From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751181AbdAYAyG (ORCPT ); Tue, 24 Jan 2017 19:54:06 -0500 Received: from mail-eopbgr30095.outbound.protection.outlook.com ([40.107.3.95]:62208 "EHLO EUR03-AM5-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751063AbdAYAyC (ORCPT ); Tue, 24 Jan 2017 19:54:02 -0500 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=avagin@virtuozzo.com; Date: Tue, 24 Jan 2017 16:53:45 -0800 From: Andrei Vagin To: Mike Frysinger CC: , , , , Mike Frysinger Subject: Re: seccomp: dump core when using SECCOMP_RET_KILL Message-ID: <20170125005338.GA30407@outlook.office365.com> References: <20170120042857.18953-1-vapier@gentoo.org> MIME-Version: 1.0 Content-Type: text/plain; charset="koi8-r" Content-Disposition: inline In-Reply-To: <20170120042857.18953-1-vapier@gentoo.org> User-Agent: Mutt/1.7.1 (2016-10-04) X-Originating-IP: [162.246.95.100] X-ClientProxiedBy: CY1PR12CA0076.namprd12.prod.outlook.com (10.163.230.44) To DB6PR0801MB1975.eurprd08.prod.outlook.com (10.168.85.148) X-MS-Office365-Filtering-Correlation-Id: bd630866-33ed-43a1-551a-08d444bca563 X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001);SRVR:DB6PR0801MB1975; X-Microsoft-Exchange-Diagnostics: 1;DB6PR0801MB1975;3:QJG8yRS0tREg4IDT8X4nX5xYY9KdW6bVHGBc93oDhctqo35kN0PNS3n4i4bFOVNteGqGMKbTJnXnuAeDvUskT0K2xiC7S7bAqxwtlsxgLA+GtcMk/gp4zwsvzbRdPgWZqSenhq7IU80yAUD9YrQgTdu6TYEzbs1tWjhuczXUBlBw3WnGLYE086pQNBb1IRJZfSfgvyjW9bM6cx2CwAyS2jTli2PtQW7kafljF6BKNH3+cGa46JfWeX7TZVwlzxTgHgLrGb4Hk2m9JlLt2Q9xvA==;25:YMMmS5bgeCwlSf4O6hd8BMm8zDo4dIdHHISFiAEyzz953v/lvUuuY/U/qooKVp+FZa2PrW/BUNANfQ3/H7ggdnWYbt+KKdyif1DW3+DMzD+NznJ2jcLcEzY/vN7njx4wUepGarvOko/Dv7JtDrEpweLQKl/be+iVuHPLlRrZpif2qJnqp+BePaRvE6lheJQcrSe9LA6BtdmZbX4h9kuAY6iVMDeCjf3OvjNSk2QhyshOcXb/eoMdg4D2nA32f6nGc8NnGhr2bmCL6GqM3Yds7EeWMcQ8UJbb0rdRYSZ034sDcGblduRVnsIz1MfnnmXgVtT6Sx8hyPsLGUNVn/NVIGL71fIPJ6gauULEPptF8PNvybxutCAKBBGNCEd3J1p9sb50x6ZOc72KFyZeM+JlNSlxQMlEVSFhaTQRPB+aJOFshQnE6/sDLU6YrpmIeBBEnm4cHT7MKkg6bmYPcwg32g== X-Microsoft-Exchange-Diagnostics: 1;DB6PR0801MB1975;31:rcK0jRXhOwWco4mOJfvXI01imZIi9wHtGJkrPQOJaFwIMAapwGz5MrGJ53Sk/KATxwZRIs04rbJDHvtfv3Y0Bv7wHaugokHAP+jO2/Huoeg7QbBRPOylsTaW7Hcg9M2ZI3knJI/V37ii//skwq5gT0oBKCcTqqsDhbIn02yQe+GVTZvNg61EQVPADmfAShbfYyT/8isOnIHtS9SdtyYB+Ps/H21NzpE2Pjx45QaqI0kmFHIKqPP8k+reVp0+qlbyYMDhHdrkymwNLu4ARfVfEA==;20:QAVJ4QBvmcEpWkXLLr7c86788QZLGnMRGT9jlPYf5WHL3L2XgUAuFneNcd8VtBobzPoDgHotp9IFChFNfuKnVOSlx4FwREXxhs4fG0If35f95OYvQ8rFsp6CKeH9FIrOotiFqSCQOqYFZcopYI4L16VGsYJJIe+MiXBXbvLWJiWH6hdykDl+6Bkv9H19+AXbuwSp3Ebxi/CAOFcAZVjTBH6jZyEDNkYOg/7iOfP9s1ZZ01FKQqlnwHOSbnwmrMiE