@@ -1329,6 +1329,7 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair,
return -6;
break;
#ifdef WITH_ARMEB
+ case MACH_ARM:
case MACH_ARMEB:
if (bits == __AUDIT_ARCH_64BIT)
return -6;
@@ -1336,6 +1337,7 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair,
#endif
#ifdef WITH_AARCH64
case MACH_AARCH64:
+ case MACH_AARCH64EB:
if (bits != __AUDIT_ARCH_64BIT)
return -6;
break;
@@ -416,8 +416,10 @@ typedef enum {
MACH_S390X,
MACH_S390,
MACH_ALPHA,
+ MACH_ARM,
MACH_ARMEB,
- MACH_AARCH64
+ MACH_AARCH64,
+ MACH_AARCH64EB
} machine_t;
/* These are the valid audit failure tunable enum values */
@@ -77,10 +77,12 @@ static const struct int_transtab elftab[] = {
{ MACH_ALPHA, AUDIT_ARCH_ALPHA },
#endif
#ifdef WITH_ARMEB
+ { MACH_ARM, AUDIT_ARCH_ARM },
{ MACH_ARMEB, AUDIT_ARCH_ARMEB },
#endif
#ifdef WITH_AARCH64
{ MACH_AARCH64, AUDIT_ARCH_AARCH64},
+ { MACH_AARCH64EB, AUDIT_ARCH_AARCH64},
#endif
};
#define AUDIT_ELF_NAMES (sizeof(elftab)/sizeof(elftab[0]))
@@ -138,12 +140,14 @@ int audit_name_to_syscall(const char *sc, int machine)
break;
#endif
#ifdef WITH_ARMEB
- case MACH_ARMEB:
+ case MACH_ARM:
+ case MACH_ARMEB:
found = armeb_syscall_s2i(sc, &res);
break;
#endif
#ifdef WITH_AARCH64
- case MACH_AARCH64:
+ case MACH_AARCH64:
+ case MACH_AARCH64EB:
found = aarch64_syscall_s2i(sc, &res);
break;
#endif
@@ -180,11 +184,13 @@ const char *audit_syscall_to_name(int sc, int machine)
return alpha_syscall_i2s(sc);
#endif
#ifdef WITH_ARMEB
- case MACH_ARMEB:
+ case MACH_ARM:
+ case MACH_ARMEB:
return armeb_syscall_i2s(sc);
#endif
#ifdef WITH_AARCH64
- case MACH_AARCH64:
+ case MACH_AARCH64:
+ case MACH_AARCH64EB:
return aarch64_syscall_i2s(sc);
#endif
}
@@ -35,11 +35,13 @@ _S(MACH_ALPHA, "alpha" )
#endif
#ifdef WITH_ARMEB
_S(MACH_ARMEB, "armeb" )
-_S(MACH_ARMEB, "armv5tejl")
-_S(MACH_ARMEB, "armv5tel")
-_S(MACH_ARMEB, "armv6l")
-_S(MACH_ARMEB, "armv7l")
+_S(MACH_ARM, "arm")
+_S(MACH_ARM, "armv5tejl")
+_S(MACH_ARM, "armv5tel")
+_S(MACH_ARM, "armv6l")
+_S(MACH_ARM, "armv7l")
#endif
#ifdef WITH_AARCH64
-_S(MACH_AARCH64, "aarch64" )
+_S(MACH_AARCH64, "aarch64")
+_S(MACH_AARCH64EB, "aarch64eb")
#endif
@@ -695,8 +695,10 @@ MACH_PPC = _audit.MACH_PPC
MACH_S390X = _audit.MACH_S390X
MACH_S390 = _audit.MACH_S390
MACH_ALPHA = _audit.MACH_ALPHA
+MACH_ARM = _audit.MACH_ARM
MACH_ARMEB = _audit.MACH_ARMEB
MACH_AARCH64 = _audit.MACH_AARCH64
+MACH_AARCH64EB = _audit.MACH_AARCH64EB
FAIL_IGNORE = _audit.FAIL_IGNORE
FAIL_LOG = _audit.FAIL_LOG
FAIL_TERMINATE = _audit.FAIL_TERMINATE
@@ -72,7 +72,8 @@ int main(int argc, char *argv[])
exit(1);
#endif
#ifndef WITH_ARMEB
- } else if (strcmp("armeb", argv[i]) == 0) {
+ } else if (strcmp("armeb", argv[i]) == 0 ||
+ strcmp("arm", argv[i]) == 0) {
fputs("Arm eabi processor support is not enabled\n",
stderr);
exit(1);
For arm/aarch64(or arm64 in kernel), endianness does not have any differences in term of system call tables. So this patch made some changes to treat LE and BE binaries equally by re-using existing conversion tables. In addition, all the machine names matching "arm*l" were classified to MACH_ARM (instead of MACH_ARMEB) because they represent LE. This patch works with the kernel patch I submitted for AArch64 support, which advertises AUDIT_ARCH_ARM/AARCH64 for LE and AUDIT_ARCH_ARMEB/ AARCH64EB for BE. Alternatively, however, we might better use single macros, AUTH_ARCH_ARM and AUTH_ARCH_AARCH64 only, for both LE and BE as discussed here: http://permalink.gmane.org/gmane.linux.ports.arm.kerenl/165266 Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org> --- lib/libaudit.c | 2 ++ lib/libaudit.h | 4 +++- lib/lookup_table.c | 14 ++++++++++---- lib/machinetab.h | 12 +++++++----- swig/audit.py | 2 ++ tools/ausyscall/ausyscall.c | 3 ++- 6 files changed, 26 insertions(+), 11 deletions(-)