lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Wed, 11 Nov 2015 17:08:27 -0800
From:	Andy Lutomirski <luto@...capital.net>
To:	Steven Rostedt <rostedt@...dmis.org>
Cc:	Andy Lutomirski <luto@...nel.org>,
	Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
	Thomas Gleixner <tglx@...utronix.de>,
	"Anvin, H. Peter" <hpa@...or.com>,
	lttng-dev <lttng-dev@...ts.lttng.org>,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: Compat syscall instrumentation and return from execve issue

On Mon, Nov 9, 2015 at 6:31 PM, Steven Rostedt <rostedt@...dmis.org> wrote:
> On Mon, 9 Nov 2015 17:51:25 -0800
> Andy Lutomirski <luto@...capital.net> wrote:
>
>
>> do_syscall_32_irqs_on would call syscall_return_slowpath(regs,
>> AUDIT_ARCH_I386).  do_syscall_64 (which doesn't exist yet) would call
>> syscall_return_slowpath(regs, AUDIT_ARCH_X86_64).
>>
>
> OK, so you are saying that a execve that switches the current state
> into ia32 will return from the do_syscall_64 regardless? Then we would
> have to add tracepoints that would be for both ia32 and x86_64. But
> that would solve the current issue at hand.
>

Indeed.  Unlike fork/clone, execve is only magical insofar as it does
magical things to task_struct and it enters in the 64-bit native case
through a nasty asm path.  The former has no effect on the entry code
(except most likely blocking opportunistic sysret because we're a bit
silly and it might break ABI to change that), and the latter barely
matters for this purpose.  In any event, I'm planning on getting rid
of the asm stub for 4.5 if I can get the code written and tested in
time.

--Andy




-- 
Andy Lutomirski
AMA Capital Management, LLC
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Powered by blists - more mailing lists