On 2021-03-18 11:52, Christian Brauner wrote:

On Thu, Mar 18, 2021 at 11:48:45AM +0100, Christian Brauner wrote:

quoted

On Wed, Mar 17, 2021 at 09:47:17PM -0400, Richard Guy Briggs wrote:

quoted

The openat2(2) syscall was added in kernel v5.6 with commit fddb5d430ad9
("open: introduce openat2(2) syscall")
Add the openat2(2) syscall to the audit syscall classifier.
See the github issue
https://github.com/linux-audit/audit-kernel/issues/67
Signed-off-by: Richard Guy Briggs <redacted>

...

And one more comment, why return a hard-coded integer from all of these
architectures instead of introducing an enum in a central place with
proper names idk:

Oh, believe me, I tried hard to do that because I really don't like
hard-coded magic values, but for expediency I continued the same
approach until I could sort out the header file mess.  There was an
extra preparatory patch (attached) in this patchset with a different
audit syscall perms patch (also attached).  By including "#include
<linux/audit.h>" in each of the compat source files there were warnings
of redefinitions of every __NR_* syscall number.  The easiest way to get
rid of it would have been to pull the new AUDITSC_* definitions into a
new <linux/auditsc.h> file and include that from <linux/audit.h> and
each of the arch/*/*/*audit.c (and lib/*audit.c) files.

enum audit_match_perm_t {
	.
	.
	.
	AUDIT_MATCH_PERM_EXECVE = 5,
	AUDIT_MATCH_PERM_OPENAT2 = 6,
	.
	.
	.
}

Then you can drop these hard-coded comments too and it's way less
brittle overall.

Totally agree.

Christian

- RGB

--
Richard Guy Briggs [off-list ref]
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635