[PATCH] arm64: ptrace: Fix seccomp of traced syscall -1 (NO_SYSCALL)

[PATCH] arm64: ptrace: Fix seccomp of traced syscall -1 (NO_SYSCALL)

[Timothy Baldwin]

 From c047f549699d31ed91d5ac0cadbcf76a02cd801e Mon Sep 17 00:00:00 2001
From: Timothy E Baldwin<T.E.Baldwin99@members.leeds.ac.uk>
Date: Sat, 16 Jan 2021 15:18:54 +0000
Subject: [PATCH] arm64: ptrace: Fix seccomp of traced syscall -1 (NO_SYSCALL)

Since commit f086f67485c5 ("arm64: ptrace: add support for syscall
emulation"), if system call number -1 is called and the process is being
traced with PTRACE_SYSCALL, for example by strace, the seccomp check is
skipped and -ENOSYS is returned unconditionally (unless altered by the
tracer) rather than carrying out action specified in the seccomp filter.

The consequence of this is that it is not possible to reliably strace
a seccomp based implementation of a foreign system call interface in
which r7/x8 is permitted to be -1 on entry to a system call.

Also trace_sys_enter and audit_syscall_entry are skipped if a system
call is skipped.

Fix by removing the in_syscall(regs) check restoring the previous behaviour
which is like AArch32, x86 (which uses generic code) and everything else.

Fixes: f086f67485c5 ("arm64: ptrace: add support for syscall emulation")
Signed-off-by: Timothy E Baldwin<T.E.Baldwin99@members.leeds.ac.uk>
Cc: Sudeep Holla<sudeep.holla@arm.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Catalin Marinas<catalin.marinas@arm.com>
Cc: Will Deacon<will.deacon@arm.com>
Cc: Kees Cook<keescook@chromium.org>
Cc:stable@vger.kernel.org
---
  arch/arm64/kernel/ptrace.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
index 8ac487c84e37..1d75471979cb 100644
--- a/arch/arm64/kernel/ptrace.c
+++ b/arch/arm64/kernel/ptrace.c
@@ -1796,7 +1796,7 @@ int syscall_trace_enter(struct pt_regs *regs)
  
  	if (flags & (_TIF_SYSCALL_EMU | _TIF_SYSCALL_TRACE)) {
  		tracehook_report_syscall(regs, PTRACE_SYSCALL_ENTER);
-		if (!in_syscall(regs) || (flags & _TIF_SYSCALL_EMU))
+		if (flags & _TIF_SYSCALL_EMU)
  			return NO_SYSCALL;
  	}
  
-- 
2.27.0

The specific implementation of a seccomp based foreign system call 
interface is my port of RISC OS to Linux, in the spirit User Mode Linux: 
https://github.com/TimothyEBaldwin/RISC_OS_Linux_Binary



_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Re: [PATCH] arm64: ptrace: Fix seccomp of traced syscall -1 (NO_SYSCALL)

[Sudeep Holla]

On Mon, Jan 18, 2021 at 02:58:58AM +0000, Timothy Baldwin wrote:
> From c047f549699d31ed91d5ac0cadbcf76a02cd801e Mon Sep 17 00:00:00 2001
> From: Timothy E Baldwin<T.E.Baldwin99@members.leeds.ac.uk>
> Date: Sat, 16 Jan 2021 15:18:54 +0000
> Subject: [PATCH] arm64: ptrace: Fix seccomp of traced syscall -1 (NO_SYSCALL)
> 
> Since commit f086f67485c5 ("arm64: ptrace: add support for syscall
> emulation"), if system call number -1 is called and the process is being
> traced with PTRACE_SYSCALL, for example by strace, the seccomp check is
> skipped and -ENOSYS is returned unconditionally (unless altered by the
> tracer) rather than carrying out action specified in the seccomp filter.
> 
> The consequence of this is that it is not possible to reliably strace
> a seccomp based implementation of a foreign system call interface in
> which r7/x8 is permitted to be -1 on entry to a system call.
> 
> Also trace_sys_enter and audit_syscall_entry are skipped if a system
> call is skipped.
> 
> Fix by removing the in_syscall(regs) check restoring the previous behaviour
> which is like AArch32, x86 (which uses generic code) and everything else.
> 

Ah, my fault. At the time of timing this I didn't test with seccomp and
also for some reason IIRC I had assumed the flags SYSCALL_{EMU,TRACE}
and seccomp calls are mutually exclusive and can't happen together.

