linux-kernel - Fwd: arch/ && tracehook_report_syscall

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 29 Apr 2009 21:08:52 +0200
From:	Oleg Nesterov <oleg@...hat.com>
To:	Christoph Hellwig <hch@....de>, chris@...kel.net,
	cooloney@...nel.org, deller@....de, geert@...ux-m68k.org,
	gerg@...inux.org, hskinnemoen@...el.com, jdike@...toit.com,
	jesper.nilsson@...s.com, kyle@...artin.ca, linux@....linux.org.uk,
	ralf@...ux-mips.org, rth@...ddle.net, starvik@...s.com,
	takata@...ux-m32r.org, ysato@...rs.sourceforge.jp,
	zippel@...ux-m68k.org
Cc:	Roland McGrath <roland@...hat.com>, linux-kernel@...r.kernel.org,
	linux-arch@...r.kernel.org
Subject: Fwd: arch/ && tracehook_report_syscall_xxx()

On 04/27, Christoph Hellwig wrote:
>
> I've poked a few arch maintainers in the past to separate the enter/exit
> path and usually got the desired changes :)

I'd like to try your method!

So. Dear maintainers of

	alpha
	arm
	avr32
	blackfin
	cris
	h8300
	m32r
	m68k
	m68knommu
	mips
	parisc
	um
	xtensa

. Could you please convert your syscall trace code to use
tracehook_report_syscall_entry/tracehook_report_syscall_exit ?


For example, let's look at more or less typical arch/alpha/kernel/ptrace.c,

	asmlinkage void
	syscall_trace(void)
	{
		if (!test_thread_flag(TIF_SYSCALL_TRACE))
			return;
		if (!(current->ptrace & PT_PTRACED))
			return;
		/* The 0x80 provides a way for the tracing parent to distinguish
		   between a syscall stop and SIGTRAP delivery */
		ptrace_notify(SIGTRAP | ((current->ptrace & PT_TRACESYSGOOD)
					 ? 0x80 : 0));

		/*
		 * This isn't the same as continuing with a signal, but it will do
		 * for normal use.  strace only continues with a signal if the
		 * stopping signal is not SIGTRAP.  -brl
		 */
		if (current->exit_code) {
			send_sig(current->exit_code, current, 1);
			current->exit_code = 0;
		}
	}

it would be really nice to turn it into something like

	asmlinkage void
	syscall_trace(int entryexit)
	{
		if (!test_thread_flag(TIF_SYSCALL_TRACE))
			return;

		if (entryexit)
			tracehook_report_syscall_entry(task_pt_regs(current));
		else
			tracehook_report_syscall_exit(task_pt_regs(current), stepping);
	}

Also, tracehook_report_syscall_entry() might want to abort this system
call (please see the comment above this helper), it would be great to
take the returned value into account.


arch/* play with ptrace internals which should be changed soon, not good.

Thanks!

Oleg.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/