On Wed, Jun 17, 2020 at 5:30 PM Andy Lutomirski [off-list ref] wrote:
On Wed, Jun 17, 2020 at 8:25 AM Jann Horn [off-list ref] wrote:
quoted
On Tue, Jun 16, 2020 at 9:49 AM Kees Cook [off-list ref] wrote:
quoted
For systems that provide multiple syscall maps based on architectures
(e.g. AUDIT_ARCH_X86_64 and AUDIT_ARCH_I386 via CONFIG_COMPAT), allow
a fast way to pin the process to a specific syscall mapping, instead of
needing to generate all filters with an architecture check as the first
filter action.
This seems reasonable; but can we maybe also add X86-specific handling
for that X32 mess? AFAIK there are four ways to do syscalls with
AUDIT_ARCH_X86_64:
You're out of date :) I fixed the mess.
commit 6365b842aae4490ebfafadfc6bb27a6d3cc54757
Author: Andy Lutomirski [off-list ref]
Date: Wed Jul 3 13:34:04 2019 -0700
x86/syscalls: Split the x32 syscalls into their own table
Oooooh, beautiful. Thank you very much for that.