]> CyberLeo.Net >> Repos - FreeBSD/FreeBSD.git/commit - sys/kern/kern_exec.c
audit: correct reporting of *execve(2) success
authorkevans <kevans@FreeBSD.org>
Sat, 24 Oct 2020 14:39:17 +0000 (14:39 +0000)
committerkevans <kevans@FreeBSD.org>
Sat, 24 Oct 2020 14:39:17 +0000 (14:39 +0000)
commit2586fae0edd1ea400e04f9ed98ce41dc563fc901
tree0081bfaba16bd708d6c7608d0795a8d749e9ac4f
parentd7f1dcbda34ba06a20f7e164efb4d91cf36deca2
audit: correct reporting of *execve(2) success

r326145 corrected do_execve() to return EJUSTRETURN upon success so that
important registers are not clobbered. This had the side effect of tapping
out 'failures' for all *execve(2) audit records, which is less than useful
for auditing purposes.

Audit exec returns earlier, where we can know for sure that EJUSTRETURN
translates to success. Note that this unsets TDP_AUDITREC as we commit the
audit record, so the usual audit in the syscall return path will do nothing.

PR: 249179
Reported by: Eirik Oeverby <ltning-freebsd anduin net>
Reviewed by: csjp, kib
MFC after: 1 week
Sponsored by: Klara, Inc.
Differential Revision: https://reviews.freebsd.org/D26922
sys/compat/freebsd32/freebsd32_misc.c
sys/kern/kern_exec.c
sys/kern/subr_syscall.c