linux-kernel - Re: [RFC] [Patch 1/1] [Self Ptrace] System call notification with self

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 27 Aug 2008 20:24:55 +0400
From:	Oleg Nesterov <oleg@...sign.ru>
To:	Pierre Morel <pmorel@...ux.vnet.ibm.com>
Cc:	Andrew Morton <akpm@...ux-foundation.org>,
	linux-kernel@...r.kernel.org, Roland McGrath <roland@...hat.com>,
	Heiko Carstens <heicars2@...ux.vnet.ibm.com>,
	sameske@...ux.vnet.ibm.com,
	Martin Schwidefsky <schwidefsky@...ibm.com>
Subject: Re: [RFC] [Patch 1/1] [Self Ptrace] System call notification with self_ptrace

On 08/27, Pierre Morel wrote:
>
> Oleg Nesterov wrote:
>
> >On s390 the patch changes handle_signal(), this is not clear to me too.
> >
> The patch clears the trace flags before delivering the signal so
> that the signal handler can use system call without bouncing again.

Yes I see. But the signal handler for SIGSYS can fisrt do
sys_ptrace(PTRACE_SELF_OFF) (which is filtered out), and then use any
other syscall.

With this patch PT_SELF is cleared on any signal. This doesn't look
right. Let's suppose that another signal comes in parallel with SIGSYS.
It is very possible that the handler for that another signal will be
called first, this handler can do some syscall which will be "missed".

> >Isn't it possible to implement this behaviour in the user space? If the
> >task needs the PT_SELF behaviour, it can fork another process which will
> >do PTRACE_ATTACH and then send the notifications to the task. We can use
> >signals or something else.
> >
> In this case we would go back to standard ptrace behaviour.
> The goal of the patch is to avoid the overhead of task switching
> and IPC when instrumenting the process.

Ah, I forgot to read the changelog, sorry.

Oleg.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/