mirror of
https://github.com/torvalds/linux
synced 2024-07-21 10:41:44 +00:00
1c30e3af8a
The openat2(2) syscall was added in kernel v5.6 with commit
fddb5d430a ("open: introduce openat2(2) syscall").
Add the openat2(2) syscall to the audit syscall classifier.
Link: https://github.com/linux-audit/audit-kernel/issues/67
Link: https://lore.kernel.org/r/f5f1a4d8699613f8c02ce762807228c841c2e26f.1621363275.git.rgb@redhat.com
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
[PM: merge fuzz due to previous header rename, commit line wraps]
Signed-off-by: Paul Moore <paul@paul-moore.com>
49 lines
852 B
C
49 lines
852 B
C
// SPDX-License-Identifier: GPL-2.0
|
|
#undef __s390x__
|
|
#include <linux/audit_arch.h>
|
|
#include <asm/unistd.h>
|
|
#include "audit.h"
|
|
|
|
unsigned s390_dir_class[] = {
|
|
#include <asm-generic/audit_dir_write.h>
|
|
~0U
|
|
};
|
|
|
|
unsigned s390_chattr_class[] = {
|
|
#include <asm-generic/audit_change_attr.h>
|
|
~0U
|
|
};
|
|
|
|
unsigned s390_write_class[] = {
|
|
#include <asm-generic/audit_write.h>
|
|
~0U
|
|
};
|
|
|
|
unsigned s390_read_class[] = {
|
|
#include <asm-generic/audit_read.h>
|
|
~0U
|
|
};
|
|
|
|
unsigned s390_signal_class[] = {
|
|
#include <asm-generic/audit_signal.h>
|
|
~0U
|
|
};
|
|
|
|
int s390_classify_syscall(unsigned syscall)
|
|
{
|
|
switch(syscall) {
|
|
case __NR_open:
|
|
return AUDITSC_OPEN;
|
|
case __NR_openat:
|
|
return AUDITSC_OPENAT;
|
|
case __NR_socketcall:
|
|
return AUDITSC_SOCKETCALL;
|
|
case __NR_execve:
|
|
return AUDITSC_EXECVE;
|
|
case __NR_openat2:
|
|
return AUDITSC_OPENAT2;
|
|
default:
|
|
return AUDITSC_COMPAT;
|
|
}
|
|
}
|