[PATCH 01/13] audit: log all six syscall arguments in the SYSCALL record
Ricardo Robaina
rrobaina at redhat.com
Thu Aug 13 10:02:51 PDT 2026
The SYSCALL record currently logs only four of the six syscall
arguments (a0-a3). The remaining two are captured but silently
discarded before reaching the audit context. This leads to the
need for auxiliary records when audit-relevant data lands in
the 5th or 6th argument of a syscall.
Extend the SYSCALL record to log all six arguments, by adding
arguments a4 and a5 (5th and 6th syscall argument respectively)
inline within the existing record. Additionally, add the two
new args to audit rules switch case, so audit rules can filter
on them. Lastly, as a minor cleanup, rename params from (a1-a4)
to (a0-a5) in __audit_syscall_entry(), for consistency.
type=SYSCALL ... syscall=openat ... a3=0x0 a4=0 a5=0 ...
type=SYSCALL ... syscall=sendto ... a3=0x0 a4=7fff68843bcc a5=c ...
Link: https://lore.kernel.org/audit/CAHC9VhSjEt_-Bsra4AEqWv+Daw5Ff=gqy7dX4Ah11RVhdyCBUQ@mail.gmail.com/T/#t
Signed-off-by: Ricardo Robaina <rrobaina at redhat.com>
---
include/linux/audit.h | 11 +++++++----
include/linux/entry-common.h | 3 ++-
include/uapi/linux/audit.h | 2 ++
kernel/audit.h | 2 +-
kernel/auditfilter.c | 2 ++
kernel/auditsc.c | 31 ++++++++++++++++++++-----------
6 files changed, 34 insertions(+), 17 deletions(-)
diff --git a/include/linux/audit.h b/include/linux/audit.h
index 45abb3722d30..7306d7861159 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -324,7 +324,8 @@ extern void __audit_free(struct task_struct *task);
extern void __audit_uring_entry(u8 op);
extern void __audit_uring_exit(int success, long code);
extern void __audit_syscall_entry(int major, unsigned long a0, unsigned long a1,
- unsigned long a2, unsigned long a3);
+ unsigned long a2, unsigned long a3,
+ unsigned long a4, unsigned long a5);
extern void __audit_syscall_exit(int ret_success, long ret_value);
extern void __audit_getname(struct filename *name);
extern void __audit_inode(struct filename *name, const struct dentry *dentry,
@@ -375,10 +376,11 @@ static inline void audit_uring_exit(int success, long code)
}
static inline void audit_syscall_entry(int major, unsigned long a0,
unsigned long a1, unsigned long a2,
- unsigned long a3)
+ unsigned long a3, unsigned long a4,
+ unsigned long a5)
{
if (unlikely(audit_context()))
- __audit_syscall_entry(major, a0, a1, a2, a3);
+ __audit_syscall_entry(major, a0, a1, a2, a3, a4, a5);
}
static inline void audit_syscall_exit(void *pt_regs)
{
@@ -613,7 +615,8 @@ static inline void audit_uring_exit(int success, long code)
{ }
static inline void audit_syscall_entry(int major, unsigned long a0,
unsigned long a1, unsigned long a2,
- unsigned long a3)
+ unsigned long a3, unsigned long a4,
+ unsigned long a5)
{ }
static inline void audit_syscall_exit(void *pt_regs)
{ }
diff --git a/include/linux/entry-common.h b/include/linux/entry-common.h
index 416a3352261f..cf2d9989e3fe 100644
--- a/include/linux/entry-common.h
+++ b/include/linux/entry-common.h
@@ -65,7 +65,8 @@ static inline void syscall_enter_audit(struct pt_regs *regs, long syscall)
unsigned long args[6];
syscall_get_arguments(current, regs, args);
- audit_syscall_entry(syscall, args[0], args[1], args[2], args[3]);
+ audit_syscall_entry(syscall, args[0], args[1], args[2], args[3],
+ args[4], args[5]);
}
}
diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
index e8f5ce677df7..6726059d6df1 100644
--- a/include/uapi/linux/audit.h
+++ b/include/uapi/linux/audit.h
@@ -303,6 +303,8 @@
#define AUDIT_ARG1 (AUDIT_ARG0+1)
#define AUDIT_ARG2 (AUDIT_ARG0+2)
#define AUDIT_ARG3 (AUDIT_ARG0+3)
