From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1750978AbdAaVs1 (ORCPT ); Tue, 31 Jan 2017 16:48:27 -0500 Received: from mail-eopbgr00117.outbound.protection.outlook.com ([40.107.0.117]:37799 "EHLO EUR02-AM5-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1750727AbdAaVsW (ORCPT ); Tue, 31 Jan 2017 16:48:22 -0500 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=avagin@virtuozzo.com; Date: Tue, 31 Jan 2017 13:47:38 -0800 From: Andrei Vagin To: Kees Cook CC: Mike Frysinger , LKML , Andy Lutomirski , Will Drewry , Mike Frysinger , Tyler Hicks , linux-security-module , James Morris , Paul Moore , Tycho Andersen Subject: Re: seccomp: dump core when using SECCOMP_RET_KILL Message-ID: <20170131214737.GB10892@outlook.office365.com> References: <20170120042857.18953-1-vapier@gentoo.org> <20170125005338.GA30407@outlook.office365.com> MIME-Version: 1.0 Content-Type: text/plain; charset="koi8-r" Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.7.1 (2016-10-04) X-Originating-IP: [162.246.95.100] X-ClientProxiedBy: BN6PR03CA0009.namprd03.prod.outlook.com (10.168.230.147) To VI1PR0801MB1983.eurprd08.prod.outlook.com (10.173.74.16) X-MS-Office365-Filtering-Correlation-Id: 175d2331-3019-44cc-3ffe-08d44a22ccc8 X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001);SRVR:VI1PR0801MB1983; X-Microsoft-Exchange-Diagnostics: 1;VI1PR0801MB1983;3:bupl431NITF/5shUzwYVp+1z0wh8JrTYDIR8UlL8y5g6c88AhoAoURU/Iu4k4modiacpmcoFG7jN+0U1gXwKb9ToW5xiGhf1eCdEOXodzKgWEFAxKCdpfFUrVA2NtYy2gU9ZTBCt1/Q3uV6154P+jPqbkjCniCy5eGhMm6hyyPtxNMJB878ctK+w6VasFxTbrp6rkLTm4azL54EX/eL9ojwlnANOaIa7Yv0/8VVPsaM6/CMv05/y87Swq1k1S1KOYVErKkdHPZo9+bOvqXwioQ==;25:Z26dqB64R03OF/9+S03juCcaJNmaSSzWUeXqCqihsDYOroyVLyvh7fb6bkp7cLNfyXxcFS5ytPvpONwSEH2e78Er/kyWJCryQmqQI1yiY33qsRlgxI3PDJwQ12mwtnnQES10ZjLhSn92EXQn3KxHh2MWZu3/fEmMyHOyueJHyQnca/OWYJgmgomS5MprjGbvOZeQR5T/NduYn2UVSsFsuIlBuuAQsg6oIxEb2feo72uUdk6xjIlNjFtvoGblJrhP9KbpFYaN/gB6zFaR+bAFp6XsBydBoYO1dN3eS68A2/imOYMQt2rMepdQQdpjeUZGBkojy4iftC7914PFpcmwU/ic/eT95VjJubmj4T8u0cSz/k3ptB2NdjshQ8Ud4m9mSPAerRBZloG3w0UsBQeqIn1/4gUW5gvZ8Hk3A27OtfCEFp9uUPvLvfQm2Ke/IDIxkbJKUB8Fyx4smsXJGnLJwA== X-Microsoft-Exchange-Diagnostics: 1;VI1PR0801MB1983;31:ow6M2B0mftC1/lqK0hrXsnUsbiT3qDuLLTUnbAf3RjvDRTPJSr4wQj0lmV9mv8Ilx2w6RKWaye6IIpIYGOFcIFZ0XXfJAH99iXyR2PItnx8i6IFIICGr1/AcTpGKV2bVI+e01QrP0zdOVF8KkcENHGpA/70eQIn/2F66hbqrYI8z6TbIkehSv9S/LJ9oNZiwpiAIU42jbyUD80or1txSYtsuX8vRJzrEdnbH5+YLfoc8tQfHZBg9OGm7SI5C5PC+sel1C6v8lbadfUsYr87wPg==;20:LZ+Nuc4ypPa7fK6T8IDTLcmDA7HtnkKP6yz8W6OqHS4awTCb5sgQIG9YG2EmjLYTRKDyRt66953CKIwlj22+THAf+X4v225I6axFFwy9ZL5F2vjMrKLGCWJhRls8ZhrgqiMYGc/5rUCgRQetj9AD7x1f7evihLI9SwNVlobHKJlWgW4t+sO8DO8FWCz4H9s+qSvXppS7j5u8kE+s9mCKwhSc3wptO/D+aHjy8XzJcUEefP/zsPHBm6vBfk9fzoja