X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(166708455590820)(192374486261705)(211171220733660); X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040375)(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001)(6041248)(20161123562025)(20161123558021)(20161123564025)(20161123560025)(20161123555025)(6072148);SRVR:DB6PR0801MB1975;BCL:0;PCL:0;RULEID:;SRVR:DB6PR0801MB1975; X-Microsoft-Exchange-Diagnostics: 1;DB6PR0801MB1975;4:AtdVkzzl4lkqihtBUh+UCDuMEw5r5uVbm2OCwQCoGJRZMQZB3dWOlwZpWYIHa1+Kytvr+g73veqgoyNnGXmp8e28ci2Plc8Pmh6v3GlOFFm2pmkGi4mYY8EGRjtCGiNFGwD4Q3g9mUnu/GyQNVGitepr7X2Kb9KbubcseBhDEOdobddY8SOR+asVeGI1EiMkMXx1qxe+f3n1t4fbNG0qkWwiQOjYcZAOhlHGEmU2lG97QtWR7Qt/aqoI+zbTzTotw3IRKXN4OybWoAfAfpsp4pBVojipUDVNkIfNW97ZY4RTVqHG+iIJq6K0832PH4/9cWbcTzaXnGJlXFNKzeW/BLXVOVRH3tuirIs1MqCVp6hmklGvA1S7Hn4oMbILaCfpZlLPuFLAfnaZEdINlvmmD0KjW2GC5eh9+s/mfmzhupNDk7VMqiOAygmVGNvDMJcoKsoy4x4gtiL5CGvN7fj75WjA65E9p+tFR0txtXD6lnLcE3xt8AMP4OUF2VqPmBv8mcskIoFezpIpkBIqWoG14t3KHi0unULvGdLHjMlwOMU0n23OXQFn0/siQCzVmlLExOBhzZVBfHkMRFXI5HnZHuMJo4BXw+ksovTTmmw85uaOFqdqn9+SZxekoXzp7db4igVjd6hJrTYX7MG33l8VrhrFFkJZCdLASgezFvIQVtok9lnCjwvaku3QXE5waOD5XKyFyMpCCv1brvf9DCdhaTXMhbFXD9qAU+uaBoOA7MI= X-Forefront-PRVS: 01986AE76B X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(4630300001)(6009001)(7916002)(39830400002)(39450400003)(39410400002)(189002)(199003)(24454002)(189998001)(25786008)(6116002)(3846002)(66066001)(55016002)(23686003)(68736007)(101416001)(5660300001)(81166006)(8676002)(50986999)(4326007)(6506006)(53416004)(105586002)(38730400001)(76176999)(2906002)(69596002)(47776003)(54356999)(81156014)(106356001)(229853002)(86362001)(42186005)(1076002)(305945005)(53936002)(97736004)(2950100002)(9686003)(6916009)(54906002)(110136003)(4001350100001)(83506001)(92566002)(6306002)(7736002)(50466002)(33656002)(6666003)(7099028)(18370500001)(26326002);DIR:OUT;SFP:1102;SCL:1;SRVR:DB6PR0801MB1975;H:outlook.office365.com;FPR:;SPF:None;PTR:InfoNoRecords;MX:1;A:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?koi8-r?Q?1;DB6PR0801MB1975;23:9QiSL7GUAJ20xj7rwD9ptOJFLWmbW6Efd/yfasaj0?= =?koi8-r?Q?3kLs8Sz3Cg/hi08WS8jm52Z7Wxf0A0/1WmDxyrrKS4GfLLfOnvEetXWpA2MIQG?= =?koi8-r?Q?ffOuACjMW09+sCOVNfSxBHASZb2QWI4O6SpEardWgnUn6KeIwUSZVqkSK1ZZdO?= =?koi8-r?Q?w+F3dDlnQH9xwWpP2uurYla9soInRJ9jFf91fbaAI2zAVVRteo56eOb50DoQgo?= =?koi8-r?Q?oMIsBoR02Ihh3z+gmQc7GiS62IXyT2hVWe1k6ExbY+fBRjHln84AoH1SAglNbN?= =?koi8-r?Q?QsA9ToVYx5PODujTdv+CgujCbvAGd43LsbT2ofNb7tMVBWljJaEP47lq2J2mm3?= =?koi8-r?Q?Pf9mGgyjWnEV9/2/ZVW7+Yecc6jW8eDdy1rdG+gqv4k0resgwiILyrmj58YskS?= =?koi8-r?Q?zoKXUHdO+OtCpVirqi4owAd3DGVe/NFYUK/4U7ktt4VKX0vVmAsVp53AYboS//?= =?koi8-r?Q?6L7S5qlT/SKbJ422tVeG32jdi3vtehetC82NTWVluKQO6lEtmr6tiCtFFEGdv3?= =?koi8-r?Q?u1cEVH4LAPiaN+ZGVfv8ES2kZl9lQErqIghkliP+eSsqxQz87vjTqYPW5rzPQh?= =?koi8-r?Q?uP7H1Fl9wHmyicwD1QViftdXAcw6ELBJt7buIP/lmK+khV2VsAeFrS1WbIaQN0?= =?koi8-r?Q?FM4Utt9iPGDTu/9pKuSDBSr+BbMdrMo2MvZYX+vBCFcUqNyN/z8GeBhvLs/AiJ?= =?koi8-r?Q?tgtWjfxwqiTNcVx5y9UijdXxuRUygG0Y3UVtxNTc8vv8vmblSsTZi1Y/HxAE5k?= =?koi8-r?Q?eJtgXtk1AODbxfuEVmkHhA6ovx1YTEjdbnkbqycHPhTAmmJtqENQa5M5tw98FF?= =?koi8-r?Q?WZtVaIqjKT3vyGFOYXspDPd/fSetvXHHJDxk9MAau+lRcium9LSduUR/CX4jDr?= =?koi8-r?Q?GoQsZ2D873DPzewNEuKw5i7EwnWrv2iC134LAB+hwjluBjVwlfXmXoBPHNWGIz?= =?koi8-r?Q?54bucbEjZB2pEqYcy7NVnl/mhpeTyjnhxEXNyiIt1bZRn1UpnJKKxnKB4dxBt/?= =?koi8-r?Q?gpQ2hC/QGBbG/wi5nhmHpb9LDBltYLNspMUmLn6avB0jJw+Cz30h0xK+2eWGOH?= =?koi8-r?Q?VTfuueH2iDxFUmrP3aqa4FJHtvE9sZ9FXQjAkBdG2olrJYfiEs7BVtsNGMpWsK?= =?koi8-r?Q?BaqnvXwt3/iz3uSqIN3Ry9KMUEbQdzfWwu5uOS+7eFwqt63oAoqmRjcKJovErI?= =?koi8-r?Q?WmlFtVEedPCJ+TAyUeLJKgWOnyHc343gvnz7IQhXc1io1naFgJiW4N3ioCOwf/?= =?koi8-r?Q?mPCXIA4R30BnF8OjvmUUNhWrjGq1p9ihED45FbUB4ozCoZfIni/zA9O6wZn4V6?= =?koi8-r?Q?/WltTaAICTUPjD4484jO7P5Obnn5bVoS3JyDgIzK9YR8=3D?= X-Microsoft-Exchange-Diagnostics: 1;DB6PR0801MB1975;6:LuUkWdiCyf4wIpHF2b2LhpSqXelD6VpOUIDUK/AzQZKBE25k8g+dZqORKT9Y4lNuQBgm6JZPcydQEKVpRMD23AWmrIntEPrXnU7QLyGkQf+OdGiZvo2h1kf5RlK7ufxZRbWtTjY3lMzqNAu9Mocx2jsarMbMbXiage6+vxTXNztC8XOXSfi1yQa9d69hdClak8B/1uloJbWLNbSrbd6HB6RyeeXksCMm0Jw1xNssk6nATnRCcFEqmvI+b+dnR8AHsHxkvoD/TrujePT2t3nQ0os8XNGbWuw3CcumZlsUQJuTfLTMACFIX9ICmAvZHrpJ49C0R79mBqpZIQrZWdbiMtkOt3R4v1qyCKDQXd2QTPGkp/Z3TE5hEjn47FiMsq9aOvtZX/16+q7dH9OiHSsEl5qDjv1yL7D+BvDZEYmWYWY=;5:d9KIqB9PdHsLDtgAWE5ZAA+B+gJ7eUojRH4eDUdAsmmOniJvzwydlHmTXTpTj96RA+tCz5+cFexiqgp+Q63V1zIbhOWLc0l4dKKByqDfeMr8M6sSk+vSXlm7PkY5XwcZNtgGo1XnPVRrupEJfQlejg==;24:YpXZqJ5jf4TCnBcA0HmzngM0pDUMVG1X1towuJwtItf4kFMGGWgqjXFL6KIVLfHGexXRgqweVu/YpTEpaD9MCu6/ckNPAGrEmYyki6z6WH4= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;DB6PR0801MB1975;7:zU3SszrqfwBKmzM4xQz/3z5xHTYFXN4ad5AgFqXgmOR9z5UIIJbJJ6cr79YXhZhHH3jKGPsNBqaE+LP1ARqclhxoDM96GT+xifnu4QjAmLOxUx/PbKY+QH0CjPuewSSOQZCwgDJzcJRc9U6Q5u9m78iCmWFZW0cYpa6doaW19LdfV+o3eaG1Y+XsUQmPCxnroFEI3y+bAGIm6F4tOS4x4s/5MOV5mgSB2nrA698J5v0wTt/xTPDBxrsJuJAL9QbKoOvijbk2nQYBcr4oZBW3oJABJk7xQQwLNKXRY5gUUVPkZimpJ+QviAdKaUMLrOd0HUqq99v2gl5PM2beAJjh4zp1i7WCIAvXRIcjAF/oi0U3e659bq7woYZmgUlkbSGdoY4mx8Ilf1siPuKftq/e2Dtn21PO1F69oRZxylgf92u4al3gjJf3Vtpl3fK+OnA18R2mFxhQqU0nJ6IGSPuw1w==;20:YvO8C/dhsrnAnDMt0AEQJmIUShJFrAYDRlBxn/UATlZc2Z9y/oZmnY301cvFoW8UCJ3no7jQymgic+KKCY5iKFEDcp1u84GGR+76jPUGgOA2lU9jSglzGW1+CLpXsKG2zg38GNM5u4IoocGbx00iA9j1Ws9sRb/hCtp2SQhjOTw= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Jan 