FWIW,
Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>

Also I ran some minimal tests I have, so
Tested-by: Sudeep Holla <sudeep.holla@arm.com>

I have also asked Haibo Xu <Haibo.Xu@arm.com> who help me testing back then
to test again.


> Fixes: f086f67485c5 ("arm64: ptrace: add support for syscall emulation")
> Signed-off-by: Timothy E Baldwin<T.E.Baldwin99@members.leeds.ac.uk>
> Cc: Sudeep Holla<sudeep.holla@arm.com>
> Cc: Oleg Nesterov <oleg@redhat.com>
> Cc: Catalin Marinas<catalin.marinas@arm.com>
> Cc: Will Deacon<will.deacon@arm.com>
> Cc: Kees Cook<keescook@chromium.org>
> Cc:stable@vger.kernel.org
> ---
>  arch/arm64/kernel/ptrace.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
> index 8ac487c84e37..1d75471979cb 100644
> --- a/arch/arm64/kernel/ptrace.c
> +++ b/arch/arm64/kernel/ptrace.c
> @@ -1796,7 +1796,7 @@ int syscall_trace_enter(struct pt_regs *regs)
>  	if (flags & (_TIF_SYSCALL_EMU | _TIF_SYSCALL_TRACE)) {
>  		tracehook_report_syscall(regs, PTRACE_SYSCALL_ENTER);
> -		if (!in_syscall(regs) || (flags & _TIF_SYSCALL_EMU))
> +		if (flags & _TIF_SYSCALL_EMU)
>  			return NO_SYSCALL;
>  	}
> -- 
> 2.27.0
> 
> The specific implementation of a seccomp based foreign system call interface
> is my port of RISC OS to Linux, in the spirit User Mode Linux:
> https://github.com/TimothyEBaldwin/RISC_OS_Linux_Binary
> 
> 
> 
> _______________________________________________
> linux-arm-kernel mailing list
> linux-arm-kernel@lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

-- 
Regards,
Sudeep

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Re: [PATCH] arm64: ptrace: Fix seccomp of traced syscall -1 (NO_SYSCALL)

[Kees Cook]

On Wed, Feb 24, 2021 at 02:49:20PM +0000, Sudeep Holla wrote:
> On Mon, Jan 18, 2021 at 02:58:58AM +0000, Timothy Baldwin wrote:
> > From c047f549699d31ed91d5ac0cadbcf76a02cd801e Mon Sep 17 00:00:00 2001
> > From: Timothy E Baldwin<T.E.Baldwin99@members.leeds.ac.uk>
> > Date: Sat, 16 Jan 2021 15:18:54 +0000
> > Subject: [PATCH] arm64: ptrace: Fix seccomp of traced syscall -1 (NO_SYSCALL)
> > 
> > Since commit f086f67485c5 ("arm64: ptrace: add support for syscall
> > emulation"), if system call number -1 is called and the process is being
> > traced with PTRACE_SYSCALL, for example by strace, the seccomp check is
> > skipped and -ENOSYS is returned unconditionally (unless altered by the
> > tracer) rather than carrying out action specified in the seccomp filter.
> > 
> > The consequence of this is that it is not possible to reliably strace
> > a seccomp based implementation of a foreign system call interface in
> > which r7/x8 is permitted to be -1 on entry to a system call.
> > 
> > Also trace_sys_enter and audit_syscall_entry are skipped if a system
> > call is skipped.
> > 
> > Fix by removing the in_syscall(regs) check restoring the previous behaviour
> > which is like AArch32, x86 (which uses generic code) and everything else.
> > 
> 
> Ah, my fault. At the time of timing this I didn't test with seccomp and
> also for some reason IIRC I had assumed the flags SYSCALL_{EMU,TRACE}
> and seccomp calls are mutually exclusive and can't happen together.
> 
> FWIW,
> Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
> 
> Also I ran some minimal tests I have, so
> Tested-by: Sudeep Holla <sudeep.holla@arm.com>
> 
> I have also asked Haibo Xu <Haibo.Xu@arm.com> who help me testing back then
> to test again.

Thanks for catching and fixing this! Does this pass the seccomp selftests?

Reviewed-by: Kees Cook <keescook@chromium.org>

Will, do you want to take this? I don't usually put the arch-specific
seccomp bits through the seccomp tree.

