Messages in this thread | | | Date | Thu, 19 Jan 2012 16:04:29 +0000 | From | Jamie Lokier <> | Subject | Re: Compat 32-bit syscall entry from 64-bit task!? [was: Re: [RFC,PATCH 1/2] seccomp_filters: system call filtering using BPF] |
| |
Andi Kleen wrote: > > Not everybody. There are programs which try hard to distinguish between > > int80 and syscall. One such example is a sandbox for programming contests > > I wrote several years ago. It analyses the instruction before EIP and as > > it does not allow threads nor executing writeable memory, it should be > > correct. > > There are other ways to break it, like using the syscall itself to change > input arguments or using ptrace from another process and other ways. > > Generally there are so many races with ptrace that if you want to do > things like that it's better to use a LSM. That's what they are for.
I could see the LSM approach working *if* there was an LSM module to make it available to unpriviledged userspace. I.e. a replacement for ptrace() for this purpose.
It would be nice to be able to trace and check syscall strings properly.
-- Jamie
| |