Received-SPF: softfail (google.com: domain of transitioning linux-kernel-owner@vger.kernel.org does not designate 23.128.96.19 as permitted sender) client-ip=23.128.96.19;
MIME-Version: 1.0
References: <20220404022317.2449865-1-yang.yang29@zte.com.cn>
In-Reply-To: <20220404022317.2449865-1-yang.yang29@zte.com.cn>
From:   Paul Moore <paul@paul-moore.com>
Date:   Mon, 4 Apr 2022 09:12:13 -0400
Message-ID: <CAHC9VhQYJuira79eEpGFSGz=63gu7RdT3i3sSzPh_tbmMKo5vA@mail.gmail.com>
Subject: Re: [PATCH v2] audit: do a quick exit when syscall number is less
 than 0
To:     cgel.zte@gmail.com
Cc:     eparis@redhat.com, linux-audit@redhat.com, rth@twiddle.net,
        sgrubb@redhat.com, linux-kernel@vger.kernel.org,
        ink@jurassic.park.msu.ru, mattst88@gmail.com,
        Yang Yang <yang.yang29@zte.com.cn>,
        Zeal Robot <zealci@zte.com.cn>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

On Sun, Apr 3, 2022 at 10:23 PM <cgel.zte@gmail.com> wrote:
>
> From: Yang Yang <yang.yang29@zte.com.cn>
>
> Userspace may use syscall with syscall number less than 0 by calling
> syscall(syscall_num,..). This kind of syscall could never be audited,
> because auditctl requires rule with syscall number >=0. Therefore we
> better do a quick handle no need to gohead with this situation.
>
> Note that auditctl may set rules auditing invalid syscall with syscall
> number bigger than NR_syscalls, to keep this mechanism working, we do
> no more check(context->major bigger than NR_syscalls or not).
>
> Signed-off-by: Yang Yang <yang.yang29@zte.com.cn>
> Reported-by: Zeal Robot <zealci@zte.com.cn>
> ---
> v2:
> - cancel checking against NR_syscalls
> ---
>  kernel/auditsc.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)

As discussed previously, this is not something I want to merge
upstream at this time.

-- 
paul-moore.com