Commit 2fd6f58b authored by 's avatar
Browse files

[AUDIT] Don't allow ptrace to fool auditing, log arch of audited syscalls. 



We were calling ptrace_notify() after auditing the syscall and arguments,
but the debugger could have _changed_ them before the syscall was actually
invoked. Reorder the calls to fix that.

While we're touching ever call to audit_syscall_entry(), we also make it
take an extra argument: the architecture of the syscall which was made,
because some architectures allow more than one type of syscall.

Also add an explicit success/failure flag to audit_syscall_exit(), for
the benefit of architectures which return that in a condition register
rather than only returning a single register.

Change type of syscall return value to 'long' not 'int'.

Signed-off-by: default avatarDavid Woodhouse <dwmw2@infradead.org>
parent ea3834d9

arch/i386/kernel/ptrace.c

+9 −10
Original line number Diff line number Diff line
@@ -682,24 +682,18 @@ void do_syscall_trace(struct pt_regs *regs, int entryexit) 
	/* do the secure computing check first */

	secure_computing(regs->orig_eax);



	if (unlikely(current->audit_context)) {

		if (!entryexit)

			audit_syscall_entry(current, regs->orig_eax,

					    regs->ebx, regs->ecx,

					    regs->edx, regs->esi);

		else

			audit_syscall_exit(current, regs->eax);

	}

	if (unlikely(current->audit_context) && entryexit)

		audit_syscall_exit(current, AUDITSC_RESULT(regs->eax), regs->eax);



	if (!(current->ptrace & PT_PTRACED))

		return;

		goto out;



	/* Fake a debug trap */

	if (test_thread_flag(TIF_SINGLESTEP))

		send_sigtrap(current, regs, 0);



	if (!test_thread_flag(TIF_SYSCALL_TRACE))

		return;

		goto out;



	/* the 0x80 provides a way for the tracing parent to distinguish

	   between a syscall stop and SIGTRAP delivery */
@@ -714,4 +708,9 @@ void do_syscall_trace(struct pt_regs *regs, int entryexit) 
		send_sig(current->exit_code, current, 1);

		current->exit_code = 0;

	}

 out:

	if (unlikely(current->audit_context) && !entryexit)

		audit_syscall_entry(current, AUDIT_ARCH_I386, regs->orig_eax,

				    regs->ebx, regs->ecx, regs->edx, regs->esi);



}

arch/ia64/kernel/ptrace.c

+13 −8
Original line number Diff line number Diff line
@@ -1595,20 +1595,25 @@ syscall_trace_enter (long arg0, long arg1, long arg2, long arg3, 
		     long arg4, long arg5, long arg6, long arg7,

		     struct pt_regs regs)

{

	long syscall;

	if (test_thread_flag(TIF_SYSCALL_TRACE) 

	    && (current->ptrace & PT_PTRACED))

		syscall_trace();



	if (unlikely(current->audit_context)) {

		if (IS_IA32_PROCESS(&regs))

		long syscall;

		int arch;



		if (IS_IA32_PROCESS(&regs)) {

			syscall = regs.r1;

		else

			arch = AUDIT_ARCH_I386;

		} else {

			syscall = regs.r15;

			arch = AUDIT_ARCH_IA64;

		}



		audit_syscall_entry(current, syscall, arg0, arg1, arg2, arg3);

		audit_syscall_entry(current, arch, syscall, arg0, arg1, arg2, arg3);

	}



	if (test_thread_flag(TIF_SYSCALL_TRACE)

	    && (current->ptrace & PT_PTRACED))

		syscall_trace();

}



/* "asmlinkage" so the input arguments are preserved... */
@@ -1619,7 +1624,7 @@ syscall_trace_leave (long arg0, long arg1, long arg2, long arg3, 
		     struct pt_regs regs)

{

	if (unlikely(current->audit_context))

		audit_syscall_exit(current, regs.r8);

		audit_syscall_exit(current, AUDITSC_RESULT(regs.r10), regs.r8);



	if (test_thread_flag(TIF_SYSCALL_TRACE)

	    && (current->ptrace & PT_PTRACED))

arch/mips/kernel/ptrace.c

+28 −10
Original line number Diff line number Diff line
@@ -300,25 +300,38 @@ out: 
	return ret;

}



static inline int audit_arch()

{

#ifdef CONFIG_CPU_LITTLE_ENDIAN

#ifdef CONFIG_MIPS64

	if (!(current->thread.mflags & MF_32BIT_REGS))

		return AUDIT_ARCH_MIPSEL64;

#endif /* MIPS64 */

	return AUDIT_ARCH_MIPSEL;



#else /* big endian... */

#ifdef CONFIG_MIPS64

	if (!(current->thread.mflags & MF_32BIT_REGS))

		return AUDIT_ARCH_MIPS64;

