Loading arch/i386/kernel/ptrace.c +9 −10 Original line number Diff line number Diff line Loading @@ -683,24 +683,18 @@ void do_syscall_trace(struct pt_regs *regs, int entryexit) /* do the secure computing check first */ secure_computing(regs->orig_eax); if (unlikely(current->audit_context)) { if (!entryexit) audit_syscall_entry(current, regs->orig_eax, regs->ebx, regs->ecx, regs->edx, regs->esi); else audit_syscall_exit(current, regs->eax); } if (unlikely(current->audit_context) && entryexit) audit_syscall_exit(current, AUDITSC_RESULT(regs->eax), regs->eax); if (!(current->ptrace & PT_PTRACED)) return; goto out; /* Fake a debug trap */ if (test_thread_flag(TIF_SINGLESTEP)) send_sigtrap(current, regs, 0); if (!test_thread_flag(TIF_SYSCALL_TRACE)) return; goto out; /* the 0x80 provides a way for the tracing parent to distinguish between a syscall stop and SIGTRAP delivery */ Loading @@ -715,4 +709,9 @@ void do_syscall_trace(struct pt_regs *regs, int entryexit) send_sig(current->exit_code, current, 1); current->exit_code = 0; } out: if (unlikely(current->audit_context) && !entryexit) audit_syscall_entry(current, AUDIT_ARCH_I386, regs->orig_eax, regs->ebx, regs->ecx, regs->edx, regs->esi); } arch/ia64/kernel/ptrace.c +13 −8 Original line number Diff line number Diff line Loading @@ -1596,20 +1596,25 @@ syscall_trace_enter (long arg0, long arg1, long arg2, long arg3, long arg4, long arg5, long arg6, long arg7, struct pt_regs regs) { long syscall; if (test_thread_flag(TIF_SYSCALL_TRACE) && (current->ptrace & PT_PTRACED)) syscall_trace(); if (unlikely(current->audit_context)) { if (IS_IA32_PROCESS(®s)) long syscall; int arch; if (IS_IA32_PROCESS(®s)) { syscall = regs.r1; else arch = AUDIT_ARCH_I386; } else { syscall = regs.r15; arch = AUDIT_ARCH_IA64; } audit_syscall_entry(current, syscall, arg0, arg1, arg2, arg3); audit_syscall_entry(current, arch, syscall, arg0, arg1, arg2, arg3); } if (test_thread_flag(TIF_SYSCALL_TRACE) && (current->ptrace & PT_PTRACED)) syscall_trace(); } /* "asmlinkage" so the input arguments are preserved... */ Loading @@ -1620,7 +1625,7 @@ syscall_trace_leave (long arg0, long arg1, long arg2, long arg3, struct pt_regs regs) { if (unlikely(current->audit_context)) audit_syscall_exit(current, regs.r8); audit_syscall_exit(current, AUDITSC_RESULT(regs.r10), regs.r8); if (test_thread_flag(TIF_SYSCALL_TRACE) && (current->ptrace & PT_PTRACED)) Loading arch/mips/kernel/ptrace.c +28 −10 Original line number Diff line number Diff line Loading @@ -301,25 +301,38 @@ asmlinkage int sys_ptrace(long request, long pid, long addr, long data) return ret; } static inline int audit_arch(void) { #ifdef CONFIG_CPU_LITTLE_ENDIAN #ifdef CONFIG_MIPS64 if (!(current->thread.mflags & MF_32BIT_REGS)) return AUDIT_ARCH_MIPSEL64; #endif /* MIPS64 */ return AUDIT_ARCH_MIPSEL; #else /* big endian... */ #ifdef CONFIG_MIPS64 if (!