Re: Process killed by seccomp looks live by tracer

[Kees Cook <kees@kernel.org>]

On March 4, 2026 2:51:38 AM PST, Max Ver <dudududumaxver@gmail.com> wrote:
>I was using ptrace to trace a tracee status, using
>`PTRACE_GET_SYSCALL_INFO` and `PTRACE_SYSCALL`
>to get its syscall arguments and results. When a tracee killed by its
>seccomp, the tracer can't know immediately,
>instead, the `PTRACE_GET_SYSCALL_INFO` tell tracer that tracee exit
>with no error. The syscall wasn't actually
>executed, it was captured by seccomp, even the tracee was killed by seccomp.
>
>Here is a poc explaining what I said.
>I was expecting to aware the death of tracee at the fourth
>`PTRACE_GET_SYSCALL_INFO`,
>at least `PTRACE_GET_SYSCALL_INFO` should tell that the syscall
>failed, or get some different message from waitpid.
>But the result are below. Tracer can only get the death of tracee at
>the fifth loop.

This is expected; PTRACE_GET_SYSCALL_INFO is at syscall entry before seccomp filtering has run.

-- 
Kees Cook