Commit 635efc70 authored by Kees Cook's avatar Kees Cook

tile/ptrace: run seccomp after ptrace

Close the hole where ptrace can change a syscall out from under seccomp.
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Cc: Chris Metcalf <cmetcalf@mellanox.com>
parent 1addc57e
...@@ -255,14 +255,15 @@ int do_syscall_trace_enter(struct pt_regs *regs) ...@@ -255,14 +255,15 @@ int do_syscall_trace_enter(struct pt_regs *regs)
{ {
u32 work = ACCESS_ONCE(current_thread_info()->flags); u32 work = ACCESS_ONCE(current_thread_info()->flags);
if (secure_computing(NULL) == -1) if ((work & _TIF_SYSCALL_TRACE) &&
tracehook_report_syscall_entry(regs)) {
regs->regs[TREG_SYSCALL_NR] = -1;
return -1; return -1;
if (work & _TIF_SYSCALL_TRACE) {
if (tracehook_report_syscall_entry(regs))
regs->regs[TREG_SYSCALL_NR] = -1;
} }
if (secure_computing(NULL) == -1)
return -1;
if (work & _TIF_SYSCALL_TRACEPOINT) if (work & _TIF_SYSCALL_TRACEPOINT)
trace_sys_enter(regs, regs->regs[TREG_SYSCALL_NR]); trace_sys_enter(regs, regs->regs[TREG_SYSCALL_NR]);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment