linux-kernel - Re: [RFC PATCH RESEND v3 3/3] ptrace: add PTRACE_EVENT_SECCOMP support to PTRACE_GET_SYSCALL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 27 Nov 2018 04:07:32 +0100
From:   Elvira Khabirova <lineprinter@...linux.org>
To:     Oleg Nesterov <oleg@...hat.com>
Cc:     rostedt@...dmis.org, mingo@...hat.com,
        linux-kernel@...r.kernel.org, ldv@...linux.org, esyr@...hat.com,
        luto@...nel.org, strace-devel@...ts.strace.io,
        linux-api@...r.kernel.org
Subject: Re: [RFC PATCH RESEND v3 3/3] ptrace: add PTRACE_EVENT_SECCOMP
 support to PTRACE_GET_SYSCALL_INFO

On Mon, 26 Nov 2018 15:35:24 +0100
Oleg Nesterov <oleg@...hat.com> wrote:

> On 11/25, Elvira Khabirova wrote:
> >
> > Extend PTRACE_GET_SYSCALL_INFO to support PTRACE_EVENT_SECCOMP stops.
> > The information returned is the same as for syscall-enter-stops.  
> 
> Oh, this is not nice ;) there must be a better option, I hope... Plus
> 
> 
> Can't ptrace_get_syscall() check
> 
> 	child->exit_code == (PTRACE_EVENT_SECCOMP << 8) | SIGTRAP;
> 
> to detect the PTRACE_EVENT_SECCOMP case?

Nope; looks like exit_code is zeroed after wait().

> Oleg.
> 
> > Signed-off-by: Elvira Khabirova <lineprinter@...linux.org>
> > Signed-off-by: Dmitry V. Levin <ldv@...linux.org>
> > ---
> >  include/linux/ptrace.h    | 1 +
> >  include/linux/sched.h     | 1 +
> >  include/linux/tracehook.h | 1 +
> >  kernel/ptrace.c           | 7 +++++--
> >  4 files changed, 8 insertions(+), 2 deletions(-)
> > 
> > diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h
> > index 6c2ffed907f5..a993d0fde865 100644
> > --- a/include/linux/ptrace.h
> > +++ b/include/linux/ptrace.h
> > @@ -166,6 +166,7 @@ static inline void ptrace_event(int event, unsigned long message)
> >  {
> >  	if (unlikely(ptrace_event_enabled(current, event))) {
> >  		current->ptrace_message = message;
> > +		current->ptrace_event = event;
> >  		ptrace_notify((event << 8) | SIGTRAP);
> >  	} else if (event == PTRACE_EVENT_EXEC) {
> >  		/* legacy EXEC report via SIGTRAP */
> > diff --git a/include/linux/sched.h b/include/linux/sched.h
> > index a51c13c2b1a0..86215fb654d6 100644
> > --- a/include/linux/sched.h
> > +++ b/include/linux/sched.h
> > @@ -964,6 +964,7 @@ struct task_struct {
> >  
> >  	/* Ptrace state: */
> >  	unsigned long			ptrace_message;
> > +	int				ptrace_event;
> >  	kernel_siginfo_t		*last_siginfo;
> >  
> >  	struct task_io_accounting	ioac;
> > diff --git a/include/linux/tracehook.h b/include/linux/tracehook.h
> > index 633a83fe7051..5d2e5aa07a5c 100644
> > --- a/include/linux/tracehook.h
> > +++ b/include/linux/tracehook.h
> > @@ -66,6 +66,7 @@ static inline int ptrace_report_syscall(struct pt_regs *regs,
> >  		return 0;
> >  
> >  	current->ptrace_message = message;
> > +	current->ptrace_event = 0;
> >  	ptrace_notify(SIGTRAP | ((ptrace & PT_TRACESYSGOOD) ? 0x80 : 0));
> >  
> >  	/*
> > diff --git a/kernel/ptrace.c b/kernel/ptrace.c
> > index 92c47cd5ad84..74a37e74c7f1 100644
> > --- a/kernel/ptrace.c
> > +++ b/kernel/ptrace.c
> > @@ -904,7 +904,9 @@ static int ptrace_get_syscall(struct task_struct *child,
> >  	unsigned long actual_size;
> >  	unsigned long write_size;
> >  
> > -	if (child->ptrace_message == PTRACE_EVENTMSG_SYSCALL_ENTRY) {
> > +	if ((child->ptrace_event == 0 &&
> > +	     child->ptrace_message == PTRACE_EVENTMSG_SYSCALL_ENTRY) ||
> > +	    child->ptrace_event == PTRACE_EVENT_SECCOMP) {
> >  		int i;
> >  
> >  		info.op = PTRACE_SYSCALL_INFO_ENTRY;
> > @@ -917,7 +919,8 @@ static int ptrace_get_syscall(struct task_struct *child,
> >  		for (i = 0; i < ARRAY_SIZE(args); i++)
> >  			info.entry.args[i] = args[i];
> >  		actual_size = offsetofend(struct ptrace_syscall_info, entry);
> > -	} else if (child->ptrace_message == PTRACE_EVENTMSG_SYSCALL_EXIT) {
> > +	} else if (child->ptrace_event == 0 &&
> > +		   child->ptrace_message == PTRACE_EVENTMSG_SYSCALL_EXIT) {
> >  		info.op = PTRACE_SYSCALL_INFO_EXIT;
> >  		info.arch = syscall_get_arch(child);
> >  		info.exit.rval = syscall_get_error(child, regs);
> > -- 
> > 2.19.1
> >   
>