audit: drop unused struct audit_rule definition

The kernel only uses struct audit_rule_data.  We dropped support for
struct audit_rule a long time ago.  Drop the definition in the header
file.

Signed-off-by: Eric Paris <eparis@redhat.com>
syscall.h: fix doc text for syscall_get_arch()

syscall_get_arch() used to take a task as a argument.  It now uses
current.  Fix the doc text.

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
SH: define syscall_get_arch() for superh

This patch defines syscall_get_arch() for the superh platform.  It does
so in both syscall_32.h and syscall_64.h.  I'm not certain if the
implementation in syscall_64.h couldn't just be used in syscall.h as I
can't really track the setting of CONFIG_64BIT...

This way is safe, but we might be able to combine these if a superh
person were able to review...

[v2]
	fixed indentation stoopidity (Sergei Shtylyov)
	use AUDIT_ARCH_SH instead of EM_SH

Based-on-patch-by: Richard Briggs <rgb@redhat.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
Cc: linux-sh@vger.kernel.org
UM: implement syscall_get_arch()

This patch defines syscall_get_arch() for the um platform.  It adds a
new syscall.h header file to define this.  It copies the HOST_AUDIT_ARCH
definition from ptrace.h.  (that definition will be removed when we
switch audit to use this new syscall_get_arch() function)

Based-on-patch-by: Richard Briggs <rgb@redhat.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
Cc: user-mode-linux-devel@lists.sourceforge.net
Alpha: define syscall_get_arch()

Since Alpha supports syscall audit it now needs to have a syscall.h
which implements syscall_get_arch() rather than hard coding this value
into audit_syscall_entry().

Based-on-patch-by: Richard Briggs <rgb@redhat.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
Cc: linux-alpha@vger.kernel.org
ARCH: AUDIT: implement syscall_get_arch for all arches

For all arches which support audit implement syscall_get_arch()
They are all pretty easy and straight forward, stolen from how the call
to audit_syscall_entry() determines the arch.

Based-on-patch-by: Richard Briggs <rgb@redhat.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
Cc: linux-ia64@vger.kernel.org
Cc: microblaze-uclinux@itee.uq.edu.au
Cc: linux-mips@linux-mips.org
Cc: linux@lists.openrisc.net
Cc: linux-parisc@vger.kernel.org
Cc: linuxppc-dev@lists.ozlabs.org
Cc: sparclinux@vger.kernel.org
ARCH: AUDIT: audit_syscall_entry() should not require the arch

We have a function where the arch can be queried, syscall_get_arch().
So rather than have every single piece of arch specific code use and/or
duplicate syscall_get_arch(), just have the audit code use the
syscall_get_arch() code.

Based-on-patch-by: Richard Briggs <rgb@redhat.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
Cc: linux-alpha@vger.kernel.org
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-ia64@vger.kernel.org
Cc: microblaze-uclinux@itee.uq.edu.au
Cc: linux-mips@linux-mips.org
Cc: linux@lists.openrisc.net
Cc: linux-parisc@vger.kernel.org
Cc: linuxppc-dev@lists.ozlabs.org
Cc: linux-s390@vger.kernel.org
Cc: linux-sh@vger.kernel.org
Cc: sparclinux@vger.kernel.org
Cc: user-mode-linux-devel@lists.sourceforge.net
Cc: linux-xtensa@linux-xtensa.org
Cc: x86@kernel.org
audit: __audit_syscall_entry: ignore arch arg and call syscall_get_arch() directly

Since every arch should have syscall_get_arch() defined, stop using the
function argument and just collect this ourselves.  We do not drop the
argument as fixing some code paths (in assembly) to not pass this first
argument is non-trivial.  The argument will be dropped when that is
fixed.

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
audit: add arch field to seccomp event log

The AUDIT_SECCOMP record looks something like this:

type=SECCOMP msg=audit(1373478171.953:32775): auid=4325 uid=4325 gid=4325 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0 pid=12381 comm="test" sig=31 syscall=231 compat=0 ip=0x39ea8bca89 code=0x0

In order to determine what syscall 231 maps to, we need to have the arch= field right before it.

