xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge tag 'audit-pr-20190507' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit

Browse Source 
Pull audit updates from Paul Moore:
 "We've got a reasonably broad set of audit patches for the v5.2 merge
  window, the highlights are below:

   - The biggest change, and the source of all the arch/* changes, is
     the patchset from Dmitry to help enable some of the work he is
     doing around PTRACE_GET_SYSCALL_INFO.

     To be honest, including this in the audit tree is a bit of a
     stretch, but it does help move audit a little further along towards
     proper syscall auditing for all arches, and everyone else seemed to
     agree that audit was a "good" spot for this to land (or maybe they
     just didn't want to merge it? dunno.).

   - We can now audit time/NTP adjustments.

   - We continue the work to connect associated audit records into a
     single event"

* tag 'audit-pr-20190507' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit: (21 commits)
  audit: fix a memory leak bug
  ntp: Audit NTP parameters adjustment
  timekeeping: Audit clock adjustments
  audit: purge unnecessary list_empty calls
  audit: link integrity evm_write_xattrs record to syscall event
  syscall_get_arch: add "struct task_struct *" argument
  unicore32: define syscall_get_arch()
  Move EM_UNICORE to uapi/linux/elf-em.h
  nios2: define syscall_get_arch()
  nds32: define syscall_get_arch()
  Move EM_NDS32 to uapi/linux/elf-em.h
  m68k: define syscall_get_arch()
  hexagon: define syscall_get_arch()
  Move EM_HEXAGON to uapi/linux/elf-em.h
  h8300: define syscall_get_arch()
  c6x: define syscall_get_arch()
  arc: define syscall_get_arch()
  Move EM_ARCOMPACT and EM_ARCV2 to uapi/linux/elf-em.h
  audit: Make audit_log_cap and audit_copy_inode static
  audit: connect LOGIN record to its syscall record
  ...
This commit is contained in:
Linus Torvalds
2019-05-07 19:06:04 -07:00
parent f72dae2089 70c4cf17e4
commit 02aff8db64
43 changed files with 329 additions and 105 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
arch/alpha/include/asm/syscall.h
View File

@@ -4,7 +4,7 @@
#include <uapi/linux/audit.h> #include <uapi/linux/audit.h>
static inline int syscall_get_arch(void) static inline int syscall_get_arch(struct task_struct *task)
{ {
return AUDIT_ARCH_ALPHA; return AUDIT_ARCH_ALPHA;
} }

6
arch/arc/include/asm/elf.h
View File

@@ -10,13 +10,9 @@
#define __ASM_ARC_ELF_H #define __ASM_ARC_ELF_H
#include <linux/types.h> #include <linux/types.h>
#include <linux/elf-em.h>
#include <uapi/asm/elf.h> #include <uapi/asm/elf.h>
/* These ELF defines belong to uapi but libc elf.h already defines them */
#define EM_ARCOMPACT 93
#define EM_ARCV2 195 /* ARCv2 Cores */
#define EM_ARC_INUSE (IS_ENABLED(CONFIG_ISA_ARCOMPACT) ? \ #define EM_ARC_INUSE (IS_ENABLED(CONFIG_ISA_ARCOMPACT) ? \
EM_ARCOMPACT : EM_ARCV2) EM_ARCOMPACT : EM_ARCV2)

11
arch/arc/include/asm/syscall.h
View File

@@ -9,6 +9,7 @@
#ifndef _ASM_ARC_SYSCALL_H #ifndef _ASM_ARC_SYSCALL_H
#define _ASM_ARC_SYSCALL_H 1 #define _ASM_ARC_SYSCALL_H 1
#include <uapi/linux/audit.h>
#include <linux/err.h> #include <linux/err.h>
#include <linux/sched.h> #include <linux/sched.h>
#include <asm/unistd.h> #include <asm/unistd.h>
@@ -67,4 +68,14 @@ syscall_get_arguments(struct task_struct *task, struct pt_regs *regs,
} }
} }
static inline int
syscall_get_arch(struct task_struct *task)
{
return IS_ENABLED(CONFIG_ISA_ARCOMPACT)
? (IS_ENABLED(CONFIG_CPU_BIG_ENDIAN)
? AUDIT_ARCH_ARCOMPACTBE : AUDIT_ARCH_ARCOMPACT)
: (IS_ENABLED(CONFIG_CPU_BIG_ENDIAN)
? AUDIT_ARCH_ARCV2BE : AUDIT_ARCH_ARCV2);
}
#endif #endif

2
arch/arm/include/asm/syscall.h
View File

@@ -73,7 +73,7 @@ static inline void syscall_set_arguments(struct task_struct *task,
memcpy(&regs->ARM_r0 + 1, args, 5 * sizeof(args[0])); memcpy(&regs->ARM_r0 + 1, args, 5 * sizeof(args[0]));
} }
static inline int syscall_get_arch(void) static inline int syscall_get_arch(struct task_struct *task)
{ {
/* ARM tasks don't change audit architectures on the fly. */ /* ARM tasks don't change audit architectures on the fly. */
return AUDIT_ARCH_ARM; return AUDIT_ARCH_ARM;

4
arch/arm64/include/asm/syscall.h
View File

@@ -87,9 +87,9 @@ static inline void syscall_set_arguments(struct task_struct *task,
* We don't care about endianness (__AUDIT_ARCH_LE bit) here because * We don't care about endianness (__AUDIT_ARCH_LE bit) here because
* AArch64 has the same system calls both on little- and big- endian. * AArch64 has the same system calls both on little- and big- endian.
*/ */
static inline int syscall_get_arch(void) static inline int syscall_get_arch(struct task_struct *task)
{ {
if (is_compat_task()) if (is_compat_thread(task_thread_info(task)))
return AUDIT_ARCH_ARM; return AUDIT_ARCH_ARM;
return AUDIT_ARCH_AARCH64; return AUDIT_ARCH_AARCH64;

7
arch/c6x/include/asm/syscall.h
View File

@@ -11,6 +11,7 @@
#ifndef __ASM_C6X_SYSCALL_H #ifndef __ASM_C6X_SYSCALL_H
#define __ASM_C6X_SYSCALL_H #define __ASM_C6X_SYSCALL_H
#include <uapi/linux/audit.h>
#include <linux/err.h> #include <linux/err.h>
#include <linux/sched.h> #include <linux/sched.h>
@@ -69,4 +70,10 @@ static inline void syscall_set_arguments(struct task_struct *task,
regs->a9 = *args; regs->a9 = *args;
} }
static inline int syscall_get_arch(struct task_struct *task)
{
return IS_ENABLED(CONFIG_CPU_BIG_ENDIAN)
? AUDIT_ARCH_C6XBE : AUDIT_ARCH_C6X;
}
#endif /* __ASM_C6X_SYSCALLS_H */ #endif /* __ASM_C6X_SYSCALLS_H */

2
arch/csky/include/asm/syscall.h
View File

@@ -60,7 +60,7 @@ syscall_set_arguments(struct task_struct *task, struct pt_regs *regs,
} }
static inline int static inline int
syscall_get_arch(void) syscall_get_arch(struct task_struct *task)
{ {
return AUDIT_ARCH_CSKY; return AUDIT_ARCH_CSKY;
} }

