Commit 80100942 authored by Palmer Dabbelt's avatar Palmer Dabbelt

Fix a handful of audit-related issue

This is sort of a mix between a new feature and a bug fix.  I've managed
to screw up merging this patch set a handful of times but I think it's
OK this time around.  The main new feature here is audit support for
RISC-V, with some fixes to audit-related bugs that cropped up along the
way:

* The addition of NR_syscalls into unistd.h, which is necessary for
  CONFIG_FTRACE_SYSCALLS.
* The definition of CREATE_TRACE_POINTS so
  __tracepoint_sys_{enter,exit} get defined.
* A fix for trace_sys_exit() so we can enable
  CONFIG_HAVE_SYSCALL_TRACEPOINTS.
parents 2cffc956 5aeb1b36
...@@ -28,11 +28,13 @@ config RISCV ...@@ -28,11 +28,13 @@ config RISCV
select GENERIC_STRNLEN_USER select GENERIC_STRNLEN_USER
select GENERIC_SMP_IDLE_THREAD select GENERIC_SMP_IDLE_THREAD
select GENERIC_ATOMIC64 if !64BIT || !RISCV_ISA_A select GENERIC_ATOMIC64 if !64BIT || !RISCV_ISA_A
select HAVE_ARCH_AUDITSYSCALL
select HAVE_MEMBLOCK_NODE_MAP select HAVE_MEMBLOCK_NODE_MAP
select HAVE_DMA_CONTIGUOUS select HAVE_DMA_CONTIGUOUS
select HAVE_FUTEX_CMPXCHG if FUTEX select HAVE_FUTEX_CMPXCHG if FUTEX
select HAVE_GENERIC_DMA_COHERENT select HAVE_GENERIC_DMA_COHERENT
select HAVE_PERF_EVENTS select HAVE_PERF_EVENTS
select HAVE_SYSCALL_TRACEPOINTS
select IRQ_DOMAIN select IRQ_DOMAIN
select RISCV_ISA_A if SMP select RISCV_ISA_A if SMP
select SPARSE_IRQ select SPARSE_IRQ
......
...@@ -113,6 +113,11 @@ static inline void frame_pointer_set(struct pt_regs *regs, ...@@ -113,6 +113,11 @@ static inline void frame_pointer_set(struct pt_regs *regs,
SET_FP(regs, val); SET_FP(regs, val);
} }
static inline unsigned long regs_return_value(struct pt_regs *regs)
{
return regs->a0;
}
#endif /* __ASSEMBLY__ */ #endif /* __ASSEMBLY__ */
#endif /* _ASM_RISCV_PTRACE_H */ #endif /* _ASM_RISCV_PTRACE_H */
...@@ -18,6 +18,7 @@ ...@@ -18,6 +18,7 @@
#ifndef _ASM_RISCV_SYSCALL_H #ifndef _ASM_RISCV_SYSCALL_H
#define _ASM_RISCV_SYSCALL_H #define _ASM_RISCV_SYSCALL_H
#include <uapi/linux/audit.h>
#include <linux/sched.h> #include <linux/sched.h>
#include <linux/err.h> #include <linux/err.h>
...@@ -99,4 +100,13 @@ static inline void syscall_set_arguments(struct task_struct *task, ...@@ -99,4 +100,13 @@ static inline void syscall_set_arguments(struct task_struct *task,
memcpy(&regs->a1 + i * sizeof(regs->a1), args, n * sizeof(regs->a0)); memcpy(&regs->a1 + i * sizeof(regs->a1), args, n * sizeof(regs->a0));
} }
static inline int syscall_get_arch(void)
{
#ifdef CONFIG_64BIT
return AUDIT_ARCH_RISCV64;
#else
return AUDIT_ARCH_RISCV32;
#endif
}
#endif /* _ASM_RISCV_SYSCALL_H */ #endif /* _ASM_RISCV_SYSCALL_H */
...@@ -80,13 +80,19 @@ struct thread_info { ...@@ -80,13 +80,19 @@ struct thread_info {
#define TIF_RESTORE_SIGMASK 4 /* restore signal mask in do_signal() */ #define TIF_RESTORE_SIGMASK 4 /* restore signal mask in do_signal() */
#define TIF_MEMDIE 5 /* is terminating due to OOM killer */ #define TIF_MEMDIE 5 /* is terminating due to OOM killer */
#define TIF_SYSCALL_TRACEPOINT 6 /* syscall tracepoint instrumentation */ #define TIF_SYSCALL_TRACEPOINT 6 /* syscall tracepoint instrumentation */
#define TIF_SYSCALL_AUDIT 7 /* syscall auditing */
#define _TIF_SYSCALL_TRACE (1 << TIF_SYSCALL_TRACE) #define _TIF_SYSCALL_TRACE (1 << TIF_SYSCALL_TRACE)
#define _TIF_NOTIFY_RESUME (1 << TIF_NOTIFY_RESUME) #define _TIF_NOTIFY_RESUME (1 << TIF_NOTIFY_RESUME)
#define _TIF_SIGPENDING (1 << TIF_SIGPENDING) #define _TIF_SIGPENDING (1 << TIF_SIGPENDING)
#define _TIF_NEED_RESCHED (1 << TIF_NEED_RESCHED) #define _TIF_NEED_RESCHED (1 << TIF_NEED_RESCHED)
#define _TIF_SYSCALL_TRACEPOINT (1 << TIF_SYSCALL_TRACEPOINT)
#define _TIF_SYSCALL_AUDIT (1 << TIF_SYSCALL_AUDIT)
#define _TIF_WORK_MASK \ #define _TIF_WORK_MASK \
(_TIF_NOTIFY_RESUME | _TIF_SIGPENDING | _TIF_NEED_RESCHED) (_TIF_NOTIFY_RESUME | _TIF_SIGPENDING | _TIF_NEED_RESCHED)
#define _TIF_SYSCALL_WORK \
(_TIF_SYSCALL_TRACE | _TIF_SYSCALL_TRACEPOINT | _TIF_SYSCALL_AUDIT)
