Messages in this thread | | | From | "Amanieu d'Antras" <> | Date | Wed, 19 May 2021 17:14:33 +0100 | Subject | Re: [RESEND PATCH v4 8/8] arm64: Allow 64-bit tasks to invoke compat syscalls |
| |
On Wed, May 19, 2021 at 4:30 PM Steven Price <steven.price@arm.com> wrote: > Perhaps I'm missing something, but surely some syscalls that would be > native on 32 bit will have to be translated by Tango to 64 bit syscalls > to do the right thing? E.g. from the previous patch compat sigreturn > isn't available.
That's correct.
Tango handles syscalls in 3 different ways: - ~20 syscalls are completely emulated in userspace or through 64-bit syscalls. E.g. sigaction, sigreturn, clone, exit. - Another ~50 syscalls have various forms of pre/post-processing, but are otherwise passed on to the kernel compat syscall handler. E.g. open, mmap, ptrace. - The remaining syscalls are passed on to the kernel compat syscall handler directly.
The first group of ~20 syscalls will effectively bypass the user-specified seccomp filter: any 64-bit syscalls used to emulate them will be whitelisted. I consider this an acceptable limitation to Tango's seccomp support since I see no viable way of supporting seccomp filtering for these syscalls.
> In those cases to correctly emulate seccomp, isn't Tango is going to > have to implement the seccomp filter in user space?
I have not implemented user-mode seccomp emulation because it can trivially be bypassed by spawning a 64-bit child process which runs outside Tango. Even when spawning another translated process, the user-mode filter will not be preserved across an execve.
> I guess the question comes down to how big a hole is > syscall_in_tango_whitelist() - if Tango only requires a small set of > syscalls then there is still some security benefit, but otherwise this > doesn't seem like a particularly big benefit considering you're already > going to need the BPF infrastructure in user space.
Currently Tango only whitelists ~50 syscalls, which is small enough to provide security benefits and definitely better than not supporting seccomp at all.
| |