* [PATCH] seccomp: Only dump core when single-threaded
@ 2017-02-07 23:18 Kees Cook
2017-02-14 6:37 ` Andrei Vagin
0 siblings, 1 reply; 6+ messages in thread
From: Kees Cook @ 2017-02-07 23:18 UTC (permalink / raw)
To: James Morris
Cc: Mike Frysinger, Paul Moore, Tyler Hicks, Andrei Vagin,
Andy Lutomirski, Will Drewry, linux-security-module,
linux-kernel
The SECCOMP_RET_KILL filter return code has always killed the current
thread, not the entire process. Changing this as a side-effect of dumping
core isn't a safe thing to do (a few test suites have already flagged this
behavioral change). Instead, restore the RET_KILL semantics, but still
dump core when a RET_KILL delivers SIGSYS to a single-threaded process.
Fixes: b25e67161c29 ("seccomp: dump core when using SECCOMP_RET_KILL")
Signed-off-by: Kees Cook <keescook@chromium.org>
---
kernel/seccomp.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index f8f88ebcb3ba..e15185c28de5 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -643,11 +643,14 @@ static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
default: {
siginfo_t info;
audit_seccomp(this_syscall, SIGSYS, action);
- /* Show the original registers in the dump. */
- syscall_rollback(current, task_pt_regs(current));
- /* Trigger a manual coredump since do_exit skips it. */
- seccomp_init_siginfo(&info, this_syscall, data);
- do_coredump(&info);
+ /* Dump core only if this is the last remaining thread. */
+ if (get_nr_threads(current) == 1) {
+ /* Show the original registers in the dump. */
+ syscall_rollback(current, task_pt_regs(current));
+ /* Trigger a manual coredump since do_exit skips it. */
+ seccomp_init_siginfo(&info, this_syscall, data);
+ do_coredump(&info);
+ }
do_exit(SIGSYS);
}
}
--
2.7.4
--
Kees Cook
Pixel Security
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH] seccomp: Only dump core when single-threaded
2017-02-07 23:18 [PATCH] seccomp: Only dump core when single-threaded Kees Cook
@ 2017-02-14 6:37 ` Andrei Vagin
2017-02-14 19:09 ` Kees Cook
0 siblings, 1 reply; 6+ messages in thread
From: Andrei Vagin @ 2017-02-14 6:37 UTC (permalink / raw)
To: Kees Cook
Cc: James Morris, Mike Frysinger, Paul Moore, Tyler Hicks,
Andy Lutomirski, Will Drewry, linux-security-module,
linux-kernel
On Tue, Feb 07, 2017 at 03:18:51PM -0800, Kees Cook wrote:
> The SECCOMP_RET_KILL filter return code has always killed the current
> thread, not the entire process. Changing this as a side-effect of dumping
> core isn't a safe thing to do (a few test suites have already flagged this
> behavioral change). Instead, restore the RET_KILL semantics, but still
> dump core when a RET_KILL delivers SIGSYS to a single-threaded process.
>
> Fixes: b25e67161c29 ("seccomp: dump core when using SECCOMP_RET_KILL")
> Signed-off-by: Kees Cook <keescook@chromium.org>
All CRIU tests passed with this patch. Thanks!
Acked-by: Andrei Vagin <avagin@virtuozzo.com>
> ---
> kernel/seccomp.c | 13 ++++++++-----
> 1 file changed, 8 insertions(+), 5 deletions(-)
>
> diff --git a/kernel/seccomp.c b/kernel/seccomp.c
> index f8f88ebcb3ba..e15185c28de5 100644
> --- a/kernel/seccomp.c
> +++ b/kernel/seccomp.c
> @@ -643,11 +643,14 @@ static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
> default: {
> siginfo_t info;
> audit_seccomp(this_syscall, SIGSYS, action);
> - /* Show the original registers in the dump. */
> - syscall_rollback(current, task_pt_regs(current));
> - /* Trigger a manual coredump since do_exit skips it. */
> - seccomp_init_siginfo(&info, this_syscall, data);
> - do_coredump(&info);
> + /* Dump core only if this is the last remaining thread. */
> + if (get_nr_threads(current) == 1) {
> + /* Show the original registers in the dump. */
> + syscall_rollback(current, task_pt_regs(current));
> + /* Trigger a manual coredump since do_exit skips it. */
> + seccomp_init_siginfo(&info, this_syscall, data);
> + do_coredump(&info);
> + }
> do_exit(SIGSYS);
> }
> }
> --
> 2.7.4
>
>
> --
> Kees Cook
> Pixel Security
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] seccomp: Only dump core when single-threaded
2017-02-14 6:37 ` Andrei Vagin
@ 2017-02-14 19:09 ` Kees Cook
2017-02-14 22:34 ` James Morris
0 siblings, 1 reply; 6+ messages in thread
From: Kees Cook @ 2017-02-14 19:09 UTC (permalink / raw)
To: Andrei Vagin, James Morris
Cc: Mike Frysinger, Paul Moore, Tyler Hicks, Andy Lutomirski,
Will Drewry, linux-security-module, LKML
On Mon, Feb 13, 2017 at 10:37 PM, Andrei Vagin <avagin@virtuozzo.com> wrote:
> On Tue, Feb 07, 2017 at 03:18:51PM -0800, Kees Cook wrote:
>> The SECCOMP_RET_KILL filter return code has always killed the current
>> thread, not the entire process. Changing this as a side-effect of dumping
>> core isn't a safe thing to do (a few test suites have already flagged this
>> behavioral change). Instead, restore the RET_KILL semantics, but still
>> dump core when a RET_KILL delivers SIGSYS to a single-threaded process.
