From mboxrd@z Thu Jan 1 00:00:00 1970 Received: with ECARTIS (v1.0.0; list linux-mips); Sat, 07 Feb 2015 00:17:27 +0100 (CET) Received: from pegasus3.altlinux.org ([194.107.17.103]:45075 "EHLO pegasus3.altlinux.org" rhost-flags-OK-OK-OK-OK) by eddie.linux-mips.org with ESMTP id S27012801AbbBFXRZx6sHo (ORCPT ); Sat, 7 Feb 2015 00:17:25 +0100 Received: from mua.local.altlinux.org (mua.local.altlinux.org [192.168.1.14]) by pegasus3.altlinux.org (Postfix) with ESMTP id 8483880A7D; Sat, 7 Feb 2015 02:17:20 +0300 (MSK) Received: by mua.local.altlinux.org (Postfix, from userid 508) id 76C93AC5EF8; Sat, 7 Feb 2015 02:17:20 +0300 (MSK) Date: Sat, 7 Feb 2015 02:17:20 +0300 From: "Dmitry V. Levin" To: Kees Cook Cc: Andy Lutomirski , LKML , Will Drewry , Oleg Nesterov , "x86@kernel.org" , "linux-arm-kernel@lists.infradead.org" , Linux MIPS Mailing List , linux-arch , linux-security-module , Alexei Starovoitov , "H. Peter Anvin" , Frederic Weisbecker , Michael Kerrisk-manpages Subject: Re: a method to distinguish between syscall-enter/exit-stop Message-ID: <20150206231720.GB3829@altlinux.org> References: <20150205233945.GA31540@altlinux.org> <20150206023249.GB31540@altlinux.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Return-Path: X-Envelope-To: <"|/home/ecartis/ecartis -s linux-mips"> (uid 0) X-Orcpt: rfc822;linux-mips@linux-mips.org Original-Recipient: rfc822;linux-mips@linux-mips.org X-archive-position: 45760 X-ecartis-version: Ecartis v1.0.0 Sender: linux-mips-bounce@linux-mips.org Errors-to: linux-mips-bounce@linux-mips.org X-original-sender: ldv@altlinux.org Precedence: bulk List-help: List-unsubscribe: List-software: Ecartis version 1.0.0 List-Id: linux-mips X-List-ID: linux-mips List-subscribe: List-owner: List-post: List-archive: X-list: linux-mips On Fri, Feb 06, 2015 at 12:07:03PM -0800, Kees Cook wrote: > On Fri, Feb 6, 2015 at 11:32 AM, Andy Lutomirski wrote: > > On Fri, Feb 6, 2015 at 11:23 AM, Kees Cook wrote: [...] > >> And an unrelated thought: > >> > >> 3) Can't we find some way to fix the inability of a ptracer to > >> distinguish between syscall-enter-stop and syscall-exit-stop? > > > > Couldn't we add PTRACE_O_TRACESYSENTRY and PTRACE_O_TRACESYSEXIT along > > the lines of PTRACE_O_TRACESYSGOOD? > > That might be a nice idea. I haven't written a test to see, but what > does PTRACE_GETEVENTMSG return on syscall-enter/exit-stop? The value returned by PTRACE_GETEVENTMSG is the value set along with the latest PTRACE_EVENT_*. In case of syscall-enter/exit-stop (which is not a PTRACE_EVENT_*), there is no particular value set for PTRACE_GETEVENTMSG. -- ldv From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from pegasus3.altlinux.org ([194.107.17.103]:45075 "EHLO pegasus3.altlinux.org" rhost-flags-OK-OK-OK-OK) by eddie.linux-mips.org with ESMTP id S27012801AbbBFXRZx6sHo (ORCPT ); Sat, 7 Feb 2015 00:17:25 +0100 Date: Sat, 7 Feb 2015 02:17:20 +0300 From: "Dmitry V. Levin" Subject: Re: a method to distinguish between syscall-enter/exit-stop Message-ID: <20150206231720.GB3829@altlinux.org> References: <20150205233945.GA31540@altlinux.org> <20150206023249.GB31540@altlinux.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Return-Path: Sender: linux-mips-bounce@linux-mips.org Errors-to: linux-mips-bounce@linux-mips.org List-help: List-unsubscribe: List-software: Ecartis version 1.0.0 List-subscribe: List-owner: List-post: List-archive: To: Kees Cook Cc: Andy Lutomirski , LKML , Will Drewry , Oleg Nesterov , "x86@kernel.org" , "linux-arm-kernel@lists.infradead.org" , Linux MIPS Mailing List , linux-arch , linux-security-module , Alexei Starovoitov , "H. Peter Anvin" , Frederic Weisbecker , Michael Kerrisk-manpages Message-ID: <20150206231720.GhQq7zbcQnGH5uQK4kLv_QRQAMPytnXp24usPOulMIA@z> On Fri, Feb 06, 2015 at 12:07:03PM -0800, Kees Cook wrote: > On Fri, Feb 6, 2015 at 11:32 AM, Andy Lutomirski wrote: > > On Fri, Feb 6, 2015 at 11:23 AM, Kees Cook wrote: [...] > >> And an unrelated thought: > >> > >> 3) Can't we find some way to fix the inability of a ptracer to > >> distinguish between syscall-enter-stop and syscall-exit-stop? > > > > Couldn't we add PTRACE_O_TRACESYSENTRY and PTRACE_O_TRACESYSEXIT along > > the lines of PTRACE_O_TRACESYSGOOD? > > That might be a nice idea. I haven't written a test to see, but what > does PTRACE_GETEVENTMSG return on syscall-enter/exit-stop? The value returned by PTRACE_GETEVENTMSG is the value set along with the latest PTRACE_EVENT_*. In case of syscall-enter/exit-stop (which is not a PTRACE_EVENT_*), there is no particular value set for PTRACE_GETEVENTMSG. -- ldv