lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:   Fri, 28 Aug 2020 21:56:13 -0400
From:   Rich Felker <>
Cc:     Kees Cook <>,
        Andy Lutomirski <>,
        Will Drewry <>
Subject: [PATCH] seccomp: kill process instead of thread for unknown actions

Asynchronous termination of a thread outside of the userspace thread
library's knowledge is an unsafe operation that leaves the process in
an inconsistent, corrupt, and possibly unrecoverable state. In order
to make new actions that may be added in the future safe on kernels
not aware of them, change the default action from

Signed-off-by: Rich Felker <>

This fundamental problem with SECCOMP_RET_KILL_THREAD, and that it
should be considered unsafe and deprecated, was recently noted/fixed
seccomp in the man page and its example. Here I've only changed the
default action for new/unknown action codes. Ideally the behavior for
strict seccomp mode would be changed too but I think that breaks
stability policy; in any case it's less likely to be an issue since
strict mode is hard or impossible to use reasonably in a multithreaded

Unfortunately changing this now won't help older kernels where unknown
new actions would still be handled unsafely, but at least it makes it
so the problem will fade away over time.

 kernel/seccomp.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index d653d8426de9..ce1875fa6b39 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -910,10 +910,10 @@ static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
 			seccomp_init_siginfo(&info, this_syscall, data);
-		if (action == SECCOMP_RET_KILL_PROCESS)
-			do_group_exit(SIGSYS);
-		else
+		if (action == SECCOMP_RET_KILL_THREAD)
+		else
+			do_group_exit(SIGSYS);

Powered by blists - more mailing lists