linux-kernel - Re: [RFC] [Patch 1/1] [Self Ptrace] System call notification with self

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1219681992.20559.196.camel@nimitz>
Date:	Mon, 25 Aug 2008 09:33:12 -0700
From:	Dave Hansen <dave@...ux.vnet.ibm.com>
To:	Pierre Morel <pmorel@...ux.vnet.ibm.com>
Cc:	Andrew Morton <akpm@...ux-foundation.org>,
	linux-kernel@...r.kernel.org, Oleg Nesterov <oleg@...sign.ru>,
	Roland McGrath <roland@...hat.com>,
	Heiko Carstens <heicars2@...ux.vnet.ibm.com>,
	sameske@...ux.vnet.ibm.com,
	Martin Schwidefsky <schwidefsky@...ibm.com>
Subject: Re: [RFC] [Patch 1/1] [Self Ptrace] System call notification with
	self_ptrace

On Mon, 2008-08-25 at 09:34 +0200, Pierre Morel wrote:
> +       if ((current->ptrace & PT_SELF)
> +               && (regs->orig_ax != __NR_rt_sigreturn)
> +               && (regs->orig_ax != __NR_ptrace)) {
> +               if (!entryexit) {
> +               struct siginfo info;
> +
> +               memset(&info, 0, sizeof(struct siginfo));
> +               info.si_signo = SIGSYS;
> +               info.si_code = SYS_SYSCALL;
> +               info.si_addr = (void *) regs->orig_ax;
> +               send_sig_info(SIGSYS, &info, current);
> +               }
> +               return 1; /* Skip system call, deliver signal. */
> +       }

The indenting here looks messed up.

Also, there looks to be a pretty substantial amount of copy-and-paste
code in those little if()s.  It's only going to get worse as we add more
architectures.  If there's ever a little buglet in that bit of code, or
we need to tweak it it some way, it'll be a bitch to fix.

For instance, if you have a little arch-independent helper like this:

static inline int is_self_ptracing(unsigned long syscall_reg)
{
	if (!(current->ptrace & PT_SELF))
		return 0;
	if (syscall_reg == __NR_rt_sigreturn)
		return 0;
	if (syscall_reg == __NR_ptrace)
		return 0;
	return 1;
}

You can call it like this:

	if (is_self_ptracing(regs->gprs[2]))
...
	if (is_self_ptracing(regs->orig_ax))
...
	if (is_self_ptracing(regs->orig_rax))

Something similar can probably be done for the siginfo construction.

You should basically try and think of ways to abstract this stuff every
single time you touch arch code.  

Why don't you also mention why you really want this feature.  That's
missing from the description. 

-- Dave

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/