#endif /* _ASM_RISCV_THREAD_INFO_H */ #endif /* _ASM_RISCV_THREAD_INFO_H */
...@@ -19,3 +19,5 @@ ...@@ -19,3 +19,5 @@
#define __ARCH_WANT_SYS_CLONE #define __ARCH_WANT_SYS_CLONE
#include <uapi/asm/unistd.h> #include <uapi/asm/unistd.h>
#define NR_syscalls (__NR_syscalls)
...@@ -201,7 +201,7 @@ handle_syscall: ...@@ -201,7 +201,7 @@ handle_syscall:
REG_S s2, PT_SEPC(sp) REG_S s2, PT_SEPC(sp)
/* Trace syscalls, but only if requested by the user. */ /* Trace syscalls, but only if requested by the user. */
REG_L t0, TASK_TI_FLAGS(tp) REG_L t0, TASK_TI_FLAGS(tp)
andi t0, t0, _TIF_SYSCALL_TRACE andi t0, t0, _TIF_SYSCALL_WORK
bnez t0, handle_syscall_trace_enter bnez t0, handle_syscall_trace_enter
check_syscall_nr: check_syscall_nr:
/* Check to make sure we don't jump to a bogus syscall number. */ /* Check to make sure we don't jump to a bogus syscall number. */
...@@ -221,7 +221,7 @@ ret_from_syscall: ...@@ -221,7 +221,7 @@ ret_from_syscall:
REG_S a0, PT_A0(sp) REG_S a0, PT_A0(sp)
/* Trace syscalls, but only if requested by the user. */ /* Trace syscalls, but only if requested by the user. */
REG_L t0, TASK_TI_FLAGS(tp) REG_L t0, TASK_TI_FLAGS(tp)
andi t0, t0, _TIF_SYSCALL_TRACE andi t0, t0, _TIF_SYSCALL_WORK
bnez t0, handle_syscall_trace_exit bnez t0, handle_syscall_trace_exit
ret_from_exception: ret_from_exception:
......
...@@ -18,12 +18,15 @@ ...@@ -18,12 +18,15 @@
#include <asm/ptrace.h> #include <asm/ptrace.h>
#include <asm/syscall.h> #include <asm/syscall.h>
#include <asm/thread_info.h> #include <asm/thread_info.h>
#include <linux/audit.h>
#include <linux/ptrace.h> #include <linux/ptrace.h>
#include <linux/elf.h> #include <linux/elf.h>
#include <linux/regset.h> #include <linux/regset.h>
#include <linux/sched.h> #include <linux/sched.h>
#include <linux/sched/task_stack.h> #include <linux/sched/task_stack.h>
#include <linux/tracehook.h> #include <linux/tracehook.h>
#define CREATE_TRACE_POINTS
#include <trace/events/syscalls.h> #include <trace/events/syscalls.h>
enum riscv_regset { enum riscv_regset {
...@@ -163,15 +166,19 @@ void do_syscall_trace_enter(struct pt_regs *regs) ...@@ -163,15 +166,19 @@ void do_syscall_trace_enter(struct pt_regs *regs)
if (test_thread_flag(TIF_SYSCALL_TRACEPOINT)) if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
trace_sys_enter(regs, syscall_get_nr(current, regs)); trace_sys_enter(regs, syscall_get_nr(current, regs));
#endif #endif
audit_syscall_entry(regs->a7, regs->a0, regs->a1, regs->a2, regs->a3);
} }
void do_syscall_trace_exit(struct pt_regs *regs) void do_syscall_trace_exit(struct pt_regs *regs)
{ {
audit_syscall_exit(regs);
if (test_thread_flag(TIF_SYSCALL_TRACE)) if (test_thread_flag(TIF_SYSCALL_TRACE))
tracehook_report_syscall_exit(regs, 0); tracehook_report_syscall_exit(regs, 0);
#ifdef CONFIG_HAVE_SYSCALL_TRACEPOINTS #ifdef CONFIG_HAVE_SYSCALL_TRACEPOINTS
if (test_thread_flag(TIF_SYSCALL_TRACEPOINT)) if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
trace_sys_exit(regs, regs->regs[0]); trace_sys_exit(regs, regs_return_value(regs));
#endif #endif
} }
...@@ -400,6 +400,8 @@ enum { ...@@ -400,6 +400,8 @@ enum {
/* do not define AUDIT_ARCH_PPCLE since it is not supported by audit */ /* do not define AUDIT_ARCH_PPCLE since it is not supported by audit */
#define AUDIT_ARCH_PPC64 (EM_PPC64|__AUDIT_ARCH_64BIT) #define AUDIT_ARCH_PPC64 (EM_PPC64|__AUDIT_ARCH_64BIT)
#define AUDIT_ARCH_PPC64LE (EM_PPC64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE) #define AUDIT_ARCH_PPC64LE (EM_PPC64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
#define AUDIT_ARCH_RISCV32 (EM_RISCV|__AUDIT_ARCH_LE)
#define AUDIT_ARCH_RISCV64 (EM_RISCV|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
#define AUDIT_ARCH_S390 (EM_S390) #define AUDIT_ARCH_S390 (EM_S390)
#define AUDIT_ARCH_S390X (EM_S390|__AUDIT_ARCH_64BIT) #define AUDIT_ARCH_S390X (EM_S390|__AUDIT_ARCH_64BIT)
#define AUDIT_ARCH_SH (EM_SH) #define AUDIT_ARCH_SH (EM_SH)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment