xref: /linux/arch/x86/kernel/audit_64.c (revision 223981db9bafb80f558162c148f261e2ff043dbe)
1 // SPDX-License-Identifier: GPL-2.0
2 #include <linux/init.h>
3 #include <linux/types.h>
4 #include <linux/audit.h>
5 #include <asm/unistd.h>
6 #include <asm/audit.h>
7 
8 static unsigned dir_class[] = {
9 #include <asm-generic/audit_dir_write.h>
10 ~0U
11 };
12 
13 static unsigned read_class[] = {
14 #include <asm-generic/audit_read.h>
15 ~0U
16 };
17 
18 static unsigned write_class[] = {
19 #include <asm-generic/audit_write.h>
20 ~0U
21 };
22 
23 static unsigned chattr_class[] = {
24 #include <asm-generic/audit_change_attr.h>
25 ~0U
26 };
27 
28 static unsigned signal_class[] = {
29 #include <asm-generic/audit_signal.h>
30 ~0U
31 };
32 
33 int audit_classify_arch(int arch)
34 {
35 #ifdef CONFIG_IA32_EMULATION
36 	if (arch == AUDIT_ARCH_I386)
37 		return 1;
38 #endif
39 	return 0;
40 }
41 
42 int audit_classify_syscall(int abi, unsigned syscall)
43 {
44 #ifdef CONFIG_IA32_EMULATION
45 	if (abi == AUDIT_ARCH_I386)
46 		return ia32_classify_syscall(syscall);
47 #endif
48 	switch(syscall) {
49 	case __NR_open:
50 		return AUDITSC_OPEN;
51 	case __NR_openat:
52 		return AUDITSC_OPENAT;
53 	case __NR_execve:
54 	case __NR_execveat:
55 		return AUDITSC_EXECVE;
56 	case __NR_openat2:
57 		return AUDITSC_OPENAT2;
58 	default:
59 		return AUDITSC_NATIVE;
60 	}
61 }
62 
63 static int __init audit_classes_init(void)
64 {
65 #ifdef CONFIG_IA32_EMULATION
66 	audit_register_class(AUDIT_CLASS_WRITE_32, ia32_write_class);
67 	audit_register_class(AUDIT_CLASS_READ_32, ia32_read_class);
68 	audit_register_class(AUDIT_CLASS_DIR_WRITE_32, ia32_dir_class);
69 	audit_register_class(AUDIT_CLASS_CHATTR_32, ia32_chattr_class);
70 	audit_register_class(AUDIT_CLASS_SIGNAL_32, ia32_signal_class);
71 #endif
72 	audit_register_class(AUDIT_CLASS_WRITE, write_class);
73 	audit_register_class(AUDIT_CLASS_READ, read_class);
74 	audit_register_class(AUDIT_CLASS_DIR_WRITE, dir_class);
75 	audit_register_class(AUDIT_CLASS_CHATTR, chattr_class);
76 	audit_register_class(AUDIT_CLASS_SIGNAL, signal_class);
77 	return 0;
78 }
79 
80 __initcall(audit_classes_init);
81