Re: [PATCH v8 1/2] seccomp: add a return code to trap to userspace

2018-11-30 Thread Oleg Nesterov
On 11/29, Tycho Andersen wrote: > > /* > * These should never be seen by user programs. To return one of ERESTART* > * codes, signal_pending() MUST be set. Note that ptrace can observe these > * at syscall exit tracing, but they will never be left for the debugged user > * process to see. >

Re: [PATCH v8 1/2] seccomp: add a return code to trap to userspace

2018-11-29 Thread Tycho Andersen
On Mon, Oct 29, 2018 at 04:40:30PM -0600, Tycho Andersen wrote: > + resp.id = req.id; > + resp.error = -512; /* -ERESTARTSYS */ > + resp.val = 0; > + > + EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0); So, it turns out this *doesn't* work, and the reason this test w

Re: [PATCH v8 1/2] seccomp: add a return code to trap to userspace

2018-11-02 Thread Tycho Andersen
On Fri, Nov 02, 2018 at 12:29:03PM +0100, Oleg Nesterov wrote: > On 11/01, Tycho Andersen wrote: > > > > On Thu, Nov 01, 2018 at 03:48:05PM +0100, Oleg Nesterov wrote: > > > > > > > > But my main concern is that either way wait_for_completion_killable() > > > > > allows > > > > > to trivially crea

Re: [PATCH v8 1/2] seccomp: add a return code to trap to userspace

2018-11-02 Thread Tycho Andersen
On Fri, Nov 02, 2018 at 11:02:35AM +0100, Oleg Nesterov wrote: > On 11/01, Tycho Andersen wrote: > > > > On Thu, Nov 01, 2018 at 02:40:02PM +0100, Oleg Nesterov wrote: > > > > > > Somehow I no longer understand why do you need to take all locks. Isn't > > > the first filter's notify_lock enough? IO

Re: [PATCH v8 1/2] seccomp: add a return code to trap to userspace

2018-11-02 Thread Oleg Nesterov
On 11/01, Tycho Andersen wrote: > > On Thu, Nov 01, 2018 at 03:48:05PM +0100, Oleg Nesterov wrote: > > > > > > But my main concern is that either way wait_for_completion_killable() > > > > allows > > > > to trivially create a process which doesn't react to SIGSTOP, not > > > > good... > > > > > >

Re: [PATCH v8 1/2] seccomp: add a return code to trap to userspace

2018-11-02 Thread Oleg Nesterov
On 11/01, Tycho Andersen wrote: > > On Thu, Nov 01, 2018 at 02:40:02PM +0100, Oleg Nesterov wrote: > > > > Somehow I no longer understand why do you need to take all locks. Isn't > > the first filter's notify_lock enough? IOW, > > > > for (cur = current->seccomp.filter; cur; cur = cur->

Re: [PATCH v8 1/2] seccomp: add a return code to trap to userspace

2018-11-01 Thread Tycho Andersen
On Thu, Nov 01, 2018 at 03:48:05PM +0100, Oleg Nesterov wrote: > On 10/30, Tycho Andersen wrote: > > > > > I am not sure I understand the value of > > > signaled/SECCOMP_NOTIF_FLAG_SIGNALED... > > > I mean, why it is actually useful? > > > > > > Sorry if this was already discussed. > > > > :) no p

Re: [PATCH v8 1/2] seccomp: add a return code to trap to userspace

2018-11-01 Thread Tycho Andersen
On Thu, Nov 01, 2018 at 02:56:34PM +0100, Oleg Nesterov wrote: > On 10/29, Tycho Andersen wrote: > > > > +static int seccomp_notify_release(struct inode *inode, struct file *file) > > +{ > > + struct seccomp_filter *filter = file->private_data; > > + struct seccomp_knotif *knotif; > > + > > +

Re: [PATCH v8 1/2] seccomp: add a return code to trap to userspace

2018-11-01 Thread Tycho Andersen
On Thu, Nov 01, 2018 at 02:40:02PM +0100, Oleg Nesterov wrote: > On 10/29, Tycho Andersen wrote: > > > > +static struct file *init_listener(struct seccomp_filter *filter) > > +{ > > + struct file *ret = ERR_PTR(-EBUSY); > > + struct seccomp_filter *cur, *last_locked = NULL; > > + int filter_n

Re: [PATCH v8 1/2] seccomp: add a return code to trap to userspace

2018-11-01 Thread Oleg Nesterov
On 10/30, Tycho Andersen wrote: > > > I am not sure I understand the value of > > signaled/SECCOMP_NOTIF_FLAG_SIGNALED... > > I mean, why it is actually useful? > > > > Sorry if this was already discussed. > > :) no problem, many people have complained about this. This is an > implementation of An

Re: [PATCH v8 1/2] seccomp: add a return code to trap to userspace

2018-11-01 Thread Oleg Nesterov
On 10/29, Tycho Andersen wrote: > > +static int seccomp_notify_release(struct inode *inode, struct file *file) > +{ > + struct seccomp_filter *filter = file->private_data; > + struct seccomp_knotif *knotif; > + > + mutex_lock(&filter->notify_lock); > + > + /* > + * If this file

Re: [PATCH v8 1/2] seccomp: add a return code to trap to userspace

2018-11-01 Thread Oleg Nesterov
On 10/29, Tycho Andersen wrote: > > +static struct file *init_listener(struct seccomp_filter *filter) > +{ > + struct file *ret = ERR_PTR(-EBUSY); > + struct seccomp_filter *cur, *last_locked = NULL; > + int filter_nesting = 0; > + > + for (cur = current->seccomp.filter; cur; cur =

Re: [PATCH v8 1/2] seccomp: add a return code to trap to userspace

2018-10-31 Thread Oleg Nesterov
On 10/30, Kees Cook wrote: > > I'd like to avoid changing the return value of __secure_computing() to > just avoid having to touch all the callers. And I'd prefer not to > change __seccomp_filter() to a bool, since I'd like the return values > to be consistent through the call chain. Sure, please

Re: [PATCH v8 1/2] seccomp: add a return code to trap to userspace

2018-10-30 Thread Kees Cook
On Tue, Oct 30, 2018 at 5:29 PM, Tycho Andersen wrote: > On Tue, Oct 30, 2018 at 03:34:54PM -0700, Kees Cook wrote: >> On Tue, Oct 30, 2018 at 3:32 PM, Tycho Andersen wrote: >> > On Tue, Oct 30, 2018 at 03:00:17PM -0700, Kees Cook wrote: >> >> On Tue, Oct 30, 2018 at 2:54 PM, Tycho Andersen wrot

Re: [PATCH v8 1/2] seccomp: add a return code to trap to userspace

2018-10-30 Thread Tycho Andersen
On Tue, Oct 30, 2018 at 03:34:54PM -0700, Kees Cook wrote: > On Tue, Oct 30, 2018 at 3:32 PM, Tycho Andersen wrote: > > On Tue, Oct 30, 2018 at 03:00:17PM -0700, Kees Cook wrote: > >> On Tue, Oct 30, 2018 at 2:54 PM, Tycho Andersen wrote: > >> > On Tue, Oct 30, 2018 at 02:49:21PM -0700, Kees Cook

Re: [PATCH v8 1/2] seccomp: add a return code to trap to userspace

2018-10-30 Thread Kees Cook
On Tue, Oct 30, 2018 at 3:32 PM, Tycho Andersen wrote: > On Tue, Oct 30, 2018 at 03:00:17PM -0700, Kees Cook wrote: >> On Tue, Oct 30, 2018 at 2:54 PM, Tycho Andersen wrote: >> > On Tue, Oct 30, 2018 at 02:49:21PM -0700, Kees Cook wrote: >> >> On Mon, Oct 29, 2018 at 3:40 PM, Tycho Andersen wrot

Re: [PATCH v8 1/2] seccomp: add a return code to trap to userspace

2018-10-30 Thread Tycho Andersen
On Tue, Oct 30, 2018 at 03:00:17PM -0700, Kees Cook wrote: > On Tue, Oct 30, 2018 at 2:54 PM, Tycho Andersen wrote: > > On Tue, Oct 30, 2018 at 02:49:21PM -0700, Kees Cook wrote: > >> On Mon, Oct 29, 2018 at 3:40 PM, Tycho Andersen wrote: > >> > * switch to a flags based future-proofing mecha

Re: [PATCH v8 1/2] seccomp: add a return code to trap to userspace

2018-10-30 Thread Kees Cook
On Tue, Oct 30, 2018 at 2:54 PM, Tycho Andersen wrote: > On Tue, Oct 30, 2018 at 02:49:21PM -0700, Kees Cook wrote: >> On Mon, Oct 29, 2018 at 3:40 PM, Tycho Andersen wrote: >> > * switch to a flags based future-proofing mechanism for struct >> > seccomp_notif and seccomp_notif_resp, th

Re: [PATCH v8 1/2] seccomp: add a return code to trap to userspace

2018-10-30 Thread Tycho Andersen
On Tue, Oct 30, 2018 at 02:49:21PM -0700, Kees Cook wrote: > On Mon, Oct 29, 2018 at 3:40 PM, Tycho Andersen wrote: > > * switch to a flags based future-proofing mechanism for struct > > seccomp_notif and seccomp_notif_resp, thus avoiding version issues > > with structure length (K

Re: [PATCH v8 1/2] seccomp: add a return code to trap to userspace

2018-10-30 Thread Kees Cook
On Mon, Oct 29, 2018 at 3:40 PM, Tycho Andersen wrote: > * switch to a flags based future-proofing mechanism for struct > seccomp_notif and seccomp_notif_resp, thus avoiding version issues > with structure length (Kees) [...] > > +struct seccomp_notif { > + __u64 id; > +

