From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dy1-f176.google.com (mail-dy1-f176.google.com [74.125.82.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 666B53D47BF for ; Fri, 15 May 2026 04:27:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.176 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778819267; cv=none; b=JpcFkizA3fwXwPkRNWLOLD0xNte/PNejS7rYY8T5lgHg614CPVZHeH+YdUKf2Jepxv/AF1Nl0bYzDQctnfM/QcxZwII5xiPmpDbmk2UknFR5IA7zPmRJuoRxyK92FxL2w7JVqOWsetcnURT2sNfOq0niYANbzX5fPyaZYKgF+5g= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778819267; c=relaxed/simple; bh=2WJm/Ku7SAg5Fkj7uYKLQ72rDvZb+fGr0aJhcZY+WZU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=uMpCcVR0kyVLMldu090/zsH/ArEuGg1YjgRBsGAaJvPEHFteEL6ytcpJhYanzd/zMIfOnwmLDRMolob7ldDRbkngGuOayJPkIZrpTiE0YWGLMkj6TuoGWcA82uHAqjyqi8e42SP1uz3FYb4EXjnHtdLDz5r9L1u0vn1ujif8ZLE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=bvZzmXp0; arc=none smtp.client-ip=74.125.82.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="bvZzmXp0" Received: by mail-dy1-f176.google.com with SMTP id 5a478bee46e88-2c156c4a9efso12140016eec.1 for ; Thu, 14 May 2026 21:27:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1778819265; x=1779424065; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=H8MHjy4DJSATyQVyoUYq05Pl2Edc8Pn1COKxWoctJow=; b=bvZzmXp0PH981GFA03HeSo1dxRqzRTqnEM9ji8L+SVbRl9wd/e4JG0UvbOl5KQnYwO GqKimNX0gXgdRo9KyHc6oA9gsS5WThUStQt+ew+rb4tutY2hXcO78c8EKMt6Wo1T30eH 47mS7ON0afXzIEXSEe1nIY6qWBP3wlj19Gh6ctsqbsEJfF9oeJD5PXHU1HcO10L10WEz /M/I6u1kq2dRvgJxHO8I2ob5CPloL2Fgv9AJ/cW+aJGYuYbfkTCJfBC0fkHJ8inzPrk+ 0uIW7PVPr6EA/lN+JYGfp3HGYODsH9uMSCj6nsZhK7ulLqQ+/pBGgNG+MY5Ya5SCAM9q X/dg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778819265; x=1779424065; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=H8MHjy4DJSATyQVyoUYq05Pl2Edc8Pn1COKxWoctJow=; b=lrCRS+ZkIwNWC3BHZEfTuUbLzrQPMwrXR7BdLHLpyHt9eEdhdh++T/nYDjDDWgueq/ zuBl8b35UjlksedpFx/qLap0A9qsUd0zsSoJoYXAn/lple3AzsM6tk03kpH+VC5jnJ+p oBS5eiunUVuWUIfj5e6bVzAIhJJly5kG36ce4J5KFYRRM4Dnp7ORKtCsJ6GLMprXH6LP 6wu1xE7WUw+bnKaggY/zclK8BirTV2P0vyMbIMvinJeYvmLF8bnaH3GEoxp3FqGLQiiL 0K3pzH77V6nghzA/iNbI6Ymt7HKgi795Sk5DoEGww4FE8no8/CXkgZ59FMb/kR2N9JNy oaGg== X-Forwarded-Encrypted: i=1; AFNElJ8Z2S2S85U2R7SnDNXxsXLP2Urkairj1T1RfTHJQj6kjM3Q85/VcXWc4rVypWQU6U092xCspHGi+lauJ6o=@vger.kernel.org X-Gm-Message-State: AOJu0YwdoDfI5Wk74yTd70l31n9pyeHagt15WzFlSDFob3YazlLm2Arf 6yS6px+eLR5Cv3dU2t+GvLPdJUXkGDwKEGoJxjxszYI7q5KJNsrbD0Vm X-Gm-Gg: Acq92OGMpbzXm2kbMZev8KJRO4Lft1DYRCWwBY03OaLM+NfjwPFSTjKkc9ukPwcEOdt dceJ121Tik4Kfphbee4c6QYGtjiDFPy3HMfYt2bdgcsYPH6WiYc49YXjudkZzorJHqOMEtinEd3 RrBoKHPDmSdcHsqtAeDo9y5WoFx2o59yfpWWoub4pqGx7rb82oKtkBjHdi1di+OLB664rffSuyu xM3hopui142UBwTJG/5i5qDmvt8L3Pi9rmKBMJfKN6+l6lnONaYuKfipTUd7AIFL7U7JI2yi2FF 04QyRnaqhgXlDVsx9mJj2av3BaIX7wJwEB1UkgOW4tEpi5/QF5jfLP6IiN6Hglt+I3mmd1BceLc ZcOCcIz1cswhaOnIuP4Y/QGG3fDXWpyv/jDjXTCXcxE06kz21eqGB0JBPqrr+Rv8b+vRvkc/JVV aOUyq4RdvYu8z2/0zFEMCWeTAjJgP5+a8AB+Q5ezjNxADdauXMtmlKGUDrWz+E X-Received: by 2002:a05:7300:5790:b0:2ed:e14:e954 with SMTP id 5a478bee46e88-303986721c1mr1110447eec.30.1778819265349; Thu, 14 May 2026 21:27:45 -0700 (PDT) Received: from pop-os.. ([2601:647:6802:dbc0:5cba:6b6f:e327:bade]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-302944ffb85sm5665521eec.7.2026.05.14.21.27.