Re: [PATCH 3/5] v2 seccomp_filters: Enable ftrace-based system call filtering

Ingo Molnar
2011-05-26T18:54:41Z

* Linus Torvalds <torvalds@linux-foundation.org> wrote:

> And if you filter system calls, it's entirely possible that you can
> attack suid executables through such a vector. Your "limit system
> calls for security" security suddenly turned into "avoid the system
> call that made things secure"!

That should not be possible with Will's event filter based solution
(his last submitted patch), due to this code in fs/exec.c (which is
in your upstream tree as well):

/*
* Flush performance counters when crossing a
* security domain:
*/
if (!get_dumpable(current->mm))
perf_event_exit_task(current);

This will drop all filters if a setuid-root (or whatever setuid)
binary is executed from a filtered environment.

Does this cover the case you were thinking of?

Thanks,

Ingo