This patch implements the following:
2 system calls
int setaudit_id(uid_t);
if (!capable(CAP_AUDIT_CONTROL) (a posix capability))
errno=EPERM, returns -1;
if == -1, generate a new sess_id (64 bit value) and set process's
sess_id
else set 'luid' for the process
returns 0 on success;
long long getaudit_id(id);
id == 1 - return process's luid
id == 2 - return process's sess_id
else return -1 and errno=EINVAL;
Preferred Calling method via the defines (in include/linux/audit.h):
int setluid(uid_t)
int newsess_id()
uid_t getluid()
long long getsess_id()
The linux/audit.h includes an implementation dependant asm/audit.h. I created
these as empty files on the non-i386 platforms so no one would get build errors.
The initial internal kernel value of sessid is 0x1 0000 0000.
A call to get_sessid before a newsess_id on a process will return 0 (unitialized).
The first newsess_id on the system will set the process's sess_id to 0x100000001.
Subsequent newsess_id's will increment values from there.
-------------
diff -r -c --new-file linux-1.3.99-pre6untainted/arch/i386/kernel/entry.S linux-2.3.99-pre6/arch/i386/kernel/entry.S
*** linux-2.3.99-pre6untainted/arch/i386/kernel/entry.S Mon Apr 24 13:39:34 2000
--- linux-2.3.99-pre6/arch/i386/kernel/entry.S Mon May 1 11:10:19 2000
***************
*** 184,189 ****
--- 184,202 ----
jne tracesys_exit
jmp ret_from_sys_call
+ ENTRY(system_call64) # 64 bit return value syscall
+ pushl %eax # save orig_eax
+ SAVE_ALL
+ GET_CURRENT(%ebx)
+ cmpl $(NR_syscalls),%eax
+ jae badsys
+ testb $0x20,flags(%ebx) # PF_TRACESYS
+ jne tracesys
+ call *SYMBOL_NAME(sys_call_table)(,%eax,4)
+ movl %eax,EAX(%esp) # save the return value
+ movl %edx,EDX(%esp) # save high 32 bits
+ jmp ret_from_sys_call
+
/*
* Return to user mode is not as complex as all this looks,
* but we want the default path for a system call return to
***************
*** 635,640 ****
--- 648,655 ----
.long SYMBOL_NAME(sys_pivot_root)
.long SYMBOL_NAME(sys_mincore)
.long SYMBOL_NAME(sys_madvise)
+ .long SYMBOL_NAME(sys_setaudit_id) /* 220 */
+ .long SYMBOL_NAME(sys_getaudit_id)
/*
diff -r -c --new-file linux-2.3.99-pre6untainted/arch/i386/kernel/i8259.c linux-2.3.99-pre6/arch/i386/kernel/i8259.c
*** linux-2.3.99-pre6untainted/arch/i386/kernel/i8259.c Wed Apr 12 09:33:19 2000
--- linux-2.3.99-pre6/arch/i386/kernel/i8259.c Mon May 1 11:10:19 2000
***************
*** 447,453 ****
*/
for (i = 0; i < NR_IRQS; i++) {
int vector = FIRST_EXTERNAL_VECTOR + i;
! if (vector != SYSCALL_VECTOR)
set_intr_gate(vector, interrupt[i]);
}
--- 447,453 ----
*/
for (i = 0; i < NR_IRQS; i++) {
int vector = FIRST_EXTERNAL_VECTOR + i;
! if (vector != SYSCALL_VECTOR && vector!=SYSCALL64_VECTOR)
set_intr_gate(vector, interrupt[i]);
}
diff -r -c --new-file linux-2.3.99-pre6untainted/arch/i386/kernel/io_apic.c linux-2.3.99-pre6/arch/i386/kernel/io_apic.c
*** linux-2.3.99-pre6untainted/arch/i386/kernel/io_apic.c Wed Apr 12 09:33:19 2000
--- linux-2.3.99-pre6/arch/i386/kernel/io_apic.c Mon May 1 11:10:19 2000
***************
*** 553,559 ****
panic("ran out of interrupt sources!");
next:
current_vector += 8;
! if (current_vector == SYSCALL_VECTOR)
goto next;
if (current_vector > 0xFF) {
--- 553,559 ----
panic("ran out of interrupt sources!");
next:
current_vector += 8;
! if (current_vector == SYSCALL_VECTOR || current_vector == SYSCALL64_VECTOR)
goto next;
if (current_vector > 0xFF) {
diff -r -c --new-file linux-2.3.99-pre6untainted/arch/i386/kernel/traps.c linux-2.3.99-pre6/arch/i386/kernel/traps.c
*** linux-2.3.99-pre6untainted/arch/i386/kernel/traps.c Tue Apr 25 17:52:01 2000
--- linux-2.3.99-pre6/arch/i386/kernel/traps.c Mon May 1 11:10:19 2000
***************
*** 47,52 ****
--- 47,53 ----
#include <linux/irq.h>
asmlinkage int system_call(void);
+ asmlinkage long long system_call64(void);
asmlinkage void lcall7(void);
asmlinkage void lcall27(void);
***************
*** 830,835 ****
--- 831,837 ----
set_trap_gate(16,&coprocessor_error);
set_trap_gate(17,&alignment_check);
set_system_gate(SYSCALL_VECTOR,&system_call);
+ set_system_gate(SYSCALL64_VECTOR,&system_call64);
/*
* default LDT is a single-entry callgate to lcall7 for iBCS
diff -r -c --new-file linux-2.3.99-pre6untainted/include/asm-alpha/audit.h linux-2.3.99-pre6/include/asm-alpha/audit.h
*** linux-2.3.99-pre6untainted/include/asm-alpha/audit.h Wed Dec 31 16:00:00 1969
--- linux-2.3.99-pre6/include/asm-alpha/audit.h Mon May 1 11:10:19 2000
***************
*** 0 ****
--- 1 ----
+
diff -r -c --new-file linux-2.3.99-pre6untainted/include/asm-arm/audit.h linux-2.3.99-pre6/include/asm-arm/audit.h
*** linux-2.3.99-pre6untainted/include/asm-arm/audit.h Wed Dec 31 16:00:00 1969
--- linux-2.3.99-pre6/include/asm-arm/audit.h Mon May 1 11:10:19 2000
***************
*** 0 ****
--- 1 ----
+
diff -r -c --new-file linux-2.3.99-pre6untainted/include/asm-generic/audit.h linux-2.3.99-pre6/include/asm-generic/audit.h
*** linux-2.3.99-pre6untainted/include/asm-generic/audit.h Wed Dec 31 16:00:00 1969
--- linux-2.3.99-pre6/include/asm-generic/audit.h Mon May 1 11:10:19 2000
***************
*** 0 ****
--- 1 ----
+
diff -r -c --new-file linux-2.3.99-pre6untainted/include/asm-i386/audit.h linux-2.3.99-pre6/include/asm-i386/audit.h
*** linux-2.3.99-pre6untainted/include/asm-i386/audit.h Wed Dec 31 16:00:00 1969
--- linux-2.3.99-pre6/include/asm-i386/audit.h Mon May 1 11:10:19 2000
***************
*** 0 ****
--- 1,6 ----
+ /* ia32 specific audit interface - law@sgi */
+
+ _syscall64_1(long long, getaudit_id,int, id)
+ _syscall1(int, setaudit_id, uid_t, luid)
+
+
diff -r -c --new-file linux-2.3.99-pre6untainted/include/asm-i386/hw_irq.h linux-2.3.99-pre6/include/asm-i386/hw_irq.h
*** linux-2.3.99-pre6untainted/include/asm-i386/hw_irq.h Wed Apr 26 15:29:06 2000
--- linux-2.3.99-pre6/include/asm-i386/hw_irq.h Mon May 1 11:10:19 2000
***************
*** 22,27 ****
--- 22,28 ----
#define FIRST_EXTERNAL_VECTOR 0x20
#define SYSCALL_VECTOR 0x80
+ #define SYSCALL64_VECTOR 0x81
/*
* Vectors 0x20-0x2f are used for ISA interrupts.
