[PATCH 1/2] kernel/entry: add CONFIG_SYSCALL_USER_DISPATCH to compile SUD out

[PATCH 1/2] kernel/entry: add CONFIG_SYSCALL_USER_DISPATCH to compile SUD out

[Gregory Price]

Syscall User Dispatch is built under CONFIG_GENERIC_SYSCALL and cannot
be disabled independent of the core syscall-entry machinery.

Native foreign-binary emulators (Wine/Proton) need it, but it should
be an optional for minimal/high security systems.

Add CONFIG_SYSCALL_USER_DISPATCH to make it optional.

Signed-off-by: Gregory Price <gourry@gourry.net>
---
 arch/Kconfig                                | 11 ++++++++
 include/linux/entry-common.h                |  6 ++---
 include/linux/syscall_user_dispatch.h       | 28 +++++++++++++++++++--
 include/linux/syscall_user_dispatch_types.h |  2 +-
 kernel/entry/Makefile                       |  3 ++-
 5 files changed, 42 insertions(+), 8 deletions(-)

diff --git a/arch/Kconfig b/arch/Kconfig
index e86880045158..a40686e2ad5b 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -114,6 +114,17 @@ config GENERIC_ENTRY
 	select GENERIC_IRQ_ENTRY
 	select GENERIC_SYSCALL
 
+config SYSCALL_USER_DISPATCH
+	bool "Syscall User Dispatch (SUD)"
+	depends on GENERIC_ENTRY
+	default y
+	help
+	  Syscall User Dispatch (SUD) lets a thread have its own system calls
+	  redirected to a userspace handler.  It is used by emulators that run
+	  foreign binaries which issue system calls directly.
+
+	  If unsure, say Y.
+
 config KPROBES
 	bool "Kprobes"
 	depends on HAVE_KPROBES
diff --git a/include/linux/entry-common.h b/include/linux/entry-common.h
index 416a3352261f..9336516430a1 100644
--- a/include/linux/entry-common.h
+++ b/include/linux/entry-common.h
@@ -9,6 +9,7 @@
 #include <linux/resume_user_mode.h>
 #include <linux/seccomp.h>
 #include <linux/sched.h>
+#include <linux/syscall_user_dispatch.h>
 
 #include <asm/entry-common.h>
 #include <asm/syscall.h>
@@ -55,7 +56,6 @@ static __always_inline int arch_ptrace_report_syscall_entry(struct pt_regs *regs
 }
 #endif
 
-bool syscall_user_dispatch(struct pt_regs *regs);
 long trace_syscall_enter(struct pt_regs *regs, long syscall);
 void trace_syscall_exit(struct pt_regs *regs, long ret);
 
@@ -232,10 +232,8 @@ static __always_inline void syscall_exit_work(struct pt_regs *regs, unsigned lon
 	 * of these syscalls is unknown.
 	 */
 	if (work & SYSCALL_WORK_SYSCALL_USER_DISPATCH) {
-		if (unlikely(current->syscall_dispatch.on_dispatch)) {
-			current->syscall_dispatch.on_dispatch = false;
+		if (syscall_user_dispatch_clear_on_dispatch())
 			return;
-		}
 	}
 
 	audit_syscall_exit(regs);
diff --git a/include/linux/syscall_user_dispatch.h b/include/linux/syscall_user_dispatch.h
index 3858a6ffdd5c..3dcb4c2dc544 100644
--- a/include/linux/syscall_user_dispatch.h
+++ b/include/linux/syscall_user_dispatch.h
@@ -7,8 +7,22 @@
 
 #include <linux/thread_info.h>
 #include <linux/syscall_user_dispatch_types.h>
+#include <linux/sched.h>
 
