Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1418667

[PATCH 06/14] x86/ptrace: run seccomp after ptrace

Show all headers | View raw

This moves seccomp after ptrace on x86 to that seccomp can catch changes
made by ptrace. Emulation should skip the rest of processing too.

We can get rid of test_thread_flag because there's no longer any
opportunity for seccomp to mess with ptrace state before invoking
ptrace.

Suggested-by: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: x86@kernel.org
Cc: Andy Lutomirski <luto@kernel.org>
---
 arch/x86/entry/common.c | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c
index df56ca394877..81c0e12d831c 100644
--- a/arch/x86/entry/common.c
+++ b/arch/x86/entry/common.c
@@ -73,6 +73,7 @@ static long syscall_trace_enter(struct pt_regs *regs)
 
 	struct thread_info *ti = pt_regs_to_thread_info(regs);
 	unsigned long ret = 0;
+	bool emulated = false;
 	u32 work;
 
 	if (IS_ENABLED(CONFIG_DEBUG_ENTRY))
@@ -80,11 +81,19 @@ static long syscall_trace_enter(struct pt_regs *regs)
 
 	work = ACCESS_ONCE(ti->flags) & _TIF_WORK_SYSCALL_ENTRY;
 
+	if (unlikely(work & _TIF_SYSCALL_EMU))
+		emulated = true;
+
+	if ((emulated || (work & _TIF_SYSCALL_TRACE)) &&
+	    tracehook_report_syscall_entry(regs))
+		return -1L;
+
+	if (emulated)
+		return -1L;
+
 #ifdef CONFIG_SECCOMP
 	/*
-	 * Do seccomp first -- it should minimize exposure of other
-	 * code, and keeping seccomp fast is probably more valuable
-	 * than the rest of this.
+	 * Do seccomp after ptrace, to catch any tracer changes.
 	 */
 	if (work & _TIF_SECCOMP) {
 		struct seccomp_data sd;
@@ -117,13 +126,6 @@ static long syscall_trace_enter(struct pt_regs *regs)
 	}
 #endif
 
-	if (unlikely(work & _TIF_SYSCALL_EMU))
-		ret = -1L;
-
-	if ((ret || test_thread_flag(TIF_SYSCALL_TRACE)) &&
-	    tracehook_report_syscall_entry(regs))
-		ret = -1L;
-
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->orig_ax);
 
-- 
2.7.4

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 00/14] run seccomp after ptrace Kees Cook <keescook@chromium.org> - 2016-06-09 23:10 +0200
  [PATCH 10/14] parisc/ptrace: run seccomp after ptrace Kees Cook <keescook@chromium.org> - 2016-06-09 23:10 +0200
  [PATCH 11/14] s390/ptrace: run seccomp after ptrace Kees Cook <keescook@chromium.org> - 2016-06-09 23:10 +0200
    Re: [PATCH 11/14] s390/ptrace: run seccomp after ptrace Martin Schwidefsky <schwidefsky@de.ibm.com> - 2016-06-10 13:00 +0200
  [PATCH 01/14] seccomp: add tests for ptrace hole Kees Cook <keescook@chromium.org> - 2016-06-09 23:10 +0200
  [PATCH 05/14] seccomp: recheck the syscall after RET_TRACE Kees Cook <keescook@chromium.org> - 2016-06-09 23:10 +0200
    Re: [PATCH 05/14] seccomp: recheck the syscall after RET_TRACE Andy Lutomirski <luto@amacapital.net> - 2016-06-10 00:50 +0200
  [PATCH 06/14] x86/ptrace: run seccomp after ptrace Kees Cook <keescook@chromium.org> - 2016-06-09 23:10 +0200
    Re: [PATCH 06/14] x86/ptrace: run seccomp after ptrace Andy Lutomirski <luto@amacapital.net> - 2016-06-10 01:00 +0200
      Re: [PATCH 06/14] x86/ptrace: run seccomp after ptrace Kees Cook <keescook@chromium.org> - 2016-06-10 04:10 +0200
  [PATCH 07/14] arm/ptrace: run seccomp after ptrace Kees Cook <keescook@chromium.org> - 2016-06-09 23:10 +0200
  [PATCH 03/14] x86/entry: Get rid of two-phase syscall entry work Kees Cook <keescook@chromium.org> - 2016-06-09 23:10 +0200

csiph-web