-Kees

> 
> 
> > Fixes: f086f67485c5 ("arm64: ptrace: add support for syscall emulation")
> > Signed-off-by: Timothy E Baldwin<T.E.Baldwin99@members.leeds.ac.uk>
> > Cc: Sudeep Holla<sudeep.holla@arm.com>
> > Cc: Oleg Nesterov <oleg@redhat.com>
> > Cc: Catalin Marinas<catalin.marinas@arm.com>
> > Cc: Will Deacon<will.deacon@arm.com>
> > Cc: Kees Cook<keescook@chromium.org>
> > Cc:stable@vger.kernel.org
> > ---
> >  arch/arm64/kernel/ptrace.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
> > index 8ac487c84e37..1d75471979cb 100644
> > --- a/arch/arm64/kernel/ptrace.c
> > +++ b/arch/arm64/kernel/ptrace.c
> > @@ -1796,7 +1796,7 @@ int syscall_trace_enter(struct pt_regs *regs)
> >  	if (flags & (_TIF_SYSCALL_EMU | _TIF_SYSCALL_TRACE)) {
> >  		tracehook_report_syscall(regs, PTRACE_SYSCALL_ENTER);
> > -		if (!in_syscall(regs) || (flags & _TIF_SYSCALL_EMU))
> > +		if (flags & _TIF_SYSCALL_EMU)
> >  			return NO_SYSCALL;
> >  	}
> > -- 
> > 2.27.0
> > 
> > The specific implementation of a seccomp based foreign system call interface
> > is my port of RISC OS to Linux, in the spirit User Mode Linux:
> > https://github.com/TimothyEBaldwin/RISC_OS_Linux_Binary
> > 
> > 
> > 
> > _______________________________________________
> > linux-arm-kernel mailing list
> > linux-arm-kernel@lists.infradead.org
> > http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
> 
> -- 
> Regards,
> Sudeep

-- 
Kees Cook

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Re: [PATCH] arm64: ptrace: Fix seccomp of traced syscall -1 (NO_SYSCALL)

[Will Deacon]

On Wed, Feb 24, 2021 at 02:48:05PM -0800, Kees Cook wrote:
> On Wed, Feb 24, 2021 at 02:49:20PM +0000, Sudeep Holla wrote:
> > On Mon, Jan 18, 2021 at 02:58:58AM +0000, Timothy Baldwin wrote:
> > > From c047f549699d31ed91d5ac0cadbcf76a02cd801e Mon Sep 17 00:00:00 2001
> > > From: Timothy E Baldwin<T.E.Baldwin99@members.leeds.ac.uk>
> > > Date: Sat, 16 Jan 2021 15:18:54 +0000
> > > Subject: [PATCH] arm64: ptrace: Fix seccomp of traced syscall -1 (NO_SYSCALL)
> > > 
> > > Since commit f086f67485c5 ("arm64: ptrace: add support for syscall
> > > emulation"), if system call number -1 is called and the process is being
> > > traced with PTRACE_SYSCALL, for example by strace, the seccomp check is
> > > skipped and -ENOSYS is returned unconditionally (unless altered by the
> > > tracer) rather than carrying out action specified in the seccomp filter.
> > > 
> > > The consequence of this is that it is not possible to reliably strace
> > > a seccomp based implementation of a foreign system call interface in
> > > which r7/x8 is permitted to be -1 on entry to a system call.
> > > 
> > > Also trace_sys_enter and audit_syscall_entry are skipped if a system
> > > call is skipped.
> > > 
> > > Fix by removing the in_syscall(regs) check restoring the previous behaviour
> > > which is like AArch32, x86 (which uses generic code) and everything else.
> > > 
> > 
> > Ah, my fault. At the time of timing this I didn't test with seccomp and
> > also for some reason IIRC I had assumed the flags SYSCALL_{EMU,TRACE}
> > and seccomp calls are mutually exclusive and can't happen together.
> > 
> > FWIW,
> > Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
> > 
> > Also I ran some minimal tests I have, so
> > Tested-by: Sudeep Holla <sudeep.holla@arm.com>
> > 
> > I have also asked Haibo Xu <Haibo.Xu@arm.com> who help me testing back then
> > to test again.
> 
> Thanks for catching and fixing this! Does this pass the seccomp selftests?
> 
> Reviewed-by: Kees Cook <keescook@chromium.org>
> 
> Will, do you want to take this? I don't usually put the arch-specific
> seccomp bits through the seccomp tree.

Sure, I'll add it to the fixes pile. Thanks!

