linux-kernel - MIPS seccomp and changing syscalls

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 17 Jul 2014 15:29:57 -0700
From:	Kees Cook <keescook@...omium.org>
To:	Markos Chandras <markos.chandras@...tec.com>
Cc:	James Hogan <james.hogan@...tec.com>,
	Paul Burton <paul.burton@...tec.com>,
	Linux MIPS Mailing List <linux-mips@...ux-mips.org>,
	Ralf Baechle <ralf@...ux-mips.org>,
	LKML <linux-kernel@...r.kernel.org>
Subject: MIPS seccomp and changing syscalls

Hi,

I recently fixed a bug in seccomp on ARM that I think may be present
in the MIPS implementation too. In arch/mips/kernel/ptrace.c
syscall_trace_enter, the syscall variable is used (and returned), but
the syscall may be changed by either secure_computing or
tracehook_report_syscall_entry (via ptracers which can block and
change the registers). (I would note that "ret" is also set but never
used, so tracehook_report_syscall_entry failures actually won't get
noticed.)

The discussion about this bug on ARM is here:
https://lkml.org/lkml/2014/6/20/439

I don't yet have a working MIPS environment to test this on, but it
feels like the same bug. (Though, for testing, what's the right way to
change syscall during PTRACE_SYSCALL? On x86 it's the orig_ax
register, on ARM it's a arch-specific ptrace function
(PTRACE_SET_SYSCALL).

Thanks!

-Kees

-- 
Kees Cook
Chrome OS Security
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/