From: Alexei Starovoitov <alexei.starovoitov@gmail.com>
To: Daniel Sangorrin <daniel.sangorrin@toshiba.co.jp>
Cc: keescook@chromium.org, luto@amacapital.net, wad@chromium.org,
linux-kernel@vger.kernel.org, linux-api@vger.kernel.org,
kernel-hardening@lists.openwall.com
Subject: [kernel-hardening] Re: [RFC PATCH 1/1] seccomp: provide information about the previous syscall
Date: Fri, 22 Jan 2016 09:30:50 -0800 [thread overview]
Message-ID: <20160122173050.GE9608@ast-mbp.thefacebook.com> (raw)
In-Reply-To: <1453444200-8604-2-git-send-email-daniel.sangorrin@toshiba.co.jp>
On Fri, Jan 22, 2016 at 03:30:00PM +0900, Daniel Sangorrin wrote:
> This patch allows applications to restrict the order in which
> its system calls may be requested. In order to do that, we
> provide seccomp-BPF scripts with information about the
> previous system call requested.
>
> An example use case consists of detecting (and stopping) return
> oriented attacks that disturb the normal execution flow of
> a user program.
>
> Signed-off-by: Daniel Sangorrin <daniel.sangorrin@toshiba.co.jp>
...
> diff --git a/include/uapi/linux/seccomp.h b/include/uapi/linux/seccomp.h
...
> struct seccomp_data {
> int nr;
> + int prev_nr;
> __u32 arch;
> __u64 instruction_pointer;
> __u64 args[6];
this will break abi for existing seccomp programs.
New field has to be at the end.
next prev parent reply other threads:[~2016-01-22 17:30 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-01-22 6:29 [kernel-hardening] [RFC PATCH 0/1] Adding previous syscall context to seccomp Daniel Sangorrin
2016-01-22 6:30 ` [kernel-hardening] [RFC PATCH 1/1] seccomp: provide information about the previous syscall Daniel Sangorrin
2016-01-22 10:48 ` Jann Horn
2016-01-22 17:17 ` Andy Lutomirski
2016-01-25 3:39 ` Daniel Sangorrin
2016-01-25 11:51 ` Jann Horn
2016-01-22 17:30 ` Alexei Starovoitov [this message]
2016-01-22 21:23 ` [kernel-hardening] " Kees Cook
2016-01-22 22:10 ` Paul Moore
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160122173050.GE9608@ast-mbp.thefacebook.com \
--to=alexei.starovoitov@gmail.com \
--cc=daniel.sangorrin@toshiba.co.jp \
--cc=keescook@chromium.org \
--cc=kernel-hardening@lists.openwall.com \
--cc=linux-api@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@amacapital.net \
--cc=wad@chromium.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox