Skip to content

Commit

Permalink
A privileged user can inhibit system call audit logging by running a
Browse files Browse the repository at this point in the history 
DTrace script which uses the "syscall" provider.  Once the DTrace script
exits, system call auditing will resume without any intervention.
  • Loading branch information
@laffer1
laffer1 committed Jan 30, 2025
1 parent 459d299 commit a7287f4
Show file tree
Hide file tree
Showing 2 changed files with 9 additions and 4 deletions.
8 changes: 5 additions & 3 deletions sys/kern/subr_syscall.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -140,9 +140,8 @@ syscallenter(struct thread *td)

sy_thr_static = (se->sy_thrcnt & SY_THR_STATIC) != 0;

if (__predict_false(SYSTRACE_ENABLED() ||
AUDIT_SYSCALL_ENTER(sa->code, td) ||
!sy_thr_static)) {
if (__predict_false(AUDIT_SYSCALL_ENABLED() ||
SYSTRACE_ENABLED() || !sy_thr_static)) {
if (!sy_thr_static) {
error = syscall_thread_enter(td, &se);
sy_thr_static = (se->sy_thrcnt & SY_THR_STATIC) != 0;
Expand All @@ -157,6 +156,9 @@ syscallenter(struct thread *td)
if (__predict_false(se->sy_entry != 0))
(*systrace_probe_func)(sa, SYSTRACE_ENTRY, 0);
#endif

AUDIT_SYSCALL_ENTER(sa->code, td);

error = (se->sy_call)(td, sa->args);
/* Save the latest error return value. */
if (__predict_false((td->td_pflags & TDP_NERRNO) != 0))
Expand Down
5 changes: 4 additions & 1 deletion sys/security/audit/audit.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -389,9 +389,11 @@ void audit_thread_free(struct thread *td);
audit_arg_vnode2((vp)); \
} while (0)

#define AUDIT_SYSCALL_ENABLED() audit_syscalls_enabled

#define AUDIT_SYSCALL_ENTER(code, td) ({ \
bool _audit_entered = false; \
if (__predict_false(audit_syscalls_enabled)) { \
if (audit_syscalls_enabled) { \
audit_syscall_enter(code, td); \
_audit_entered = true; \
} \
Expand Down Expand Up @@ -468,6 +470,7 @@ void audit_thread_free(struct thread *td);

#define AUDITING_TD(td) 0

#define AUDIT_SYSCALL_ENABLED() 0
#define AUDIT_SYSCALL_ENTER(code, td) 0
#define AUDIT_SYSCALL_EXIT(error, td)

Expand Down

0 comments on commit a7287f4

Please sign in to comment.