X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(166708455590820)(192374486261705); X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6041248)(20161123555025)(20161123560025)(20161123562025)(20161123564025)(6072148);SRVR:VI1PR0801MB1983;BCL:0;PCL:0;RULEID:;SRVR:VI1PR0801MB1983; X-Microsoft-Exchange-Diagnostics: 1;VI1PR0801MB1983;4:ZpdNio6EQr/Puond+qekTi/5am7BWDLigChqAX3e4xcfhyuJQEosAXQkFb0E0rBBnThcRwKkSF6TvjeDom7QizbfXlQye42xcfH/OGaS5NZFj6+EnEtInY00Vs0uifQF+G1/6dT9XCSpWa5OLgg/sjHYf6LCb3SGILlSRSE2fd90nrK8jFyQEE6qmUShKqpzWRCawSZPg9V2ahum6V5Csf9eWObbn6sVkzFrtnKjrZrwIHOrY4ZvquVLTMQqFdHHPI/9iC00Yeg3ha7ZE1TqfDokTiMaYLstDfeD19haYt4vK0CMiYC4tuML1wrMUpY/QXT0DAj0RkrQRls8lAL3iNcQ1/HCj8JU9bJwAtKAP5lJUN8EURjlPQJpG58MPIcymtwzKjUXuPGkB04N/XILWeZh2IXoUlHKDSIIL7Kb53YByO64fvN4BSXFgUunvNZxXuQ5JIang4Z2JVYHQRA7DRPEOQbQyM0MLRa8gphiO4Icoh8VBwoTIZCj+km8pzfHSyga2NfOvDN8YHgnKwyq5aWAbdHy7h1FkNlhuBWLF5fkWtwlwuzn5jezoqC5rioOyJMe7x05q3AjxWnsoMHrkqaOOvc+wbEVKAKefAEGwUtpcPBvycfHHGQbs9AaiKqFofurkVOup78Vc/fX4XmQ2Q== X-Forefront-PRVS: 0204F0BDE2 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(4630300001)(6009001)(7916002)(39450400003)(189002)(377454003)(199003)(51444003)(24454002)(105586002)(93886004)(7736002)(305945005)(76176999)(54356999)(42186005)(53936002)(106356001)(68736007)(53416004)(101416001)(50986999)(189998001)(6916009)(33656002)(2950100002)(4326007)(6666003)(110136003)(97736004)(5660300001)(92566002)(23686003)(4001350100001)(2906002)(3846002)(8676002)(6306002)(55016002)(25786008)(1076002)(9686003)(6116002)(229853002)(47776003)(81156014)(38730400001)(6506006)(66066001)(81166006)(7416002)(86362001)(69596002)(83506001)(50466002)(54906002)(7099028)(18370500001)(26326002);DIR:OUT;SFP:1102;SCL:1;SRVR:VI1PR0801MB1983;H:outlook.office365.com;FPR:;SPF:None;PTR:InfoNoRecords;MX:1;A:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?koi8-r?Q?1;VI1PR0801MB1983;23:wZhlhgsrRutDdBt2YjnLYoWcLRl5yoOf+jdZFp5K1?= =?koi8-r?Q?0/CTl+HAfLIpBEebtYJwxXGc4SrPcENpEqwTGnDbTv6PIH89pC5b2jIgs+Ac5X?= =?koi8-r?Q?3SHrWk6fCdMlDB9KRqNmmH75yKFZgOQyxxW4Os+89lOu9iPdeSjdrHdTskqTU5?= =?koi8-r?Q?Lhnur0EgPRM2Km18JpHcs0O5rcDbagv4YWRqO0JKyYh0mq+WT8EimTJ5fOkVYU?= =?koi8-r?Q?GxtyDXhgrBDgPSqvCwPn0iyYz2OgggnaB0g6rfFW4kKXdi2dURVFiRqvFGayAn?= =?koi8-r?Q?PVYgyw1e8YjcWj8A4Vqb6ROMCBvPmUcp1iaqODRKbeXJvIquUxIYkt2IsRAyNB?= =?koi8-r?Q?l/mvyyuy+3DCtsuruq/NEv9Kw1F6uwTM+xascN6LdxWgM5u82uXzs3pHh/PFIX?= =?koi8-r?Q?9MaRRZfRS6g6etwwAaFkjbFPIYQmjm7OMfVesFVGOpx3yEnJIgEpWoqkF9q2zd?= =?koi8-r?Q?e29cYhyJYxn7ivto6ScnBINgDJHkC9ZN+2jLcmll0JL5iJ7QQ1XPX+x60aO1TO?= =?koi8-r?Q?HRrs1CJTSxwMe9l598r75WYGrenVxDQaRAxZKb/fRCOfKzv1p3pXWgWUoDzPCG?= =?koi8-r?Q?tvHHOAOAzYDrUbXy1I1UafLrRSPMzckMdQUSx5gEShuXGeAOUoN3riUDXH3MMO?= =?koi8-r?Q?1kD7QSt8Hhzbz89jfk4iEnEYCHcZdXaLYhN3ikT1ziCiPZ/3CsO+vJU8VI9mNV?= =?koi8-r?Q?PYMfJNDEDX/PXCqiY2t70tVnqhcXUrnN7gWRonYmw/6SWmqxXa5+k9G3W6h65t?= =?koi8-r?Q?xmSNm9HvoVotaSQrbrFUsRIVVZUz7pMuJFckl9b8NebGW64730zBACY/GF3BZ5?= =?koi8-r?Q?Ohe3g/8bTSU+qtzq0DfrF345pCLX7qVAu1bynXzUVI3d6HOUusuZUv4JGYNLMP?