/
githubmirror
/
audit-userspace
Обзор
Документация
Войти
/
githubmirror
/
audit-userspace
Код
Запросы
0
Пакеты
0
Релизы
0
Аналитика
Безопасность
master
lib/syscall-update.txt
58 строк
2 KB
David Abdurachmanov
Add support for RISC-V 32-bit & 64-bit (riscv32, riscv64) (#73)
03 янв 2025, 18:38
Не верифицирован
03 янв 2025, 18:38
a5dabdc
Код
Авторство
О чём код?
The place where syscall information is gathered is: arch/arm/tools/syscall.tbl arch/arm/include/uapi/asm/unistd.h (unused?) include/uapi/asm-generic/unistd.h (aarch64) arch/powerpc/kernel/syscalls/syscall.tbl arch/s390/kernel/syscalls/syscall.tbl arch/x86/entry/syscalls/syscall_32.tbl arch/x86/entry/syscalls/syscall_64.tbl include/uapi/asm-generic/unistd.h (riscv32, riscv64) For src/ausearch-lookup.c: Inspect include/linux/net.h for socketcall updates Inspect include/linux/ipc.h for ipccall updates For adding new arches, the following might be useful to get a first pass file: cat unistd.h | grep '^#define __NR_' | tr -d ')' | tr 'NR+' ' ' | awk '{ printf "_S(%s, \"%s\")\n", $6, $3 }; ' On newer kernels (4.19+): cat unistd.h | grep '^#define __NR_' | sed 's/__NR_//g' | awk '{ printf "_S(%s, \"%s\")\n", $3, $2 }; ' it will still need hand editing Alternative would be to use https://pypi.org/project/system-calls/ Python pacakge. The latest version is available here: https://github.com/hrw/syscalls-table Another place to find syscalls (not incl. riscv yet) is in GDB: https://github.com/bminor/binutils-gdb/tree/master/gdb/syscalls For example (system-calls 5.19.0): #!/usr/bin/python3 import system_calls import sys syscalls = system_calls.syscalls() table = {} for syscall_name in syscalls.names(): num = None try: num = syscalls.get(syscall_name, "riscv64") except system_calls.NotSupportedSystemCall: pass if num is not None: if num in table: print("This is bad!") sys.exit(1) table[num] = syscall_name for key, value in sorted(table.items(), key=lambda item: int(item[0])): print("_S({}, \"{}\")".format(key, value))