| Message ID | 4ada9fcbb93af8d5c1c9bfe2c83d94fc10bfe327.1788351089.git.rrobaina@redhat.com |
|---|---|
| State | New |
| Headers | show |
| Series | audit: log all six syscall arguments in the SYSCALL record | expand |
Hi Ricardo, On Wed, Sep 2, 2026 at 4:44 PM Ricardo Robaina <rrobaina@redhat.com> wrote: > > audit_syscall_entry() now takes a pointer to pt_regs and extracts > the syscall arguments itself via syscall_get_arguments(). Drop the > individual argument registers from the call and pass regs instead. > > Signed-off-by: Ricardo Robaina <rrobaina@redhat.com> > --- > arch/alpha/kernel/ptrace.c | 3 +-- > 1 file changed, 1 insertion(+), 2 deletions(-) > > diff --git a/arch/alpha/kernel/ptrace.c b/arch/alpha/kernel/ptrace.c > index fc8f6cedbb28..8a39c0473297 100644 > --- a/arch/alpha/kernel/ptrace.c > +++ b/arch/alpha/kernel/ptrace.c > @@ -496,8 +496,7 @@ asmlinkage unsigned long syscall_trace_enter(void) > } > > #ifdef CONFIG_AUDITSYSCALL > - audit_syscall_entry(syscall_get_nr(current, regs), > - regs->r16, regs->r17, regs->r18, regs->r19); > + audit_syscall_entry(syscall_get_nr(current, regs), regs); > #endif > return syscall_get_nr(current, regs); > } > -- > 2.55.0 > This doesn't apply on top of my "alpha: enable GENERIC_ENTRY" series https://lore.kernel.org/linux-alpha/20260902184058.198679-1-linmag7@gmail.com/T/#t That series moves alpha's syscall entry onto the generic entry framework and removes syscall_trace_enter() and its direct audit_syscall_entry() call entirely - verified with git am against GENERIC_ENTRY applied, it fails at exactly this hunk. You don't need a replacement alpha patch, though. Once GENERIC_ENTRY lands, alpha's syscall entry goes through syscall_enter_from_user_mode_randomize_stack(), which already calls syscall_enter_audit() as part of the shared entry helpers (include/linux/entry-common.h). I applied patch 1/13 alone on top of GENERIC_ENTRY and confirmed alpha's entry path already routes through the updated __audit_syscall_entry() - no alpha-specific code needed. So for alpha, you can drop this patch in the next revision rather than rebase it. Regards Magnus
diff --git a/arch/alpha/kernel/ptrace.c b/arch/alpha/kernel/ptrace.c index fc8f6cedbb28..8a39c0473297 100644 --- a/arch/alpha/kernel/ptrace.c +++ b/arch/alpha/kernel/ptrace.c @@ -496,8 +496,7 @@ asmlinkage unsigned long syscall_trace_enter(void) } #ifdef CONFIG_AUDITSYSCALL - audit_syscall_entry(syscall_get_nr(current, regs), - regs->r16, regs->r17, regs->r18, regs->r19); + audit_syscall_entry(syscall_get_nr(current, regs), regs); #endif return syscall_get_nr(current, regs); }
audit_syscall_entry() now takes a pointer to pt_regs and extracts the syscall arguments itself via syscall_get_arguments(). Drop the individual argument registers from the call and pass regs instead. Signed-off-by: Ricardo Robaina <rrobaina@redhat.com> --- arch/alpha/kernel/ptrace.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)