linux-kernel - Re: Fwd: arch/ && tracehook_report_syscall

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090429193036.GB14652@elte.hu>
Date:	Wed, 29 Apr 2009 21:30:36 +0200
From:	Ingo Molnar <mingo@...e.hu>
To:	Oleg Nesterov <oleg@...hat.com>
Cc:	Christoph Hellwig <hch@....de>, chris@...kel.net,
	cooloney@...nel.org, deller@....de, geert@...ux-m68k.org,
	gerg@...inux.org, hskinnemoen@...el.com, jdike@...toit.com,
	jesper.nilsson@...s.com, kyle@...artin.ca, linux@....linux.org.uk,
	ralf@...ux-mips.org, rth@...ddle.net, starvik@...s.com,
	takata@...ux-m32r.org, ysato@...rs.sourceforge.jp,
	zippel@...ux-m68k.org, Roland McGrath <roland@...hat.com>,
	linux-kernel@...r.kernel.org, linux-arch@...r.kernel.org
Subject: Re: Fwd: arch/ && tracehook_report_syscall_xxx()


* Oleg Nesterov <oleg@...hat.com> wrote:

> On 04/27, Christoph Hellwig wrote:
> >
> > I've poked a few arch maintainers in the past to separate the enter/exit
> > path and usually got the desired changes :)
> 
> I'd like to try your method!
> 
> So. Dear maintainers of
> 
> 	alpha
> 	arm
> 	avr32
> 	blackfin
> 	cris
> 	h8300
> 	m32r
> 	m68k
> 	m68knommu
> 	mips
> 	parisc
> 	um
> 	xtensa
> 
> . Could you please convert your syscall trace code to use
> tracehook_report_syscall_entry/tracehook_report_syscall_exit ?
> 
> 
> For example, let's look at more or less typical arch/alpha/kernel/ptrace.c,
> 
> 	asmlinkage void
> 	syscall_trace(void)
> 	{
> 		if (!test_thread_flag(TIF_SYSCALL_TRACE))
> 			return;
> 		if (!(current->ptrace & PT_PTRACED))
> 			return;
> 		/* The 0x80 provides a way for the tracing parent to distinguish
> 		   between a syscall stop and SIGTRAP delivery */
> 		ptrace_notify(SIGTRAP | ((current->ptrace & PT_TRACESYSGOOD)
> 					 ? 0x80 : 0));
> 
> 		/*
> 		 * This isn't the same as continuing with a signal, but it will do
> 		 * for normal use.  strace only continues with a signal if the
> 		 * stopping signal is not SIGTRAP.  -brl
> 		 */
> 		if (current->exit_code) {
> 			send_sig(current->exit_code, current, 1);
> 			current->exit_code = 0;
> 		}
> 	}
> 
> it would be really nice to turn it into something like
> 
> 	asmlinkage void
> 	syscall_trace(int entryexit)
> 	{
> 		if (!test_thread_flag(TIF_SYSCALL_TRACE))
> 			return;
> 
> 		if (entryexit)
> 			tracehook_report_syscall_entry(task_pt_regs(current));
> 		else
> 			tracehook_report_syscall_exit(task_pt_regs(current), stepping);
> 	}
> 
> Also, tracehook_report_syscall_entry() might want to abort this system
> call (please see the comment above this helper), it would be great to
> take the returned value into account.
> 
> arch/* play with ptrace internals which should be changed soon, not good.

And there's upstream examples in:

 arch/ia64/kernel/ptrace.c
 arch/powerpc/kernel/ptrace.c
 arch/s390/kernel/ptrace.c
 arch/sh/kernel/ptrace_32.c
 arch/sh/kernel/ptrace_64.c
 arch/sparc/kernel/ptrace_32.c
 arch/sparc/kernel/ptrace_64.c
 arch/x86/kernel/ptrace.c

as well, for tracehook usage. Chances are that your architecture's 
syscall entry/exit ptrace hooks look quite similar to one of the 
architectures above!

	Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/