2017 00:53:57.3683 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0801MB1975 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi, One of CRIU tests fails with this patch: https://github.com/xemul/criu/blob/master/test/zdtm/static/seccomp_filter_tsync.c Before this patch only a thread which called a "wrong" syscall is killed. Now a whole process is killed if one of threads called a "wrong" syscall. Before this patch only one thread is killed: 512 seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, {len=4, filter=0x7fffe111fb10} 484 kill(30, SIG_0) = 0 484 write(1, "Wait for zdtm/static/seccomp_filter_tsync(30) to die for 0.100000\n", 66 512 <... seccomp resumed> ) = 0 512 futex(0x606420, FUTEX_WAKE_PRIVATE, 1 484 <... write resumed> ) = 66 512 <... futex resumed> ) = 1 484 select(0, NULL, NULL, NULL, {tv_sec=0, tv_usec=100000} 512 futex(0x7f9e894a19d0, FUTEX_WAIT, 32, NULL 513 <... futex resumed> ) = 0 513 futex(0x606420, FUTEX_WAKE_PRIVATE, 1) = 0 513 ptrace(PTRACE_TRACEME) = ? 513 +++ killed by SIGSYS +++ 512 <... futex resumed> ) = 0 After this patch a whole process is killed: 767 seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, {len=4, filter=0x7ffdeedbcd20}) = 0 767 futex(0x606420, FUTEX_WAKE_PRIVATE, 1) = 1 768 <... futex resumed> ) = 0 767 futex(0x7fab05b229d0, FUTEX_WAIT, 32, NULL 768 futex(0x606420, FUTEX_WAKE_PRIVATE, 1) = 0 768 ptrace(PTRACE_TRACEME 767 <... futex resumed>) = ? 768 <... ptrace resumed>) = ? 768 +++ killed by SIGSYS (core dumped) +++ 767 +++ killed by SIGSYS (core dumped) +++ 766 <... wait4 resumed> [{WIFSIGNALED(s) && WTERMSIG(s) == SIGSYS && WCOREDUMP(s)}], 0, NULL) = 31 766 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=31, si_ Steps to reproduce: $ git clone git://github.com/xemul/criu $ cd criu/test/zdtm/static/ $ make seccomp_filter_tsync.out $ cat seccomp_filter_tsync.out On Thu, Jan 19, 2017 at 10:28:57PM -0600, Mike Frysinger wrote: > From: Mike Frysinger > > The SECCOMP_RET_KILL mode is documented as immediately killing the > process as if a SIGSYS had been sent and not caught (similar to a > SIGKILL). However, a SIGSYS is documented as triggering a coredump > which does not happen today. > > This has the advantage of being able to more easily debug a process > that fails a seccomp filter. Today, most apps need to recompile and > change their filter in order to get