audit: add support for the openat2 syscall

rgbriggs · pcmoore · commit 1c30e3af8a79 · 2021-10-01T16:52:48.000-04:00
The openat2(2) syscall was added in kernel v5.6 with commit fddb5d4 ("open: introduce openat2(2) syscall"). Add the openat2(2) syscall to the audit syscall classifier. Link: linux-audit/audit-kernel#67 Link: https://lore.kernel.org/r/f5f1a4d8699613f8c02ce762807228c841c2e26f.1621363275.git.rgb@redhat.com Signed-off-by: Richard Guy Briggs <rgb@redhat.com> Acked-by: Christian Brauner <christian.brauner@ubuntu.com> [PM: merge fuzz due to previous header rename, commit line wraps] Signed-off-by: Paul Moore <paul@paul-moore.com>
diff --git a/arch/alpha/kernel/audit.c b/arch/alpha/kernel/audit.c
@@ -42,6 +42,8 @@ int audit_classify_syscall(int abi, unsigned syscall)
 		return AUDITSC_OPENAT;
 	case __NR_execve:
 		return AUDITSC_EXECVE;
+	case __NR_openat2:
+		return AUDITSC_OPENAT2;
 	default:
 		return AUDITSC_NATIVE;
 	}
diff --git a/arch/ia64/kernel/audit.c b/arch/ia64/kernel/audit.c
@@ -43,6 +43,8 @@ int audit_classify_syscall(int abi, unsigned syscall)
 		return AUDITSC_OPENAT;
 	case __NR_execve:
 		return AUDITSC_EXECVE;
+	case __NR_openat2:
+		return AUDITSC_OPENAT2;
 	default:
 		return AUDITSC_NATIVE;
 	}
diff --git a/arch/parisc/kernel/audit.c b/arch/parisc/kernel/audit.c
@@ -52,6 +52,8 @@ int audit_classify_syscall(int abi, unsigned syscall)
 		return AUDITSC_OPENAT;
 	case __NR_execve:
 		return AUDITSC_EXECVE;
+	case __NR_openat2:
+		return AUDITSC_OPENAT2;
 	default:
 		return AUDITSC_NATIVE;
 	}
diff --git a/arch/parisc/kernel/compat_audit.c b/arch/parisc/kernel/compat_audit.c
@@ -36,6 +36,8 @@ int parisc32_classify_syscall(unsigned syscall)
 		return AUDITSC_OPENAT;
 	case __NR_execve:
 		return AUDITSC_EXECVE;
+	case __NR_openat2:
+		return AUDITSC_OPENAT2;
 	default:
 		return AUDITSC_COMPAT;
 	}
diff --git a/arch/powerpc/kernel/audit.c b/arch/powerpc/kernel/audit.c
@@ -54,6 +54,8 @@ int audit_classify_syscall(int abi, unsigned syscall)
 		return AUDITSC_SOCKETCALL;
 	case __NR_execve:
 		return AUDITSC_EXECVE;
+	case __NR_openat2:
+		return AUDITSC_OPENAT2;
 	default:
 		return AUDITSC_NATIVE;
 	}
diff --git a/arch/powerpc/kernel/compat_audit.c b/arch/powerpc/kernel/compat_audit.c
@@ -39,6 +39,8 @@ int ppc32_classify_syscall(unsigned syscall)
 		return AUDITSC_SOCKETCALL;
 	case __NR_execve:
 		return AUDITSC_EXECVE;
+	case __NR_openat2:
+		return AUDITSC_OPENAT2;
 	default:
 		return AUDITSC_COMPAT;
 	}
diff --git a/arch/s390/kernel/audit.c b/arch/s390/kernel/audit.c
@@ -54,6 +54,8 @@ int audit_classify_syscall(int abi, unsigned syscall)
 		return AUDITSC_SOCKETCALL;
 	case __NR_execve:
 		return AUDITSC_EXECVE;
+	case __NR_openat2:
+		return AUDITSC_OPENAT2;
 	default:
 		return AUDITSC_NATIVE;
 	}
diff --git a/arch/s390/kernel/compat_audit.c b/arch/s390/kernel/compat_audit.c
@@ -40,6 +40,8 @@ int s390_classify_syscall(unsigned syscall)
 		return AUDITSC_SOCKETCALL;
 	case __NR_execve:
 		return AUDITSC_EXECVE;
+	case __NR_openat2:
+		return AUDITSC_OPENAT2;
 	default:
 		return AUDITSC_COMPAT;
 	}
diff --git a/arch/sparc/kernel/audit.c b/arch/sparc/kernel/audit.c
@@ -55,6 +55,8 @@ int audit_classify_syscall(int abi, unsigned int syscall)
 		return AUDITSC_SOCKETCALL;
 	case __NR_execve:
 		return AUDITSC_EXECVE;
+	case __NR_openat2:
+		return AUDITSC_OPENAT2;
 	default:
 		return AUDITSC_NATIVE;
 	}
diff --git a/arch/sparc/kernel/compat_audit.c b/arch/sparc/kernel/compat_audit.c
@@ -40,6 +40,8 @@ int sparc32_classify_syscall(unsigned int syscall)
 		return AUDITSC_SOCKETCALL;
 	case __NR_execve:
 		return AUDITSC_EXECVE;
+	case __NR_openat2:
+		return AUDITSC_OPENAT2;
 	default:
 		return AUDITSC_COMPAT;
 	}
diff --git a/arch/x86/ia32/audit.c b/arch/x86/ia32/audit.c
@@ -40,6 +40,8 @@ int ia32_classify_syscall(unsigned syscall)
 	case __NR_execve:
 	case __NR_execveat:
 		return AUDITSC_EXECVE;
+	case __NR_openat2:
+		return AUDITSC_OPENAT2;
 	default:
 		return AUDITSC_COMPAT;
 	}
diff --git a/arch/x86/kernel/audit_64.c b/arch/x86/kernel/audit_64.c
@@ -53,6 +53,8 @@ int audit_classify_syscall(int abi, unsigned syscall)
 	case __NR_execve:
 	case __NR_execveat:
 		return AUDITSC_EXECVE;
+	case __NR_openat2:
+		return AUDITSC_OPENAT2;
 	default:
 		return AUDITSC_NATIVE;
 	}
diff --git a/include/linux/audit_arch.h b/include/linux/audit_arch.h
@@ -16,6 +16,7 @@ enum auditsc_class_t {
 	AUDITSC_OPENAT,
 	AUDITSC_SOCKETCALL,
 	AUDITSC_EXECVE,
+	AUDITSC_OPENAT2,
 
