Since both ppc and ppc64 have LE variants which are now reported by uname, add
that flag (__AUDIT_ARCH_LE) to syscall_get_arch() and add AUDIT_ARCH_PPC64LE
variant.
Without this, perf trace and auditctl fail.
Mainline kernel reports ppc64le (per a058801) but there is no matching
AUDIT_ARCH_PPC64LE.
Since 32-bit PPC LE is not supported by audit, don't advertise it in
AUDIT_ARCH_PPC* variants.
See:
https://www.redhat.com/archives/linux-audit/2014-August/msg00082.html
https://www.redhat.com/archives/linux-audit/2014-December/msg00004.html
Signed-off-by: Richard Guy Briggs <[email protected]>
---
arch/powerpc/include/asm/syscall.h | 6 +++++-
include/uapi/linux/audit.h | 2 ++
2 files changed, 7 insertions(+), 1 deletions(-)
diff --git a/arch/powerpc/include/asm/syscall.h b/arch/powerpc/include/asm/syscall.h
index 6fa2708..d1934e5 100644
--- a/arch/powerpc/include/asm/syscall.h
+++ b/arch/powerpc/include/asm/syscall.h
@@ -90,6 +90,10 @@ static inline void syscall_set_arguments(struct task_struct *task,
static inline int syscall_get_arch(void)
{
- return is_32bit_task() ? AUDIT_ARCH_PPC : AUDIT_ARCH_PPC64;
+ int arch = is_32bit_task() ? AUDIT_ARCH_PPC : AUDIT_ARCH_PPC64;
+#ifdef __LITTLE_ENDIAN__
+ arch |= __AUDIT_ARCH_LE;
+#endif
+ return arch;
}
#endif /* _ASM_SYSCALL_H */
diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
index 4d100c8..d82beec 100644
--- a/include/uapi/linux/audit.h
+++ b/include/uapi/linux/audit.h
@@ -364,7 +364,9 @@ enum {
#define AUDIT_ARCH_PARISC (EM_PARISC)
#define AUDIT_ARCH_PARISC64 (EM_PARISC|__AUDIT_ARCH_64BIT)
#define AUDIT_ARCH_PPC (EM_PPC)
+/* do not define AUDIT_ARCH_PPCLE since it is not supported by audit */
#define AUDIT_ARCH_PPC64 (EM_PPC64|__AUDIT_ARCH_64BIT)
+#define AUDIT_ARCH_PPC64LE (EM_PPC64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
#define AUDIT_ARCH_S390 (EM_S390)
#define AUDIT_ARCH_S390X (EM_S390|__AUDIT_ARCH_64BIT)
#define AUDIT_ARCH_SH (EM_SH)
--
1.7.1
On Tuesday, December 09, 2014 03:37:07 PM Richard Guy Briggs wrote:
> Since both ppc and ppc64 have LE variants which are now reported by uname,
> add that flag (__AUDIT_ARCH_LE) to syscall_get_arch() and add
> AUDIT_ARCH_PPC64LE variant.
>
> Without this, perf trace and auditctl fail.
>
> Mainline kernel reports ppc64le (per a058801) but there is no matching
> AUDIT_ARCH_PPC64LE.
>
> Since 32-bit PPC LE is not supported by audit, don't advertise it in
> AUDIT_ARCH_PPC* variants.
>
> See:
> https://www.redhat.com/archives/linux-audit/2014-August/msg00082.html
> https://www.redhat.com/archives/linux-audit/2014-December/msg00004.html
>
> Signed-off-by: Richard Guy Briggs <[email protected]>
> ---
> arch/powerpc/include/asm/syscall.h | 6 +++++-
> include/uapi/linux/audit.h | 2 ++
> 2 files changed, 7 insertions(+), 1 deletions(-)
The audit changes look fine to me, but as I mentioned earlier, this should go
in via the ppc tree and not the audit tree.
