linux-kernel - Re: [PATCH v2] seccomp: passthrough uretprobe systemcall without filtering

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAEf4BzZxR0RDTQ2TmBko-AM9FQg6JjvRmqXeuqS4K99TdSO1uQ@mail.gmail.com>
Date: Wed, 29 Jan 2025 14:52:55 -0800
From: Andrii Nakryiko <andrii.nakryiko@...il.com>
To: Eyal Birger <eyal.birger@...il.com>
Cc: Kees Cook <kees@...nel.org>, luto@...capital.net, wad@...omium.org, oleg@...hat.com, 
	mhiramat@...nel.org, andrii@...nel.org, jolsa@...nel.org, 
	alexei.starovoitov@...il.com, olsajiri@...il.com, cyphar@...har.com, 
	songliubraving@...com, yhs@...com, john.fastabend@...il.com, 
	peterz@...radead.org, tglx@...utronix.de, bp@...en8.de, daniel@...earbox.net, 
	ast@...nel.org, rostedt@...dmis.org, rafi@....io, shmulik.ladkani@...il.com, 
	bpf@...r.kernel.org, linux-api@...r.kernel.org, 
	linux-trace-kernel@...r.kernel.org, x86@...nel.org, 
	linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH v2] seccomp: passthrough uretprobe systemcall without filtering

On Wed, Jan 29, 2025 at 9:27 AM Eyal Birger <eyal.birger@...il.com> wrote:
>
> Hi,
>
> Thanks for the review!
>
> On Tue, Jan 28, 2025 at 5:41 PM Kees Cook <kees@...nel.org> wrote:
> >
> > On Tue, Jan 28, 2025 at 06:58:06AM -0800, Eyal Birger wrote:
> > > Note: uretprobe isn't supported in i386 and __NR_ia32_rt_tgsigqueueinfo
> > > uses the same number as __NR_uretprobe so the syscall isn't forced in the
> > > compat bitmap.
> >
> > So a 64-bit tracer cannot use uretprobe on a 32-bit process? Also is
> > uretprobe strictly an x86_64 feature?
> >
>
> My understanding is that they'd be able to do so, but use the int3 trap
> instead of the uretprobe syscall.
>

Syscall-based uretprobe implementation is strictly x86-64 and I don't
think we have any plans to expand it beyond x86-64. But uretprobes in
general do work across many bitnesses and architectures, they are just
implemented through a trap approach (int3 on x86), so none of that
should be relevant to seccomp. It's just that trapping on x86-64 is
that much slower that we had to do syscall to speed it up but quite a
lot.

> > > [...]
> > > diff --git a/kernel/seccomp.c b/kernel/seccomp.c
> > > index 385d48293a5f..23b594a68bc0 100644
> > > --- a/kernel/seccomp.c
> > > +++ b/kernel/seccomp.c
> > > @@ -734,13 +734,13 @@ seccomp_prepare_user_filter(const char __user *user_filter)
> > >

[...]