tree 87cf236a78ad242ae01f1b71c289131e6d1c0662
parent ea3834d9fb348fb1144ad3affea22df933eaf62e
author  <dwmw2@shinybook.infradead.org> 1114787308 +0100
committer  <dwmw2@shinybook.infradead.org> 1114787308 +0100

[AUDIT] Don't allow ptrace to fool auditing, log arch of audited syscalls.

We were calling ptrace_notify() after auditing the syscall and arguments,
but the debugger could have _changed_ them before the syscall was actually
invoked. Reorder the calls to fix that.

While we're touching ever call to audit_syscall_entry(), we also make it
take an extra argument: the architecture of the syscall which was made,
because some architectures allow more than one type of syscall.

Also add an explicit success/failure flag to audit_syscall_exit(), for
the benefit of architectures which return that in a condition register
rather than only returning a single register.

Change type of syscall return value to 'long' not 'int'.

Signed-off-by: David Woodhouse <dwmw2@infradead.org>