Commit 375f0183 authored by Kees Cook's avatar Kees Cook

parisc/ptrace: run seccomp after ptrace

Close the hole where ptrace can change a syscall out from under seccomp.
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Cc: "James E.J. Bottomley" <jejb@parisc-linux.org>
Cc: Helge Deller <deller@gmx.de>
Cc: linux-parisc@vger.kernel.org
parent 2ac3c8d1
...@@ -311,10 +311,6 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request, ...@@ -311,10 +311,6 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
long do_syscall_trace_enter(struct pt_regs *regs) long do_syscall_trace_enter(struct pt_regs *regs)
{ {
/* Do the secure computing check first. */
if (secure_computing(NULL) == -1)
return -1;
if (test_thread_flag(TIF_SYSCALL_TRACE) && if (test_thread_flag(TIF_SYSCALL_TRACE) &&
tracehook_report_syscall_entry(regs)) { tracehook_report_syscall_entry(regs)) {
/* /*
...@@ -325,6 +321,11 @@ long do_syscall_trace_enter(struct pt_regs *regs) ...@@ -325,6 +321,11 @@ long do_syscall_trace_enter(struct pt_regs *regs)
regs->gr[20] = -1UL; regs->gr[20] = -1UL;
goto out; goto out;
} }
/* Do the secure computing check after ptrace. */
if (secure_computing(NULL) == -1)
return -1;
#ifdef CONFIG_HAVE_SYSCALL_TRACEPOINTS #ifdef CONFIG_HAVE_SYSCALL_TRACEPOINTS
if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT))) if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
trace_sys_enter(regs, regs->gr[20]); trace_sys_enter(regs, regs->gr[20]);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment