[PATCH v9 1/3] seccomp: let the tracer skip a syscall independently of its number
flat view
WARM3d
From: Renzo Davoli <hidden>
Date: 2026-10-20 15:29:58
Also in:
linux-kselftest, linux-s390, lkml
Subsystem:
secure computing, the rest · Maintainers:
Kees Cook, Linus Torvalds
Revision v9 of 9 in this series.
Revisions (9)
From: Davide Berardi <redacted> At a PTRACE_EVENT_SECCOMP stop the tracer can only skip the system call by setting its number to -1, which seccomp reads back with syscall_get_nr(). This depends on how each architecture lays out the syscall number and the return value in the registers: - on some architectures the syscall number shares a register with the return value (e.g. v0 on MIPS), so setting the return value after the number would overwrite the skip request, and each of them needs its own way to keep it (MIPS keeps a copy of the number in thread_info); - on s390 syscall_get_nr() returns the low 16 bits of int_code, so -1 is read back as 65535: seccomp does not skip the call but runs the filters again on syscall 65535, which kills the task if the filter denies unknown syscalls. Add a per-task flag which the tracer sets with seccomp_ptrace_skip_syscall() while the tracee is stopped at the PTRACE_EVENT_SECCOMP stop, after it has set the return value. When the tracee resumes, seccomp skips the system call like for SECCOMP_RET_ERRNO, which every architecture already handles without touching the return value. The flag is cleared by the tracee before the stop and written by the tracer only while the tracee is stopped, so it needs no locking: the wake-up of the tracee orders it like the registers written by the tracer. The next patch uses this in PTRACE_SET_SYSCALL_INFO. Suggested-by: Michal Suchánek <redacted> Assisted-by: claude-opus-5-5 Signed-off-by: Renzo Davoli <redacted> --- include/linux/seccomp.h | 33 +++++++++++++++++++++++++++++++++ include/linux/seccomp_types.h | 4 ++++ kernel/seccomp.c | 11 ++++++++++- 3 files changed, 47 insertions(+), 1 deletion(-)
diff --git a/include/linux/seccomp.h b/include/linux/seccomp.h
index fcb3eb9825e5..ee31857f3ba6 100644
--- a/include/linux/seccomp.h
+++ b/include/linux/seccomp.h@@ -75,6 +75,32 @@ static inline int seccomp_mode(struct seccomp *s) #ifdef CONFIG_SECCOMP_FILTER extern void seccomp_filter_release(struct task_struct *tsk); extern void get_seccomp_filter(struct task_struct *tsk); + +/** + * seccomp_ptrace_skip_syscall - make a tracee skip the current system call + * @tsk: tracee stopped at a PTRACE_EVENT_SECCOMP stop + * + * Must only be called by the tracer of @tsk while @tsk is stopped at a + * PTRACE_EVENT_SECCOMP stop, after it has set the return value of the system + * call. When the tracee resumes, the system call is skipped and the return + * value is left untouched, like with SECCOMP_RET_ERRNO. + */ +static inline void seccomp_ptrace_skip_syscall(struct task_struct *tsk) +{ + tsk->seccomp.ptrace_skip = true; +} + +/** + * seccomp_ptrace_syscall_skipped - check for seccomp_ptrace_skip_syscall() + * @tsk: tracee stopped at a PTRACE_EVENT_SECCOMP stop + * + * Return: true if the tracer requested to skip the system call during the + * current PTRACE_EVENT_SECCOMP stop of @tsk. + */ +static inline bool seccomp_ptrace_syscall_skipped(struct task_struct *tsk) +{ + return tsk->seccomp.ptrace_skip; +} #else /* CONFIG_SECCOMP_FILTER */ static inline void seccomp_filter_release(struct task_struct *tsk) {
@@ -84,6 +110,13 @@ static inline void get_seccomp_filter(struct task_struct *tsk) { return; } +static inline void seccomp_ptrace_skip_syscall(struct task_struct *tsk) +{ +} +static inline bool seccomp_ptrace_syscall_skipped(struct task_struct *tsk) +{ + return false; +} #endif /* CONFIG_SECCOMP_FILTER */ #if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
diff --git a/include/linux/seccomp_types.h b/include/linux/seccomp_types.h
index cf0a0355024f..4bdb8424055b 100644
--- a/include/linux/seccomp_types.h
+++ b/include/linux/seccomp_types.h@@ -18,11 +18,15 @@ struct seccomp_filter; * * @filter must only be accessed from the context of current as there * is no read locking. + * @ptrace_skip: set by the tracer while the task is stopped at a + * PTRACE_EVENT_SECCOMP stop to request that the system call is + * skipped, after it has set the return value. */ struct seccomp { int mode; atomic_t filter_count; struct seccomp_filter *filter; + bool ptrace_skip; }; #else
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index 86cf4460d69e..edeb21fa3e23 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c@@ -1306,6 +1306,7 @@ static bool __seccomp_filter(int this_syscall, const bool recheck_after_trace) } /* Allow the BPF to provide the event message */ + current->seccomp.ptrace_skip = false; ptrace_event(PTRACE_EVENT_SECCOMP, data); /* * The delivery of a fatal signal during event
@@ -1319,7 +1320,15 @@ static bool __seccomp_filter(int this_syscall, const bool recheck_after_trace) */ if (fatal_signal_pending(current)) goto skip; - /* Check if the tracer forced the syscall to be skipped. */ + /* + * Check if the tracer forced the syscall to be skipped, either + * with seccomp_ptrace_skip_syscall(), which does not depend on + * how the architecture encodes the syscall number and the + * return value in the registers, or by setting the syscall + * number to -1. + */ + if (current->seccomp.ptrace_skip) + goto skip; this_syscall = syscall_get_nr(current, current_pt_regs()); if (this_syscall < 0) goto skip;
--
2.55.0