Syscall auditing on ppc64 lacks correct return codes.

David Woodhouse dwmw2 at infradead.org
Wed Jan 26 18:45:40 UTC 2005


We were pretending that every syscall returned zero. Don't do that.

===== arch/ppc64/kernel/entry.S 1.51 vs edited =====
--- 1.51/arch/ppc64/kernel/entry.S	Thu Jan 13 09:48:36 2005
+++ edited/arch/ppc64/kernel/entry.S	Thu Jan 20 16:14:50 2005
@@ -231,6 +231,7 @@
 syscall_exit_trace:
 	std	r3,GPR3(r1)
 	bl	.save_nvgprs
+	addi	r3,r1,STACK_FRAME_OVERHEAD
 	bl	.do_syscall_trace_leave
 	REST_NVGPRS(r1)
 	ld	r3,GPR3(r1)
@@ -324,6 +325,7 @@
 	ld	r4,TI_FLAGS(r4)
 	andi.	r4,r4,(_TIF_SYSCALL_T_OR_A|_TIF_SINGLESTEP)
 	beq+	81f
+	addi	r3,r1,STACK_FRAME_OVERHEAD
 	bl	.do_syscall_trace_leave
 81:	b	.ret_from_except
 
===== arch/ppc64/kernel/ptrace.c 1.13 vs edited =====
--- 1.13/arch/ppc64/kernel/ptrace.c	Fri Dec 17 08:09:09 2004
+++ edited/arch/ppc64/kernel/ptrace.c	Thu Jan 20 16:24:12 2005
@@ -313,10 +313,10 @@
 		do_syscall_trace();
 }
 
-void do_syscall_trace_leave(void)
+void do_syscall_trace_leave(struct pt_regs *regs)
 {
 	if (unlikely(current->audit_context))
-		audit_syscall_exit(current, 0);	/* FIXME: pass pt_regs */
+		audit_syscall_exit(current, regs->result);
 
 	if ((test_thread_flag(TIF_SYSCALL_TRACE)
 	     || test_thread_flag(TIF_SINGLESTEP))


-- 
dwmw2




More information about the Linux-audit mailing list