Auditing audit-libs syscalls

Auditing audit-libs syscalls

[Mark Wielaard]

[-- Attachment #1: Type: text/plain, Size: 1849 bytes --]

Hi,

I had a look at audit-libs and our syscall lists. I extended the audit
interface to also make it possible to lookup the number of a syscall
according to audit-libs given a name. Unfortunately audit-libs doesn't
seem to give argument numbers, types or whether the syscall returns.
Otherwise we could have used it to fully automate the generation of our
syscall tables.

I also cleaned up and extended the TestSyscallsWithAudit a bit to do
more checks and to make the checks generic enough use the same code with
all our architectures. This showed our syscall tables had a couple of
omissions and small bugs.

There are also some extended sanity checks. But I had to disable them.
audit-libs doesn't seem to know about syscall 260 on ppc being
get_mempolicy. According to audit-libs syscall 232 and 215 on x86_64
both have the name epoll_wait. Where possible I made sure we use the
same names as audit-libs, even if that means having duplicate names for
different syscall numbers. But these anomalies make it so that we do
have to disable some of the new TestSyscallsWithAudit checks. See the
source for what is currently disabled.

2006-10-14  Mark Wielaard  <mark@klomp.org>

    * AuditLibs.java (SyscallToName): Renamed to...
    (syscallToName): Renamed to not start with a Capital.
    (nameToSyscall): New native method.
    * cni/AuditLibs.cxx: (nameToSyscall): New method.

2006-10-14  Mark Wielaard  <mark@klomp.org>

    * LinuxIa32Syscall.java (syscallList): Add entries 273 till 317.
    * LinuxPowerPCSyscall.java (syscallList): Add entries 278 till 300.
    * Syscall.java (toString): New method.
    * TestSyscallsWithAudit.java (syscallTest): New private method.
    (testLinuxIa32): Use generic syscallTest method.
    (testLinuxPPC): Likewise.
    (testLinuxPPC64): Likewise.
    (testLinuxX86_64): Likewise.

Committed,

Mark

[-- Attachment #2: syscall-audit.patch --]
[-- Type: text/x-patch, Size: 11014 bytes --]

Index: frysk-core/frysk/proc/LinuxIa32Syscall.java
===================================================================
RCS file: /cvs/frysk/frysk-core/frysk/proc/LinuxIa32Syscall.java,v
retrieving revision 1.3
diff -u -r1.3 LinuxIa32Syscall.java
--- frysk-core/frysk/proc/LinuxIa32Syscall.java	20 Sep 2006 00:30:48 -0000	1.3
+++ frysk-core/frysk/proc/LinuxIa32Syscall.java	14 Oct 2006 21:12:41 -0000
@@ -395,7 +395,52 @@
     new Ia32Syscall ("fstatfs64", 269),
     new Ia32Syscall ("tgkill", 270),
     new Ia32Syscall ("utimes", 271),
-    new Ia32Syscall ("fadvise64_64", 272)
+    new Ia32Syscall ("fadvise64_64", 272),
+    new Ia32Syscall ("vserver", 273),
+    new Ia32Syscall ("mbind", 274),
+    new Ia32Syscall ("get_mempolicy", 275),
+    new Ia32Syscall ("set_mempolicy", 276),
+    new Ia32Syscall ("mq_open", 277),
+    new Ia32Syscall ("mq_unlink", 278),
+    new Ia32Syscall ("mq_timedsend", 279),
+    new Ia32Syscall ("mq_timedreceive", 280),
+    new Ia32Syscall ("mq_notify", 281),
+    new Ia32Syscall ("mq_getsetattr", 282),
+    new Ia32Syscall ("sys_kexec_load", 283),
+    new Ia32Syscall ("waitid", 284),
+    new Ia32Syscall (285),
+    new Ia32Syscall ("add_key", 286),
+    new Ia32Syscall ("request_key", 287),
+    new Ia32Syscall ("keyctl", 288),
+    new Ia32Syscall ("ioprio_set", 289),
+    new Ia32Syscall ("ioprio_get", 290),
+    new Ia32Syscall ("inotify_init", 291),
+    new Ia32Syscall ("inotify_add_watch", 292),
+    new Ia32Syscall ("inotify_rm_watch", 293),
+    new Ia32Syscall ("migrate_pages", 294),
+    new Ia32Syscall ("openat", 295),
+    new Ia32Syscall ("mkdirat", 296),
+    new Ia32Syscall ("mknodat", 297),
+    new Ia32Syscall ("fchownat", 298),
+    new Ia32Syscall ("futimesat", 299),
+    new Ia32Syscall ("fstatat64", 300),
+    new Ia32Syscall ("unlinkat", 301),
+    new Ia32Syscall ("renameat", 302),
+    new Ia32Syscall ("linkat", 303),
+    new Ia32Syscall ("symlinkat", 304),
+    new Ia32Syscall ("readlinkat", 305),
+    new Ia32Syscall ("fchmodat", 306),
+    new Ia32Syscall ("faccessat", 307),
+    new Ia32Syscall ("pselect6", 308),
+    new Ia32Syscall ("ppoll", 309),
+    new Ia32Syscall ("unshare", 310),
+    new Ia32Syscall ("set_robust_list", 311),
+    new Ia32Syscall ("get_robust_list", 312),
+    new Ia32Syscall ("splice", 313),
+    new Ia32Syscall ("sync_file_range", 314),
+    new Ia32Syscall ("tee", 315),
+    new Ia32Syscall ("vmsplice", 316),
+    new Ia32Syscall ("move_pages", 317)
     };
 
