From mboxrd@z Thu Jan 1 00:00:00 1970 From: Alexei Starovoitov Subject: Re: [PATCH net-next] seccomp, ptrace: add support for dumping seccomp filters Date: Mon, 26 Oct 2015 20:39:50 -0700 Message-ID: <20151027033949.GA26775@Alexeis-MacBook-Pro.local> References: <1445905439-25449-1-git-send-email-tycho.andersen@canonical.com> <1445905439-25449-2-git-send-email-tycho.andersen@canonical.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: "David S. Miller" , Kees Cook , Alexei Starovoitov , Will Drewry , Oleg Nesterov , Andy Lutomirski , Pavel Emelyanov , "Serge E. Hallyn" , Daniel Borkmann , linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-api-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, netdev-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: Tycho Andersen Return-path: Content-Disposition: inline In-Reply-To: <1445905439-25449-2-git-send-email-tycho.andersen-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org> Sender: linux-api-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org List-Id: netdev.vger.kernel.org On Tue, Oct 27, 2015 at 09:23:59AM +0900, Tycho Andersen wrote: > This patch adds support for dumping a process' (classic BPF) seccomp > filters via ptrace. > > PTRACE_SECCOMP_GET_FILTER allows the tracer to dump the user's classic BPF > seccomp filters. addr should be an integer which represents the ith seccomp > filter (0 is the most recently installed filter). data should be a struct > sock_filter * with enough room for the ith filter, or NULL, in which case > the filter is not saved. The return value for this command is the number of > BPF instructions the program represents, or negative in the case of errors. > Command specific errors are ENOENT: which indicates that there is no ith > filter in this seccomp tree, and EMEDIUMTYPE, which indicates that the ith > filter was not installed as a classic BPF filter. > > A caveat with this approach is that there is no way to get explicitly at > the heirarchy of seccomp filters, and users need to memcmp() filters to > decide which are inherited. This means that a task which installs two of > the same filter can potentially confuse users of this interface. > > v2: * make save_orig const > * check that the orig_prog exists (not necessary right now, but when > grows eBPF support it will be) > * s/n/filter_off and make it an unsigned long to match ptrace > * count "down" the tree instead of "up" when passing a filter offset > > v3: * don't take the current task's lock for inspecting its seccomp mode > * use a 0x42** constant for the ptrace command value > > v4: * don't copy to userspace while holding spinlocks > > v5: * add another condition to WARN_ON > > v6: * rebase on net-next > > Signed-off-by: Tycho Andersen > Acked-by: Kees Cook > CC: Will Drewry > Reviewed-by: Oleg Nesterov > CC: Andy Lutomirski > CC: Pavel Emelyanov > CC: Serge E. Hallyn > CC: Alexei Starovoitov > CC: Daniel Borkmann Looks fine. Acked-by: Alexei Starovoitov