From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0B0201DED49 for ; Sun, 22 Mar 2026 14:47:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774190851; cv=none; b=BX9uspiXCAG4RWBfHXPQT8dEplcTGyRDJfCng3L2hs0lvUa4KefDtkKISEtEWTsELVHkD5AiwhyfD39q1RwS6qwaVzM4/9ZElSN3K9x1r1BLijdvo06Lhn8Ck3BrPOnh2MZQ8lybSLy6kc62CJy0m4s9nMw06jzFPHb9LBuXhqA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774190851; c=relaxed/simple; bh=W+UZMOWkt0dx8kqu94eJpxGot/gxhMoztJL11zqew2A=; h=Date:From:To:CC:Subject:In-Reply-To:References:Message-ID: MIME-Version:Content-Type; b=LX3mVXjesxIPmaED5OiQoQKObCR3TkbZ97717eJZTdWafKfjjApgFjcBgM4gMT9OQbgcyzAF9zFBaGoL52oSpX8GNqwX8Q8U9S/wCgGvwQC/styQx7FzcQNOss8FQmaZ5NqRA4v9HEgcyyv1SJ+4kwOIA9gHehg5PCvn4NmxYs8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=WGbtDgYp; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="WGbtDgYp" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A3F93C19424; Sun, 22 Mar 2026 14:47:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1774190850; bh=W+UZMOWkt0dx8kqu94eJpxGot/gxhMoztJL11zqew2A=; h=Date:From:To:CC:Subject:In-Reply-To:References:From; b=WGbtDgYp1vs9YBtENPAfeSViakhPU/qQYJGYlQLZPwisu0K/xy9J4aDvk0/ANSpik hKKpe2aF5QGU5gvVGVtozteqcZTV+BFRtboI0kJVGav0FX0NfggWT+XM2vhwRvCJdq BJtH+u7UJZlVVB/51hC2G9TU4VYhZxHMjOZ+KaYOtWLTBUmCM20BHtHFcoDTzi0sIf 9cU+6z9SK5hgfdyNF1w2cIDEVl1IHDlx/yGEVTjjV+tFz7qUfac8shCMQFpKW5es1y lTgA9GVxr2HhiTFvwBTZEhbkr59YX8YooolcVuPqU+wGDTBndal3sNCmgUcB4zzFfD 4MsQ0gVxQf23A== Date: Sun, 22 Mar 2026 07:47:29 -0700 From: Kees Cook To: Oleg Nesterov , Andrew Morton , Andy Lutomirski , Peter Zijlstra , Thomas Gleixner , Will Drewry CC: Max Ver , linux-kernel@vger.kernel.org Subject: =?US-ASCII?Q?Re=3A_=5BRFC_PATCH=5D_ptrace=3A_don=27t_report_sysca?= =?US-ASCII?Q?ll-exit_if_the_tracee_was_killed_by_seccomp?= User-Agent: K-9 Mail for Android In-Reply-To: References: Message-ID: <6E69C3F0-0691-4115-AE36-F5E5743C942A@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On March 22, 2026 6:44:54 AM PDT, Oleg Nesterov wrote: >__seccomp_filter() does > > case SECCOMP_RET_KILL_THREAD: > case SECCOMP_RET_KILL_PROCESS: > =2E=2E=2E > /* Show the original registers in the dump=2E */ > syscall_rollback(current, current_pt_regs()); > > /* Trigger a coredump with SIGSYS */ > force_sig_seccomp(this_syscall, data, true); > >syscall_rollback() does regs->ax =3D=3D orig_ax=2E This means that >ptrace_get_syscall_info_exit() will see =2Eis_error =3D=3D 0=2E To the tr= acer, >it looks as if the aborted syscall actually succeeded and returned its >own syscall number=2E > >And since force_sig_seccomp() uses force_coredump =3D=3D true, SIGSYS won= 't >be reported (see the SA_IMMUTABLE check in get_signal()), so the tracee >will "silently" exit with error_code =3D=3D SIGSYS after the bogus report= =2E > >Change syscall_exit_work() to avoid the bogus single-step/syscall-exit >reports if the tracee is SECCOMP_MODE_DEAD=2E > >TODO: With or without this change, get_signal() -> ptrace_signal() may >report other !SA_IMMUTABLE pending signals before it dequeues SIGSYS=2E >Perhaps it makes sense to change get_signal() to check SECCOMP_MODE_DEAD >too and prioritize the fatal SIGSYS=2E > >Reported-by: Max Ver >Closes: https://lore=2Ekernel=2Eorg/all/CABjJbFJO+p3jA1r0gjUZrCepQb1Fab3k= qxYhc_PSfoqo21ypeQ@mail=2Egmail=2Ecom/ >Signed-off-by: Oleg Nesterov >--- > include/linux/entry-common=2Eh | 3 +++ > include/linux/seccomp=2Eh | 8 ++++++++ > kernel/seccomp=2Ec | 3 --- > 3 files changed, 11 insertions(+), 3 deletions(-) > >diff --git a/include/linux/entry-common=2Eh b/include/linux/entry-common= =2Eh >index f83ca0abf2cd=2E=2E5c62bda9dcf9 100644 >--- a/include/linux/entry-common=2Eh >+++ b/include/linux/entry-common=2Eh >@@ -250,6 +250,9 @@ static __always_inline void syscall_exit_work(struct = pt_regs *regs, unsigned lon > if (work & SYSCALL_WORK_SYSCALL_TRACEPOINT) > trace_syscall_exit(regs, syscall_get_return_value(current, regs)); >=20 >+ if (killed_by_seccomp(current)) >+ return; Hmm=2E I'm still not convinced this is right, but if we make this change, = I'd want to see a behavioral test added (likely to the seccomp self tests),= and to make sure the rr test suite doesn't regress=2E It's traditionally b= een the most sensitive to these kinds of notification ordering/behavior cha= nges=2E -Kees >+ > step =3D report_single_step(work); > if (step || work & SYSCALL_WORK_SYSCALL_TRACE) > arch_ptrace_report_syscall_exit(regs, step); >diff --git a/include/linux/seccomp=2Eh b/include/linux/seccomp=2Eh >index 9b959972bf4a=2E=2Ee95a251955c1 100644 >--- a/include/linux/seccomp=2Eh >+++ b/include/linux/seccomp=2Eh >@@ -22,6 +22,12 @@ > #include > #include >=20 >+/* Not exposed in uapi headers: internal use only=2E */ >+#define SECCOMP_MODE_DEAD (SECCOMP_MODE_FILTER + 1) >+ >+#define killed_by_seccomp(task) \ >+ ((task)->seccomp=2Emode =3D=3D SECCOMP_MODE_DEAD) >+ > extern int __secure_computing(void); >=20 > #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER >@@ -49,6 +55,8 @@ static inline int seccomp_mode(struct seccomp *s) >=20 > struct seccomp_data; >=20 >+#define killed_by_seccomp(task) 0 >+ > #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER > static inline int secure_computing(void) { return 0; } > #else >diff --git a/kernel/seccomp=2Ec b/kernel/seccomp=2Ec >index 066909393c38=2E=2E461eb15c66c3 100644 >--- a/kernel/seccomp=2Ec >+++ b/kernel/seccomp=2Ec >@@ -31,9 +31,6 @@ >=20 > #include >=20 >-/* Not exposed in headers: strictly internal use only=2E */ >-#define SECCOMP_MODE_DEAD (SECCOMP_MODE_FILTER + 1) >- > #ifdef CONFIG_SECCOMP_FILTER > #include > #include --=20 Kees Cook