 
Index: frysk-core/frysk/proc/LinuxPowerPCSyscall.java
===================================================================
RCS file: /cvs/frysk/frysk-core/frysk/proc/LinuxPowerPCSyscall.java,v
retrieving revision 1.3
diff -u -r1.3 LinuxPowerPCSyscall.java
--- frysk-core/frysk/proc/LinuxPowerPCSyscall.java	20 Sep 2006 10:58:21 -0000	1.3
+++ frysk-core/frysk/proc/LinuxPowerPCSyscall.java	14 Oct 2006 21:12:41 -0000
@@ -354,7 +354,7 @@
     new PowerPCSyscall ("sched_setaffinity", 222),
     new PowerPCSyscall ("sched_getaffinity", 223),
     new PowerPCSyscall (224),
-    new PowerPCSyscall (225),
+    new PowerPCSyscall ("tuxcall", 225),
     new PowerPCSyscall ("sendfile64", 226, 4, "i:iipi "),
     new PowerPCSyscall ("io_setup", 227, 2, "i:ip "),
     new PowerPCSyscall ("io_destroy", 228, 1, "i:i "),
@@ -385,7 +385,7 @@
     new PowerPCSyscall ("fstatfs64", 253),
     new PowerPCSyscall ("fadvise64_64", 254),
     new PowerPCSyscall ("rtas", 255),
-    new PowerPCSyscall ("sys_debug_setcontext", 256),
+    new PowerPCSyscall (256),
     new PowerPCSyscall (257),
     new PowerPCSyscall (258),
     new PowerPCSyscall (259),
@@ -407,7 +407,29 @@
     new PowerPCSyscall ("inotify_init", 275),
     new PowerPCSyscall ("inotify_add_watch", 276),
     new PowerPCSyscall ("inotify_rm_watch", 277),
-    new PowerPCSyscall ("syscalls", 278)
+    new PowerPCSyscall ("spu_run", 278),
+    new PowerPCSyscall ("spu_create", 279),
+    new PowerPCSyscall ("pselect6", 280),
+    new PowerPCSyscall ("ppoll", 281),
+    new PowerPCSyscall ("unshare", 282),
+    new PowerPCSyscall ("splice", 283),
+    new PowerPCSyscall ("tee", 284),
+    new PowerPCSyscall ("vmsplice", 285),
+    new PowerPCSyscall ("openat", 286),
+    new PowerPCSyscall ("mkdirat", 287),
+    new PowerPCSyscall ("mknodat", 288),
+    new PowerPCSyscall ("fchownat", 289),
+    new PowerPCSyscall ("futimesat", 290),
+    new PowerPCSyscall ("fstatat", 291),
+    new PowerPCSyscall ("unlinkat", 292),
+    new PowerPCSyscall ("renameat", 293),
+    new PowerPCSyscall ("linkat", 294),
+    new PowerPCSyscall ("symlinkat", 295),
+    new PowerPCSyscall ("readlinkat", 296),
+    new PowerPCSyscall ("fchmodat", 297),
+    new PowerPCSyscall ("faccessat", 298),
+    new PowerPCSyscall ("get_robust_list", 299),
+    new PowerPCSyscall ("set_robust_list", 300)
     };
 
