On Wed, Jun 17, 2020 at 5:30 PM Andy Lutomirski [off-list ref] wrote:

On Wed, Jun 17, 2020 at 8:25 AM Jann Horn [off-list ref] wrote:

quoted

On Tue, Jun 16, 2020 at 9:49 AM Kees Cook [off-list ref] wrote:

quoted

For systems that provide multiple syscall maps based on architectures
(e.g. AUDIT_ARCH_X86_64 and AUDIT_ARCH_I386 via CONFIG_COMPAT), allow
a fast way to pin the process to a specific syscall mapping, instead of
needing to generate all filters with an architecture check as the first
filter action.

This seems reasonable; but can we maybe also add X86-specific handling
for that X32 mess? AFAIK there are four ways to do syscalls with
AUDIT_ARCH_X86_64:

You're out of date :)  I fixed the mess.

commit 6365b842aae4490ebfafadfc6bb27a6d3cc54757
Author: Andy Lutomirski [off-list ref]
Date:   Wed Jul 3 13:34:04 2019 -0700

    x86/syscalls: Split the x32 syscalls into their own table

Oooooh, beautiful. Thank you very much for that.