linux-kernel - Re: [RFC PATCH] ptrace: add PTRACE_GET_SYSCALL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 8 Nov 2018 15:33:43 +0100
From:   Oleg Nesterov <oleg@...hat.com>
To:     Andy Lutomirski <luto@...capital.net>
Cc:     Elvira Khabirova <lineprinter@...linux.org>, rostedt@...dmis.org,
        mingo@...hat.com, linux-kernel@...r.kernel.org, ldv@...linux.org,
        esyr@...hat.com, luto@...nel.org, strace-devel@...ts.strace.io
Subject: Re: [RFC PATCH] ptrace: add PTRACE_GET_SYSCALL_INFO request

On 11/07, Andy Lutomirski wrote:
>
> > On Nov 7, 2018, at 8:44 AM, Oleg Nesterov <oleg@...hat.com> wrote:
> >
> > Not sure I understand you... I do not like "compat" too, but this patch uses
> > is_compat/etc and I agree with any naming.
>
> My point is: returning a value to user code that is:
>
> 0 if the kernel and tracee are 32-bit
> 0 if the kernel and tracer are 64-but
> 1 if the kernel is 64-bit and the tracer is 32-bit
> ? If the tracer is arm64 ILP32
>
> Is not a good design.  And 32-bit builds of strace will not appreciate it.

Sure, I agree.

> While oddly named, audit_arch fits the bill nicely, and we already
> require it to have the right semantics for seccomp support.

Again, I agree, and I even mentioned PTRACE_EVENT_SECCOMP.


This reminds me about in_ia32_syscall/TS_COMPAT problems... The 1st one is
get_nr_restart_syscall, I'll try to re-send the fix tomorrow.

Another problem is in_compat_syscall() in get_unmapped_area() paths, it can
return the addr > TASK_SIZE for uprobed 32-bit task.

There was something else but I forgot...

Oleg.