linux-kernel - Re: [PATCH] x86_64,entry: Fix RCX for traced syscalls

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 30 Jun 2014 08:12:47 -0700
From:	Andy Lutomirski <luto@...capital.net>
To:	Pavel Machek <pavel@....cz>
Cc:	"H. Peter Anvin" <hpa@...or.com>, Andi Kleen <andi@...stfloor.org>,
	X86 ML <x86@...nel.org>,
	Linux Kernel <linux-kernel@...r.kernel.org>,
	Borislav Petkov <bp@...en8.de>
Subject: Re: [PATCH] x86_64,entry: Fix RCX for traced syscalls

On Sat, Jun 28, 2014 at 10:07 AM, Pavel Machek <pavel@....cz> wrote:
> On Thu 2014-06-26 13:47:32, Andy Lutomirski wrote:
>> On Thu, Jun 26, 2014 at 1:12 PM, H. Peter Anvin <hpa@...or.com> wrote:
>> > The real question is if we care that sysret and iter don't match.  On 32 bits the situation is even more complex.
>>
>> At least for 64 bits, iret vs sysret is purely a kernel implementation
>> detail (except where a tracer modifies things that are inaccessible to
>> sysret), so ISTM it's worth one instruction to make them match.
>>
>> I noticed this thing while fiddling with moving some of the syscall
>> tracing logic to C.  This isn't a real problem, but it at least made
>> me scratch my head.
>
> If possible, we'd like to trace programs without programs being noticed they are
> being traced. See subterfugue utility, for example.
>
> It is certainly worth one extra instruction.

I tend to agree.

FWIW, I haven't looked at the ia32 stuff, but it should be possible to
do something similar if it's not there already.  The iret path can set
any user state it wants.

--Andy
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/