   static class SocketSubSyscall
Index: frysk-core/frysk/proc/Syscall.java
===================================================================
RCS file: /cvs/frysk/frysk-core/frysk/proc/Syscall.java,v
retrieving revision 1.14
diff -u -r1.14 Syscall.java
--- frysk-core/frysk/proc/Syscall.java	19 Sep 2006 01:21:22 -0000	1.14
+++ frysk-core/frysk/proc/Syscall.java	14 Oct 2006 21:12:41 -0000
@@ -173,6 +173,13 @@
 	return writer;
     }
     
+  public String toString()
+  {
+    return (this.getClass()
+	    +"[name=" + getName()
+	    + ",number=" + getNumber() + "]");
+  }
+
     /**
      * Print a textual representation of the return result of a system
      * call.
Index: frysk-core/frysk/proc/TestSyscallsWithAudit.java
===================================================================
RCS file: /cvs/frysk/frysk-core/frysk/proc/TestSyscallsWithAudit.java,v
retrieving revision 1.4
diff -u -r1.4 TestSyscallsWithAudit.java
--- frysk-core/frysk/proc/TestSyscallsWithAudit.java	5 Oct 2006 11:31:53 -0000	1.4
+++ frysk-core/frysk/proc/TestSyscallsWithAudit.java	14 Oct 2006 21:12:41 -0000
@@ -45,95 +45,88 @@
   extends TestLib
 {
   
-  public void testLinuxIa32(){
-//    if (brokenXXX (3218))
-//      return;
-
+  public void testLinuxIa32()
+  {
     int machine = AuditLibs.MACH_X86;
     Isa isa = LinuxIa32.isaSingleton();
-    
-    String auditName;
-    String fryskName;
-    
-    int i = 0;
-    auditName = AuditLibs.SyscallToName(i, machine);
-    fryskName = isa.getSyscallList()[i].getName();
-    assertNotNull(auditName);
-    
-    for(i = i+1; auditName != null; i++){
-//        System.out.println(i + ": " + auditName + " " + fryskName);
-        assertEquals(auditName, fryskName);
-        auditName = AuditLibs.SyscallToName(i, machine);
-        fryskName = isa.getSyscallList()[i].getName();
-    }
+    syscallTest(machine, isa);
   }
 
-  public void testLinuxPPC(){
-//    if (brokenXXX (3218))
-//      return;
-    
+  public void testLinuxPPC()
+  {
     int machine = AuditLibs.MACH_PPC;
     Isa isa = LinuxPPC.isaSingleton();
-    
-    String auditName;
-    String fryskName;
-    
-    int i = 1; //XXX: There is no syscall 0 in PPC ??
-    auditName = AuditLibs.SyscallToName(i, machine);
-    fryskName = isa.getSyscallList()[i].getName();
-    assertNotNull(auditName);
-    
-    for(i = i+1; auditName != null; i++){
-    //    System.out.println(i + ": " + auditName + " " + fryskName);
-        assertEquals(auditName, fryskName);
-        auditName = AuditLibs.SyscallToName(i, machine);
-        fryskName = isa.getSyscallList()[i].getName();
-    }
+    syscallTest(machine, isa);
   }
 
-  public void testLinuxPPC64(){
-//    if (brokenXXX (3218))
-//      return;
-    
-    int machine = AuditLibs.MACH_PPC;
+  public void testLinuxPPC64()
+  {
+    int machine = AuditLibs.MACH_PPC64;
     Isa isa = LinuxPPC64.isaSingleton();
-    
-    String auditName;
-    String fryskName;
-    
-    int i = 1; //XXX: There is no syscall 0 in PPC ??
-    auditName = AuditLibs.SyscallToName(i, machine);
-    fryskName = isa.getSyscallList()[i].getName();
-    assertNotNull(auditName);
-    
-    for(i = i+1; auditName != null; i++){
-        // System.out.println(i + ": " + auditName + " " + fryskName);
-        assertEquals(auditName, fryskName);
-        auditName = AuditLibs.SyscallToName(i, machine);
-        fryskName = isa.getSyscallList()[i].getName();
-    }
+    syscallTest(machine, isa);
   }
 
-  public void testLinuxEMT64(){
+  public void testLinuxEMT64()
+  {
     int machine = AuditLibs.MACH_86_64;
     Isa isa = LinuxX8664.isaSingleton();
-    
-    String auditName;
-    String fryskName;
-    
-    int i = 0;
-    auditName = AuditLibs.SyscallToName(i, machine);
-    fryskName = isa.getSyscallList()[i].getName();
-    assertNotNull(auditName);
-    
-    for(i = i+1; auditName != null; i++){
-        // System.out.println(i - 1 + ": " + auditName + " " + fryskName);
-        assertEquals(auditName, fryskName);
-        auditName = AuditLibs.SyscallToName(i, machine);
-        if (auditName != null)
-          fryskName = isa.getSyscallList()[i].getName();
-    }
+    syscallTest(machine, isa);
   }
 
+  private void syscallTest(int machine, Isa isa)
+  {
+    Syscall[] syscallList = isa.getSyscallList();
+    int highestNum = 0;
+
+    // We assume there are at most this many syscall numbers
+    int MAX_SYSCALL_NUM = 1024;
+    for (int i = 0; i < MAX_SYSCALL_NUM; i++)
+      {
+	String auditName = AuditLibs.syscallToName(i, machine);
+	if (auditName != null)
+	  {
+	    highestNum = i;
+	    int auditNum = AuditLibs.nameToSyscall(auditName, machine);
+	    // XXX There are a couple of syscalls with the same name...
+	    // Below we test for auditNum, which is the lowest number.
+	    // assertEquals("auditlib sanity", i, auditNum);
+
+	    Syscall syscall = syscallList[i];
+	    String fryskName = syscall.getName();
+	    int fryskNum = syscall.getNumber();
+	    
+	    assertEquals("number", i, fryskNum);
+	    assertEquals("name (" + i + ")", auditName, fryskName);
+
+	    Syscall syscallByName = isa.syscallByName(auditName);
+	    // XXX There are a couple of syscalls with the same name
+	    // Below we test for auditNum, not i.
+	    // assertEquals("byName", syscall, syscallByName);
+	    assertEquals("byName-name (" + i + ")",
+			 auditName, syscallByName.getName());
+	    assertEquals("byName-number",
+			 auditNum, syscallByName.getNumber());
+	  }
+	else
+	  {
+	    if (i < syscallList.length)
+	      {
+		Syscall syscall = syscallList[i];
+		int fryskNum = syscall.getNumber();
+		assertEquals("number", i, fryskNum);
+
+		// Unfortunately auditlib doesn't seem to know all the names.
+		// String fryskName = syscall.getName();
+		// assertEquals("no-name", "<" + i + ">", fryskName);
+	      }
+	  }
+      }
+
+    // Extra sanity check of MAX_SYSCALL_NUM assumption.
+    assertNull("MAX_SYSCALL_NUM", AuditLibs.syscallToName(MAX_SYSCALL_NUM,
+							  machine));
 
+    // We should have names up to the highest number auditlib knows about.
+    assertEquals("max-syscall-num", highestNum, syscallList.length - 1);
+  }
 }

[-- Attachment #3: syscall-audit-sys.patch --]
[-- Type: text/x-patch, Size: 1987 bytes --]

