Re: [PATCH v2] seccomp: passthrough uretprobe systemcall without filtering

On Wed, Jan 29, 2025 at 9:27 AM Eyal Birger [off-list ref] wrote:

Hi,

Thanks for the review!

On Tue, Jan 28, 2025 at 5:41 PM Kees Cook [off-list ref] wrote:

quoted

On Tue, Jan 28, 2025 at 06:58:06AM -0800, Eyal Birger wrote:

quoted

Note: uretprobe isn't supported in i386 and __NR_ia32_rt_tgsigqueueinfo
uses the same number as __NR_uretprobe so the syscall isn't forced in the
compat bitmap.

So a 64-bit tracer cannot use uretprobe on a 32-bit process? Also is
uretprobe strictly an x86_64 feature?

My understanding is that they'd be able to do so, but use the int3 trap
instead of the uretprobe syscall.

Syscall-based uretprobe implementation is strictly x86-64 and I don't
think we have any plans to expand it beyond x86-64. But uretprobes in
general do work across many bitnesses and architectures, they are just
implemented through a trap approach (int3 on x86), so none of that
should be relevant to seccomp. It's just that trapping on x86-64 is
that much slower that we had to do syscall to speed it up but quite a
lot.

quoted

quoted

[...]

diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index 385d48293a5f..23b594a68bc0 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c

@@ -734,13 +734,13 @@ seccomp_prepare_user_filter(const char __user *user_filter)

[...]