Commit 29ef73b7 authored by Nathaniel Husted's avatar Nathaniel Husted Committed by Al Viro
Browse files

Kernel: Audit Support For The ARM Platform 

This patch provides functionality to audit system call events on the
ARM platform. The implementation was based off the structure of the
MIPS platform and information in this
(http://lists.fedoraproject.org/pipermail/arm/2009-October/000382.html

)
mailing list thread. The required audit_syscall_exit and
audit_syscall_entry checks were added to ptrace using the standard
registers for system call values (r0 through r3). A thread information
flag was added for auditing (TIF_SYSCALL_AUDIT) and a meta-flag was
added (_TIF_SYSCALL_WORK) to simplify modifications to the syscall
entry/exit. Now, if either the TRACE flag is set or the AUDIT flag is
set, the syscall_trace function will be executed. The prober changes
were made to Kconfig to allow CONFIG_AUDITSYSCALL to be enabled.

Due to platform availability limitations, this patch was only tested
on the Android platform running the modified "android-goldfish-2.6.29"
kernel. A test compile was performed using Code Sourcery's
cross-compilation toolset and the current linux-3.0 stable kernel. The
changes compile without error. I'm hoping, due to the simple modifications,
the patch is "obviously correct".

Signed-off-by: default avatarNathaniel Husted <nhusted@gmail.com>
Signed-off-by: default avatarEric Paris <eparis@redhat.com>
parent 4043cde8

arch/arm/include/asm/kprobes.h

+0 −1
Original line number Diff line number Diff line
@@ -24,7 +24,6 @@ 
#define MAX_INSN_SIZE			2

#define MAX_STACK_SIZE			64	/* 32 would probably be OK */



#define regs_return_value(regs)		((regs)->ARM_r0)

#define flush_insn_slot(p)		do { } while (0)

#define kretprobe_blacklist_size	0

arch/arm/include/asm/ptrace.h

+5 −0
Original line number Diff line number Diff line
@@ -189,6 +189,11 @@ static inline int valid_user_regs(struct pt_regs *regs) 
	return 0;

}



static inline long regs_return_value(struct pt_regs *regs)

{

	return regs->ARM_r0;

}



#define instruction_pointer(regs)	(regs)->ARM_pc



#ifdef CONFIG_SMP

arch/arm/include/asm/thread_info.h

+6 −0
Original line number Diff line number Diff line
@@ -129,6 +129,7 @@ extern void vfp_flush_hwstate(struct thread_info *); 
/*

 * thread information flags:

 *  TIF_SYSCALL_TRACE	- syscall trace active

 *  TIF_SYSCAL_AUDIT	- syscall auditing active

 *  TIF_SIGPENDING	- signal pending

 *  TIF_NEED_RESCHED	- rescheduling necessary

 *  TIF_NOTIFY_RESUME	- callback before returning to user
@@ -139,6 +140,7 @@ extern void vfp_flush_hwstate(struct thread_info *); 
#define TIF_NEED_RESCHED	1

#define TIF_NOTIFY_RESUME	2	/* callback before returning to user */

#define TIF_SYSCALL_TRACE	8

#define TIF_SYSCALL_AUDIT	9

#define TIF_POLLING_NRFLAG	16

#define TIF_USING_IWMMXT	17

#define TIF_MEMDIE		18	/* is terminating due to OOM killer */
@@ -149,11 +151,15 @@ extern void vfp_flush_hwstate(struct thread_info *); 
#define _TIF_NEED_RESCHED	(1 << TIF_NEED_RESCHED)

#define _TIF_NOTIFY_RESUME	(1 << TIF_NOTIFY_RESUME)

#define _TIF_SYSCALL_TRACE	(1 << TIF_SYSCALL_TRACE)

#define _TIF_SYSCALL_AUDIT	(1 << TIF_SYSCALL_AUDIT)

#define _TIF_POLLING_NRFLAG	(1 << TIF_POLLING_NRFLAG)

#define _TIF_USING_IWMMXT	(1 << TIF_USING_IWMMXT)

#define _TIF_RESTORE_SIGMASK	(1 << TIF_RESTORE_SIGMASK)

#define _TIF_SECCOMP		(1 << TIF_SECCOMP)



/* Checks for any syscall work in entry-common.S */

#define _TIF_SYSCALL_WORK (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT)



/*

 * Change these and you break ASM code in entry-common.S

 */

arch/arm/kernel/entry-common.S

+2 −2
Original line number Diff line number Diff line
@@ -87,7 +87,7 @@ ENTRY(ret_from_fork) 
	get_thread_info tsk

	ldr	r1, [tsk, #TI_FLAGS]		@ check for syscall tracing

	mov	why, #1

	tst	r1, #_TIF_SYSCALL_TRACE		@ are we tracing syscalls?

	tst	r1, #_TIF_SYSCALL_WORK		@ are we tracing syscalls?

	beq	ret_slow_syscall

	mov	r1, sp

	mov	r0, #1				@ trace exit [IP = 1]
@@ -443,7 +443,7 @@ ENTRY(vector_swi) 
1:

#endif



	tst	r10, #_TIF_SYSCALL_TRACE		@ are we tracing syscalls?

	tst	r10, #_TIF_SYSCALL_WORK		@ are we tracing syscalls?

	bne	__sys_trace



	cmp	scno, #NR_syscalls		@ check upper syscall limit

arch/arm/kernel/ptrace.c

+11 −5
Original line number Diff line number Diff line
@@ -906,11 +906,6 @@ asmlinkage int syscall_trace(int why, struct pt_regs *regs, int scno) 
{

	unsigned long ip;



	if (!test_thread_flag(TIF_SYSCALL_TRACE))

		return scno;

	if (!(current->ptrace & PT_PTRACED))

		return scno;



	/*

	 * Save IP.  IP is used to denote syscall entry/exit:

	 *  IP = 0 -> entry, = 1 -> exit
@@ -918,6 +913,17 @@ asmlinkage int syscall_trace(int why, struct pt_regs *regs, int scno) 
	ip = regs->ARM_ip;

	regs->ARM_ip = why;



	if (!ip)

		audit_syscall_exit(regs);

	else

		audit_syscall_entry(AUDIT_ARCH_ARMEB, scno, regs->ARM_r0,

				    regs->ARM_r1, regs->ARM_r2, regs->ARM_r3);



	if (!test_thread_flag(TIF_SYSCALL_TRACE))

		return scno;

	if (!(current->ptrace & PT_PTRACED))

		return scno;



	current_thread_info()->syscall = scno;



	/* the 0x80 provides a way for the tracing parent to distinguish

CRA Git | Maintained and supported by SUSTech CRA and CCSE