(current->thread.mflags & MF_32BIT_REGS)) return AUDIT_ARCH_MIPS64; #endif /* MIPS64 */ return AUDIT_ARCH_MIPS; #endif /* endian */ } /* * Notification of system call entry/exit * - triggered by current->work.syscall_trace */ asmlinkage void do_syscall_trace(struct pt_regs *regs, int entryexit) { if (unlikely(current->audit_context)) { if (!entryexit) audit_syscall_entry(current, regs->regs[2], regs->regs[4], regs->regs[5], regs->regs[6], regs->regs[7]); else audit_syscall_exit(current, regs->regs[2]); } if (unlikely(current->audit_context) && entryexit) audit_syscall_exit(current, AUDITSC_RESULT(regs->regs[2]), regs->regs[2]); if (!test_thread_flag(TIF_SYSCALL_TRACE)) return; goto out; if (!(current->ptrace & PT_PTRACED)) return; goto out; /* The 0x80 provides a way for the tracing parent to distinguish between a syscall stop and SIGTRAP delivery */ Loading @@ -335,4 +348,9 @@ asmlinkage void do_syscall_trace(struct pt_regs *regs, int entryexit) send_sig(current->exit_code, current, 1); current->exit_code = 0; } out: if (unlikely(current->audit_context) && !entryexit) audit_syscall_entry(current, audit_arch(), regs->regs[2], regs->regs[4], regs->regs[5], regs->regs[6], regs->regs[7]); } arch/ppc64/kernel/ptrace.c +10 −5 Original line number Diff line number Diff line Loading @@ -305,14 +305,17 @@ static void do_syscall_trace(void) void do_syscall_trace_enter(struct pt_regs *regs) { if (test_thread_flag(TIF_SYSCALL_TRACE) && (current->ptrace & PT_PTRACED)) do_syscall_trace(); if (unlikely(current->audit_context)) audit_syscall_entry(current, regs->gpr[0], audit_syscall_entry(current, test_thread_flag(TIF_32BIT)?AUDIT_ARCH_PPC:AUDIT_ARCH_PPC64, regs->gpr[0], regs->gpr[3], regs->gpr[4], regs->gpr[5], regs->gpr[6]); if (test_thread_flag(TIF_SYSCALL_TRACE) && (current->ptrace & PT_PTRACED)) do_syscall_trace(); } void do_syscall_trace_leave(struct pt_regs *regs) Loading @@ -320,7 +323,9 @@ void do_syscall_trace_leave(struct pt_regs *regs) secure_computing(regs->gpr[0]); if (unlikely(current->audit_context)) audit_syscall_exit(current, regs->result); audit_syscall_exit(current, (regs->ccr&0x1000)?AUDITSC_FAILURE:AUDITSC_SUCCESS, regs->result); if ((test_thread_flag(TIF_SYSCALL_TRACE) || test_thread_flag(TIF_SINGLESTEP)) Loading arch/s390/kernel/ptrace.c +11 −10 Original line number Diff line number Diff line Loading @@ -712,18 +712,13 @@ sys_ptrace(long request, long pid, long addr, long data) asmlinkage void syscall_trace(struct pt_regs *regs, int entryexit) { if (unlikely(current->audit_context)) { if (!entryexit) audit_syscall_entry(current, regs->gprs[2], regs->orig_gpr2, regs->gprs[3], regs->gprs[4], regs->gprs[5]); else audit_syscall_exit(current, regs->gprs[2]); } if (unlikely(current->audit_context) && entryexit) audit_syscall_exit(current, AUDITSC_RESULT(regs->gprs[2]), regs->gprs[2]); if (!test_thread_flag(TIF_SYSCALL_TRACE)) return; goto out; if (!(current->ptrace & PT_PTRACED)) return; goto out; ptrace_notify(SIGTRAP | ((current->ptrace & PT_TRACESYSGOOD) ? 0x80 : 0)); Loading @@ -736,4 +731,10 @@ syscall_trace(struct pt_regs *regs, int entryexit) send_sig(current->exit_code, current, 1); current->exit_code = 0; } out: if (unlikely(current->audit_context) && !entryexit) audit_syscall_entry(current, test_thread_flag(TIF_31BIT)?AUDIT_ARCH_S390:AUDIT_ARCH_S390X, regs->gprs[2], regs->orig_gpr2, regs->gprs[3], regs->gprs[4], regs->gprs[5]); } Loading
