As Andy pointed out that there are races between force_sig_info_to_task and sigaction[1] when force_sig_info_task. As Kees discovered[2] ptrace is also able to change these signals. In the case of seeccomp killing a process with a signal it is a security violation to allow the signal to be caught or manipulated. Solve this problem by introducing a new flag SA_IMMUTABLE that prevents sigaction and ptrace from modifying these forced signals. This flag is carefully made kernel internal so that no new ABI is introduced. Longer term I think this can be solved by guaranteeing short circuit delivery of signals in this case. Unfortunately reliable and guaranteed short circuit delivery of these signals is still a ways off from being implemented, tested, and merged. So I have implemented a much simpler alternative for now. [1] https://lkml.kernel.org/r/b5d52d25-7bde-4030-a7b1-7c6f8ab90660@www.fastmail.com [2] https://lkml.kernel.org/r/202110281136.5CE65399A7@keescook Cc: stable@vger.kernel.org Fixes: 307d522f5eb8 ("signal/seccomp: Refactor seccomp signal and coredump generation") Tested-by: Andrea Righi <andrea.righi@canonical.com> Tested-by: Kees Cook <keescook@chromium.org> Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Showing the changes to include/uapi (1 of 3 files). Show all
Unified · Split
| @@ -45,6 +45,7 @@ · 44 unmodified lines | |||
| 45 | #define SA_UNSUPPORTED 0x00000400 | 45 | #define SA_UNSUPPORTED 0x00000400 |
| 46 | #define SA_EXPOSE_TAGBITS 0x00000800 | 46 | #define SA_EXPOSE_TAGBITS 0x00000800 |
| 47 | /* 0x00010000 used on mips */ | 47 | /* 0x00010000 used on mips */ |
| 48 | /* 0x00800000 used for internal SA_IMMUTABLE */ | ||
| 48 | /* 0x01000000 used on x86 */ | 49 | /* 0x01000000 used on x86 */ |
| 49 | /* 0x02000000 used on x86 */ | 50 | /* 0x02000000 used on x86 */ |
| 50 | /* | 51 | /* |