[PATCH] fix ia64 syscall auditing
Amy Griffis
amy.griffis at hp.com
Fri Apr 1 15:52:37 UTC 2005
David Woodhouse wrote: [Thu Mar 31 2005, 06:29:34PM EST]
> I had to modify it to apply to Linus' current kernel -- please could you
> verify that my modification to fsys.S was correct? Note the new line
> immediately after the addition. The only IA64 hardware I have easy
> access to has wheels, and I believe it's too old to run _any_ Linux
> kernel any more.
>
> ===== arch/ia64/kernel/fsys.S 1.34 vs edited =====
> --- 1.34/arch/ia64/kernel/fsys.S 2005-01-22 22:19:11 +00:00
> +++ edited/arch/ia64/kernel/fsys.S 2005-04-01 00:20:32 +01:00
> @@ -611,8 +611,10 @@
> movl r2=ia64_ret_from_syscall
> ;;
> mov rp=r2 // set the real return addr
> - tbit.z p8,p0=r3,TIF_SYSCALL_TRACE
> + and r3=_TIF_SYSCALL_TRACEAUDIT,r3
> ;;
> + cmp.eq p8,p0=r3,r0
> +
> (p10) br.cond.spnt.many ia64_ret_from_syscall // p10==true means out registers are more than 8
^-- This line is interesting because it's not in David Mosberger's
tree. I'll check out the changesets to see why it was added (or
removed).
> (p8) br.call.sptk.many b6=b6 // ignore this return addr
> br.cond.sptk ia64_trace_syscall
More information about the Linux-audit
mailing list