seccomp.2: Note that memory area is read-only

Hi Kees,

I recently was asked about the point below, and had to go check the code to be sure, since the man page said nothing. It would be good to have a confirmation: the seccomp_data buffer supplied to a seccomp BPF program is read-only, right? (That is, one can't write to the buffer in order to change the arguments that a system call actually receives.)

A small man page patch below.

Cheers,

Michael

man2/seccomp.2 +1 -2

@@ -232,15 +232,15 @@ struct sock_filter {            /* Filter block */
 };
 .fi
 .in
 
 When executing the instructions, the BPF program operates on the
 system call information made available (i.e., use the
 .BR BPF_ABS
-addressing mode) as a buffer of the following form:
+addressing mode) as a (read-only) buffer of the following form:
 
 .in +4n
 .nf
 struct seccomp_data {
     int   nr;                   /* System call number */
     __u32 arch;                 /* AUDIT_ARCH_* value
                                    (see <linux/audit.h>) */
 
 
--

Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/

Hi Kees,

I recently was asked about the point below, and had to go check the code to be sure, since the man page said nothing. It would be good to have a confirmation: the seccomp_data buffer supplied to a seccomp BPF program is read-only, right? (That is, one can't write to the buffer in order to change the arguments that a system call actually receives.)

A small man page patch below.

Cheers,

Michael

man2/seccomp.2 +1 -2

@@ -232,15 +232,15 @@ struct sock_filter {            /* Filter block */
 };
 .fi
 .in
 
 When executing the instructions, the BPF program operates on the
 system call information made available (i.e., use the
 .BR BPF_ABS
-addressing mode) as a buffer of the following form:
+addressing mode) as a (read-only) buffer of the following form:
 
 .in +4n
 .nf
 struct seccomp_data {
     int   nr;                   /* System call number */
     __u32 arch;                 /* AUDIT_ARCH_* value
                                    (see <linux/audit.h>) */
 
 
--

Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/

Quoted 7 lines · Michael Kerrisk (man-pages)

Hi Kees,

I recently was asked about the point below, and had to go check the code to be sure, since the man page said nothing. It would be good to have a confirmation: the seccomp_data buffer supplied to a seccomp BPF program is read-only, right? (That is, one can't write to the buffer in order to change the arguments that a system call actually receives.)

That's correct. If BPF even allows changing the data, it's not copied back to the syscall when it runs. Anything wanting to do things like that would need to use ptrace to catch the call an directly modify the registers before continuing with the call.

Quoted 7 lines · Michael Kerrisk (man-pages)

Hi Kees,

I recently was asked about the point below, and had to go check the code to be sure, since the man page said nothing. It would be good to have a confirmation: the seccomp_data buffer supplied to a seccomp BPF program is read-only, right? (That is, one can't write to the buffer in order to change the arguments that a system call actually receives.)

That's correct. If BPF even allows changing the data, it's not copied back to the syscall when it runs. Anything wanting to do things like that would need to use ptrace to catch the call an directly modify the registers before continuing with the call.

Quoted 1 line

Quoted 1 line

A small man page patch below.

Looks good, thanks!

Quoted 22 lines

man2/seccomp.2 +1 -2

@@ -232,15 +232,15 @@ struct sock_filter {            /* Filter block */
 };
 .fi
 .in
 
 When executing the instructions, the BPF program operates on the
 system call information made available (i.e., use the
 .BR BPF_ABS
-addressing mode) as a buffer of the following form:
+addressing mode) as a (read-only) buffer of the following form:
 
 .in +4n
 .nf
 struct seccomp_data {
     int   nr;                   /* System call number */
     __u32 arch;                 /* AUDIT_ARCH_* value
                                    (see <linux/audit.h>) */
 
 
--

Quoted 3 lines

Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/

--
Kees Cook
Chrome OS Security