linux-kernel - Re: ARM seccomp filters and EABI/OABI

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAGXu5jKaj=AVxFGdUYquyRw6stSYU6-Fun7T70Mgsc97z3Dsmw@mail.gmail.com>
Date:	Fri, 1 Nov 2013 07:45:54 +0000
From:	Kees Cook <keescook@...omium.org>
To:	Andy Lutomirski <luto@...capital.net>
Cc:	Paul Moore <paul@...l-moore.com>,
	Richard Weinberger <richard@....at>,
	libseccomp-discuss@...ts.sourceforge.net,
	Will Drewry <wad@...omium.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: ARM seccomp filters and EABI/OABI

On Thu, Oct 31, 2013 at 11:50 PM, Andy Lutomirski <luto@...capital.net> wrote:
> On Tue, Oct 29, 2013 at 12:38 PM, Paul Moore <paul@...l-moore.com> wrote:
>> On Monday, October 28, 2013 11:16:20 PM Richard Weinberger wrote:
>>> Am 28.10.2013 22:53, schrieb Paul Moore:
>>> > On Thursday, October 24, 2013 09:55:57 PM Richard Weinberger wrote:
>>> >> On Wed, Oct 23, 2013 at 11:02 PM, Andy Lutomirski <luto@...capital.net>
>>> >
>>> > wrote:
>>> >>> I'm looking at the seccomp code, the ARM entry code, and the
>>> >>> syscall(2) manpage, and I'm a bit lost.  (The fact that I don't really
>>> >>> speak ARM assembly doesn't help.)  My basic question is: what happens
>>> >>> if an OABI syscall happens?
>>> >>>
>>> >>> AFAICS, the syscall arguments for EABI are r0..r5, although their
>>> >>> ordering is a bit odd*.  For OABI, r6 seems to play some role, but I'm
>>> >>> lost as to what it is.  The seccomp_bpf_load function won't load r6,
>>> >>> so there had better not be anything useful in there...  (Also, struct
>>> >>> seccomp_data will have issues with a seventh "argument".)
>>> >>>
>>> >>> But what happens to the syscall number?  For an EABI syscall, it's in
>>> >>> r7.  For an OABI syscall, it's in the swi instruction and gets copied
>>> >>> to r7 on entry.  If a debugger changes r7, presumably the syscall
>>> >>> number changes.
>>> >>>
>>> >>> Oddly, there are two different syscall tables.  The major differences
>>> >>> seem to be that some of the OABI entries have their argument order
>>> >>> changed.  But there's also a magic constant 0x900000 added to the
>>> >>> syscall number somewhere -- is it reflected in _sigsys._syscall?  Is
>>> >>> it reflected in ucontext's r7?
>>> >>>
>>> >>> I'm a bit surprised to see that both the EABI and OABI ABIs show up as
>>> >>> AUDIT_ARCH_ARM.
>>> >>>
>>> >>> Can any of you shed some light on this?  I don't have an ARM system I
>>> >>> can test on, but if one of you can point me at a decent QEMU image, I
>>> >>> can play around.
>>> >>
>>> >> Maybe this helps:
>>> >> http://people.debian.org/~aurel32/qemu/armel/
>>> >
>>> > Thanks for the pointer, although those images look quite old, has anyone
>>> > done a refresh?
>>>
>>> You are free to run "apt-get upgrade" within the said images. :-)
>>
>> Okay, true ;)
>
> Except it didn't work...  I fixed it with 'apt-key adv --recv-keys
> --keyserver keyserver.ubuntu.com <key id from update's error
> message>'.
>
> I have yet to build a working kernel for this thing, though.
> Apparently kernels since 3.8 have something wrong in the "versatile"
> board file.  Do any of you have a working .config and qemu -M option?

For qemu before 1.5, I needed to revert
f9b71fef12f0d6ac5c7051cfd87f7700f78c56b6 to get SCSI working again.
I've attached my .config. I launch with:

sudo qemu-system-arm -nographic -m 256 -M versatilepb \
    -kernel $HOME/Code/linux/arch/arm/boot/zImage \
    -drive file=$DIR/vda.qcow2,if=scsi,format=qcow2 \
    -net nic,vlan=0 -net
tap,vlan=0,script=$HOME/kvm/kvm-ifup,downscript=$HOME/kvm/kvm-ifdown,ifname=tap-$IMG
\
    -monitor tcp:127.0.0.1:8087,server,nowait \
    -append "loglevel=8 debug root=/dev/sda1 slub_debug=FZ console=ttyAMA0 $@"

I can send the if-up/down scripts if you want them too.

-Kees

-- 
Kees Cook
Chrome OS Security

Download attachment "config.arm" of type "application/octet-stream" (53585 bytes)