From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1752605AbbFDSEG (ORCPT <rfc822;w@1wt.eu>);
	Thu, 4 Jun 2015 14:04:06 -0400
Received: from mx1.redhat.com ([209.132.183.28]:54777 "EHLO mx1.redhat.com"
	rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
	id S1751010AbbFDSEA (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
	Thu, 4 Jun 2015 14:04:00 -0400
Date: Thu, 4 Jun 2015 20:03:03 +0200
From: Oleg Nesterov <oleg@redhat.com>
To: Kees Cook <keescook@chromium.org>
Cc: Tycho Andersen <tycho.andersen@canonical.com>,
        LKML <linux-kernel@vger.kernel.org>,
        Linux API <linux-api@vger.kernel.org>,
        Andy Lutomirski <luto@amacapital.net>, Will Drewry <wad@chromium.org>,
        Roland McGrath <roland@hack.frob.com>,
        Pavel Emelyanov <xemul@parallels.com>,
        "Serge E. Hallyn" <serge.hallyn@ubuntu.com>
Subject: Re: [PATCH v2] seccomp: add ptrace options for suspend/resume
Message-ID: <20150604180303.GA32421@redhat.com>
References: <1433369396-13360-1-git-send-email-tycho.andersen@canonical.com> <CAGXu5jLBm6ZBptsDTrNV6OrFSwoZ__k3867-Ji+6oYuTQ8ncWQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CAGXu5jLBm6ZBptsDTrNV6OrFSwoZ__k3867-Ji+6oYuTQ8ncWQ@mail.gmail.com>
User-Agent: Mutt/1.5.18 (2008-05-17)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 06/04, Kees Cook wrote:
>
> On Wed, Jun 3, 2015 at 3:09 PM, Tycho Andersen
> > @@ -556,6 +557,11 @@ static int ptrace_setoptions(struct task_struct *child, unsigned long data)
> >         if (data & ~(unsigned long)PTRACE_O_MASK)
> >                 return -EINVAL;
> >
> > +#ifdef CONFIG_CHECKPOINT_RESTORE
> > +       if (data & PTRACE_O_SUSPEND_SECCOMP && !may_suspend_seccomp())
> > +               return -EPERM;
> > +#endif
>
> I'd like to avoid seeing any #ifdefs added to the .c files. Using a
> static inline for may_suspend_seccomp() should cause this statement to
> be eliminated by the compiler.

Agreed, me too, but see below.

> > @@ -590,6 +590,11 @@ void secure_computing_strict(int this_syscall)
> >  {
> >         int mode = current->seccomp.mode;
> >
> > +#ifdef CONFIG_CHECKPOINT_RESTORE
> > +       if (unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
> > +               return;
> > +#endif
>
> Could PT_SUSPEND_SECCOMP be defined to "0" with not
> CONFIG_CHECKPOINT_RESTORE? Then this wouldn't need ifdefs, and should
> be similarly eliminated by the compiler.

Yes, but this way we add another ugly ifdef into .h, and if you read
this code it is not clear that this check should be eliminated by gcc.

I'd suggest

	if (config_enabled(CONFIG_CHECKPOINT_RESTORE) &&
	    unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
		return;

Oleg.