arch/i386/kernel/ptrace.c +9 −10 Original line number Diff line number Diff line Loading @@ -683,24 +683,18 @@ void do_syscall_trace(struct pt_regs *regs, int entryexit) /* do the secure computing check first */ secure_computing(regs->orig_eax); if (unlikely(current->audit_context)) { if (!entryexit) audit_syscall_entry(current, regs->orig_eax, regs->ebx, regs->ecx, regs->edx, regs->esi); else audit_syscall_exit(current, regs->eax); } if (unlikely(current->audit_context) && entryexit) audit_syscall_exit(current, AUDITSC_RESULT(regs->eax), regs->eax); if (!(current->ptrace & PT_PTRACED)) return; goto out; /* Fake a debug trap */ if (test_thread_flag(TIF_SINGLESTEP)) send_sigtrap(current, regs, 0); if (!test_thread_flag(TIF_SYSCALL_TRACE)) return; goto out; /* the 0x80 provides a way for the tracing parent to distinguish between a syscall stop and SIGTRAP delivery */ Loading @@ -715,4 +709,9 @@ void do_syscall_trace(struct pt_regs *regs, int entryexit) send_sig(current->exit_code, current, 1); current->exit_code = 0; } out: if (unlikely(current->audit_context) && !entryexit) audit_syscall_entry(current, AUDIT_ARCH_I386, regs->orig_eax, regs->ebx, regs->ecx, regs->edx, regs->esi); }
arch/ia64/kernel/ptrace.c +13 −8 Original line number Diff line number Diff line Loading @@ -1596,20 +1596,25 @@ syscall_trace_enter (long arg0, long arg1, long arg2, long arg3, long arg4, long arg5, long arg6, long arg7, struct pt_regs regs) { long syscall; if (test_thread_flag(TIF_SYSCALL_TRACE) && (current->ptrace & PT_PTRACED)) syscall_trace(); if (unlikely(current->audit_context)) { if (IS_IA32_PROCESS(®s)) long syscall; int arch; if (IS_IA32_PROCESS(®s)) { syscall = regs.r1; else arch = AUDIT_ARCH_I386; } else { syscall = regs.r15; arch = AUDIT_ARCH_IA64; } audit_syscall_entry(current, syscall, arg0, arg1, arg2, arg3); audit_syscall_entry(current, arch, syscall, arg0, arg1, arg2, arg3); } if (test_thread_flag(TIF_SYSCALL_TRACE) && (current->ptrace & PT_PTRACED)) syscall_trace(); } /* "asmlinkage" so the input arguments are preserved... */ Loading @@ -1620,7 +1625,7 @@ syscall_trace_leave (long arg0, long arg1, long arg2, long arg3, struct pt_regs regs) { if (unlikely(current->audit_context)) audit_syscall_exit(current, regs.r8); audit_syscall_exit(current, AUDITSC_RESULT(regs.r10), regs.r8); if (test_thread_flag(TIF_SYSCALL_TRACE) && (current->ptrace & PT_PTRACED)) Loading
arch/mips/kernel/ptrace.c +28 −10 Original line number Diff line number Diff line Loading @@ -301,25 +301,38 @@ asmlinkage int sys_ptrace(long request, long pid, long addr, long data) return ret; } static inline int audit_arch(void) { #ifdef CONFIG_CPU_LITTLE_ENDIAN #ifdef CONFIG_MIPS64 if (!(current->thread.mflags & MF_32BIT_REGS)) return AUDIT_ARCH_MIPSEL64; #endif /* MIPS64 */ return AUDIT_ARCH_MIPSEL; #else /* big endian... */ #ifdef CONFIG_MIPS64 if (!