From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757536AbbBFXRY (ORCPT ); Fri, 6 Feb 2015 18:17:24 -0500 Received: from pegasus3.altlinux.org ([194.107.17.103]:56942 "EHLO pegasus3.altlinux.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751559AbbBFXRW (ORCPT ); Fri, 6 Feb 2015 18:17:22 -0500 Date: Sat, 7 Feb 2015 02:17:20 +0300 From: "Dmitry V. Levin" To: Kees Cook Cc: Andy Lutomirski , LKML , Will Drewry , Oleg Nesterov , "x86@kernel.org" , "linux-arm-kernel@lists.infradead.org" , Linux MIPS Mailing List , linux-arch , linux-security-module , Alexei Starovoitov , "H. Peter Anvin" , Frederic Weisbecker , Michael Kerrisk-manpages Subject: Re: a method to distinguish between syscall-enter/exit-stop Message-ID: <20150206231720.GB3829@altlinux.org> References: <20150205233945.GA31540@altlinux.org> <20150206023249.GB31540@altlinux.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Feb 06, 2015 at 12:07:03PM -0800, Kees Cook wrote: > On Fri, Feb 6, 2015 at 11:32 AM, Andy Lutomirski wrote: > > On Fri, Feb 6, 2015 at 11:23 AM, Kees Cook wrote: [...] > >> And an unrelated thought: > >> > >> 3) Can't we find some way to fix the inability of a ptracer to > >> distinguish between syscall-enter-stop and syscall-exit-stop? > > > > Couldn't we add PTRACE_O_TRACESYSENTRY and PTRACE_O_TRACESYSEXIT along > > the lines of PTRACE_O_TRACESYSGOOD? > > That might be a nice idea. I haven't written a test to see, but what > does PTRACE_GETEVENTMSG return on syscall-enter/exit-stop? The value returned by PTRACE_GETEVENTMSG is the value set along with the latest PTRACE_EVENT_*. In case of syscall-enter/exit-stop (which is not a PTRACE_EVENT_*), there is no particular value set for PTRACE_GETEVENTMSG. -- ldv