linux-kernel - Re: [PATCH] seccomp: passthrough uretprobe systemcall without filtering

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250121182939.33d05470@gandalf.local.home>
Date: Tue, 21 Jan 2025 18:29:39 -0500
From: Steven Rostedt <rostedt@...dmis.org>
To: Eyal Birger <eyal.birger@...il.com>
Cc: Andrii Nakryiko <andrii.nakryiko@...il.com>, Jiri Olsa
 <olsajiri@...il.com>, Kees Cook <kees@...nel.org>, luto@...capital.net,
 wad@...omium.org, oleg@...hat.com, ldv@...ace.io, mhiramat@...nel.org,
 andrii@...nel.org, alexei.starovoitov@...il.com, cyphar@...har.com,
 songliubraving@...com, yhs@...com, john.fastabend@...il.com,
 peterz@...radead.org, tglx@...utronix.de, bp@...en8.de,
 daniel@...earbox.net, ast@...nel.org, rafi@....io,
 shmulik.ladkani@...il.com, bpf@...r.kernel.org, linux-api@...r.kernel.org,
 linux-trace-kernel@...r.kernel.org, x86@...nel.org,
 linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH] seccomp: passthrough uretprobe systemcall without
 filtering

On Tue, 21 Jan 2025 15:13:52 -0800
Eyal Birger <eyal.birger@...il.com> wrote:

> Isn't that the case already, or maybe I misunderstood what Jiri wrote [1]:
> 
> > On Sun, Jan 19, 2025 at 2:44 AM Jiri Olsa <olsajiri@...il.com> wrote:
> > that's correct, uretprobe syscall is installed by kernel to special user
> > memory map and it can be executed only from there and if process calls it
> > from another place it receives sigill  
> 
> Eyal.
> 
> [1] https://lore.kernel.org/lkml/Z4zXlaEMPbiYYlQ8@krava/

Ah, he did. Thanks I missed that:

> that's correct, uretprobe syscall is installed by kernel to special user
> memory map and it can be executed only from there and if process calls it
> from another place it receives sigill

-- Steve