lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 24 Jan 2017 16:53:45 -0800 From: Andrei Vagin <avagin@...tuozzo.com> To: Mike Frysinger <vapier@...too.org> CC: <linux-kernel@...r.kernel.org>, <luto@...capital.net>, <wad@...omium.org>, <keescook@...omium.org>, Mike Frysinger <vapier@...omium.org> Subject: Re: seccomp: dump core when using SECCOMP_RET_KILL Hi, One of CRIU tests fails with this patch: https://github.com/xemul/criu/blob/master/test/zdtm/static/seccomp_filter_tsync.c Before this patch only a thread which called a "wrong" syscall is killed. Now a whole process is killed if one of threads called a "wrong" syscall. Before this patch only one thread is killed: 512 seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, {len=4, filter=0x7fffe111fb10} <unfinished ...> 484 kill(30, SIG_0) = 0 484 write(1, "Wait for zdtm/static/seccomp_filter_tsync(30) to die for 0.100000\n", 66 <unfinished ...> 512 <... seccomp resumed> ) = 0 512 futex(0x606420, FUTEX_WAKE_PRIVATE, 1 <unfinished ...> 484 <... write resumed> ) = 66 512 <... futex resumed> ) = 1 484 select(0, NULL, NULL, NULL, {tv_sec=0, tv_usec=100000} <unfinished ...> 512 futex(0x7f9e894a19d0, FUTEX_WAIT, 32, NULL <unfinished ...> 513 <... futex resumed> ) = 0 513 futex(0x606420, FUTEX_WAKE_PRIVATE, 1) = 0 513 ptrace(PTRACE_TRACEME) = ? 513 +++ killed by SIGSYS +++ 512 <... futex resumed> ) = 0 After this patch a whole process is killed: 767 seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, {len=4, filter=0x7ffdeedbcd20}) = 0 767 futex(0x606420, FUTEX_WAKE_PRIVATE, 1) = 1 768 <... futex resumed> ) = 0 767 futex(0x7fab05b229d0, FUTEX_WAIT, 32, NULL <unfinished ...> 768 futex(0x606420, FUTEX_WAKE_PRIVATE, 1) = 0 768 ptrace(PTRACE_TRACEME <unfinished ...> 767 <... futex resumed>) = ? 768 <... ptrace resumed>) = ? 768 +++ killed by SIGSYS (core dumped) +++ 767 +++ killed by SIGSYS (core dumped) +++ 766 <... wait4 resumed> [{WIFSIGNALED(s) && WTERMSIG(s) == SIGSYS && WCOREDUMP(s)}], 0, NULL) = 31 766 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=31, si_ Steps to reproduce: $ git clone git://github.com/xemul/criu $ cd criu/test/zdtm/static/ $ make seccomp_filter_tsync.out $ cat seccomp_filter_tsync.out On Thu, Jan 19, 2017 at 10:28:57PM -0600, Mike Frysinger wrote: > From: Mike Frysinger <vapier@...omium.org> > > The SECCOMP_RET_KILL mode is documented as immediately killing the > process as if a SIGSYS had been sent and not caught (similar to a > SIGKILL). However, a SIGSYS is documented as triggering a coredump > which does not happen today. > > This has the advantage of being able to more easily debug a process > that fails a seccomp filter. Today, most apps need to recompile and > change their filter in order to get detailed info out, or manually run > things through strace, or enable detailed kernel auditing. Now we get > coredumps that fit into existing system-wide crash reporting setups. > > >From a security pov, this shouldn't be a problem. Unhandled signals > can already be sent externally which trigger a coredump independent of > the status of the seccomp filter. The act of dumping core itself does > not cause change in execution of the program. > > URL: https://crbug.com/676357 > Signed-off-by: Mike Frysinger <vapier@...omium.org> > Acked-by: Jorge Lucangeli Obes <jorgelo@...omium.org> > Acked-by: Kees Cook <keescook@...omium.org> > Acked-by: Kees Cook <keescook@...omium.org> > --- > kernel/seccomp.c | 29 +++++++++++++++++++++-------- > 1 file changed, 21 insertions(+), 8 deletions(-) > > diff --git a/kernel/seccomp.c b/kernel/seccomp.c > index f7ce79a46050..f8f88ebcb3ba 100644 > --- a/kernel/seccomp.c > +++ b/kernel/seccomp.c > @@ -16,6 +16,7 @@ > #include <linux/atomic.h> > #include <linux/audit.h> > #include <linux/compat.h> > +#include <linux/coredump.h> > #include <linux/sched.h> > #include <linux/seccomp.h> > #include <linux/slab.h> > @@ -486,6 +487,17 @@ void put_seccomp_filter(struct task_struct *tsk) > } > } > > +static void seccomp_init_siginfo(siginfo_t *info, int syscall, int reason) > +{ > + memset(info, 0, sizeof(*info)); > + info->si_signo = SIGSYS; > + info->si_code = SYS_SECCOMP; > + info->si_call_addr = (void __user *)KSTK_EIP(current); > + info->si_errno = reason; > + info->si_arch = syscall_get_arch(); > + info->si_syscall = syscall; > +} > + > /** > * seccomp_send_sigsys - signals the task to allow in-process syscall emulation > * @syscall: syscall number to send to userland > @@ -496,13 +508,7 @@ void put_seccomp_filter(struct task_struct *tsk) > static void seccomp_send_sigsys(int syscall, int reason) > { > struct siginfo info; > - memset(&info, 0, sizeof(info)); > - info.si_signo = SIGSYS; > - info.si_code = SYS_SECCOMP; > - info.si_call_addr = (void __user *)KSTK_EIP(current); > - info.si_errno = reason; > - info.si_arch = syscall_get_arch(); > - info.si_syscall = syscall; > + seccomp_init_siginfo(&info, syscall, reason); > force_sig_info(SIGSYS, &info, current); > } > #endif /* CONFIG_SECCOMP_FILTER */ > @@ -634,10 +640,17 @@ static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd, > return 0; > > case SECCOMP_RET_KILL: > - default: > + default: { > + siginfo_t info; > audit_seccomp(this_syscall, SIGSYS, action); > + /* Show the original registers in the dump. */ > + syscall_rollback(current, task_pt_regs(current)); > + /* Trigger a manual coredump since do_exit skips it. */ > + seccomp_init_siginfo(&info, this_syscall, data); > + do_coredump(&info); > do_exit(SIGSYS); > } > + } > > unreachable(); >
Powered by blists - more mailing lists