<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<p style="margin: 0in 0in 8pt; line-height: 107%; font-size: 11pt; font-family: Calibri, sans-serif">
<span style="font-size: 9pt; font-family: "Segoe UI", sans-serif; color: rgb(0, 0, 0); background: white;">To whom it may concern,
</span></p>
<p style="margin: 0in 0in 8pt; line-height: 107%; font-size: 11pt; font-family: Calibri, sans-serif">
<span style="font-size: 9pt; font-family: "Segoe UI", sans-serif; color: rgb(0, 0, 0); background: white;">Hi,
</span><span style="font-size:9.0pt; font-family:
"Segoe UI",sans-serif; color:#0078D4; background:white"><span style="color: rgb(0, 0, 0);"> </span></span></p>
<p style="margin: 0in 0in 8pt; line-height: 107%; font-size: 11pt; font-family: Calibri, sans-serif">
<span style="font-size:9.0pt; font-family:
"Segoe UI",sans-serif; color:#0078D4; background:white"><span style="color: rgb(0, 0, 0);">
</span><span style="color: rgb(0, 0, 0);"> </span></span><span style="font-size: 9pt; font-family: "Segoe UI", sans-serif; color: rgb(0, 0, 0); background: white;">I am a CS research assistant currently working at Lahore University of Management Sciences (LUMS),
Pakistan. The project I am working on involves understanding and working with the Linux Audit Kernel.</span></p>
<p style="margin: 0in 0in 8pt; line-height: 107%; font-size: 11pt; font-family: Calibri, sans-serif;text-indent:.5in">
<span style="font-size: 9pt; font-family: "Segoe UI", sans-serif; color: rgb(0, 0, 0); background: white;">As you know, linux-audit logs all the syscall arguments as a1, a2, a3, a4 as unsigned longs. In the case of some syscall, such as WRITE, the second argument,
a2, stores the pointer to a buffer, where the buffer contains the content being written. I have been trying to deference the buffer from its address stored in a2. I am dereferencing the buffer currently in kernel/auditsc.c and dumping the dereferenced contents
of a2 to printk. However, after building the customized kernel, auditd fails probably due to invalid pointer dereferencing.
</span></p>
<p style="margin: 0in 0in 8pt; line-height: 107%; font-size: 11pt; font-family: Calibri, sans-serif">
<span style="font-size:9.0pt; font-family:
"Segoe UI",sans-serif; color:#0078D4; background:white"><span style="color: rgb(0, 0, 0);">
</span><span style="color: rgb(0, 0, 0);"> </span></span><span style="font-size: 9pt; font-family: "Segoe UI", sans-serif; color: rgb(0, 0, 0); background: white;">I am confused regarding the scope of that pointer variable stored in a2. I have two questions:</span></p>
<p style="margin: 0in 0in 8pt; line-height: 107%; font-size: 11pt; font-family: Calibri, sans-serif">
<span style="font-size:9.0pt; font-family:
"Segoe UI",sans-serif; color:#0078D4; background:white"><br>
</span><span style="font-size: 9pt; font-family: "Segoe UI", sans-serif; color: rgb(0, 0, 0); background: white;"><b>1) Is it possible to deference the syscall arguments in the Linux kernel, given the buffer was initially sent by the process that initiated
the syscall?</b></span></p>
<p style="margin: 0in 0in 8pt; line-height: 107%; font-size: 11pt; font-family: Calibri, sans-serif">
<span style="font-size: 9pt; font-family: "Segoe UI", sans-serif; color: rgb(0, 0, 0); background: white;"><b>2) If it is possible to do so, what is the right way to go about it. What is the right file to work if the goal is to dereference the address stored
in one of the SYSCALL arguments?</b></span></p>
<p style="margin: 0in 0in 8pt; line-height: 107%; font-size: 11pt; font-family: Calibri, sans-serif">
<span style="font-size:9.0pt; font-family:
"Segoe UI",sans-serif; color:#0078D4; background:white"></span></p>
<p style="margin: 0in 0in 8pt; line-height: 107%; font-size: 11pt; font-family: Calibri, sans-serif">
<span style="font-size: 9pt; font-family: "Segoe UI", sans-serif; color: rgb(0, 0, 0); background: white;">Really looking forward to hearing back from you.</span></p>
<p style="margin: 0in 0in 8pt; line-height: 107%; font-size: 11pt; font-family: Calibri, sans-serif">
<span style="font-size:9.0pt; font-family:
"Segoe UI",sans-serif; color:#0078D4; background:white"></span></p>
<p style="margin: 0in 0in 8pt; line-height: 107%; font-size: 11pt; font-family: Calibri, sans-serif">
<span style="font-size: 9pt; font-family: "Segoe UI", sans-serif; color: rgb(0, 0, 0); background: white;">Best Regards,</span></p>
<p style="margin: 0in 0in 8pt; line-height: 107%; font-size: 11pt; font-family: Calibri, sans-serif">
<span style="font-size: 9pt; font-family: "Segoe UI", sans-serif; color: rgb(0, 0, 0); background: white;">Adil</span></p>
<br>
</div>
</body>
</html>