Commit 4c7fc722 authored by Andrea Arcangeli's avatar Andrea Arcangeli Committed by Linus Torvalds

[PATCH] i386: seccomp fix for auditing/ptrace

This is the same issue as ppc64 before, when returning to userland we
shouldn't re-compute the seccomp check or the task could be killed during
sigreturn when orig_eax is overwritten by the sigreturn syscall.  This was
found by Roland.

This was harmless from a security standpoint, but some i686 users reported
failures with auditing enabled system wide (some distro surprisingly makes
it the default) and I reproduced it too by keeping the whole workload under
strace -f.

Patch is tested and works for me under strace -f.

nobody@athlon:~/cpushare> strace -o /tmp/o -f python seccomp_test.py
make: Nothing to be done for `seccomp_test'.
Starting computing some malicious bytecode
init
load
start
stop
receive_data failure
kill
exit_code 0 signal 9
The malicious bytecode has been killed successfully by seccomp
Starting computing some safe bytecode
init
load
start
stop
174 counts
kill
exit_code 0 signal 0
The seccomp_test.py completed successfully, thank you for testing.

(akpm: collaterally cleaned up a bit of do_syscall_trace() too)
Signed-off-by: default avatarAndrea Arcangeli <andrea@cpushare.com>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 4d666d7a
...@@ -694,17 +694,22 @@ void send_sigtrap(struct task_struct *tsk, struct pt_regs *regs, int error_code) ...@@ -694,17 +694,22 @@ void send_sigtrap(struct task_struct *tsk, struct pt_regs *regs, int error_code)
__attribute__((regparm(3))) __attribute__((regparm(3)))
int do_syscall_trace(struct pt_regs *regs, int entryexit) int do_syscall_trace(struct pt_regs *regs, int entryexit)
{ {
int is_sysemu = test_thread_flag(TIF_SYSCALL_EMU), ret = 0; int is_sysemu = test_thread_flag(TIF_SYSCALL_EMU);
/* With TIF_SYSCALL_EMU set we want to ignore TIF_SINGLESTEP for syscall /*
* interception. */ * With TIF_SYSCALL_EMU set we want to ignore TIF_SINGLESTEP for syscall
* interception
*/
int is_singlestep = !is_sysemu && test_thread_flag(TIF_SINGLESTEP); int is_singlestep = !is_sysemu && test_thread_flag(TIF_SINGLESTEP);
int ret = 0;
/* do the secure computing check first */ /* do the secure computing check first */
secure_computing(regs->orig_eax); if (!entryexit)
secure_computing(regs->orig_eax);
if (unlikely(current->audit_context)) { if (unlikely(current->audit_context)) {
if (entryexit) if (entryexit)
audit_syscall_exit(current, AUDITSC_RESULT(regs->eax), regs->eax); audit_syscall_exit(current, AUDITSC_RESULT(regs->eax),
regs->eax);
/* Debug traps, when using PTRACE_SINGLESTEP, must be sent only /* Debug traps, when using PTRACE_SINGLESTEP, must be sent only
* on the syscall exit path. Normally, when TIF_SYSCALL_AUDIT is * on the syscall exit path. Normally, when TIF_SYSCALL_AUDIT is
* not used, entry.S will call us only on syscall exit, not * not used, entry.S will call us only on syscall exit, not
...@@ -738,7 +743,7 @@ int do_syscall_trace(struct pt_regs *regs, int entryexit) ...@@ -738,7 +743,7 @@ int do_syscall_trace(struct pt_regs *regs, int entryexit)
/* the 0x80 provides a way for the tracing parent to distinguish /* the 0x80 provides a way for the tracing parent to distinguish
between a syscall stop and SIGTRAP delivery */ between a syscall stop and SIGTRAP delivery */
/* Note that the debugger could change the result of test_thread_flag!*/ /* Note that the debugger could change the result of test_thread_flag!*/
ptrace_notify(SIGTRAP | ((current->ptrace & PT_TRACESYSGOOD) ? 0x80 : 0)); ptrace_notify(SIGTRAP | ((current->ptrace & PT_TRACESYSGOOD) ? 0x80:0));
/* /*
* this isn't the same as continuing with a signal, but it will do * this isn't the same as continuing with a signal, but it will do
...@@ -750,7 +755,7 @@ int do_syscall_trace(struct pt_regs *regs, int entryexit) ...@@ -750,7 +755,7 @@ int do_syscall_trace(struct pt_regs *regs, int entryexit)
current->exit_code = 0; current->exit_code = 0;
} }
ret = is_sysemu; ret = is_sysemu;
out: out:
if (unlikely(current->audit_context) && !entryexit) if (unlikely(current->audit_context) && !entryexit)
audit_syscall_entry(current, AUDIT_ARCH_I386, regs->orig_eax, audit_syscall_entry(current, AUDIT_ARCH_I386, regs->orig_eax,
regs->ebx, regs->ecx, regs->edx, regs->esi); regs->ebx, regs->ecx, regs->edx, regs->esi);
...@@ -759,6 +764,7 @@ int do_syscall_trace(struct pt_regs *regs, int entryexit) ...@@ -759,6 +764,7 @@ int do_syscall_trace(struct pt_regs *regs, int entryexit)
regs->orig_eax = -1; /* force skip of syscall restarting */ regs->orig_eax = -1; /* force skip of syscall restarting */
if (unlikely(current->audit_context)) if (unlikely(current->audit_context))
audit_syscall_exit(current, AUDITSC_RESULT(regs->eax), regs->eax); audit_syscall_exit(current, AUDITSC_RESULT(regs->eax),
regs->eax);
return 1; return 1;
} }
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment