linux-kernel - Re: [kernel-hardening] Re: [RFC PATCH 1/1] seccomp: provide information about the previous syscall

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHC9VhTM7rK2j3Ge1-XbQ5D74gm=P4CaB5mb06UbjCsAN4RnwA@mail.gmail.com>
Date:	Fri, 22 Jan 2016 17:10:53 -0500
From:	Paul Moore <paul@...l-moore.com>
To:	kernel-hardening@...ts.openwall.com
Cc:	Alexei Starovoitov <alexei.starovoitov@...il.com>,
	Daniel Sangorrin <daniel.sangorrin@...hiba.co.jp>,
	Andy Lutomirski <luto@...capital.net>,
	Will Drewry <wad@...omium.org>,
	LKML <linux-kernel@...r.kernel.org>,
	Linux API <linux-api@...r.kernel.org>
Subject: Re: [kernel-hardening] Re: [RFC PATCH 1/1] seccomp: provide
 information about the previous syscall

On Fri, Jan 22, 2016 at 4:23 PM, Kees Cook <keescook@...omium.org> wrote:
> Yeah, and if we break abi, we need to add further sanity checking to
> the parser to determine which "version" of seccomp_data we need. I'm
> not convinced that there is enough utility here to break ABI.

PLEASE do not break the seccomp ABI for this alone ... I'm still
trying to sort out the well intentioned, but extremely annoying
direct-wired x86 socket syscalls in 4.4 for libseccomp, I don't want
to have to deal with another big change for at least a month or two ;)

> (Though if we do, I'd like to add tid to the seccomp_data, which has
> been requested in the past to make some pid-based arg checks easier to
> do.)

Agreed, if we break anything, please add this.

-- 
paul moore
www.paul-moore.com