Re: Kernel stack read with PTRACE_EVENT_EXIT and io_uring threads

Michael Schmitz
2021-06-23T05:26:36Z

Hi Eric,

Am 23.06.2021 um 09:48 schrieb Michael Schmitz:
>>
>> The challenging ones are /proc/pid/syscall and seccomp which want to see
>> all of the system call arguments. I think every architecture always
>> saves the system call arguments unconditionally, so those cases are
>> probably not as interesting. But they certain look like they could be
>> trouble.
>
> Seccomp hasn't yet been implemented on m68k, though I'm working on that
> with Adrian. The sole secure_computing() call will happen in
> syscall_trace_enter(), so all system call arguments have been saved on
> the stack.
>
> Haven't looked at /proc/pid/syscall yet ...

Not supported at present (no HAVE_ARCH_TRACEHOOK for m68k). And the
syscall_get_arguments I wrote for seccomp support only copies the first
five data registers, which are always saved.

Cheers,

Michael