Re: [PATCH] seccomp: plug syscall-dodging ptrace hole

From	Andy Lutomirski <luto@amacapital.net>
Newsgroups	linux.kernel
Subject	Re: [PATCH] seccomp: plug syscall-dodging ptrace hole
Date	2016-05-27 22:20 +0200
Message-ID	<rDwoG-7YU-9@gated-at.bofh.it> (permalink)
References	(1 earlier) <rDfxv-5W2-5@gated-at.bofh.it> <rDg0x-65I-3@gated-at.bofh.it> <rDhSF-7hl-5@gated-at.bofh.it> <rDuZA-71l-13@gated-at.bofh.it> <rDw5k-7Db-33@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Fri, May 27, 2016 at 12:52 PM, Andy Lutomirski <luto@amacapital.net> wrote:
>> Right, I know, it's aesthetically much nicer that way, but I really
>> want to stay totally paranoid and keep seccomp absolutely first on the
>> path.
>>
>> How about this: we'll use this patch as-is for now, since I'd like to
>> be able to start getting feedback from the container-using folks ASAP,
>> and then we can redesign the 2-phase system going forward from there.
>>
>
> I think I'd rather change the ABI as few times as possible.  On the
> other hand, it's still early, and I see nothing wrong with adding it
> to -next.

To get the ball rolling:

https://git.kernel.org/cgit/linux/kernel/git/luto/linux.git/log/?h=seccomp

It's incomplete, but it should be straightforward to finish it.  The
only interesting bit is dealing with SECCOMP_RET_TRACE.

--Andy

Thread

[PATCH] seccomp: plug syscall-dodging ptrace hole Kees Cook <keescook@chromium.org> - 2016-05-26 23:10 +0200
  Re: [PATCH] seccomp: plug syscall-dodging ptrace hole Jann Horn <jann@thejh.net> - 2016-05-27 01:00 +0200
  Re: [PATCH] seccomp: plug syscall-dodging ptrace hole Andy Lutomirski <luto@amacapital.net> - 2016-05-27 04:20 +0200
    Re: [PATCH] seccomp: plug syscall-dodging ptrace hole Kees Cook <keescook@chromium.org> - 2016-05-27 04:50 +0200
      Re: [PATCH] seccomp: plug syscall-dodging ptrace hole Andy Lutomirski <luto@amacapital.net> - 2016-05-27 06:50 +0200
        Re: [PATCH] seccomp: plug syscall-dodging ptrace hole Kees Cook <keescook@chromium.org> - 2016-05-27 20:50 +0200
          Re: [PATCH] seccomp: plug syscall-dodging ptrace hole Andy Lutomirski <luto@amacapital.net> - 2016-05-27 22:00 +0200
            Re: [PATCH] seccomp: plug syscall-dodging ptrace hole Andy Lutomirski <luto@amacapital.net> - 2016-05-27 22:20 +0200
            Re: [PATCH] seccomp: plug syscall-dodging ptrace hole Kees Cook <keescook@chromium.org> - 2016-05-28 00:40 +0200
              Re: [PATCH] seccomp: plug syscall-dodging ptrace hole Andy Lutomirski <luto@amacapital.net> - 2016-05-28 01:30 +0200
                Re: [PATCH] seccomp: plug syscall-dodging ptrace hole Kees Cook <keescook@chromium.org> - 2016-05-28 04:40 +0200

csiph-web