6
arch/h8300/include/asm/syscall.h
View File

@@ -8,6 +8,7 @@
#include <linux/linkage.h> #include <linux/linkage.h>
#include <linux/types.h> #include <linux/types.h>
#include <linux/ptrace.h> #include <linux/ptrace.h>
#include <uapi/linux/audit.h>
static inline int static inline int
syscall_get_nr(struct task_struct *task, struct pt_regs *regs) syscall_get_nr(struct task_struct *task, struct pt_regs *regs)
@@ -27,6 +28,11 @@ syscall_get_arguments(struct task_struct *task, struct pt_regs *regs,
*args = regs->er6; *args = regs->er6;
} }
static inline int
syscall_get_arch(struct task_struct *task)
{
return AUDIT_ARCH_H8300;
}
/* Misc syscall related bits */ /* Misc syscall related bits */

6
arch/hexagon/include/asm/elf.h
View File

@@ -23,11 +23,7 @@
#include <asm/ptrace.h> #include <asm/ptrace.h>
#include <asm/user.h> #include <asm/user.h>
#include <linux/elf-em.h>
/*
* This should really be in linux/elf-em.h.
*/
#define EM_HEXAGON 164 /* QUALCOMM Hexagon */
struct elf32_hdr; struct elf32_hdr;

8
arch/hexagon/include/asm/syscall.h
View File

@@ -21,6 +21,8 @@
#ifndef _ASM_HEXAGON_SYSCALL_H #ifndef _ASM_HEXAGON_SYSCALL_H
#define _ASM_HEXAGON_SYSCALL_H #define _ASM_HEXAGON_SYSCALL_H
#include <uapi/linux/audit.h>
typedef long (*syscall_fn)(unsigned long, unsigned long, typedef long (*syscall_fn)(unsigned long, unsigned long,
unsigned long, unsigned long, unsigned long, unsigned long,
unsigned long, unsigned long); unsigned long, unsigned long);
@@ -41,4 +43,10 @@ static inline void syscall_get_arguments(struct task_struct *task,
{ {
memcpy(args, &(&regs->r00)[0], 6 * sizeof(args[0])); memcpy(args, &(&regs->r00)[0], 6 * sizeof(args[0]));
} }
static inline int syscall_get_arch(struct task_struct *task)
{
return AUDIT_ARCH_HEXAGON;
}
#endif #endif

2
arch/ia64/include/asm/syscall.h
View File

@@ -74,7 +74,7 @@ static inline void syscall_set_arguments(struct task_struct *task,
ia64_syscall_get_set_arguments(task, regs, args, 1); ia64_syscall_get_set_arguments(task, regs, args, 1);
} }
static inline int syscall_get_arch(void) static inline int syscall_get_arch(struct task_struct *task)
{ {
return AUDIT_ARCH_IA64; return AUDIT_ARCH_IA64;
} }

12
arch/m68k/include/asm/syscall.h Normal file
View File

@@ -0,0 +1,12 @@
/* SPDX-License-Identifier: GPL-2.0 */
#ifndef _ASM_M68K_SYSCALL_H
#define _ASM_M68K_SYSCALL_H
#include <uapi/linux/audit.h>
static inline int syscall_get_arch(struct task_struct *task)
{
return AUDIT_ARCH_M68K;
}
#endif /* _ASM_M68K_SYSCALL_H */

2
arch/microblaze/include/asm/syscall.h
View File

@@ -105,7 +105,7 @@ static inline void syscall_set_arguments(struct task_struct *task,
asmlinkage unsigned long do_syscall_trace_enter(struct pt_regs *regs); asmlinkage unsigned long do_syscall_trace_enter(struct pt_regs *regs);
asmlinkage void do_syscall_trace_leave(struct pt_regs *regs); asmlinkage void do_syscall_trace_leave(struct pt_regs *regs);
static inline int syscall_get_arch(void) static inline int syscall_get_arch(struct task_struct *task)
{ {
return AUDIT_ARCH_MICROBLAZE; return AUDIT_ARCH_MICROBLAZE;
} }

6
arch/mips/include/asm/syscall.h
View File

@@ -141,14 +141,14 @@ extern const unsigned long sys_call_table[];
extern const unsigned long sys32_call_table[]; extern const unsigned long sys32_call_table[];
extern const unsigned long sysn32_call_table[]; extern const unsigned long sysn32_call_table[];
static inline int syscall_get_arch(void) static inline int syscall_get_arch(struct task_struct *task)
{ {
int arch = AUDIT_ARCH_MIPS; int arch = AUDIT_ARCH_MIPS;
#ifdef CONFIG_64BIT #ifdef CONFIG_64BIT
if (!test_thread_flag(TIF_32BIT_REGS)) { if (!test_tsk_thread_flag(task, TIF_32BIT_REGS)) {
arch |= __AUDIT_ARCH_64BIT; arch |= __AUDIT_ARCH_64BIT;
/* N32 sets only TIF_32BIT_ADDR */ /* N32 sets only TIF_32BIT_ADDR */
if (test_thread_flag(TIF_32BIT_ADDR)) if (test_tsk_thread_flag(task, TIF_32BIT_ADDR))
arch |= __AUDIT_ARCH_CONVENTION_MIPS64_N32; arch |= __AUDIT_ARCH_CONVENTION_MIPS64_N32;
} }
#endif #endif

2
arch/mips/kernel/ptrace.c
View File

@@ -1418,7 +1418,7 @@ asmlinkage long syscall_trace_enter(struct pt_regs *regs, long syscall)
unsigned long args[6]; unsigned long args[6];
sd.nr = syscall; sd.nr = syscall;
sd.arch = syscall_get_arch(); sd.arch = syscall_get_arch(current);
syscall_get_arguments(current, regs, args); syscall_get_arguments(current, regs, args);
for (i = 0; i < 6; i++) for (i = 0; i < 6; i++)
sd.args[i] = args[i]; sd.args[i] = args[i];

3
arch/nds32/include/asm/elf.h
View File

@@ -10,14 +10,13 @@
#include <asm/ptrace.h> #include <asm/ptrace.h>
#include <asm/fpu.h> #include <asm/fpu.h>
#include <linux/elf-em.h>
typedef unsigned long elf_greg_t; typedef unsigned long elf_greg_t;
typedef unsigned long elf_freg_t[3]; typedef unsigned long elf_freg_t[3];
extern unsigned int elf_hwcap; extern unsigned int elf_hwcap;
#define EM_NDS32 167
#define R_NDS32_NONE 0 #define R_NDS32_NONE 0
#define R_NDS32_16_RELA 19 #define R_NDS32_16_RELA 19
#define R_NDS32_32_RELA 20 #define R_NDS32_32_RELA 20

9
arch/nds32/include/asm/syscall.h
View File

@@ -5,6 +5,7 @@
#ifndef _ASM_NDS32_SYSCALL_H #ifndef _ASM_NDS32_SYSCALL_H
#define _ASM_NDS32_SYSCALL_H 1 #define _ASM_NDS32_SYSCALL_H 1
#include <uapi/linux/audit.h>
#include <linux/err.h> #include <linux/err.h>
struct task_struct; struct task_struct;
struct pt_regs; struct pt_regs;
@@ -145,4 +146,12 @@ void syscall_set_arguments(struct task_struct *task, struct pt_regs *regs,
memcpy(&regs->uregs[0] + 1, args, 5 * sizeof(args[0])); memcpy(&regs->uregs[0] + 1, args, 5 * sizeof(args[0]));
} }
static inline int
syscall_get_arch(struct task_struct *task)
{
return IS_ENABLED(CONFIG_CPU_BIG_ENDIAN)
? AUDIT_ARCH_NDS32BE : AUDIT_ARCH_NDS32;
}
#endif /* _ASM_NDS32_SYSCALL_H */ #endif /* _ASM_NDS32_SYSCALL_H */

