Re: [PATCH v3 01/14] audit: log all six syscall arguments in the SYSCALL record

On 09/22, Ricardo Robaina wrote:

The SYSCALL record currently logs only four of the six syscall
arguments (a0-a3). The remaining two are captured but silently
discarded before reaching the audit context. This leads to the
need for auxiliary records when audit-relevant data lands in the
5th or 6th argument of a syscall.

Extend the SYSCALL record to log all six arguments, by adding
arguments a4 and a5 (5th and 6th syscall arguments respectively)
inline within the existing record. Also add the two new args to
the audit rules switch case, so audit rules can filter on them.

Rather than plumbing two more register arguments through every
architecture's syscall entry path, retrieve the arguments from
pt_regs via syscall_get_arguments(). To keep the series bisectable,
add new helpers audit_syscall_entry_regs() and
__audit_syscall_entry_regs() that take a pointer to pt_regs, rather
than modifying the existing ones in place. Later patches convert
each architecture over to the new helpers, and a final patch removes
the legacy helpers and renames the new ones back to the original
naming.

Reviewed-by: Oleg Nesterov <oleg@redhat.com>