Bug#1146073: trixie-pu: package audit/4.0.2-2+deb13u1
Aurelien Jarno <[email protected]>
| Newsgroups | gmane.linux.debian.devel.release |
|---|---|
| Message-ID | <178801585522.2200901.16084716794900963124.reportbug__511.800758407333$1788016064$gmane$org@ohm.local> |
Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected], [email protected] Control: affects -1 + src:audit User: [email protected] Usertags: pu [ Reason ] Following all the recent kernel security issues, DSA decided to enable audit on the hosts it manages. We discovered that riscv64 support is missing from audit in trixie. Unfortunately support only landed upstream in version 4.0.3, while trixie ships version 4.0.2. [ Impact ] If the update isn't approved, DSA will not be enable to audit on riscv64 like on other architectures. [ Tests ] I have built and installed the package on both amd64 and riscv64. I have checked that a configuration similar to the one used by DSA works. [ Risks ] The changes are mechanical changes to get the list of syscalls for RISC-V. In addition those changes are in testing/sid for more than a year. Therefore I believe they are limited. [ Checklist ] [x] *all* changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in (old)stable [x] the issue is verified as fixed in unstable [ Changes ] The change consists in backporting a commit from upstream (which applies cleanly), and passing --with-riscv to the configure to script enable riscv support.
audit_4.0.2-2+deb13u1.debdiff
(text/plain, 30.3 KB)
diff -Nru audit-4.0.2/debian/changelog audit-4.0.2/debian/changelog --- audit-4.0.2/debian/changelog 2024-11-14 22:10:09.000000000 +0100 +++ audit-4.0.2/debian/changelog 2026-08-29 10:54:36.000000000 +0200 @@ -1,3 +1,11 @@ +audit (1:4.0.2-2+deb13u1) trixie; urgency=medium + + * Non-maintainer upload. + * d/p/04-riscv64.patch: backport riscv64 support from version 4.0.3 + * debian/rules: Pass --with-riscv to configure (Closes: #1136948) + + -- Aurelien Jarno <[email protected]> Sat, 29 Aug 2026 10:54:36 +0200 + audit (1:4.0.2-2) unstable; urgency=medium * debian/rules: Fix the building of the python module for the non default diff -Nru audit-4.0.2/debian/patches/04-riscv64.patch audit-4.0.2/debian/patches/04-riscv64.patch --- audit-4.0.2/debian/patches/04-riscv64.patch 1970-01-01 01:00:00.000000000 +0100 +++ audit-4.0.2/debian/patches/04-riscv64.patch 2026-08-29 10:54:36.000000000 +0200 @@ -0,0 +1,1073 @@ +From a5dabdc8b52ef798e46d05403f09333fbc2c0f5c Mon Sep 17 00:00:00 2001 +From: David Abdurachmanov <[email protected]> +Date: Fri, 3 Jan 2025 17:38:40 +0200 +Subject: [PATCH] Add support for RISC-V 32-bit & 64-bit (riscv32, riscv64) + (#73) + +* Add support for RISC-V 32-bit & 64-bit (riscv32, riscv64) archs + +--------- + +Signed-off-by: David Abdurachmanov <[email protected]> +Co-authored-by: David Abdurachmanov <[email protected]> +Co-authored-by: Attila Lakatos <[email protected]> +--- + auparse/interpret.c | 2 +- + configure.ac | 12 ++ + lib/Makefile.am | 34 ++++ + lib/libaudit.c | 9 + + lib/libaudit.h | 4 +- + lib/lookup_table.c | 22 +++ + lib/machinetab.h | 4 + + lib/riscv32_table.h | 335 ++++++++++++++++++++++++++++++++++ + lib/riscv64_table.h | 345 ++++++++++++++++++++++++++++++++++++ + lib/syscall-update.txt | 39 ++++ + lib/test/lookup_test.c | 40 +++++ + tools/ausyscall/ausyscall.c | 11 ++ + 12 files changed, 855 insertions(+), 2 deletions(-) + create mode 100644 lib/riscv32_table.h + create mode 100644 lib/riscv64_table.h + +diff --git a/auparse/interpret.c b/auparse/interpret.c +index 1ca986d09..9ea2a66cc 100644 +--- a/auparse/interpret.c ++++ b/auparse/interpret.c +@@ -713,7 +713,7 @@ static const char *print_arch(const char *val, unsigned int machine) + const char *ptr; + char *out; + +- if (machine > MACH_AARCH64) { ++ if (machine > MACH_RISCV64) { + unsigned int ival; + + errno = 0; +diff --git a/configure.ac b/configure.ac +index cadef5817..050910cf4 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -323,6 +323,18 @@ fi + AM_CONDITIONAL(USE_AARCH64, test x$use_aarch64 = xyes) + AC_MSG_RESULT($use_aarch64) + ++withval="" ++AC_MSG_CHECKING(whether to include riscv processor support) ++AC_ARG_WITH(riscv, ++AS_HELP_STRING([--with-riscv],[enable riscv processor support]), ++use_riscv=$withval, ++use_riscv=no) ++if test x$use_riscv != xno ; then ++ AC_DEFINE(WITH_RISCV,1,[Define if you want to enable RISC-V processor support.]) ++fi ++AM_CONDITIONAL(USE_RISCV, test x$use_riscv = xyes) ++AC_MSG_RESULT($use_riscv) ++ + withval="" + AC_MSG_CHECKING(whether to use apparmor) + AC_ARG_WITH(apparmor, +diff --git a/lib/Makefile.am b/lib/Makefile.am +index 3c1028b90..b54c8cc66 100644 +--- a/lib/Makefile.am ++++ b/lib/Makefile.am +@@ -54,6 +54,9 @@ endif + if USE_AARCH64 + BUILT_SOURCES += aarch64_tables.h + endif ++if USE_RISCV ++BUILT_SOURCES += riscv64_tables.h riscv32_tables.h ++endif + noinst_PROGRAMS = gen_actiontabs_h gen_errtabs_h gen_fieldtabs_h \ + gen_flagtabs_h gen_fstypetabs_h gen_ftypetabs_h gen_i386_tables_h \ + gen_machinetabs_h gen_msg_typetabs_h gen_optabs_h \ +@@ -65,6 +68,9 @@ endif + if USE_AARCH64 + noinst_PROGRAMS += gen_aarch64_tables_h + endif ++if USE_RISCV ++noinst_PROGRAMS += gen_riscv64_tables_h gen_riscv32_tables_h ++endif + gen_actiontabs_h_SOURCES = gen_tables.c gen_tables.h actiontab.h + gen_actiontabs_h_CFLAGS = '-DTABLE_H="actiontab.h"' + $(gen_actiontabs_h_OBJECTS): CC=$(CC_FOR_BUILD) +@@ -108,6 +114,34 @@ aarch64_tables.h: gen_aarch64_tables_h Makefile + ./gen_aarch64_tables_h --lowercase --i2s --s2i aarch64_syscall > $@ + endif + ++if USE_RISCV ++gen_riscv64_tables_h_SOURCES = gen_tables.c gen_tables.h riscv64_table.h ++gen_riscv64_tables_h_CFLAGS = '-DTABLE_H="riscv64_table.h"' ++$(gen_riscv64_tables_h_OBJECTS): CC=$(CC_FOR_BUILD) ++$(gen_riscv64_tables_h_OBJECTS): CFLAGS=$(CFLAGS_FOR_BUILD) ++$(gen_riscv64_tables_h_OBJECTS): CPPFLAGS=$(CPPFLAGS_FOR_BUILD) ++$(gen_riscv64_tables_h_OBJECTS): LDFLAGS=$(LDFLAGS_FOR_BUILD) ++gen_riscv64_tables_h$(BUILD_EXEEXT): CC=$(CC_FOR_BUILD) ++gen_riscv64_tables_h$(BUILD_EXEEXT): CFLAGS=$(CFLAGS_FOR_BUILD) ++gen_riscv64_tables_h$(BUILD_EXEEXT): CPPFLAGS=$(CPPFLAGS_FOR_BUILD) ++gen_riscv64_tables_h$(BUILD_EXEEXT): LDFLAGS=$(LDFLAGS_FOR_BUILD) ++riscv64_tables.h: gen_riscv64_tables_h Makefile ++ ./gen_riscv64_tables_h --lowercase --i2s --s2i riscv64_syscall > $@ ++ ++gen_riscv32_tables_h_SOURCES = gen_tables.c gen_tables.h riscv32_table.h ++gen_riscv32_tables_h_CFLAGS = '-DTABLE_H="riscv32_table.h"' ++$(gen_riscv32_tables_h_OBJECTS): CC=$(CC_FOR_BUILD) ++$(gen_riscv32_tables_h_OBJECTS): CFLAGS=$(CFLAGS_FOR_BUILD) ++$(gen_riscv32_tables_h_OBJECTS): CPPFLAGS=$(CPPFLAGS_FOR_BUILD) ++$(gen_riscv32_tables_h_OBJECTS): LDFLAGS=$(LDFLAGS_FOR_BUILD) ++gen_riscv32_tables_h$(BUILD_EXEEXT): CC=$(CC_FOR_BUILD) ++gen_riscv32_tables_h$(BUILD_EXEEXT): CFLAGS=$(CFLAGS_FOR_BUILD) ++gen_riscv32_tables_h$(BUILD_EXEEXT): CPPFLAGS=$(CPPFLAGS_FOR_BUILD) ++gen_riscv32_tables_h$(BUILD_EXEEXT): LDFLAGS=$(LDFLAGS_FOR_BUILD) ++riscv32_tables.h: gen_riscv32_tables_h Makefile ++ ./gen_riscv32_tables_h --lowercase --i2s --s2i riscv32_syscall > $@ ++endif ++ + gen_errtabs_h_SOURCES = gen_tables.c gen_tables.h errtab.h + gen_errtabs_h_CFLAGS = '-DTABLE_H="errtab.h"' + $(gen_errtabs_h_OBJECTS): CC=$(CC_FOR_BUILD) +diff --git a/lib/libaudit.c b/lib/libaudit.c +index 576fa8131..7a8c6d4b1 100644 +--- a/lib/libaudit.c ++++ b/lib/libaudit.c +@@ -1441,6 +1441,8 @@ int audit_determine_machine(const char *arch) + machine = MACH_S390; + else if (bits == ~__AUDIT_ARCH_64BIT && machine == MACH_AARCH64) + machine = MACH_ARM; ++ else if (bits == ~__AUDIT_ARCH_64BIT && machine == MACH_RISCV64) ++ machine = MACH_RISCV32; + + /* Check for errors - return -6 + * We don't allow 32 bit machines to specify 64 bit. */ +@@ -1469,11 +1471,18 @@ int audit_determine_machine(const char *arch) + if (bits && bits != __AUDIT_ARCH_64BIT) + return -6; /* 64 bit only */ + break; ++#endif ++#ifdef WITH_RISCV ++ case MACH_RISCV32: ++ if (bits == __AUDIT_ARCH_64BIT) ++ return -6; ++ break; + #endif + case MACH_86_64: /* fallthrough */ + case MACH_PPC64: /* fallthrough */ + case MACH_S390X: /* fallthrough */ + case MACH_IO_URING: ++ case MACH_RISCV64: /* fallthrough */ + break; + case MACH_PPC64LE: /* 64 bit only */ + if (bits && bits != __AUDIT_ARCH_64BIT) +diff --git a/lib/libaudit.h b/lib/libaudit.h +index 15ea2e6f4..d4f1e73ac 100644 +--- a/lib/libaudit.h ++++ b/lib/libaudit.h +@@ -180,7 +180,9 @@ typedef enum { + MACH_ARM, + MACH_AARCH64, + MACH_PPC64LE, +- MACH_IO_URING ++ MACH_IO_URING, ++ MACH_RISCV32, ++ MACH_RISCV64 + } machine_t; + + /* These are the valid audit failure tunable enum values */ +diff --git a/lib/lookup_table.c b/lib/lookup_table.c +index 31a91c28f..71a00f7f6 100644 +--- a/lib/lookup_table.c ++++ b/lib/lookup_table.c +@@ -47,6 +47,10 @@ + #ifdef WITH_AARCH64 + #include "aarch64_tables.h" + #endif ++#ifdef WITH_RISCV ++#include "riscv64_tables.h" ++#include "riscv32_tables.h" ++#endif + #include "i386_tables.h" + #include "ppc_tables.h" + #include "s390_tables.h" +@@ -86,6 +90,10 @@ static const struct int_transtab elftab[] = { + #ifdef WITH_AARCH64 + { MACH_AARCH64, AUDIT_ARCH_AARCH64}, + #endif ++#ifdef WITH_RISCV ++ { MACH_RISCV32, AUDIT_ARCH_RISCV32 }, ++ { MACH_RISCV64, AUDIT_ARCH_RISCV64 }, ++#endif + }; + #define AUDIT_ELF_NAMES (sizeof(elftab)/sizeof(elftab[0])) + +@@ -157,6 +165,14 @@ int audit_name_to_syscall(const char *sc, int machine) + found = aarch64_syscall_s2i(sc, &res); + break; + #endif ++#ifdef WITH_RISCV ++ case MACH_RISCV64: ++ found = riscv64_syscall_s2i(sc, &res); ++ break; ++ case MACH_RISCV32: ++ found = riscv32_syscall_s2i(sc, &res); ++ break; ++#endif + #endif + case MACH_IO_URING: + return audit_name_to_uringop(sc); +@@ -203,6 +219,12 @@ const char *audit_syscall_to_name(int sc, int machine) + #ifdef WITH_AARCH64 + case MACH_AARCH64: + return aarch64_syscall_i2s(sc); ++#endif ++#ifdef WITH_RISCV ++ case MACH_RISCV64: ++ return riscv64_syscall_i2s(sc); ++ case MACH_RISCV32: ++ return riscv32_syscall_i2s(sc); + #endif + case MACH_IO_URING: + return audit_uringop_to_name(sc); +diff --git a/lib/machinetab.h b/lib/machinetab.h +index 5bd27dc19..2a2ad7fe6 100644 +--- a/lib/machinetab.h ++++ b/lib/machinetab.h +@@ -45,4 +45,8 @@ _S(MACH_AARCH64, "armv8l") + #ifdef WITH_IO_URING + _S(MACH_IO_URING, "uring") + #endif ++#ifdef WITH_RISCV ++_S(MACH_RISCV32, "riscv32") ++_S(MACH_RISCV64, "riscv64") ++#endif + +diff --git a/lib/riscv32_table.h b/lib/riscv32_table.h +new file mode 100644 +index 000000000..572998435 +--- /dev/null ++++ b/lib/riscv32_table.h +@@ -0,0 +1,335 @@ ++/* riscv32_table.h -- ++ * Copyright 2024 Rivos Inc. ++ * All Rights Reserved. ++ * ++ * This library is free software; you can redistribute it and/or ++ * modify it under the terms of the GNU Lesser General Public ++ * License as published by the Free Software Foundation; either ++ * version 2.1 of the License, or (at your option) any later version. ++ * ++ * This library is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ * Lesser General Public License for more details. ++ * ++ * You should have received a copy of the GNU Lesser General Public ++ * License along with this library; if not, write to the Free Software ++ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA ++ * ++ * Authors: ++ * David Abdurachmanov <[email protected]> ++ */ ++ ++_S(0, "io_setup") ++_S(1, "io_destroy") ++_S(2, "io_submit") ++_S(3, "io_cancel") ++_S(5, "setxattr") ++_S(6, "lsetxattr") ++_S(7, "fsetxattr") ++_S(8, "getxattr") ++_S(9, "lgetxattr") ++_S(10, "fgetxattr") ++_S(11, "listxattr") ++_S(12, "llistxattr") ++_S(13, "flistxattr") ++_S(14, "removexattr") ++_S(15, "lremovexattr") ++_S(16, "fremovexattr") ++_S(17, "getcwd") ++_S(18, "lookup_dcookie") ++_S(19, "eventfd2") ++_S(20, "epoll_create1") ++_S(21, "epoll_ctl") ++_S(22, "epoll_pwait") ++_S(23, "dup") ++_S(24, "dup3") ++_S(25, "fcntl64") ++_S(26, "inotify_init1") ++_S(27, "inotify_add_watch") ++_S(28, "inotify_rm_watch") ++_S(29, "ioctl") ++_S(30, "ioprio_set") ++_S(31, "ioprio_get") ++_S(32, "flock") ++_S(33, "mknodat") ++_S(34, "mkdirat") ++_S(35, "unlinkat") ++_S(36, "symlinkat") ++_S(37, "linkat") ++_S(39, "umount2") ++_S(40, "mount") ++_S(41, "pivot_root") ++_S(42, "nfsservctl") ++_S(43, "statfs64") ++_S(44, "fstatfs64") ++_S(45, "truncate64") ++_S(46, "ftruncate64") ++_S(47, "fallocate") ++_S(48, "faccessat") ++_S(49, "chdir") ++_S(50, "fchdir") ++_S(51, "chroot") ++_S(52, "fchmod") ++_S(53, "fchmodat") ++_S(54, "fchownat") ++_S(55, "fchown") ++_S(56, "openat") ++_S(57, "close") ++_S(58, "vhangup") ++_S(59, "pipe2") ++_S(60, "quotactl") ++_S(61, "getdents64") ++_S(62, "llseek") ++_S(63, "read") ++_S(64, "write") ++_S(65, "readv") ++_S(66, "writev") ++_S(67, "pread64") ++_S(68, "pwrite64") ++_S(69, "preadv") ++_S(70, "pwritev") ++_S(71, "sendfile64") ++_S(74, "signalfd4") ++_S(75, "vmsplice") ++_S(76, "splice") ++_S(77, "tee") ++_S(78, "readlinkat") ++_S(81, "sync") ++_S(82, "fsync") ++_S(83, "fdatasync") ++_S(84, "sync_file_range") ++_S(85, "timerfd_create") ++_S(89, "acct") ++_S(90, "capget") ++_S(91, "capset") ++_S(92, "personality") ++_S(93, "exit") ++_S(94, "exit_group") ++_S(95, "waitid") ++_S(96, "set_tid_address") ++_S(97, "unshare") ++_S(99, "set_robust_list") ++_S(100, "get_robust_list") ++_S(102, "getitimer") ++_S(103, "setitimer") ++_S(104, "kexec_load") ++_S(105, "init_module") ++_S(106, "delete_module") ++_S(107, "timer_create") ++_S(109, "timer_getoverrun") ++_S(111, "timer_delete") ++_S(116, "syslog") ++_S(117, "ptrace") ++_S(118, "sched_setparam") ++_S(119, "sched_setscheduler") ++_S(120, "sched_getscheduler") ++_S(121, "sched_getparam") ++_S(122, "sched_setaffinity") ++_S(123, "sched_getaffinity") ++_S(124, "sched_yield") ++_S(125, "sched_get_priority_max") ++_S(126, "sched_get_priority_min") ++_S(128, "restart_syscall") ++_S(129, "kill") ++_S(130, "tkill") ++_S(131, "tgkill") ++_S(132, "sigaltstack") ++_S(133, "rt_sigsuspend") ++_S(134, "rt_sigaction") ++_S(135, "rt_sigprocmask") ++_S(136, "rt_sigpending") ++_S(138, "rt_sigqueueinfo") ++_S(139, "rt_sigreturn") ++_S(140, "setpriority") ++_S(141, "getpriority") ++_S(142, "reboot") ++_S(143, "setregid") ++_S(144, "setgid") ++_S(145, "setreuid") ++_S(146, "setuid") ++_S(147, "setresuid") ++_S(148, "getresuid") ++_S(149, "setresgid") ++_S(150, "getresgid") ++_S(151, "setfsuid") ++_S(152, "setfsgid") ++_S(153, "times") ++_S(154, "setpgid") ++_S(155, "getpgid") ++_S(156, "getsid") ++_S(157, "setsid") ++_S(158, "getgroups") ++_S(159, "setgroups") ++_S(160, "uname") ++_S(161, "sethostname") ++_S(162, "setdomainname") ++_S(165, "getrusage") ++_S(166, "umask") ++_S(167, "prctl") ++_S(168, "getcpu") ++_S(172, "getpid") ++_S(173, "getppid") ++_S(174, "getuid") ++_S(175, "geteuid") ++_S(176, "getgid") ++_S(177, "getegid") ++_S(178, "gettid") ++_S(179, "sysinfo") ++_S(180, "mq_open") ++_S(181, "mq_unlink") ++_S(184, "mq_notify") ++_S(185, "mq_getsetattr") ++_S(186, "msgget") ++_S(187, "msgctl") ++_S(188, "msgrcv") ++_S(189, "msgsnd") ++_S(190, "semget") ++_S(191, "semctl") ++_S(193, "semop") ++_S(194, "shmget") ++_S(195, "shmctl") ++_S(196, "shmat") ++_S(197, "shmdt") ++_S(198, "socket") ++_S(199, "socketpair") ++_S(200, "bind") ++_S(201, "listen") ++_S(202, "accept") ++_S(203, "connect") ++_S(204, "getsockname") ++_S(205, "getpeername") ++_S(206, "sendto") ++_S(207, "recvfrom") ++_S(208, "setsockopt") ++_S(209, "getsockopt") ++_S(210, "shutdown") ++_S(211, "sendmsg") ++_S(212, "recvmsg") ++_S(213, "readahead") ++_S(214, "brk") ++_S(215, "munmap") ++_S(216, "mremap") ++_S(217, "add_key") ++_S(218, "request_key") ++_S(219, "keyctl") ++_S(220, "clone") ++_S(221, "execve") ++_S(222, "mmap2") ++_S(223, "fadvise64_64") ++_S(224, "swapon") ++_S(225, "swapoff") ++_S(226, "mprotect") ++_S(227, "msync") ++_S(228, "mlock") ++_S(229, "munlock") ++_S(230, "mlockall") ++_