6
arch/nios2/include/asm/syscall.h
View File

@@ -17,6 +17,7 @@
#ifndef __ASM_NIOS2_SYSCALL_H__ #ifndef __ASM_NIOS2_SYSCALL_H__
#define __ASM_NIOS2_SYSCALL_H__ #define __ASM_NIOS2_SYSCALL_H__
#include <uapi/linux/audit.h>
#include <linux/err.h> #include <linux/err.h>
#include <linux/sched.h> #include <linux/sched.h>
@@ -79,4 +80,9 @@ static inline void syscall_set_arguments(struct task_struct *task,
regs->r9 = *args; regs->r9 = *args;
} }
static inline int syscall_get_arch(struct task_struct *task)
{
return AUDIT_ARCH_NIOS2;
}
#endif #endif

2
arch/openrisc/include/asm/syscall.h
View File

@@ -68,7 +68,7 @@ syscall_set_arguments(struct task_struct *task, struct pt_regs *regs,
memcpy(&regs->gpr[3], args, 6 * sizeof(args[0])); memcpy(&regs->gpr[3], args, 6 * sizeof(args[0]));
} }
static inline int syscall_get_arch(void) static inline int syscall_get_arch(struct task_struct *task)
{ {
return AUDIT_ARCH_OPENRISC; return AUDIT_ARCH_OPENRISC;
} }

4
arch/parisc/include/asm/syscall.h
View File

@@ -48,11 +48,11 @@ static inline void syscall_rollback(struct task_struct *task,
/* do nothing */ /* do nothing */
} }
static inline int syscall_get_arch(void) static inline int syscall_get_arch(struct task_struct *task)
{ {
int arch = AUDIT_ARCH_PARISC; int arch = AUDIT_ARCH_PARISC;
#ifdef CONFIG_64BIT #ifdef CONFIG_64BIT
if (!is_compat_task()) if (!__is_compat_task(task))
arch = AUDIT_ARCH_PARISC64; arch = AUDIT_ARCH_PARISC64;
#endif #endif
return arch; return arch;

10
arch/powerpc/include/asm/syscall.h
View File

@@ -94,9 +94,15 @@ static inline void syscall_set_arguments(struct task_struct *task,
regs->orig_gpr3 = args[0]; regs->orig_gpr3 = args[0];
} }
static inline int syscall_get_arch(void) static inline int syscall_get_arch(struct task_struct *task)
{ {
int arch = is_32bit_task() ? AUDIT_ARCH_PPC : AUDIT_ARCH_PPC64; int arch;
if (IS_ENABLED(CONFIG_PPC64) && !test_tsk_thread_flag(task, TIF_32BIT))
arch = AUDIT_ARCH_PPC64;
else
arch = AUDIT_ARCH_PPC;
#ifdef __LITTLE_ENDIAN__ #ifdef __LITTLE_ENDIAN__
arch |= __AUDIT_ARCH_LE; arch |= __AUDIT_ARCH_LE;
#endif #endif

2
arch/riscv/include/asm/syscall.h
View File

@@ -88,7 +88,7 @@ static inline void syscall_set_arguments(struct task_struct *task,
memcpy(&regs->a1, args, 5 * sizeof(regs->a1)); memcpy(&regs->a1, args, 5 * sizeof(regs->a1));
} }
static inline int syscall_get_arch(void) static inline int syscall_get_arch(struct task_struct *task)
{ {
#ifdef CONFIG_64BIT #ifdef CONFIG_64BIT
return AUDIT_ARCH_RISCV64; return AUDIT_ARCH_RISCV64;

4
arch/s390/include/asm/syscall.h
View File

@@ -79,10 +79,10 @@ static inline void syscall_set_arguments(struct task_struct *task,
regs->orig_gpr2 = args[0]; regs->orig_gpr2 = args[0];
} }
static inline int syscall_get_arch(void) static inline int syscall_get_arch(struct task_struct *task)
{ {
#ifdef CONFIG_COMPAT #ifdef CONFIG_COMPAT
if (test_tsk_thread_flag(current, TIF_31BIT)) if (test_tsk_thread_flag(task, TIF_31BIT))
return AUDIT_ARCH_S390; return AUDIT_ARCH_S390;
#endif #endif
return AUDIT_ARCH_S390X; return AUDIT_ARCH_S390X;

2
arch/sh/include/asm/syscall_32.h
View File

@@ -72,7 +72,7 @@ static inline void syscall_set_arguments(struct task_struct *task,
regs->regs[4] = args[0]; regs->regs[4] = args[0];
} }
static inline int syscall_get_arch(void) static inline int syscall_get_arch(struct task_struct *task)
{ {
int arch = AUDIT_ARCH_SH; int arch = AUDIT_ARCH_SH;

2
arch/sh/include/asm/syscall_64.h
View File

@@ -59,7 +59,7 @@ static inline void syscall_set_arguments(struct task_struct *task,
memcpy(&regs->regs[2], args, 6 * sizeof(args[0])); memcpy(&regs->regs[2], args, 6 * sizeof(args[0]));
} }
static inline int syscall_get_arch(void) static inline int syscall_get_arch(struct task_struct *task)
{ {
int arch = AUDIT_ARCH_SH; int arch = AUDIT_ARCH_SH;

5
arch/sparc/include/asm/syscall.h
View File

@@ -127,10 +127,11 @@ static inline void syscall_set_arguments(struct task_struct *task,
regs->u_regs[UREG_I0 + i] = args[i]; regs->u_regs[UREG_I0 + i] = args[i];
} }
static inline int syscall_get_arch(void) static inline int syscall_get_arch(struct task_struct *task)
{ {
#if defined(CONFIG_SPARC64) && defined(CONFIG_COMPAT) #if defined(CONFIG_SPARC64) && defined(CONFIG_COMPAT)
return in_compat_syscall() ? AUDIT_ARCH_SPARC : AUDIT_ARCH_SPARC64; return test_tsk_thread_flag(task, TIF_32BIT)
? AUDIT_ARCH_SPARC : AUDIT_ARCH_SPARC64;
#elif defined(CONFIG_SPARC64) #elif defined(CONFIG_SPARC64)
return AUDIT_ARCH_SPARC64; return AUDIT_ARCH_SPARC64;
#else #else

3
arch/unicore32/include/asm/elf.h
View File

@@ -19,6 +19,7 @@
* ELF register definitions.. * ELF register definitions..
*/ */
#include <asm/ptrace.h> #include <asm/ptrace.h>
#include <linux/elf-em.h>
typedef unsigned long elf_greg_t; typedef unsigned long elf_greg_t;
typedef unsigned long elf_freg_t[3]; typedef unsigned long elf_freg_t[3];
@@ -28,8 +29,6 @@ typedef elf_greg_t elf_gregset_t[ELF_NGREG];
typedef struct fp_state elf_fpregset_t; typedef struct fp_state elf_fpregset_t;
#define EM_UNICORE 110
#define R_UNICORE_NONE 0 #define R_UNICORE_NONE 0
#define R_UNICORE_PC24 1 #define R_UNICORE_PC24 1
#define R_UNICORE_ABS32 2 #define R_UNICORE_ABS32 2

12
arch/unicore32/include/asm/syscall.h Normal file
View File

@@ -0,0 +1,12 @@
/* SPDX-License-Identifier: GPL-2.0 */
#ifndef _ASM_UNICORE_SYSCALL_H
#define _ASM_UNICORE_SYSCALL_H
#include <uapi/linux/audit.h>
static inline int syscall_get_arch(struct task_struct *task)
{
return AUDIT_ARCH_UNICORE;
}
#endif /* _ASM_UNICORE_SYSCALL_H */

8
arch/x86/include/asm/syscall.h
View File

@@ -105,7 +105,7 @@ static inline void syscall_set_arguments(struct task_struct *task,
memcpy(&regs->bx + i, args, n * sizeof(args[0])); memcpy(&regs->bx + i, args, n * sizeof(args[0]));
} }
static inline int syscall_get_arch(void) static inline int syscall_get_arch(struct task_struct *task)
{ {
return AUDIT_ARCH_I386; return AUDIT_ARCH_I386;
} }
@@ -160,10 +160,12 @@ static inline void syscall_set_arguments(struct task_struct *task,
} }
} }
static inline int syscall_get_arch(void) static inline int syscall_get_arch(struct task_struct *task)
{ {
/* x32 tasks should be considered AUDIT_ARCH_X86_64. */ /* x32 tasks should be considered AUDIT_ARCH_X86_64. */
return in_ia32_syscall() ? AUDIT_ARCH_I386 : AUDIT_ARCH_X86_64; return (IS_ENABLED(CONFIG_IA32_EMULATION) &&
task->thread_info.status & TS_COMPAT)
? AUDIT_ARCH_I386 : AUDIT_ARCH_X86_64;
} }
#endif /* CONFIG_X86_32 */ #endif /* CONFIG_X86_32 */

2
arch/x86/um/asm/syscall.h
View File

@@ -9,7 +9,7 @@ typedef asmlinkage long (*sys_call_ptr_t)(unsigned long, unsigned long,
unsigned long, unsigned long, unsigned long, unsigned long,
unsigned long, unsigned long); unsigned long, unsigned long);
static inline int syscall_get_arch(void) static inline int syscall_get_arch(struct task_struct *task)
{ {
#ifdef CONFIG_X86_32 #ifdef CONFIG_X86_32
return AUDIT_ARCH_I386; return AUDIT_ARCH_I386;

2
arch/xtensa/include/asm/syscall.h
View File

@@ -14,7 +14,7 @@
#include <asm/ptrace.h> #include <asm/ptrace.h>
#include <uapi/linux/audit.h> #include <uapi/linux/audit.h>
static inline int syscall_get_arch(void) static inline int syscall_get_arch(struct task_struct *task)
{ {
return AUDIT_ARCH_XTENSA; return AUDIT_ARCH_XTENSA;
} }

5
include/asm-generic/syscall.h
View File

@@ -133,14 +133,15 @@ void syscall_set_arguments(struct task_struct *task, struct pt_regs *regs,
/** /**
* syscall_get_arch - return the AUDIT_ARCH for the current system call * syscall_get_arch - return the AUDIT_ARCH for the current system call
* @task: task of interest, must be blocked
* *
* Returns the AUDIT_ARCH_* based on the system call convention in use. * Returns the AUDIT_ARCH_* based on the system call convention in use.
* *
* It's only valid to call this when current is stopped on entry to a system * It's only valid to call this when @task is stopped on entry to a system
* call, due to %TIF_SYSCALL_TRACE, %TIF_SYSCALL_AUDIT, or %TIF_SECCOMP. * call, due to %TIF_SYSCALL_TRACE, %TIF_SYSCALL_AUDIT, or %TIF_SECCOMP.
* *
* Architectures which permit CONFIG_HAVE_ARCH_SECCOMP_FILTER must * Architectures which permit CONFIG_HAVE_ARCH_SECCOMP_FILTER must
* provide an implementation of this. * provide an implementation of this.
*/ */
int syscall_get_arch(void); int syscall_get_arch(struct task_struct *task);
#endif /* _ASM_SYSCALL_H */ #endif /* _ASM_SYSCALL_H */

75
include/linux/audit.h
View File

@@ -86,6 +86,29 @@ struct audit_field {
u32 op; u32 op;
}; };
enum audit_ntp_type {
AUDIT_NTP_OFFSET,
AUDIT_NTP_FREQ,
AUDIT_NTP_STATUS,
AUDIT_NTP_TAI,
AUDIT_NTP_TICK,
AUDIT_NTP_ADJUST,
AUDIT_NTP_NVALS /* count */
};
#ifdef CONFIG_AUDITSYSCALL
struct audit_ntp_val {
long long oldval, newval;
};
struct audit_ntp_data {
struct audit_ntp_val vals[AUDIT_NTP_NVALS];
};
#else
struct audit_ntp_data {};
#endif
extern int is_audit_feature_set(int which); extern int is_audit_feature_set(int which);
extern int __init audit_register_class(int class, unsigned *list); extern int __init audit_register_class(int class, unsigned *list);
@@ -365,6 +388,8 @@ extern void __audit_log_capset(const struct cred *new, const struct cred *old);
extern void __audit_mmap_fd(int fd, int flags); extern void __audit_mmap_fd(int fd, int flags);
extern void __audit_log_kern_module(char *name); extern void __audit_log_kern_module(char *name);
extern void __audit_fanotify(unsigned int response); extern void __audit_fanotify(unsigned int response);
extern void __audit_tk_injoffset(struct timespec64 offset);
extern void __audit_ntp_log(const struct audit_ntp_data *ad);
static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp) static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp)
{ {
@@ -467,6 +492,39 @@ static inline void audit_fanotify(unsigned int response)
__audit_fanotify(response); __audit_fanotify(response);
} }
static inline void audit_tk_injoffset(struct timespec64 offset)
{
/* ignore no-op events */
if (offset.tv_sec == 0 && offset.tv_nsec == 0)
return;
if (!audit_dummy_context())
__audit_tk_injoffset(offset);
}
static inline void audit_ntp_init(struct audit_ntp_data *ad)
{
memset(ad, 0, sizeof(*ad));
}
static inline void audit_ntp_set_old(struct audit_ntp_data *ad,
enum audit_ntp_type type, long long val)
{
ad->vals[type].oldval = val;
}
static inline void audit_ntp_set_new(struct audit_ntp_data *ad,
enum audit_ntp_type type, long long val)
{
ad->vals[type].newval = val;
}
static inline void audit_ntp_log(const struct audit_ntp_data *ad)
{
if (!audit_dummy_context())
__audit_ntp_log(ad);
}
extern int audit_n_rules; extern int audit_n_rules;
extern int audit_signals; extern int audit_signals;
#else /* CONFIG_AUDITSYSCALL */ #else /* CONFIG_AUDITSYSCALL */
@@ -580,6 +638,23 @@ static inline void audit_log_kern_module(char *name)
static inline void audit_fanotify(unsigned int response) static inline void audit_fanotify(unsigned int response)
{ } { }
static inline void audit_tk_injoffset(struct timespec64 offset)
{ }
static inline void audit_ntp_init(struct audit_ntp_data *ad)
{ }
static inline void audit_ntp_set_old(struct audit_ntp_data *ad,
enum audit_ntp_type type, long long val)
{ }
static inline void audit_ntp_set_new(struct audit_ntp_data *ad,
enum audit_ntp_type type, long long val)
{ }
static inline void audit_ntp_log(const struct audit_ntp_data *ad)
{ }
static inline void audit_ptrace(struct task_struct *t) static inline void audit_ptrace(struct task_struct *t)
{ } { }
#define audit_n_rules 0 #define audit_n_rules 0

