ret ?: regs->regs[9];
diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c
index c13c9f2..9ddc492 100644
--- a/arch/sparc/kernel/ptrace_64.c
+++ b/arch/sparc/kernel/ptrace_64.c
@@ -1076,13 +1076,8 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->u_regs[UREG_G1]);
 
-	audit_syscall_entry((test_thread_flag(TIF_32BIT) ?
-			     AUDIT_ARCH_SPARC :
-			     AUDIT_ARCH_SPARC64),
-			    regs->u_regs[UREG_G1],
-			    regs->u_regs[UREG_I0],
-			    regs->u_regs[UREG_I1],
-			    regs->u_regs[UREG_I2],
+	audit_syscall_entry(regs->u_regs[UREG_G1], regs->u_regs[UREG_I0],
+			    regs->u_regs[UREG_I1], regs->u_regs[UREG_I2],
 			    regs->u_regs[UREG_I3]);
 
 	return ret;
diff --git a/arch/um/kernel/ptrace.c b/arch/um/kernel/ptrace.c
index 694d551..62435ef 100644
--- a/arch/um/kernel/ptrace.c
+++ b/arch/um/kernel/ptrace.c
@@ -165,8 +165,7 @@ static void send_sigtrap(struct task_struct *tsk, struct uml_pt_regs *regs,
  */
 void syscall_trace_enter(struct pt_regs *regs)
 {
-	audit_syscall_entry(HOST_AUDIT_ARCH,
-			    UPT_SYSCALL_NR(&regs->regs),
+	audit_syscall_entry(UPT_SYSCALL_NR(&regs->regs),
 			    UPT_SYSCALL_ARG1(&regs->regs),
 			    UPT_SYSCALL_ARG2(&regs->regs),
 			    UPT_SYSCALL_ARG3(&regs->regs),
diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
index 7461f50..46dfba6 100644
--- a/arch/x86/kernel/ptrace.c
+++ b/arch/x86/kernel/ptrace.c
@@ -1488,15 +1488,11 @@ long syscall_trace_enter(struct pt_regs *regs)
 		trace_sys_enter(regs, regs->orig_ax);
 
 	if (IS_IA32)
-		audit_syscall_entry(AUDIT_ARCH_I386,
-				    regs->orig_ax,
-				    regs->bx, regs->cx,
+		audit_syscall_entry(regs->orig_ax, regs->bx, regs->cx,
 				    regs->dx, regs->si);
 #ifdef CONFIG_X86_64
 	else
-		audit_syscall_entry(AUDIT_ARCH_X86_64,
-				    regs->orig_ax,
-				    regs->di, regs->si,
+		audit_syscall_entry(regs->orig_ax, regs->di, regs->si,
 				    regs->dx, regs->r10);
 #endif
 
diff --git a/arch/x86/um/asm/ptrace.h b/arch/x86/um/asm/ptrace.h
index 54f8102..e59eef2 100644
--- a/arch/x86/um/asm/ptrace.h
+++ b/arch/x86/um/asm/ptrace.h
@@ -47,8 +47,6 @@ struct user_desc;
 
 #ifdef CONFIG_X86_32
 
-#define HOST_AUDIT_ARCH AUDIT_ARCH_I386
-
 extern int ptrace_get_thread_area(struct task_struct *child, int idx,
                                   struct user_desc __user *user_desc);
 
@@ -57,8 +55,6 @@ extern int ptrace_set_thread_area(struct task_struct *child, int idx,
 
 #else
 
-#define HOST_AUDIT_ARCH AUDIT_ARCH_X86_64
-
 #define PT_REGS_R8(r) UPT_R8(&(r)->regs)
 #define PT_REGS_R9(r) UPT_R9(&(r)->regs)
 #define PT_REGS_R10(r) UPT_R10(&(r)->regs)
diff --git a/arch/xtensa/kernel/ptrace.c b/arch/xtensa/kernel/ptrace.c
index 562fac6..4d54b48 100644
--- a/arch/xtensa/kernel/ptrace.c
+++ b/arch/xtensa/kernel/ptrace.c
@@ -342,7 +342,7 @@ void do_syscall_trace_enter(struct pt_regs *regs)
 		do_syscall_trace();
 
 #if 0
-	audit_syscall_entry(current, AUDIT_ARCH_XTENSA..);
+	audit_syscall_entry(...);
 #endif
 }
 
diff --git a/include/linux/audit.h b/include/linux/audit.h
index 4b2983e..62c9d98 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -26,6 +26,7 @@
 #include <linux/sched.h>
 #include <linux/ptrace.h>
 #include <uapi/linux/audit.h>
+#include <asm/syscall.h>
 
 struct audit_sig_info {
 	uid_t		uid;
@@ -135,12 +136,12 @@ static inline void audit_free(struct task_struct *task)
 	if (unlikely(task->audit_context))
 		__audit_free(task);
 }
-static inline void audit_syscall_entry(int arch, int major, unsigned long a0,
+static inline void audit_syscall_entry(int major, unsigned long a0,
 				       unsigned long a1, unsigned long a2,
 				       unsigned long a3)
 {
 	if (unlikely(current->audit_context))
-		__audit_syscall_entry(arch, major, a0, a1, a2, a3);
+		__audit_syscall_entry(syscall_get_arch(), major, a0, a1, a2, a3);
 }
 static inline void audit_syscall_exit(void *pt_regs)
 {
@@ -316,7 +317,7 @@ static inline int audit_alloc(struct task_struct *task)
 }
 static inline void audit_free(struct task_struct *task)
 { }
-static inline void audit_syscall_entry(int arch, int major, unsigned long a0,
+static inline void audit_syscall_entry(int major, unsigned long a0,
 				       unsigned long a1, unsigned long a2,
 				       unsigned long a3)
 { }
-- 
1.8.5.3

[PATCH 4/4] ARCH: AUDIT: audit_syscall_entry() should not require the arch

[Eric Paris]

We have a function where the arch can be queried, syscall_get_arch().
So rather than have every single piece of arch specific code use and/or
duplicate syscall_get_arch(), just have the audit code use the
syscall_get_arch() code.

Signed-off-by: Eric Paris <eparis@redhat.com>
Cc: linux-alpha at vger.kernel.org
Cc: linux-arm-kernel at lists.infradead.org
Cc: linux-ia64 at vger.kernel.org
Cc: microblaze-uclinux at itee.uq.edu.au
Cc: linux-mips at linux-mips.org
Cc: linux at lists.openrisc.net
Cc: linux-parisc at vger.kernel.org
Cc: linuxppc-dev at lists.ozlabs.org
Cc: linux-s390 at vger.kernel.org
Cc: linux-sh at vger.kernel.org
Cc: sparclinux at vger.kernel.org
Cc: user-mode-linux-devel at lists.sourceforge.net
Cc: linux-xtensa at linux-xtensa.org
Cc: x86 at kernel.org
---
 arch/alpha/kernel/ptrace.c      |  2 +-
 arch/arm/kernel/ptrace.c        |  4 ++--
 arch/ia64/kernel/ptrace.c       |  2 +-
 arch/microblaze/kernel/ptrace.c |  3 +--
 arch/mips/kernel/ptrace.c       |  4 +---
 arch/openrisc/kernel/ptrace.c   |  3 +--
 arch/parisc/kernel/ptrace.c     |  9 +++------
 arch/powerpc/kernel/ptrace.c    |  7 ++-----
 arch/s390/kernel/ptrace.c       |  4 +---
 arch/sh/kernel/ptrace_32.c      | 14 +-------------
 arch/sh/kernel/ptrace_64.c      | 17 +----------------
 arch/sparc/kernel/ptrace_64.c   |  9 ++-------
 arch/um/kernel/ptrace.c         |  3 +--
 arch/x86/kernel/ptrace.c        |  8 ++------
 arch/x86/um/asm/ptrace.h        |  4 ----
 arch/xtensa/kernel/ptrace.c     |  2 +-
 include/linux/audit.h           |  7 ++++---
 17 files changed, 25 insertions(+), 77 deletions(-)

diff --git a/arch/alpha/kernel/ptrace.c b/arch/alpha/kernel/ptrace.c
index 86d8351..d9ee817 100644
--- a/arch/alpha/kernel/ptrace.c
+++ b/arch/alpha/kernel/ptrace.c
@@ -321,7 +321,7 @@ asmlinkage unsigned long syscall_trace_enter(void)
 	if (test_thread_flag(TIF_SYSCALL_TRACE) &&
 	    tracehook_report_syscall_entry(current_pt_regs()))
 		ret = -1UL;
-	audit_syscall_entry(AUDIT_ARCH_ALPHA, regs->r0, regs->r16, regs->r17, regs->r18, regs->r19);
+	audit_syscall_entry(regs->r0, regs->r16, regs->r17, regs->r18, regs->r19);
 	return ret ?: current_pt_regs()->r0;
 }
 
diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
index 0dd3b79..c9d2b34 100644
--- a/arch/arm/kernel/ptrace.c
+++ b/arch/arm/kernel/ptrace.c
@@ -943,8 +943,8 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs, int scno)
 	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
 		trace_sys_enter(regs, scno);
 
-	audit_syscall_entry(AUDIT_ARCH_ARM, scno, regs->ARM_r0, regs->ARM_r1,
-			    regs->ARM_r2, regs->ARM_r3);
+	audit_syscall_entry(scno, regs->ARM_r0, regs->ARM_r1, regs->ARM_r2,
+			    regs->ARM_r3);
 
 	return scno;
 }
diff --git a/arch/ia64/kernel/ptrace.c b/arch/ia64/kernel/ptrace.c
index b7a5fff..6f54d51 100644
--- a/arch/ia64/kernel/ptrace.c
+++ b/arch/ia64/kernel/ptrace.c
@@ -1219,7 +1219,7 @@ syscall_trace_enter (long arg0, long arg1, long arg2, long arg3,
 		ia64_sync_krbs();
 
 
-	audit_syscall_entry(AUDIT_ARCH_IA64, regs.r15, arg0, arg1, arg2, arg3);
+	audit_syscall_entry(regs.r15, arg0, arg1, arg2, arg3);
 
 	return 0;
 }
diff --git a/arch/microblaze/kernel/ptrace.c b/arch/microblaze/kernel/ptrace.c
index 39cf508..bb10637 100644
--- a/arch/microblaze/kernel/ptrace.c
+++ b/arch/microblaze/kernel/ptrace.c
@@ -147,8 +147,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 		 */
 		ret = -1L;
 
-	audit_syscall_entry(EM_MICROBLAZE, regs->r12, regs->r5, regs->r6,
-			    regs->r7, regs->r8);
+	audit_syscall_entry(regs->r12, regs->r5, regs->r6, regs->r7, regs->r8);
 
 	return ret ?: regs->r12;
 }
diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
index 65ba622..c06bb82 100644
--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -671,9 +671,7 @@ asmlinkage void syscall_trace_enter(struct pt_regs *regs)
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->regs[2]);
 
-	audit_syscall_entry(syscall_get_arch(),
-			    regs->regs[2],
-			    regs->regs[4], regs->regs[5],
+	audit_syscall_entry(regs->regs[2], regs->regs[4], regs->regs[5],
 			    regs->regs[6], regs->regs[7]);
 }
 
diff --git a/arch/openrisc/kernel/ptrace.c b/arch/openrisc/kernel/ptrace.c
index 71a2a0c..4f59fa4 100644
--- a/arch/openrisc/kernel/ptrace.c
+++ b/arch/openrisc/kernel/ptrace.c
@@ -187,8 +187,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 		 */
 		ret = -1L;
 
-	audit_syscall_entry(AUDIT_ARCH_OPENRISC, regs->gpr[11],
-			    regs->gpr[3], regs->gpr[4],
+	audit_syscall_entry(regs->gpr[11], regs->gpr[3], regs->gpr[4],
 			    regs->gpr[5], regs->gpr[6]);
 
 	return ret ? : regs->gpr[11];
diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c
index e842ee2..7481457 100644
--- a/arch/parisc/kernel/ptrace.c
+++ b/arch/parisc/kernel/ptrace.c
@@ -276,14 +276,11 @@ long do_syscall_trace_enter(struct pt_regs *regs)
 
 #ifdef CONFIG_64BIT
 	if (!is_compat_task())
-		audit_syscall_entry(AUDIT_ARCH_PARISC64,
-			regs->gr[20],
-			regs->gr[26], regs->gr[25],
-			regs->gr[24], regs->gr[23]);
+		audit_syscall_entry(regs->gr[20], regs->gr[26], regs->gr[25],
+				    regs->gr[24], regs->gr[23]);
 	else
 #endif
-		audit_syscall_entry(AUDIT_ARCH_PARISC,
-			regs->gr[20] & 0xffffffff,
+		audit_syscall_entry(regs->gr[20] & 0xffffffff,
 			regs->gr[26] & 0xffffffff,
 			regs->gr[25] & 0xffffffff,
 			regs->gr[24] & 0xffffffff,
diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
index 2e3d2bf..524a943 100644
--- a/arch/powerpc/kernel/ptrace.c
+++ b/arch/powerpc/kernel/ptrace.c
@@ -1788,14 +1788,11 @@ long do_syscall_trace_enter(struct pt_regs *regs)
 
 #ifdef CONFIG_PPC64
 	if (!is_32bit_task())
-		audit_syscall_entry(AUDIT_ARCH_PPC64,
-				    regs->gpr[0],
-				    regs->gpr[3], regs->gpr[4],
+		audit_syscall_entry(regs->gpr[0], regs->gpr[3], regs->gpr[4],
 				    regs->gpr[5], regs->gpr[6]);
 	else
 #endif
-		audit_syscall_entry(AUDIT_ARCH_PPC,
-				    regs->gpr[0],
+		audit_syscall_entry(regs->gpr[0],
 				    regs->gpr[3] & 0xffffffff,
 				    regs->gpr[4] & 0xffffffff,
 				    regs->gpr[5] & 0xffffffff,
diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
index e65c91c..2e2e7bb5 100644
--- a/arch/s390/kernel/ptrace.c
+++ b/arch/s390/kernel/ptrace.c
@@ -812,9 +812,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->gprs[2]);
 
-	audit_syscall_entry(is_compat_task() ?
-				AUDIT_ARCH_S390 : AUDIT_ARCH_S390X,
-			    regs->gprs[2], regs->orig_gpr2,
+	audit_syscall_entry(regs->gprs[2], regs->orig_gpr2,
 			    regs->gprs[3], regs->gprs[4],
 			    regs->gprs[5]);
 out:
diff --git a/arch/sh/kernel/ptrace_32.c b/arch/sh/kernel/ptrace_32.c
index 668c816..c1a6b89 100644
--- a/arch/sh/kernel/ptrace_32.c
+++ b/arch/sh/kernel/ptrace_32.c
@@ -484,17 +484,6 @@ long arch_ptrace(struct task_struct *child, long request,
 	return ret;
 }
 
-static inline int audit_arch(void)
-{
-	int arch = EM_SH;
-
-#ifdef CONFIG_CPU_LITTLE_ENDIAN
-	arch |= __AUDIT_ARCH_LE;
-#endif
-
-	return arch;
-}
-
 asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 {
 	long ret = 0;
@@ -513,8 +502,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->regs[0]);
 
-	audit_syscall_entry(audit_arch(), regs->regs[3],
-			    regs->regs[4], regs->regs[5],
+	audit_syscall_entry(regs->regs[3], regs->regs[4], regs->regs[5],
 			    regs->regs[6], regs->regs[7]);
 
 	return ret ?: regs->regs[0];
diff --git a/arch/sh/kernel/ptrace_64.c b/arch/sh/kernel/ptrace_64.c
index af90339..5cea973 100644
--- a/arch/sh/kernel/ptrace_64.c
+++ b/arch/sh/kernel/ptrace_64.c
@@ -504,20 +504,6 @@ asmlinkage int sh64_ptrace(long request, long pid,
 	return sys_ptrace(request, pid, addr, data);
 }
 
-static inline int audit_arch(void)
-{
-	int arch = EM_SH;
-
-#ifdef CONFIG_64BIT
-	arch |= __AUDIT_ARCH_64BIT;
-#endif
-#ifdef CONFIG_CPU_LITTLE_ENDIAN
-	arch |= __AUDIT_ARCH_LE;
-#endif
-
-	return arch;
-}
-
 asmlinkage long long do_syscall_trace_enter(struct pt_regs *regs)
 {
 	long long ret = 0;
@@ -536,8 +522,7 @@ asmlinkage long long do_syscall_trace_enter(struct pt_regs *regs)
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->regs[9]);
 
-	audit_syscall_entry(audit_arch(), regs->regs[1],
-			    regs->regs[2], regs->regs[3],
+	audit_syscall_entry(regs->regs[1], regs->regs[2], regs->regs[3],
 			    regs->regs[4], regs->regs[5]);
 
 	return ret ?: regs->regs[9];
diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c
index c13c9f2..9ddc492 100644
--- a/arch/sparc/kernel/ptrace_64.c
+++ b/arch/sparc/kernel/ptrace_64.c
@@ -1076,13 +1076,8 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->u_regs[UREG_G1]);
 
-	audit_syscall_entry((test_thread_flag(TIF_32BIT) ?
-			     AUDIT_ARCH_SPARC :
-			     AUDIT_ARCH_SPARC64),
-			    regs->u_regs[UREG_G1],
-			    regs->u_regs[UREG_I0],
-			    regs->u_regs[UREG_I1],
-			    regs->u_regs[UREG_I2],
+	audit_syscall_entry(regs->u_regs[UREG_G1], regs->u_regs[UREG_I0],
+			    regs->u_regs[UREG_I1], regs->u_regs[UREG_I2],
 			    regs->u_regs[UREG_I3]);
 
 	return ret;
diff --git a/arch/um/kernel/ptrace.c b/arch/um/kernel/ptrace.c
index 694d551..62435ef 100644
--- a/arch/um/kernel/ptrace.c
+++ b/arch/um/kernel/ptrace.c
@@ -165,8 +165,7 @@ static void send_sigtrap(struct task_struct *tsk, struct uml_pt_regs *regs,
  */
 void syscall_trace_enter(struct pt_regs *regs)
 {
-	audit_syscall_entry(HOST_AUDIT_ARCH,
-			    UPT_SYSCALL_NR(&regs->regs),
+	audit_syscall_entry(UPT_SYSCALL_NR(&regs->regs),
 			    UPT_SYSCALL_ARG1(&regs->regs),
 			    UPT_SYSCALL_ARG2(&regs->regs),
 			    UPT_SYSCALL_ARG3(&regs->regs),
diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
index 7461f50..46dfba6 100644
--- a/arch/x86/kernel/ptrace.c
+++ b/arch/x86/kernel/ptrace.c
@@ -1488,15 +1488,11 @@ long syscall_trace_enter(struct pt_regs *regs)
 		trace_sys_enter(regs, regs->orig_ax);
 
 	if (IS_IA32)
-		audit_syscall_entry(AUDIT_ARCH_I386,
-				    regs->orig_ax,
-				    regs->bx, regs->cx,
+		audit_syscall_entry(regs->orig_ax, regs->bx, regs->cx,
 				    regs->dx, regs->si);
 #ifdef CONFIG_X86_64
 	else
-		audit_syscall_entry(AUDIT_ARCH_X86_64,
-				    regs->orig_ax,
-				    regs->di, regs->si,
+		audit_syscall_entry(regs->orig_ax, regs->di, regs->si,
 				    regs->dx, regs->r10);
 #endif
 
diff --git a/arch/x86/um/asm/ptrace.h b/arch/x86/um/asm/ptrace.h
index 54f8102..e59eef2 100644
--- a/arch/x86/um/asm/ptrace.h
+++ b/arch/x86/um/asm/ptrace.h
@@ -47,8 +47,6 @@ struct user_desc;
 
 #ifdef CONFIG_X86_32
 
-#define HOST_AUDIT_ARCH AUDIT_ARCH_I386
-
 extern int ptrace_get_thread_area(struct task_struct *child, int idx,
                                   struct user_desc __user *user_desc);
 
@@ -57,8 +55,6 @@ extern int ptrace_set_thread_area(struct task_struct *child, int idx,
 
 #else
 
-#define HOST_AUDIT_ARCH AUDIT_ARCH_X86_64
-
 #define PT_REGS_R8(r) UPT_R8(&(r)->regs)
 #define PT_REGS_R9(r) UPT_R9(&(r)->regs)
 #define PT_REGS_R10(r) UPT_R10(&(r)->regs)
diff --git a/arch/xtensa/kernel/ptrace.c b/arch/xtensa/kernel/ptrace.c
index 562fac6..4d54b48 100644
--- a/arch/xtensa/kernel/ptrace.c
+++ b/arch/xtensa/kernel/ptrace.c
@@ -342,7 +342,7 @@ void do_syscall_trace_enter(struct pt_regs *regs)
 		do_syscall_trace();
 
 #if 0
-	audit_syscall_entry(current, AUDIT_ARCH_XTENSA..);
+	audit_syscall_entry(...);
 #endif
 }
 
diff --git a/include/linux/audit.h b/include/linux/audit.h
index 4b2983e..62c9d98 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -26,6 +26,7 @@
 #include <linux/sched.h>
 #include <linux/ptrace.h>
 #include <uapi/linux/audit.h>
+#include <asm/syscall.h>
 
 struct audit_sig_info {
 	uid_t		uid;
@@ -135,12 +136,12 @@ static inline void audit_free(struct task_struct *task)
 	if (unlikely(task->audit_context))
 		__audit_free(task);
 }
-static inline void audit_syscall_entry(int arch, int major, unsigned long a0,
+static inline void audit_syscall_entry(int major, unsigned long a0,
 				       unsigned long a1, unsigned long a2,
 				       unsigned long a3)
 {
 	if (unlikely(current->audit_context))
-		__audit_syscall_entry(arch, major, a0, a1, a2, a3);
+		__audit_syscall_entry(syscall_get_arch(), major, a0, a1, a2, a3);
 }
 static inline void audit_syscall_exit(void *pt_regs)
 {
@@ -316,7 +317,7 @@ static inline int audit_alloc(struct task_struct *task)
 }
 static inline void audit_free(struct task_struct *task)
 { }
-static inline void audit_syscall_entry(int arch, int major, unsigned long a0,
+static inline void audit_syscall_entry(int major, unsigned long a0,
 				       unsigned long a1, unsigned long a2,
 				       unsigned long a3)
 { }
-- 
1.8.5.3

Re: [PATCH 3/4] ARCH: AUDIT: implement syscall_get_arch for all arches

[Matt Turner]

On Wed, Mar 19, 2014 at 3:04 PM, Eric Paris <eparis@redhat.com> wrote:
> For all arches which support audit implement syscall_get_arch()

support audit -- is that AUDIT_ARCH? If so, alpha gained support
recently, so I think this patch needs to handle alpha too?

Re: [PATCH 3/4] ARCH: AUDIT: implement syscall_get_arch for all arches

[Matt Turner]

On Wed, Mar 19, 2014 at 3:04 PM, Eric Paris <eparis@redhat.com> wrote:
> For all arches which support audit implement syscall_get_arch()

support audit -- is that AUDIT_ARCH? If so, alpha gained support
recently, so I think this patch needs to handle alpha too?

Re: [PATCH 3/4] ARCH: AUDIT: implement syscall_get_arch for all arches

[Matt Turner]

On Wed, Mar 19, 2014 at 3:04 PM, Eric Paris <eparis@redhat.com> wrote:
> For all arches which support audit implement syscall_get_arch()

support audit -- is that AUDIT_ARCH? If so, alpha gained support
recently, so I think this patch needs to handle alpha too?

Re: [PATCH 1/4] SH: define syscall_get_arch() for superh

[Sergei Shtylyov]

Hello.

On 03/20/2014 01:04 AM, Eric Paris wrote:

> This patch defines syscall_get_arch() for the superh platform.  It does
> so in both syscall_32.h and syscall_64.h.  I'm not certain if the
> implementation in syscall_64.h couldn't just be used in syscall.h as I
> can't really track the setting of CONFIG_64BIT...

> This way is safe, but we might be able to combine these if a superh
> person were able to review...

> Signed-off-by: Eric Paris <eparis@redhat.com>
> Cc: linux-sh@vger.kernel.org
> ---
>   arch/sh/include/asm/syscall_32.h | 10 ++++++++++
>   arch/sh/include/asm/syscall_64.h | 14 ++++++++++++++
>   2 files changed, 24 insertions(+)

> diff --git a/arch/sh/include/asm/syscall_32.h b/arch/sh/include/asm/syscall_32.h
> index 7d80df4..460e9c6 100644
> --- a/arch/sh/include/asm/syscall_32.h
> +++ b/arch/sh/include/asm/syscall_32.h
[...]
> @@ -93,4 +94,13 @@ static inline void syscall_set_arguments(struct task_struct *task,
>   	}
>   }
>
> +static inline int syscall_get_arch(void)
> +{
> +	int arch = EM_SH;
> +
> +#ifdef CONFIG_CPU_LITTLE_ENDIAN
> +		arch |= __AUDIT_ARCH_LE;

    Er, why the indentation jumped to the right suddenly?

> +#endif
> +	return arch;
> +}
>   #endif /* __ASM_SH_SYSCALL_32_H */

WBR, Sergei

Re: [PATCH 3/4] ARCH: AUDIT: implement syscall_get_arch for all arches

[Eric Paris]

On Wed, 2014-03-19 at 15:19 -0700, Matt Turner wrote:
> On Wed, Mar 19, 2014 at 3:04 PM, Eric Paris <eparis@redhat.com> wrote:
> > For all arches which support audit implement syscall_get_arch()
> 
> support audit -- is that AUDIT_ARCH? If so, alpha gained support
> recently, so I think this patch needs to handle alpha too?

Absolutely right.  I broke Alpha (in the next patch).  Will fix.

-Eric

Re: [PATCH 3/4] ARCH: AUDIT: implement syscall_get_arch for all arches

[Eric Paris]

On Wed, 2014-03-19 at 15:19 -0700, Matt Turner wrote:
> On Wed, Mar 19, 2014 at 3:04 PM, Eric Paris <eparis@redhat.com> wrote:
> > For all arches which support audit implement syscall_get_arch()
> 
> support audit -- is that AUDIT_ARCH? If so, alpha gained support
> recently, so I think this patch needs to handle alpha too?

Absolutely right.  I broke Alpha (in the next patch).  Will fix.

-Eric

Re: [PATCH 3/4] ARCH: AUDIT: implement syscall_get_arch for all arches

[Eric Paris]

On Wed, 2014-03-19 at 15:19 -0700, Matt Turner wrote:
> On Wed, Mar 19, 2014 at 3:04 PM, Eric Paris <eparis@redhat.com> wrote:
> > For all arches which support audit implement syscall_get_arch()
> 
> support audit -- is that AUDIT_ARCH? If so, alpha gained support
> recently, so I think this patch needs to handle alpha too?

Absolutely right.  I broke Alpha (in the next patch).  Will fix.

-Eric

Re: [PATCH 1/4] SH: define syscall_get_arch() for superh

[Eric Paris]

On Thu, 2014-03-20 at 03:01 +0300, Sergei Shtylyov wrote:
> Hello.
> 
> On 03/20/2014 01:04 AM, Eric Paris wrote:
> 
> > This patch defines syscall_get_arch() for the superh platform.  It does
> > so in both syscall_32.h and syscall_64.h.  I'm not certain if the
> > implementation in syscall_64.h couldn't just be used in syscall.h as I
> > can't really track the setting of CONFIG_64BIT...
> 
> > This way is safe, but we might be able to combine these if a superh
> > person were able to review...
> 
> > Signed-off-by: Eric Paris <eparis@redhat.com>
> > Cc: linux-sh@vger.kernel.org
> > ---
> >   arch/sh/include/asm/syscall_32.h | 10 ++++++++++
> >   arch/sh/include/asm/syscall_64.h | 14 ++++++++++++++
> >   2 files changed, 24 insertions(+)
> 
> > diff --git a/arch/sh/include/asm/syscall_32.h b/arch/sh/include/asm/syscall_32.h
> > index 7d80df4..460e9c6 100644
> > --- a/arch/sh/include/asm/syscall_32.h
> > +++ b/arch/sh/include/asm/syscall_32.h
> [...]
> > @@ -93,4 +94,13 @@ static inline void syscall_set_arguments(struct task_struct *task,
> >   	}
> >   }
> >
> > +static inline int syscall_get_arch(void)
> > +{
> > +	int arch = EM_SH;
> > +
> > +#ifdef CONFIG_CPU_LITTLE_ENDIAN
> > +		arch |= __AUDIT_ARCH_LE;
> 
>     Er, why the indentation jumped to the right suddenly?

Bad copy and pasting, will fix.  But I'd love to be able to just use the
64bit version in syscall.h and not need 2 copies...

-Eric

Re: [PATCH 1/4] SH: define syscall_get_arch() for superh

[Eric Paris]

On Thu, 2014-03-20 at 03:01 +0300, Sergei Shtylyov wrote:
> Hello.
> 
> On 03/20/2014 01:04 AM, Eric Paris wrote:
> 
> > This patch defines syscall_get_arch() for the superh platform.  It does
> > so in both syscall_32.h and syscall_64.h.  I'm not certain if the
> > implementation in syscall_64.h couldn't just be used in syscall.h as I
> > can't really track the setting of CONFIG_64BIT...
> 
> > This way is safe, but we might be able to combine these if a superh
> > person were able to review...
> 
> > Signed-off-by: Eric Paris <eparis@redhat.com>
> > Cc: linux-sh@vger.kernel.org
> > ---
> >   arch/sh/include/asm/syscall_32.h | 10 ++++++++++
> >   arch/sh/include/asm/syscall_64.h | 14 ++++++++++++++
> >   2 files changed, 24 insertions(+)
> 
> > diff --git a/arch/sh/include/asm/syscall_32.h b/arch/sh/include/asm/syscall_32.h
> > index 7d80df4..460e9c6 100644
> > --- a/arch/sh/include/asm/syscall_32.h
> > +++ b/arch/sh/include/asm/syscall_32.h
> [...]
> > @@ -93,4 +94,13 @@ static inline void syscall_set_arguments(struct task_struct *task,
> >   	}
> >   }
> >
> > +static inline int syscall_get_arch(void)
> > +{
> > +	int arch = EM_SH;
> > +
> > +#ifdef CONFIG_CPU_LITTLE_ENDIAN
> > +		arch |= __AUDIT_ARCH_LE;
> 
>     Er, why the indentation jumped to the right suddenly?

Bad copy and pasting, will fix.  But I'd love to be able to just use the
64bit version in syscall.h and not need 2 copies...

-Eric

Re: [PATCH 1/4] SH: define syscall_get_arch() for superh

[Sergei Shtylyov]

Hello.

On 03/20/2014 01:04 AM, Eric Paris wrote:

> This patch defines syscall_get_arch() for the superh platform.  It does
> so in both syscall_32.h and syscall_64.h.  I'm not certain if the
> implementation in syscall_64.h couldn't just be used in syscall.h as I
> can't really track the setting of CONFIG_64BIT...

> This way is safe, but we might be able to combine these if a superh
> person were able to review...

> Signed-off-by: Eric Paris <eparis@redhat.com>
> Cc: linux-sh@vger.kernel.org
> ---
>   arch/sh/include/asm/syscall_32.h | 10 ++++++++++
>   arch/sh/include/asm/syscall_64.h | 14 ++++++++++++++
>   2 files changed, 24 insertions(+)

> diff --git a/arch/sh/include/asm/syscall_32.h b/arch/sh/include/asm/syscall_32.h
> index 7d80df4..460e9c6 100644
> --- a/arch/sh/include/asm/syscall_32.h
> +++ b/arch/sh/include/asm/syscall_32.h
[...]
> @@ -93,4 +94,13 @@ static inline void syscall_set_arguments(struct task_struct *task,
>   	}
>   }
>
> +static inline int syscall_get_arch(void)
> +{
> +	int arch = EM_SH;
> +
> +#ifdef CONFIG_CPU_LITTLE_ENDIAN
> +		arch |= __AUDIT_ARCH_LE;

    Er, why the indentation jumped to the right suddenly?

> +#endif
> +	return arch;
> +}
>   #endif /* __ASM_SH_SYSCALL_32_H */

WBR, Sergei

Re: [PATCH 1/4] SH: define syscall_get_arch() for superh

[Richard Guy Briggs]

On 14/03/19, Eric Paris wrote:
> This patch defines syscall_get_arch() for the superh platform.  It does
> so in both syscall_32.h and syscall_64.h.  I'm not certain if the
> implementation in syscall_64.h couldn't just be used in syscall.h as I
> can't really track the setting of CONFIG_64BIT...
> 
> This way is safe, but we might be able to combine these if a superh
> person were able to review...
> 
> Signed-off-by: Eric Paris <eparis@redhat.com>
> Cc: linux-sh@vger.kernel.org

Acked-by: Richard Guy Briggs <rgb@redhat.com> (but prefer the syscall.h version)

> ---
>  arch/sh/include/asm/syscall_32.h | 10 ++++++++++
>  arch/sh/include/asm/syscall_64.h | 14 ++++++++++++++
>  2 files changed, 24 insertions(+)
> 
> diff --git a/arch/sh/include/asm/syscall_32.h b/arch/sh/include/asm/syscall_32.h
> index 7d80df4..460e9c6 100644
> --- a/arch/sh/include/asm/syscall_32.h
> +++ b/arch/sh/include/asm/syscall_32.h
> @@ -1,6 +1,7 @@
>  #ifndef __ASM_SH_SYSCALL_32_H
>  #define __ASM_SH_SYSCALL_32_H
>  
> +#include <uapi/linux/audit.h>
>  #include <linux/kernel.h>
>  #include <linux/sched.h>
>  #include <linux/err.h>
> @@ -93,4 +94,13 @@ static inline void syscall_set_arguments(struct task_struct *task,
>  	}
>  }
>  
> +static inline int syscall_get_arch(void)
> +{
> +	int arch = EM_SH;
> +
> +#ifdef CONFIG_CPU_LITTLE_ENDIAN
> +		arch |= __AUDIT_ARCH_LE;
> +#endif
> +	return arch;
> +}
>  #endif /* __ASM_SH_SYSCALL_32_H */
> diff --git a/arch/sh/include/asm/syscall_64.h b/arch/sh/include/asm/syscall_64.h
> index c3561ca..e03e77d 100644
> --- a/arch/sh/include/asm/syscall_64.h
> +++ b/arch/sh/include/asm/syscall_64.h
> @@ -1,6 +1,7 @@
>  #ifndef __ASM_SH_SYSCALL_64_H
>  #define __ASM_SH_SYSCALL_64_H
>  
> +#include <uapi/linux/audit.h>
>  #include <linux/kernel.h>
>  #include <linux/sched.h>
>  #include <asm/ptrace.h>
> @@ -61,4 +62,17 @@ static inline void syscall_set_arguments(struct task_struct *task,
>  	memcpy(&regs->regs[2 + i], args, n * sizeof(args[0]));
>  }
>  
> +static inline int syscall_get_arch(void)
> +{
> +	int arch = EM_SH;
> +
> +#ifdef CONFIG_64BIT
> +	arch |= __AUDIT_ARCH_64BIT;
> +#endif
> +#ifdef CONFIG_CPU_LITTLE_ENDIAN
> +	arch |= __AUDIT_ARCH_LE;
> +#endif
> +
> +	return arch;
> +}
>  #endif /* __ASM_SH_SYSCALL_64_H */
> -- 
> 1.8.5.3
> 
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit

- RGB

--
Richard Guy Briggs <rbriggs@redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545

Re: [PATCH 1/4] SH: define syscall_get_arch() for superh

[Richard Guy Briggs]

On 14/03/19, Eric Paris wrote:
> This patch defines syscall_get_arch() for the superh platform.  It does
> so in both syscall_32.h and syscall_64.h.  I'm not certain if the
> implementation in syscall_64.h couldn't just be used in syscall.h as I
> can't really track the setting of CONFIG_64BIT...
> 
> This way is safe, but we might be able to combine these if a superh
> person were able to review...
> 
> Signed-off-by: Eric Paris <eparis@redhat.com>
> Cc: linux-sh@vger.kernel.org

Acked-by: Richard Guy Briggs <rgb@redhat.com> (but prefer the syscall.h version)

> ---
>  arch/sh/include/asm/syscall_32.h | 10 ++++++++++
>  arch/sh/include/asm/syscall_64.h | 14 ++++++++++++++
>  2 files changed, 24 insertions(+)
> 
> diff --git a/arch/sh/include/asm/syscall_32.h b/arch/sh/include/asm/syscall_32.h
> index 7d80df4..460e9c6 100644
> --- a/arch/sh/include/asm/syscall_32.h
> +++ b/arch/sh/include/asm/syscall_32.h
> @@ -1,6 +1,7 @@
>  #ifndef __ASM_SH_SYSCALL_32_H
>  #define __ASM_SH_SYSCALL_32_H
>  
> +#include <uapi/linux/audit.h>
>  #include <linux/kernel.h>
>  #include <linux/sched.h>
>  #include <linux/err.h>
> @@ -93,4 +94,13 @@ static inline void syscall_set_arguments(struct task_struct *task,
>  	}
>  }
>  
> +static inline int syscall_get_arch(void)
> +{
> +	int arch = EM_SH;
> +
> +#ifdef CONFIG_CPU_LITTLE_ENDIAN
> +		arch |= __AUDIT_ARCH_LE;
> +#endif
> +	return arch;
> +}
>  #endif /* __ASM_SH_SYSCALL_32_H */
> diff --git a/arch/sh/include/asm/syscall_64.h b/arch/sh/include/asm/syscall_64.h
> index c3561ca..e03e77d 100644
> --- a/arch/sh/include/asm/syscall_64.h
> +++ b/arch/sh/include/asm/syscall_64.h
> @@ -1,6 +1,7 @@
>  #ifndef __ASM_SH_SYSCALL_64_H
>  #define __ASM_SH_SYSCALL_64_H
>  
> +#include <uapi/linux/audit.h>
>  #include <linux/kernel.h>
>  #include <linux/sched.h>
>  #include <asm/ptrace.h>
> @@ -61,4 +62,17 @@ static inline void syscall_set_arguments(struct task_struct *task,
>  	memcpy(&regs->regs[2 + i], args, n * sizeof(args[0]));
>  }
>  
> +static inline int syscall_get_arch(void)
> +{
> +	int arch = EM_SH;
> +
> +#ifdef CONFIG_64BIT
> +	arch |= __AUDIT_ARCH_64BIT;
> +#endif
> +#ifdef CONFIG_CPU_LITTLE_ENDIAN
> +	arch |= __AUDIT_ARCH_LE;
> +#endif
> +
> +	return arch;
> +}
>  #endif /* __ASM_SH_SYSCALL_64_H */
> -- 
> 1.8.5.3
> 
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit

- RGB

--
Richard Guy Briggs <rbriggs@redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545

Re: [PATCH 2/4] UM: implement syscall_get_arch()

[Richard Guy Briggs]

On 14/03/19, Eric Paris wrote:
> SH: define syscall_get_arch() for superh
> 
> This patch defines syscall_get_arch() for the um platform.  It adds a
> new syscall.h header file to define this.  It copies the HOST_AUDIT_ARCH
> definition from ptrace.h.  (that definition will be removed when we
> switch audit to use this new syscall_get_arch() function)

Why not just use:

diff --git a/arch/um/include/asm/syscall.h
b/arch/um/include/asm/syscall.h
new file mode 100644
index 0000000..fbcb2e4
--- /dev/null
+++ b/arch/um/include/asm/syscall.h
@@ -0,0 +1,9 @@
+#ifndef __ASM_UM_SYSCALL_H
+#define __ASM_UM_SYSCALL_H
+
+static inline int syscall_get_arch(void)
+{
+       return HOST_AUDIT_ARCH;
+}
+
+#endif /* __ASM_SH_SYSCALL_H */

> Signed-off-by: Eric Paris <eparis@redhat.com>
> Cc: user-mode-linux-devel@lists.sourceforge.net
> ---
>  arch/x86/um/asm/syscall.h | 15 +++++++++++++++
>  1 file changed, 15 insertions(+)
>  create mode 100644 arch/x86/um/asm/syscall.h
> 
> diff --git a/arch/x86/um/asm/syscall.h b/arch/x86/um/asm/syscall.h
> new file mode 100644
> index 0000000..9fe77b7
> --- /dev/null
> +++ b/arch/x86/um/asm/syscall.h
> @@ -0,0 +1,15 @@
> +#ifndef __UM_ASM_SYSCALL_H
> +#define __UM_ASM_SYSCALL_H
> +
> +#include <uapi/linux/audit.h>
> +
> +static inline int syscall_get_arch(void)
> +{
> +#ifdef CONFIG_X86_32
> +	return AUDIT_ARCH_I386;
> +#else
> +	return AUDIT_ARCH_X86_64;
> +#endif
> +}
> +
> +#endif /* __UM_ASM_SYSCALL_H */
> -- 
> 1.8.5.3
> 
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit

- RGB

--
Richard Guy Briggs <rbriggs@redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545

Re: [uml-devel] [PATCH 2/4] UM: implement syscall_get_arch()

[Richard Guy Briggs]

On 14/03/19, Eric Paris wrote:
> SH: define syscall_get_arch() for superh
> 
> This patch defines syscall_get_arch() for the um platform.  It adds a
> new syscall.h header file to define this.  It copies the HOST_AUDIT_ARCH
> definition from ptrace.h.  (that definition will be removed when we
> switch audit to use this new syscall_get_arch() function)

Why not just use:

diff --git a/arch/um/include/asm/syscall.h
b/arch/um/include/asm/syscall.h
new file mode 100644
index 0000000..fbcb2e4
--- /dev/null
+++ b/arch/um/include/asm/syscall.h
@@ -0,0 +1,9 @@
+#ifndef __ASM_UM_SYSCALL_H
+#define __ASM_UM_SYSCALL_H
+
+static inline int syscall_get_arch(void)
+{
+       return HOST_AUDIT_ARCH;
+}
+
+#endif /* __ASM_SH_SYSCALL_H */

> Signed-off-by: Eric Paris <eparis@redhat.com>
> Cc: user-mode-linux-devel@lists.sourceforge.net
> ---
>  arch/x86/um/asm/syscall.h | 15 +++++++++++++++
>  1 file changed, 15 insertions(+)
>  create mode 100644 arch/x86/um/asm/syscall.h
> 
> diff --git a/arch/x86/um/asm/syscall.h b/arch/x86/um/asm/syscall.h
> new file mode 100644
> index 0000000..9fe77b7
> --- /dev/null
> +++ b/arch/x86/um/asm/syscall.h
> @@ -0,0 +1,15 @@
> +#ifndef __UM_ASM_SYSCALL_H
> +#define __UM_ASM_SYSCALL_H
> +
> +#include <uapi/linux/audit.h>
> +
> +static inline int syscall_get_arch(void)
> +{
> +#ifdef CONFIG_X86_32
> +	return AUDIT_ARCH_I386;
> +#else
> +	return AUDIT_ARCH_X86_64;
> +#endif
> +}
> +
> +#endif /* __UM_ASM_SYSCALL_H */
> -- 
> 1.8.5.3
> 
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit

- RGB

--
Richard Guy Briggs <rbriggs@redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545

------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and their
applications. Written by three acclaimed leaders in the field,
this first edition is now available. Download your free book today!
http://p.sf.net/sfu/13534_NeoTech
_______________________________________________
User-mode-linux-devel mailing list
User-mode-linux-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel

Re: [PATCH 3/4] ARCH: AUDIT: implement syscall_get_arch for all arches

[Richard Guy Briggs]

On 14/03/19, Eric Paris wrote:
> For all arches which support audit implement syscall_get_arch()
> They are all pretty easy and straight forward, stolen from how the call
> to audit_syscall_entry() determines the arch.
> 
> Signed-off-by: Eric Paris <eparis@redhat.com>
> Cc: linux-ia64@vger.kernel.org
> Cc: microblaze-uclinux@itee.uq.edu.au
> Cc: linux-mips@linux-mips.org
> Cc: linux@lists.openrisc.net
> Cc: linux-parisc@vger.kernel.org
> Cc: linuxppc-dev@lists.ozlabs.org
> Cc: sparclinux@vger.kernel.org

Acked-by: Richard Guy Briggs <rgb@redhat.com>

> ---
>  arch/ia64/include/asm/syscall.h       |  6 ++++++
>  arch/microblaze/include/asm/syscall.h |  5 +++++
>  arch/mips/include/asm/syscall.h       |  2 +-
>  arch/openrisc/include/asm/syscall.h   |  5 +++++
>  arch/parisc/include/asm/syscall.h     | 11 +++++++++++
>  arch/powerpc/include/asm/syscall.h    | 12 ++++++++++++
>  arch/sparc/include/asm/syscall.h      |  8 ++++++++
>  include/uapi/linux/audit.h            |  1 +
>  8 files changed, 49 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/ia64/include/asm/syscall.h b/arch/ia64/include/asm/syscall.h
> index a7ff1c6..1d0b875 100644
> --- a/arch/ia64/include/asm/syscall.h
> +++ b/arch/ia64/include/asm/syscall.h
> @@ -13,6 +13,7 @@
>  #ifndef _ASM_SYSCALL_H
>  #define _ASM_SYSCALL_H	1
>  
> +#include <uapi/linux/audit.h>
>  #include <linux/sched.h>
>  #include <linux/err.h>
>  
> @@ -79,4 +80,9 @@ static inline void syscall_set_arguments(struct task_struct *task,
>  
>  	ia64_syscall_get_set_arguments(task, regs, i, n, args, 1);
>  }
> +
> +static inline int syscall_get_arch(void)
> +{
> +	return AUDIT_ARCH_IA64;
> +}
>  #endif	/* _ASM_SYSCALL_H */
> diff --git a/arch/microblaze/include/asm/syscall.h b/arch/microblaze/include/asm/syscall.h
> index 9bc4317..53cfaf3 100644
> --- a/arch/microblaze/include/asm/syscall.h
> +++ b/arch/microblaze/include/asm/syscall.h
> @@ -1,6 +1,7 @@
>  #ifndef __ASM_MICROBLAZE_SYSCALL_H
>  #define __ASM_MICROBLAZE_SYSCALL_H
>  
> +#include <uapi/linux/audit.h>
>  #include <linux/kernel.h>
>  #include <linux/sched.h>
>  #include <asm/ptrace.h>
> @@ -99,4 +100,8 @@ static inline void syscall_set_arguments(struct task_struct *task,
>  asmlinkage long do_syscall_trace_enter(struct pt_regs *regs);
>  asmlinkage void do_syscall_trace_leave(struct pt_regs *regs);
>  
> +static inline int syscall_get_arch(void)
> +{
> +	return AUDIT_ARCH_MICROBLAZE;
> +}
>  #endif /* __ASM_MICROBLAZE_SYSCALL_H */
> diff --git a/arch/mips/include/asm/syscall.h b/arch/mips/include/asm/syscall.h
> index fc556d8..992b6ab 100644
> --- a/arch/mips/include/asm/syscall.h
> +++ b/arch/mips/include/asm/syscall.h
> @@ -103,7 +103,7 @@ extern const unsigned long sysn32_call_table[];
>  
>  static inline int syscall_get_arch(void)
>  {
> -	int arch = EM_MIPS;
> +	int arch = AUDIT_ARCH_MIPS;
>  #ifdef CONFIG_64BIT
>  	arch |=  __AUDIT_ARCH_64BIT;
>  #endif
> diff --git a/arch/openrisc/include/asm/syscall.h b/arch/openrisc/include/asm/syscall.h
> index b752bb6..2db9f1c 100644
> --- a/arch/openrisc/include/asm/syscall.h
> +++ b/arch/openrisc/include/asm/syscall.h
> @@ -19,6 +19,7 @@
>  #ifndef __ASM_OPENRISC_SYSCALL_H__
>  #define __ASM_OPENRISC_SYSCALL_H__
>  
> +#include <uapi/linux/audit.h>
>  #include <linux/err.h>
>  #include <linux/sched.h>
>  
> @@ -71,4 +72,8 @@ syscall_set_arguments(struct task_struct *task, struct pt_regs *regs,
>  	memcpy(&regs->gpr[3 + i], args, n * sizeof(args[0]));
>  }
>  
> +static inline int syscall_get_arch(void)
> +{
> +	return AUDIT_ARCH_OPENRISC;
> +}
>  #endif
> diff --git a/arch/parisc/include/asm/syscall.h b/arch/parisc/include/asm/syscall.h
> index 8bdfd2c..a5eba95 100644
> --- a/arch/parisc/include/asm/syscall.h
> +++ b/arch/parisc/include/asm/syscall.h
> @@ -3,6 +3,8 @@
>  #ifndef _ASM_PARISC_SYSCALL_H_
>  #define _ASM_PARISC_SYSCALL_H_
>  
> +#include <uapi/linux/audit.h>
> +#include <linux/compat.h>
>  #include <linux/err.h>
>  #include <asm/ptrace.h>
>  
> @@ -37,4 +39,13 @@ static inline void syscall_get_arguments(struct task_struct *tsk,
>  	}
>  }
>  
> +static inline int syscall_get_arch(void)
> +{
> +	int arch = AUDIT_ARCH_PARISC;
> +#ifdef CONFIG_64BIT
> +	if (!is_compat_task())
> +		arch = AUDIT_ARCH_PARISC64;
> +#endif
> +	return arch;
> +}
>  #endif /*_ASM_PARISC_SYSCALL_H_*/
> diff --git a/arch/powerpc/include/asm/syscall.h b/arch/powerpc/include/asm/syscall.h
> index b54b2ad..4271544 100644
> --- a/arch/powerpc/include/asm/syscall.h
> +++ b/arch/powerpc/include/asm/syscall.h
> @@ -13,6 +13,8 @@
>  #ifndef _ASM_SYSCALL_H
>  #define _ASM_SYSCALL_H	1
>  
> +#include <uapi/linux/audit.h>
> +#include <linux/compat.h>
>  #include <linux/sched.h>
>  
>  /* ftrace syscalls requires exporting the sys_call_table */
> @@ -86,4 +88,14 @@ static inline void syscall_set_arguments(struct task_struct *task,
>  	memcpy(&regs->gpr[3 + i], args, n * sizeof(args[0]));
>  }
>  
> +static inline int syscall_get_arch(void)
> +{
> +	int arch = AUDIT_ARCH_PPC;
> +
> +#ifdef CONFIG_PPC64
> +	if (!is_32bit_task())
> +		arch = AUDIT_ARCH_PPC64;
> +#endif
> +	return arch;
> +}
>  #endif	/* _ASM_SYSCALL_H */
> diff --git a/arch/sparc/include/asm/syscall.h b/arch/sparc/include/asm/syscall.h
> index 025a02a..fed3d51 100644
> --- a/arch/sparc/include/asm/syscall.h
> +++ b/arch/sparc/include/asm/syscall.h
> @@ -1,9 +1,11 @@
>  #ifndef __ASM_SPARC_SYSCALL_H
>  #define __ASM_SPARC_SYSCALL_H
>  
> +#include <uapi/linux/audit.h>
>  #include <linux/kernel.h>
>  #include <linux/sched.h>
>  #include <asm/ptrace.h>
> +#include <asm/thread_info.h>
>  
>  /*
>   * The syscall table always contains 32 bit pointers since we know that the
> @@ -124,4 +126,10 @@ static inline void syscall_set_arguments(struct task_struct *task,
>  		regs->u_regs[UREG_I0 + i + j] = args[j];
>  }
>  
> +static inline int syscall_get_arch(void)
> +{
> +	return test_thread_flag(TIF_32BIT) ? AUDIT_ARCH_SPARC
> +					   : AUDIT_ARCH_SPARC64;
> +}
> +
>  #endif /* __ASM_SPARC_SYSCALL_H */
> diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
> index 9af01d7..8496cfa 100644
> --- a/include/uapi/linux/audit.h
> +++ b/include/uapi/linux/audit.h
> @@ -343,6 +343,7 @@ enum {
>  #define AUDIT_ARCH_IA64		(EM_IA_64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
>  #define AUDIT_ARCH_M32R		(EM_M32R)
>  #define AUDIT_ARCH_M68K		(EM_68K)
> +#define AUDIT_ARCH_MICROBLAZE	(EM_MICROBLAZE)
>  #define AUDIT_ARCH_MIPS		(EM_MIPS)
>  #define AUDIT_ARCH_MIPSEL	(EM_MIPS|__AUDIT_ARCH_LE)
>  #define AUDIT_ARCH_MIPS64	(EM_MIPS|__AUDIT_ARCH_64BIT)
> -- 
> 1.8.5.3
> 
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit

- RGB

--
Richard Guy Briggs <rbriggs@redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545

Re: [PATCH 3/4] ARCH: AUDIT: implement syscall_get_arch for all arches

[Richard Guy Briggs]

On 14/03/19, Eric Paris wrote:
> For all arches which support audit implement syscall_get_arch()
> They are all pretty easy and straight forward, stolen from how the call
> to audit_syscall_entry() determines the arch.
> 
> Signed-off-by: Eric Paris <eparis@redhat.com>
> Cc: linux-ia64@vger.kernel.org
> Cc: microblaze-uclinux@itee.uq.edu.au
> Cc: linux-mips@linux-mips.org
> Cc: linux@lists.openrisc.net
> Cc: linux-parisc@vger.kernel.org
> Cc: linuxppc-dev@lists.ozlabs.org
> Cc: sparclinux@vger.kernel.org

Acked-by: Richard Guy Briggs <rgb@redhat.com>

> ---
>  arch/ia64/include/asm/syscall.h       |  6 ++++++
>  arch/microblaze/include/asm/syscall.h |  5 +++++
>  arch/mips/include/asm/syscall.h       |  2 +-
>  arch/openrisc/include/asm/syscall.h   |  5 +++++
>  arch/parisc/include/asm/syscall.h     | 11 +++++++++++
>  arch/powerpc/include/asm/syscall.h    | 12 ++++++++++++
>  arch/sparc/include/asm/syscall.h      |  8 ++++++++
>  include/uapi/linux/audit.h            |  1 +
>  8 files changed, 49 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/ia64/include/asm/syscall.h b/arch/ia64/include/asm/syscall.h
> index a7ff1c6..1d0b875 100644
> --- a/arch/ia64/include/asm/syscall.h
> +++ b/arch/ia64/include/asm/syscall.h
> @@ -13,6 +13,7 @@
>  #ifndef _ASM_SYSCALL_H
>  #define _ASM_SYSCALL_H	1
>  
> +#include <uapi/linux/audit.h>
>  #include <linux/sched.h>
>  #include <linux/err.h>
>  
> @@ -79,4 +80,9 @@ static inline void syscall_set_arguments(struct task_struct *task,
>  
>  	ia64_syscall_get_set_arguments(task, regs, i, n, args, 1);
>  }
> +
> +static inline int syscall_get_arch(void)
> +{
> +	return AUDIT_ARCH_IA64;
> +}
>  #endif	/* _ASM_SYSCALL_H */
> diff --git a/arch/microblaze/include/asm/syscall.h b/arch/microblaze/include/asm/syscall.h
> index 9bc4317..53cfaf3 100644
> --- a/arch/microblaze/include/asm/syscall.h
> +++ b/arch/microblaze/include/asm/syscall.h
> @@ -1,6 +1,7 @@
>  #ifndef __ASM_MICROBLAZE_SYSCALL_H
>  #define __ASM_MICROBLAZE_SYSCALL_H
>  
> +#include <uapi/linux/audit.h>
>  #include <linux/kernel.h>
>  #include <linux/sched.h>
>  #include <asm/ptrace.h>
> @@ -99,4 +100,8 @@ static inline void syscall_set_arguments(struct task_struct *task,
>  asmlinkage long do_syscall_trace_enter(struct pt_regs *regs);
>  asmlinkage void do_syscall_trace_leave(struct pt_regs *regs);
>  
> +static inline int syscall_get_arch(void)
> +{
> +	return AUDIT_ARCH_MICROBLAZE;
> +}
>  #endif /* __ASM_MICROBLAZE_SYSCALL_H */
> diff --git a/arch/mips/include/asm/syscall.h b/arch/mips/include/asm/syscall.h
> index fc556d8..992b6ab 100644
> --- a/arch/mips/include/asm/syscall.h
> +++ b/arch/mips/include/asm/syscall.h
> @@ -103,7 +103,7 @@ extern const unsigned long sysn32_call_table[];
>  
>  static inline int syscall_get_arch(void)
>  {
> -	int arch = EM_MIPS;
> +	int arch = AUDIT_ARCH_MIPS;
>  #ifdef CONFIG_64BIT
>  	arch |=  __AUDIT_ARCH_64BIT;
>  #endif
> diff --git a/arch/openrisc/include/asm/syscall.h b/arch/openrisc/include/asm/syscall.h
> index b752bb6..2db9f1c 100644
> --- a/arch/openrisc/include/asm/syscall.h
> +++ b/arch/openrisc/include/asm/syscall.h
> @@ -19,6 +19,7 @@
>  #ifndef __ASM_OPENRISC_SYSCALL_H__
>  #define __ASM_OPENRISC_SYSCALL_H__
>  
> +#include <uapi/linux/audit.h>
>  #include <linux/err.h>
>  #include <linux/sched.h>
>  
> @@ -71,4 +72,8 @@ syscall_set_arguments(struct task_struct *task, struct pt_regs *regs,
>  	memcpy(&regs->gpr[3 + i], args, n * sizeof(args[0]));
>  }
>  
> +static inline int syscall_get_arch(void)
> +{
> +	return AUDIT_ARCH_OPENRISC;
> +}
>  #endif
> diff --git a/arch/parisc/include/asm/syscall.h b/arch/parisc/include/asm/syscall.h
> index 8bdfd2c..a5eba95 100644
> --- a/arch/parisc/include/asm/syscall.h
> +++ b/arch/parisc/include/asm/syscall.h
> @@ -3,6 +3,8 @@
>  #ifndef _ASM_PARISC_SYSCALL_H_
>  #define _ASM_PARISC_SYSCALL_H_
>  
> +#include <uapi/linux/audit.h>
> +#include <linux/compat.h>
>  #include <linux/err.h>
>  #include <asm/ptrace.h>
>  
> @@ -37,4 +39,13 @@ static inline void syscall_get_arguments(struct task_struct *tsk,
>  	}
>  }
>  
> +static inline int syscall_get_arch(void)
> +{
> +	int arch = AUDIT_ARCH_PARISC;
> +#ifdef CONFIG_64BIT
> +	if (!is_compat_task())
> +		arch = AUDIT_ARCH_PARISC64;
> +#endif
> +	return arch;
> +}
>  #endif /*_ASM_PARISC_SYSCALL_H_*/
> diff --git a/arch/powerpc/include/asm/syscall.h b/arch/powerpc/include/asm/syscall.h
> index b54b2ad..4271544 100644
> --- a/arch/powerpc/include/asm/syscall.h
> +++ b/arch/powerpc/include/asm/syscall.h
> @@ -13,6 +13,8 @@
>  #ifndef _ASM_SYSCALL_H
>  #define _ASM_SYSCALL_H	1
>  
> +#include <uapi/linux/audit.h>
> +#include <linux/compat.h>
>  #include <linux/sched.h>
>  
>  /* ftrace syscalls requires exporting the sys_call_table */
> @@ -86,4 +88,14 @@ static inline void syscall_set_arguments(struct task_struct *task,
>  	memcpy(&regs->gpr[3 + i], args, n * sizeof(args[0]));
>  }
>  
> +static inline int syscall_get_arch(void)
> +{
> +	int arch = AUDIT_ARCH_PPC;
> +
> +#ifdef CONFIG_PPC64
> +	if (!is_32bit_task())
> +		arch = AUDIT_ARCH_PPC64;
> +#endif
> +	return arch;
> +}
>  #endif	/* _ASM_SYSCALL_H */
> diff --git a/arch/sparc/include/asm/syscall.h b/arch/sparc/include/asm/syscall.h
> index 025a02a..fed3d51 100644
> --- a/arch/sparc/include/asm/syscall.h
> +++ b/arch/sparc/include/asm/syscall.h
> @@ -1,9 +1,11 @@
>  #ifndef __ASM_SPARC_SYSCALL_H
>  #define __ASM_SPARC_SYSCALL_H
>  
> +#include <uapi/linux/audit.h>
>  #include <linux/kernel.h>
>  #include <linux/sched.h>
>  #include <asm/ptrace.h>
> +#include <asm/thread_info.h>
>  
>  /*
>   * The syscall table always contains 32 bit pointers since we know that the
> @@ -124,4 +126,10 @@ static inline void syscall_set_arguments(struct task_struct *task,
>  		regs->u_regs[UREG_I0 + i + j] = args[j];
>  }
>  
> +static inline int syscall_get_arch(void)
> +{
> +	return test_thread_flag(TIF_32BIT) ? AUDIT_ARCH_SPARC
> +					   : AUDIT_ARCH_SPARC64;
> +}
> +
>  #endif /* __ASM_SPARC_SYSCALL_H */
> diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
> index 9af01d7..8496cfa 100644
> --- a/include/uapi/linux/audit.h
> +++ b/include/uapi/linux/audit.h
> @@ -343,6 +343,7 @@ enum {
>  #define AUDIT_ARCH_IA64		(EM_IA_64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
>  #define AUDIT_ARCH_M32R		(EM_M32R)
>  #define AUDIT_ARCH_M68K		(EM_68K)
> +#define AUDIT_ARCH_MICROBLAZE	(EM_MICROBLAZE)
>  #define AUDIT_ARCH_MIPS		(EM_MIPS)
>  #define AUDIT_ARCH_MIPSEL	(EM_MIPS|__AUDIT_ARCH_LE)
>  #define AUDIT_ARCH_MIPS64	(EM_MIPS|__AUDIT_ARCH_64BIT)
> -- 
> 1.8.5.3
> 
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit

- RGB

--
Richard Guy Briggs <rbriggs@redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545

Re: [PATCH 3/4] ARCH: AUDIT: implement syscall_get_arch for all arches

[Richard Guy Briggs]

On 14/03/19, Eric Paris wrote:
> For all arches which support audit implement syscall_get_arch()
> They are all pretty easy and straight forward, stolen from how the call
> to audit_syscall_entry() determines the arch.
> 
> Signed-off-by: Eric Paris <eparis@redhat.com>
> Cc: linux-ia64@vger.kernel.org
> Cc: microblaze-uclinux@itee.uq.edu.au
> Cc: linux-mips@linux-mips.org
> Cc: linux@lists.openrisc.net
> Cc: linux-parisc@vger.kernel.org
> Cc: linuxppc-dev@lists.ozlabs.org
> Cc: sparclinux@vger.kernel.org