 	AUDITSC_NVALS /* count */
 };
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
@@ -63,6 +63,7 @@
 #include <linux/fsnotify_backend.h>
 #include <uapi/linux/limits.h>
 #include <uapi/linux/netfilter/nf_tables.h>
+#include <uapi/linux/openat2.h>
 
 #include "audit.h"
 
@@ -183,6 +184,8 @@ static int audit_match_perm(struct audit_context *ctx, int mask)
 		return ((mask & AUDIT_PERM_WRITE) && ctx->argv[0] == SYS_BIND);
 	case AUDITSC_EXECVE:
 		return mask & AUDIT_PERM_EXEC;
+	case AUDITSC_OPENAT2:
+		return mask & ACC_MODE((u32)((struct open_how *)ctx->argv[2])->flags);
 	default:
 		return 0;
 	}
diff --git a/lib/audit.c b/lib/audit.c
@@ -60,6 +60,10 @@ int audit_classify_syscall(int abi, unsigned syscall)
 #endif
 	case __NR_execve:
 		return AUDITSC_EXECVE;
+#ifdef __NR_openat2
+	case __NR_openat2:
+		return AUDITSC_OPENAT2;
+#endif
 	default:
 		return AUDITSC_NATIVE;
 	}
diff --git a/lib/compat_audit.c b/lib/compat_audit.c
@@ -46,6 +46,10 @@ int audit_classify_compat_syscall(int abi, unsigned syscall)
 #endif
 	case __NR_execve:
 		return AUDITSC_EXECVE;
+#ifdef __NR_openat2
+	case __NR_openat2:
+		return AUDITSC_OPENAT2;
+#endif
 	default:
 		return AUDITSC_COMPAT;
 	}

Original file line number	Diff line number	Diff line change
`@@ -42,6 +42,8 @@ int audit_classify_syscall(int abi, unsigned syscall)`
`42`	`42`	`return AUDITSC_OPENAT;`
`43`	`43`	`case __NR_execve:`
`44`	`44`	`return AUDITSC_EXECVE;`
	`45`	`+ case __NR_openat2:`
	`46`	`+ return AUDITSC_OPENAT2;`
`45`	`47`	`default:`
`46`	`48`	`return AUDITSC_NATIVE;`
`47`	`49`	`}`
Original file line number	Diff line number	Diff line change
`@@ -43,6 +43,8 @@ int audit_classify_syscall(int abi, unsigned syscall)`
`43`	`43`	`return AUDITSC_OPENAT;`
`44`	`44`	`case __NR_execve:`
`45`	`45`	`return AUDITSC_EXECVE;`
	`46`	`+ case __NR_openat2:`
	`47`	`+ return AUDITSC_OPENAT2;`
`46`	`48`	`default:`
`47`	`49`	`return AUDITSC_NATIVE;`
`48`	`50`	`}`
Original file line number	Diff line number	Diff line change
`@@ -52,6 +52,8 @@ int audit_classify_syscall(int abi, unsigned syscall)`
`52`	`52`	`return AUDITSC_OPENAT;`
`53`	`53`	`case __NR_execve:`
`54`	`54`	`return AUDITSC_EXECVE;`
	`55`	`+ case __NR_openat2:`
	`56`	`+ return AUDITSC_OPENAT2;`
`55`	`57`	`default:`
`56`	`58`	`return AUDITSC_NATIVE;`
`57`	`59`	`}`
Original file line number	Diff line number	Diff line change
`@@ -36,6 +36,8 @@ int parisc32_classify_syscall(unsigned syscall)`
`36`	`36`	`return AUDITSC_OPENAT;`
`37`	`37`	`case __NR_execve:`
`38`	`38`	`return AUDITSC_EXECVE;`
	`39`	`+ case __NR_openat2:`
	`40`	`+ return AUDITSC_OPENAT2;`
`39`	`41`	`default:`
`40`	`42`	`return AUDITSC_COMPAT;`
`41`	`43`	`}`
Original file line number	Diff line number	Diff line change
`@@ -54,6 +54,8 @@ int audit_classify_syscall(int abi, unsigned syscall)`
`54`	`54`	`return AUDITSC_SOCKETCALL;`
`55`	`55`	`case __NR_execve:`
`56`	`56`	`return AUDITSC_EXECVE;`
	`57`	`+ case __NR_openat2:`
	`58`	`+ return AUDITSC_OPENAT2;`
`57`	`59`	`default:`
`58`	`60`	`return AUDITSC_NATIVE;`
`59`	`61`	`}`
Original file line number	Diff line number	Diff line change
`@@ -39,6 +39,8 @@ int ppc32_classify_syscall(unsigned syscall)`
`39`	`39`	`return AUDITSC_SOCKETCALL;`
`40`	`40`	`case __NR_execve:`
`41`	`41`	`return AUDITSC_EXECVE;`
	`42`	`+ case __NR_openat2:`
	`43`	`+ return AUDITSC_OPENAT2;`
`42`	`44`	`default:`
`43`	`45`	`return AUDITSC_COMPAT;`
`44`	`46`	`}`
Original file line number	Diff line number	Diff line change
`@@ -40,6 +40,8 @@ int s390_classify_syscall(unsigned syscall)`
`40`	`40`	`return AUDITSC_SOCKETCALL;`
`41`	`41`	`case __NR_execve:`
`42`	`42`	`return AUDITSC_EXECVE;`
	`43`	`+ case __NR_openat2:`
	`44`	`+ return AUDITSC_OPENAT2;`
`43`	`45`	`default:`
`44`	`46`	`return AUDITSC_COMPAT;`
`45`	`47`	`}`
Original file line number	Diff line number	Diff line change
`@@ -55,6 +55,8 @@ int audit_classify_syscall(int abi, unsigned int syscall)`
`55`	`55`	`return AUDITSC_SOCKETCALL;`
`56`	`56`	`case __NR_execve:`
`57`	`57`	`return AUDITSC_EXECVE;`
	`58`	`+ case __NR_openat2:`
	`59`	`+ return AUDITSC_OPENAT2;`
`58`	`60`	`default:`
`59`	`61`	`return AUDITSC_NATIVE;`
`60`	`62`	`}`
Original file line number	Diff line number	Diff line change
`@@ -40,6 +40,8 @@ int sparc32_classify_syscall(unsigned int syscall)`
`40`	`40`	`return AUDITSC_SOCKETCALL;`
`41`	`41`	`case __NR_execve:`
`42`	`42`	`return AUDITSC_EXECVE;`
	`43`	`+ case __NR_openat2:`
	`44`	`+ return AUDITSC_OPENAT2;`
`43`	`45`	`default:`
`44`	`46`	`return AUDITSC_COMPAT;`
`45`	`47`	`}`