14
include/uapi/linux/audit.h
View File

@@ -114,6 +114,8 @@
#define AUDIT_REPLACE 1329 /* Replace auditd if this packet unanswerd */ #define AUDIT_REPLACE 1329 /* Replace auditd if this packet unanswerd */
#define AUDIT_KERN_MODULE 1330 /* Kernel Module events */ #define AUDIT_KERN_MODULE 1330 /* Kernel Module events */
#define AUDIT_FANOTIFY 1331 /* Fanotify access decision */ #define AUDIT_FANOTIFY 1331 /* Fanotify access decision */
#define AUDIT_TIME_INJOFFSET 1332 /* Timekeeping offset injected */
#define AUDIT_TIME_ADJNTPVAL 1333 /* NTP value adjustment */
#define AUDIT_AVC 1400 /* SE Linux avc denial or grant */ #define AUDIT_AVC 1400 /* SE Linux avc denial or grant */
#define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */ #define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */
@@ -375,11 +377,19 @@ enum {
#define AUDIT_ARCH_AARCH64 (EM_AARCH64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE) #define AUDIT_ARCH_AARCH64 (EM_AARCH64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
#define AUDIT_ARCH_ALPHA (EM_ALPHA|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE) #define AUDIT_ARCH_ALPHA (EM_ALPHA|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
#define AUDIT_ARCH_ARCOMPACT (EM_ARCOMPACT|__AUDIT_ARCH_LE)
#define AUDIT_ARCH_ARCOMPACTBE (EM_ARCOMPACT)
#define AUDIT_ARCH_ARCV2 (EM_ARCV2|__AUDIT_ARCH_LE)
#define AUDIT_ARCH_ARCV2BE (EM_ARCV2)
#define AUDIT_ARCH_ARM (EM_ARM|__AUDIT_ARCH_LE) #define AUDIT_ARCH_ARM (EM_ARM|__AUDIT_ARCH_LE)
#define AUDIT_ARCH_ARMEB (EM_ARM) #define AUDIT_ARCH_ARMEB (EM_ARM)
#define AUDIT_ARCH_C6X (EM_TI_C6000|__AUDIT_ARCH_LE)
#define AUDIT_ARCH_C6XBE (EM_TI_C6000)
#define AUDIT_ARCH_CRIS (EM_CRIS|__AUDIT_ARCH_LE) #define AUDIT_ARCH_CRIS (EM_CRIS|__AUDIT_ARCH_LE)
#define AUDIT_ARCH_CSKY (EM_CSKY|__AUDIT_ARCH_LE) #define AUDIT_ARCH_CSKY (EM_CSKY|__AUDIT_ARCH_LE)
#define AUDIT_ARCH_FRV (EM_FRV) #define AUDIT_ARCH_FRV (EM_FRV)
#define AUDIT_ARCH_H8300 (EM_H8_300)
#define AUDIT_ARCH_HEXAGON (EM_HEXAGON)
#define AUDIT_ARCH_I386 (EM_386|__AUDIT_ARCH_LE) #define AUDIT_ARCH_I386 (EM_386|__AUDIT_ARCH_LE)
#define AUDIT_ARCH_IA64 (EM_IA_64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE) #define AUDIT_ARCH_IA64 (EM_IA_64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
#define AUDIT_ARCH_M32R (EM_M32R) #define AUDIT_ARCH_M32R (EM_M32R)
@@ -393,6 +403,9 @@ enum {
#define AUDIT_ARCH_MIPSEL64 (EM_MIPS|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE) #define AUDIT_ARCH_MIPSEL64 (EM_MIPS|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
#define AUDIT_ARCH_MIPSEL64N32 (EM_MIPS|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE|\ #define AUDIT_ARCH_MIPSEL64N32 (EM_MIPS|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE|\
__AUDIT_ARCH_CONVENTION_MIPS64_N32) __AUDIT_ARCH_CONVENTION_MIPS64_N32)
#define AUDIT_ARCH_NDS32 (EM_NDS32|__AUDIT_ARCH_LE)
#define AUDIT_ARCH_NDS32BE (EM_NDS32)
#define AUDIT_ARCH_NIOS2 (EM_ALTERA_NIOS2|__AUDIT_ARCH_LE)
#define AUDIT_ARCH_OPENRISC (EM_OPENRISC) #define AUDIT_ARCH_OPENRISC (EM_OPENRISC)
#define AUDIT_ARCH_PARISC (EM_PARISC) #define AUDIT_ARCH_PARISC (EM_PARISC)
#define AUDIT_ARCH_PARISC64 (EM_PARISC|__AUDIT_ARCH_64BIT) #define AUDIT_ARCH_PARISC64 (EM_PARISC|__AUDIT_ARCH_64BIT)
@@ -413,6 +426,7 @@ enum {
#define AUDIT_ARCH_TILEGX (EM_TILEGX|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE) #define AUDIT_ARCH_TILEGX (EM_TILEGX|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
#define AUDIT_ARCH_TILEGX32 (EM_TILEGX|__AUDIT_ARCH_LE) #define AUDIT_ARCH_TILEGX32 (EM_TILEGX|__AUDIT_ARCH_LE)
#define AUDIT_ARCH_TILEPRO (EM_TILEPRO|__AUDIT_ARCH_LE) #define AUDIT_ARCH_TILEPRO (EM_TILEPRO|__AUDIT_ARCH_LE)
#define AUDIT_ARCH_UNICORE (EM_UNICORE|__AUDIT_ARCH_LE)
#define AUDIT_ARCH_X86_64 (EM_X86_64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE) #define AUDIT_ARCH_X86_64 (EM_X86_64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
#define AUDIT_ARCH_XTENSA (EM_XTENSA) #define AUDIT_ARCH_XTENSA (EM_XTENSA)

6
include/uapi/linux/elf-em.h
View File

@@ -34,14 +34,20 @@
#define EM_M32R 88 /* Renesas M32R */ #define EM_M32R 88 /* Renesas M32R */
#define EM_MN10300 89 /* Panasonic/MEI MN10300, AM33 */ #define EM_MN10300 89 /* Panasonic/MEI MN10300, AM33 */
#define EM_OPENRISC 92 /* OpenRISC 32-bit embedded processor */ #define EM_OPENRISC 92 /* OpenRISC 32-bit embedded processor */
#define EM_ARCOMPACT 93 /* ARCompact processor */
#define EM_XTENSA 94 /* Tensilica Xtensa Architecture */ #define EM_XTENSA 94 /* Tensilica Xtensa Architecture */
#define EM_BLACKFIN 106 /* ADI Blackfin Processor */ #define EM_BLACKFIN 106 /* ADI Blackfin Processor */
#define EM_UNICORE 110 /* UniCore-32 */
#define EM_ALTERA_NIOS2 113 /* Altera Nios II soft-core processor */ #define EM_ALTERA_NIOS2 113 /* Altera Nios II soft-core processor */
#define EM_TI_C6000 140 /* TI C6X DSPs */ #define EM_TI_C6000 140 /* TI C6X DSPs */
#define EM_HEXAGON 164 /* QUALCOMM Hexagon */
#define EM_NDS32 167 /* Andes Technology compact code size
embedded RISC processor family */
#define EM_AARCH64 183 /* ARM 64 bit */ #define EM_AARCH64 183 /* ARM 64 bit */
#define EM_TILEPRO 188 /* Tilera TILEPro */ #define EM_TILEPRO 188 /* Tilera TILEPro */
#define EM_MICROBLAZE 189 /* Xilinx MicroBlaze */ #define EM_MICROBLAZE 189 /* Xilinx MicroBlaze */
#define EM_TILEGX 191 /* Tilera TILE-Gx */ #define EM_TILEGX 191 /* Tilera TILE-Gx */
#define EM_ARCV2 195 /* ARCv2 Cores */
#define EM_RISCV 243 /* RISC-V */ #define EM_RISCV 243 /* RISC-V */
#define EM_BPF 247 /* Linux BPF - in-kernel virtual machine */ #define EM_BPF 247 /* Linux BPF - in-kernel virtual machine */
#define EM_CSKY 252 /* C-SKY */ #define EM_CSKY 252 /* C-SKY */

