linux-kernel - [RFC PATCH v3 3/3] ptrace: add PTRACE_EVENT_SECCOMP support to PTRACE_GET_SYSCALL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20181125020932.054e05a6@akathisia>
Date:   Sun, 25 Nov 2018 02:09:32 +0100
From:   Elvira Khabirova <lineprinter@...linux.org>
To:     oleg@...hat.com, rostedt@...dmis.org, mingo@...hat.com
Cc:     linux-kernel@...r.kernel.org, ldv@...linux.org, esyr@...hat.com,
        luto@...nel.org, strace-devel@...ts.strace.io
Subject: [RFC PATCH v3 3/3] ptrace: add PTRACE_EVENT_SECCOMP support to
 PTRACE_GET_SYSCALL_INFO

Extend PTRACE_GET_SYSCALL_INFO to support PTRACE_EVENT_SECCOMP stops.
The information returned is the same as for syscall-enter-stops.

Signed-off-by: Elvira Khabirova <lineprinter@...linux.org>
Signed-off-by: Dmitry V. Levin <ldv@...linux.org>
---
 include/linux/ptrace.h    | 1 +
 include/linux/sched.h     | 1 +
 include/linux/tracehook.h | 1 +
 kernel/ptrace.c           | 7 +++++--
 4 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h
index 6c2ffed907f5..a993d0fde865 100644
--- a/include/linux/ptrace.h
+++ b/include/linux/ptrace.h
@@ -166,6 +166,7 @@ static inline void ptrace_event(int event, unsigned long message)
 {
 	if (unlikely(ptrace_event_enabled(current, event))) {
 		current->ptrace_message = message;
+		current->ptrace_event = event;
 		ptrace_notify((event << 8) | SIGTRAP);
 	} else if (event == PTRACE_EVENT_EXEC) {
 		/* legacy EXEC report via SIGTRAP */
diff --git a/include/linux/sched.h b/include/linux/sched.h
index a51c13c2b1a0..86215fb654d6 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -964,6 +964,7 @@ struct task_struct {
 
 	/* Ptrace state: */
 	unsigned long			ptrace_message;
+	int				ptrace_event;
 	kernel_siginfo_t		*last_siginfo;
 
 	struct task_io_accounting	ioac;
diff --git a/include/linux/tracehook.h b/include/linux/tracehook.h
index 633a83fe7051..5d2e5aa07a5c 100644
--- a/include/linux/tracehook.h
+++ b/include/linux/tracehook.h
@@ -66,6 +66,7 @@ static inline int ptrace_report_syscall(struct pt_regs *regs,
 		return 0;
 
 	current->ptrace_message = message;
+	current->ptrace_event = 0;
 	ptrace_notify(SIGTRAP | ((ptrace & PT_TRACESYSGOOD) ? 0x80 : 0));
 
 	/*
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 92c47cd5ad84..74a37e74c7f1 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -904,7 +904,9 @@ static int ptrace_get_syscall(struct task_struct *child,
 	unsigned long actual_size;
 	unsigned long write_size;
 
-	if (child->ptrace_message == PTRACE_EVENTMSG_SYSCALL_ENTRY) {
+	if ((child->ptrace_event == 0 &&
+	     child->ptrace_message == PTRACE_EVENTMSG_SYSCALL_ENTRY) ||
+	    child->ptrace_event == PTRACE_EVENT_SECCOMP) {
 		int i;
 
 		info.op = PTRACE_SYSCALL_INFO_ENTRY;
@@ -917,7 +919,8 @@ static int ptrace_get_syscall(struct task_struct *child,
 		for (i = 0; i < ARRAY_SIZE(args); i++)
 			info.entry.args[i] = args[i];
 		actual_size = offsetofend(struct ptrace_syscall_info, entry);
-	} else if (child->ptrace_message == PTRACE_EVENTMSG_SYSCALL_EXIT) {
+	} else if (child->ptrace_event == 0 &&
+		   child->ptrace_message == PTRACE_EVENTMSG_SYSCALL_EXIT) {
 		info.op = PTRACE_SYSCALL_INFO_EXIT;
 		info.arch = syscall_get_arch(child);
 		info.exit.rval = syscall_get_error(child, regs);
-- 
2.19.1