-#ifdef CONFIG_GENERIC_ENTRY
+struct pt_regs;
+
+#ifdef CONFIG_SYSCALL_USER_DISPATCH
+
+bool syscall_user_dispatch(struct pt_regs *regs);
+
+static inline bool syscall_user_dispatch_clear_on_dispatch(void)
+{
+	if (likely(!current->syscall_dispatch.on_dispatch))
+		return false;
+
+	current->syscall_dispatch.on_dispatch = false;
+	return true;
+}
 
 int set_syscall_user_dispatch(unsigned long mode, unsigned long offset,
 			      unsigned long len, char __user *selector);
@@ -24,6 +38,16 @@ int syscall_user_dispatch_set_config(struct task_struct *task, unsigned long siz
 
 #else
 
+static inline bool syscall_user_dispatch(struct pt_regs *regs)
+{
+	return false;
+}
+
+static inline bool syscall_user_dispatch_clear_on_dispatch(void)
+{
+	return false;
+}
+
 static inline int set_syscall_user_dispatch(unsigned long mode, unsigned long offset,
 					    unsigned long len, char __user *selector)
 {
@@ -46,6 +70,6 @@ static inline int syscall_user_dispatch_set_config(struct task_struct *task,
 	return -EINVAL;
 }
 
-#endif /* CONFIG_GENERIC_ENTRY */
+#endif /* CONFIG_SYSCALL_USER_DISPATCH */
 
 #endif /* _SYSCALL_USER_DISPATCH_H */
diff --git a/include/linux/syscall_user_dispatch_types.h b/include/linux/syscall_user_dispatch_types.h
index 3be36b06c7d7..c0bdd4f760d3 100644
--- a/include/linux/syscall_user_dispatch_types.h
+++ b/include/linux/syscall_user_dispatch_types.h
@@ -4,7 +4,7 @@
 
 #include <linux/types.h>
 
-#ifdef CONFIG_GENERIC_ENTRY
+#ifdef CONFIG_SYSCALL_USER_DISPATCH
 
 struct syscall_user_dispatch {
 	char __user	*selector;
diff --git a/kernel/entry/Makefile b/kernel/entry/Makefile
index 2333d70802e4..f220bae86b12 100644
--- a/kernel/entry/Makefile
+++ b/kernel/entry/Makefile
@@ -13,5 +13,6 @@ CFLAGS_REMOVE_common.o	 = -fstack-protector -fstack-protector-strong
 CFLAGS_common.o		+= -fno-stack-protector
 
 obj-$(CONFIG_GENERIC_IRQ_ENTRY) 	+= common.o
-obj-$(CONFIG_GENERIC_SYSCALL) 		+= syscall-common.o syscall_user_dispatch.o
+obj-$(CONFIG_GENERIC_SYSCALL) 		+= syscall-common.o
+obj-$(CONFIG_SYSCALL_USER_DISPATCH)	+= syscall_user_dispatch.o
 obj-$(CONFIG_VIRT_XFER_TO_GUEST_WORK)	+= virt.o
-- 
2.54.0

[PATCH 2/2] kernel/entry: add kernel.syscall_user_dispatch sysctl

[Gregory Price]

Add a matching sysctl to go with CONFIG_SYSCALL_USER_DISPATCH.

kernel.syscall_user_dispatch (default 1) controls whether userspace
may arm SUD (both via prctl and ptrace).

Disarming is always permitted - same semantics as comparable knobs

Signed-off-by: Gregory Price <gourry@gourry.net>
---
 Documentation/admin-guide/sysctl/kernel.rst | 17 +++++++++++++
 kernel/entry/syscall_user_dispatch.c        | 28 +++++++++++++++++++++
 2 files changed, 45 insertions(+)

diff --git a/Documentation/admin-guide/sysctl/kernel.rst b/Documentation/admin-guide/sysctl/kernel.rst
index c6994e55d141..4c90caaf1e21 100644
--- a/Documentation/admin-guide/sysctl/kernel.rst
+++ b/Documentation/admin-guide/sysctl/kernel.rst
@@ -1402,6 +1402,23 @@ Note that if you change this from 0 to 1, already created segments
 without users and with a dead originative process will be destroyed.
 
 
+syscall_user_dispatch
+=====================
+
+Controls whether userspace may arm Syscall User Dispatch (SUD) via
+``prctl(PR_SET_SYSCALL_USER_DISPATCH, ...)`` or the
+``PTRACE_SET_SYSCALL_USER_DISPATCH_CONFIG`` ptrace request:
+
+  ==  ===================================================================
+  0   Arming SUD is denied with ``-EPERM``.  Tasks that already armed it
+      keep it, and disabling SUD (``PR_SYS_DISPATCH_OFF``) is always
+      permitted.
+  1   (default) Arming SUD is permitted.
+  ==  ===================================================================
+
+Only present when the kernel is built with ``CONFIG_SYSCALL_USER_DISPATCH``.
+
+
 sysctl_writes_strict
 ====================
 
diff --git a/kernel/entry/syscall_user_dispatch.c b/kernel/entry/syscall_user_dispatch.c
index d89dffcc2d64..1c39ccd733f5 100644
--- a/kernel/entry/syscall_user_dispatch.c
+++ b/kernel/entry/syscall_user_dispatch.c
@@ -11,12 +11,15 @@
 #include <linux/uaccess.h>
 #include <linux/signal.h>
 #include <linux/elf.h>
+#include <linux/sysctl.h>
 
 #include <linux/sched/signal.h>
 #include <linux/sched/task_stack.h>
 
 #include <asm/syscall.h>
 
+static int syscall_user_dispatch_allowed __read_mostly = 1;
+
 static void trigger_sigsys(struct pt_regs *regs)
 {
 	struct kernel_siginfo info;
@@ -102,6 +105,10 @@ static int task_set_syscall_user_dispatch(struct task_struct *task, unsigned lon
 		return -EINVAL;
 	}
 
+	/* Arming can be denied at runtime via sysctl, disarming is allowed */
+	if (mode != PR_SYS_DISPATCH_OFF && !syscall_user_dispatch_allowed)
+		return -EPERM;
+
 	/*
 	 * access_ok() will clear memory tags for tagged addresses
 	 * if current has memory tagging enabled.
@@ -172,3 +179,24 @@ int syscall_user_dispatch_set_config(struct task_struct *task, unsigned long siz
 	return task_set_syscall_user_dispatch(task, cfg.mode, cfg.offset, cfg.len,
 					      (char __user *)(uintptr_t)cfg.selector);
 }
+
+#ifdef CONFIG_SYSCTL
+static const struct ctl_table syscall_user_dispatch_sysctls[] = {
+	{
+		.procname	= "syscall_user_dispatch",
+		.data		= &syscall_user_dispatch_allowed,
+		.maxlen		= sizeof(syscall_user_dispatch_allowed),
+		.mode		= 0644,
+		.proc_handler	= proc_dointvec_minmax,
+		.extra1		= SYSCTL_ZERO,
+		.extra2		= SYSCTL_ONE,
+	},
+};
+
+static int __init syscall_user_dispatch_sysctl_init(void)
+{
+	register_sysctl_init("kernel", syscall_user_dispatch_sysctls);
+	return 0;
+}
+late_initcall(syscall_user_dispatch_sysctl_init);
+#endif /* CONFIG_SYSCTL */
-- 
2.54.0

Re: [PATCH 2/2] kernel/entry: add kernel.syscall_user_dispatch sysctl

[Thomas Gleixner]

On Sat, Jun 27 2026 at 16:55, Gregory Price wrote:

Same comment vs. subject prefix.

> Add a matching sysctl to go with CONFIG_SYSCALL_USER_DISPATCH.
>
> kernel.syscall_user_dispatch (default 1) controls whether userspace
> may arm SUD (both via prctl and ptrace).

What's SUD again? This is a changelog and not twatter.

> +	/* Arming can be denied at runtime via sysctl, disarming is allowed */
> +	if (mode != PR_SYS_DISPATCH_OFF && !syscall_user_dispatch_allowed)
> +		return -EPERM;

That might be similar to other sysctls, but if an application had it
enabled prior to the sysctl=off toggle, then that application will
suddenly fail in operation if it requires to move the dispatch window.

Thanks,

        tglx

Re: [PATCH 2/2] kernel/entry: add kernel.syscall_user_dispatch sysctl

[Gregory Price]

> > +	/* Arming can be denied at runtime via sysctl, disarming is allowed */
> > +	if (mode != PR_SYS_DISPATCH_OFF && !syscall_user_dispatch_allowed)
> > +		return -EPERM;
> 
> That might be similar to other sysctls, but if an application had it
> enabled prior to the sysctl=off toggle, then that application will
> suddenly fail in operation if it requires to move the dispatch window.
>

If the admin is turning it off globally, is that not exactly what the
admin wants?  The alternative is a hard disable that will simply result
in undefined behavior (windows syscall ABI being interpreted at a linux
syscall) instead of failing gracefully on the re-arm.

This seemed like the better option.

~Gregory

Re: [PATCH 2/2] kernel/entry: add kernel.syscall_user_dispatch sysctl

[Thomas Gleixner]

On Fri, Jul 03 2026 at 13:26, Gregory Price wrote:
>> > +	/* Arming can be denied at runtime via sysctl, disarming is allowed */
>> > +	if (mode != PR_SYS_DISPATCH_OFF && !syscall_user_dispatch_allowed)
>> > +		return -EPERM;
>> 
>> That might be similar to other sysctls, but if an application had it
>> enabled prior to the sysctl=off toggle, then that application will
>> suddenly fail in operation if it requires to move the dispatch window.
>>
>
> If the admin is turning it off globally, is that not exactly what the
> admin wants?  The alternative is a hard disable that will simply result
> in undefined behavior (windows syscall ABI being interpreted at a linux
> syscall) instead of failing gracefully on the re-arm.
>
> This seemed like the better option.

Fair enough, but please explain such reasoning properly in the change
log.

Re: [PATCH 1/2] kernel/entry: add CONFIG_SYSCALL_USER_DISPATCH to compile SUD out

[Thomas Gleixner]

Gregory!

On Sat, Jun 27 2026 at 16:55, Gregory Price wrote:

First a few formal notes.

    - Multi patch series require a cover letter

    - The subject prefix is not a matter of personal preference

See https://docs.kernel.org/process/maintainer-tip.html and the related
generic process documentation.

Please also refrain from made up acronyms in the subject line. What the
heck is SUD and why needs this to spell out the CONFIG option name
prominently.

    syscall_user_dispatch: Make it configurable in Kconfig

or something like that is concise and clear, no?

> Syscall User Dispatch is built under CONFIG_GENERIC_SYSCALL and cannot
> be disabled independent of the core syscall-entry machinery.
>
> Native foreign-binary emulators (Wine/Proton) need it, but it should
> be an optional for minimal/high security systems.

I buy the miminal system aspect, but high security is just a voodoo
argument. Why?

  1) The functionality needs to be enabled with a PRCTL, which can be
     filtered.

  2) It requires LD_PRELOAD to be effective

If your high security system allows #2 then it's not a high security
system to begin with. If you fail to add the proper filters then it does
not pass the test either.

I agree that disabling it alltogether reduces the effort, but it's not a
prerequisite.

> +config SYSCALL_USER_DISPATCH
> +	bool "Syscall User Dispatch (SUD)"
> +	depends on GENERIC_ENTRY
> +	default y
> +	help
> +	  Syscall User Dispatch (SUD) lets a thread have its own system calls
> +	  redirected to a userspace handler.  It is used by emulators that run
> +	  foreign binaries which issue system calls directly.

Huch?

What is foreign? Different country, different universe or different
mindset?

It's also not restricted to emulators. It allows to intercept and abort
system calls which are issued within a certain IP address range and
redirect them to a emulator or debugger. 


