1// SPDX-License-Identifier: GPL-2.0
2#include <linux/init.h>
3#include <linux/types.h>
4#include <linux/audit.h>
5#include <asm/unistd.h>
6#include <asm/audit.h>
7
8static unsigned dir_class[] = {
9#include <asm-generic/audit_dir_write.h>
10~0U
11};
12
13static unsigned read_class[] = {
14#include <asm-generic/audit_read.h>
15~0U
16};
17
18static unsigned write_class[] = {
19#include <asm-generic/audit_write.h>
20~0U
21};
22
23static unsigned chattr_class[] = {
24#include <asm-generic/audit_change_attr.h>
25~0U
26};
27
28static unsigned signal_class[] = {
29#include <asm-generic/audit_signal.h>
30~0U
31};
32
33int audit_classify_arch(int arch)
34{
35#ifdef CONFIG_IA32_EMULATION
36 if (arch == AUDIT_ARCH_I386)
37 return 1;
38#endif
39 return 0;
40}
41
42int audit_classify_syscall(int abi, unsigned syscall)
43{
44#ifdef CONFIG_IA32_EMULATION
45 if (abi == AUDIT_ARCH_I386)
46 return ia32_classify_syscall(syscall);
47#endif
48 switch(syscall) {
49 case __NR_open:
50 return AUDITSC_OPEN;
51 case __NR_openat:
52 return AUDITSC_OPENAT;
53 case __NR_execve:
54 case __NR_execveat:
55 return AUDITSC_EXECVE;
56 case __NR_openat2:
57 return AUDITSC_OPENAT2;
58 default:
59 return AUDITSC_NATIVE;
60 }
61}
62
63static int __init audit_classes_init(void)
64{
65#ifdef CONFIG_IA32_EMULATION
66 audit_register_class(AUDIT_CLASS_WRITE_32, list: ia32_write_class);
67 audit_register_class(AUDIT_CLASS_READ_32, list: ia32_read_class);
68 audit_register_class(AUDIT_CLASS_DIR_WRITE_32, list: ia32_dir_class);
69 audit_register_class(AUDIT_CLASS_CHATTR_32, list: ia32_chattr_class);
70 audit_register_class(AUDIT_CLASS_SIGNAL_32, list: ia32_signal_class);
71#endif
72 audit_register_class(AUDIT_CLASS_WRITE, list: write_class);
73 audit_register_class(AUDIT_CLASS_READ, list: read_class);
74 audit_register_class(AUDIT_CLASS_DIR_WRITE, list: dir_class);
75 audit_register_class(AUDIT_CLASS_CHATTR, list: chattr_class);
76 audit_register_class(AUDIT_CLASS_SIGNAL, list: signal_class);
77 return 0;
78}
79
80__initcall(audit_classes_init);
81

source code of linux/arch/x86/kernel/audit_64.c