Will

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Re: [PATCH] arm64: ptrace: Fix seccomp of traced syscall -1 (NO_SYSCALL)

[Will Deacon]

On Mon, 18 Jan 2021 02:58:58 +0000, Timothy Baldwin wrote:
>  From c047f549699d31ed91d5ac0cadbcf76a02cd801e Mon Sep 17 00:00:00 2001
> From: Timothy E Baldwin<T.E.Baldwin99@members.leeds.ac.uk>
> Date: Sat, 16 Jan 2021 15:18:54 +0000
> Subject: [PATCH] arm64: ptrace: Fix seccomp of traced syscall -1 (NO_SYSCALL)
> 
> Since commit f086f67485c5 ("arm64: ptrace: add support for syscall
> emulation"), if system call number -1 is called and the process is being
> traced with PTRACE_SYSCALL, for example by strace, the seccomp check is
> skipped and -ENOSYS is returned unconditionally (unless altered by the
> tracer) rather than carrying out action specified in the seccomp filter.
> 
> [...]

(Note that I had to fix up whitespace errors in order for git am to apply
 this, so please check the resulting commit).

Applied to arm64 (for-next/fixes), thanks!

[1/1] arm64: ptrace: Fix seccomp of traced syscall -1 (NO_SYSCALL)
      https://git.kernel.org/arm64/c/df84fe947089

Cheers,
-- 
Will

https://fixes.arm64.dev
https://next.arm64.dev
https://will.arm64.dev

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Re: FAILED: patch "[PATCH] arm64: ptrace: Fix seccomp of traced syscall -1 (NO_SYSCALL)" failed to apply to 5.4-stable tree

[Sudeep Holla]

Hi Timothy,

On Mon, Mar 01, 2021 at 11:33:37AM +0100, gregkh@linuxfoundation.org wrote:
> 
> The patch below does not apply to the 5.4-stable tree.
> If someone wants it applied there, or to any other stable or longterm
> tree, then please email the backport, including the original git commit
> id to <stable@vger.kernel.org>.
>

Looks like simple context mismatch here, the change itself applies
easily. Would you be able to send the backport for v5.4 separately ?

-- 
Regards,
Sudeep

[PATCH] arm64: ptrace: Fix seccomp of traced syscall -1 (NO_SYSCALL)

[Timothy E Baldwin]

commit df84fe94708985cdfb78a83148322bcd0a699472 upstream.

Backported to Linux 5.4 by changing "return NO_SYSCALL" to "return -1"
in patch context.

Since commit f086f67485c5 ("arm64: ptrace: add support for syscall
emulation"), if system call number -1 is called and the process is being
traced with PTRACE_SYSCALL, for example by strace, the seccomp check is
skipped and -ENOSYS is returned unconditionally (unless altered by the
tracer) rather than carrying out action specified in the seccomp filter.

The consequence of this is that it is not possible to reliably strace
a seccomp based implementation of a foreign system call interface in
which r7/x8 is permitted to be -1 on entry to a system call.

Also trace_sys_enter and audit_syscall_entry are skipped if a system
call is skipped.

Fix by removing the in_syscall(regs) check restoring the previous
behaviour which is like AArch32, x86 (which uses generic code) and
everything else.

Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: <stable@vger.kernel.org>
Fixes: f086f67485c5 ("arm64: ptrace: add support for syscall emulation")
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
Tested-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Timothy E Baldwin <T.E.Baldwin99@members.leeds.ac.uk>
Link: https://lore.kernel.org/r/90edd33b-6353-1228-791f-0336d94d5f8c@majoroak.me.uk
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/kernel/ptrace.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
index 30b877f8b85e..0cfd68577489 100644
--- a/arch/arm64/kernel/ptrace.c
+++ b/arch/arm64/kernel/ptrace.c
@@ -1844,7 +1844,7 @@ int syscall_trace_enter(struct pt_regs *regs)
 
 	if (flags & (_TIF_SYSCALL_EMU | _TIF_SYSCALL_TRACE)) {
 		tracehook_report_syscall(regs, PTRACE_SYSCALL_ENTER);
-		if (!in_syscall(regs) || (flags & _TIF_SYSCALL_EMU))
+		if (flags & _TIF_SYSCALL_EMU)
 			return -1;
 	}
 
-- 
2.27.0

Re: [PATCH] arm64: ptrace: Fix seccomp of traced syscall -1 (NO_SYSCALL)

[Greg KH]

On Fri, Mar 05, 2021 at 07:12:05PM +0000, Timothy E Baldwin wrote:
> commit df84fe94708985cdfb78a83148322bcd0a699472 upstream.

Thanks for the backport, now queued up.

greg k-h