= =?koi8-r?Q?yvcuC0lQSXiagGfHSN8F39Oo2hMEvovRzaKE5CoV5zyIrbjeW1vaT/OKQ+DId6?= =?koi8-r?Q?DxcLyuYny9DC97LkmPo15q6yOx9L5A6y880sMpPaOqSlshTsnCIeH/iCBS2rNf?= =?koi8-r?Q?j94kAIKCi3o376s14gI/iGeX/c4fm3++aULHLayIYiMocu4YR9vatBOgBsq/mx?= =?koi8-r?Q?lb8TjiTbB+JpsVnQ4YKpvy+7lqIedPotdGQqL10DtFmBMjwU/OH3Qs6BPJxDyg?= =?koi8-r?Q?Bx16D9b6p0NF4987oJoYp7EQvUor712oRlnM4mkjllDHo7DNzmNV4Sm5Eu/Ypo?= =?koi8-r?Q?QUvtMUWKD8sirdJXP9ZFB7880Vrzmx00kXJyrEPDrlA8Icz6USfyE63qrujd4t?= =?koi8-r?Q?Jb/pd1qcTfRdIvjRNo3tro9HqHWD8BxbfGv7GZcIUSpGZCPf6NcJ0+VneCwvQ0?= =?koi8-r?Q?3v1roXRWqbPpxPb/vJPUjRWkX0fDOpo60qPTRJ9hvYzNbFYuBigouCAPEHetYF?= =?koi8-r?Q?m8P?= X-Microsoft-Exchange-Diagnostics: 1;VI1PR0801MB1983;6:FHj0YrspCFAYZQw783n342N9v0h/XM8ftr639Jvp7TJTZECS3KST/5af8CZdXKViH0efkcSnKsSQvdX5h9ApyxrawTWafQ8Dx8ozWsTbr5rBd9Kp+hq5jCEFJwhApPx8BMfTL9Q5yOcuLePOqOKqhkFSLAzZb+RAo0VMcNFvU9gy/4NgcMWgewuIGBZ8ADmeal/ENM4+dC5ss0mctP/83RJfjHhzpW1zkg1JfBpnE0GwxEfLAQKRALA28l7kZrO4s/jETSRzZkg6VAiAu3G6Grsrepgr4idYE/moSWH8LrmfdVjgF+yaaOt09TI/uvVmgjKsk6CeSnq5Q/go8UwMushW2MNgJw58jZ076GpcBwVdwWuzpeiK4IouZ4F6XaUxdZdWXAWGcK0uvBrJv92SiGspvGf0nmseKV09z+mfm1I=;5:Go9W1x8NaEiMTl8GeI9T+7n/Y4AILraLsKYW51mf5zgVPA/BxZW/xSsbnpEDxzOdBp2rsLlfqIiBdlryI0ws49eqNj8sa8wzY3Y98qYEjW1D2Mu4yrG9BAX6293heU9Q8G+IRfL6ttEFEHfT7oJWoQ==;24:WgHQYBrGHi5YyJFg/IU02CE6OJv2/jhTmYmZnelrA/j1XzofeEAUvs6X50s1XKZ+bKDEvbBrLWPxk5w3LERFwgFgmG30t5gvIZqn08xgxU0= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;VI1PR0801MB1983;7:lnL4lHlMX+qtDGVjh9eiqVpZQTxyuqJfRYZfrVtNJ3Syvr9Xxhay3MQr8jazyUoBRIOdvGbmoz4lQxbRGdgTMQ1OwIUTwheva+vy0XT9ASWcUM/OJWLZSHK1/bJP44qKI+q6eZU0nKDWKbL8eLQpxgmSO3f1zFFQQjQtRTpzuw2p4/hmvNhCBH2dlRegGjNimq18x6E48MOSCRrxGfA1ThPC+RW6M9G3uuSSHWJ/TKo1HaaLmG8HZG4NxYUtd7skfAaXrkIHcJt4b9b5+gITQa21D2mc1GdZyhjGBOWhIBvhqwVRPhdX/98utiFG5ISiS9SLjDwMyWlzBw1KmKCjqd/NCWrUJFu/dnDvimPeAd7gyNhZnTlcnnwq8lNnRHY0ygc99ZZI/oWQKC0bUa8jK+hC2Grhcq96+2N4FT3613A0JAjCVkMU2T+NjuFcpdqnOKgtrjRHa/A83otCHxonH3+B73yzCBRl5ECJfCYMlpQl/iL6EcZvn8vvm7cc61c1fmQnLT6y/Zb+CEgKXsTgrrTJ5JROzLtE/Z0/uxqISTm1jKYBG0MMq3eNWjHrPz2b;20:LT3SM5yz7NYRHBD20QXmPHWfVyak4ZwPd8rvLct07Usi9wweAEJAtqrvZ6vyvNhoPuil2ibnZxlHTR/k1xYYcc6zxP7pUOUUv7mZ3UICvc/EAGDewTXERQYYqYoWvqMpDwDrVJd6WyOyp7wC4P1wHAi0lE78nWn81zO2d7dYxg0= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 31 Jan 2017 21:47:46.7231 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR0801MB1983 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Jan 27, 2017 at 01:48:30PM -0800, Kees Cook wrote: > On Wed, Jan 25, 2017 at 12:05 PM, Kees Cook wrote: > > On Tue, Jan 24, 2017 at 4:53 PM, Andrei Vagin wrote: > >> Hi, > >> > >> One of CRIU tests fails with this patch: > >> https://github.com/xemul/criu/blob/master/test/zdtm/static/seccomp_filter_tsync.c > >> > >> Before this patch only a thread which called a "wrong" syscall is killed. > >> Now a whole process is killed if one of threads called a "wrong" syscall. > > > > Oh ew. I wonder what is