From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752935AbcFTWWA (ORCPT ); Mon, 20 Jun 2016 18:22:00 -0400 Received: from mx1.redhat.com ([209.132.183.28]:39536 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752226AbcFTWVx (ORCPT ); Mon, 20 Jun 2016 18:21:53 -0400 Subject: Re: [PATCH v2] x86/ptrace: Stop setting TS_COMPAT in ptrace code To: Andy Lutomirski , Andy Lutomirski References: <34c11bd7bb9719a0d8477042b121da7a3fbf0d32.1466438182.git.luto@kernel.org> Cc: X86 ML , "linux-kernel@vger.kernel.org" , Kees Cook , Borislav Petkov , Oleg Nesterov From: Pedro Alves Message-ID: Date: Mon, 20 Jun 2016 23:21:42 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.1.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.29]); Mon, 20 Jun 2016 22:21:45 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 06/20/2016 08:37 PM, Andy Lutomirski wrote: > On Mon, Jun 20, 2016 at 9:29 AM, Andy Lutomirski wrote: >> Setting TS_COMPAT in ptrace is wrong: if we happen to do it during >> syscall entry, then we'll confuse seccomp and audit. (The former >> isn't a security problem: seccomp is currently entirely insecure if a >> malicious ptracer is attached.) As a minimal fix, this patch adds a >> new flag TS_I386_REGS_POKED that handles the ptrace special case. >> >> Cc: Pedro Alves >> Cc: Oleg Nesterov >> Cc: Kees Cook >> Signed-off-by: Andy Lutomirski > > In case you're interested, my draft followup (definitely not for x86/urgent) is: > > https://git.kernel.org/cgit/linux/kernel/git/luto/linux.git/commit/?h=x86/vmap_stack&id=50d2f2a9fe1b > > Pedro, this appears to pass ptrace-tests. I need to try the 64-vs-32 > thing, but it's intended to fix it for real. Awesome, thanks much for working on this! Thanks, Pedro Alves