#endif /* MIPS64 */

	return AUDIT_ARCH_MIPS;



#endif /* endian */

}



/*

 * Notification of system call entry/exit

 * - triggered by current->work.syscall_trace

 */

asmlinkage void do_syscall_trace(struct pt_regs *regs, int entryexit)

{

	if (unlikely(current->audit_context)) {

		if (!entryexit)

			audit_syscall_entry(current, regs->regs[2],

			                    regs->regs[4], regs->regs[5],

			                    regs->regs[6], regs->regs[7]);

		else

			audit_syscall_exit(current, regs->regs[2]);

	}

	if (unlikely(current->audit_context) && entryexit)

		audit_syscall_exit(current, AUDITSC_RESULT(regs->regs[2]), regs->regs[2]);



	if (!test_thread_flag(TIF_SYSCALL_TRACE))

		return;

		goto out;

	if (!(current->ptrace & PT_PTRACED))

		return;

		goto out;



	/* The 0x80 provides a way for the tracing parent to distinguish

	   between a syscall stop and SIGTRAP delivery */
@@ -334,4 +347,9 @@ asmlinkage void do_syscall_trace(struct pt_regs *regs, int entryexit) 
		send_sig(current->exit_code, current, 1);

		current->exit_code = 0;

	}

 out:

	if (unlikely(current->audit_context) && !entryexit)

		audit_syscall_entry(current, audit_arch(), regs->regs[2],

				    regs->regs[4], regs->regs[5],

				    regs->regs[6], regs->regs[7]);

}

arch/ppc64/kernel/ptrace.c

+10 −5
Original line number Diff line number Diff line
@@ -304,14 +304,17 @@ static void do_syscall_trace(void) 


void do_syscall_trace_enter(struct pt_regs *regs)

{

	if (test_thread_flag(TIF_SYSCALL_TRACE)

	    && (current->ptrace & PT_PTRACED))

		do_syscall_trace();



	if (unlikely(current->audit_context))

		audit_syscall_entry(current, regs->gpr[0],

		audit_syscall_entry(current,

				    test_thread_flag(TIF_32BIT)?AUDIT_ARCH_PPC:AUDIT_ARCH_PPC64,

				    regs->gpr[0],

				    regs->gpr[3], regs->gpr[4],

				    regs->gpr[5], regs->gpr[6]);



	if (test_thread_flag(TIF_SYSCALL_TRACE)

	    && (current->ptrace & PT_PTRACED))

		do_syscall_trace();

}



void do_syscall_trace_leave(struct pt_regs *regs)
@@ -319,7 +322,9 @@ void do_syscall_trace_leave(struct pt_regs *regs) 
	secure_computing(regs->gpr[0]);



	if (unlikely(current->audit_context))

		audit_syscall_exit(current, regs->result);

		audit_syscall_exit(current, 

				   (regs->ccr&0x1000)?AUDITSC_FAILURE:AUDITSC_SUCCESS,

				   regs->result);



	if ((test_thread_flag(TIF_SYSCALL_TRACE)

	     || test_thread_flag(TIF_SINGLESTEP))

arch/s390/kernel/ptrace.c

+11 −10
Original line number Diff line number Diff line
@@ -711,18 +711,13 @@ out: 
asmlinkage void

syscall_trace(struct pt_regs *regs, int entryexit)

{

	if (unlikely(current->audit_context)) {

		if (!entryexit)

			audit_syscall_entry(current, regs->gprs[2],

					    regs->orig_gpr2, regs->gprs[3],

					    regs->gprs[4], regs->gprs[5]);

		else

			audit_syscall_exit(current, regs->gprs[2]);

	}

	if (unlikely(current->audit_context) && entryexit)

		audit_syscall_exit(current, AUDITSC_RESULT(regs->gprs[2]), regs->gprs[2]);



	if (!test_thread_flag(TIF_SYSCALL_TRACE))

		return;

		goto out;

	if (!(current->ptrace & PT_PTRACED))

		return;

		goto out;

	ptrace_notify(SIGTRAP | ((current->ptrace & PT_TRACESYSGOOD)

				 ? 0x80 : 0));
@@ -735,4 +730,10 @@ syscall_trace(struct pt_regs *regs, int entryexit) 
		send_sig(current->exit_code, current, 1);

		current->exit_code = 0;

	}

 out:

	if (unlikely(current->audit_context) && !entryexit)

		audit_syscall_entry(current, 

				    test_thread_flag(TIF_31BIT)?AUDIT_ARCH_S390:AUDIT_ARCH_S390X,

				    regs->gprs[2], regs->orig_gpr2, regs->gprs[3],

				    regs->gprs[4], regs->gprs[5]);

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE