Re: [PATCH 1/5] ptrace: add PTRACE_SYSCALL_INFO_SECCOMP_SKIP

[Oleg Nesterov <oleg@redhat.com>]

On 07/02, Oleg Nesterov wrote:
>
> Or we can simply allow the ENTRY/SECCOMP -> EXIT transition, I dunno.
> This is more safe.

and more simple

> But somehow I don't like the new PTRACE_SYSCALL_INFO_SECCOMP_SKIP...

Wdyt about something like below?

Oleg.
---

diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 130043bfc209..ecbfa28dfbf6 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -1084,7 +1084,7 @@ ptrace_set_syscall_info_seccomp(struct task_struct *child, struct pt_regs *regs,
 
 static int
 ptrace_set_syscall_info_exit(struct task_struct *child, struct pt_regs *regs,
-			     struct ptrace_syscall_info *info)
+			     struct ptrace_syscall_info *info, bool force)
 {
 	long rval = info->exit.rval;
 
@@ -1101,6 +1101,9 @@ ptrace_set_syscall_info_exit(struct task_struct *child, struct pt_regs *regs,
 	else
 		syscall_set_return_value(child, regs, 0, rval);
 
+	if (force)
+		syscall_set_nr(child, regs, -1);
+
 	return 0;
 }
 
@@ -1110,6 +1113,7 @@ ptrace_set_syscall_info(struct task_struct *child, unsigned long user_size,
 {
 	struct pt_regs *regs = task_pt_regs(child);
 	struct ptrace_syscall_info info;
+	bool force = false;
 
 	if (user_size < sizeof(info))
 		return -EINVAL;
@@ -1127,14 +1131,17 @@ ptrace_set_syscall_info(struct task_struct *child, unsigned long user_size,
 		return -EINVAL;
 
 	/* Changing the type of the system call stop is not supported yet. */
-	if (ptrace_get_syscall_info_op(child) != info.op)
-		return -EINVAL;
+	if (ptrace_get_syscall_info_op(child) != info.op) {
+		if (info.op != PTRACE_SYSCALL_INFO_EXIT)
+			return -EINVAL;
+		force = true;
+	}
 
 	switch (info.op) {
 	case PTRACE_SYSCALL_INFO_ENTRY:
 		return ptrace_set_syscall_info_entry(child, regs, &info);
 	case PTRACE_SYSCALL_INFO_EXIT:
-		return ptrace_set_syscall_info_exit(child, regs, &info);
+		return ptrace_set_syscall_info_exit(child, regs, &info, force);
 	case PTRACE_SYSCALL_INFO_SECCOMP:
 		return ptrace_set_syscall_info_seccomp(child, regs, &info);
 	default: