Messages in this thread | | | Date | Wed, 02 Feb 2011 21:14:41 +0900 | From | Masami Hiramatsu <> | Subject | Re: Using ftrace/perf as a basis for generic seccomp |
| |
Hi Eric,
(2011/02/01 23:58), Eric Paris wrote: > On Wed, Jan 12, 2011 at 4:28 PM, Eric Paris <eparis@redhat.com> wrote: >> Some time ago Adam posted a patch to allow for a generic seccomp >> implementation (unlike the current seccomp where your choice is all >> syscalls or only read, write, sigreturn, and exit) which got little >> traction and it was suggested he instead do the same thing somehow using >> the tracing code: >> http://thread.gmane.org/gmane.linux.kernel/833556
Hm, interesting idea :) But why would you like to use tracing code? just for hooking?
>> The actual method that this could be achieved was apparently left as an >> exercise for the reader. Since I'd like to do something similar (and >> actually basically reimplemented Adam's code before I found this thread) >> I guess that makes me the reader. I've never touched >> perf/ftrace/whatever so I'm not even knowledgeably enough to ask good >> questions so please, try to talk to me like a 2 year old.
OK, I'll try to explain;
Ftrace/perf syscall event tracing is based on syscall tracepoints (sys_enter and sys_exit) which are implemented as a special hook requiring TIF_SYSCALL_TRACEPOINT.
--<arch/x86/kernel/ptrace.c>-- asmregparm long syscall_trace_enter(struct pt_regs *regs) { long ret = 0; [...] /* do the secure computing check first */ secure_computing(regs->orig_ax); <-- secomp!
if (unlikely(test_thread_flag(TIF_SYSCALL_EMU))) ret = -1L;
if ((ret || test_thread_flag(TIF_SYSCALL_TRACE)) && tracehook_report_syscall_entry(regs)) ret = -1L;
if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT))) trace_sys_enter(regs, regs->orig_ax); <--here! ----
All syscalls issued by threads which has TIF_SYSCALL_TRACEPOINT kick trace_sys_enter() tracepoint, and then the tracepoint calls ftrace handler or perf handler.
And this tracepoint is not only for ftrace/perf, but also you can use it directly via register_trace_sys_enter() (the tracepoint can be shared among several handlers). If you just want to hook the syscall entry, I recommend that instead of modifying ftrace/perf. See kernel/trace/trace_syscalls.c, Documentation/trace/tracepoints.txt and samples/tracepoints/ for details.
However, I think here is an ordering problem. As you can see, secomp hook is done before these hooks, that might cause a problem because tracehook_report_syscall_entry(), which is also done before tracepoint, is used by ptrace(). This means that someone can hook into an unsafe syscall via debugger.
So, finally, I think you'd better expand secure_computing() hook, or introduce more generic hook-point.
Thank you,
-- Masami HIRAMATSU 2nd Dept. Linux Technology Center Hitachi, Ltd., Systems Development Laboratory E-mail: masami.hiramatsu.pt@hitachi.com
| |