S(231, "munlockall") ++_S(232, "mincore") ++_S(233, "madvise") ++_S(234, "remap_file_pages") ++_S(235, "mbind") ++_S(236, "get_mempolicy") ++_S(237, "set_mempolicy") ++_S(238, "migrate_pages") ++_S(239, "move_pages") ++_S(240, "rt_tgsigqueueinfo") ++_S(241, "perf_event_open") ++_S(242, "accept4") ++_S(258, "riscv_hwprobe") ++_S(259, "riscv_flush_icache") ++_S(261, "prlimit64") ++_S(262, "fanotify_init") ++_S(263, "fanotify_mark") ++_S(264, "name_to_handle_at") ++_S(265, "open_by_handle_at") ++_S(267, "syncfs") ++_S(268, "setns") ++_S(269, "sendmmsg") ++_S(270, "process_vm_readv") ++_S(271, "process_vm_writev") ++_S(272, "kcmp") ++_S(273, "finit_module") ++_S(274, "sched_setattr") ++_S(275, "sched_getattr") ++_S(276, "renameat2") ++_S(277, "seccomp") ++_S(278, "getrandom") ++_S(279, "memfd_create") ++_S(280, "bpf") ++_S(281, "execveat") ++_S(282, "userfaultfd") ++_S(283, "membarrier") ++_S(284, "mlock2") ++_S(285, "copy_file_range") ++_S(286, "preadv2") ++_S(287, "pwritev2") ++_S(288, "pkey_mprotect") ++_S(289, "pkey_alloc") ++_S(290, "pkey_free") ++_S(291, "statx") ++_S(293, "rseq") ++_S(294, "kexec_file_load") ++_S(403, "clock_gettime64") ++_S(404, "clock_settime64") ++_S(405, "clock_adjtime64") ++_S(406, "clock_getres_time64") ++_S(407, "clock_nanosleep_time64") ++_S(408, "timer_gettime64") ++_S(409, "timer_settime64") ++_S(410, "timerfd_gettime64") ++_S(411, "timerfd_settime64") ++_S(412, "utimensat_time64") ++_S(413, "pselect6_time64") ++_S(414, "ppoll_time64") ++_S(416, "io_pgetevents_time64") ++_S(417, "recvmmsg_time64") ++_S(418, "mq_timedsend_time64") ++_S(419, "mq_timedreceive_time64") ++_S(420, "semtimedop_time64") ++_S(421, "rt_sigtimedwait_time64") ++_S(422, "futex_time64") ++_S(423, "sched_rr_get_interval_time64") ++_S(424, "pidfd_send_signal") ++_S(425, "io_uring_setup") ++_S(426, "io_uring_enter") ++_S(427, "io_uring_register") ++_S(428, "open_tree") ++_S(429, "move_mount") ++_S(430, "fsopen") ++_S(431, "fsconfig") ++_S(432, "fsmount") ++_S(433, "fspick") ++_S(434, "pidfd_open") ++_S(435, "clone3") ++_S(436, "close_range") ++_S(437, "openat2") ++_S(438, "pidfd_getfd") ++_S(439, "faccessat2") ++_S(440, "process_madvise") ++_S(441, "epoll_pwait2") ++_S(442, "mount_setattr") ++_S(443, "quotactl_fd") ++_S(444, "landlock_create_ruleset") ++_S(445, "landlock_add_rule") ++_S(446, "landlock_restrict_self") ++_S(447, "memfd_secret") ++_S(448, "process_mrelease") ++_S(449, "futex_waitv") ++_S(450, "set_mempolicy_home_node") ++_S(451, "cachestat") ++_S(452, "fchmodat2") ++_S(453, "map_shadow_stack") ++_S(454, "futex_wake") ++_S(455, "futex_wait") ++_S(456, "futex_requeue") ++_S(457, "statmount") ++_S(458, "listmount") ++_S(459, "lsm_get_self_attr") ++_S(460, "lsm_set_self_attr") ++_S(461, "lsm_list_modules") ++_S(462, "mseal") ++_S(463, "setxattrat") ++_S(464, "getxattrat") ++_S(465, "listxattrat") ++_S(466, "removexattrat") +diff --git a/lib/riscv64_table.h b/lib/riscv64_table.h +new file mode 100644 +index 000000000..525a59248 +--- /dev/null ++++ b/lib/riscv64_table.h +@@ -0,0 +1,345 @@ ++/* riscv64_table.h -- ++ * Copyright 2024 Rivos Inc. ++ * All Rights Reserved. ++ * ++ * This library is free software; you can redistribute it and/or ++ * modify it under the terms of the GNU Lesser General Public ++ * License as published by the Free Software Foundation; either ++ * version 2.1 of the License, or (at your option) any later version. ++ * ++ * This library is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ * Lesser General Public License for more details. ++ * ++ * You should have received a copy of the GNU Lesser General Public ++ * License along with this library; if not, write to the Free Software ++ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA ++ * ++ * Authors: ++ * David Abdurachmanov <[email protected]> ++ */ ++ ++_S(0, "io_setup") ++_S(1, "io_destroy") ++_S(2, "io_submit") ++_S(3, "io_cancel") ++_S(4, "io_getevents") ++_S(5, "setxattr") ++_S(6, "lsetxattr") ++_S(7, "fsetxattr") ++_S(8, "getxattr") ++_S(9, "lgetxattr") ++_S(10, "fgetxattr") ++_S(11, "listxattr") ++_S(12, "llistxattr") ++_S(13, "flistxattr") ++_S(14, "removexattr") ++_S(15, "lremovexattr") ++_S(16, "fremovexattr") ++_S(17, "getcwd") ++_S(18, "lookup_dcookie") ++_S(19, "eventfd2") ++_S(20, "epoll_create1") ++_S(21, "epoll_ctl") ++_S(22, "epoll_pwait") ++_S(23, "dup") ++_S(24, "dup3") ++_S(25, "fcntl") ++_S(26, "inotify_init1") ++_S(27, "inotify_add_watch") ++_S(28, "inotify_rm_watch") ++_S(29, "ioctl") ++_S(30, "ioprio_set") ++_S(31, "ioprio_get") ++_S(32, "flock") ++_S(33, "mknodat") ++_S(34, "mkdirat") ++_S(35, "unlinkat") ++_S(36, "symlinkat") ++_S(37, "linkat") ++_S(39, "umount2") ++_S(40, "mount") ++_S(41, "pivot_root") ++_S(42, "nfsservctl") ++_S(43, "statfs") ++_S(44, "fstatfs") ++_S(45, "truncate") ++_S(46, "ftruncate") ++_S(47, "fallocate") ++_S(48, "faccessat") ++_S(49, "chdir") ++_S(50, "fchdir") ++_S(51, "chroot") ++_S(52, "fchmod") ++_S(53, "fchmodat") ++_S(54, "fchownat") ++_S(55, "fchown") ++_S(56, "openat") ++_S(57, "close") ++_S(58, "vhangup") ++_S(59, "pipe2") ++_S(60, "quotactl") ++_S(61, "getdents64") ++_S(62, "lseek") ++_S(63, "read") ++_S(64, "write") ++_S(65, "readv") ++_S(66, "writev") ++_S(67, "pread64") ++_S(68, "pwrite64") ++_S(69, "preadv") ++_S(70, "pwritev") ++_S(71, "sendfile") ++_S(72, "pselect6") ++_S(73, "ppoll") ++_S(74, "signalfd4") ++_S(75, "vmsplice") ++_S(76, "splice") ++_S(77, "tee") ++_S(78, "readlinkat") ++_S(79, "newfstatat") ++_S(80, "fstat") ++_S(81, "sync") ++_S(82, "fsync") ++_S(83, "fdatasync") ++_S(84, "sync_file_range") ++_S(85, "timerfd_create") ++_S(86, "timerfd_settime") ++_S(87, "timerfd_gettime") ++_S(88, "utimensat") ++_S(89, "acct") ++_S(90, "capget") ++_S(91, "capset") ++_S(92, "personality") ++_S(93, "exit") ++_S(94, "exit_group") ++_S(95, "waitid") ++_S(96, "set_tid_address") ++_S(97, "unshare") ++_S(98, "futex") ++_S(99, "set_robust_list") ++_S(100, "get_robust_list") ++_S(101, "nanosleep") ++_S(102, "getitimer") ++_S(103, "setitimer") ++_S(104, "kexec_load") ++_S(105, "init_module") ++_S(106, "delete_module") ++_S(107, "timer_create") ++_S(108, "timer_gettime") ++_S(109, "timer_getoverrun") ++_S(110, "timer_settime") ++_S(111, "timer_delete") ++_S(112, "clock_settime") ++_S(113, "clock_gettime") ++_S(114, "clock_getres") ++_S(115, "clock_nanosleep") ++_S(116, "syslog") ++_S(117, "ptrace") ++_S(118, "sched_setparam") ++_S(119, "sched_setscheduler") ++_S(120, "sched_getscheduler") ++_S(121, "sched_getparam") ++_S(122, "sched_setaffinity") ++_S(123, "sched_getaffinity") ++_S(124, "sched_yield") ++_S(125, "sched_get_priority_max") ++_S(126, "sched_get_priority_min") ++_S(127, "sched_rr_get_interval") ++_S(128, "restart_syscall") ++_S(129, "kill") ++_S(130, "tkill") ++_S(131, "tgkill") ++_S(132, "sigaltstack") ++_S(133, "rt_sigsuspend") ++_S(134, "rt_sigaction") ++_S(135, "rt_sigprocmask") ++_S(136, "rt_sigpending") ++_S(137, "rt_sigtimedwait") ++_S(138, "rt_sigqueueinfo") ++_S(139, "rt_sigreturn") ++_S(140, "setpriority") ++_S(141, "getpriority") ++_S(142, "reboot") ++_S(143, "setregid") ++_S(144, "setgid") ++_S(145, "setreuid") ++_S(146, "setuid") ++_S(147, "setresuid") ++_S(148, "getresuid") ++_S(149, "setresgid") ++_S(150, "getresgid") ++_S(151, "setfsuid") ++_S(152, "setfsgid") ++_S(153, "times") ++_S(154, "setpgid") ++_S(155, "getpgid") ++_S(156, "getsid") ++_S(157, "setsid") ++_S(158, "getgroups") ++_S(159, "setgroups") ++_S(160, "uname") ++_S(161, "sethostname") ++_S(162, "setdomainname") ++_S(163, "getrlimit") ++_S(164, "setrlimit") ++_S(165, "getrusage") ++_S(166, "umask") ++_S(167, "prctl") ++_S(168, "getcpu") ++_S(169, "gettimeofday") ++_S(170, "settimeofday") ++_S(171, "adjtimex") ++_S(172, "getpid") ++_S(173, "getppid") ++_S(174, "getuid") ++_S(175, "geteuid") ++_S(176, "getgid") ++_S(177, "getegid") ++_S(178, "gettid") ++_S(179, "sysinfo") ++_S(180, "mq_open") ++_S(181, "mq_unlink") ++_S(182, "mq_timedsend") ++_S(183, "mq_timedreceive") ++_S(184, "mq_notify") ++_S(185, "mq_getsetattr") ++_S(186, "msgget") ++_S(187, "msgctl") ++_S(188, "msgrcv") ++_S(189, "msgsnd") ++_S(190, "semget") ++_S(191, "semctl") ++_S(192, "semtimedop") ++_S(193, "semop") ++_S(194, "shmget") ++_S(195, "shmctl") ++_S(196, "shmat") ++_S(197, "shmdt") ++_S(198, "socket") ++_S(199, "socketpair") ++_S(200, "bind") ++_S(201, "listen") ++_S(202, "accept") ++_S(203, "connect") ++_S(204, "getsockname") ++_S(205, "getpeername") ++_S(206, "sendto") ++_S(207, "recvfrom") ++_S(208, "setsockopt") ++_S(209, "getsockopt") ++_S(210, "shutdown") ++_S(211, "sendmsg") ++_S(212, "recvmsg") ++_S(213, "readahead") ++_S(214, "brk") ++_S(215, "munmap") ++_S(216, "mremap") ++_S(217, "add_key") ++_S(218, "request_key") ++_S(219, "keyctl") ++_S(220, "clone") ++_S(221, "execve") ++_S(222, "mmap") ++_S(223, "fadvise64") ++_S(224, "swapon") ++_S(225, "swapoff") ++_S(226, "mprotect") ++_S(227, "msync") ++_S(228, "mlock") ++_S(229, "munlock") ++_S(230, "mlockall") ++_S(231, "munlockall") ++_S(232, "mincore") ++_S(233, "madvise") ++_S(234, "remap_file_pages") ++_S(235, "mbind") ++_S(236, "get_mempolicy") ++_S(237, "set_mempolicy") ++_S(238, "migrate_pages") ++_S(239, "move_pages") ++_S(240, "rt_tgsigqueueinfo") ++_S(241, "perf_event_open") ++_S(242, "accept4") ++_S(243, "recvmmsg") ++_S(258, "riscv_hwprobe") ++_S(259, "riscv_flush_icache") ++_S(260, "wait4") ++_S(261, "prlimit64") ++_S(262, "fanotify_init") ++_S(263, "fanotify_mark") ++_S(264, "name_to_handle_at") ++_S(265, "open_by_handle_at") ++_S(266, "clock_adjtime") ++_S(267, "syncfs") ++_S(268, "setns") ++_S(269, "sendmmsg") ++_S(270, "process_vm_readv") ++_S(271, "process_vm_writev") ++_S(272, "kcmp") ++_S(273, "finit_module") ++_S(274, "sched_setattr") ++_S(275, "sched_getattr") ++_S(276, "renameat2") ++_S(277, "seccomp") ++_S(278, "getrandom") ++_S(279, "memfd_create") ++_S(280, "bpf") ++_S(281, "execveat") ++_S(282, "userfaultfd") ++_S(283, "membarrier") ++_S(284, "mlock2") ++_S(285, "copy_file_range") ++_S(286, "preadv2") ++_S(287, "pwritev2") ++_S(288, "pkey_mprotect") ++_S(289, "pkey_alloc") ++_S(290, "pkey_free") ++_S(291, "statx") ++_S(292, "io_pgetevents") ++_S(293, "rseq") ++_S(294, "kexec_file_load") ++_S(424, "pidfd_send_signal") ++_S(425, "io_uring_setup") ++_S(426, "io_uring_enter") ++_S(427, "io_uring_register") ++_S(428, "open_tree") ++_S(429, "move_mount") ++_S(430, "fsopen") ++_S(431, "fsconfig") ++_S(432, "fsmount") ++_S(433, "fspick") ++_S(434, "pidfd_open") ++_S(435, "clone3") ++_S(436, "close_range") ++_S(437, "openat2") ++_S(438, "pidfd_getfd") ++_S(439, "faccessat2") ++_S(440, "process_madvise") ++_S(441, "epoll_pwait2") ++_S(442, "mount_setattr") ++_S(443, "quotactl_fd") ++_S(444, "landlock_create_ruleset") ++_S(445, "landlock_add_rule") ++_S(446, "landlock_restrict_self") ++_S(447, "memfd_secret") ++_S(448, "process_mrelease") ++_S(449, "futex_waitv") ++_S(450, "set_mempolicy_home_node") ++_S(451, "cachestat") ++_S(452, "fchmodat2") ++_S(453, "map_shadow_stack") ++_S(454, "futex_wake") ++_S(455, "futex_wait") ++_S(456, "futex_requeue") ++_S(457, "statmount") ++_S(458, "listmount") ++_S(459, "lsm_get_self_attr") ++_S(460, "lsm_set_self_attr") ++_S(461, "lsm_list_modules") ++_S(462, "mseal") ++_S(463, "setxattrat") ++_S(464, "getxattrat") ++_S(465, "listxattrat") ++_S(466, "removexattrat") +diff --git a/lib/syscall-update.txt b/lib/syscall-update.txt +index 928df43dc..ae660ec87 100644 +--- a/lib/syscall-update.txt ++++ b/lib/syscall-update.txt +@@ -7,6 +7,7 @@ arch/powerpc/kernel/syscalls/syscall.tbl + arch/s390/kernel/syscalls/syscall.tbl + arch/x86/entry/syscalls/syscall_32.tbl + arch/x86/entry/syscalls/syscall_64.tbl ++include/uapi/asm-generic/unistd.h (riscv32, riscv64) + + For src/ausearch-lookup.c: + Inspect include/linux/net.h for socketcall updates +@@ -16,4 +17,42 @@ For adding new arches, the following might be useful to get a first pass file: + + cat unistd.h | grep '^#define __NR_' | tr -d ')' | tr 'NR+' ' ' | awk '{ printf "_S(%s, \"%s\")\n", $6, $3 }; ' + ++On newer kernels (4.19+): ++ ++cat unistd.h | grep '^#define __NR_' | sed 's/__NR_//g' | awk '{ printf "_S(%s, \"%s\")\n", $3, $2 }; ' ++ + it will still need hand editing ++ ++Alternative would be to use https://pypi.org/project/system-calls/ Python pacakge. ++The latest version is available here: https://github.com/hrw/syscalls-table ++ ++Another place to find syscalls (not incl. riscv yet) is in GDB: ++https://github.com/bminor/binutils-gdb/tree/master/gdb/syscalls ++ ++For example (system-calls 5.19.0): ++ ++#!/usr/bin/python3 ++ ++import system_calls ++import sys ++ ++syscalls = system_calls.syscalls() ++ ++table = {} ++ ++for syscall_name in syscalls.names(): ++ num = None ++ try: ++ num = syscalls.get(syscall_name, "riscv64") ++ except system_calls.NotSupportedSystemCall: ++ pass ++ ++ if num is not None: ++ if num in table: ++ print("This is bad!") ++ sys.exit(1) ++ ++ table[num] = syscall_name ++ ++for key, value in sorted(table.items(), key=lambda item: int(item[0])): ++ print("_S({}, \"{}\")".format(key, value)) +diff --git a/lib/test/lookup_test.c b/lib/test/lookup_test.c +index de6e65382..1f49a0e99 100644 +--- a/lib/test/lookup_test.c ++++ b/lib/test/lookup_test.c +@@ -154,6 +154,42 @@ test_aarch64_table(void) + } + #endif + ++#ifdef WITH_RISCV ++static void ++test_riscv64_table(void) ++{ ++ static const struct entry t[] = { ++#include "../riscv64_table.h" ++ }; ++ ++ printf("Testing riscv64_table...\n"); ++#define I2S(I) audit_syscall_to_name((I), MACH_RISCV64) ++#define S2I(S) audit_name_to_syscall((S), MACH_RISCV64) ++ TEST_I2S(0); ++ TEST_S2I(-1); ++#undef I2S ++#undef S2I ++} ++ ++static void ++test_riscv32_table(void) ++{ ++ static const struct entry t[] = { ++#include "../riscv32_table.h" ++ }; ++ ++ printf("Testing riscv32_table...\n"); ++#define I2S(I) audit_syscall_to_name((I), MACH_RISCV32) ++#define S2I(S) audit_name_to_syscall((S), MACH_RISCV32) ++ TEST_I2S(0); ++ TEST_S2I(-1); ++#undef I2S ++#undef S2I ++} ++ ++#endif ++ ++ + static void + test_i386_table(void) + { +@@ -407,6 +443,10 @@ main(void) + #endif + #ifdef WITH_AARCH64 + test_aarch64_table(); ++#endif ++#ifdef WITH_RISCV ++ test_riscv64_table(); ++ test_riscv32_table(); + #endif + test_i386_table(); + test_ppc_table(); +diff --git a/tools/ausyscall/ausyscall.c b/tools/ausyscall/ausyscall.c +index 489b10957..eaf0f3531 100644 +--- a/tools/ausyscall/ausyscall.c ++++ b/tools/ausyscall/ausyscall.c +@@ -22,6 +22,7 @@ + * Steve Grubb <[email protected]> + */ + ++#include "config.h" + #include <stdio.h> + #include <string.h> + #include <stdlib.h> +@@ -84,6 +85,16 @@ int main(int argc, char *argv[]) + fputs("Aarch64 processor support is not enabled\n", + stderr); + exit(1); ++#endif ++#ifndef WITH_RISCV ++ } else if (strcmp("riscv32", argv[i]) == 0) { ++ fputs("RISC-V 32-bit (riscv32) processor support is not enabled\n", ++ stderr); ++ exit(1); ++ } else if (strcmp("riscv64", argv[i]) == 0) { ++ fputs("RISC-V 64-bit (riscv64) processor support is not enabled\n", ++ stderr); ++ exit(1); + #endif + } else { + if (name != NULL) { diff -Nru audit-4.0.2/debian/patches/series audit-4.0.2/debian/patches/series --- audit-4.0.2/debian/patches/series 2024-11-14 22:10:09.000000000 +0100 +++ audit-4.0.2/debian/patches/series 2026-08-29 10:54:36.000000000 +0200 @@ -1,2 +1,3 @@ 01-no-refusemanualstop.patch 03-Set-log_group-adm.patch +04-riscv64.patch diff -Nru audit-4.0.2/debian/rules audit-4.0.2/debian/rules --- audit-4.0.2/debian/rules 2024-11-14 22:10:09.000000000 +0100 +++ audit-4.0.2/debian/rules 2026-08-29 10:54:36.000000000 +0200 @@ -55,7 +55,7 @@ --with-libcap-ng \ --with-io_uring \ $(CONFIGURE_FLAGS) \ - --with-arm --with-aarch64 ${EXTRA_ARCH_TABLE} + --with-arm --with-aarch64 --with-riscv ${EXTRA_ARCH_TABLE} touch $@ debian/config-python3-%-stamp: debian/config-python-stamp cp -lpr debian/build/bindings/swig debian/build/bindings/swig3.$*