Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a5cd110c authored by Kees Cook's avatar Kees Cook
Browse files

arm64/ptrace: run seccomp after ptrace 



Close the hole where ptrace can change a syscall out from under seccomp.

Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: linux-arm-kernel@lists.infradead.org
parent 0f3912fd

arch/arm64/kernel/ptrace.c

+4 −4
Original line number Diff line number Diff line
@@ -1246,13 +1246,13 @@ static void tracehook_report_syscall(struct pt_regs *regs, 


asmlinkage int syscall_trace_enter(struct pt_regs *regs)

{

	/* Do the secure computing check first; failures should be fast. */

	if (secure_computing(NULL) == -1)

		return -1;



	if (test_thread_flag(TIF_SYSCALL_TRACE))

		tracehook_report_syscall(regs, PTRACE_SYSCALL_ENTER);



	/* Do the secure computing after ptrace; failures should be fast. */

	if (secure_computing(NULL) == -1)

		return -1;



	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))

		trace_sys_enter(regs, regs->syscallno);