Acked-by: Richard Guy Briggs <rgb@redhat.com>

> ---
>  arch/ia64/include/asm/syscall.h       |  6 ++++++
>  arch/microblaze/include/asm/syscall.h |  5 +++++
>  arch/mips/include/asm/syscall.h       |  2 +-
>  arch/openrisc/include/asm/syscall.h   |  5 +++++
>  arch/parisc/include/asm/syscall.h     | 11 +++++++++++
>  arch/powerpc/include/asm/syscall.h    | 12 ++++++++++++
>  arch/sparc/include/asm/syscall.h      |  8 ++++++++
>  include/uapi/linux/audit.h            |  1 +
>  8 files changed, 49 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/ia64/include/asm/syscall.h b/arch/ia64/include/asm/syscall.h
> index a7ff1c6..1d0b875 100644
> --- a/arch/ia64/include/asm/syscall.h
> +++ b/arch/ia64/include/asm/syscall.h
> @@ -13,6 +13,7 @@
>  #ifndef _ASM_SYSCALL_H
>  #define _ASM_SYSCALL_H	1
>  
> +#include <uapi/linux/audit.h>
>  #include <linux/sched.h>
>  #include <linux/err.h>
>  
> @@ -79,4 +80,9 @@ static inline void syscall_set_arguments(struct task_struct *task,
>  
>  	ia64_syscall_get_set_arguments(task, regs, i, n, args, 1);
>  }
> +
> +static inline int syscall_get_arch(void)
> +{
> +	return AUDIT_ARCH_IA64;
> +}
>  #endif	/* _ASM_SYSCALL_H */
> diff --git a/arch/microblaze/include/asm/syscall.h b/arch/microblaze/include/asm/syscall.h
> index 9bc4317..53cfaf3 100644
> --- a/arch/microblaze/include/asm/syscall.h
> +++ b/arch/microblaze/include/asm/syscall.h
> @@ -1,6 +1,7 @@
>  #ifndef __ASM_MICROBLAZE_SYSCALL_H
>  #define __ASM_MICROBLAZE_SYSCALL_H
>  
> +#include <uapi/linux/audit.h>
>  #include <linux/kernel.h>
>  #include <linux/sched.h>
>  #include <asm/ptrace.h>
> @@ -99,4 +100,8 @@ static inline void syscall_set_arguments(struct task_struct *task,
>  asmlinkage long do_syscall_trace_enter(struct pt_regs *regs);
>  asmlinkage void do_syscall_trace_leave(struct pt_regs *regs);
>  
> +static inline int syscall_get_arch(void)
> +{
> +	return AUDIT_ARCH_MICROBLAZE;
> +}
>  #endif /* __ASM_MICROBLAZE_SYSCALL_H */
> diff --git a/arch/mips/include/asm/syscall.h b/arch/mips/include/asm/syscall.h
> index fc556d8..992b6ab 100644
> --- a/arch/mips/include/asm/syscall.h
> +++ b/arch/mips/include/asm/syscall.h
> @@ -103,7 +103,7 @@ extern const unsigned long sysn32_call_table[];
>  
>  static inline int syscall_get_arch(void)
>  {
> -	int arch = EM_MIPS;
> +	int arch = AUDIT_ARCH_MIPS;
>  #ifdef CONFIG_64BIT
>  	arch |=  __AUDIT_ARCH_64BIT;
>  #endif
> diff --git a/arch/openrisc/include/asm/syscall.h b/arch/openrisc/include/asm/syscall.h
> index b752bb6..2db9f1c 100644
> --- a/arch/openrisc/include/asm/syscall.h
> +++ b/arch/openrisc/include/asm/syscall.h
> @@ -19,6 +19,7 @@
>  #ifndef __ASM_OPENRISC_SYSCALL_H__
>  #define __ASM_OPENRISC_SYSCALL_H__
>  
> +#include <uapi/linux/audit.h>
>  #include <linux/err.h>
>  #include <linux/sched.h>
>  
> @@ -71,4 +72,8 @@ syscall_set_arguments(struct task_struct *task, struct pt_regs *regs,
>  	memcpy(&regs->gpr[3 + i], args, n * sizeof(args[0]));
>  }
>  
> +static inline int syscall_get_arch(void)
> +{
> +	return AUDIT_ARCH_OPENRISC;
> +}
>  #endif
> diff --git a/arch/parisc/include/asm/syscall.h b/arch/parisc/include/asm/syscall.h
> index 8bdfd2c..a5eba95 100644
> --- a/arch/parisc/include/asm/syscall.h
> +++ b/arch/parisc/include/asm/syscall.h
> @@ -3,6 +3,8 @@
>  #ifndef _ASM_PARISC_SYSCALL_H_
>  #define _ASM_PARISC_SYSCALL_H_
>  
> +#include <uapi/linux/audit.h>
> +#include <linux/compat.h>
>  #include <linux/err.h>
>  #include <asm/ptrace.h>
>  
> @@ -37,4 +39,13 @@ static inline void syscall_get_arguments(struct task_struct *tsk,
>  	}
>  }
>  
> +static inline int syscall_get_arch(void)
> +{
> +	int arch = AUDIT_ARCH_PARISC;
> +#ifdef CONFIG_64BIT
> +	if (!is_compat_task())
> +		arch = AUDIT_ARCH_PARISC64;
> +#endif
> +	return arch;
> +}
>  #endif /*_ASM_PARISC_SYSCALL_H_*/
> diff --git a/arch/powerpc/include/asm/syscall.h b/arch/powerpc/include/asm/syscall.h
> index b54b2ad..4271544 100644
> --- a/arch/powerpc/include/asm/syscall.h
> +++ b/arch/powerpc/include/asm/syscall.h
> @@ -13,6 +13,8 @@
>  #ifndef _ASM_SYSCALL_H
>  #define _ASM_SYSCALL_H	1
>  
> +#include <uapi/linux/audit.h>
> +#include <linux/compat.h>
>  #include <linux/sched.h>
>  
>  /* ftrace syscalls requires exporting the sys_call_table */
> @@ -86,4 +88,14 @@ static inline void syscall_set_arguments(struct task_struct *task,
>  	memcpy(&regs->gpr[3 + i], args, n * sizeof(args[0]));
>  }
>  
> +static inline int syscall_get_arch(void)
> +{
> +	int arch = AUDIT_ARCH_PPC;
> +
> +#ifdef CONFIG_PPC64
> +	if (!is_32bit_task())
> +		arch = AUDIT_ARCH_PPC64;
> +#endif
> +	return arch;
> +}
>  #endif	/* _ASM_SYSCALL_H */
> diff --git a/arch/sparc/include/asm/syscall.h b/arch/sparc/include/asm/syscall.h
> index 025a02a..fed3d51 100644
> --- a/arch/sparc/include/asm/syscall.h
> +++ b/arch/sparc/include/asm/syscall.h
> @@ -1,9 +1,11 @@
>  #ifndef __ASM_SPARC_SYSCALL_H
>  #define __ASM_SPARC_SYSCALL_H
>  
> +#include <uapi/linux/audit.h>
>  #include <linux/kernel.h>
>  #include <linux/sched.h>
>  #include <asm/ptrace.h>
> +#include <asm/thread_info.h>
>  
>  /*
>   * The syscall table always contains 32 bit pointers since we know that the
> @@ -124,4 +126,10 @@ static inline void syscall_set_arguments(struct task_struct *task,
>  		regs->u_regs[UREG_I0 + i + j] = args[j];
>  }
>  
> +static inline int syscall_get_arch(void)
> +{
> +	return test_thread_flag(TIF_32BIT) ? AUDIT_ARCH_SPARC
> +					   : AUDIT_ARCH_SPARC64;
> +}
> +
>  #endif /* __ASM_SPARC_SYSCALL_H */
> diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
> index 9af01d7..8496cfa 100644
> --- a/include/uapi/linux/audit.h
> +++ b/include/uapi/linux/audit.h
> @@ -343,6 +343,7 @@ enum {
>  #define AUDIT_ARCH_IA64		(EM_IA_64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
>  #define AUDIT_ARCH_M32R		(EM_M32R)
>  #define AUDIT_ARCH_M68K		(EM_68K)
> +#define AUDIT_ARCH_MICROBLAZE	(EM_MICROBLAZE)
>  #define AUDIT_ARCH_MIPS		(EM_MIPS)
>  #define AUDIT_ARCH_MIPSEL	(EM_MIPS|__AUDIT_ARCH_LE)
>  #define AUDIT_ARCH_MIPS64	(EM_MIPS|__AUDIT_ARCH_64BIT)
> -- 
> 1.8.5.3
> 
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit

- RGB

--
Richard Guy Briggs <rbriggs@redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545

Re: [PATCH 4/4] ARCH: AUDIT: audit_syscall_entry() should not require the arch

[Richard Guy Briggs]

On 14/03/19, Eric Paris wrote:
> We have a function where the arch can be queried, syscall_get_arch().
> So rather than have every single piece of arch specific code use and/or
> duplicate syscall_get_arch(), just have the audit code use the
> syscall_get_arch() code.
> 
> Signed-off-by: Eric Paris <eparis@redhat.com>
> Cc: linux-alpha@vger.kernel.org
> Cc: linux-arm-kernel@lists.infradead.org
> Cc: linux-ia64@vger.kernel.org
> Cc: microblaze-uclinux@itee.uq.edu.au
> Cc: linux-mips@linux-mips.org
> Cc: linux@lists.openrisc.net
> Cc: linux-parisc@vger.kernel.org
> Cc: linuxppc-dev@lists.ozlabs.org
> Cc: linux-s390@vger.kernel.org
> Cc: linux-sh@vger.kernel.org
> Cc: sparclinux@vger.kernel.org
> Cc: user-mode-linux-devel@lists.sourceforge.net
> Cc: linux-xtensa@linux-xtensa.org
> Cc: x86@kernel.org

Acked-by: Richard Guy Briggs <rgb@redhat.com>

> ---
>  arch/alpha/kernel/ptrace.c      |  2 +-
>  arch/arm/kernel/ptrace.c        |  4 ++--
>  arch/ia64/kernel/ptrace.c       |  2 +-
>  arch/microblaze/kernel/ptrace.c |  3 +--
>  arch/mips/kernel/ptrace.c       |  4 +---
>  arch/openrisc/kernel/ptrace.c   |  3 +--
>  arch/parisc/kernel/ptrace.c     |  9 +++------
>  arch/powerpc/kernel/ptrace.c    |  7 ++-----
>  arch/s390/kernel/ptrace.c       |  4 +---
>  arch/sh/kernel/ptrace_32.c      | 14 +-------------
>  arch/sh/kernel/ptrace_64.c      | 17 +----------------
>  arch/sparc/kernel/ptrace_64.c   |  9 ++-------
>  arch/um/kernel/ptrace.c         |  3 +--
>  arch/x86/kernel/ptrace.c        |  8 ++------
>  arch/x86/um/asm/ptrace.h        |  4 ----
>  arch/xtensa/kernel/ptrace.c     |  2 +-
>  include/linux/audit.h           |  7 ++++---
>  17 files changed, 25 insertions(+), 77 deletions(-)
> 
> diff --git a/arch/alpha/kernel/ptrace.c b/arch/alpha/kernel/ptrace.c
> index 86d8351..d9ee817 100644
> --- a/arch/alpha/kernel/ptrace.c
> +++ b/arch/alpha/kernel/ptrace.c
> @@ -321,7 +321,7 @@ asmlinkage unsigned long syscall_trace_enter(void)
>  	if (test_thread_flag(TIF_SYSCALL_TRACE) &&
>  	    tracehook_report_syscall_entry(current_pt_regs()))
>  		ret = -1UL;
> -	audit_syscall_entry(AUDIT_ARCH_ALPHA, regs->r0, regs->r16, regs->r17, regs->r18, regs->r19);
> +	audit_syscall_entry(regs->r0, regs->r16, regs->r17, regs->r18, regs->r19);
>  	return ret ?: current_pt_regs()->r0;
>  }
>  
> diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
> index 0dd3b79..c9d2b34 100644
> --- a/arch/arm/kernel/ptrace.c
> +++ b/arch/arm/kernel/ptrace.c
> @@ -943,8 +943,8 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs, int scno)
>  	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
>  		trace_sys_enter(regs, scno);
>  
> -	audit_syscall_entry(AUDIT_ARCH_ARM, scno, regs->ARM_r0, regs->ARM_r1,
> -			    regs->ARM_r2, regs->ARM_r3);
> +	audit_syscall_entry(scno, regs->ARM_r0, regs->ARM_r1, regs->ARM_r2,
> +			    regs->ARM_r3);
>  
>  	return scno;
>  }
> diff --git a/arch/ia64/kernel/ptrace.c b/arch/ia64/kernel/ptrace.c
> index b7a5fff..6f54d51 100644
> --- a/arch/ia64/kernel/ptrace.c
> +++ b/arch/ia64/kernel/ptrace.c
> @@ -1219,7 +1219,7 @@ syscall_trace_enter (long arg0, long arg1, long arg2, long arg3,
>  		ia64_sync_krbs();
>  
>  
> -	audit_syscall_entry(AUDIT_ARCH_IA64, regs.r15, arg0, arg1, arg2, arg3);
> +	audit_syscall_entry(regs.r15, arg0, arg1, arg2, arg3);
>  
>  	return 0;
>  }
> diff --git a/arch/microblaze/kernel/ptrace.c b/arch/microblaze/kernel/ptrace.c
> index 39cf508..bb10637 100644
> --- a/arch/microblaze/kernel/ptrace.c
> +++ b/arch/microblaze/kernel/ptrace.c
> @@ -147,8 +147,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
>  		 */
>  		ret = -1L;
>  
> -	audit_syscall_entry(EM_MICROBLAZE, regs->r12, regs->r5, regs->r6,
> -			    regs->r7, regs->r8);
> +	audit_syscall_entry(regs->r12, regs->r5, regs->r6, regs->r7, regs->r8);
>  
>  	return ret ?: regs->r12;
>  }
> diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
> index 65ba622..c06bb82 100644
> --- a/arch/mips/kernel/ptrace.c
> +++ b/arch/mips/kernel/ptrace.c
> @@ -671,9 +671,7 @@ asmlinkage void syscall_trace_enter(struct pt_regs *regs)
>  	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
>  		trace_sys_enter(regs, regs->regs[2]);
>  
> -	audit_syscall_entry(syscall_get_arch(),
> -			    regs->regs[2],
> -			    regs->regs[4], regs->regs[5],
> +	audit_syscall_entry(regs->regs[2], regs->regs[4], regs->regs[5],
>  			    regs->regs[6], regs->regs[7]);
>  }
>  
> diff --git a/arch/openrisc/kernel/ptrace.c b/arch/openrisc/kernel/ptrace.c
> index 71a2a0c..4f59fa4 100644
> --- a/arch/openrisc/kernel/ptrace.c
> +++ b/arch/openrisc/kernel/ptrace.c
> @@ -187,8 +187,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
>  		 */
>  		ret = -1L;
>  
> -	audit_syscall_entry(AUDIT_ARCH_OPENRISC, regs->gpr[11],
> -			    regs->gpr[3], regs->gpr[4],
> +	audit_syscall_entry(regs->gpr[11], regs->gpr[3], regs->gpr[4],
>  			    regs->gpr[5], regs->gpr[6]);
>  
>  	return ret ? : regs->gpr[11];
> diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c
> index e842ee2..7481457 100644
> --- a/arch/parisc/kernel/ptrace.c
> +++ b/arch/parisc/kernel/ptrace.c
> @@ -276,14 +276,11 @@ long do_syscall_trace_enter(struct pt_regs *regs)
>  
>  #ifdef CONFIG_64BIT
>  	if (!is_compat_task())
> -		audit_syscall_entry(AUDIT_ARCH_PARISC64,
> -			regs->gr[20],
> -			regs->gr[26], regs->gr[25],
> -			regs->gr[24], regs->gr[23]);
> +		audit_syscall_entry(regs->gr[20], regs->gr[26], regs->gr[25],
> +				    regs->gr[24], regs->gr[23]);
>  	else
>  #endif
> -		audit_syscall_entry(AUDIT_ARCH_PARISC,
> -			regs->gr[20] & 0xffffffff,
> +		audit_syscall_entry(regs->gr[20] & 0xffffffff,
>  			regs->gr[26] & 0xffffffff,
>  			regs->gr[25] & 0xffffffff,
>  			regs->gr[24] & 0xffffffff,
> diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
> index 2e3d2bf..524a943 100644
> --- a/arch/powerpc/kernel/ptrace.c
> +++ b/arch/powerpc/kernel/ptrace.c
> @@ -1788,14 +1788,11 @@ long do_syscall_trace_enter(struct pt_regs *regs)
>  
>  #ifdef CONFIG_PPC64
>  	if (!is_32bit_task())
> -		audit_syscall_entry(AUDIT_ARCH_PPC64,
> -				    regs->gpr[0],
> -				    regs->gpr[3], regs->gpr[4],
> +		audit_syscall_entry(regs->gpr[0], regs->gpr[3], regs->gpr[4],
>  				    regs->gpr[5], regs->gpr[6]);
>  	else
>  #endif
> -		audit_syscall_entry(AUDIT_ARCH_PPC,
> -				    regs->gpr[0],
> +		audit_syscall_entry(regs->gpr[0],
>  				    regs->gpr[3] & 0xffffffff,
>  				    regs->gpr[4] & 0xffffffff,
>  				    regs->gpr[5] & 0xffffffff,
> diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
> index e65c91c..2e2e7bb5 100644
> --- a/arch/s390/kernel/ptrace.c
> +++ b/arch/s390/kernel/ptrace.c
> @@ -812,9 +812,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
>  	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
>  		trace_sys_enter(regs, regs->gprs[2]);
>  
> -	audit_syscall_entry(is_compat_task() ?
> -				AUDIT_ARCH_S390 : AUDIT_ARCH_S390X,
> -			    regs->gprs[2], regs->orig_gpr2,
> +	audit_syscall_entry(regs->gprs[2], regs->orig_gpr2,
>  			    regs->gprs[3], regs->gprs[4],
>  			    regs->gprs[5]);
>  out:
> diff --git a/arch/sh/kernel/ptrace_32.c b/arch/sh/kernel/ptrace_32.c
> index 668c816..c1a6b89 100644
> --- a/arch/sh/kernel/ptrace_32.c
> +++ b/arch/sh/kernel/ptrace_32.c
> @@ -484,17 +484,6 @@ long arch_ptrace(struct task_struct *child, long request,
>  	return ret;
>  }
>  
> -static inline int audit_arch(void)
> -{
> -	int arch = EM_SH;
> -
> -#ifdef CONFIG_CPU_LITTLE_ENDIAN
> -	arch |= __AUDIT_ARCH_LE;
> -#endif
> -
> -	return arch;
> -}
> -
>  asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
>  {
>  	long ret = 0;
> @@ -513,8 +502,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
>  	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
>  		trace_sys_enter(regs, regs->regs[0]);
>  
> -	audit_syscall_entry(audit_arch(), regs->regs[3],
> -			    regs->regs[4], regs->regs[5],
> +	audit_syscall_entry(regs->regs[3], regs->regs[4], regs->regs[5],
>  			    regs->regs[6], regs->regs[7]);
>  
>  	return ret ?: regs->regs[0];
> diff --git a/arch/sh/kernel/ptrace_64.c b/arch/sh/kernel/ptrace_64.c
> index af90339..5cea973 100644
> --- a/arch/sh/kernel/ptrace_64.c
> +++ b/arch/sh/kernel/ptrace_64.c
> @@ -504,20 +504,6 @@ asmlinkage int sh64_ptrace(long request, long pid,
>  	return sys_ptrace(request, pid, addr, data);
>  }
>  
> -static inline int audit_arch(void)
> -{
> -	int arch = EM_SH;
> -
> -#ifdef CONFIG_64BIT
> -	arch |= __AUDIT_ARCH_64BIT;
> -#endif
> -#ifdef CONFIG_CPU_LITTLE_ENDIAN
> -	arch |= __AUDIT_ARCH_LE;
> -#endif
> -
> -	return arch;
> -}
> -
>  asmlinkage long long do_syscall_trace_enter(struct pt_regs *regs)
>  {
>  	long long ret = 0;
> @@ -536,8 +522,7 @@ asmlinkage long long do_syscall_trace_enter(struct pt_regs *regs)
>  	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
>  		trace_sys_enter(regs, regs->regs[9]);
>  
> -	audit_syscall_entry(audit_arch(), regs->regs[1],
> -			    regs->regs[2], regs->regs[3],
> +	audit_syscall_entry(regs->regs[1], regs->regs[2], regs->regs[3],
>  			    regs->regs[4], regs->regs[5]);
>  
>  	return ret ?: regs->regs[9];
> diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c
> index c13c9f2..9ddc492 100644
> --- a/arch/sparc/kernel/ptrace_64.c
> +++ b/arch/sparc/kernel/ptrace_64.c
> @@ -1076,13 +1076,8 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
>  	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
>  		trace_sys_enter(regs, regs->u_regs[UREG_G1]);
>  
> -	audit_syscall_entry((test_thread_flag(TIF_32BIT) ?
> -			     AUDIT_ARCH_SPARC :
> -			     AUDIT_ARCH_SPARC64),
> -			    regs->u_regs[UREG_G1],
> -			    regs->u_regs[UREG_I0],
> -			    regs->u_regs[UREG_I1],
> -			    regs->u_regs[UREG_I2],
> +	audit_syscall_entry(regs->u_regs[UREG_G1], regs->u_regs[UREG_I0],
> +			    regs->u_regs[UREG_I1], regs->u_regs[UREG_I2],
>  			    regs->u_regs[UREG_I3]);
>  
>  	return ret;
> diff --git a/arch/um/kernel/ptrace.c b/arch/um/kernel/ptrace.c
> index 694d551..62435ef 100644
> --- a/arch/um/kernel/ptrace.c
> +++ b/arch/um/kernel/ptrace.c
> @@ -165,8 +165,7 @@ static void send_sigtrap(struct task_struct *tsk, struct uml_pt_regs *regs,
>   */
>  void syscall_trace_enter(struct pt_regs *regs)
>  {
> -	audit_syscall_entry(HOST_AUDIT_ARCH,
> -			    UPT_SYSCALL_NR(&regs->regs),
> +	audit_syscall_entry(UPT_SYSCALL_NR(&regs->regs),
>  			    UPT_SYSCALL_ARG1(&regs->regs),
>  			    UPT_SYSCALL_ARG2(&regs->regs),
>  			    UPT_SYSCALL_ARG3(&regs->regs),
> diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
> index 7461f50..46dfba6 100644
> --- a/arch/x86/kernel/ptrace.c
> +++ b/arch/x86/kernel/ptrace.c
> @@ -1488,15 +1488,11 @@ long syscall_trace_enter(struct pt_regs *regs)
>  		trace_sys_enter(regs, regs->orig_ax);
>  
>  	if (IS_IA32)
> -		audit_syscall_entry(AUDIT_ARCH_I386,
> -				    regs->orig_ax,
> -				    regs->bx, regs->cx,
> +		audit_syscall_entry(regs->orig_ax, regs->bx, regs->cx,
>  				    regs->dx, regs->si);
>  #ifdef CONFIG_X86_64
>  	else
> -		audit_syscall_entry(AUDIT_ARCH_X86_64,
> -				    regs->orig_ax,
> -				    regs->di, regs->si,
> +		audit_syscall_entry(regs->orig_ax, regs->di, regs->si,
>  				    regs->dx, regs->r10);
>  #endif
>  
> diff --git a/arch/x86/um/asm/ptrace.h b/arch/x86/um/asm/ptrace.h
> index 54f8102..e59eef2 100644
> --- a/arch/x86/um/asm/ptrace.h
> +++ b/arch/x86/um/asm/ptrace.h
> @@ -47,8 +47,6 @@ struct user_desc;
>  
>  #ifdef CONFIG_X86_32
>  
> -#define HOST_AUDIT_ARCH AUDIT_ARCH_I386
> -
>  extern int ptrace_get_thread_area(struct task_struct *child, int idx,
>                                    struct user_desc __user *user_desc);
>  
> @@ -57,8 +55,6 @@ extern int ptrace_set_thread_area(struct task_struct *child, int idx,
>  
>  #else
>  
> -#define HOST_AUDIT_ARCH AUDIT_ARCH_X86_64
> -
>  #define PT_REGS_R8(r) UPT_R8(&(r)->regs)
>  #define PT_REGS_R9(r) UPT_R9(&(r)->regs)
>  #define PT_REGS_R10(r) UPT_R10(&(r)->regs)
> diff --git a/arch/xtensa/kernel/ptrace.c b/arch/xtensa/kernel/ptrace.c
> index 562fac6..4d54b48 100644
> --- a/arch/xtensa/kernel/ptrace.c
> +++ b/arch/xtensa/kernel/ptrace.c
> @@ -342,7 +342,7 @@ void do_syscall_trace_enter(struct pt_regs *regs)
>  		do_syscall_trace();
>  
>  #if 0
> -	audit_syscall_entry(current, AUDIT_ARCH_XTENSA..);
> +	audit_syscall_entry(...);
>  #endif
>  }
>  
> diff --git a/include/linux/audit.h b/include/linux/audit.h
> index 4b2983e..62c9d98 100644
> --- a/include/linux/audit.h
> +++ b/include/linux/audit.h
> @@ -26,6 +26,7 @@
>  #include <linux/sched.h>
>  #include <linux/ptrace.h>
>  #include <uapi/linux/audit.h>
> +#include <asm/syscall.h>
>  
>  struct audit_sig_info {
>  	uid_t		uid;
> @@ -135,12 +136,12 @@ static inline void audit_free(struct task_struct *task)
>  	if (unlikely(task->audit_context))
>  		__audit_free(task);
>  }
> -static inline void audit_syscall_entry(int arch, int major, unsigned long a0,
> +static inline void audit_syscall_entry(int major, unsigned long a0,
>  				       unsigned long a1, unsigned long a2,
>  				       unsigned long a3)
>  {
>  	if (unlikely(current->audit_context))
> -		__audit_syscall_entry(arch, major, a0, a1, a2, a3);
> +		__audit_syscall_entry(syscall_get_arch(), major, a0, a1, a2, a3);
>  }
>  static inline void audit_syscall_exit(void *pt_regs)
>  {
> @@ -316,7 +317,7 @@ static inline int audit_alloc(struct task_struct *task)
>  }
>  static inline void audit_free(struct task_struct *task)
>  { }
> -static inline void audit_syscall_entry(int arch, int major, unsigned long a0,
> +static inline void audit_syscall_entry(int major, unsigned long a0,
>  				       unsigned long a1, unsigned long a2,
>  				       unsigned long a3)
>  { }
> -- 
> 1.8.5.3
> 
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit

- RGB

--
Richard Guy Briggs <rbriggs@redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545

Re: [PATCH 4/4] ARCH: AUDIT: audit_syscall_entry() should not require the arch

[Richard Guy Briggs]

On 14/03/19, Eric Paris wrote:
> We have a function where the arch can be queried, syscall_get_arch().
> So rather than have every single piece of arch specific code use and/or
> duplicate syscall_get_arch(), just have the audit code use the
> syscall_get_arch() code.
> 
> Signed-off-by: Eric Paris <eparis@redhat.com>
> Cc: linux-alpha@vger.kernel.org
> Cc: linux-arm-kernel@lists.infradead.org
> Cc: linux-ia64@vger.kernel.org
> Cc: microblaze-uclinux@itee.uq.edu.au
> Cc: linux-mips@linux-mips.org
> Cc: linux@lists.openrisc.net
> Cc: linux-parisc@vger.kernel.org
> Cc: linuxppc-dev@lists.ozlabs.org
> Cc: linux-s390@vger.kernel.org
> Cc: linux-sh@vger.kernel.org
> Cc: sparclinux@vger.kernel.org
> Cc: user-mode-linux-devel@lists.sourceforge.net
> Cc: linux-xtensa@linux-xtensa.org
> Cc: x86@kernel.org

Acked-by: Richard Guy Briggs <rgb@redhat.com>

> ---
>  arch/alpha/kernel/ptrace.c      |  2 +-
>  arch/arm/kernel/ptrace.c        |  4 ++--
>  arch/ia64/kernel/ptrace.c       |  2 +-
>  arch/microblaze/kernel/ptrace.c |  3 +--
>  arch/mips/kernel/ptrace.c       |  4 +---
>  arch/openrisc/kernel/ptrace.c   |  3 +--
>  arch/parisc/kernel/ptrace.c     |  9 +++------
>  arch/powerpc/kernel/ptrace.c    |  7 ++-----
>  arch/s390/kernel/ptrace.c       |  4 +---
>  arch/sh/kernel/ptrace_32.c      | 14 +-------------
>  arch/sh/kernel/ptrace_64.c      | 17 +----------------
>  arch/sparc/kernel/ptrace_64.c   |  9 ++-------
>  arch/um/kernel/ptrace.c         |  3 +--
>  arch/x86/kernel/ptrace.c        |  8 ++------
>  arch/x86/um/asm/ptrace.h        |  4 ----
>  arch/xtensa/kernel/ptrace.c     |  2 +-
>  include/linux/audit.h           |  7 ++++---
>  17 files changed, 25 insertions(+), 77 deletions(-)
> 
> diff --git a/arch/alpha/kernel/ptrace.c b/arch/alpha/kernel/ptrace.c
> index 86d8351..d9ee817 100644
> --- a/arch/alpha/kernel/ptrace.c
> +++ b/arch/alpha/kernel/ptrace.c
> @@ -321,7 +321,7 @@ asmlinkage unsigned long syscall_trace_enter(void)
>  	if (test_thread_flag(TIF_SYSCALL_TRACE) &&
>  	    tracehook_report_syscall_entry(current_pt_regs()))
>  		ret = -1UL;
> -	audit_syscall_entry(AUDIT_ARCH_ALPHA, regs->r0, regs->r16, regs->r17, regs->r18, regs->r19);
> +	audit_syscall_entry(regs->r0, regs->r16, regs->r17, regs->r18, regs->r19);
>  	return ret ?: current_pt_regs()->r0;
>  }
>  
> diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
> index 0dd3b79..c9d2b34 100644
> --- a/arch/arm/kernel/ptrace.c
> +++ b/arch/arm/kernel/ptrace.c
> @@ -943,8 +943,8 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs, int scno)
>  	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
>  		trace_sys_enter(regs, scno);
>  
> -	audit_syscall_entry(AUDIT_ARCH_ARM, scno, regs->ARM_r0, regs->ARM_r1,
> -			    regs->ARM_r2, regs->ARM_r3);
> +	audit_syscall_entry(scno, regs->ARM_r0, regs->ARM_r1, regs->ARM_r2,
> +			    regs->ARM_r3);
>  
>  	return scno;
>  }
> diff --git a/arch/ia64/kernel/ptrace.c b/arch/ia64/kernel/ptrace.c
> index b7a5fff..6f54d51 100644
> --- a/arch/ia64/kernel/ptrace.c
> +++ b/arch/ia64/kernel/ptrace.c
> @@ -1219,7 +1219,7 @@ syscall_trace_enter (long arg0, long arg1, long arg2, long arg3,
>  		ia64_sync_krbs();
>  
>  
> -	audit_syscall_entry(AUDIT_ARCH_IA64, regs.r15, arg0, arg1, arg2, arg3);
> +	audit_syscall_entry(regs.r15, arg0, arg1, arg2, arg3);
>  
>  	return 0;
>  }
> diff --git a/arch/microblaze/kernel/ptrace.c b/arch/microblaze/kernel/ptrace.c
> index 39cf508..bb10637 100644
> --- a/arch/microblaze/kernel/ptrace.c
> +++ b/arch/microblaze/kernel/ptrace.c
> @@ -147,8 +147,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
>  		 */
>  		ret = -1L;
>  
> -	audit_syscall_entry(EM_MICROBLAZE, regs->r12, regs->r5, regs->r6,
> -			    regs->r7, regs->r8);
> +	audit_syscall_entry(regs->r12, regs->r5, regs->r6, regs->r7, regs->r8);
>  
>  	return ret ?: regs->r12;
>  }
> diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
> index 65ba622..c06bb82 100644
> --- a/arch/mips/kernel/ptrace.c
> +++ b/arch/mips/kernel/ptrace.c
> @@ -671,9 +671,7 @@ asmlinkage void syscall_trace_enter(struct pt_regs *regs)
>  	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
>  		trace_sys_enter(regs, regs->regs[2]);
>  
> -	audit_syscall_entry(syscall_get_arch(),
> -			    regs->regs[2],
> -			    regs->regs[4], regs->regs[5],
> +	audit_syscall_entry(regs->regs[2], regs->regs[4], regs->regs[5],
>  			    regs->regs[6], regs->regs[7]);
>  }
>  
> diff --git a/arch/openrisc/kernel/ptrace.c b/arch/openrisc/kernel/ptrace.c
> index 71a2a0c..4f59fa4 100644
> --- a/arch/openrisc/kernel/ptrace.c
> +++ b/arch/openrisc/kernel/ptrace.c
> @@ -187,8 +187,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
>  		 */
>  		ret = -1L;
>  
> -	audit_syscall_entry(AUDIT_ARCH_OPENRISC, regs->gpr[11],
> -			    regs->gpr[3], regs->gpr[4],
> +	audit_syscall_entry(regs->gpr[11], regs->gpr[3], regs->gpr[4],
>  			    regs->gpr[5], regs->gpr[6]);
>  
>  	return ret ? : regs->gpr[11];
> diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c
> index e842ee2..7481457 100644
> --- a/arch/parisc/kernel/ptrace.c
> +++ b/arch/parisc/kernel/ptrace.c
> @@ -276,14 +276,11 @@ long do_syscall_trace_enter(struct pt_regs *regs)
>  
>  #ifdef CONFIG_64BIT
>  	if (!is_compat_task())
> -		audit_syscall_entry(AUDIT_ARCH_PARISC64,
> -			regs->gr[20],
> -			regs->gr[26], regs->gr[25],
> -			regs->gr[24], regs->gr[23]);
> +		audit_syscall_entry(regs->gr[20], regs->gr[26], regs->gr[25],
> +				    regs->gr[24], regs->gr[23]);
>  	else
>  #endif
> -		audit_syscall_entry(AUDIT_ARCH_PARISC,
> -			regs->gr[20] & 0xffffffff,
> +		audit_syscall_entry(regs->gr[20] & 0xffffffff,
>  			regs->gr[26] & 0xffffffff,
>  			regs->gr[25] & 0xffffffff,
>  			regs->gr[24] & 0xffffffff,
> diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
> index 2e3d2bf..524a943 100644
> --- a/arch/powerpc/kernel/ptrace.c
> +++ b/arch/powerpc/kernel/ptrace.c
> @@ -1788,14 +1788,11 @@ long do_syscall_trace_enter(struct pt_regs *regs)
>  
>  #ifdef CONFIG_PPC64
>  	if (!is_32bit_task())
> -		audit_syscall_entry(AUDIT_ARCH_PPC64,
> -				    regs->gpr[0],
> -				    regs->gpr[3], regs->gpr[4],
> +		audit_syscall_entry(regs->gpr[0], regs->gpr[3], regs->gpr[4],
>  				    regs->gpr[5], regs->gpr[6]);
>  	else
>  #endif
> -		audit_syscall_entry(AUDIT_ARCH_PPC,
> -				    regs->gpr[0],
> +		audit_syscall_entry(regs->gpr[0],
>  				    regs->gpr[3] & 0xffffffff,
>  				    regs->gpr[4] & 0xffffffff,
>  				    regs->gpr[5] & 0xffffffff,
> diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
> index e65c91c..2e2e7bb5 100644
> --- a/arch/s390/kernel/ptrace.c
> +++ b/arch/s390/kernel/ptrace.c
> @@ -812,9 +812,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
>  	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
>  		trace_sys_enter(regs, regs->gprs[2]);
>  
> -	audit_syscall_entry(is_compat_task() ?
> -				AUDIT_ARCH_S390 : AUDIT_ARCH_S390X,
> -			    regs->gprs[2], regs->orig_gpr2,
> +	audit_syscall_entry(regs->gprs[2], regs->orig_gpr2,
>  			    regs->gprs[3], regs->gprs[4],
>  			    regs->gprs[5]);
>  out:
> diff --git a/arch/sh/kernel/ptrace_32.c b/arch/sh/kernel/ptrace_32.c
> index 668c816..c1a6b89 100644
> --- a/arch/sh/kernel/ptrace_32.c
> +++ b/arch/sh/kernel/ptrace_32.c
> @@ -484,17 +484,6 @@ long arch_ptrace(struct task_struct *child, long request,
>  	return ret;
>  }
>  
> -static inline int audit_arch(void)
> -{
> -	int arch = EM_SH;
> -
> -#ifdef CONFIG_CPU_LITTLE_ENDIAN
> -	arch |= __AUDIT_ARCH_LE;
> -#endif
> -
> -	return arch;
> -}
> -
>  asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
>  {
>  	long ret = 0;
> @@ -513,8 +502,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
>  	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
>  		trace_sys_enter(regs, regs->regs[0]);
>  
> -	audit_syscall_entry(audit_arch(), regs->regs[3],
> -			    regs->regs[4], regs->regs[5],
> +	audit_syscall_entry(regs->regs[3], regs->regs[4], regs->regs[5],
>  			    regs->regs[6], regs->regs[7]);
>  
>  	return ret ?: regs->regs[0];
> diff --git a/arch/sh/kernel/ptrace_64.c b/arch/sh/kernel/ptrace_64.c
> index af90339..5cea973 100644
> --- a/arch/sh/kernel/ptrace_64.c
> +++ b/arch/sh/kernel/ptrace_64.c
> @@ -504,20 +504,6 @@ asmlinkage int sh64_ptrace(long request, long pid,
>  	return sys_ptrace(request, pid, addr, data);
>  }
>  
> -static inline int audit_arch(void)
> -{
> -	int arch = EM_SH;
> -
> -#ifdef CONFIG_64BIT
> -	arch |= __AUDIT_ARCH_64BIT;
> -#endif
> -#ifdef CONFIG_CPU_LITTLE_ENDIAN
> -	arch |= __AUDIT_ARCH_LE;
> -#endif
> -
> -	return arch;
> -}
> -
>  asmlinkage long long do_syscall_trace_enter(struct pt_regs *regs)
>  {
>  	long long ret = 0;
> @@ -536,8 +522,7 @@ asmlinkage long long do_syscall_trace_enter(struct pt_regs *regs)
>  	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
>  		trace_sys_enter(regs, regs->regs[9]);
>  
> -	audit_syscall_entry(audit_arch(), regs->regs[1],
> -			    regs->regs[2], regs->regs[3],
> +	audit_syscall_entry(regs->regs[1], regs->regs[2], regs->regs[3],
>  			    regs->regs[4], regs->regs[5]);
>  
>  	return ret ?: regs->regs[9];
> diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c
> index c13c9f2..9ddc492 100644
> --- a/arch/sparc/kernel/ptrace_64.c
> +++ b/arch/sparc/kernel/ptrace_64.c
> @@ -1076,13 +1076,8 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
>  	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
>  		trace_sys_enter(regs, regs->u_regs[UREG_G1]);
>  
> -	audit_syscall_entry((test_thread_flag(TIF_32BIT) ?
> -			     AUDIT_ARCH_SPARC :
> -			     AUDIT_ARCH_SPARC64),
> -			    regs->u_regs[UREG_G1],
> -			    regs->u_regs[UREG_I0],
> -			    regs->u_regs[UREG_I1],
> -			    regs->u_regs[UREG_I2],
> +	audit_syscall_entry(regs->u_regs[UREG_G1], regs->u_regs[UREG_I0],
> +			    regs->u_regs[UREG_I1], regs->u_regs[UREG_I2],
>  			    regs->u_regs[UREG_I3]);
>  
>  	return ret;
> diff --git a/arch/um/kernel/ptrace.c b/arch/um/kernel/ptrace.c
> index 694d551..62435ef 100644
> --- a/arch/um/kernel/ptrace.c
> +++ b/arch/um/kernel/ptrace.c
> @@ -165,8 +165,7 @@ static void send_sigtrap(struct task_struct *tsk, struct uml_pt_regs *regs,
>   */
>  void syscall_trace_enter(struct pt_regs *regs)
>  {
> -	audit_syscall_entry(HOST_AUDIT_ARCH,
> -			    UPT_SYSCALL_NR(&regs->regs),
> +	audit_syscall_entry(UPT_SYSCALL_NR(&regs->regs),
>  			    UPT_SYSCALL_ARG1(&regs->regs),
>  			    UPT_SYSCALL_ARG2(&regs->regs),
>  			    UPT_SYSCALL_ARG3(&regs->regs),
> diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
> index 7461f50..46dfba6 100644
> --- a/arch/x86/kernel/ptrace.c
> +++ b/arch/x86/kernel/ptrace.c
> @@ -1488,15 +1488,11 @@ long syscall_trace_enter(struct pt_regs *regs)
>  		trace_sys_enter(regs, regs->orig_ax);
>  
>  	if (IS_IA32)
> -		audit_syscall_entry(AUDIT_ARCH_I386,
> -				    regs->orig_ax,
> -				    regs->bx, regs->cx,
> +		audit_syscall_entry(regs->orig_ax, regs->bx, regs->cx,
>  				    regs->dx, regs->si);
>  #ifdef CONFIG_X86_64
>  	else
> -		audit_syscall_entry(AUDIT_ARCH_X86_64,
> -				    regs->orig_ax,
> -				    regs->di, regs->si,
> +		audit_syscall_entry(regs->orig_ax, regs->di, regs->si,
>  				    regs->dx, regs->r10);
>  #endif
>  
> diff --git a/arch/x86/um/asm/ptrace.h b/arch/x86/um/asm/ptrace.h
> index 54f8102..e59eef2 100644
> --- a/arch/x86/um/asm/ptrace.h
> +++ b/arch/x86/um/asm/ptrace.h
> @@ -47,8 +47,6 @@ struct user_desc;
>  
>  #ifdef CONFIG_X86_32
>  
> -#define HOST_AUDIT_ARCH AUDIT_ARCH_I386
> -
>  extern int ptrace_get_thread_area(struct task_struct *child, int idx,
>                                    struct user_desc __user *user_desc);
>  
> @@ -57,8 +55,6 @@ extern int ptrace_set_thread_area(struct task_struct *child, int idx,
>  
>  #else
>  
> -#define HOST_AUDIT_ARCH AUDIT_ARCH_X86_64
> -
>  #define PT_REGS_R8(r) UPT_R8(&(r)->regs)
>  #define PT_REGS_R9(r) UPT_R9(&(r)->regs)
>  #define PT_REGS_R10(r) UPT_R10(&(r)->regs)
> diff --git a/arch/xtensa/kernel/ptrace.c b/arch/xtensa/kernel/ptrace.c
> index 562fac6..4d54b48 100644
> --- a/arch/xtensa/kernel/ptrace.c
> +++ b/arch/xtensa/kernel/ptrace.c
> @@ -342,7 +342,7 @@ void do_syscall_trace_enter(struct pt_regs *regs)
>  		do_syscall_trace();
>  
>  #if 0
> -	audit_syscall_entry(current, AUDIT_ARCH_XTENSA..);
> +	audit_syscall_entry(...);
>  #endif
>  }
>  
> diff --git a/include/linux/audit.h b/include/linux/audit.h
> index 4b2983e..62c9d98 100644
> --- a/include/linux/audit.h
> +++ b/include/linux/audit.h
> @@ -26,6 +26,7 @@
>  #include <linux/sched.h>
>  #include <linux/ptrace.h>
>  #include <uapi/linux/audit.h>
> +#include <asm/syscall.h>
>  
>  struct audit_sig_info {
>  	uid_t		uid;
> @@ -135,12 +136,12 @@ static inline void audit_free(struct task_struct *task)
>  	if (unlikely(task->audit_context))
>  		__audit_free(task);
>  }
> -static inline void audit_syscall_entry(int arch, int major, unsigned long a0,
> +static inline void audit_syscall_entry(int major, unsigned long a0,
>  				       unsigned long a1, unsigned long a2,
>  				       unsigned long a3)
>  {
>  	if (unlikely(current->audit_context))
> -		__audit_syscall_entry(arch, major, a0, a1, a2, a3);
> +		__audit_syscall_entry(syscall_get_arch(), major, a0, a1, a2, a3);
>  }
>  static inline void audit_syscall_exit(void *pt_regs)
>  {
> @@ -316,7 +317,7 @@ static inline int audit_alloc(struct task_struct *task)
>  }
>  static inline void audit_free(struct task_struct *task)
>  { }
> -static inline void audit_syscall_entry(int arch, int major, unsigned long a0,
> +static inline void audit_syscall_entry(int major, unsigned long a0,
>  				       unsigned long a1, unsigned long a2,
>  				       unsigned long a3)
>  { }
> -- 
> 1.8.5.3
> 
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit

- RGB

--
Richard Guy Briggs <rbriggs@redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545

Re: [PATCH 4/4] ARCH: AUDIT: audit_syscall_entry() should not require the arch

[Richard Guy Briggs]

On 14/03/19, Eric Paris wrote:
> We have a function where the arch can be queried, syscall_get_arch().
> So rather than have every single piece of arch specific code use and/or
> duplicate syscall_get_arch(), just have the audit code use the
> syscall_get_arch() code.
> 
> Signed-off-by: Eric Paris <eparis@redhat.com>
> Cc: linux-alpha@vger.kernel.org
> Cc: linux-arm-kernel@lists.infradead.org
> Cc: linux-ia64@vger.kernel.org
> Cc: microblaze-uclinux@itee.uq.edu.au
> Cc: linux-mips@linux-mips.org
> Cc: linux@lists.openrisc.net
> Cc: linux-parisc@vger.kernel.org
> Cc: linuxppc-dev@lists.ozlabs.org
> Cc: linux-s390@vger.kernel.org
> Cc: linux-sh@vger.kernel.org
> Cc: sparclinux@vger.kernel.org
> Cc: user-mode-linux-devel@lists.sourceforge.net
> Cc: linux-xtensa@linux-xtensa.org
> Cc: x86@kernel.org

Acked-by: Richard Guy Briggs <rgb@redhat.com>

> ---
>  arch/alpha/kernel/ptrace.c      |  2 +-
>  arch/arm/kernel/ptrace.c        |  4 ++--
>  arch/ia64/kernel/ptrace.c       |  2 +-
>  arch/microblaze/kernel/ptrace.c |  3 +--
>  arch/mips/kernel/ptrace.c       |  4 +---
>  arch/openrisc/kernel/ptrace.c   |  3 +--
>  arch/parisc/kernel/ptrace.c     |  9 +++------
>  arch/powerpc/kernel/ptrace.c    |  7 ++-----
>  arch/s390/kernel/ptrace.c       |  4 +---
>  arch/sh/kernel/ptrace_32.c      | 14 +-------------
>  arch/sh/kernel/ptrace_64.c      | 17 +----------------
>  arch/sparc/kernel/ptrace_64.c   |  9 ++-------
>  arch/um/kernel/ptrace.c         |  3 +--
>  arch/x86/kernel/ptrace.c        |  8 ++------
>  arch/x86/um/asm/ptrace.h        |  4 ----
>  arch/xtensa/kernel/ptrace.c     |  2 +-
>  include/linux/audit.h           |  7 ++++---
>  17 files changed, 25 insertions(+), 77 deletions(-)
> 
> diff --git a/arch/alpha/kernel/ptrace.c b/arch/alpha/kernel/ptrace.c
> index 86d8351..d9ee817 100644
> --- a/arch/alpha/kernel/ptrace.c
> +++ b/arch/alpha/kernel/ptrace.c
> @@ -321,7 +321,7 @@ asmlinkage unsigned long syscall_trace_enter(void)
>  	if (test_thread_flag(TIF_SYSCALL_TRACE) &&
>  	    tracehook_report_syscall_entry(current_pt_regs()))
>  		ret = -1UL;
> -	audit_syscall_entry(AUDIT_ARCH_ALPHA, regs->r0, regs->r16, regs->r17, regs->r18, regs->r19);
> +	audit_syscall_entry(regs->r0, regs->r16, regs->r17, regs->r18, regs->r19);
>  	return ret ?: current_pt_regs()->r0;
>  }
>  
> diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
> index 0dd3b79..c9d2b34 100644
> --- a/arch/arm/kernel/ptrace.c
> +++ b/arch/arm/kernel/ptrace.c
> @@ -943,8 +943,8 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs, int scno)
>  	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
>  		trace_sys_enter(regs, scno);
>  
> -	audit_syscall_entry(AUDIT_ARCH_ARM, scno, regs->ARM_r0, regs->ARM_r1,
> -			    regs->ARM_r2, regs->ARM_r3);
> +	audit_syscall_entry(scno, regs->ARM_r0, regs->ARM_r1, regs->ARM_r2,
> +			    regs->ARM_r3);
>  
>  	return scno;
>  }
> diff --git a/arch/ia64/kernel/ptrace.c b/arch/ia64/kernel/ptrace.c
> index b7a5fff..6f54d51 100644
> --- a/arch/ia64/kernel/ptrace.c
> +++ b/arch/ia64/kernel/ptrace.c
> @@ -1219,7 +1219,7 @@ syscall_trace_enter (long arg0, long arg1, long arg2, long arg3,
>  		ia64_sync_krbs();
>  
>  
> -	audit_syscall_entry(AUDIT_ARCH_IA64, regs.r15, arg0, arg1, arg2, arg3);
> +	audit_syscall_entry(regs.r15, arg0, arg1, arg2, arg3);
>  
>  	return 0;
>  }
> diff --git a/arch/microblaze/kernel/ptrace.c b/arch/microblaze/kernel/ptrace.c
> index 39cf508..bb10637 100644
> --- a/arch/microblaze/kernel/ptrace.c
> +++ b/arch/microblaze/kernel/ptrace.c
> @@ -147,8 +147,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
>  		 */
>  		ret = -1L;
>  
> -	audit_syscall_entry(EM_MICROBLAZE, regs->r12, regs->r5, regs->r6,
> -			    regs->r7, regs->r8);
> +	audit_syscall_entry(regs->r12, regs->r5, regs->r6, regs->r7, regs->r8);
>  
>  	return ret ?: regs->r12;
>  }
> diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
> index 65ba622..c06bb82 100644
> --- a/arch/mips/kernel/ptrace.c
> +++ b/arch/mips/kernel/ptrace.c
> @@ -671,9 +671,7 @@ asmlinkage void syscall_trace_enter(struct pt_regs *regs)
>  	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
>  		trace_sys_enter(regs, regs->regs[2]);
>  
> -	audit_syscall_entry(syscall_get_arch(),
> -			    regs->regs[2],
> -			    regs->regs[4], regs->regs[5],
> +	audit_syscall_entry(regs->regs[2], regs->regs[4], regs->regs[5],
>  			    regs->regs[6], regs->regs[7]);
>  }
>  
> diff --git a/arch/openrisc/kernel/ptrace.c b/arch/openrisc/kernel/ptrace.c
> index 71a2a0c..4f59fa4 100644
> --- a/arch/openrisc/kernel/ptrace.c
> +++ b/arch/openrisc/kernel/ptrace.c
> @@ -187,8 +187,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
>  		 */
>  		ret = -1L;
>  
> -	audit_syscall_entry(AUDIT_ARCH_OPENRISC, regs->gpr[11],
> -			    regs->gpr[3], regs->gpr[4],
> +	audit_syscall_entry(regs->gpr[11], regs->gpr[3], regs->gpr[4],
>  			    regs->gpr[5], regs->gpr[6]);
>  
>  	return ret ? : regs->gpr[11];
> diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c
> index e842ee2..7481457 100644
> --- a/arch/parisc/kernel/ptrace.c
> +++ b/arch/parisc/kernel/ptrace.c
> @@ -276,14 +276,11 @@ long do_syscall_trace_enter(struct pt_regs *regs)
>  
>  #ifdef CONFIG_64BIT
>  	if (!is_compat_task())
> -		audit_syscall_entry(AUDIT_ARCH_PARISC64,
> -			regs->gr[20],
> -			regs->gr[26], regs->gr[25],
> -			regs->gr[24], regs->gr[23]);
> +		audit_syscall_entry(regs->gr[20], regs->gr[26], regs->gr[25],
> +				    regs->gr[24], regs->gr[23]);
>  	else
>  #endif
> -		audit_syscall_entry(AUDIT_ARCH_PARISC,
> -			regs->gr[20] & 0xffffffff,
> +		audit_syscall_entry(regs->gr[20] & 0xffffffff,
>  			regs->gr[26] & 0xffffffff,
>  			regs->gr[25] & 0xffffffff,
>  			regs->gr[24] & 0xffffffff,
> diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
> index 2e3d2bf..524a943 100644
> --- a/arch/powerpc/kernel/ptrace.c
> +++ b/arch/powerpc/kernel/ptrace.c
> @@ -1788,14 +1788,11 @@ long do_syscall_trace_enter(struct pt_regs *regs)
>  
>  #ifdef CONFIG_PPC64
>  	if (!is_32bit_task())
> -		audit_syscall_entry(AUDIT_ARCH_PPC64,
> -				    regs->gpr[0],
> -				    regs->gpr[3], regs->gpr[4],
> +		audit_syscall_entry(regs->gpr[0], regs->gpr[3], regs->gpr[4],
>  				    regs->gpr[5], regs->gpr[6]);
>  	else
>  #endif
> -		audit_syscall_entry(AUDIT_ARCH_PPC,
> -				    regs->gpr[0],
> +		audit_syscall_entry(regs->gpr[0],
>  				    regs->gpr[3] & 0xffffffff,
>  				    regs->gpr[4] & 0xffffffff,
>  				    regs->gpr[5] & 0xffffffff,
> diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
> index e65c91c..2e2e7bb5 100644
> --- a/arch/s390/kernel/ptrace.c
> +++ b/arch/s390/kernel/ptrace.c
> @@ -812,9 +812,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
>  	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
>  		trace_sys_enter(regs, regs->gprs[2]);
>  
> -	audit_syscall_entry(is_compat_task() ?
> -				AUDIT_ARCH_S390 : AUDIT_ARCH_S390X,
> -			    regs->gprs[2], regs->orig_gpr2,
> +	audit_syscall_entry(regs->gprs[2], regs->orig_gpr2,
>  			    regs->gprs[3], regs->gprs[4],
>  			    regs->gprs[5]);
>  out:
> diff --git a/arch/sh/kernel/ptrace_32.c b/arch/sh/kernel/ptrace_32.c
> index 668c816..c1a6b89 100644
> --- a/arch/sh/kernel/ptrace_32.c
> +++ b/arch/sh/kernel/ptrace_32.c
> @@ -484,17 +484,6 @@ long arch_ptrace(struct task_struct *child, long request,
>  	return ret;
>  }
>  
> -static inline int audit_arch(void)
> -{
> -	int arch = EM_SH;
> -
> -#ifdef CONFIG_CPU_LITTLE_ENDIAN
> -	arch |= __AUDIT_ARCH_LE;
> -#endif
> -
> -	return arch;
> -}
> -
>  asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
>  {
>  	long ret = 0;
> @@ -513,8 +502,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
>  	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
>  		trace_sys_enter(regs, regs->regs[0]);
>  
> -	audit_syscall_entry(audit_arch(), regs->regs[3],
> -			    regs->regs[4], regs->regs[5],
> +	audit_syscall_entry(regs->regs[3], regs->regs[4], regs->regs[5],
>  			    regs->regs[6], regs->regs[7]);
>  
>  	return ret ?: regs->regs[0];
> diff --git a/arch/sh/kernel/ptrace_64.c b/arch/sh/kernel/ptrace_64.c
> index af90339..5cea973 100644
> --- a/arch/sh/kernel/ptrace_64.c
> +++ b/arch/sh/kernel/ptrace_64.c
> @@ -504,20 +504,6 @@ asmlinkage int sh64_ptrace(long request, long pid,
>  	return sys_ptrace(request, pid, addr, data);
>  }
>  
> -static inline int audit_arch(void)
> -{
> -	int arch = EM_SH;
> -
> -#ifdef CONFIG_64BIT
> -	arch |= __AUDIT_ARCH_64BIT;
> -#endif
> -#ifdef CONFIG_CPU_LITTLE_ENDIAN
> -	arch |= __AUDIT_ARCH_LE;
> -#endif
> -
> -	return arch;
> -}
> -
>  asmlinkage long long do_syscall_trace_enter(struct pt_regs *regs)
>  {
>  	long long ret = 0;
> @@ -536,8 +522,7 @@ asmlinkage long long do_syscall_trace_enter(struct pt_regs *regs)
>  	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
>  		trace_sys_enter(regs, regs->regs[9]);
>  
> -	audit_syscall_entry(audit_arch(), regs->regs[1],
> -			    regs->regs[2], regs->regs[3],
> +	audit_syscall_entry(regs->regs[1], regs->regs[2], regs->regs[3],
>  			    regs->regs[4], regs->regs[5]);
>  
>  	return ret ?: regs->regs[9];
> diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c
> index c13c9f2..9ddc492 100644
> --- a/arch/sparc/kernel/ptrace_64.c
> +++ b/arch/sparc/kernel/ptrace_64.c
> @@ -1076,13 +1076,8 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
>  	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
>  		trace_sys_enter(regs, regs->u_regs[UREG_G1]);
>  
> -	audit_syscall_entry((test_thread_flag(TIF_32BIT) ?
> -			     AUDIT_ARCH_SPARC :
> -			     AUDIT_ARCH_SPARC64),
> -			    regs->u_regs[UREG_G1],
> -			    regs->u_regs[UREG_I0],
> -			    regs->u_regs[UREG_I1],
> -			    regs->u_regs[UREG_I2],
> +	audit_syscall_entry(regs->u_regs[UREG_G1], regs->u_regs[UREG_I0],
> +			    regs->u_regs[UREG_I1], regs->u_regs[UREG_I2],
>  			    regs->u_regs[UREG_I3]);
>  
>  	return ret;
> diff --git a/arch/um/kernel/ptrace.c b/arch/um/kernel/ptrace.c
> index 694d551..62435ef 100644
> --- a/arch/um/kernel/ptrace.c
> +++ b/arch/um/kernel/ptrace.c
> @@ -165,8 +165,7 @@ static void send_sigtrap(struct task_struct *tsk, struct uml_pt_regs *regs,
>   */
>  void syscall_trace_enter(struct pt_regs *regs)
>  {
> -	audit_syscall_entry(HOST_AUDIT_ARCH,
> -			    UPT_SYSCALL_NR(&regs->regs),
> +	audit_syscall_entry(UPT_SYSCALL_NR(&regs->regs),
>  			    UPT_SYSCALL_ARG1(&regs->regs),
>  			    UPT_SYSCALL_ARG2(&regs->regs),
>  			    UPT_SYSCALL_ARG3(&regs->regs),
> diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
> index 7461f50..46dfba6 100644
> --- a/arch/x86/kernel/ptrace.c
> +++ b/arch/x86/kernel/ptrace.c
> @@ -1488,15 +1488,11 @@ long syscall_trace_enter(struct pt_regs *regs)
>  		trace_sys_enter(regs, regs->orig_ax);
>  
>  	if (IS_IA32)
> -		audit_syscall_entry(AUDIT_ARCH_I386,
> -				    regs->orig_ax,
> -				    regs->bx, regs->cx,
> +		audit_syscall_entry(regs->orig_ax, regs->bx, regs->cx,
>  				    regs->dx, regs->si);
>  #ifdef CONFIG_X86_64
>  	else
> -		audit_syscall_entry(AUDIT_ARCH_X86_64,
> -				    regs->orig_ax,
> -				    regs->di, regs->si,
> +		audit_syscall_entry(regs->orig_ax, regs->di, regs->si,
>  				    regs->dx, regs->r10);
>  #endif
>  
> diff --git a/arch/x86/um/asm/ptrace.h b/arch/x86/um/asm/ptrace.h
> index 54f8102..e59eef2 100644
> --- a/arch/x86/um/asm/ptrace.h
> +++ b/arch/x86/um/asm/ptrace.h
> @@ -47,8 +47,6 @@ struct user_desc;
>  
>  #ifdef CONFIG_X86_32
>  
> -#define HOST_AUDIT_ARCH AUDIT_ARCH_I386
> -
>  extern int ptrace_get_thread_area(struct task_struct *child, int idx,
>                                    struct user_desc __user *user_desc);
>  
> @@ -57,8 +55,6 @@ extern int ptrace_set_thread_area(struct task_struct *child, int idx,
>  
>  #else
>  
> -#define HOST_AUDIT_ARCH AUDIT_ARCH_X86_64
> -
>  #define PT_REGS_R8(r) UPT_R8(&(r)->regs)
>  #define PT_REGS_R9(r) UPT_R9(&(r)->regs)
>  #define PT_REGS_R10(r) UPT_R10(&(r)->regs)
> diff --git a/arch/xtensa/kernel/ptrace.c b/arch/xtensa/kernel/ptrace.c
> index 562fac6..4d54b48 100644
> --- a/arch/xtensa/kernel/ptrace.c
> +++ b/arch/xtensa/kernel/ptrace.c
> @@ -342,7 +342,7 @@ void do_syscall_trace_enter(struct pt_regs *regs)
>  		do_syscall_trace();
>  
>  #if 0
> -	audit_syscall_entry(current, AUDIT_ARCH_XTENSA..);
> +	audit_syscall_entry(...);
>  #endif
>  }
>  
> diff --git a/include/linux/audit.h b/include/linux/audit.h
> index 4b2983e..62c9d98 100644
> --- a/include/linux/audit.h
> +++ b/include/linux/audit.h
> @@ -26,6 +26,7 @@
>  #include <linux/sched.h>
>  #include <linux/ptrace.h>
>  #include <uapi/linux/audit.h>
> +#include <asm/syscall.h>
>  
>  struct audit_sig_info {
>  	uid_t		uid;
> @@ -135,12 +136,12 @@ static inline void audit_free(struct task_struct *task)
>  	if (unlikely(task->audit_context))
>  		__audit_free(task);
>  }
> -static inline void audit_syscall_entry(int arch, int major, unsigned long a0,
> +static inline void audit_syscall_entry(int major, unsigned long a0,
>  				       unsigned long a1, unsigned long a2,
>  				       unsigned long a3)
>  {
>  	if (unlikely(current->audit_context))
> -		__audit_syscall_entry(arch, major, a0, a1, a2, a3);
> +		__audit_syscall_entry(syscall_get_arch(), major, a0, a1, a2, a3);
>  }
>  static inline void audit_syscall_exit(void *pt_regs)
>  {
> @@ -316,7 +317,7 @@ static inline int audit_alloc(struct task_struct *task)
>  }
>  static inline void audit_free(struct task_struct *task)
>  { }
> -static inline void audit_syscall_entry(int arch, int major, unsigned long a0,
> +static inline void audit_syscall_entry(int major, unsigned long a0,
>  				       unsigned long a1, unsigned long a2,
>  				       unsigned long a3)
>  { }
> -- 
> 1.8.5.3
> 
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit

- RGB

--
Richard Guy Briggs <rbriggs@redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545

[PATCH 4/4] ARCH: AUDIT: audit_syscall_entry() should not require the arch

[Richard Guy Briggs]

On 14/03/19, Eric Paris wrote:
> We have a function where the arch can be queried, syscall_get_arch().
> So rather than have every single piece of arch specific code use and/or
> duplicate syscall_get_arch(), just have the audit code use the
> syscall_get_arch() code.
> 
> Signed-off-by: Eric Paris <eparis@redhat.com>
> Cc: linux-alpha at vger.kernel.org
> Cc: linux-arm-kernel at lists.infradead.org
> Cc: linux-ia64 at vger.kernel.org
> Cc: microblaze-uclinux at itee.uq.edu.au
> Cc: linux-mips at linux-mips.org
> Cc: linux at lists.openrisc.net
> Cc: linux-parisc at vger.kernel.org
> Cc: linuxppc-dev at lists.ozlabs.org
> Cc: linux-s390 at vger.kernel.org
> Cc: linux-sh at vger.kernel.org
> Cc: sparclinux at vger.kernel.org
> Cc: user-mode-linux-devel at lists.sourceforge.net
> Cc: linux-xtensa at linux-xtensa.org
> Cc: x86 at kernel.org

Acked-by: Richard Guy Briggs <rgb@redhat.com>

> ---
>  arch/alpha/kernel/ptrace.c      |  2 +-
>  arch/arm/kernel/ptrace.c        |  4 ++--
>  arch/ia64/kernel/ptrace.c       |  2 +-
>  arch/microblaze/kernel/ptrace.c |  3 +--
>  arch/mips/kernel/ptrace.c       |  4 +---
>  arch/openrisc/kernel/ptrace.c   |  3 +--
>  arch/parisc/kernel/ptrace.c     |  9 +++------
>  arch/powerpc/kernel/ptrace.c    |  7 ++-----
>  arch/s390/kernel/ptrace.c       |  4 +---
>  arch/sh/kernel/ptrace_32.c      | 14 +-------------
>  arch/sh/kernel/ptrace_64.c      | 17 +----------------
>  arch/sparc/kernel/ptrace_64.c   |  9 ++-------
>  arch/um/kernel/ptrace.c         |  3 +--
>  arch/x86/kernel/ptrace.c        |  8 ++------
>  arch/x86/um/asm/ptrace.h        |  4 ----
>  arch/xtensa/kernel/ptrace.c     |  2 +-
>  include/linux/audit.h           |  7 ++++---
>  17 files changed, 25 insertions(+), 77 deletions(-)
> 
> diff --git a/arch/alpha/kernel/ptrace.c b/arch/alpha/kernel/ptrace.c
> index 86d8351..d9ee817 100644
> --- a/arch/alpha/kernel/ptrace.c
> +++ b/arch/alpha/kernel/ptrace.c
> @@ -321,7 +321,7 @@ asmlinkage unsigned long syscall_trace_enter(void)
>  	if (test_thread_flag(TIF_SYSCALL_TRACE) &&
>  	    tracehook_report_syscall_entry(current_pt_regs()))
>  		ret = -1UL;
> -	audit_syscall_entry(AUDIT_ARCH_ALPHA, regs->r0, regs->r16, regs->r17, regs->r18, regs->r19);
> +	audit_syscall_entry(regs->r0, regs->r16, regs->r17, regs->r18, regs->r19);
>  	return ret ?: current_pt_regs()->r0;
>  }
>  
> diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
> index 0dd3b79..c9d2b34 100644
> --- a/arch/arm/kernel/ptrace.c
> +++ b/arch/arm/kernel/ptrace.c
> @@ -943,8 +943,8 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs, int scno)
>  	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
>  		trace_sys_enter(regs, scno);
>  
> -	audit_syscall_entry(AUDIT_ARCH_ARM, scno, regs->ARM_r0, regs->ARM_r1,
> -			    regs->ARM_r2, regs->ARM_r3);
> +	audit_syscall_entry(scno, regs->ARM_r0, regs->ARM_r1, regs->ARM_r2,
> +			    regs->ARM_r3);
>  
>  	return scno;
>  }
> diff --git a/arch/ia64/kernel/ptrace.c b/arch/ia64/kernel/ptrace.c
> index b7a5fff..6f54d51 100644
> --- a/arch/ia64/kernel/ptrace.c
> +++ b/arch/ia64/kernel/ptrace.c
> @@ -1219,7 +1219,7 @@ syscall_trace_enter (long arg0, long arg1, long arg2, long arg3,
>  		ia64_sync_krbs();
>  
>  
> -	audit_syscall_entry(AUDIT_ARCH_IA64, regs.r15, arg0, arg1, arg2, arg3);
> +	audit_syscall_entry(regs.r15, arg0, arg1, arg2, arg3);
>  
>  	return 0;
>  }
> diff --git a/arch/microblaze/kernel/ptrace.c b/arch/microblaze/kernel/ptrace.c
> index 39cf508..bb10637 100644
> --- a/arch/microblaze/kernel/ptrace.c
> +++ b/arch/microblaze/kernel/ptrace.c
> @@ -147,8 +147,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
>  		 */
>  		ret = -1L;
>  
> -	audit_syscall_entry(EM_MICROBLAZE, regs->r12, regs->r5, regs->r6,
> -			    regs->r7, regs->r8);
> +	audit_syscall_entry(regs->r12, regs->r5, regs->r6, regs->r7, regs->r8);
>  
>  	return ret ?: regs->r12;
>  }
> diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
> index 65ba622..c06bb82 100644
> --- a/arch/mips/kernel/ptrace.c
> +++ b/arch/mips/kernel/ptrace.c
> @@ -671,9 +671,7 @@ asmlinkage void syscall_trace_enter(struct pt_regs *regs)
>  	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
>  		trace_sys_enter(regs, regs->regs[2]);
>  
> -	audit_syscall_entry(syscall_get_arch(),
> -			    regs->regs[2],
> -			    regs->regs[4], regs->regs[5],
> +	audit_syscall_entry(regs->regs[2], regs->regs[4], regs->regs[5],
>  			    regs->regs[6], regs->regs[7]);
>  }
>  
> diff --git a/arch/openrisc/kernel/ptrace.c b/arch/openrisc/kernel/ptrace.c
> index 71a2a0c..4f59fa4 100644
> --- a/arch/openrisc/kernel/ptrace.c
> +++ b/arch/openrisc/kernel/ptrace.c
> @@ -187,8 +187,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
>  		 */
>  		ret = -1L;
>  
> -	audit_syscall_entry(AUDIT_ARCH_OPENRISC, regs->gpr[11],
> -			    regs->gpr[3], regs->gpr[4],
> +	audit_syscall_entry(regs->gpr[11], regs->gpr[3], regs->gpr[4],
>  			    regs->gpr[5], regs->gpr[6]);
>  
>  	return ret ? : regs->gpr[11];
> diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c
> index e842ee2..7481457 100644
> --- a/arch/parisc/kernel/ptrace.c
> +++ b/arch/parisc/kernel/ptrace.c
> @@ -276,14 +276,11 @@ long do_syscall_trace_enter(struct pt_regs *regs)
>  
>  #ifdef CONFIG_64BIT
>  	if (!is_compat_task())
> -		audit_syscall_entry(AUDIT_ARCH_PARISC64,
> -			regs->gr[20],
> -			regs->gr[26], regs->gr[25],
> -			regs->gr[24], regs->gr[23]);
> +		audit_syscall_entry(regs->gr[20], regs->gr[26], regs->gr[25],
> +				    regs->gr[24], regs->gr[23]);
>  	else
>  #endif
> -		audit_syscall_entry(AUDIT_ARCH_PARISC,
> -			regs->gr[20] & 0xffffffff,
> +		audit_syscall_entry(regs->gr[20] & 0xffffffff,
>  			regs->gr[26] & 0xffffffff,
>  			regs->gr[25] & 0xffffffff,
>  			regs->gr[24] & 0xffffffff,
> diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
> index 2e3d2bf..524a943 100644
> --- a/arch/powerpc/kernel/ptrace.c
> +++ b/arch/powerpc/kernel/ptrace.c
> @@ -1788,14 +1788,11 @@ long do_syscall_trace_enter(struct pt_regs *regs)
>  
>  #ifdef CONFIG_PPC64
>  	if (!is_32bit_task())
> -		audit_syscall_entry(AUDIT_ARCH_PPC64,
> -				    regs->gpr[0],
> -				    regs->gpr[3], regs->gpr[4],
> +		audit_syscall_entry(regs->gpr[0], regs->gpr[3], regs->gpr[4],
>  				    regs->gpr[5], regs->gpr[6]);
>  	else
>  #endif
> -		audit_syscall_entry(AUDIT_ARCH_PPC,
> -				    regs->gpr[0],
> +		audit_syscall_entry(regs->gpr[0],
>  				    regs->gpr[3] & 0xffffffff,
>  				    regs->gpr[4] & 0xffffffff,
>  				    regs->gpr[5] & 0xffffffff,
> diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
> index e65c91c..2e2e7bb5 100644
> --- a/arch/s390/kernel/ptrace.c
> +++ b/arch/s390/kernel/ptrace.c
> @@ -812,9 +812,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
>  	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
>  		trace_sys_enter(regs, regs->gprs[2]);
>  
> -	audit_syscall_entry(is_compat_task() ?
> -				AUDIT_ARCH_S390 : AUDIT_ARCH_S390X,
> -			    regs->gprs[2], regs->orig_gpr2,
> +	audit_syscall_entry(regs->gprs[2], regs->orig_gpr2,
>  			    regs->gprs[3], regs->gprs[4],
>  			    regs->gprs[5]);
>  out:
> diff --git a/arch/sh/kernel/ptrace_32.c b/arch/sh/kernel/ptrace_32.c
> index 668c816..c1a6b89 100644
> --- a/arch/sh/kernel/ptrace_32.c
> +++ b/arch/sh/kernel/ptrace_32.c
> @@ -484,17 +484,6 @@ long arch_ptrace(struct task_struct *child, long request,
>  	return ret;
>  }
>  
> -static inline int audit_arch(void)
> -{
> -	int arch = EM_SH;
> -
> -#ifdef CONFIG_CPU_LITTLE_ENDIAN
> -	arch |= __AUDIT_ARCH_LE;
> -#endif
> -
> -	return arch;
> -}
> -
>  asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
>  {
>  	long ret = 0;
> @@ -513,8 +502,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
>  	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
>  		trace_sys_enter(regs, regs->regs[0]);
>  
> -	audit_syscall_entry(audit_arch(), regs->regs[3],
> -			    regs->regs[4], regs->regs[5],
> +	audit_syscall_entry(regs->regs[3], regs->regs[4], regs->regs[5],
>  			    regs->regs[6], regs->regs[7]);
>  
>  	return ret ?: regs->regs[0];
> diff --git a/arch/sh/kernel/ptrace_64.c b/arch/sh/kernel/ptrace_64.c
> index af90339..5cea973 100644
> --- a/arch/sh/kernel/ptrace_64.c
> +++ b/arch/sh/kernel/ptrace_64.c
> @@ -504,20 +504,6 @@ asmlinkage int sh64_ptrace(long request, long pid,
>  	return sys_ptrace(request, pid, addr, data);
>  }
>  
> -static inline int audit_arch(void)
> -{
> -	int arch = EM_SH;
> -
> -#ifdef CONFIG_64BIT
> -	arch |= __AUDIT_ARCH_64BIT;
> -#endif
> -#ifdef CONFIG_CPU_LITTLE_ENDIAN
> -	arch |= __AUDIT_ARCH_LE;
> -#endif
> -
> -	return arch;
> -}
> -
>  asmlinkage long long do_syscall_trace_enter(struct pt_regs *regs)
>  {
>  	long long ret = 0;
> @@ -536,8 +522,7 @@ asmlinkage long long do_syscall_trace_enter(struct pt_regs *regs)
>  	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
>  		trace_sys_enter(regs, regs->regs[9]);
>  
> -	audit_syscall_entry(audit_arch(), regs->regs[1],
> -			    regs->regs[2], regs->regs[3],
> +	audit_syscall_entry(regs->regs[1], regs->regs[2], regs->regs[3],
>  			    regs->regs[4], regs->regs[5]);
>  
>  	return ret ?: regs->regs[9];
> diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c
> index c13c9f2..9ddc492 100644
> --- a/arch/sparc/kernel/ptrace_64.c
> +++ b/arch/sparc/kernel/ptrace_64.c
> @@ -1076,13 +1076,8 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
>  	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
>  		trace_sys_enter(regs, regs->u_regs[UREG_G1]);
>  
> -	audit_syscall_entry((test_thread_flag(TIF_32BIT) ?
> -			     AUDIT_ARCH_SPARC :
> -			     AUDIT_ARCH_SPARC64),
> -			    regs->u_regs[UREG_G1],
> -			    regs->u_regs[UREG_I0],
> -			    regs->u_regs[UREG_I1],
> -			    regs->u_regs[UREG_I2],
> +	audit_syscall_entry(regs->u_regs[UREG_G1], regs->u_regs[UREG_I0],
> +			    regs->u_regs[UREG_I1], regs->u_regs[UREG_I2],
>  			    regs->u_regs[UREG_I3]);
>  
>  	return ret;
> diff --git a/arch/um/kernel/ptrace.c b/arch/um/kernel/ptrace.c
> index 694d551..62435ef 100644
> --- a/arch/um/kernel/ptrace.c
> +++ b/arch/um/kernel/ptrace.c
> @@ -165,8 +165,7 @@ static void send_sigtrap(struct task_struct *tsk, struct uml_pt_regs *regs,
>   */
>  void syscall_trace_enter(struct pt_regs *regs)
>  {
> -	audit_syscall_entry(HOST_AUDIT_ARCH,
> -			    UPT_SYSCALL_NR(&regs->regs),
> +	audit_syscall_entry(UPT_SYSCALL_NR(&regs->regs),
>  			    UPT_SYSCALL_ARG1(&regs->regs),
>  			    UPT_SYSCALL_ARG2(&regs->regs),
>  			    UPT_SYSCALL_ARG3(&regs->regs),
> diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
> index 7461f50..46dfba6 100644
> --- a/arch/x86/kernel/ptrace.c
> +++ b/arch/x86/kernel/ptrace.c
> @@ -1488,15 +1488,11 @@ long syscall_trace_enter(struct pt_regs *regs)
>  		trace_sys_enter(regs, regs->orig_ax);
>  
>  	if (IS_IA32)
> -		audit_syscall_entry(AUDIT_ARCH_I386,
> -				    regs->orig_ax,
> -				    regs->bx, regs->cx,
> +		audit_syscall_entry(regs->orig_ax, regs->bx, regs->cx,
>  				    regs->dx, regs->si);
>  #ifdef CONFIG_X86_64
>  	else
> -		audit_syscall_entry(AUDIT_ARCH_X86_64,
> -				    regs->orig_ax,
> -				    regs->di, regs->si,
> +		audit_syscall_entry(regs->orig_ax, regs->di, regs->si,
>  				    regs->dx, regs->r10);
>  #endif
>  
> diff --git a/arch/x86/um/asm/ptrace.h b/arch/x86/um/asm/ptrace.h
> index 54f8102..e59eef2 100644
> --- a/arch/x86/um/asm/ptrace.h
> +++ b/arch/x86/um/asm/ptrace.h
> @@ -47,8 +47,6 @@ struct user_desc;
>  
>  #ifdef CONFIG_X86_32
>  
> -#define HOST_AUDIT_ARCH AUDIT_ARCH_I386
> -
>  extern int ptrace_get_thread_area(struct task_struct *child, int idx,
>                                    struct user_desc __user *user_desc);
>  
> @@ -57,8 +55,6 @@ extern int ptrace_set_thread_area(struct task_struct *child, int idx,
>  
>  #else
>  
> -#define HOST_AUDIT_ARCH AUDIT_ARCH_X86_64
> -
>  #define PT_REGS_R8(r) UPT_R8(&(r)->regs)
>  #define PT_REGS_R9(r) UPT_R9(&(r)->regs)
>  #define PT_REGS_R10(r) UPT_R10(&(r)->regs)
> diff --git a/arch/xtensa/kernel/ptrace.c b/arch/xtensa/kernel/ptrace.c
> index 562fac6..4d54b48 100644
> --- a/arch/xtensa/kernel/ptrace.c
> +++ b/arch/xtensa/kernel/ptrace.c
> @@ -342,7 +342,7 @@ void do_syscall_trace_enter(struct pt_regs *regs)
>  		do_syscall_trace();
>  
>  #if 0
> -	audit_syscall_entry(current, AUDIT_ARCH_XTENSA..);
> +	audit_syscall_entry(...);
>  #endif
>  }
>  
> diff --git a/include/linux/audit.h b/include/linux/audit.h
> index 4b2983e..62c9d98 100644
> --- a/include/linux/audit.h
> +++ b/include/linux/audit.h
> @@ -26,6 +26,7 @@
>  #include <linux/sched.h>
>  #include <linux/ptrace.h>
>  #include <uapi/linux/audit.h>
> +#include <asm/syscall.h>
>  
>  struct audit_sig_info {
>  	uid_t		uid;
> @@ -135,12 +136,12 @@ static inline void audit_free(struct task_struct *task)
>  	if (unlikely(task->audit_context))
>  		__audit_free(task);
>  }
> -static inline void audit_syscall_entry(int arch, int major, unsigned long a0,
> +static inline void audit_syscall_entry(int major, unsigned long a0,
>  				       unsigned long a1, unsigned long a2,
>  				       unsigned long a3)
>  {
>  	if (unlikely(current->audit_context))
> -		__audit_syscall_entry(arch, major, a0, a1, a2, a3);
> +		__audit_syscall_entry(syscall_get_arch(), major, a0, a1, a2, a3);
>  }
>  static inline void audit_syscall_exit(void *pt_regs)
>  {
> @@ -316,7 +317,7 @@ static inline int audit_alloc(struct task_struct *task)
>  }
>  static inline void audit_free(struct task_struct *task)
>  { }
> -static inline void audit_syscall_entry(int arch, int major, unsigned long a0,
> +static inline void audit_syscall_entry(int major, unsigned long a0,
>  				       unsigned long a1, unsigned long a2,
>  				       unsigned long a3)
>  { }
> -- 
> 1.8.5.3
> 
> --
> Linux-audit mailing list
> Linux-audit at redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit

- RGB

--
Richard Guy Briggs <rbriggs@redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545

Re: [PATCH 2/4] UM: implement syscall_get_arch()

[Richard Guy Briggs]

On 14/03/21, Richard Guy Briggs wrote:
> On 14/03/19, Eric Paris wrote:
> > SH: define syscall_get_arch() for superh
> > 
> > This patch defines syscall_get_arch() for the um platform.  It adds a
> > new syscall.h header file to define this.  It copies the HOST_AUDIT_ARCH
> > definition from ptrace.h.  (that definition will be removed when we
> > switch audit to use this new syscall_get_arch() function)
> 
> Why not just use:

Sorry, I see now that you yanked it out of ptrace.h.

