Messages in this thread | | | Date | Wed, 18 Jan 2012 02:04:53 +0000 | From | Jamie Lokier <> | Subject | Re: Compat 32-bit syscall entry from 64-bit task!? [was: Re: [RFC,PATCH 1/2] seccomp_filters: system call filtering using BPF] |
| |
Andi Kleen wrote: > > Our ptrace jailer is checking cs to figure out if a task is a compat task > > or not, if the kernel can change that behind our back it means our jailer > > Every user program change it behind your back. .. > Look up far jumps in any x86 manual.
I'm pretty sure this isn't about changing cs or far jumps
I think Indan means code is running with 64-bit cs, but the kernel treats int $0x80 as a 32-bit syscall and sysenter as a 64-bit syscall, and there's no way for the ptracer to know which syscall the kernel will perform, even by looking at all registers. It looks like a hole in ptrace which could be fixed.
-- Jamie
| |