Re: [PATCH 1/2] kernel/entry: add CONFIG_SYSCALL_USER_DISPATCH to compile SUD out

[Gregory Price <gourry@gourry.net>]

On Fri, Jul 03, 2026 at 05:39:59PM +0200, Thomas Gleixner wrote:
> 
> I buy the miminal system aspect, but high security is just a voodoo
> argument. Why?
> 
>   1) The functionality needs to be enabled with a PRCTL, which can be
>      filtered.
> 
>   2) It requires LD_PRELOAD to be effective
> 
> If your high security system allows #2 then it's not a high security
> system to begin with. If you fail to add the proper filters then it does
> not pass the test either.
> 

sure, it can be filtered, but not all software runs in a sandbox and not
all attack vectors need end in priv-esc or launching new tasks.  It
does not require LD_PRELOAD to be useful to an attacker.

just as an example, if i land remote execution in a task, i can enable
syscall user dispatch and just steal cpu time from that task whenever it
makes a syscall without having to do any of the traditional tricks of
overwriting GDT entries to get hooks.  No need for ld preloading or even
leaving the active task's context.

syscall user dispatch is just a really clean, powerful tool for writing
implants.  I've been playing with it for the better part of 2 years and
just realized I don't want it enabled (or even present at all) on some
of my machines / machines I manage and there's no way to do that.

> I agree that disabling it alltogether reduces the effort, but it's not a
> prerequisite.
> 
> > +config SYSCALL_USER_DISPATCH
> > +	bool "Syscall User Dispatch (SUD)"
> > +	depends on GENERIC_ENTRY
> > +	default y
> > +	help
> > +	  Syscall User Dispatch (SUD) lets a thread have its own system calls
> > +	  redirected to a userspace handler.  It is used by emulators that run
> > +	  foreign binaries which issue system calls directly.
> 
> Huch?
> 
> What is foreign? Different country, different universe or different
> mindset?
> 
> It's also not restricted to emulators. It allows to intercept and abort
> system calls which are issued within a certain IP address range and
> redirect them to a emulator or debugger. 
> 

foreign meaning non-linux, but sure i'll change it to be more general.

> 
> >--- a/include/linux/syscall_user_dispatch.h
> >+++ b/include/linux/syscall_user_dispatch.h
> >@@ -7,8 +7,22 @@
> >
> > #include <linux/thread_info.h>
> > #include <linux/syscall_user_dispatch_types.h>
> > +#include <linux/sched.h>
> 
> Why does this require to pull in the heaviest header?
> 

we dereference current (struct task_struct)

> > +bool syscall_user_dispatch(struct pt_regs *regs);
> > +
> > +static inline bool syscall_user_dispatch_clear_on_dispatch(void)
> 
> Wants to be __always_inline as otherwise agressive compilers like CLANG
> happily put it out of line.
>

ack.