linux-kernel - Re: [PATCH] x32: Mask away the x32 syscall bit in the ptrace codepath

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAA2ZrUSzXUp=uipjwCDLsXPOhPwp7m1oSfR8zdKJaQCgg2aoeQ@mail.gmail.com>
Date:	Wed, 28 May 2014 23:53:00 +0200
From:	Philipp Kern <pkern@...gle.com>
To:	Andy Lutomirski <luto@...capital.net>
Cc:	"H. Peter Anvin" <hpa@...ux.intel.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"H. J. Lu" <hjl.tools@...il.com>, Eric Paris <eparis@...hat.com>
Subject: Re: [PATCH] x32: Mask away the x32 syscall bit in the ptrace codepath

On Wed, May 28, 2014 at 11:43 PM, Andy Lutomirski <luto@...capital.net> wrote:
> However: are you sure that entry_64.S handles this?  It looks like
> tracesys has higher priority than badsys.  And strace can certainly
> see out-of-range syscalls. […]

Not only can it see them: It must see that this bit is set as that's
the only identifier it has to deduce that the binary is running in x32
mode.

Out of range syscall numbers certainly do not work for auditing right
now, hence my attempt to patch around it.

Kind regards and thanks
Philipp Kern
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/