On Wed, Jan 29, 2025 at 9:27 AM Eyal Birger eyal.birger@gmail.com wrote:
Hi,
Thanks for the review!
On Tue, Jan 28, 2025 at 5:41 PM Kees Cook kees@kernel.org wrote:
On Tue, Jan 28, 2025 at 06:58:06AM -0800, Eyal Birger wrote:
Note: uretprobe isn't supported in i386 and __NR_ia32_rt_tgsigqueueinfo uses the same number as __NR_uretprobe so the syscall isn't forced in the compat bitmap.
So a 64-bit tracer cannot use uretprobe on a 32-bit process? Also is uretprobe strictly an x86_64 feature?
My understanding is that they'd be able to do so, but use the int3 trap instead of the uretprobe syscall.
Syscall-based uretprobe implementation is strictly x86-64 and I don't think we have any plans to expand it beyond x86-64. But uretprobes in general do work across many bitnesses and architectures, they are just implemented through a trap approach (int3 on x86), so none of that should be relevant to seccomp. It's just that trapping on x86-64 is that much slower that we had to do syscall to speed it up but quite a lot.
[...] diff --git a/kernel/seccomp.c b/kernel/seccomp.c index 385d48293a5f..23b594a68bc0 100644 --- a/kernel/seccomp.c +++ b/kernel/seccomp.c @@ -734,13 +734,13 @@ seccomp_prepare_user_filter(const char __user *user_filter)
[...]