2
kernel/audit.c
View File

@@ -2220,7 +2220,7 @@ static void audit_log_set_loginuid(kuid_t koldloginuid, kuid_t kloginuid,
if (!audit_enabled) if (!audit_enabled)
return; return;
ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_LOGIN); ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_LOGIN);
if (!ab) if (!ab)
return; return;

14
kernel/auditfilter.c
View File

@@ -1114,22 +1114,24 @@ int audit_rule_change(int type, int seq, void *data, size_t datasz)
int err = 0; int err = 0;
struct audit_entry *entry; struct audit_entry *entry;
entry = audit_data_to_entry(data, datasz);
if (IS_ERR(entry))
return PTR_ERR(entry);
switch (type) { switch (type) {
case AUDIT_ADD_RULE: case AUDIT_ADD_RULE:
entry = audit_data_to_entry(data, datasz);
if (IS_ERR(entry))
return PTR_ERR(entry);
err = audit_add_rule(entry); err = audit_add_rule(entry);
audit_log_rule_change("add_rule", &entry->rule, !err); audit_log_rule_change("add_rule", &entry->rule, !err);
break; break;
case AUDIT_DEL_RULE: case AUDIT_DEL_RULE:
entry = audit_data_to_entry(data, datasz);
if (IS_ERR(entry))
return PTR_ERR(entry);
err = audit_del_rule(entry); err = audit_del_rule(entry);
audit_log_rule_change("remove_rule", &entry->rule, !err); audit_log_rule_change("remove_rule", &entry->rule, !err);
break; break;
default: default:
err = -EINVAL;
WARN_ON(1); WARN_ON(1);
return -EINVAL;
} }
if (err || type == AUDIT_DEL_RULE) { if (err || type == AUDIT_DEL_RULE) {
@@ -1315,8 +1317,6 @@ int audit_filter(int msgtype, unsigned int listtype)
int ret = 1; /* Audit by default */ int ret = 1; /* Audit by default */
rcu_read_lock(); rcu_read_lock();
if (list_empty(&audit_filter_list[listtype]))
goto unlock_and_return;
list_for_each_entry_rcu(e, &audit_filter_list[listtype], list) { list_for_each_entry_rcu(e, &audit_filter_list[listtype], list) {
int i, result = 0; int i, result = 0;

