diff options
| author | Kees Cook <keescook@chromium.org> | 2016-06-02 12:28:52 -0700 |
|---|---|---|
| committer | Kees Cook <keescook@chromium.org> | 2016-06-14 10:54:43 -0700 |
| commit | a5cd110cb8369d6b37ef5ccfe56b3fa1338c9615 (patch) | |
| tree | c177ca1e824ad48939000fbd8c6df29e3ef84498 /arch/arm64/kernel/ptrace.c | |
| parent | 0f3912fd934cdfd03d93f2dc6f064099795bf638 (diff) | |
| download | linux-a5cd110cb8369d6b37ef5ccfe56b3fa1338c9615.tar.gz linux-a5cd110cb8369d6b37ef5ccfe56b3fa1338c9615.tar.xz | |
arm64/ptrace: run seccomp after ptrace
Close the hole where ptrace can change a syscall out from under seccomp.
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: linux-arm-kernel@lists.infradead.org
Diffstat (limited to 'arch/arm64/kernel/ptrace.c')
| -rw-r--r-- | arch/arm64/kernel/ptrace.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c index 6e2cf046615d..602316c97a47 100644 --- a/arch/arm64/kernel/ptrace.c +++ b/arch/arm64/kernel/ptrace.c @@ -1246,13 +1246,13 @@ static void tracehook_report_syscall(struct pt_regs *regs, asmlinkage int syscall_trace_enter(struct pt_regs *regs) { - /* Do the secure computing check first; failures should be fast. */ - if (secure_computing(NULL) == -1) - return -1; - if (test_thread_flag(TIF_SYSCALL_TRACE)) tracehook_report_syscall(regs, PTRACE_SYSCALL_ENTER); + /* Do the secure computing after ptrace; failures should be fast. */ + if (secure_computing(NULL) == -1) + return -1; + if (test_thread_flag(TIF_SYSCALL_TRACEPOINT)) trace_sys_enter(regs, regs->syscallno); |