Re: [PATCH 00/35] Shadow stacks for userspace
From: "Andy Lutomirski" <luto@kernel.org>
Date: 2022-02-28 22:56:04
Also in:
linux-arch, linux-doc, linux-mm, lkml
On Mon, Feb 28, 2022, at 1:30 PM, Mike Rapoport wrote:
On Mon, Feb 28, 2022 at 12:30:41PM -0800, Andy Lutomirski wrote:quoted
On Mon, Feb 28, 2022, at 12:27 PM, Mike Rapoport wrote:quoted
On Wed, Feb 09, 2022 at 06:37:53PM -0800, Andy Lutomirski wrote:quoted
On 2/8/22 18:18, Edgecombe, Rick P wrote:quoted
On Tue, 2022-02-08 at 20:02 +0300, Cyrill Gorcunov wrote:Even with the current shadow stack interface Rick proposed, CRIU can restore the victim using ptrace without any additional knobs, but we loose an important ability to "self-cure" the victim from the parasite in case anything goes wrong with criu control process. Moreover, the issue with backward compatibility is not with ptrace but with sigreturn and it seems that criu is not its only user.So we need an ability for a tracer to cause the tracee to call a function and to return successfully. Apparently a gdb branch can already do this with shstk, and my PTRACE_CALL_FUNCTION_SIGFRAME should also do the trick. I don't see why we need a sigretur-but-dont-verify -- we just need this mechanism to create a frame such that sigreturn actually works.If I understand correctly, PTRACE_CALL_FUNCTION_SIGFRAME() injects a frame into the tracee and makes the tracee call sigreturn. I.e. the tracee is stopped and this is used pretty much as PTRACE_CONT or PTRACE_SYSCALL. In such case this defeats the purpose of sigreturn in CRIU because it is called asynchronously by the tracee when the tracer is about to detach or even already detached.
The intent of PTRACE_CALL_FUNCTION_SIGFRAME is push a signal frame onto the stack and call a function. That function should then be able to call sigreturn just like any normal signal handler. There should be no requirement that the tracer still be attached when this happens, although the code calling sigreturn still needs to be mapped. (Specifically, on modern arches, the user runtime is expected to provide a "restorer" that calls sigreturn. A hypotheticall PTRACE_CALL_FUNCTION_SIGFRAME would either need to call sigreturn directly or provide a restorer.)