Re: [PATCH v2 2/3] arm64: Add seccomp support

[AKASHI Takahiro]

On 03/01/2014 02:20 AM, Will Deacon wrote:
> On Tue, Feb 25, 2014 at 09:20:24AM +0000, AKASHI Takahiro wrote:
> > secure_computing() should always be called first in syscall_trace(), and
> > if it returns non-zero, we should stop further handling. Then that system
> > call may eventually fail, be trapped or the process itself be killed
> > depending on loaded rules.
>
> [...]
>
> > diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
> > index d4ce70e..f2a74bc 100644
> > --- a/arch/arm64/kernel/ptrace.c
> > +++ b/arch/arm64/kernel/ptrace.c
> > @@ -20,12 +20,14 @@
> >    */
> >
> >   #include <linux/audit.h>
> > +#include <linux/errno.h>
> >   #include <linux/kernel.h>
> >   #include <linux/sched.h>
> >   #include <linux/mm.h>
> >   #include <linux/smp.h>
> >   #include <linux/ptrace.h>
> >   #include <linux/user.h>
> > +#include <linux/seccomp.h>
> >   #include <linux/security.h>
> >   #include <linux/init.h>
> >   #include <linux/signal.h>
> > @@ -1064,6 +1066,10 @@ asmlinkage int syscall_trace(int dir, struct pt_regs *regs)
> >   {
> >   	unsigned long saved_reg;
> >
> > +	if (!dir && secure_computing((int)regs->syscallno))
>
> Why do you need this cast to (int)?

OK. I will remove it because gcc doesn't complain about it anyway.

> Also, it's probably better to check for
> -1 explicitly here.

I wil fix it.

> I'm slightly surprised that we do the secure computing check first. Doesn't
> this allow a debugger to change the syscall to something else after we've
> decided that it's ok?

To be honest, I just followed other architectures' implementation.
Can you elaborate any use case that you have in your mind?

-Takahiro AKASHI

> Will
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/