>>
>> Fixes: b25e67161c29 ("seccomp: dump core when using SECCOMP_RET_KILL")
>> Signed-off-by: Kees Cook <keescook@chromium.org>
>
> All CRIU tests passed with this patch. Thanks!
>
> Acked-by: Andrei Vagin <avagin@virtuozzo.com>
Thanks for testing!
James, can you make sure this makes it into your -next tree for v4.11?
Thanks!
-Kees
>
>> ---
>> kernel/seccomp.c | 13 ++++++++-----
>> 1 file changed, 8 insertions(+), 5 deletions(-)
>>
>> diff --git a/kernel/seccomp.c b/kernel/seccomp.c
>> index f8f88ebcb3ba..e15185c28de5 100644
>> --- a/kernel/seccomp.c
>> +++ b/kernel/seccomp.c
>> @@ -643,11 +643,14 @@ static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
>> default: {
>> siginfo_t info;
>> audit_seccomp(this_syscall, SIGSYS, action);
>> - /* Show the original registers in the dump. */
>> - syscall_rollback(current, task_pt_regs(current));
>> - /* Trigger a manual coredump since do_exit skips it. */
>> - seccomp_init_siginfo(&info, this_syscall, data);
>> - do_coredump(&info);
>> + /* Dump core only if this is the last remaining thread. */
>> + if (get_nr_threads(current) == 1) {
>> + /* Show the original registers in the dump. */
>> + syscall_rollback(current, task_pt_regs(current));
>> + /* Trigger a manual coredump since do_exit skips it. */
>> + seccomp_init_siginfo(&info, this_syscall, data);
>> + do_coredump(&info);
>> + }
>> do_exit(SIGSYS);
>> }
>> }
>> --
>> 2.7.4
>>
>>
>> --
>> Kees Cook
>> Pixel Security
--
Kees Cook
Pixel Security
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] seccomp: Only dump core when single-threaded
2017-02-14 19:09 ` Kees Cook
@ 2017-02-14 22:34 ` James Morris
2017-02-22 23:35 ` Andrei Vagin
0 siblings, 1 reply; 6+ messages in thread
From: James Morris @ 2017-02-14 22:34 UTC (permalink / raw)
To: Kees Cook
Cc: Andrei Vagin, James Morris, Mike Frysinger, Paul Moore,
Tyler Hicks, Andy Lutomirski, Will Drewry, linux-security-module,
LKML
On Tue, 14 Feb 2017, Kees Cook wrote:
> James, can you make sure this makes it into your -next tree for v4.11?
Queued for next at:
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git#next-queue
--
James Morris
<jmorris@namei.org>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] seccomp: Only dump core when single-threaded
2017-02-14 22:34 ` James Morris
@ 2017-02-22 23:35 ` Andrei Vagin
2017-02-23 0:01 ` Kees Cook
0 siblings, 1 reply; 6+ messages in thread
From: Andrei Vagin @ 2017-02-22 23:35 UTC (permalink / raw)
To: James Morris
Cc: Kees Cook, James Morris, Mike Frysinger, Paul Moore, Tyler Hicks,
Andy Lutomirski, Will Drewry, linux-security-module, LKML
On Wed, Feb 15, 2017 at 09:34:35AM +1100, James Morris wrote:
> On Tue, 14 Feb 2017, Kees Cook wrote:
>
> > James, can you make sure this makes it into your -next tree for v4.11?
>
> Queued for next at:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git#next-queue
The b25e67161c29 ("seccomp: dump core when using SECCOMP_RET_KILL") is
in the Linus' tree, but this patch isn't there yet. And I don't see it
event in linux-next.
Do you have any plan to push it into the linus' tree?
https://travis-ci.org/avagin/criu/builds/204341051
Thanks,
Andrei
>
> --
> James Morris
> <jmorris@namei.org>
>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] seccomp: Only dump core when single-threaded
2017-02-22 23:35 ` Andrei Vagin
@ 2017-02-23 0:01 ` Kees Cook
0 siblings, 0 replies; 6+ messages in thread
From: Kees Cook @ 2017-02-23 0:01 UTC (permalink / raw)
To: Andrei Vagin
Cc: James Morris, James Morris, Mike Frysinger, Paul Moore,
Tyler Hicks, Andy Lutomirski, Will Drewry, linux-security-module,
LKML
On Wed, Feb 22, 2017 at 3:35 PM, Andrei Vagin <avagin@virtuozzo.com> wrote:
> On Wed, Feb 15, 2017 at 09:34:35AM +1100, James Morris wrote:
>> On Tue, 14 Feb 2017, Kees Cook wrote:
>>
>> > James, can you make sure this makes it into your -next tree for v4.11?
>>
>> Queued for next at:
>>
>> git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git#next-queue
>
> The b25e67161c29 ("seccomp: dump core when using SECCOMP_RET_KILL") is
> in the Linus' tree, but this patch isn't there yet. And I don't see it
> event in linux-next.
>
> Do you have any plan to push it into the linus' tree?
>
> https://travis-ci.org/avagin/criu/builds/204341051
Yup, I already called James's attention to this. He just sent a pull
request with the fix.
-Kees
--
Kees Cook
Pixel Security
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2017-02-23 0:01 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-02-07 23:18 [PATCH] seccomp: Only dump core when single-threaded Kees Cook
2017-02-14 6:37 ` Andrei Vagin
2017-02-14 19:09 ` Kees Cook
2017-02-14 22:34 ` James Morris
2017-02-22 23:35 ` Andrei Vagin
2017-02-23 0:01 ` Kees Cook
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).