BUG: inconsistent 32-bit x86 SOCKETCALL auditing on 32-bit and 64-bit kernels

[pcmoore]

See the linux-audit mail list thread for details:

• https://www.redhat.com/archives/linux-audit/2016-May/msg00010.html

[jikk]

any update on this issue?

[rgbriggs]

None yet.

[rgbriggs]

Other half of thread (cut off by list archive sw):
https://www.redhat.com/archives/linux-audit/2016-May/msg00019.html
Test program source code: conn.c:
https://www.redhat.com/archives/linux-audit/2016-May/binl9WGBWeApX.bin

[rgbriggs]

Reproduced on:
rawhide - 4.8.0-0.rc4.git4.1.fc26.x86_64
f25 - 4.8.0-0.rc4.git0.1.fc25.x86_64
f22 - 4.6.0-+.x86_64
RHEL7.2 - 3.10.0-537+.el7.test.x86_64.debug
RHEL6.8 - 2.6.32-642.11.1.el6.x86_64

Works as expected on:
RHEL6.6 - 2.6.32-642.4.2.el6.i686
Debian 7.7 - 3.2.0-4-686-pae

A delay of 1s and a sync was required after triggering the rule before calling ausearch.

[rgbriggs]

@jikk How are you assured that the binary you are running on your x86_64 system is 32-bit?

Can you use the file(1) tool to report the binary details for conn on each of your 32-bit and 64-bit systems please?

The reason I ask is that without extra flags, I believe that gcc will create a 64-bit binary when run on a 64-bit system if you don't include the -m32 or -mx32 flags, and a binary created on a 32-bit system that you intend to run on the 64-bit system would most likely need a gcc --static argument to avoid issues finding the exact shared libraries.

[rgbriggs]

Found root cause: net/compat.c:sys_socketcall() is missing the call to audit_socketcall() as in net/socket.c:sys_socketcall(). The fix will be a bit tricky because the arguments need to be translated from 32 bits to 64 bits somewhere around copy_from_user().

[rgbriggs]

Correction: net/compat.c:compat_sys_socketcall()