On Thu, Sep 06, 2018 at 05:45:25PM +0200, Jann Horn wrote:

On Thu, Sep 6, 2018 at 5:29 PM Tycho Andersen [off-list ref] wrote:

quoted

As an alternative to SECCOMP_FILTER_FLAG_GET_LISTENER, perhaps a ptrace()
version which can acquire filters is useful. There are at least two reasons
this is preferable, even though it uses ptrace:

1. You can control tasks that aren't cooperating with you
2. You can control tasks whose filters block sendmsg() and socket(); if the
   task installs a filter which blocks these calls, there's no way with
   SECCOMP_FILTER_FLAG_GET_LISTENER to get the fd out to the privileged task.

[...]

quoted

+long seccomp_new_listener(struct task_struct *task,
+                         unsigned long filter_off)
+{
+       struct seccomp_filter *filter;
+       struct file *listener;
+       int fd;
+
+       if (!capable(CAP_SYS_ADMIN))
+               return -EACCES;
+
+       filter = get_nth_filter(task, filter_off);
+       if (IS_ERR(filter))
+               return PTR_ERR(filter);
+
+       fd = get_unused_fd_flags(0);
+       if (fd < 0) {
+               __put_seccomp_filter(filter);
+               return fd;
+       }
+
+       listener = init_listener(task, task->seccomp.filter);

Did you mean to write something like `init_listener(task, filter)` here?

Yes, yes I did. Thanks, Jann.

Tycho