From c38904ebb74b455a44e3b9a679aef320361654ae Mon Sep 17 00:00:00 2001 From: Marco Elver Date: Fri, 8 Nov 2024 12:34:24 +0100 Subject: tracing: Add task_prctl_unknown tracepoint prctl() is a complex syscall which multiplexes its functionality based on a large set of PR_* options. Currently we count 64 such options. The return value of unknown options is -EINVAL, and doesn't distinguish from known options that were passed invalid args that also return -EINVAL. To understand if programs are attempting to use prctl() options not yet available on the running kernel, provide the task_prctl_unknown tracepoint. Note, this tracepoint is in an unlikely cold path, and would therefore be suitable for continuous monitoring (e.g. via perf_event_open). While the above is likely the simplest usecase, additionally this tracepoint can help unlock some testing scenarios (where probing sys_enter or sys_exit causes undesirable performance overheads): a. unprivileged triggering of a test module: test modules may register a probe to be called back on task_prctl_unknown, and pick a very large unknown prctl() option upon which they perform a test function for an unprivileged user; b. unprivileged triggering of an eBPF program function: similar as idea (a). Example trace_pipe output: test-380 [001] ..... 78.142904: task_prctl_unknown: option=1234 arg2=101 arg3=102 arg4=103 arg5=104 Signed-off-by: Marco Elver Reviewed-by: Alexander Potapenko Link: https://lore.kernel.org/r/20241108113455.2924361-1-elver@google.com Signed-off-by: Kees Cook --- kernel/sys.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'kernel') diff --git a/kernel/sys.c b/kernel/sys.c index c4c701c6f0b4..cb366ff8703a 100644 --- a/kernel/sys.c +++ b/kernel/sys.c @@ -75,6 +75,8 @@ #include #include +#include + #include "uid16.h" #ifndef SET_UNALIGN_CTL @@ -2810,6 +2812,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3, error = arch_lock_shadow_stack_status(me, arg2); break; default: + trace_task_prctl_unknown(option, arg2, arg3, arg4, arg5); error = -EINVAL; break; } -- cgit v1.2.3 From 62e9c1e8ecee87a86052ffeeca382f1252f7aef6 Mon Sep 17 00:00:00 2001 From: Thorsten Blum Date: Sun, 22 Dec 2024 23:31:57 +0100 Subject: stackleak: Use str_enabled_disabled() helper in stack_erasing_sysctl() Remove hard-coded strings by using the str_enabled_disabled() helper function. Signed-off-by: Thorsten Blum Link: https://lore.kernel.org/r/20241222223157.135164-2-thorsten.blum@linux.dev Signed-off-by: Kees Cook --- kernel/stackleak.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'kernel') diff --git a/kernel/stackleak.c b/kernel/stackleak.c index 39fd620a7db6..0f4804f28c61 100644 --- a/kernel/stackleak.c +++ b/kernel/stackleak.c @@ -15,6 +15,7 @@ #ifdef CONFIG_STACKLEAK_RUNTIME_DISABLE #include +#include #include #include @@ -41,7 +42,7 @@ static int stack_erasing_sysctl(const struct ctl_table *table, int write, static_branch_enable(&stack_erasing_bypass); pr_warn("stackleak: kernel stack erasing is %s\n", - state ? "enabled" : "disabled"); + str_enabled_disabled(state)); return ret; } static struct ctl_table stackleak_sysctls[] = { -- cgit v1.2.3