causing this? In other do_coredump() callers, > > they explicitly call do_group_exit(). Hmmm > > We need to find a way to fix this or remove the coredump change from > -next. We have a few things that have come up recently (coincident > with the coredump change): > > - some folks would like seccomp kills to kill the entire process not > just the thread > - on a full-process kill, there needs to be a way to get a coredump > - on a kill, it would be nice to have reliable logging > > Getting a coredump requires a full-process kill. It is possible to do > this already with RET_TRAP and just not catch the SIGSYS. However, > this isn't sufficient if you want to be _sure_ the entire process gets > killed since RET_TRAP depends on cooperation from the process. > > Getting reliable logging out of seccomp for non-RET_KILL is > non-trivial because syscall-audit doesn't track forks. > > The RET_* values are part of the UAPI, so changing or adding to them > requires care. > > Right now we have very little room in the RET_* values (the lower > bytes are for the RET_DATA which is ignored for RET_KILL and the > semantics of changing that is very difficult): > > #define SECCOMP_RET_KILL 0x00000000U /* kill the task immediately */ > #define SECCOMP_RET_TRAP 0x00030000U /* disallow and force a SIGSYS */ > > Killing the entire process is more aggressive than RET_KILL currently, > so the question becomes, should we upgrade RET_KILL to > RET_KILL_PROCESS and add RET_KILL_THREAD? Are there people that WANT > only a thread to be killed? Andrei, does CRIU depend on this behavior, > or is it "just" a regression test detail? It is just a regression test detail. We can change the test if you decide to kill a whole process. > > We can add two more RET_* values... however, it seems like only thread > vs process is a filter-level concept. Whether or not to dump core > seems to be an external aspect of the process (think ulimit -c), and > logging seems to be a system-level thing. > > For logging, I think audit needs to grow fork-tracking, and/or have a > new "is under seccomp" test that can be exposed to auditctl. Then the > system owner can issue either "tell me about all seccomp kills" or > "tell me about seccomp kills in this process tree". As such, I don't > think we should be making filter-level changes to deal with the needs > of seccomp logging. > > For coredumping, I remain a bit stumped. Strictly speaking, > coredumping exposes more kernel code to the running process, so it is > "less safe" than the instant kill RET_KILL performs. Though the > current patch is actually more aggressive in that it causes the entire > process to die as part of the coredumping. > > I think that if there is a move to make RET_KILL kill the process, > then we can add coredumping. If not, I'm less sure how to proceed... > > -Kees > > -- > Kees Cook > Nexus Security