Messages in this thread | | | Date | Mon, 23 Jan 2012 14:23:18 -0800 | Subject | Re: Compat 32-bit syscall entry from 64-bit task!? [was: Re: [RFC,PATCH 1/2] seccomp_filters: system call filtering using BPF] | From | Chris Evans <> |
| |
On Mon, Jan 23, 2012 at 8:56 AM, Oleg Nesterov <oleg@redhat.com> wrote: > On 01/18, Chris Evans wrote: >> >> Thanks, Oleg. Seems like this would be a nice change to have. As we >> can see, people do use ptrace() as a security technology. > > OK, I'll send it. > >> With this in place, you can also (where possible) set up the tracee >> with PR_SET_PDEATHSIG==SIGKILL. And then, you have defences again >> either of the tracer or tracee dying from a stray SIGKILL. > > This can only help if the tracer is the natural parent, is it enough? > > Indan suggested PTRACE_O_SIGKILL_ON_DEATH, perhaps it makes sense.
Yeah, this takes care of all cases.
One caveat I can think of with the implementation: in the parent exit() path, the child's SIGKILL needs to be delivered _before_ the tracer is detached. Otherwise it might feasible wake up and run for a bit :)
Cheers Chris
> > Oleg. >
| |