lkml.org 
[lkml]   [2005]   [Aug]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [patch 1/1] Ptrace - i386: fix "syscall audit" interaction with singlestep
blaisorblade@yahoo.it wrote:
>
>
> From: Bodo Stroesser <bstroesser@fujitsu-siemens.com>, Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
> CC: Roland McGrath <roland@redhat.com>
>
> Avoid giving two traps for singlestep instead of one, when syscall auditing is
> enabled.
>
> In fact no singlestep trap is sent on syscall entry, only on syscall exit, as
> can be seen in entry.S:
>
> # Note that in this mask _TIF_SINGLESTEP is not tested !!! <<<<<<<<<<<<<<
> testb $(_TIF_SYSCALL_TRACE|_TIF_SYSCALL_AUDIT|_TIF_SECCOMP),TI_flags(%ebp)
> jnz syscall_trace_entry
> ...
> syscall_trace_entry:
> ...
> call do_syscall_trace
>
> But auditing a SINGLESTEP'ed process causes do_syscall_trace to be called, so
> the tracer will get one more trap on the syscall entry path, which it
> shouldn't.
>
> This does not affect (to my knowledge) UML, nor is critical, so this shouldn't
> IMHO go in 2.6.13.
>
> Signed-off-by: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
> ---
>
> linux-2.6.git-paolo/arch/i386/kernel/ptrace.c | 15 +++++++++++++--
> 1 files changed, 13 insertions(+), 2 deletions(-)
>
> diff -puN arch/i386/kernel/ptrace.c~sysaudit-singlestep-non-umlhost arch/i386/kernel/ptrace.c
> --- linux-2.6.git/arch/i386/kernel/ptrace.c~sysaudit-singlestep-non-umlhost 2005-07-26 20:22:40.000000000 +0200
> +++ linux-2.6.git-paolo/arch/i386/kernel/ptrace.c 2005-07-26 20:23:44.000000000 +0200
> @@ -683,8 +683,19 @@ void do_syscall_trace(struct pt_regs *re
> /* do the secure computing check first */
> secure_computing(regs->orig_eax);
>
> - if (unlikely(current->audit_context) && entryexit)
> - audit_syscall_exit(current, AUDITSC_RESULT(regs->eax), regs->eax);
> + if (unlikely(current->audit_context)) {
> + if (entryexit)
> + audit_syscall_exit(current, AUDITSC_RESULT(regs->eax), regs->eax);
> +
> + /* Debug traps, when using PTRACE_SINGLESTEP, must be sent only
> + * on the syscall exit path. Normally, when TIF_SYSCALL_AUDIT is
> + * not used, entry.S will call us only on syscall exit, not
> + * entry ; so when TIF_SYSCALL_AUDIT is used we must avoid
> + * calling send_sigtrap() on syscall entry.
> + */
> + else if (is_singlestep)
> + goto out;
> + }
>

This appears to be a UML patch, applied to x86, which has no `is_singlestep'.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-08-31 04:09    [W:0.071 / U:1.756 seconds]
©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site