+#define AUDIT_ARG4 (AUDIT_ARG0+4)
+#define AUDIT_ARG5 (AUDIT_ARG0+5)
#define AUDIT_FILTERKEY 210
diff --git a/kernel/audit.h b/kernel/audit.h
index 92d5e723d570..83011b14af18 100644
--- a/kernel/audit.h
+++ b/kernel/audit.h
@@ -117,7 +117,7 @@ struct audit_context {
struct audit_stamp stamp; /* event identifier */
int major; /* syscall number */
int uring_op; /* uring operation */
- unsigned long argv[4]; /* syscall arguments */
+ unsigned long argv[6]; /* syscall arguments */
long return_code;/* syscall return code */
u64 prio;
int return_valid; /* return code is valid */
diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index 7f791afe5791..4bf539d6937d 100644
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -358,6 +358,8 @@ static int audit_field_valid(struct audit_entry *entry, struct audit_field *f)
case AUDIT_ARG1:
case AUDIT_ARG2:
case AUDIT_ARG3:
+ case AUDIT_ARG4:
+ case AUDIT_ARG5:
case AUDIT_PERS: /* <uapi/linux/personality.h> */
case AUDIT_DEVMINOR:
/* all ops are valid */
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 6610e667c728..7a9d65a6b1cc 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -728,6 +728,8 @@ static int audit_filter_rules(struct task_struct *tsk,
case AUDIT_ARG1:
case AUDIT_ARG2:
case AUDIT_ARG3:
+ case AUDIT_ARG4:
+ case AUDIT_ARG5:
if (ctx)
result = audit_comparator(ctx->argv[f->type-AUDIT_ARG0], f->op, f->val);
break;
@@ -1674,11 +1676,13 @@ static void audit_log_exit(void)
AUDITSC_SUCCESS),
context->return_code);
audit_log_format(ab,
- " a0=%lx a1=%lx a2=%lx a3=%lx items=%d",
+ " a0=%lx a1=%lx a2=%lx a3=%lx a4=%lx a5=%lx items=%d",
context->argv[0],
context->argv[1],
context->argv[2],
context->argv[3],
+ context->argv[4],
+ context->argv[5],
context->name_count);
audit_log_task_info(ab);
audit_log_key(ab, context->filterkey);
@@ -1970,10 +1974,12 @@ void __audit_uring_exit(int success, long code)
/**
* __audit_syscall_entry - fill in an audit record at syscall entry
* @major: major syscall type (function)
- * @a1: additional syscall register 1
- * @a2: additional syscall register 2
- * @a3: additional syscall register 3
- * @a4: additional syscall register 4
+ * @a0: additional syscall register 1
+ * @a1: additional syscall register 2
+ * @a2: additional syscall register 3
+ * @a3: additional syscall register 4
+ * @a4: additional syscall register 5
+ * @a5: additional syscall register 6
*
* Fill in audit context at syscall entry. This only happens if the
* audit context was created when the task was created and the state or
@@ -1983,8 +1989,9 @@ void __audit_uring_exit(int success, long code)
* will only be written if another part of the kernel requests that it
* be written).
*/
-void __audit_syscall_entry(int major, unsigned long a1, unsigned long a2,
- unsigned long a3, unsigned long a4)
+void __audit_syscall_entry(int major, unsigned long a0, unsigned long a1,
+ unsigned long a2, unsigned long a3,
+ unsigned long a4, unsigned long a5)
{
struct audit_context *context = audit_context();
enum audit_state state;
@@ -2012,10 +2019,12 @@ void __audit_syscall_entry(int major, unsigned long a1, unsigned long a2,
context->arch = syscall_get_arch(current);
context->major = major;
- context->argv[0] = a1;
- context->argv[1] = a2;
- context->argv[2] = a3;
- context->argv[3] = a4;
+ context->argv[0] = a0;
+ context->argv[1] = a1;
+ context->argv[2] = a2;
+ context->argv[3] = a3;
+ context->argv[4] = a4;
+ context->argv[5] = a5;
context->context = AUDIT_CTX_SYSCALL;
context->current_state = state;
ktime_get_coarse_real_ts64(&context->stamp.ctime);
--
2.55.0
More information about the linux-arm-kernel
mailing list