detailed info out, or manually run > things through strace, or enable detailed kernel auditing. Now we get > coredumps that fit into existing system-wide crash reporting setups. > > >From a security pov, this shouldn't be a problem. Unhandled signals > can already be sent externally which trigger a coredump independent of > the status of the seccomp filter. The act of dumping core itself does > not cause change in execution of the program. > > URL: https://crbug.com/676357 > Signed-off-by: Mike Frysinger > Acked-by: Jorge Lucangeli Obes > Acked-by: Kees Cook > Acked-by: Kees Cook > --- > kernel/seccomp.c | 29 +++++++++++++++++++++-------- > 1 file changed, 21 insertions(+), 8 deletions(-) > > diff --git a/kernel/seccomp.c b/kernel/seccomp.c > index f7ce79a46050..f8f88ebcb3ba 100644 > --- a/kernel/seccomp.c > +++ b/kernel/seccomp.c > @@ -16,6 +16,7 @@ > #include > #include > #include > +#include > #include > #include > #include > @@ -486,6 +487,17 @@ void put_seccomp_filter(struct task_struct *tsk) > } > } > > +static void seccomp_init_siginfo(siginfo_t *info, int syscall, int reason) > +{ > + memset(info, 0, sizeof(*info)); > + info->si_signo = SIGSYS; > + info->si_code = SYS_SECCOMP; > + info->si_call_addr = (void __user *)KSTK_EIP(current); > + info->si_errno = reason; > + info->si_arch = syscall_get_arch(); > + info->si_syscall = syscall; > +} > + > /** > * seccomp_send_sigsys - signals the task to allow in-process syscall emulation > * @syscall: syscall number to send to userland > @@ -496,13 +508,7 @@ void put_seccomp_filter(struct task_struct *tsk) > static void seccomp_send_sigsys(int syscall, int reason) > { > struct siginfo info; > - memset(&info, 0, sizeof(info)); > - info.si_signo = SIGSYS; > - info.si_code = SYS_SECCOMP; > - info.si_call_addr = (void __user *)KSTK_EIP(current); > - info.si_errno = reason; > - info.si_arch = syscall_get_arch(); > - info.si_syscall = syscall; > + seccomp_init_siginfo(&info, syscall, reason); > force_sig_info(SIGSYS, &info, current); > } > #endif /* CONFIG_SECCOMP_FILTER */ > @@ -634,10 +640,17 @@ static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd, > return 0; > > case SECCOMP_RET_KILL: > - default: > + default: { > + siginfo_t info; > audit_seccomp(this_syscall, SIGSYS, action); > + /* Show the original registers in the dump. */ > + syscall_rollback(current, task_pt_regs(current)); > + /* Trigger a manual coredump since do_exit skips it. */ > + seccomp_init_siginfo(&info, this_syscall, data); > + do_coredump(&info); > do_exit(SIGSYS); > } > + } > > unreachable(); >