To see the event, compile this test.c program:

=====
int main(void)
{
        return seccomp_load(seccomp_init(SCMP_ACT_KILL));
}
=====

gcc -g test.c -o test -lseccomp

After running the program, find the record by:  ausearch --start recent -m SECCOMP -i

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
signed-off-by: Eric Paris <eparis@redhat.com>
audit: fix build error when asm/syscall.h does not exist

avr32 does not have an asm/syscall.h file.  We need the
syscall_get_arch() definition from that file for all arch's which
support CONFIG_AUDITSYSCALL.  Obviously avr32 is not one of those
arch's.  Move the include inside the CONFIG_AUDITSYSCALL such that we
only do the include if we need the results.

When the syscall_get_arch() call is moved inside __audit_syscall_entry()
this include can be dropped entirely.  But that is going to require some
assembly changes on x86* in a patch that is not ready for the tree...

Reported-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
sparc: simplify syscall_get_arch()

Include linux/thread_info.h so we can use is_32_bit_task() cleanly.
Then just simplify syscall_get_arch() since is_32_bit_task() works for
all configuration options.

Suggested-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Eric Paris <eparis@redhat.com>
sparc: properly conditionalize use of TIF_32BIT

After merging the audit tree, today's linux-next build (sparc defconfig)
failed like this:

In file included from include/linux/audit.h:29:0,
                 from mm/mmap.c:33:
arch/sparc/include/asm/syscall.h: In function 'syscall_get_arch':
arch/sparc/include/asm/syscall.h:131:9: error: 'TIF_32BIT' undeclared (first use in this function)
arch/sparc/include/asm/syscall.h:131:9: note: each undeclared identifier is reported only once for each function it appears in

And many more ...

Caused by commit 374c0c054122 ("ARCH: AUDIT: implement syscall_get_arch
for all arches").

This patch wraps the usage of TIF_32BIT in:
   if defined(__sparc__) && defined(__arch64__)
Which solves the build problem.

Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Acked-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
sparc: implement is_32bit_task

We are currently embedding the same check from thread_info.h into
syscall.h thanks to the way syscall_get_arch() was implemented in the
audit tree.  Instead create a new function, is_32bit_task() which is
similar to that found on the powerpc arch.  This simplifies the
syscall.h code and makes the build/Kconfig requirements much easier
to understand.

Signed-off-by: Eric Paris <eparis@redhat.com
Acked-by: David S. Miller <davem@davemloft.net>
Cc: Stephen Rothwell <sfr@canb.auug.org.au>
Cc: sparclinux@vger.kernel.org
audit: x86: drop arch from __audit_syscall_entry() interface

Since the arch is found locally in __audit_syscall_entry(), there is no need to
pass it in as a parameter.  Delete it from the parameter list.

x86* was the only arch to call __audit_syscall_entry() directly and did so from
assembly code.

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: x86@kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: linux-audit@redhat.com
Signed-off-by: Eric Paris <eparis@redhat.com>

---

As this patch relies on changes in the audit tree, I think it
appropriate to send it through my tree rather than the x86 tree.
arm64: audit: Add audit hook in syscall_trace_enter/exit()

This patch adds auditing functions on entry to or exit from
every system call invocation.

Acked-by: Richard Guy Briggs <rgb@redhat.com>
Acked-by Will Deacon <will.deacon@arm.com>
Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
audit: arm64: Remove the audit arch argument to audit_syscall_entry

The arm64 tree added calls to audit_syscall_entry() and rightly included
the syscall number.  The interface has since been changed to not need
the syscall number.  As such, arm64 should no longer pass that value.

Signed-off-by: Eric Paris <eparis@redhat.com>
audit: reduce scope of audit_net_id

audit_net_id isn't used outside kernel/audit.c.  Reduce its scope.

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
audit: reduce scope of audit_log_fcaps

audit_log_fcaps() isn't used outside kernel/audit.c.  Reduce its scope.

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
kernel/audit.c: use ARRAY_SIZE instead of sizeof/sizeof[0]

Use kernel.h definition.

Cc: Eric Paris <eparis@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Fabian Frederick <fabf@skynet.be>
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
audit: use atomic_t to simplify audit_serial()

Since there is already a primitive to do this operation in the atomic_t, use it
to simplify audit_serial().

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>