[PATCH] fix ia64 syscall auditing

Amy Griffis amy.griffis at hp.com
Fri Apr 1 15:52:37 UTC 2005


David Woodhouse wrote:     [Thu Mar 31 2005, 06:29:34PM EST]
> I had to modify it to apply to Linus' current kernel -- please could you
> verify that my modification to fsys.S was correct? Note the new line
> immediately after the addition. The only IA64 hardware I have easy
> access to has wheels, and I believe it's too old to run _any_ Linux
> kernel any more.
> 
> ===== arch/ia64/kernel/fsys.S 1.34 vs edited =====
> --- 1.34/arch/ia64/kernel/fsys.S	2005-01-22 22:19:11 +00:00
> +++ edited/arch/ia64/kernel/fsys.S	2005-04-01 00:20:32 +01:00
> @@ -611,8 +611,10 @@
>  	movl r2=ia64_ret_from_syscall
>  	;;
>  	mov rp=r2				// set the real return addr
> -	tbit.z p8,p0=r3,TIF_SYSCALL_TRACE
> +	and r3=_TIF_SYSCALL_TRACEAUDIT,r3
>  	;;
> +	cmp.eq p8,p0=r3,r0
> +
>  (p10)	br.cond.spnt.many ia64_ret_from_syscall	// p10==true means out registers are more than 8

^-- This line is interesting because it's not in David Mosberger's
tree.  I'll check out the changesets to see why it was added (or
removed).

>  (p8)	br.call.sptk.many b6=b6		// ignore this return addr
>  	br.cond.sptk ia64_trace_syscall




More information about the Linux-audit mailing list