Index: frysk-sys/frysk/sys/AuditLibs.java
===================================================================
RCS file: /cvs/frysk/frysk-sys/frysk/sys/AuditLibs.java,v
retrieving revision 1.1
diff -u -r1.1 AuditLibs.java
--- frysk-sys/frysk/sys/AuditLibs.java	20 Sep 2006 00:30:48 -0000	1.1
+++ frysk-sys/frysk/sys/AuditLibs.java	14 Oct 2006 21:29:49 -0000
@@ -50,5 +50,6 @@
     public static final int MACH_S390  = 6;
     public static final int MACH_ALPHA = 7;
 
-    public static native String SyscallToName(int syscall, int machine);
+    public static native String syscallToName(int syscall, int machine);
+    public static native int nameToSyscall(String name, int machine);
 }
Index: frysk-sys/frysk/sys/cni/AuditLibs.cxx
===================================================================
RCS file: /cvs/frysk/frysk-sys/frysk/sys/cni/AuditLibs.cxx,v
retrieving revision 1.1
diff -u -r1.1 AuditLibs.cxx
--- frysk-sys/frysk/sys/cni/AuditLibs.cxx	20 Sep 2006 00:30:48 -0000	1.1
+++ frysk-sys/frysk/sys/cni/AuditLibs.cxx	14 Oct 2006 21:29:49 -0000
@@ -37,6 +37,8 @@
 // version and license this file solely under the GPL without
 // exception.
 
+#include <stdlib.h>
+
 #include <gcj/cni.h>
 
 #include <libaudit.h>
@@ -44,7 +46,7 @@
 #include "frysk/sys/AuditLibs.h"
 
 jstring
-frysk::sys::AuditLibs::SyscallToName(jint syscall, jint machine)
+frysk::sys::AuditLibs::syscallToName(jint syscall, jint machine)
 {
   jstring jname;
   const char* syscall_name = audit_syscall_to_name(syscall, machine);
@@ -54,3 +56,15 @@
   jname = JvNewStringLatin1 (syscall_name, strlen (syscall_name));
   return jname;
 }
+
+jint
+frysk::sys::AuditLibs::nameToSyscall(jstring name, jint machine)
+{
+  jsize len = JvGetStringUTFLength (name);
+  char *syscall_name = (char *) malloc (len + 1);
+  JvGetStringUTFRegion (name, 0, name->length(), syscall_name);
+  syscall_name[len] = '\0';
+  int num = audit_name_to_syscall (syscall_name, machine);
+  free (syscall_name);
+  return num;
+}

Re: Auditing audit-libs syscalls

[Andrew Cagney]

Mark,

Yes, Sami went through this exact same issue when setting up the initial 
mechanism for auditing our system call list - unlike other kernels 
there's nothing easy available but at least the audit list is likely to 
be maintained.  He and I even broached the possibility of a more 
complete table with kernel developers but didn't get a warming response.

Andrew

Mark Wielaard wrote:
> Hi,
>
> I had a look at audit-libs and our syscall lists. I extended the audit
> interface to also make it possible to lookup the number of a syscall
> according to audit-libs given a name. Unfortunately audit-libs doesn't
> seem to give argument numbers, types or whether the syscall returns.
> Otherwise we could have used it to fully automate the generation of our
> syscall tables.
>   

Re: Auditing audit-libs syscalls

[Andrew Cagney]

Mark,

If the audit table doesn't know about a syscall number, but you're sure 
its real, can you file a bug against the vendor (I'm guessing here it's 
Red Hat :-).  Anyway, yes, the checks need to be flexible enough to 
allow gaps in the audit-libs table - as it could be run against an 
out-of-date list.  As for duplicates, I'm surprised that there aren't 
more, an OS worried about backward compatibility often re-numbers system 
calls, however this being linux it might pay to again check with the 
vendor to confirm that this is the intent.

Nice,

Andrew


Mark Wielaard wrote:
> There are also some extended sanity checks. But I had to disable them.
> audit-libs doesn't seem to know about syscall 260 on ppc being
> get_mempolicy. According to audit-libs syscall 232 and 215 on x86_64
> both have the name epoll_wait. Where possible I made sure we use the
> same names as audit-libs, even if that means having duplicate names for
> different syscall numbers. But these anomalies make it so that we do
> have to disable some of the new TestSyscallsWithAudit checks. See the
> source for what is currently disabled.
>