From: tycho at tycho.ws (Tycho Andersen)
Subject: [PATCH] selftests/seccomp: Handle namespace failures gracefully
Date: Fri, 12 Apr 2019 13:44:09 -0600 [thread overview]
Message-ID: <20190412194409.GD25793@cisco> (raw)
In-Reply-To: <8fca6205-4983-2ba1-c1eb-c80be2dc8769@kernel.org>
On Fri, Apr 12, 2019 at 11:07:11AM -0600, shuah wrote:
> On 4/12/19 9:25 AM, Tycho Andersen wrote:
> > On Thu, Apr 11, 2019 at 04:56:31PM -0700, Kees Cook wrote:
> > > When running without USERNS or PIDNS the seccomp test would hang since
> > > it was waiting forever for the child to trigger the user notification
> > > since it seems the glibc() abort handler makes a call to getpid(),
> > > which would trap again. This changes the getpid filter to getppid, and
> > > makes sure ASSERTs execute to stop from spawning the listener.
> > >
> > > Reported-by: Shuah Khan <shuah at kernel.org>
> > > Fixes: 6a21cc50f0c7 ("seccomp: add a return code to trap to userspace")
> > > Signed-off-by: Kees Cook <keescook at chromium.org>
> >
> > Sorry for the delay, thanks for looking at this!
> >
> > Reviewed-by: Tycho Andersen <tycho at tycho.ws>
> >
>
> Thanks both. Should it go into stables. I will pull this and
> add stable if that is appropriate.
Yes, for 5.0+ that sounds good.
Thanks!
Tycho
WARNING: multiple messages have this Message-ID (diff)
From: tycho@tycho.ws (Tycho Andersen)
Subject: [PATCH] selftests/seccomp: Handle namespace failures gracefully
Date: Fri, 12 Apr 2019 13:44:09 -0600 [thread overview]
Message-ID: <20190412194409.GD25793@cisco> (raw)
Message-ID: <20190412194409.Y5ECq7TP1bon3ZwrQ8cmcjSw4OkhIW9cr2fAKQqsO7o@z> (raw)
In-Reply-To: <8fca6205-4983-2ba1-c1eb-c80be2dc8769@kernel.org>
On Fri, Apr 12, 2019@11:07:11AM -0600, shuah wrote:
> On 4/12/19 9:25 AM, Tycho Andersen wrote:
> > On Thu, Apr 11, 2019@04:56:31PM -0700, Kees Cook wrote:
> > > When running without USERNS or PIDNS the seccomp test would hang since
> > > it was waiting forever for the child to trigger the user notification
> > > since it seems the glibc() abort handler makes a call to getpid(),
> > > which would trap again. This changes the getpid filter to getppid, and
> > > makes sure ASSERTs execute to stop from spawning the listener.
> > >
> > > Reported-by: Shuah Khan <shuah at kernel.org>
> > > Fixes: 6a21cc50f0c7 ("seccomp: add a return code to trap to userspace")
> > > Signed-off-by: Kees Cook <keescook at chromium.org>
> >
> > Sorry for the delay, thanks for looking at this!
> >
> > Reviewed-by: Tycho Andersen <tycho at tycho.ws>
> >
>
> Thanks both. Should it go into stables. I will pull this and
> add stable if that is appropriate.
Yes, for 5.0+ that sounds good.
Thanks!
Tycho
WARNING: multiple messages have this Message-ID (diff)
From: Tycho Andersen <tycho@tycho.ws>
To: shuah <shuah@kernel.org>
Cc: Kees Cook <keescook@chromium.org>,
linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] selftests/seccomp: Handle namespace failures gracefully
Date: Fri, 12 Apr 2019 13:44:09 -0600 [thread overview]
Message-ID: <20190412194409.GD25793@cisco> (raw)
In-Reply-To: <8fca6205-4983-2ba1-c1eb-c80be2dc8769@kernel.org>
On Fri, Apr 12, 2019 at 11:07:11AM -0600, shuah wrote:
> On 4/12/19 9:25 AM, Tycho Andersen wrote:
> > On Thu, Apr 11, 2019 at 04:56:31PM -0700, Kees Cook wrote:
> > > When running without USERNS or PIDNS the seccomp test would hang since
> > > it was waiting forever for the child to trigger the user notification
> > > since it seems the glibc() abort handler makes a call to getpid(),
> > > which would trap again. This changes the getpid filter to getppid, and
> > > makes sure ASSERTs execute to stop from spawning the listener.
> > >
> > > Reported-by: Shuah Khan <shuah@kernel.org>
> > > Fixes: 6a21cc50f0c7 ("seccomp: add a return code to trap to userspace")
> > > Signed-off-by: Kees Cook <keescook@chromium.org>
> >
> > Sorry for the delay, thanks for looking at this!
> >
> > Reviewed-by: Tycho Andersen <tycho@tycho.ws>
> >
>
> Thanks both. Should it go into stables. I will pull this and
> add stable if that is appropriate.
Yes, for 5.0+ that sounds good.
Thanks!
Tycho
next prev parent reply other threads:[~2019-04-12 19:44 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-04-11 23:56 [PATCH] selftests/seccomp: Handle namespace failures gracefully keescook
2019-04-11 23:56 ` Kees Cook
2019-04-11 23:56 ` Kees Cook
2019-04-12 15:25 ` tycho
2019-04-12 15:25 ` Tycho Andersen
2019-04-12 15:25 ` Tycho Andersen
2019-04-12 17:07 ` shuah
2019-04-12 17:07 ` shuah
2019-04-12 17:07 ` shuah
2019-04-12 19:44 ` tycho [this message]
2019-04-12 19:44 ` Tycho Andersen
2019-04-12 19:44 ` Tycho Andersen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190412194409.GD25793@cisco \
--to=unknown@example.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.