Acked-by: Paul Moore <[email protected]>
> diff --git a/arch/powerpc/include/asm/syscall.h
> b/arch/powerpc/include/asm/syscall.h index 6fa2708..d1934e5 100644
> --- a/arch/powerpc/include/asm/syscall.h
> +++ b/arch/powerpc/include/asm/syscall.h
> @@ -90,6 +90,10 @@ static inline void syscall_set_arguments(struct
> task_struct *task,
>
> static inline int syscall_get_arch(void)
> {
> - return is_32bit_task() ? AUDIT_ARCH_PPC : AUDIT_ARCH_PPC64;
> + int arch = is_32bit_task() ? AUDIT_ARCH_PPC : AUDIT_ARCH_PPC64;
> +#ifdef __LITTLE_ENDIAN__
> + arch |= __AUDIT_ARCH_LE;
> +#endif
> + return arch;
> }
> #endif /* _ASM_SYSCALL_H */
> diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
> index 4d100c8..d82beec 100644
> --- a/include/uapi/linux/audit.h
> +++ b/include/uapi/linux/audit.h
> @@ -364,7 +364,9 @@ enum {
> #define AUDIT_ARCH_PARISC (EM_PARISC)
> #define AUDIT_ARCH_PARISC64 (EM_PARISC|__AUDIT_ARCH_64BIT)
> #define AUDIT_ARCH_PPC (EM_PPC)
> +/* do not define AUDIT_ARCH_PPCLE since it is not supported by audit */
> #define AUDIT_ARCH_PPC64 (EM_PPC64|__AUDIT_ARCH_64BIT)
> +#define AUDIT_ARCH_PPC64LE (EM_PPC64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
> #define AUDIT_ARCH_S390 (EM_S390)
> #define AUDIT_ARCH_S390X (EM_S390|__AUDIT_ARCH_64BIT)
> #define AUDIT_ARCH_SH (EM_SH)
--
paul moore
security and virtualization @ redhat
On Tue, 2014-12-09 at 21:11 -0500, Paul Moore wrote:
> On Tuesday, December 09, 2014 03:37:07 PM Richard Guy Briggs wrote:
> > Since both ppc and ppc64 have LE variants which are now reported by uname,
> > add that flag (__AUDIT_ARCH_LE) to syscall_get_arch() and add
> > AUDIT_ARCH_PPC64LE variant.
> >
> > Without this, perf trace and auditctl fail.
> >
> > Mainline kernel reports ppc64le (per a058801) but there is no matching
> > AUDIT_ARCH_PPC64LE.
> >
> > Since 32-bit PPC LE is not supported by audit, don't advertise it in
> > AUDIT_ARCH_PPC* variants.
> >
> > See:
> > https://www.redhat.com/archives/linux-audit/2014-August/msg00082.html
> > https://www.redhat.com/archives/linux-audit/2014-December/msg00004.html
> >
> > Signed-off-by: Richard Guy Briggs <[email protected]>
> > ---
> > arch/powerpc/include/asm/syscall.h | 6 +++++-
> > include/uapi/linux/audit.h | 2 ++
> > 2 files changed, 7 insertions(+), 1 deletions(-)
>
> The audit changes look fine to me, but as I mentioned earlier, this should go
> in via the ppc tree and not the audit tree.
>
> Acked-by: Paul Moore <[email protected]>
Thanks.
Yep I'll take it via the powerpc tree, I'll CC stable as well as presumably we
want this to work in all versions that had LE support.
cheers
On 14/12/10, Michael Ellerman wrote:
> On Tue, 2014-12-09 at 21:11 -0500, Paul Moore wrote:
> > On Tuesday, December 09, 2014 03:37:07 PM Richard Guy Briggs wrote:
> > > Since both ppc and ppc64 have LE variants which are now reported by uname,
> > > add that flag (__AUDIT_ARCH_LE) to syscall_get_arch() and add
> > > AUDIT_ARCH_PPC64LE variant.
> > >
> > > Without this, perf trace and auditctl fail.
> > >
> > > Mainline kernel reports ppc64le (per a058801) but there is no matching
> > > AUDIT_ARCH_PPC64LE.
> > >
> > > Since 32-bit PPC LE is not supported by audit, don't advertise it in
> > > AUDIT_ARCH_PPC* variants.
> > >
> > > See:
> > > https://www.redhat.com/archives/linux-audit/2014-August/msg00082.html
> > > https://www.redhat.com/archives/linux-audit/2014-December/msg00004.html
> > >
> > > Signed-off-by: Richard Guy Briggs <[email protected]>
> > > ---
> > > arch/powerpc/include/asm/syscall.h | 6 +++++-
> > > include/uapi/linux/audit.h | 2 ++
> > > 2 files changed, 7 insertions(+), 1 deletions(-)
> >
> > The audit changes look fine to me, but as I mentioned earlier, this should go
> > in via the ppc tree and not the audit tree.
> >
> > Acked-by: Paul Moore <[email protected]>
>
> Thanks.
>
> Yep I'll take it via the powerpc tree, I'll CC stable as well as presumably we
> want this to work in all versions that had LE support.
Yes, please!
(I was very tempted to change the #error to #warning, but figured the
placeholder comment in the uapi file was sufficient.)
> cheers
- RGB
--
Richard Guy Briggs <[email protected]>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545