111
kernel/auditsc.c
View File

@@ -771,15 +771,13 @@ static enum audit_state audit_filter_syscall(struct task_struct *tsk,
return AUDIT_DISABLED; return AUDIT_DISABLED;
rcu_read_lock(); rcu_read_lock();
if (!list_empty(list)) { list_for_each_entry_rcu(e, list, list) {
list_for_each_entry_rcu(e, list, list) { if (audit_in_mask(&e->rule, ctx->major) &&
if (audit_in_mask(&e->rule, ctx->major) && audit_filter_rules(tsk, &e->rule, ctx, NULL,
audit_filter_rules(tsk, &e->rule, ctx, NULL, &state, false)) {
&state, false)) { rcu_read_unlock();
rcu_read_unlock(); ctx->current_state = state;
ctx->current_state = state; return state;
return state;
}
} }
} }
rcu_read_unlock(); rcu_read_unlock();
@@ -798,9 +796,6 @@ static int audit_filter_inode_name(struct task_struct *tsk,
struct audit_entry *e; struct audit_entry *e;
enum audit_state state; enum audit_state state;
if (list_empty(list))
return 0;
list_for_each_entry_rcu(e, list, list) { list_for_each_entry_rcu(e, list, list) {
if (audit_in_mask(&e->rule, ctx->major) && if (audit_in_mask(&e->rule, ctx->major) &&
audit_filter_rules(tsk, &e->rule, ctx, n, &state, false)) { audit_filter_rules(tsk, &e->rule, ctx, n, &state, false)) {
@@ -808,7 +803,6 @@ static int audit_filter_inode_name(struct task_struct *tsk,
return 1; return 1;
} }
} }
return 0; return 0;
} }
@@ -840,6 +834,13 @@ static inline void audit_proctitle_free(struct audit_context *context)
context->proctitle.len = 0; context->proctitle.len = 0;
} }
static inline void audit_free_module(struct audit_context *context)
{
if (context->type == AUDIT_KERN_MODULE) {
kfree(context->module.name);
context->module.name = NULL;
}
}
static inline void audit_free_names(struct audit_context *context) static inline void audit_free_names(struct audit_context *context)
{ {
struct audit_names *n, *next; struct audit_names *n, *next;
@@ -923,6 +924,7 @@ int audit_alloc(struct task_struct *tsk)
static inline void audit_free_context(struct audit_context *context) static inline void audit_free_context(struct audit_context *context)
{ {
audit_free_module(context);
audit_free_names(context); audit_free_names(context);
unroll_tree_refs(context, NULL, 0); unroll_tree_refs(context, NULL, 0);
free_tree_refs(context); free_tree_refs(context);
@@ -1139,7 +1141,8 @@ out:
kfree(buf_head); kfree(buf_head);
} }
void audit_log_cap(struct audit_buffer *ab, char *prefix, kernel_cap_t *cap) static void audit_log_cap(struct audit_buffer *ab, char *prefix,
kernel_cap_t *cap)
{ {
int i; int i;
@@ -1266,7 +1269,6 @@ static void show_special(struct audit_context *context, int *call_panic)
audit_log_format(ab, "name="); audit_log_format(ab, "name=");
if (context->module.name) { if (context->module.name) {
audit_log_untrustedstring(ab, context->module.name); audit_log_untrustedstring(ab, context->module.name);
kfree(context->module.name);
} else } else
audit_log_format(ab, "(null)"); audit_log_format(ab, "(null)");
@@ -1628,7 +1630,7 @@ void __audit_syscall_entry(int major, unsigned long a1, unsigned long a2,
return; return;
} }
context->arch = syscall_get_arch(); context->arch = syscall_get_arch(current);
context->major = major; context->major = major;
context->argv[0] = a1; context->argv[0] = a1;
context->argv[1] = a2; context->argv[1] = a2;
@@ -1697,6 +1699,7 @@ void __audit_syscall_exit(int success, long return_code)
context->in_syscall = 0; context->in_syscall = 0;
context->prio = context->state == AUDIT_RECORD_CONTEXT ? ~0ULL : 0; context->prio = context->state == AUDIT_RECORD_CONTEXT ? ~0ULL : 0;
audit_free_module(context);
audit_free_names(context); audit_free_names(context);
unroll_tree_refs(context, NULL, 0); unroll_tree_refs(context, NULL, 0);
audit_free_aux(context); audit_free_aux(context);
@@ -1897,8 +1900,9 @@ static inline int audit_copy_fcaps(struct audit_names *name,
} }
/* Copy inode data into an audit_names. */ /* Copy inode data into an audit_names. */
void audit_copy_inode(struct audit_names *name, const struct dentry *dentry, static void audit_copy_inode(struct audit_names *name,
struct inode *inode, unsigned int flags) const struct dentry *dentry,
struct inode *inode, unsigned int flags)
{ {
name->ino = inode->i_ino; name->ino = inode->i_ino;
name->dev = inode->i_sb->s_dev; name->dev = inode->i_sb->s_dev;
@@ -1935,18 +1939,16 @@ void __audit_inode(struct filename *name, const struct dentry *dentry,
return; return;
rcu_read_lock(); rcu_read_lock();
if (!list_empty(list)) { list_for_each_entry_rcu(e, list, list) {
list_for_each_entry_rcu(e, list, list) { for (i = 0; i < e->rule.field_count; i++) {
for (i = 0; i < e->rule.field_count; i++) { struct audit_field *f = &e->rule.fields[i];
struct audit_field *f = &e->rule.fields[i];
if (f->type == AUDIT_FSTYPE if (f->type == AUDIT_FSTYPE
&& audit_comparator(inode->i_sb->s_magic, && audit_comparator(inode->i_sb->s_magic,
f->op, f->val) f->op, f->val)
&& e->rule.action == AUDIT_NEVER) { && e->rule.action == AUDIT_NEVER) {
rcu_read_unlock(); rcu_read_unlock();
return; return;
}
} }
} }
} }
@@ -2055,18 +2057,16 @@ void __audit_inode_child(struct inode *parent,
return; return;
rcu_read_lock(); rcu_read_lock();
if (!list_empty(list)) { list_for_each_entry_rcu(e, list, list) {
list_for_each_entry_rcu(e, list, list) { for (i = 0; i < e->rule.field_count; i++) {
for (i = 0; i < e->rule.field_count; i++) { struct audit_field *f = &e->rule.fields[i];
struct audit_field *f = &e->rule.fields[i];
if (f->type == AUDIT_FSTYPE if (f->type == AUDIT_FSTYPE
&& audit_comparator(parent->i_sb->s_magic, && audit_comparator(parent->i_sb->s_magic,
f->op, f->val) f->op, f->val)
&& e->rule.action == AUDIT_NEVER) { && e->rule.action == AUDIT_NEVER) {
rcu_read_unlock(); rcu_read_unlock();
return; return;
}
} }
} }
} }
@@ -2512,6 +2512,35 @@ void __audit_fanotify(unsigned int response)
AUDIT_FANOTIFY, "resp=%u", response); AUDIT_FANOTIFY, "resp=%u", response);
} }
void __audit_tk_injoffset(struct timespec64 offset)
{
audit_log(audit_context(), GFP_KERNEL, AUDIT_TIME_INJOFFSET,
"sec=%lli nsec=%li",
(long long)offset.tv_sec, offset.tv_nsec);
}
static void audit_log_ntp_val(const struct audit_ntp_data *ad,
const char *op, enum audit_ntp_type type)
{
const struct audit_ntp_val *val = &ad->vals[type];
if (val->newval == val->oldval)
return;
audit_log(audit_context(), GFP_KERNEL, AUDIT_TIME_ADJNTPVAL,
"op=%s old=%lli new=%lli", op, val->oldval, val->newval);
}
void __audit_ntp_log(const struct audit_ntp_data *ad)
{
audit_log_ntp_val(ad, "offset", AUDIT_NTP_OFFSET);
audit_log_ntp_val(ad, "freq", AUDIT_NTP_FREQ);
audit_log_ntp_val(ad, "status", AUDIT_NTP_STATUS);
audit_log_ntp_val(ad, "tai", AUDIT_NTP_TAI);
audit_log_ntp_val(ad, "tick", AUDIT_NTP_TICK);
audit_log_ntp_val(ad, "adjust", AUDIT_NTP_ADJUST);
}
static void audit_log_task(struct audit_buffer *ab) static void audit_log_task(struct audit_buffer *ab)
{ {
kuid_t auid, uid; kuid_t auid, uid;
@@ -2580,7 +2609,7 @@ void audit_seccomp(unsigned long syscall, long signr, int code)
return; return;
audit_log_task(ab); audit_log_task(ab);
audit_log_format(ab, " sig=%ld arch=%x syscall=%ld compat=%d ip=0x%lx code=0x%x", audit_log_format(ab, " sig=%ld arch=%x syscall=%ld compat=%d ip=0x%lx code=0x%x",
signr, syscall_get_arch(), syscall, signr, syscall_get_arch(current), syscall,
in_compat_syscall(), KSTK_EIP(current), code); in_compat_syscall(), KSTK_EIP(current), code);
audit_log_end(ab); audit_log_end(ab);
} }

4
kernel/seccomp.c
View File

@@ -148,7 +148,7 @@ static void populate_seccomp_data(struct seccomp_data *sd)
unsigned long args[6]; unsigned long args[6];
sd->nr = syscall_get_nr(task, regs); sd->nr = syscall_get_nr(task, regs);
sd->arch = syscall_get_arch(); sd->arch = syscall_get_arch(task);
syscall_get_arguments(task, regs, args); syscall_get_arguments(task, regs, args);
sd->args[0] = args[0]; sd->args[0] = args[0];
sd->args[1] = args[1]; sd->args[1] = args[1];
@@ -594,7 +594,7 @@ static void seccomp_init_siginfo(kernel_siginfo_t *info, int syscall, int reason
info->si_code = SYS_SECCOMP; info->si_code = SYS_SECCOMP;
info->si_call_addr = (void __user *)KSTK_EIP(current); info->si_call_addr = (void __user *)KSTK_EIP(current);
info->si_errno = reason; info->si_errno = reason;
info->si_arch = syscall_get_arch(); info->si_arch = syscall_get_arch(current);
info->si_syscall = syscall; info->si_syscall = syscall;
} }

22
kernel/time/ntp.c
View File

@@ -17,6 +17,7 @@
#include <linux/mm.h> #include <linux/mm.h>
#include <linux/module.h> #include <linux/module.h>
#include <linux/rtc.h> #include <linux/rtc.h>
#include <linux/audit.h>
#include "ntp_internal.h" #include "ntp_internal.h"
#include "timekeeping_internal.h" #include "timekeeping_internal.h"
@@ -709,7 +710,7 @@ static inline void process_adjtimex_modes(const struct __kernel_timex *txc,
* kernel time-keeping variables. used by xntpd. * kernel time-keeping variables. used by xntpd.
*/ */
int __do_adjtimex(struct __kernel_timex *txc, const struct timespec64 *ts, int __do_adjtimex(struct __kernel_timex *txc, const struct timespec64 *ts,
s32 *time_tai) s32 *time_tai, struct audit_ntp_data *ad)
{ {
int result; int result;
@@ -720,14 +721,29 @@ int __do_adjtimex(struct __kernel_timex *txc, const struct timespec64 *ts,
/* adjtime() is independent from ntp_adjtime() */ /* adjtime() is independent from ntp_adjtime() */
time_adjust = txc->offset; time_adjust = txc->offset;
ntp_update_frequency(); ntp_update_frequency();
audit_ntp_set_old(ad, AUDIT_NTP_ADJUST, save_adjust);
audit_ntp_set_new(ad, AUDIT_NTP_ADJUST, time_adjust);
} }
txc->offset = save_adjust; txc->offset = save_adjust;
} else { } else {
/* If there are input parameters, then process them: */ /* If there are input parameters, then process them: */
if (txc->modes) if (txc->modes) {
audit_ntp_set_old(ad, AUDIT_NTP_OFFSET, time_offset);
audit_ntp_set_old(ad, AUDIT_NTP_FREQ, time_freq);
audit_ntp_set_old(ad, AUDIT_NTP_STATUS, time_status);
audit_ntp_set_old(ad, AUDIT_NTP_TAI, *time_tai);
audit_ntp_set_old(ad, AUDIT_NTP_TICK, tick_usec);
process_adjtimex_modes(txc, time_tai); process_adjtimex_modes(txc, time_tai);
audit_ntp_set_new(ad, AUDIT_NTP_OFFSET, time_offset);
audit_ntp_set_new(ad, AUDIT_NTP_FREQ, time_freq);
audit_ntp_set_new(ad, AUDIT_NTP_STATUS, time_status);
audit_ntp_set_new(ad, AUDIT_NTP_TAI, *time_tai);
audit_ntp_set_new(ad, AUDIT_NTP_TICK, tick_usec);
}
txc->offset = shift_right(time_offset * NTP_INTERVAL_FREQ, txc->offset = shift_right(time_offset * NTP_INTERVAL_FREQ,
NTP_SCALE_SHIFT); NTP_SCALE_SHIFT);
if (!(time_status & STA_NANO)) if (!(time_status & STA_NANO))

4
kernel/time/ntp_internal.h
View File

@@ -8,6 +8,8 @@ extern void ntp_clear(void);
extern u64 ntp_tick_length(void); extern u64 ntp_tick_length(void);
extern ktime_t ntp_get_next_leap(void); extern ktime_t ntp_get_next_leap(void);
extern int second_overflow(time64_t secs); extern int second_overflow(time64_t secs);
extern int __do_adjtimex(struct __kernel_timex *txc, const struct timespec64 *ts, s32 *time_tai); extern int __do_adjtimex(struct __kernel_timex *txc,
const struct timespec64 *ts,
s32 *time_tai, struct audit_ntp_data *ad);
extern void __hardpps(const struct timespec64 *phase_ts, const struct timespec64 *raw_ts); extern void __hardpps(const struct timespec64 *phase_ts, const struct timespec64 *raw_ts);
#endif /* _LINUX_NTP_INTERNAL_H */ #endif /* _LINUX_NTP_INTERNAL_H */

13
kernel/time/timekeeping.c
View File

@@ -21,6 +21,7 @@
#include <linux/stop_machine.h> #include <linux/stop_machine.h>
#include <linux/pvclock_gtod.h> #include <linux/pvclock_gtod.h>
#include <linux/compiler.h> #include <linux/compiler.h>
#include <linux/audit.h>
#include "tick-internal.h" #include "tick-internal.h"
#include "ntp_internal.h" #include "ntp_internal.h"
@@ -1250,6 +1251,9 @@ out:
/* signal hrtimers about time change */ /* signal hrtimers about time change */
clock_was_set(); clock_was_set();
if (!ret)
audit_tk_injoffset(ts_delta);
return ret; return ret;
} }
EXPORT_SYMBOL(do_settimeofday64); EXPORT_SYMBOL(do_settimeofday64);
@@ -2303,6 +2307,7 @@ static int timekeeping_validate_timex(const struct __kernel_timex *txc)
int do_adjtimex(struct __kernel_timex *txc) int do_adjtimex(struct __kernel_timex *txc)
{ {
struct timekeeper *tk = &tk_core.timekeeper; struct timekeeper *tk = &tk_core.timekeeper;
struct audit_ntp_data ad;
unsigned long flags; unsigned long flags;
struct timespec64 ts; struct timespec64 ts;
s32 orig_tai, tai; s32 orig_tai, tai;
@@ -2322,15 +2327,19 @@ int do_adjtimex(struct __kernel_timex *txc)
ret = timekeeping_inject_offset(&delta); ret = timekeeping_inject_offset(&delta);
if (ret) if (ret)
return ret; return ret;
audit_tk_injoffset(delta);
} }
audit_ntp_init(&ad);
ktime_get_real_ts64(&ts); ktime_get_real_ts64(&ts);
raw_spin_lock_irqsave(&timekeeper_lock, flags); raw_spin_lock_irqsave(&timekeeper_lock, flags);
write_seqcount_begin(&tk_core.seq); write_seqcount_begin(&tk_core.seq);
orig_tai = tai = tk->tai_offset; orig_tai = tai = tk->tai_offset;
ret = __do_adjtimex(txc, &ts, &tai); ret = __do_adjtimex(txc, &ts, &tai, &ad);
if (tai != orig_tai) { if (tai != orig_tai) {
__timekeeping_set_tai_offset(tk, tai); __timekeeping_set_tai_offset(tk, tai);
@@ -2341,6 +2350,8 @@ int do_adjtimex(struct __kernel_timex *txc)
write_seqcount_end(&tk_core.seq); write_seqcount_end(&tk_core.seq);
raw_spin_unlock_irqrestore(&timekeeper_lock, flags); raw_spin_unlock_irqrestore(&timekeeper_lock, flags);
audit_ntp_log(&ad);
/* Update the multiplier immediately if frequency was set directly */ /* Update the multiplier immediately if frequency was set directly */
if (txc->modes & (ADJ_FREQUENCY | ADJ_TICK)) if (txc->modes & (ADJ_FREQUENCY | ADJ_TICK))
timekeeping_advance(TK_ADV_FREQ); timekeeping_advance(TK_ADV_FREQ);

10
security/integrity/evm/evm_secfs.c
View File

@@ -192,7 +192,8 @@ static ssize_t evm_write_xattrs(struct file *file, const char __user *buf,
if (count > XATTR_NAME_MAX) if (count > XATTR_NAME_MAX)
return -E2BIG; return -E2BIG;
ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_INTEGRITY_EVM_XATTR); ab = audit_log_start(audit_context(), GFP_KERNEL,
AUDIT_INTEGRITY_EVM_XATTR);
if (!ab) if (!ab)
return -ENOMEM; return -ENOMEM;
@@ -214,6 +215,9 @@ static ssize_t evm_write_xattrs(struct file *file, const char __user *buf,
if (len && xattr->name[len-1] == '\n') if (len && xattr->name[len-1] == '\n')
xattr->name[len-1] = '\0'; xattr->name[len-1] = '\0';
audit_log_format(ab, "xattr=");
audit_log_untrustedstring(ab, xattr->name);
if (strcmp(xattr->name, ".") == 0) { if (strcmp(xattr->name, ".") == 0) {
evm_xattrs_locked = 1; evm_xattrs_locked = 1;
newattrs.ia_mode = S_IFREG | 0440; newattrs.ia_mode = S_IFREG | 0440;
@@ -222,15 +226,11 @@ static ssize_t evm_write_xattrs(struct file *file, const char __user *buf,
inode_lock(inode); inode_lock(inode);
err = simple_setattr(evm_xattrs, &newattrs); err = simple_setattr(evm_xattrs, &newattrs);
inode_unlock(inode); inode_unlock(inode);
audit_log_format(ab, "locked");
if (!err) if (!err)
err = count; err = count;
goto out; goto out;
} }
audit_log_format(ab, "xattr=");
audit_log_untrustedstring(ab, xattr->name);
if (strncmp(xattr->name, XATTR_SECURITY_PREFIX, if (strncmp(xattr->name, XATTR_SECURITY_PREFIX,
XATTR_SECURITY_PREFIX_LEN) != 0) { XATTR_SECURITY_PREFIX_LEN) != 0) {
err = -EINVAL; err = -EINVAL;