audit_64.c (2001B)
1// SPDX-License-Identifier: GPL-2.0 2#include <linux/init.h> 3#include <linux/types.h> 4#include <linux/audit.h> 5#include <asm/unistd.h> 6#include <asm/audit.h> 7 8static unsigned dir_class[] = { 9#include <asm-generic/audit_dir_write.h> 10~0U 11}; 12 13static unsigned read_class[] = { 14#include <asm-generic/audit_read.h> 15~0U 16}; 17 18static unsigned write_class[] = { 19#include <asm-generic/audit_write.h> 20~0U 21}; 22 23static unsigned chattr_class[] = { 24#include <asm-generic/audit_change_attr.h> 25~0U 26}; 27 28static unsigned signal_class[] = { 29#include <asm-generic/audit_signal.h> 30~0U 31}; 32 33int audit_classify_arch(int arch) 34{ 35#ifdef CONFIG_IA32_EMULATION 36 if (arch == AUDIT_ARCH_I386) 37 return 1; 38#endif 39 return 0; 40} 41 42int audit_classify_syscall(int abi, unsigned syscall) 43{ 44#ifdef CONFIG_IA32_EMULATION 45 if (abi == AUDIT_ARCH_I386) 46 return ia32_classify_syscall(syscall); 47#endif 48 switch(syscall) { 49 case __NR_open: 50 return AUDITSC_OPEN; 51 case __NR_openat: 52 return AUDITSC_OPENAT; 53 case __NR_execve: 54 case __NR_execveat: 55 return AUDITSC_EXECVE; 56 case __NR_openat2: 57 return AUDITSC_OPENAT2; 58 default: 59 return AUDITSC_NATIVE; 60 } 61} 62 63static int __init audit_classes_init(void) 64{ 65#ifdef CONFIG_IA32_EMULATION 66 extern __u32 ia32_dir_class[]; 67 extern __u32 ia32_write_class[]; 68 extern __u32 ia32_read_class[]; 69 extern __u32 ia32_chattr_class[]; 70 extern __u32 ia32_signal_class[]; 71 audit_register_class(AUDIT_CLASS_WRITE_32, ia32_write_class); 72 audit_register_class(AUDIT_CLASS_READ_32, ia32_read_class); 73 audit_register_class(AUDIT_CLASS_DIR_WRITE_32, ia32_dir_class); 74 audit_register_class(AUDIT_CLASS_CHATTR_32, ia32_chattr_class); 75 audit_register_class(AUDIT_CLASS_SIGNAL_32, ia32_signal_class); 76#endif 77 audit_register_class(AUDIT_CLASS_WRITE, write_class); 78 audit_register_class(AUDIT_CLASS_READ, read_class); 79 audit_register_class(AUDIT_CLASS_DIR_WRITE, dir_class); 80 audit_register_class(AUDIT_CLASS_CHATTR, chattr_class); 81 audit_register_class(AUDIT_CLASS_SIGNAL, signal_class); 82 return 0; 83} 84 85__initcall(audit_classes_init);