1c30e3af8a
The openat2(2) syscall was added in kernel v5.6 with commit
fddb5d430a ("open: introduce openat2(2) syscall").
Add the openat2(2) syscall to the audit syscall classifier.
Link: https://github.com/linux-audit/audit-kernel/issues/67
Link: https://lore.kernel.org/r/f5f1a4d8699613f8c02ce762807228c841c2e26f.1621363275.git.rgb@redhat.com
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
[PM: merge fuzz due to previous header rename, commit line wraps]
Signed-off-by: Paul Moore <paul@paul-moore.com>
49 lines
864 B
C
49 lines
864 B
C
// SPDX-License-Identifier: GPL-2.0
|
|
#include <linux/audit_arch.h>
|
|
#include <asm/unistd_32.h>
|
|
#include <asm/audit.h>
|
|
|
|
unsigned ia32_dir_class[] = {
|
|
#include <asm-generic/audit_dir_write.h>
|
|
~0U
|
|
};
|
|
|
|
unsigned ia32_chattr_class[] = {
|
|
#include <asm-generic/audit_change_attr.h>
|
|
~0U
|
|
};
|
|
|
|
unsigned ia32_write_class[] = {
|
|
#include <asm-generic/audit_write.h>
|
|
~0U
|
|
};
|
|
|
|
unsigned ia32_read_class[] = {
|
|
#include <asm-generic/audit_read.h>
|
|
~0U
|
|
};
|
|
|
|
unsigned ia32_signal_class[] = {
|
|
#include <asm-generic/audit_signal.h>
|
|
~0U
|
|
};
|
|
|
|
int ia32_classify_syscall(unsigned syscall)
|
|
{
|
|
switch (syscall) {
|
|
case __NR_open:
|
|
return AUDITSC_OPEN;
|
|
case __NR_openat:
|
|
return AUDITSC_OPENAT;
|
|
case __NR_socketcall:
|
|
return AUDITSC_SOCKETCALL;
|
|
case __NR_execve:
|
|
case __NR_execveat:
|
|
return AUDITSC_EXECVE;
|
|
case __NR_openat2:
|
|
return AUDITSC_OPENAT2;
|
|
default:
|
|
return AUDITSC_COMPAT;
|
|
}
|
|
}
|