Skip to contentSkip to conversation

seccomp: Add SECCOMP_RET_INFO return value

PATCH In review Corey Bryant 2 participants 5 messages Jan 7, 2013 – Jan 14, 2013

Subsystems (2)
Documentation Secure computing
lore
Share & tools
lore

Corey Bryant

author
#0 lore raw

PATCH v2 1/3 seccomp: Add SECCOMP_RET_INFO return value

Adds a new return value to seccomp filters that causes an informational kernel message to be printed. The message includes the system call number and architecture.

This can be used to learn the system calls that a process is using.

Signed-off-by Corey Bryant <[email protected]>

---
v2:
- Add arch to message ([email protected])

 include/uapi/linux/seccomp.h | 1 +
 kernel/seccomp.c             | 6 ++++++
 2 files changed, 7 insertions(+)
include/uapi/linux/seccomp.h +1 -0
index ac2dc9f..0086626 100644
@@ -22,6 +22,7 @@
 #define SECCOMP_RET_TRAP	0x00030000U /* disallow and force a SIGSYS */
 #define SECCOMP_RET_ERRNO	0x00050000U /* returns an errno */
 #define SECCOMP_RET_TRACE	0x7ff00000U /* pass to a tracer or disallow */
+#define SECCOMP_RET_INFO	0x7ff70000U /* print info message and allow */
 #define SECCOMP_RET_ALLOW	0x7fff0000U /* allow */
 
 /* Masks for the return value sections. */
kernel/seccomp.c +6 -0
index 5af44b5..954bb40 100644
@@ -433,6 +433,12 @@ int __secure_computing(int this_syscall)
 				goto skip;  /* Explicit request to skip. */
 
 			return 0;
+		case SECCOMP_RET_INFO:
+			if (printk_ratelimit())
+				pr_info("seccomp: syscall=%d, arch=0x%X\n",
+					this_syscall,
+					syscall_get_arch(current, regs));
+			return 0;
 		case SECCOMP_RET_ALLOW:
 			return 0;
 		case SECCOMP_RET_KILL:
Signature · 1 line
1.7.11.7
author
#1 lore raw

PATCH v2 2/3 Documentation: SECCOMP_RET_INFO return value

Adds documentation describing the SECCOMP_RET_INFO return value.

Signed-off-by Corey Bryant <[email protected]>

---
v2:
- Add arch to message ([email protected])

 Documentation/prctl/seccomp_filter.txt | 8 ++++++++
 1 file changed, 8 insertions(+)
Documentation/prctl/seccomp_filter.txt +8 -0
index 1e469ef..88d6882 100644
@@ -49,6 +49,7 @@ CONFIG_HAVE_ARCH_SECCOMP_FILTER, then filters may be added as below:
 PR_SET_SECCOMP:
 	Now takes an additional argument which specifies a new filter
 	using a BPF program.
+
 	The BPF program will be executed over struct seccomp_data
 	reflecting the system call number, arguments, and other
 	metadata.  The BPF program must then return one of the

@@ -138,6 +139,13 @@ SECCOMP_RET_TRACE:
 	allow use of ptrace, even of other sandboxed processes, without
 	extreme care; ptracers can use this mechanism to escape.)
 
+SECCOMP_RET_INFO:
+	Results in a rate-limited informational kernel message that
+	includes the system call number and architecture, and the
+	system call is executed.  The message format is:
+	"seccomp: syscall=x, arch=y", where x is the system call number
+	and y is the architecture.
+
 SECCOMP_RET_ALLOW:
 	Results in the system call being executed.
Signature · 1 line
1.7.11.7
author
#2 lore raw

PATCH v2 3/3 samples: Add sample using SECCOMP_RET_INFO

In reply to Corey Bryant

Adds a sample that demonstrates use of the SECCOMP_RET_INFO return value.

Signed-off-by Corey Bryant <[email protected]>

---
v2:
- Modify test to use fprintf and add arch hints

 samples/seccomp/Makefile     |  8 ++++++-
 samples/seccomp/bpf-logger.c | 50 ++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 57 insertions(+), 1 deletion(-)
 create mode 100644 samples/seccomp/bpf-logger.c
samples/seccomp/Makefile +7 -1
index bbbd276..ee769bb 100644
@@ -1,7 +1,7 @@
 # kbuild trick to avoid linker error. Can be omitted if a module is built.
 obj- := dummy.o
 
-hostprogs-$(CONFIG_SECCOMP_FILTER) := bpf-fancy dropper bpf-direct
+hostprogs-$(CONFIG_SECCOMP_FILTER) := bpf-fancy dropper bpf-direct bpf-logger
 
 HOSTCFLAGS_bpf-fancy.o += -I$(objtree)/usr/include
 HOSTCFLAGS_bpf-fancy.o += -idirafter $(objtree)/include

@@ -17,6 +17,10 @@ HOSTCFLAGS_bpf-direct.o += -I$(objtree)/usr/include
 HOSTCFLAGS_bpf-direct.o += -idirafter $(objtree)/include
 bpf-direct-objs := bpf-direct.o
 
+HOSTCFLAGS_bpf-logger.o += -I$(objtree)/usr/include
+HOSTCFLAGS_bpf-logger.o += -idirafter $(objtree)/include
+bpf-logger-objs := bpf-logger.o
+
 # Try to match the kernel target.
 ifndef CONFIG_64BIT
 

@@ -31,9 +35,11 @@ HOSTCFLAGS_bpf-direct.o += $(MFLAG)
 HOSTCFLAGS_dropper.o += $(MFLAG)
 HOSTCFLAGS_bpf-helper.o += $(MFLAG)
 HOSTCFLAGS_bpf-fancy.o += $(MFLAG)
+HOSTCFLAGS_bpf-logger.o += $(MFLAG)
 HOSTLOADLIBES_bpf-direct += $(MFLAG)
 HOSTLOADLIBES_bpf-fancy += $(MFLAG)
 HOSTLOADLIBES_dropper += $(MFLAG)
+HOSTLOADLIBES_bpf-logger += $(MFLAG)
 endif
 
 # Tell kbuild to always build the programs
samples/seccomp/bpf-logger.c new file +50 -0

50 lines not on this page · raw message

Signature · 1 line
1.7.11.7
#3 lore raw
In reply to Corey Bryant
Quoted 8 lines · Corey Bryant

Adds a new return value to seccomp filters that causes an informational kernel message to be printed. The message includes the system call number and architecture.

This can be used to learn the system calls that a process is using.

Signed-off-by Corey Bryant <[email protected]>

Were do things currently stand with this patchset? It still seems like a reasonable addition to me.

Signature · 2 lines
paul moore
security and virtualization @ redhat
author
#4 lore raw
Quoted 5 lines · Paul Moore
Quoted 4 lines · Corey Bryant

Adds a new return value to seccomp filters that causes an informational kernel message to be printed. The message includes the system call number and architecture.

Quoted 8 lines
Quoted 4 lines

This can be used to learn the system calls that a process is using.

Signed-off-by Corey Bryant <[email protected]>

Were do things currently stand with this patchset? It still seems like a reasonable addition to me.

Thanks for asking. I haven't heard anything in response to the v2 patches. Does anyone have any comments/thoughts?

Signature · 2 lines
Regards,
Corey Bryant