[AUDIT] Don't allow ptrace to fool auditing, log arch of audited syscalls.

We were calling ptrace_notify() after auditing the syscall and arguments,
but the debugger could have _changed_ them before the syscall was actually
invoked. Reorder the calls to fix that.

While we're touching ever call to audit_syscall_entry(), we also make it
take an extra argument: the architecture of the syscall which was made,
because some architectures allow more than one type of syscall.

Also add an explicit success/failure flag to audit_syscall_exit(), for
the benefit of architectures which return that in a condition register
rather than only returning a single register.

Change type of syscall return value to 'long' not 'int'.

Signed-off-by: David Woodhouse <dwmw2@infradead.org>

1 files changed, 44 insertions, 4 deletions

diff --git a/include/linux/audit.h b/include/linux/audit.h
index 9b77992c4888..fad0c1dc21a9 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -24,6 +24,9 @@
 #ifndef _LINUX_AUDIT_H_
 #define _LINUX_AUDIT_H_
 
+#include <linux/sched.h>
+#include <linux/elf.h>
+
 /* Request and reply types */
 #define AUDIT_GET      1000     /* Get status */
 #define AUDIT_SET      1001     /* Set status (enable/disable/auditd) */
@@ -67,6 +70,7 @@
 #define AUDIT_FSGID     8
 #define AUDIT_LOGINUID  9
 #define AUDIT_PERS      10
+#define AUDIT_ARCH      11
 
                                 /* These are ONLY useful when checking
                                  * at syscall exit time (AUDIT_AT_EXIT). */
@@ -96,6 +100,38 @@
 #define AUDIT_FAIL_PRINTK       1
 #define AUDIT_FAIL_PANIC        2
 
+/* distinguish syscall tables */
+#define __AUDIT_ARCH_64BIT 0x80000000
+#define __AUDIT_ARCH_LE    0x40000000
+#define AUDIT_ARCH_ALPHA        (EM_ALPHA|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
+#define AUDIT_ARCH_ARM          (EM_ARM|__AUDIT_ARCH_LE)
+#define AUDIT_ARCH_ARMEB        (EM_ARM)
+#define AUDIT_ARCH_CRIS         (EM_CRIS|__AUDIT_ARCH_LE)
+#define AUDIT_ARCH_FRV          (EM_FRV)
+#define AUDIT_ARCH_H8300        (EM_H8_300)
+#define AUDIT_ARCH_I386         (EM_386|__AUDIT_ARCH_LE)
+#define AUDIT_ARCH_IA64         (EM_IA_64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
+#define AUDIT_ARCH_M32R         (EM_M32R)
+#define AUDIT_ARCH_M68K         (EM_68K)
+#define AUDIT_ARCH_MIPS         (EM_MIPS)
+#define AUDIT_ARCH_MIPSEL       (EM_MIPS|__AUDIT_ARCH_LE)
+#define AUDIT_ARCH_MIPS64       (EM_MIPS|__AUDIT_ARCH_64BIT)
+#define AUDIT_ARCH_MIPSEL64     (EM_MIPS|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
+#define AUDIT_ARCH_PARISC       (EM_PARISC)
+#define AUDIT_ARCH_PARISC64     (EM_PARISC|__AUDIT_ARCH_64BIT)
+#define AUDIT_ARCH_PPC          (EM_PPC)
+#define AUDIT_ARCH_PPC64        (EM_PPC64|__AUDIT_ARCH_64BIT)
+#define AUDIT_ARCH_S390         (EM_S390)
+#define AUDIT_ARCH_S390X        (EM_S390|__AUDIT_ARCH_64BIT)
+#define AUDIT_ARCH_SH           (EM_SH)
+#define AUDIT_ARCH_SHEL         (EM_SH|__AUDIT_ARCH_LE)
+#define AUDIT_ARCH_SH64         (EM_SH|__AUDIT_ARCH_64BIT)
+#define AUDIT_ARCH_SHEL64       (EM_SH|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
+#define AUDIT_ARCH_SPARC        (EM_SPARC)
+#define AUDIT_ARCH_SPARC64      (EM_SPARC64|__AUDIT_ARCH_64BIT)
+#define AUDIT_ARCH_V850         (EM_V850|__AUDIT_ARCH_LE)
+#define AUDIT_ARCH_X86_64       (EM_X86_64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
+
 #ifndef __KERNEL__
 struct audit_message {
         struct nlmsghdr nlh;
@@ -129,15 +165,19 @@ struct audit_buffer;
 struct audit_context;
 struct inode;
 
+#define AUDITSC_INVALID 0
+#define AUDITSC_SUCCESS 1
+#define AUDITSC_FAILURE 2
+#define AUDITSC_RESULT(x) ( ((long)(x))<0?AUDITSC_FAILURE:AUDITSC_SUCCESS )
 #ifdef CONFIG_AUDITSYSCALL
 /* These are defined in auditsc.c */
                                 /* Public API */
 extern int  audit_alloc(struct task_struct *task);
 extern void audit_free(struct task_struct *task);
-extern void audit_syscall_entry(struct task_struct *task,
+extern void audit_syscall_entry(struct task_struct *task, int arch,
                                 int major, unsigned long a0, unsigned long a1,
                                 unsigned long a2, unsigned long a3);
-extern void audit_syscall_exit(struct task_struct *task, int return_code);
+extern void audit_syscall_exit(struct task_struct *task, int failed, long return_code);
 extern void audit_getname(const char *name);
 extern void audit_putname(const char *name);
 extern void audit_inode(const char *name, const struct inode *inode);
@@ -153,8 +193,8 @@ extern int audit_ipc_perms(unsigned long qbytes, uid_t uid, gid_t gid, mode_t mo
 #else
 #define audit_alloc(t) ({ 0; })
 #define audit_free(t) do { ; } while (0)
-#define audit_syscall_entry(t,a,b,c,d,e) do { ; } while (0)
-#define audit_syscall_exit(t,r) do { ; } while (0)
+#define audit_syscall_entry(t,ta,a,b,c,d,e) do { ; } while (0)
+#define audit_syscall_exit(t,f,r) do { ; } while (0)
 #define audit_getname(n) do { ; } while (0)
 #define audit_putname(n) do { ; } while (0)
 #define audit_inode(n,i) do { ; } while (0)