From: Kyle Huey <me@kylehuey.com>
To: Kees Cook <keescook@chromium.org>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>,
Andrea Righi <andrea.righi@canonical.com>,
Shuah Khan <shuah@kernel.org>,
Alexei Starovoitov <ast@kernel.org>,
Andy Lutomirski <luto@amacapital.net>,
Will Drewry <wad@chromium.org>,
"open list:KERNEL SELFTEST FRAMEWORK"
<linux-kselftest@vger.kernel.org>,
bpf@vger.kernel.org, open list <linux-kernel@vger.kernel.org>,
linux-hardening@vger.kernel.org,
Linus Torvalds <torvalds@linux-foundation.org>,
"Robert O'Callahan" <rocallahan@gmail.com>
Subject: Re: [REGRESSION] 5.16rc1: SA_IMMUTABLE breaks debuggers
Date: Wed, 17 Nov 2021 11:05:51 -0800 [thread overview]
Message-ID: <CAP045Apg9AUZN_WwDd6AwxovGjCA++mSfzrWq-mZ7kXYS+GCfA@mail.gmail.com> (raw)
In-Reply-To: <202111171049.3F9C5F1@keescook>
On Wed, Nov 17, 2021 at 10:51 AM Kees Cook <keescook@chromium.org> wrote:
>
> On Wed, Nov 17, 2021 at 10:47:13AM -0800, Kyle Huey wrote:
> > rr, a userspace record and replay debugger[0], is completely broken on
> > 5.16rc1. I bisected this to 00b06da29cf9dc633cdba87acd3f57f4df3fd5c7.
> >
> > That patch makes two changes, it blocks sigaction from changing signal
> > handlers once the kernel has decided to force the program to take a
> > signal and it also stops notifying ptracers of the signal in the same
> > circumstances. The latter behavior is just wrong. There's no reason
> > that ptrace should not be able to observe and even change
> > (non-SIGKILL) forced signals. It should be reverted.
> >
> > This behavior change is also observable in gdb. If you take a program
> > that sets SIGSYS to SIG_IGN and then raises a SIGSYS via
> > SECCOMP_RET_TRAP and run it under gdb on a good kernel gdb will stop
> > when the SIGSYS is raised, let you inspect program state, etc. After
> > the SA_IMMUTABLE change gdb won't stop until the program has already
> > died of SIGSYS.
>
> Ah, hm, this was trying to fix the case where a program trips
> SECCOMP_RET_KILL (which is a "fatal SIGSYS"), and had been unobservable
> before. I guess the fix was too broad...
Perhaps I don't understand precisely what you mean by this, but gdb's
behavior for a program that is SECCOMP_RET_KILLed was not changed by
this patch (the SIGSYS is not observed until after program exit before
or after this change).
- Kyle
next prev parent reply other threads:[~2021-11-17 19:06 UTC|newest]
Thread overview: 44+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-11-17 18:47 [REGRESSION] 5.16rc1: SA_IMMUTABLE breaks debuggers Kyle Huey
2021-11-17 18:51 ` Kees Cook
2021-11-17 19:05 ` Kyle Huey [this message]
2021-11-17 19:09 ` Kyle Huey
2021-11-17 21:04 ` Eric W. Biederman
2021-11-17 21:54 ` Kees Cook
2021-11-17 23:24 ` Linus Torvalds
2021-11-18 0:05 ` Kees Cook
2021-11-18 0:15 ` Linus Torvalds
2021-11-18 0:37 ` Kyle Huey
2021-11-18 1:11 ` Linus Torvalds
2021-11-18 1:20 ` Kyle Huey
2021-11-18 1:32 ` Kees Cook
2021-11-18 16:10 ` Eric W. Biederman
2021-11-19 16:07 ` Kyle Huey
2021-11-19 16:35 ` Kees Cook
2021-11-19 16:58 ` Kyle Huey
2021-11-18 21:58 ` [PATCH 0/2] SA_IMMUTABLE fixes Eric W. Biederman
2021-11-18 21:58 ` Eric W. Biederman
2021-11-18 22:04 ` [PATCH 1/2] signal: Don't always set SA_IMMUTABLE for forced signals Eric W. Biederman
2021-11-18 22:04 ` Eric W. Biederman
2021-11-18 23:52 ` Kees Cook
2021-11-18 23:52 ` Kees Cook
2021-11-18 23:54 ` Kees Cook
2021-11-18 23:54 ` Kees Cook
2021-11-19 15:08 ` Eric W. Biederman
2021-11-19 15:08 ` Eric W. Biederman
2021-11-19 1:13 ` Kyle Huey
2021-11-19 1:13 ` Kyle Huey
2021-11-19 15:03 ` Eric W. Biederman
2021-11-19 15:03 ` Eric W. Biederman
2021-11-18 22:05 ` [PATCH 2/2] signal: Replace force_fatal_sig with force_exit_sig when in doubt Eric W. Biederman
2021-11-18 22:05 ` Eric W. Biederman
2021-11-18 23:53 ` Kees Cook
2021-11-18 23:53 ` Kees Cook
2021-11-19 1:12 ` [PATCH 0/2] SA_IMMUTABLE fixes Kyle Huey
2021-11-19 1:12 ` Kyle Huey
2021-11-19 15:41 ` [GIT PULL] SA_IMMUTABLE fixes for v5.16-rc2 Eric W. Biederman
2021-11-19 15:41 ` Eric W. Biederman
2021-11-19 19:46 ` pr-tracker-bot
2021-11-19 19:46 ` pr-tracker-bot
2021-11-17 22:29 ` [REGRESSION] 5.16rc1: SA_IMMUTABLE breaks debuggers Kyle Huey
2021-11-18 5:43 ` Thorsten Leemhuis
2021-11-20 6:13 ` Thorsten Leemhuis
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAP045Apg9AUZN_WwDd6AwxovGjCA++mSfzrWq-mZ7kXYS+GCfA@mail.gmail.com \
--to=me@kylehuey.com \
--cc=andrea.righi@canonical.com \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=ebiederm@xmission.com \
--cc=keescook@chromium.org \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=luto@amacapital.net \
--cc=rocallahan@gmail.com \
--cc=shuah@kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=wad@chromium.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.