AcoSail/kernel_optimize_test
8
0
Fork 0
forked from luck/tmp_suning_uos_patched
Code Pull Requests Activity

um/ptrace: run seccomp after ptrace

Browse Source 
Close the hole where ptrace can change a syscall out from under seccomp.

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Jeff Dike <jdike@addtoit.com>
Cc: Richard Weinberger <richard@nod.at>
Cc: user-mode-linux-devel@lists.sourceforge.net
This commit is contained in:
Kees Cook 2016-06-02 19:59:42 -07:00
parent 635efc7029
commit 26703c636c
1 changed files with 4 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
arch/um/kernel/skas/syscall.c
View File

@ -20,12 +20,12 @@ void handle_syscall(struct uml_pt_regs *r)
UPT_SYSCALL_NR(r) = PT_SYSCALL_NR(r->gp); UPT_SYSCALL_NR(r) = PT_SYSCALL_NR(r->gp);
PT_REGS_SET_SYSCALL_RETURN(regs, -ENOSYS); PT_REGS_SET_SYSCALL_RETURN(regs, -ENOSYS);
/* Do the secure computing check first; failures should be fast. */ if (syscall_trace_enter(regs))
if (secure_computing(NULL) == -1)
return; return;
if (syscall_trace_enter(regs)) /* Do the seccomp check after ptrace; failures should be fast. */
goto out; if (secure_computing(NULL) == -1)
return;
/* Update the syscall number after orig_ax has potentially been updated /* Update the syscall number after orig_ax has potentially been updated
* with ptrace. * with ptrace.
@ -37,6 +37,5 @@ void handle_syscall(struct uml_pt_regs *r)
PT_REGS_SET_SYSCALL_RETURN(regs, PT_REGS_SET_SYSCALL_RETURN(regs,
EXECUTE_SYSCALL(syscall, regs)); EXECUTE_SYSCALL(syscall, regs));
out:
syscall_trace_leave(regs); syscall_trace_leave(regs);
} }