>--- a/include/linux/syscall_user_dispatch.h
>+++ b/include/linux/syscall_user_dispatch.h
>@@ -7,8 +7,22 @@
>
> #include <linux/thread_info.h>
> #include <linux/syscall_user_dispatch_types.h>
> +#include <linux/sched.h>

Why does this require to pull in the heaviest header?

> +bool syscall_user_dispatch(struct pt_regs *regs);
> +
> +static inline bool syscall_user_dispatch_clear_on_dispatch(void)

Wants to be __always_inline as otherwise agressive compilers like CLANG
happily put it out of line.

Thanks,

        tglx

Re: [PATCH 1/2] kernel/entry: add CONFIG_SYSCALL_USER_DISPATCH to compile SUD out

[Gregory Price]

On Fri, Jul 03, 2026 at 05:39:59PM +0200, Thomas Gleixner wrote:
> 
> I buy the miminal system aspect, but high security is just a voodoo
> argument. Why?
> 
>   1) The functionality needs to be enabled with a PRCTL, which can be
>      filtered.
> 
>   2) It requires LD_PRELOAD to be effective
> 
> If your high security system allows #2 then it's not a high security
> system to begin with. If you fail to add the proper filters then it does
> not pass the test either.
> 

sure, it can be filtered, but not all software runs in a sandbox and not
all attack vectors need end in priv-esc or launching new tasks.  It
does not require LD_PRELOAD to be useful to an attacker.

just as an example, if i land remote execution in a task, i can enable
syscall user dispatch and just steal cpu time from that task whenever it
makes a syscall without having to do any of the traditional tricks of
overwriting GDT entries to get hooks.  No need for ld preloading or even
leaving the active task's context.

syscall user dispatch is just a really clean, powerful tool for writing
implants.  I've been playing with it for the better part of 2 years and
just realized I don't want it enabled (or even present at all) on some
of my machines / machines I manage and there's no way to do that.

> I agree that disabling it alltogether reduces the effort, but it's not a
> prerequisite.
> 
> > +config SYSCALL_USER_DISPATCH
> > +	bool "Syscall User Dispatch (SUD)"
> > +	depends on GENERIC_ENTRY
> > +	default y
> > +	help
> > +	  Syscall User Dispatch (SUD) lets a thread have its own system calls
> > +	  redirected to a userspace handler.  It is used by emulators that run
> > +	  foreign binaries which issue system calls directly.
> 
> Huch?
> 
> What is foreign? Different country, different universe or different
> mindset?
> 
> It's also not restricted to emulators. It allows to intercept and abort
> system calls which are issued within a certain IP address range and
> redirect them to a emulator or debugger. 
> 

foreign meaning non-linux, but sure i'll change it to be more general.

> 
> >--- a/include/linux/syscall_user_dispatch.h
> >+++ b/include/linux/syscall_user_dispatch.h
> >@@ -7,8 +7,22 @@
> >
> > #include <linux/thread_info.h>
> > #include <linux/syscall_user_dispatch_types.h>
> > +#include <linux/sched.h>
> 
> Why does this require to pull in the heaviest header?
> 

we dereference current (struct task_struct)

> > +bool syscall_user_dispatch(struct pt_regs *regs);
> > +
> > +static inline bool syscall_user_dispatch_clear_on_dispatch(void)
> 
> Wants to be __always_inline as otherwise agressive compilers like CLANG
> happily put it out of line.
>

ack.

Re: [PATCH 1/2] kernel/entry: add CONFIG_SYSCALL_USER_DISPATCH to compile SUD out

[Thomas Gleixner]

On Fri, Jul 03 2026 at 13:22, Gregory Price wrote:
> On Fri, Jul 03, 2026 at 05:39:59PM +0200, Thomas Gleixner wrote:
>> > #include <linux/thread_info.h>
>> > #include <linux/syscall_user_dispatch_types.h>
>> > +#include <linux/sched.h>
>> 
>> Why does this require to pull in the heaviest header?
>> 
> we dereference current (struct task_struct)

Who is we? :)