Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Mon, 26 Nov 2018 15:35:24 +0100
From:   Oleg Nesterov <oleg@redhat.com>
To:     Elvira Khabirova <lineprinter@altlinux.org>
Cc:     rostedt@goodmis.org, mingo@redhat.com,
        linux-kernel@vger.kernel.org, ldv@altlinux.org, esyr@redhat.com,
        luto@kernel.org, strace-devel@lists.strace.io,
        linux-api@vger.kernel.org
Subject: Re: [RFC PATCH RESEND v3 3/3] ptrace: add PTRACE_EVENT_SECCOMP
 support to PTRACE_GET_SYSCALL_INFO
Message-ID: <20181126143524.GB1660@redhat.com>
References: <20181125022150.46258a20@akathisia>
 <20181125022340.5703400f@akathisia>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20181125022340.5703400f@akathisia>
User-Agent: Mutt/1.5.24 (2015-08-30)
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On 11/25, Elvira Khabirova wrote:
>
> Extend PTRACE_GET_SYSCALL_INFO to support PTRACE_EVENT_SECCOMP stops.
> The information returned is the same as for syscall-enter-stops.

Oh, this is not nice ;) there must be a better option, I hope... Plus


Can't ptrace_get_syscall() check

	child->exit_code == (PTRACE_EVENT_SECCOMP << 8) | SIGTRAP;

to detect the PTRACE_EVENT_SECCOMP case?

Oleg.

> Signed-off-by: Elvira Khabirova <lineprinter@altlinux.org>
> Signed-off-by: Dmitry V. Levin <ldv@altlinux.org>
> ---
>  include/linux/ptrace.h    | 1 +
>  include/linux/sched.h     | 1 +
>  include/linux/tracehook.h | 1 +
>  kernel/ptrace.c           | 7 +++++--
>  4 files changed, 8 insertions(+), 2 deletions(-)
> 
> diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h
> index 6c2ffed907f5..a993d0fde865 100644
> --- a/include/linux/ptrace.h
> +++ b/include/linux/ptrace.h
> @@ -166,6 +166,7 @@ static inline void ptrace_event(int event, unsigned long message)
>  {
>  	if (unlikely(ptrace_event_enabled(current, event))) {
>  		current->ptrace_message = message;
> +		current->ptrace_event = event;
>  		ptrace_notify((event << 8) | SIGTRAP);
>  	} else if (event == PTRACE_EVENT_EXEC) {
>  		/* legacy EXEC report via SIGTRAP */
> diff --git a/include/linux/sched.h b/include/linux/sched.h
> index a51c13c2b1a0..86215fb654d6 100644
> --- a/include/linux/sched.h
> +++ b/include/linux/sched.h
> @@ -964,6 +964,7 @@ struct task_struct {
>  
>  	/* Ptrace state: */
>  	unsigned long			ptrace_message;
> +	int				ptrace_event;
>  	kernel_siginfo_t		*last_siginfo;
>  
>  	struct task_io_accounting	ioac;
> diff --git a/include/linux/tracehook.h b/include/linux/tracehook.h
> index 633a83fe7051..5d2e5aa07a5c 100644
> --- a/include/linux/tracehook.h
> +++ b/include/linux/tracehook.h
> @@ -66,6 +66,7 @@ static inline int ptrace_report_syscall(struct pt_regs *regs,
>  		return 0;
>  
>  	current->ptrace_message = message;
> +	current->ptrace_event = 0;
>  	ptrace_notify(SIGTRAP | ((ptrace & PT_TRACESYSGOOD) ? 0x80 : 0));
>  
>  	/*
> diff --git a/kernel/ptrace.c b/kernel/ptrace.c
> index 92c47cd5ad84..74a37e74c7f1 100644
> --- a/kernel/ptrace.c
> +++ b/kernel/ptrace.c
> @@ -904,7 +904,9 @@ static int ptrace_get_syscall(struct task_struct *child,
>  	unsigned long actual_size;
>  	unsigned long write_size;
>  
> -	if (child->ptrace_message == PTRACE_EVENTMSG_SYSCALL_ENTRY) {
> +	if ((child->ptrace_event == 0 &&
> +	     child->ptrace_message == PTRACE_EVENTMSG_SYSCALL_ENTRY) ||
> +	    child->ptrace_event == PTRACE_EVENT_SECCOMP) {
>  		int i;
>  
>  		info.op = PTRACE_SYSCALL_INFO_ENTRY;
> @@ -917,7 +919,8 @@ static int ptrace_get_syscall(struct task_struct *child,
>  		for (i = 0; i < ARRAY_SIZE(args); i++)
>  			info.entry.args[i] = args[i];
>  		actual_size = offsetofend(struct ptrace_syscall_info, entry);
> -	} else if (child->ptrace_message == PTRACE_EVENTMSG_SYSCALL_EXIT) {
> +	} else if (child->ptrace_event == 0 &&
> +		   child->ptrace_message == PTRACE_EVENTMSG_SYSCALL_EXIT) {
>  		info.op = PTRACE_SYSCALL_INFO_EXIT;
>  		info.arch = syscall_get_arch(child);
>  		info.exit.rval = syscall_get_error(child, regs);
> -- 
> 2.19.1
>