[lkml]   [2011]   [Feb]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: Using ftrace/perf as a basis for generic seccomp
    Hi Eric,

    (2011/02/01 23:58), Eric Paris wrote:
    > On Wed, Jan 12, 2011 at 4:28 PM, Eric Paris <> wrote:
    >> Some time ago Adam posted a patch to allow for a generic seccomp
    >> implementation (unlike the current seccomp where your choice is all
    >> syscalls or only read, write, sigreturn, and exit) which got little
    >> traction and it was suggested he instead do the same thing somehow using
    >> the tracing code:

    Hm, interesting idea :)
    But why would you like to use tracing code? just for hooking?

    >> The actual method that this could be achieved was apparently left as an
    >> exercise for the reader. Since I'd like to do something similar (and
    >> actually basically reimplemented Adam's code before I found this thread)
    >> I guess that makes me the reader. I've never touched
    >> perf/ftrace/whatever so I'm not even knowledgeably enough to ask good
    >> questions so please, try to talk to me like a 2 year old.

    OK, I'll try to explain;

    Ftrace/perf syscall event tracing is based on syscall tracepoints
    (sys_enter and sys_exit) which are implemented as a special hook

    asmregparm long syscall_trace_enter(struct pt_regs *regs)
    long ret = 0;
    /* do the secure computing check first */
    secure_computing(regs->orig_ax); <-- secomp!

    if (unlikely(test_thread_flag(TIF_SYSCALL_EMU)))
    ret = -1L;

    if ((ret || test_thread_flag(TIF_SYSCALL_TRACE)) &&
    ret = -1L;

    if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
    trace_sys_enter(regs, regs->orig_ax); <--here!

    All syscalls issued by threads which has TIF_SYSCALL_TRACEPOINT
    kick trace_sys_enter() tracepoint, and then the tracepoint calls
    ftrace handler or perf handler.

    And this tracepoint is not only for ftrace/perf, but also you
    can use it directly via register_trace_sys_enter() (the tracepoint
    can be shared among several handlers). If you just want to hook
    the syscall entry, I recommend that instead of modifying ftrace/perf.
    See kernel/trace/trace_syscalls.c, Documentation/trace/tracepoints.txt
    and samples/tracepoints/ for details.

    However, I think here is an ordering problem. As you can see, secomp
    hook is done before these hooks, that might cause a problem because
    tracehook_report_syscall_entry(), which is also done before tracepoint,
    is used by ptrace().
    This means that someone can hook into an unsafe syscall via debugger.

    So, finally, I think you'd better expand secure_computing() hook, or
    introduce more generic hook-point.

    Thank you,

    Masami HIRAMATSU
    2nd Dept. Linux Technology Center
    Hitachi, Ltd., Systems Development Laboratory

     \ /
      Last update: 2011-02-02 13:17    [W:0.023 / U:30.700 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site