Re: [RFC 3/3] seccomp: add a way to get a listener fd from ptrace

[Kees Cook <keescook-F7+t8E8rja9g9hUCZPvPmw@public.gmane.org>]

On Sun, Feb 4, 2018 at 2:49 AM, Tycho Andersen <tycho-E0fblnxP3wo@public.gmane.org> wrote:
> As an alternative to SECCOMP_FILTER_FLAG_GET_LISTENER, perhaps a ptrace()
> version which can acquire filters is useful. There are at least two reasons
> this is preferable, even though it uses ptrace:
>
> 1. You can control tasks that aren't cooperating with you
> 2. You can control tasks whose filters block sendmsg() and socket(); if the
>    task installs a filter which blocks these calls, there's no way with
>    SECCOMP_FILTER_FLAG_GET_LISTENER to get the fd out to the privileged task.

I got worried for a second that this would get us into a many-to-many
state, but I see init_listener enforces a single listener per filter.
Whew. Seems legit. :)

-Kees

-- 
Kees Cook
Pixel Security