(current->thread.mflags & MF_32BIT_REGS)) return AUDIT_ARCH_MIPS64; #endif /* MIPS64 */ return AUDIT_ARCH_MIPS; #endif /* endian */ } /* * Notification of system call entry/exit * - triggered by current->work.syscall_trace */ asmlinkage void do_syscall_trace(struct pt_regs *regs, int entryexit) { if (unlikely(current->audit_context)) { if (!entryexit) audit_syscall_entry(current, regs->regs[2], regs->regs[4], regs->regs[5], regs->regs[6], regs->regs[7]); else audit_syscall_exit(current, regs->regs[2]); } if (unlikely(current->audit_context) && entryexit) audit_syscall_exit(current, AUDITSC_RESULT(regs->regs[2]), regs->regs[2]); if (!test_thread_flag(TIF_SYSCALL_TRACE)) return; goto out; if (!(current->ptrace & PT_PTRACED)) return; goto out; /* The 0x80 provides a way for the tracing parent to distinguish between a syscall stop and SIGTRAP delivery */ Loading @@ -335,4 +348,9 @@ asmlinkage void do_syscall_trace(struct pt_regs *regs, int entryexit) send_sig(current->exit_code, current, 1); current->exit_code = 0; } out: if (unlikely(current->audit_context) && !entryexit) audit_syscall_entry(current, audit_arch(), regs->regs[2], regs->regs[4], regs->regs[5], regs->regs[6], regs->regs[7]); }
arch/ppc64/kernel/ptrace.c +10 −5 Original line number Diff line number Diff line Loading @@ -305,14 +305,17 @@ static void do_syscall_trace(void) void do_syscall_trace_enter(struct pt_regs *regs) { if (test_thread_flag(TIF_SYSCALL_TRACE) && (current->ptrace & PT_PTRACED)) do_syscall_trace(); if (unlikely(current->audit_context)) audit_syscall_entry(current, regs->gpr[0], audit_syscall_entry(current, test_thread_flag(TIF_32BIT)?AUDIT_ARCH_PPC:AUDIT_ARCH_PPC64, regs->gpr[0], regs->gpr[3], regs->gpr[4], regs->gpr[5], regs->gpr[6]); if (test_thread_flag(TIF_SYSCALL_TRACE) && (current->ptrace & PT_PTRACED)) do_syscall_trace(); } void do_syscall_trace_leave(struct pt_regs *regs) Loading @@ -320,7 +323,9 @@ void do_syscall_trace_leave(struct pt_regs *regs) secure_computing(regs->gpr[0]); if (unlikely(current->audit_context)) audit_syscall_exit(current, regs->result); audit_syscall_exit(current, (regs->ccr&0x1000)?AUDITSC_FAILURE:AUDITSC_SUCCESS, regs->result); if ((test_thread_flag(TIF_SYSCALL_TRACE) || test_thread_flag(TIF_SINGLESTEP)) Loading
arch/s390/kernel/ptrace.c +11 −10 Original line number Diff line number Diff line Loading @@ -712,18 +712,13 @@ sys_ptrace(long request, long pid, long addr, long data) asmlinkage void syscall_trace(struct pt_regs *regs, int entryexit) { if (unlikely(current->audit_context)) { if (!entryexit) audit_syscall_entry(current, regs->gprs[2], regs->orig_gpr2, regs->gprs[3], regs->gprs[4], regs->gprs[5]); else audit_syscall_exit(current, regs->gprs[2]); } if (unlikely(current->audit_context) && entryexit) audit_syscall_exit(current, AUDITSC_RESULT(regs->gprs[2]), regs->gprs[2]); if (!test_thread_flag(TIF_SYSCALL_TRACE)) return; goto out; if (!(current->ptrace & PT_PTRACED)) return; goto out; ptrace_notify(SIGTRAP | ((current->ptrace & PT_TRACESYSGOOD) ? 0x80 : 0)); Loading @@ -736,4 +731,10 @@ syscall_trace(struct pt_regs *regs, int entryexit) send_sig(current->exit_code, current, 1); current->exit_code = 0; } out: if (unlikely(current->audit_context) && !entryexit) audit_syscall_entry(current, test_thread_flag(TIF_31BIT)?AUDIT_ARCH_S390:AUDIT_ARCH_S390X, regs->gprs[2], regs->orig_gpr2, regs->gprs[3], regs->gprs[4], regs->gprs[5]); }