Re: [PATCH v8 1/2] seccomp: add a return code to trap to userspace

2018-10-30 Thread Kees Cook
On Tue, Oct 30, 2018 at 8:54 AM, Tycho Andersen wrote: > On Tue, Oct 30, 2018 at 04:02:54PM +0100, Oleg Nesterov wrote: >> On 10/29, Tycho Andersen wrote: >> > >> > +static long seccomp_notify_recv(struct seccomp_filter *filter, >> > + void __user *buf) >> > +{ >> > + s

Re: [PATCH v8 1/2] seccomp: add a return code to trap to userspace

2018-10-30 Thread Kees Cook
On Tue, Oct 30, 2018 at 10:21 AM, Tycho Andersen wrote: > On Tue, Oct 30, 2018 at 05:39:26PM +0100, Oleg Nesterov wrote: >> On 10/30, Oleg Nesterov wrote: >> > >> > On 10/30, Tycho Andersen wrote: >> > > >> > > @@ -828,6 +823,11 @@ static int __seccomp_filter(int this_syscall, const >> > > struct

Re: [PATCH v8 1/2] seccomp: add a return code to trap to userspace

2018-10-30 Thread Tycho Andersen
On Tue, Oct 30, 2018 at 05:39:26PM +0100, Oleg Nesterov wrote: > On 10/30, Oleg Nesterov wrote: > > > > On 10/30, Tycho Andersen wrote: > > > > > > @@ -828,6 +823,11 @@ static int __seccomp_filter(int this_syscall, const > > > struct seccomp_data *sd, > > >*/ > > > rmb(); > > > > > > + if (!

Re: [PATCH v8 1/2] seccomp: add a return code to trap to userspace

2018-10-30 Thread Oleg Nesterov
On 10/30, Oleg Nesterov wrote: > > On 10/30, Tycho Andersen wrote: > > > > @@ -828,6 +823,11 @@ static int __seccomp_filter(int this_syscall, const > > struct seccomp_data *sd, > > */ > > rmb(); > > > > + if (!sd) { > > + populate_seccomp_data(&sd_local); > > + sd =

Re: [PATCH v8 1/2] seccomp: add a return code to trap to userspace

2018-10-30 Thread Oleg Nesterov
On 10/30, Tycho Andersen wrote: > > @@ -828,6 +823,11 @@ static int __seccomp_filter(int this_syscall, const > struct seccomp_data *sd, >*/ > rmb(); > > + if (!sd) { > + populate_seccomp_data(&sd_local); > + sd = &sd_local; > + } > + To me it would

Re: [PATCH v8 1/2] seccomp: add a return code to trap to userspace

2018-10-30 Thread Tycho Andersen
On Tue, Oct 30, 2018 at 04:02:54PM +0100, Oleg Nesterov wrote: > On 10/29, Tycho Andersen wrote: > > > > +static long seccomp_notify_recv(struct seccomp_filter *filter, > > + void __user *buf) > > +{ > > + struct seccomp_knotif *knotif = NULL, *cur; > > + struct seccom

Re: [PATCH v8 1/2] seccomp: add a return code to trap to userspace

2018-10-30 Thread Tycho Andersen
Hi Oleg, On Tue, Oct 30, 2018 at 03:32:36PM +0100, Oleg Nesterov wrote: > On 10/29, Tycho Andersen wrote: > > > > + /* This is where we wait for a reply from userspace. */ > > + err = wait_for_completion_interruptible(&n.ready); > > + mutex_lock(&match->notify_lock); > > + > > + /* > > +

Re: [PATCH v8 1/2] seccomp: add a return code to trap to userspace

2018-10-30 Thread Oleg Nesterov
On 10/29, Tycho Andersen wrote: > > +static long seccomp_notify_recv(struct seccomp_filter *filter, > + void __user *buf) > +{ > + struct seccomp_knotif *knotif = NULL, *cur; > + struct seccomp_notif unotif; > + ssize_t ret; > + > + memset(&unotif, 0, siz

Re: [PATCH v8 1/2] seccomp: add a return code to trap to userspace

2018-10-30 Thread Oleg Nesterov
On 10/29, Tycho Andersen wrote: > > + /* This is where we wait for a reply from userspace. */ > + err = wait_for_completion_interruptible(&n.ready); > + mutex_lock(&match->notify_lock); > + > + /* > + * If the noticiation fd died before we re-acquired the lock, we still > +

[PATCH v8 1/2] seccomp: add a return code to trap to userspace

2018-10-29 Thread Tycho Andersen
This patch introduces a means for syscalls matched in seccomp to notify some other task that a particular filter has been triggered. The motivation for this is primarily for use with containers. For example, if a container does an init_module(), we obviously don't want to load this untrusted code,