[PATCH] audit: add missing syscalls to signal class

[PATCH] audit: add missing syscalls to signal class

[Jeffrey Bencteux]

The pidfd_send_signal(), rt_sigqueueinfo() and rt_tgsigqueueinfo()
system calls are missing from the AUDIT_CLASS_SIGNAL* class. It seems
to be used only in kernel/auditfilter.c to increment the audit_signals
counter.

This counter is used to determine if information related to a target
process of a syscall audit rule using signals, such as its pid,
should be logged (e54dc2431d740a79a6bd013babade99d71b1714f).

Information related to signals sent via these system calls are
currently not correctly logged. The current patch adds it to the
AUDIT_CLASS_SIGNAL* class.

Signed-off-by: Jeffrey Bencteux <jeff@bencteux.fr>
---
 include/asm-generic/audit_signal.h | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/include/asm-generic/audit_signal.h b/include/asm-generic/audit_signal.h
index 6feab7f18a53..65336a9aef7b 100644
--- a/include/asm-generic/audit_signal.h
+++ b/include/asm-generic/audit_signal.h
@@ -1,3 +1,12 @@
 __NR_kill,
 __NR_tgkill,
 __NR_tkill,
+#ifdef __NR_rt_sigqueueinfo
+__NR_rt_sigqueueinfo,
+#endif
+#ifdef __NR_rt_tgsigqueueinfo
+__NR_rt_tgsigqueueinfo,
+#endif
+#ifdef __NR_pidfd_send_signal
+__NR_pidfd_send_signal,
+#endif

base-commit: 6614d4c05c7a661a925b3d8dbf9c70faac3bd2da
-- 
2.56.0

Re: [PATCH] audit: add missing syscalls to signal class

[Arnd Bergmann]

On Wed, Nov 11, 2026, at 12:01, Jeffrey Bencteux wrote:
> diff --git a/include/asm-generic/audit_signal.h 
> b/include/asm-generic/audit_signal.h
> index 6feab7f18a53..65336a9aef7b 100644
> --- a/include/asm-generic/audit_signal.h
> +++ b/include/asm-generic/audit_signal.h
> @@ -1,3 +1,12 @@
>  __NR_kill,
>  __NR_tgkill,
>  __NR_tkill,
> +#ifdef __NR_rt_sigqueueinfo
> +__NR_rt_sigqueueinfo,
> +#endif
> +#ifdef __NR_rt_tgsigqueueinfo
> +__NR_rt_tgsigqueueinfo,
> +#endif
> +#ifdef __NR_pidfd_send_signal
> +__NR_pidfd_send_signal,
> +#endif

Why the #ifdef checks? These should be available on all architectures.

     Arnd

Re: [PATCH] audit: add missing syscalls to signal class

[Jeffrey Bencteux]

On Wed, Nov 11, 2026 at 12:18:01PM +0100, Arnd Bergmann wrote:
> Why the #ifdef checks? These should be available on all architectures.

I included them as convention, should they be removed?

Re: [PATCH] audit: add missing syscalls to signal class

[Arnd Bergmann]

On Wed, Nov 11, 2026, at 14:52, Jeffrey Bencteux wrote:
> On Wed, Nov 11, 2026 at 12:18:01PM +0100, Arnd Bergmann wrote:
>> Why the #ifdef checks? These should be available on all architectures.
>
> I included them as convention, should they be removed?

Not sure where the convention comes from, it just seemed
odd that you have the #ifdef checks for the newly added
entries but not the ones that are already in this file.

I had not checked the other files that have similar ones.

     Arnd