diff -r -c --new-file linux-2.3.99-pre6untainted/include/asm-i386/unistd.h linux-2.3.99-pre6/include/asm-i386/unistd.h
*** linux-2.3.99-pre6untainted/include/asm-i386/unistd.h Tue Mar 14 17:45:20 2000
--- linux-2.3.99-pre6/include/asm-i386/unistd.h Mon May 1 11:10:19 2000
***************
*** 225,230 ****
--- 225,232 ----
#define __NR_mincore 218
#define __NR_madvise 219
#define __NR_madvise1 219 /* delete when C lib stub is removed */
+ #define __NR_setaudit_id 220
+ #define __NR_getaudit_id 221
/* user-visible error numbers are in the range -1 - -124: see <asm-i386/errno.h> */
***************
*** 313,318 ****
--- 315,347 ----
"d" ((long)(arg3)),"S" ((long)(arg4)),"D" ((long)(arg5)), \
"0" ((long)(arg6))); \
__syscall_return(type,__res); \
+ }
+
+ /* this call interface needs to be fixed -- while it works on
+ * current GCC, the asm code does not *explicitly* "return" a
+ * 64-bit value via EDX holding the high order 32 bits. Unfortunately
+ * I don't know the intricacies of gcc-asm
+ */
+
+
+ #define __syscall64_return(type, res) \
+ do { \
+ if ((unsigned long long)(res.___res) >= (unsigned long long)(-125)) { \
+ errno = -(res.___res); \
+ res.___res = -1; \
+ } \
+ return (type) (res.___res); \
+ } while (0)
+
+
+ #define _syscall64_1(type,name,type1,arg1) \
+ type name(type1 arg1) \
+ { \
+ register union { long long ___res; long __res[2];} __resunion; \
+ __asm__ volatile ("int $0x81" \
+ : "=a" (__resunion.__res[0]), "=d" (__resunion.__res[1]) \
+ : "0" (__NR_##name),"b" ((long)arg1)); \
+ __syscall64_return(type,__resunion); \
}
#ifdef __KERNEL_SYSCALLS__
diff -r -c --new-file linux-2.3.99-pre6untainted/include/asm-ia64/audit.h linux-2.3.99-pre6/include/asm-ia64/audit.h
*** linux-2.3.99-pre6untainted/include/asm-ia64/audit.h Wed Dec 31 16:00:00 1969
--- linux-2.3.99-pre6/include/asm-ia64/audit.h Mon May 1 11:10:19 2000
***************
*** 0 ****
--- 1 ----
+
diff -r -c --new-file linux-2.3.99-pre6untainted/include/asm-m68k/audit.h linux-2.3.99-pre6/include/asm-m68k/audit.h
*** linux-2.3.99-pre6untainted/include/asm-m68k/audit.h Wed Dec 31 16:00:00 1969
--- linux-2.3.99-pre6/include/asm-m68k/audit.h Mon May 1 11:10:19 2000
***************
*** 0 ****
--- 1 ----
+
diff -r -c --new-file linux-2.3.99-pre6untainted/include/asm-mips/audit.h linux-2.3.99-pre6/include/asm-mips/audit.h
*** linux-2.3.99-pre6untainted/include/asm-mips/audit.h Wed Dec 31 16:00:00 1969
--- linux-2.3.99-pre6/include/asm-mips/audit.h Mon May 1 11:10:19 2000
***************
*** 0 ****
--- 1 ----
+
diff -r -c --new-file linux-2.3.99-pre6untainted/include/asm-mips64/audit.h linux-2.3.99-pre6/include/asm-mips64/audit.h
*** linux-2.3.99-pre6untainted/include/asm-mips64/audit.h Wed Dec 31 16:00:00 1969
--- linux-2.3.99-pre6/include/asm-mips64/audit.h Mon May 1 11:10:19 2000
***************
*** 0 ****
--- 1 ----
+
diff -r -c --new-file linux-2.3.99-pre6untainted/include/asm-ppc/audit.h linux-2.3.99-pre6/include/asm-ppc/audit.h
*** linux-2.3.99-pre6untainted/include/asm-ppc/audit.h Wed Dec 31 16:00:00 1969
--- linux-2.3.99-pre6/include/asm-ppc/audit.h Mon May 1 11:10:19 2000
***************
*** 0 ****
--- 1 ----
+
diff -r -c --new-file linux-2.3.99-pre6untainted/include/asm-sh/audit.h linux-2.3.99-pre6/include/asm-sh/audit.h
*** linux-2.3.99-pre6untainted/include/asm-sh/audit.h Wed Dec 31 16:00:00 1969
--- linux-2.3.99-pre6/include/asm-sh/audit.h Mon May 1 11:10:19 2000
***************
*** 0 ****
--- 1 ----
+
diff -r -c --new-file linux-2.3.99-pre6untainted/include/asm-sparc/audit.h linux-2.3.99-pre6/include/asm-sparc/audit.h
*** linux-2.3.99-pre6untainted/include/asm-sparc/audit.h Wed Dec 31 16:00:00 1969
--- linux-2.3.99-pre6/include/asm-sparc/audit.h Mon May 1 11:10:19 2000
***************
*** 0 ****
--- 1 ----
+
diff -r -c --new-file linux-2.3.99-pre6untainted/include/asm-sparc64/audit.h linux-2.3.99-pre6/include/asm-sparc64/audit.h
*** linux-2.3.99-pre6untainted/include/asm-sparc64/audit.h Wed Dec 31 16:00:00 1969
--- linux-2.3.99-pre6/include/asm-sparc64/audit.h Mon May 1 11:10:19 2000
***************
*** 0 ****
--- 1 ----
+
diff -r -c --new-file linux-2.3.99-pre6untainted/include/linux/audit.h linux-2.3.99-pre6/include/linux/audit.h
*** linux-2.3.99-pre6untainted/include/linux/audit.h Wed Dec 31 16:00:00 1969
--- linux-2.3.99-pre6/include/linux/audit.h Mon May 1 11:10:19 2000
***************
*** 0 ****
--- 1,8 ----
+ #include <asm/audit.h>
+
+ /* audit id function definitions */
+
+ #define setluid(id) setaudit_id(id)
+ #define newsess_id() setaudit_id((uid_t)-1)
+ #define getluid() ((uid_t)getaudit_id(1))
+ #define getsess_id() getaudit_id(2)
diff -r -c --new-file linux-2.3.99-pre6untainted/include/linux/capability.h linux-2.3.99-pre6/include/linux/capability.h
*** linux-2.3.99-pre6untainted/include/linux/capability.h Wed Apr 26 15:29:07 2000
--- linux-2.3.99-pre6/include/linux/capability.h Mon May 1 11:10:19 2000
***************
*** 269,274 ****
--- 269,280 ----
#define CAP_MKNOD 27
+ /* allow setting of Login user ID */
+ /* allow generating and setting of session id */
+ /* start/stop audit */
+
+ #define CAP_AUDIT_CONTROL 28
+
#ifdef __KERNEL__
/*
* Bounding set
diff -r -c --new-file linux-2.3.99-pre6untainted/include/linux/sched.h linux-2.3.99-pre6/include/linux/sched.h
*** linux-2.3.99-pre6untainted/include/linux/sched.h Wed Apr 26 15:29:08 2000
--- linux-2.3.99-pre6/include/linux/sched.h Mon May 1 11:10:19 2000
***************
*** 312,319 ****
int swappable:1;
int hog:1;
/* process credentials */
! uid_t uid,euid,suid,fsuid;
gid_t gid,egid,sgid,fsgid;
int ngroups;
gid_t groups[NGROUPS];
kernel_cap_t cap_effective, cap_inheritable, cap_permitted;
--- 312,320 ----
int swappable:1;
int hog:1;
/* process credentials */
! uid_t uid,euid,suid,fsuid,luid;
gid_t gid,egid,sgid,fsgid;
+ long long sessid;
int ngroups;
gid_t groups[NGROUPS];
kernel_cap_t cap_effective, cap_inheritable, cap_permitted;
diff -r -c --new-file linux-2.3.99-pre6untainted/kernel/sys.c linux-2.3.99-pre6/kernel/sys.c
*** linux-2.3.99-pre6untainted/kernel/sys.c Thu Apr 13 17:06:05 2000
--- linux-2.3.99-pre6/kernel/sys.c Mon May 1 11:10:19 2000
***************
*** 516,521 ****
--- 516,555 ----
return 0;
}
+ /* login uid functions for auditing purposes */
+
+ static spinlock_t sessid_lock = SPIN_LOCK_UNLOCKED;
+ static long long sessid = 0x100000000LL;
+
+ asmlinkage int sys_setaudit_id(uid_t audit_id)
+ {
+ if (!capable(CAP_AUDIT_CONTROL)) return -EPERM;
+
+ if ((int)audit_id == -1) { /* generate a new sessid for the process */
+ spin_lock(&sessid_lock);
+ current->sessid = ++sessid;
+ spin_unlock(&sessid_lock);
+ } else {
+ current->luid = audit_id;
+ }
+
+ return 0;
+ }
+
+ /* note that this will only return "long long" if called from
+ assembly code that also returns a "long long" value */
+
+ asmlinkage long long sys_getaudit_id(int id)
+ {
+ if (id==1) {
+ return (long long) (current->luid);
+ } else if (id==2) {
+ return current->sessid;
+ } else return -EINVAL;
+ }
+
+
+
asmlinkage long sys_getresuid(uid_t *ruid, uid_t *euid, uid_t *suid)
{
int retval;
-- Linda A Walsh | Trust Technology, Core Linux, SGI law@sgi.com | Voice: (650) 933-5338- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
This archive was generated by hypermail 2b29 : Sun May 07 2000 - 21:00:08 EST