From: Mathieu Desnoyers <mathieu.desnoyers@polymtl.ca>
To: David Woodhouse <dwmw2@infradead.org>, linux-kernel@vger.kernel.org
Cc: mingo@redhat.com
Subject: System call audit
Date: Mon, 12 May 2008 20:06:17 -0400 [thread overview]
Message-ID: <20080513000617.GA26009@Krystal> (raw)
Hi David,
As I am looking into the system-wide system call tracing problem, I
start to wonder how auditsc deals with the fact that user-space could
concurrently change the content referred to by the __user pointers.
This would be the case for execve. If we create a program with two
thread; one is executing execve syscalls and the other thread would be
modifying the userspace string containing the name of the program to
execute. Since we have two copy_from_user, one in auditsc and one in the
real execve() function, the string passed to the OS could differ from
the string seen by auditsc.
Regards,
Mathieu
--
Mathieu Desnoyers
OpenPGP key fingerprint: 8CD5 52C3 8E3C 4140 715F BA06 3F25 A8FE 3BAE 9A68
next reply other threads:[~2008-05-13 0:06 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-05-13 0:06 Mathieu Desnoyers [this message]
2008-05-13 9:24 ` System call audit David Woodhouse
2008-05-13 12:51 ` Mathieu Desnoyers
2008-05-13 12:59 ` David Woodhouse
2008-05-13 13:12 ` Mathieu Desnoyers
2008-05-13 13:19 ` Stephen Smalley
2008-05-13 13:51 ` Mathieu Desnoyers
2008-05-13 13:12 ` Stephen Smalley
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20080513000617.GA26009@Krystal \
--to=mathieu.desnoyers@polymtl.ca \
--cc=dwmw2@infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.