arm/ptrace: run seccomp after ptrace
authorKees Cook <keescook@chromium.org>
Thu, 2 Jun 2016 19:16:31 +0000 (12:16 -0700)
committerKees Cook <keescook@chromium.org>
Tue, 14 Jun 2016 17:54:42 +0000 (10:54 -0700)
Close the hole where ptrace can change a syscall out from under seccomp.

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Russell King <linux@armlinux.org.uk>
Cc: linux-arm-kernel@lists.infradead.org
arch/arm/kernel/ptrace.c

index 1027d3b54541686bc118aa940b2e275b9c1ac140..ce131ed5939d5ff86054afc3a14de7cb51225a79 100644 (file)
@@ -932,18 +932,19 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs, int scno)
 {
        current_thread_info()->syscall = scno;
 
-       /* Do the secure computing check first; failures should be fast. */
+       if (test_thread_flag(TIF_SYSCALL_TRACE))
+               tracehook_report_syscall(regs, PTRACE_SYSCALL_ENTER);
+
+       /* Do seccomp after ptrace; syscall may have changed. */
 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
        if (secure_computing(NULL) == -1)
                return -1;
 #else
        /* XXX: remove this once OABI gets fixed */
-       secure_computing_strict(scno);
+       secure_computing_strict(current_thread_info()->syscall);
 #endif
 
-       if (test_thread_flag(TIF_SYSCALL_TRACE))
-               tracehook_report_syscall(regs, PTRACE_SYSCALL_ENTER);
-
+       /* Tracer or seccomp may have changed syscall. */
        scno = current_thread_info()->syscall;
 
        if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))