identify missing calls from syscall() in libsr3shim

[petersilva]

The initial implementation has been fairly thoroughly investigated on redhat 8. We initially were only expecting to have the syscall() implementation active on redhat 8 and ubuntu 18, where there is a known very common case of syscall usage by a very common package (file-utils... aka mv.)

• We expanded the solution to cover all possible calls to syscall() to prevent breakage of existing calls,
• We decided to have the syscall implementation active on all OS's, not just the ones mentioned above, as it is a general vulnerability where files could be written that we would miss.
• We now appreciate that newer kernels might have syscalls() we haven't implemented.
• If we build libsr3shim on a new system, it just has a canned syscall() implementation using the calls we have found on all previous ones.

There should be some kind of audit script to warn that there is a syscall defined on the current system that isn't covered by what we do in libsr3shim.

[reidsunderland]

One of the main reasons that caused me to give up on making the generate_syscall_code.py script compatible with Ubuntu is that I couldn't find the syscall_64.tbl file.

I tried again this morning and still couldn't find it in any packages.

But it is available in the Ubuntu kernel git repos: https://wiki.ubuntu.com/Kernel/Dev/KernelGitGuide

e.g. https://[git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/jammy/plain/arch/x86/entry/syscalls/syscall_64.tbl](https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/jammy/plain/arch/x86/entry/syscalls/syscall_64.tbl)

[petersilva]

I think this is just a placeholder for when we are looking... it's not worth a real effort at the moment. maybe I should put wishlist on it?

[reidsunderland]

I made some small changes to get the generate_syscall_code script working on Ubuntu.

It would be nice if it could compare what it generates with the code in libsr3shim.c, or just automatically insert the generated code at compile time. Automatically modifying the code shouldn't be too hard, it just has to replace everything between // start of auto-generated code and // end of auto generated code.