[PATCH v3 01/14] audit: log all six syscall arguments in the SYSCALL record

[Oleg Nesterov]

On 09/22, Ricardo Robaina wrote:
>
> The SYSCALL record currently logs only four of the six syscall
> arguments (a0-a3). The remaining two are captured but silently
> discarded before reaching the audit context. This leads to the
> need for auxiliary records when audit-relevant data lands in the
> 5th or 6th argument of a syscall.
>
> Extend the SYSCALL record to log all six arguments, by adding
> arguments a4 and a5 (5th and 6th syscall arguments respectively)
> inline within the existing record. Also add the two new args to
> the audit rules switch case, so audit rules can filter on them.
>
> Rather than plumbing two more register arguments through every
> architecture's syscall entry path, retrieve the arguments from
> pt_regs via syscall_get_arguments(). To keep the series bisectable,
> add new helpers audit_syscall_entry_regs() and
> __audit_syscall_entry_regs() that take a pointer to pt_regs, rather
> than modifying the existing ones in place. Later patches convert
> each architecture over to the new helpers, and a final patch removes
> the legacy helpers and renames the new ones back to the original
> naming.

Reviewed-by: Oleg Nesterov <oleg at redhat.com>