> diff --git a/arch/um/include/asm/syscall.h
> b/arch/um/include/asm/syscall.h
> new file mode 100644
> index 0000000..fbcb2e4
> --- /dev/null
> +++ b/arch/um/include/asm/syscall.h
> @@ -0,0 +1,9 @@
> +#ifndef __ASM_UM_SYSCALL_H
> +#define __ASM_UM_SYSCALL_H
> +
> +static inline int syscall_get_arch(void)
> +{
> +       return HOST_AUDIT_ARCH;
> +}
> +
> +#endif /* __ASM_SH_SYSCALL_H */
> 
> > Signed-off-by: Eric Paris <eparis@redhat.com>
> > Cc: user-mode-linux-devel@lists.sourceforge.net
> > ---
> >  arch/x86/um/asm/syscall.h | 15 +++++++++++++++
> >  1 file changed, 15 insertions(+)
> >  create mode 100644 arch/x86/um/asm/syscall.h
> > 
> > diff --git a/arch/x86/um/asm/syscall.h b/arch/x86/um/asm/syscall.h
> > new file mode 100644
> > index 0000000..9fe77b7
> > --- /dev/null
> > +++ b/arch/x86/um/asm/syscall.h
> > @@ -0,0 +1,15 @@
> > +#ifndef __UM_ASM_SYSCALL_H
> > +#define __UM_ASM_SYSCALL_H
> > +
> > +#include <uapi/linux/audit.h>
> > +
> > +static inline int syscall_get_arch(void)
> > +{
> > +#ifdef CONFIG_X86_32
> > +	return AUDIT_ARCH_I386;
> > +#else
> > +	return AUDIT_ARCH_X86_64;
> > +#endif
> > +}
> > +
> > +#endif /* __UM_ASM_SYSCALL_H */
> > -- 
> > 1.8.5.3
> > 
> > --
> > Linux-audit mailing list
> > Linux-audit@redhat.com
> > https://www.redhat.com/mailman/listinfo/linux-audit
> 
> - RGB
> 
> --
> Richard Guy Briggs <rbriggs@redhat.com>
> Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
> Remote, Ottawa, Canada
> Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545
> 
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit

- RGB

--
Richard Guy Briggs <rbriggs@redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545

Re: [uml-devel] [PATCH 2/4] UM: implement syscall_get_arch()

[Richard Guy Briggs]

On 14/03/21, Richard Guy Briggs wrote:
> On 14/03/19, Eric Paris wrote:
> > SH: define syscall_get_arch() for superh
> > 
> > This patch defines syscall_get_arch() for the um platform.  It adds a
> > new syscall.h header file to define this.  It copies the HOST_AUDIT_ARCH
> > definition from ptrace.h.  (that definition will be removed when we
> > switch audit to use this new syscall_get_arch() function)
> 
> Why not just use:

Sorry, I see now that you yanked it out of ptrace.h.

> diff --git a/arch/um/include/asm/syscall.h
> b/arch/um/include/asm/syscall.h
> new file mode 100644
> index 0000000..fbcb2e4
> --- /dev/null
> +++ b/arch/um/include/asm/syscall.h
> @@ -0,0 +1,9 @@
> +#ifndef __ASM_UM_SYSCALL_H
> +#define __ASM_UM_SYSCALL_H
> +
> +static inline int syscall_get_arch(void)
> +{
> +       return HOST_AUDIT_ARCH;
> +}
> +
> +#endif /* __ASM_SH_SYSCALL_H */
> 
> > Signed-off-by: Eric Paris <eparis@redhat.com>
> > Cc: user-mode-linux-devel@lists.sourceforge.net
> > ---
> >  arch/x86/um/asm/syscall.h | 15 +++++++++++++++
> >  1 file changed, 15 insertions(+)
> >  create mode 100644 arch/x86/um/asm/syscall.h
> > 
> > diff --git a/arch/x86/um/asm/syscall.h b/arch/x86/um/asm/syscall.h
> > new file mode 100644
> > index 0000000..9fe77b7
> > --- /dev/null
> > +++ b/arch/x86/um/asm/syscall.h
> > @@ -0,0 +1,15 @@
> > +#ifndef __UM_ASM_SYSCALL_H
> > +#define __UM_ASM_SYSCALL_H
> > +
> > +#include <uapi/linux/audit.h>
> > +
> > +static inline int syscall_get_arch(void)
> > +{
> > +#ifdef CONFIG_X86_32
> > +	return AUDIT_ARCH_I386;
> > +#else
> > +	return AUDIT_ARCH_X86_64;
> > +#endif
> > +}
> > +
> > +#endif /* __UM_ASM_SYSCALL_H */
> > -- 
> > 1.8.5.3
> > 
> > --
> > Linux-audit mailing list
> > Linux-audit@redhat.com
> > https://www.redhat.com/mailman/listinfo/linux-audit
> 
> - RGB
> 
> --
> Richard Guy Briggs <rbriggs@redhat.com>
> Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
> Remote, Ottawa, Canada
> Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545
> 
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit

- RGB

--
Richard Guy Briggs <rbriggs@redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545

------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and their
applications. Written by three acclaimed leaders in the field,
this first edition is now available. Download your free book today!
http://p.sf.net/sfu/13534_NeoTech
_______________________________________________
User-mode-linux-devel mailing list
User-mode-linux-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel

Re: [PATCH 2/4] UM: implement syscall_get_arch()

[Richard Guy Briggs]

On 14/03/19, Eric Paris wrote:
> SH: define syscall_get_arch() for superh
> 
> This patch defines syscall_get_arch() for the um platform.  It adds a
> new syscall.h header file to define this.  It copies the HOST_AUDIT_ARCH
> definition from ptrace.h.  (that definition will be removed when we
> switch audit to use this new syscall_get_arch() function)
> 
> Signed-off-by: Eric Paris <eparis@redhat.com>
> Cc: user-mode-linux-devel@lists.sourceforge.net

Acked-by: Richard Guy Briggs <rgb@redhat.com>

> ---
>  arch/x86/um/asm/syscall.h | 15 +++++++++++++++
>  1 file changed, 15 insertions(+)
>  create mode 100644 arch/x86/um/asm/syscall.h
> 
> diff --git a/arch/x86/um/asm/syscall.h b/arch/x86/um/asm/syscall.h
> new file mode 100644
> index 0000000..9fe77b7
> --- /dev/null
> +++ b/arch/x86/um/asm/syscall.h
> @@ -0,0 +1,15 @@
> +#ifndef __UM_ASM_SYSCALL_H
> +#define __UM_ASM_SYSCALL_H
> +
> +#include <uapi/linux/audit.h>
> +
> +static inline int syscall_get_arch(void)
> +{
> +#ifdef CONFIG_X86_32
> +	return AUDIT_ARCH_I386;
> +#else
> +	return AUDIT_ARCH_X86_64;
> +#endif
> +}
> +
> +#endif /* __UM_ASM_SYSCALL_H */
> -- 
> 1.8.5.3
> 
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit

- RGB

--
Richard Guy Briggs <rbriggs@redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545

Re: [uml-devel] [PATCH 2/4] UM: implement syscall_get_arch()

[Richard Guy Briggs]

On 14/03/19, Eric Paris wrote:
> SH: define syscall_get_arch() for superh
> 
> This patch defines syscall_get_arch() for the um platform.  It adds a
> new syscall.h header file to define this.  It copies the HOST_AUDIT_ARCH
> definition from ptrace.h.  (that definition will be removed when we
> switch audit to use this new syscall_get_arch() function)
> 
> Signed-off-by: Eric Paris <eparis@redhat.com>
> Cc: user-mode-linux-devel@lists.sourceforge.net

Acked-by: Richard Guy Briggs <rgb@redhat.com>

> ---
>  arch/x86/um/asm/syscall.h | 15 +++++++++++++++
>  1 file changed, 15 insertions(+)
>  create mode 100644 arch/x86/um/asm/syscall.h
> 
> diff --git a/arch/x86/um/asm/syscall.h b/arch/x86/um/asm/syscall.h
> new file mode 100644
> index 0000000..9fe77b7
> --- /dev/null
> +++ b/arch/x86/um/asm/syscall.h
> @@ -0,0 +1,15 @@
> +#ifndef __UM_ASM_SYSCALL_H
> +#define __UM_ASM_SYSCALL_H
> +
> +#include <uapi/linux/audit.h>
> +
> +static inline int syscall_get_arch(void)
> +{
> +#ifdef CONFIG_X86_32
> +	return AUDIT_ARCH_I386;
> +#else
> +	return AUDIT_ARCH_X86_64;
> +#endif
> +}
> +
> +#endif /* __UM_ASM_SYSCALL_H */
> -- 
> 1.8.5.3
> 
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit

- RGB

--
Richard Guy Briggs <rbriggs@redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545

------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and their
applications. Written by three acclaimed leaders in the field,
this first edition is now available. Download your free book today!
http://p.sf.net/sfu/13534_NeoTech
_______________________________________________
User-mode-linux-devel mailing list
User-mode-linux-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel

Re: [PATCH 2/4] UM: implement syscall_get_arch()

[Eric Paris]

On Fri, 2014-03-21 at 15:08 -0400, Richard Guy Briggs wrote:
> On 14/03/19, Eric Paris wrote:
> > SH: define syscall_get_arch() for superh
> > 
> > This patch defines syscall_get_arch() for the um platform.  It adds a
> > new syscall.h header file to define this.  It copies the HOST_AUDIT_ARCH
> > definition from ptrace.h.  (that definition will be removed when we
> > switch audit to use this new syscall_get_arch() function)
> 
> Why not just use:
> 
> diff --git a/arch/um/include/asm/syscall.h
> b/arch/um/include/asm/syscall.h
> new file mode 100644
> index 0000000..fbcb2e4
> --- /dev/null
> +++ b/arch/um/include/asm/syscall.h
> @@ -0,0 +1,9 @@
> +#ifndef __ASM_UM_SYSCALL_H
> +#define __ASM_UM_SYSCALL_H
> +
> +static inline int syscall_get_arch(void)
> +{
> +       return HOST_AUDIT_ARCH;
> +}
> +
> +#endif /* __ASM_SH_SYSCALL_H */

because then I'm relying on something in ptrace.h that serves no purpose
other than creating indirection from here...

-Eric

> > Signed-off-by: Eric Paris <eparis@redhat.com>
> > Cc: user-mode-linux-devel@lists.sourceforge.net
> > ---
> >  arch/x86/um/asm/syscall.h | 15 +++++++++++++++
> >  1 file changed, 15 insertions(+)
> >  create mode 100644 arch/x86/um/asm/syscall.h
> > 
> > diff --git a/arch/x86/um/asm/syscall.h b/arch/x86/um/asm/syscall.h
> > new file mode 100644
> > index 0000000..9fe77b7
> > --- /dev/null
> > +++ b/arch/x86/um/asm/syscall.h
> > @@ -0,0 +1,15 @@
> > +#ifndef __UM_ASM_SYSCALL_H
> > +#define __UM_ASM_SYSCALL_H
> > +
> > +#include <uapi/linux/audit.h>
> > +
> > +static inline int syscall_get_arch(void)
> > +{
> > +#ifdef CONFIG_X86_32
> > +	return AUDIT_ARCH_I386;
> > +#else
> > +	return AUDIT_ARCH_X86_64;
> > +#endif
> > +}
> > +
> > +#endif /* __UM_ASM_SYSCALL_H */
> > -- 
> > 1.8.5.3
> > 
> > --
> > Linux-audit mailing list
> > Linux-audit@redhat.com
> > https://www.redhat.com/mailman/listinfo/linux-audit
> 
> - RGB
> 
> --
> Richard Guy Briggs <rbriggs@redhat.com>
> Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
> Remote, Ottawa, Canada
> Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545

Re: [uml-devel] [PATCH 2/4] UM: implement syscall_get_arch()

[Eric Paris]

On Fri, 2014-03-21 at 15:08 -0400, Richard Guy Briggs wrote:
> On 14/03/19, Eric Paris wrote:
> > SH: define syscall_get_arch() for superh
> > 
> > This patch defines syscall_get_arch() for the um platform.  It adds a
> > new syscall.h header file to define this.  It copies the HOST_AUDIT_ARCH
> > definition from ptrace.h.  (that definition will be removed when we
> > switch audit to use this new syscall_get_arch() function)
> 
> Why not just use:
> 
> diff --git a/arch/um/include/asm/syscall.h
> b/arch/um/include/asm/syscall.h
> new file mode 100644
> index 0000000..fbcb2e4
> --- /dev/null
> +++ b/arch/um/include/asm/syscall.h
> @@ -0,0 +1,9 @@
> +#ifndef __ASM_UM_SYSCALL_H
> +#define __ASM_UM_SYSCALL_H
> +
> +static inline int syscall_get_arch(void)
> +{
> +       return HOST_AUDIT_ARCH;
> +}
> +
> +#endif /* __ASM_SH_SYSCALL_H */

because then I'm relying on something in ptrace.h that serves no purpose
other than creating indirection from here...

-Eric

> > Signed-off-by: Eric Paris <eparis@redhat.com>
> > Cc: user-mode-linux-devel@lists.sourceforge.net
> > ---
> >  arch/x86/um/asm/syscall.h | 15 +++++++++++++++
> >  1 file changed, 15 insertions(+)
> >  create mode 100644 arch/x86/um/asm/syscall.h
> > 
> > diff --git a/arch/x86/um/asm/syscall.h b/arch/x86/um/asm/syscall.h
> > new file mode 100644
> > index 0000000..9fe77b7
> > --- /dev/null
> > +++ b/arch/x86/um/asm/syscall.h
> > @@ -0,0 +1,15 @@
> > +#ifndef __UM_ASM_SYSCALL_H
> > +#define __UM_ASM_SYSCALL_H
> > +
> > +#include <uapi/linux/audit.h>
> > +
> > +static inline int syscall_get_arch(void)
> > +{
> > +#ifdef CONFIG_X86_32
> > +	return AUDIT_ARCH_I386;
> > +#else
> > +	return AUDIT_ARCH_X86_64;
> > +#endif
> > +}
> > +
> > +#endif /* __UM_ASM_SYSCALL_H */
> > -- 
> > 1.8.5.3
> > 
> > --
> > Linux-audit mailing list
> > Linux-audit@redhat.com
> > https://www.redhat.com/mailman/listinfo/linux-audit
> 
> - RGB
> 
> --
> Richard Guy Briggs <rbriggs@redhat.com>
> Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
> Remote, Ottawa, Canada
> Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545



------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and their
applications. Written by three acclaimed leaders in the field,
this first edition is now available. Download your free book today!
http://p.sf.net/sfu/13534_NeoTech
_______________________________________________
User-mode-linux-devel mailing list
User-mode-linux-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel

Re: [PATCH 3/4] ARCH: AUDIT: implement syscall_get_arch for all arches

[Stephen Rothwell]

[-- Attachment #1.1: Type: text/plain, Size: 1310 bytes --]

Hi Eric,

[I just noticed that this turned up in linux-next ...]

On Wed, 19 Mar 2014 18:04:02 -0400 Eric Paris <eparis@redhat.com> wrote:
>
> diff --git a/arch/powerpc/include/asm/syscall.h b/arch/powerpc/include/asm/syscall.h
> index b54b2ad..4271544 100644
> --- a/arch/powerpc/include/asm/syscall.h
> +++ b/arch/powerpc/include/asm/syscall.h
> @@ -13,6 +13,8 @@
>  #ifndef _ASM_SYSCALL_H
>  #define _ASM_SYSCALL_H	1
>  
> +#include <uapi/linux/audit.h>
> +#include <linux/compat.h>

You don't need linux/compat.h, I think, but you do need to include
linux/thread_info.h for is_32bit_task() below.

>  #include <linux/sched.h>
>  
>  /* ftrace syscalls requires exporting the sys_call_table */
> @@ -86,4 +88,14 @@ static inline void syscall_set_arguments(struct task_struct *task,
>  	memcpy(&regs->gpr[3 + i], args, n * sizeof(args[0]));
>  }
>  
> +static inline int syscall_get_arch(void)
> +{
> +	int arch = AUDIT_ARCH_PPC;
> +
> +#ifdef CONFIG_PPC64
> +	if (!is_32bit_task())
> +		arch = AUDIT_ARCH_PPC64;
> +#endif
> +	return arch;

This could just be

	return is_32bit_task() ? AUDIT_ARCH_PPC : AUDIT_ARCH_PPC64;

as is_32bit_task() is always defined (and is (1) for !CONFIG_PPC64).

-- 
Cheers,
Stephen Rothwell                    sfr@canb.auug.org.au

[-- Attachment #1.2: Type: application/pgp-signature, Size: 836 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: [PATCH 3/4] ARCH: AUDIT: implement syscall_get_arch for all arches

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 1310 bytes --]

Hi Eric,

[I just noticed that this turned up in linux-next ...]

On Wed, 19 Mar 2014 18:04:02 -0400 Eric Paris <eparis@redhat.com> wrote:
>
> diff --git a/arch/powerpc/include/asm/syscall.h b/arch/powerpc/include/asm/syscall.h
> index b54b2ad..4271544 100644
> --- a/arch/powerpc/include/asm/syscall.h
> +++ b/arch/powerpc/include/asm/syscall.h
> @@ -13,6 +13,8 @@
>  #ifndef _ASM_SYSCALL_H
>  #define _ASM_SYSCALL_H	1
>  
> +#include <uapi/linux/audit.h>
> +#include <linux/compat.h>

You don't need linux/compat.h, I think, but you do need to include
linux/thread_info.h for is_32bit_task() below.

>  #include <linux/sched.h>
>  
>  /* ftrace syscalls requires exporting the sys_call_table */
> @@ -86,4 +88,14 @@ static inline void syscall_set_arguments(struct task_struct *task,
>  	memcpy(&regs->gpr[3 + i], args, n * sizeof(args[0]));
>  }
>  
> +static inline int syscall_get_arch(void)
> +{
> +	int arch = AUDIT_ARCH_PPC;
> +
> +#ifdef CONFIG_PPC64
> +	if (!is_32bit_task())
> +		arch = AUDIT_ARCH_PPC64;
> +#endif
> +	return arch;

This could just be

	return is_32bit_task() ? AUDIT_ARCH_PPC : AUDIT_ARCH_PPC64;

as is_32bit_task() is always defined (and is (1) for !CONFIG_PPC64).

-- 
Cheers,
Stephen Rothwell                    sfr@canb.auug.org.au

[-- Attachment #2: Type: application/pgp-signature, Size: 836 bytes --]

Re: [PATCH 3/4] ARCH: AUDIT: implement syscall_get_arch for all arches

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 1310 bytes --]

Hi Eric,

[I just noticed that this turned up in linux-next ...]

On Wed, 19 Mar 2014 18:04:02 -0400 Eric Paris <eparis@redhat.com> wrote:
>
> diff --git a/arch/powerpc/include/asm/syscall.h b/arch/powerpc/include/asm/syscall.h
> index b54b2ad..4271544 100644
> --- a/arch/powerpc/include/asm/syscall.h
> +++ b/arch/powerpc/include/asm/syscall.h
> @@ -13,6 +13,8 @@
>  #ifndef _ASM_SYSCALL_H
>  #define _ASM_SYSCALL_H	1
>  
> +#include <uapi/linux/audit.h>
> +#include <linux/compat.h>

You don't need linux/compat.h, I think, but you do need to include
linux/thread_info.h for is_32bit_task() below.

>  #include <linux/sched.h>
>  
>  /* ftrace syscalls requires exporting the sys_call_table */
> @@ -86,4 +88,14 @@ static inline void syscall_set_arguments(struct task_struct *task,
>  	memcpy(&regs->gpr[3 + i], args, n * sizeof(args[0]));
>  }
>  
> +static inline int syscall_get_arch(void)
> +{
> +	int arch = AUDIT_ARCH_PPC;
> +
> +#ifdef CONFIG_PPC64
> +	if (!is_32bit_task())
> +		arch = AUDIT_ARCH_PPC64;
> +#endif
> +	return arch;

This could just be

	return is_32bit_task() ? AUDIT_ARCH_PPC : AUDIT_ARCH_PPC64;

as is_32bit_task() is always defined (and is (1) for !CONFIG_PPC64).

-- 
Cheers,
Stephen Rothwell                    sfr@canb.auug.org.au

[-- Attachment #2: Type: application/pgp-signature, Size: 836 bytes --]

Re: [PATCH 3/4] ARCH: AUDIT: implement syscall_get_arch for all arches

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 1310 bytes --]

Hi Eric,

[I just noticed that this turned up in linux-next ...]

On Wed, 19 Mar 2014 18:04:02 -0400 Eric Paris <eparis@redhat.com> wrote:
>
> diff --git a/arch/powerpc/include/asm/syscall.h b/arch/powerpc/include/asm/syscall.h
> index b54b2ad..4271544 100644
> --- a/arch/powerpc/include/asm/syscall.h
> +++ b/arch/powerpc/include/asm/syscall.h
> @@ -13,6 +13,8 @@
>  #ifndef _ASM_SYSCALL_H
>  #define _ASM_SYSCALL_H	1
>  
> +#include <uapi/linux/audit.h>
> +#include <linux/compat.h>

You don't need linux/compat.h, I think, but you do need to include
linux/thread_info.h for is_32bit_task() below.

>  #include <linux/sched.h>
>  
>  /* ftrace syscalls requires exporting the sys_call_table */
> @@ -86,4 +88,14 @@ static inline void syscall_set_arguments(struct task_struct *task,
>  	memcpy(&regs->gpr[3 + i], args, n * sizeof(args[0]));
>  }
>  
> +static inline int syscall_get_arch(void)
> +{
> +	int arch = AUDIT_ARCH_PPC;
> +
> +#ifdef CONFIG_PPC64
> +	if (!is_32bit_task())
> +		arch = AUDIT_ARCH_PPC64;
> +#endif
> +	return arch;

This could just be

	return is_32bit_task() ? AUDIT_ARCH_PPC : AUDIT_ARCH_PPC64;

as is_32bit_task() is always defined (and is (1) for !CONFIG_PPC64).

-- 
Cheers,
Stephen Rothwell                    sfr@canb.auug.org.au

[-- Attachment #2: Type: application/pgp-signature, Size: 836 bytes --]