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 14 May 2026 21:27:44 -0700 (PDT) From: Cong Wang To: Kees Cook , linux-kernel@vger.kernel.org Cc: Andy Lutomirski , Will Drewry , Christian Brauner , Cong Wang Subject: [RFC PATCH v2 3/3] Documentation: seccomp: document SECCOMP_IOCTL_NOTIF_INJECT Date: Thu, 14 May 2026 21:27:38 -0700 Message-ID: <20260515042738.1723296-4-xiyou.wangcong@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260515042738.1723296-1-xiyou.wangcong@gmail.com> References: <20260515042738.1723296-1-xiyou.wangcong@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Cong Wang Add a "Syscall Injection" subsection to the user-notification chapter covering the motivation (closing the documented TOCTOU window for unprivileged supervisors), the substitute-syscall flow via SECCOMP_IOCTL_NOTIF_INJECT and SECCOMP_USER_NOTIF_FLAG_INJECTED, the ptrace-shaped struct layout, the kernel-buffer-backed pointer arguments, the listener-fd capability model, and the relationship to ptrace's existing register/memory manipulation. Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Cong Wang --- .../userspace-api/seccomp_filter.rst | 42 +++++++++++++++++++ 1 file changed, 42 insertions(+) diff --git a/Documentation/userspace-api/seccomp_filter.rst b/Documentation/userspace-api/seccomp_filter.rst index cff0fa7f3175..9057505b2b92 100644 --- a/Documentation/userspace-api/seccomp_filter.rst +++ b/Documentation/userspace-api/seccomp_filter.rst @@ -289,6 +289,48 @@ above in this document: all arguments being read from the tracee's memory should be read into the tracer's memory before any policy decisions are made. This allows for an atomic decision on syscall arguments. +Syscall Injection +----------------- + +For unprivileged supervisors, ``ptrace()`` and ``/proc/pid/mem`` are not +available, and reading the tracee's memory via ``process_vm_readv()`` +remains racy: a sibling thread or ``CLONE_VM`` peer can mutate pointer-arg +buffers between the supervisor's read and the kernel's re-read on +``SECCOMP_USER_NOTIF_FLAG_CONTINUE``. ``SECCOMP_IOCTL_NOTIF_INJECT`` +closes that race by letting the supervisor describe a substitute syscall +(``nr`` plus ``args[6]``, mirroring ``ptrace_syscall_info.entry``) whose +pointer arguments are backed by a kernel-side copy of supervisor-supplied +bytes rather than the tracee's user mm. + +The supervisor receives a notification as today, then issues +``ioctl(SECCOMP_IOCTL_NOTIF_INJECT, &inj)`` with a +``struct seccomp_notif_inject`` describing the substitute. Each pointer- +shaped argument is encoded as a byte offset into ``inj.buf`` (a user +buffer the kernel copies in at attach time); the ``args_in_buf_mask`` +field flags which ``args[i]`` are offsets versus raw scalar values. +The substitute is consumed by ``ioctl(SECCOMP_IOCTL_NOTIF_SEND)`` with +``SECCOMP_USER_NOTIF_FLAG_INJECTED``: the trapped task wakes, dispatches +into the matching kernel-mode helper (``filp_open`` for ``openat``, +``kernel_bind`` for ``bind``, ``kernel_write`` for ``write``), and the +helper's return value becomes the trapped syscall's return value. + +The trapped task's user mm is never re-read for the substituted syscall, +so peer mutations after ``SECCOMP_IOCTL_NOTIF_INJECT`` returns have no +effect. + +Injection is gated by listener-fd possession (the same capability model +as the rest of the user-notification interface) and by an explicit +kernel-side whitelist of injectable syscalls. The substitute ``nr`` must +match the trapped syscall's number, preventing a malicious supervisor +from converting "task tried to bind()" into "kernel does an openat() on +the task's behalf". + +This is intentionally a strict subset of ``PTRACE_SYSCALL`` + +``PTRACE_POKEDATA`` + ``PTRACE_SETREGSET``: the same kernel capability +(running a syscall in the trapped task's context with kernel-validated +args), exposed to unprivileged listener-fd-holding supervisors with a +narrowed surface and no need for ``CAP_SYS_PTRACE``. + Sysctls ======= -- 2.43.0