From: Kees Cook <keescook@chromium.org>
To: James Morris <jmorris@namei.org>
Cc: linux-security-module@vger.kernel.org,
linux-kernel@vger.kernel.org, Andy Lutomirski <luto@kernel.org>,
Kees Cook <keescook@chromium.org>
Subject: [PULL] seccomp update (next)
Date: Tue, 14 Jun 2016 10:57:29 -0700 [thread overview]
Message-ID: <20160614175729.GA20816@www.outflux.net> (raw)
Hi,
Please pull these seccomp changes for next. These have been tested by
myself and Andy, and close a long-standing issue with seccomp where tracers
could change the syscall out from under seccomp.
Thanks!
-Kees
The following changes since commit 40d273782ff16fe1a7445cc05c66a447dfea3433:
security: tomoyo: simplify the gc kthread creation (2016-06-06 20:23:55 +1000)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git tags/seccomp-next
for you to fetch changes up to 26703c636c1f3272b39bd0f6d04d2e970984f1b6:
um/ptrace: run seccomp after ptrace (2016-06-14 10:54:47 -0700)
----------------------------------------------------------------
Fix seccomp vs ptrace ordering to plug syscall filter bypass issue.
----------------------------------------------------------------
Andy Lutomirski (2):
seccomp: Add a seccomp_data parameter secure_computing()
x86/entry: Get rid of two-phase syscall entry work
Kees Cook (12):
seccomp: add tests for ptrace hole
seccomp: remove 2-phase API
seccomp: recheck the syscall after RET_TRACE
x86/ptrace: run seccomp after ptrace
arm/ptrace: run seccomp after ptrace
arm64/ptrace: run seccomp after ptrace
MIPS/ptrace: run seccomp after ptrace
parisc/ptrace: run seccomp after ptrace
s390/ptrace: run seccomp after ptrace
powerpc/ptrace: run seccomp after ptrace
tile/ptrace: run seccomp after ptrace
um/ptrace: run seccomp after ptrace
arch/arm/kernel/ptrace.c | 13 +-
arch/arm64/kernel/ptrace.c | 8 +-
arch/mips/kernel/ptrace.c | 9 +-
arch/parisc/kernel/ptrace.c | 9 +-
arch/powerpc/kernel/ptrace.c | 46 +++----
arch/s390/kernel/ptrace.c | 21 ++-
arch/tile/kernel/ptrace.c | 11 +-
arch/um/kernel/skas/syscall.c | 9 +-
arch/x86/entry/common.c | 106 +++-------------
arch/x86/entry/vsyscall/vsyscall_64.c | 2 +-
arch/x86/include/asm/ptrace.h | 6 -
include/linux/seccomp.h | 14 +-
kernel/seccomp.c | 144 ++++++++-------------
tools/testing/selftests/seccomp/seccomp_bpf.c | 176 ++++++++++++++++++++++++--
14 files changed, 309 insertions(+), 265 deletions(-)
--
Kees Cook
Chrome OS & Brillo Security
next reply other threads:[~2016-06-14 17:57 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-06-14 17:57 Kees Cook [this message]
2016-06-17 7:15 ` James Morris
2016-06-17 18:55 ` Andy Lutomirski
2016-06-18 7:02 ` Kees Cook
2016-06-18 10:21 ` Andy Lutomirski
2016-06-19 22:45 ` Andy Lutomirski
-- strict thread matches above, loose matches on Subject: below --
2016-07-07 17:59 Kees Cook
2016-07-07 23:47 ` James Morris
2016-01-05 23:40 Kees Cook
2015-07-15 18:56 Kees Cook
2015-07-20 6:58 ` James Morris
2014-11-25 19:43 Kees Cook
2014-11-26 13:23 ` James Morris
2014-11-26 21:46 ` Stephen Rothwell
2014-11-26 21:59 ` Kees Cook
2014-11-27 23:37 ` James Morris
2014-12-01 20:34 ` Kees Cook
2014-12-01 22:56 ` James Morris
2014-12-01 23:06 ` Kees Cook
2014-12-02 7:56 ` James Morris
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160614175729.GA20816@www.outflux.net \
--to=keescook@chromium.org \
--cc=jmorris@namei.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=luto@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®