linux-kernel - Re: [PATCH] core/entry: Report syscall correctly for trace and audit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAP045Ar=-nPVw94LhZ3dV=yzY-SoS8Xf-JtfcywT9_D5eP1vEA@mail.gmail.com>
Date:   Mon, 14 Sep 2020 10:22:40 -0700
From:   Kyle Huey <me@...ehuey.com>
To:     Kees Cook <keescook@...omium.org>
Cc:     Thomas Gleixner <tglx@...utronix.de>,
        Michael Ellerman <mpe@...erman.id.au>,
        Andy Lutomirski <luto@...nel.org>,
        Ingo Molnar <mingo@...nel.org>, x86@...r.kernel.org,
        open list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] core/entry: Report syscall correctly for trace and audit

On Fri, Sep 11, 2020 at 5:58 PM Kees Cook <keescook@...omium.org> wrote:
>
> On v5.8 when doing seccomp syscall rewrites (e.g. getpid into getppid
> as seen in the seccomp selftests), trace (and audit) correctly see the
> rewritten syscall on entry and exit:
>
>         seccomp_bpf-1307  [000] .... 22974.874393: sys_enter: NR 110 (...
>         seccomp_bpf-1307  [000] .N.. 22974.874401: sys_exit: NR 110 = 1304
>
> With mainline we see a mismatched enter and exit (the original syscall
> is incorrectly visible on entry):
>
>         seccomp_bpf-1030  [000] ....    21.806766: sys_enter: NR 39 (...
>         seccomp_bpf-1030  [000] ....    21.806767: sys_exit: NR 110 = 1027
>
> When ptrace or seccomp change the syscall, this needs to be visible to
> trace and audit at that time as well. Update the syscall earlier so they
> see the correct value.
>
> Reported-by: Michael Ellerman <mpe@...erman.id.au>
> Fixes: d88d59b64ca3 ("core/entry: Respect syscall number rewrites")
> Cc: Thomas Gleixner <tglx@...utronix.de>
> Cc: Kyle Huey <me@...ehuey.com>
> Cc: Andy Lutomirski <luto@...nel.org>
> Cc: Ingo Molnar <mingo@...nel.org>
> Signed-off-by: Kees Cook <keescook@...omium.org>
> ---
>  kernel/entry/common.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/kernel/entry/common.c b/kernel/entry/common.c
> index 18683598edbc..6fdb6105e6d6 100644
> --- a/kernel/entry/common.c
> +++ b/kernel/entry/common.c
> @@ -60,13 +60,15 @@ static long syscall_trace_enter(struct pt_regs *regs, long syscall,
>                         return ret;
>         }
>
> +       /* Either of the above might have changed the syscall number */
> +       syscall = syscall_get_nr(current, regs);
> +
>         if (unlikely(ti_work & _TIF_SYSCALL_TRACEPOINT))
>                 trace_sys_enter(regs, syscall);
>
>         syscall_enter_audit(regs, syscall);
>
> -       /* The above might have changed the syscall number */
> -       return ret ? : syscall_get_nr(current, regs);
> +       return ret ? : syscall;
>  }
>
>  static __always_inline long
> --
> 2.25.1
>

lgtm

- Kyle