[PATCH] ptrace.2: add PTRACE_O_SUSPEND_SECCOMP flag

[PATCH] ptrace.2: add PTRACE_O_SUSPEND_SECCOMP flag

[Tycho Andersen]

From: Tycho Andersen <tycho.andersen-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>

I'm assuming (although I don't know) that this will make it into 4.2; the
"since" message may need to be updated. The commit e9e3ae0b that implements
this feature is in seccomp/tip now, though.

Signed-off-by: Tycho Andersen <tycho.andersen-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>
CC: Kees Cook <keescook-F7+t8E8rja9g9hUCZPvPmw@public.gmane.org>
CC: Andy Lutomirski <luto-kltTT9wpgjJwATOyAt5JVQ@public.gmane.org>
CC: Oleg Nesterov <oleg-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
---
 man2/ptrace.2 | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/man2/ptrace.2 b/man2/ptrace.2
index b7c514f..5dfec3b 100644
--- a/man2/ptrace.2
+++ b/man2/ptrace.2
@@ -42,6 +42,8 @@
 .\" 2011-09, major update by Denys Vlasenko <vda.linux-gM/Ye1E23mwN+BqQ9rBEUg@public.gmane.org>
 .\" 2015-01, Kees Cook <keescook-F7+t8E8rja9g9hUCZPvPmw@public.gmane.org>
 .\"    Added PTRACE_O_TRACESECCOMP, PTRACE_EVENT_SECCOMP
+.\" 2015-06, Tycho Andersen <tycho.andersen-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>
+.\"    Added PTRACE_O_SUSPEND_SECCOMP
 .\"
 .TH PTRACE 2 2015-02-21 "Linux" "Linux Programmer's Manual"
 .SH NAME
@@ -592,6 +594,13 @@ The seccomp event message data (from the
 .BR SECCOMP_RET_DATA
 portion of the seccomp filter rule) can be retrieved with
 .BR PTRACE_GETEVENTMSG .
+.TP
+.BR PTRACE_O_SUSPEND_SECCOMP " (since Linux 4.2)"
+Suspend the tracee's seccomp protections. This applies regardless of mode, and
+can be used when the tracee has not yet installed seccomp filters. That is, a
+valid usecase is to suspend a tracee's seccomp protections before they are
+installed by the tracee, let the tracee install the filters, and then clear
+this flag when the filters should be resumed.
 .RE
 .TP
 .BR PTRACE_GETEVENTMSG " (since Linux 2.5.46)"
-- 
2.1.4

--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH] ptrace.2: add PTRACE_O_SUSPEND_SECCOMP flag

[Kees Cook]

On Wed, Jun 17, 2015 at 10:42 AM, Tycho Andersen
<tycho.andersen-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org> wrote:
> From: Tycho Andersen <tycho.andersen-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>
>
> I'm assuming (although I don't know) that this will make it into 4.2; the
> "since" message may need to be updated. The commit e9e3ae0b that implements
> this feature is in seccomp/tip now, though.
>
> Signed-off-by: Tycho Andersen <tycho.andersen-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>
> CC: Kees Cook <keescook-F7+t8E8rja9g9hUCZPvPmw@public.gmane.org>
> CC: Andy Lutomirski <luto-kltTT9wpgjJwATOyAt5JVQ@public.gmane.org>
> CC: Oleg Nesterov <oleg-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
> ---
>  man2/ptrace.2 | 9 +++++++++
>  1 file changed, 9 insertions(+)
>
> diff --git a/man2/ptrace.2 b/man2/ptrace.2
> index b7c514f..5dfec3b 100644
> --- a/man2/ptrace.2
> +++ b/man2/ptrace.2
> @@ -42,6 +42,8 @@
>  .\" 2011-09, major update by Denys Vlasenko <vda.linux-gM/Ye1E23mwN+BqQ9rBEUg@public.gmane.org>
>  .\" 2015-01, Kees Cook <keescook-F7+t8E8rja9g9hUCZPvPmw@public.gmane.org>
>  .\"    Added PTRACE_O_TRACESECCOMP, PTRACE_EVENT_SECCOMP
> +.\" 2015-06, Tycho Andersen <tycho.andersen-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>
> +.\"    Added PTRACE_O_SUSPEND_SECCOMP
>  .\"
>  .TH PTRACE 2 2015-02-21 "Linux" "Linux Programmer's Manual"
>  .SH NAME
> @@ -592,6 +594,13 @@ The seccomp event message data (from the
>  .BR SECCOMP_RET_DATA
>  portion of the seccomp filter rule) can be retrieved with
>  .BR PTRACE_GETEVENTMSG .
> +.TP
> +.BR PTRACE_O_SUSPEND_SECCOMP " (since Linux 4.2)"
> +Suspend the tracee's seccomp protections. This applies regardless of mode, and
> +can be used when the tracee has not yet installed seccomp filters. That is, a
> +valid usecase is to suspend a tracee's seccomp protections before they are
> +installed by the tracee, let the tracee install the filters, and then clear
> +this flag when the filters should be resumed.
>  .RE
>  .TP
>  .BR PTRACE_GETEVENTMSG " (since Linux 2.5.46)"
> --
> 2.1.4
>

This should probably also mention the CAP_SYS_ADMIN requirement.
Otherwise, it looks good!

Thanks,

-Kees

-- 
Kees Cook
Chrome OS Security
--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH] ptrace.2: add PTRACE_O_SUSPEND_SECCOMP flag

[Tycho Andersen]

[-- Attachment #1: Type: text/plain, Size: 206 bytes --]

On Thu, Jun 18, 2015 at 12:27:48PM -0700, Kees Cook wrote:
>
> This should probably also mention the CAP_SYS_ADMIN requirement.
> Otherwise, it looks good!

Good point, attached is an updated patch.

Tycho

[-- Attachment #2: 0001-ptrace.2-add-PTRACE_O_SUSPEND_SECCOMP-flag.patch --]
[-- Type: text/x-diff, Size: 2230 bytes --]

>From ab790f8441c4d6f5691078b5b124b0f14c7a69df Mon Sep 17 00:00:00 2001
From: Tycho Andersen <tycho.andersen-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>
Date: Wed, 17 Jun 2015 11:17:32 -0600
Subject: [PATCH] ptrace.2: add PTRACE_O_SUSPEND_SECCOMP flag

I'm assuming (although I don't know) that this will make it into 4.2; the
"since" message may need to be updated. The commit e9e3ae0b that implements
this feature is in seccomp/tip now, though.

v2: add note about security checks

Signed-off-by: Tycho Andersen <tycho.andersen-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>
CC: Kees Cook <keescook-F7+t8E8rja9g9hUCZPvPmw@public.gmane.org>
CC: Andy Lutomirski <luto-kltTT9wpgjJwATOyAt5JVQ@public.gmane.org>
CC: Oleg Nesterov <oleg-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
---
 man2/ptrace.2 | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/man2/ptrace.2 b/man2/ptrace.2
index b7c514f..2bd40c6 100644
--- a/man2/ptrace.2
+++ b/man2/ptrace.2
@@ -42,6 +42,8 @@
 .\" 2011-09, major update by Denys Vlasenko <vda.linux-gM/Ye1E23mwN+BqQ9rBEUg@public.gmane.org>
 .\" 2015-01, Kees Cook <keescook-F7+t8E8rja9g9hUCZPvPmw@public.gmane.org>
 .\"    Added PTRACE_O_TRACESECCOMP, PTRACE_EVENT_SECCOMP
+.\" 2015-06, Tycho Andersen <tycho.andersen-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>
+.\"    Added PTRACE_O_SUSPEND_SECCOMP
 .\"
 .TH PTRACE 2 2015-02-21 "Linux" "Linux Programmer's Manual"
 .SH NAME
@@ -592,6 +594,18 @@ The seccomp event message data (from the
 .BR SECCOMP_RET_DATA
 portion of the seccomp filter rule) can be retrieved with
 .BR PTRACE_GETEVENTMSG .
+.TP
+.BR PTRACE_O_SUSPEND_SECCOMP " (since Linux 4.2)"
+Suspend the tracee's seccomp protections. This applies regardless of mode, and
+can be used when the tracee has not yet installed seccomp filters. That is, a
+valid usecase is to suspend a tracee's seccomp protections before they are
+installed by the tracee, let the tracee install the filters, and then clear
+this flag when the filters should be resumed. Setting this option requires that
+the tracer have
+.BR CAP_SYS_ADMIN ,
+not have any seccomp protections installed, and not have
+.BR PTRACE_O_SUSPEND_SECCOMP
+set on itself.
 .RE
 .TP
 .BR PTRACE_GETEVENTMSG " (since Linux 2.5.46)"
-- 
2.1.4

Re: [PATCH] ptrace.2: add PTRACE_O_SUSPEND_SECCOMP flag

[Michael Kerrisk (man-pages)]

Hello Tycho,

On 18 June 2015 at 23:31, Tycho Andersen <tycho.andersen-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org> wrote:
> On Thu, Jun 18, 2015 at 12:27:48PM -0700, Kees Cook wrote:
>>
>> This should probably also mention the CAP_SYS_ADMIN requirement.
>> Otherwise, it looks good!
>
> Good point, attached is an updated patch.

Thanks for the patch. I applied, and updated the kernel version to be 4.3.

Cheers,

Michael

diff --git a/man2/ptrace.2 b/man2/ptrace.2
index c2c92cd..47c96b1 100644
--- a/man2/ptrace.2
+++ b/man2/ptrace.2
@@ -592,6 +592,18 @@ The seccomp event message data (from the
 .BR SECCOMP_RET_DATA
 portion of the seccomp filter rule) can be retrieved with
 .BR PTRACE_GETEVENTMSG .
+.TP
+.BR PTRACE_O_SUSPEND_SECCOMP " (since Linux 4.2)"
+Suspend the tracee's seccomp protections. This applies regardless of mode, and
+can be used when the tracee has not yet installed seccomp filters. That is, a
+valid usecase is to suspend a tracee's seccomp protections before they are
+installed by the tracee, let the tracee install the filters, and then clear
+this flag when the filters should be resumed. Setting this option requires that
+the tracer have
+.BR CAP_SYS_ADMIN ,
+not have any seccomp protections installed, and not have
+.BR PTRACE_O_SUSPEND_SECCOMP
+set on itself.
 .RE
 .TP
 .BR PTRACE_GETEVENTMSG " (since Linux 2.5.46)"


-- 
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/
--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html