From owner-freebsd-ia64@FreeBSD.ORG  Fri Sep  1 07:11:08 2006
Return-Path: <owner-freebsd-ia64@FreeBSD.ORG>
X-Original-To: ia64@FreeBSD.org
Delivered-To: freebsd-ia64@FreeBSD.ORG
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id D656216A4DF;
	Fri,  1 Sep 2006 07:11:08 +0000 (UTC)
	(envelope-from rwatson@FreeBSD.org)
Received: from cyrus.watson.org (cyrus.watson.org [209.31.154.42])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 6C56443D45;
	Fri,  1 Sep 2006 07:11:08 +0000 (GMT)
	(envelope-from rwatson@FreeBSD.org)
Received: from fledge.watson.org (fledge.watson.org [209.31.154.41])
	by cyrus.watson.org (Postfix) with ESMTP id 5650746CD9;
	Fri,  1 Sep 2006 03:11:07 -0400 (EDT)
Date: Fri, 1 Sep 2006 08:11:07 +0100 (BST)
From: Robert Watson <rwatson@FreeBSD.org>
X-X-Sender: robert@fledge.watson.org
To: ppc@FreeBSD.org, ia64@FreeBSD.org
Message-ID: <20060901080402.W97485@fledge.watson.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
Cc: marcel@FreeBSD.org
Subject: IA64, PPC system call path audit patches
X-BeenThere: freebsd-ia64@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Porting FreeBSD to the IA-64 <freebsd-ia64.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ia64>,
	<mailto:freebsd-ia64-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-ia64>
List-Post: <mailto:freebsd-ia64@freebsd.org>
List-Help: <mailto:freebsd-ia64-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ia64>,
	<mailto:freebsd-ia64-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 01 Sep 2006 07:11:08 -0000


(This is a resend of a previously sent patch to ppc@, FYI)

Attached is a patch that adds the audit event points in the system call paths 
for ia64, the ia32 emulation in ia64, and the system call path for ppc.  I'd 
like to get these committed in the next few days, but am not set up to test 
them.  A head nod from ia64/ppc maintainers would be good regardless of 
whether audit itself has specifically been tested, and it also wouldn't hurt 
to compile boot it :-).

(I'm set up to test/run audit on i386 and amd64, but not other platforms.)

Thanks,

Robert N M Watson
Computer Laboratory
University of Cambridge

--- //depot/projects/trustedbsd/base/sys/ia64/ia32/ia32_trap.c	2006/08/05 14:21:26
+++ //depot/projects/trustedbsd/audit3/sys/ia64/ia32/ia32_trap.c	2006/08/06 13:19:15
@@ -46,6 +46,8 @@
  #include <machine/md_var.h>
  #include <i386/include/psl.h>

+#include <security/audit/audit.h>
+
  extern char *syscallnames[];

  static void
@@ -122,7 +124,9 @@

  		PTRACESTOP_SC(p, td, S_PT_SCE);

+		AUDIT_SYSCALL_ENTER(code, td);
  		error = (*callp->sy_call)(td, args64);
+		AUDIT_SYSCALL_EXIT(error, td);
  	}

  	switch (error) {
--- //depot/projects/trustedbsd/base/sys/ia64/ia64/trap.c	2006/08/05 14:21:26
+++ //depot/projects/trustedbsd/audit3/sys/ia64/ia64/trap.c	2006/08/06 13:21:12
@@ -72,6 +72,8 @@
  #include <sys/ktrace.h>
  #endif

+#include <security/audit/audit.h>
+
  #include <ia64/disasm/disasm.h>

  static int print_usertrap = 0;
@@ -1016,7 +1018,9 @@

  	PTRACESTOP_SC(p, td, S_PT_SCE);

+	AUDIT_SYSCALL_ENTER(code, td);
  	error = (*callp->sy_call)(td, args);
+	AUDIT_SYSCALL_EXIT(error, td);

  	if (error != EJUSTRETURN) {
  		/*
--- //depot/projects/trustedbsd/base/sys/powerpc/powerpc/trap.c	2006/08/05 14:21:26
+++ //depot/projects/trustedbsd/audit3/sys/powerpc/powerpc/trap.c	2006/08/06 13:22:21
@@ -55,6 +55,8 @@
  #endif
  #include <sys/vmmeter.h>

+#include <security/audit/audit.h>
+
  #include <vm/vm.h>
  #include <vm/pmap.h>
  #include <vm/vm_extern.h>
@@ -418,7 +420,9 @@

  		PTRACESTOP_SC(p, td, S_PT_SCE);

+		AUDIT_SYSCALL_ENTER(code, td);
  		error = (*callp->sy_call)(td, params);
+		AUDIT_SYSCALL_EXIT(error, td);

  		CTR3(KTR_SYSC, "syscall: p=%s %s ret=%x", p->p_comm,
  		     syscallnames[code], td->td_retval[0]);