Hi,
Please pull these seccomp changes for next. These have been tested by
myself and Andy, and close a long-standing issue with seccomp where tracers
could change the syscall out from under seccomp.
Thanks!
-Kees
The following changes since commit 40d273782ff16fe1a7445cc05c66a447dfea3433:
security: tomoyo: simplify the gc kthread creation (2016-06-06 20:23:55 +1000)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git tags/seccomp-next
for you to fetch changes up to 26703c636c1f3272b39bd0f6d04d2e970984f1b6:
um/ptrace: run seccomp after ptrace (2016-06-14 10:54:47 -0700)
----------------------------------------------------------------
Fix seccomp vs ptrace ordering to plug syscall filter bypass issue.
----------------------------------------------------------------
Andy Lutomirski (2):
seccomp: Add a seccomp_data parameter secure_computing()
x86/entry: Get rid of two-phase syscall entry work
Kees Cook (12):
seccomp: add tests for ptrace hole
seccomp: remove 2-phase API
seccomp: recheck the syscall after RET_TRACE
x86/ptrace: run seccomp after ptrace
arm/ptrace: run seccomp after ptrace
arm64/ptrace: run seccomp after ptrace
MIPS/ptrace: run seccomp after ptrace
parisc/ptrace: run seccomp after ptrace
s390/ptrace: run seccomp after ptrace
powerpc/ptrace: run seccomp after ptrace
tile/ptrace: run seccomp after ptrace
um/ptrace: run seccomp after ptrace
arch/arm/kernel/ptrace.c | 13 +-
arch/arm64/kernel/ptrace.c | 8 +-
arch/mips/kernel/ptrace.c | 9 +-
arch/parisc/kernel/ptrace.c | 9 +-
arch/powerpc/kernel/ptrace.c | 46 +++----
arch/s390/kernel/ptrace.c | 21 ++-
arch/tile/kernel/ptrace.c | 11 +-
arch/um/kernel/skas/syscall.c | 9 +-
arch/x86/entry/common.c | 106 +++-------------
arch/x86/entry/vsyscall/vsyscall_64.c | 2 +-
arch/x86/include/asm/ptrace.h | 6 -
include/linux/seccomp.h | 14 +-
kernel/seccomp.c | 144 ++++++++-------------
tools/testing/selftests/seccomp/seccomp_bpf.c | 176 ++++++++++++++++++++++++--
14 files changed, 309 insertions(+), 265 deletions(-)
--
Kees Cook
Chrome OS & Brillo Security
