c - How to get the return code of the syscall using SECCOMP_RET_DATA and PTRACE_GETEVENTMSG
问题描述
I'm a little bit confused trying to obtaining syscall's return value using ptrace + seccomp.
man 4 bpf says:
FILTER MACHINE
A filter program is an array of instructions, with all branches forwardly
directed, terminated by a return instruction
man 2 ptrace says:
PTRACE_O_TRACESECCOMP
While this triggers a PTRACE_EVENT stop, it is
similar to a syscall-enter-stop, in that the tracee has not yet
entered the syscall that seccomp triggered on. The seccomp event
message data (from the SECCOMP_RET_DATA portion of the seccomp filter
rule) can be retrieved with PTRACE_GETEVENTMSG.
PTRACE_GETEVENTMSG
For PTRACE_EVENT_SECCOMP, this is the seccomp(2)
filter's SECCOMP_RET_DATA associated with the triggered rule.
man 2 seccomp says:
SECCOMP_RET_TRACE
The tracer will be notified of a
PTRACE_EVENT_SECCOMP and the SECCOMP_RET_DATA
portion of the filter's return value will be available to
the tracer via PTRACE_GETEVENTMSG
[...]
The seccomp check will not be run again after the tracer is notified.
It turns out that the BPF program can not perform something further after the BPF_RET
statement. So when tracee is interrupted on SECCOMP_RET_TRACE
it's in the syscall-enter-stop
state and the syscall has not yet been made, therefore, the return code is definitely nowhere to take. I expect that after a subsequent call PTRACE_SYSCALL
, tracee will be in the syscall-exit-stop
state and tracer will be able to get the result of the syscall using PTRACE_GETEVENTMSG
. But it doesn't work in my sample.
#include <linux/filter.h>
#include <linux/seccomp.h>
#include <linux/unistd.h>
#include <stddef.h>
#include <stdio.h>
#include <sys/prctl.h>
#include <sys/ptrace.h>
#include <sys/wait.h>
#include <unistd.h>
int main(int argc, char **argv)
{
pid_t pid;
int status;
if (argc < 2) {
fprintf(stderr, "Usage: %s <prog> <arg1> ... <argN>\n", argv[0]);
return 1;
}
if ((pid = fork()) == 0) {
ptrace(PTRACE_TRACEME, 0, 0, 0);
struct sock_filter filter[] = {
BPF_STMT(BPF_LD | BPF_W | BPF_ABS, (offsetof(struct seccomp_data, nr))),
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_open, 1, 2),
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_openat, 0, 1),
BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_TRACE | SECCOMP_RET_DATA),
BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
};
struct sock_fprog prog = {
.filter = filter,
.len = (unsigned short) (sizeof(filter)/sizeof(filter[0])),
};
if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == -1)
return 2;
if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) == -1)
return 3;
kill(getpid(), SIGSTOP);
return execvp(argv[1], argv + 1);
} else {
waitpid(pid, &status, 0);
ptrace(PTRACE_SETOPTIONS, pid, 0, PTRACE_O_TRACESECCOMP);
ptrace(PTRACE_CONT, pid, 0, 0);
int status = 0;
unsigned long ret_data = 0;
while(1) {
while (1) {
waitpid(pid, &status, 0);
fprintf(stderr, "status = %08x\n", status);
if (status >> 8 == (SIGTRAP | (PTRACE_EVENT_SECCOMP << 8)))
break;
if (WIFEXITED(status))
return 0;
ptrace(PTRACE_CONT, pid, 0, 0);
}
// restart stopped tracee
ptrace(PTRACE_SYSCALL, pid, 0, 0);
// wait for SIGTRAP, when tracee will be in the syscall-exit-stop state
waitpid(pid, &status, 0);
ptrace(PTRACE_GETEVENTMSG, pid, 0, &ret_data);
fprintf(stderr, "retdat = %lu\n", ret_data);
ptrace(PTRACE_CONT, pid, 0, 0);
}
return 0;
}
}
I am able to get syscall's return code inspecting registers
// ptrace(PTRACE_GETEVENTMSG, pid, 0, &ret_data);
struct user_regs_struct regs;
ptrace(PTRACE_GETREGS, pid, 0, ®s);
fprintf(stderr, "retdat = %lu\n", regs.rax);
but I wonder how to do it in the way specified in the documentation.
解决方案
如何使用 SECCOMP_RET_DATA 和 PTRACE_GETEVENTMSG 获取系统调用的返回码?
简单的答案是你不能。甚至在进入系统调用之前发送seccomp事件。你看不到任何结果,因为还没有任何系统调用。要获得一个,您必须PTRACE_SYSCALL
在收到seccomp事件后将该过程旋转两次:
bool WaitForSyscallExit(const pid_t pid)
{
bool entered = false;
int status = 0;
while (true)
{
ptrace(PTRACE_SYSCALL, pid, 0, 0);
waitpid(pid, &status, 0);
if (WSTOPSIG(status) == SIGTRAP)
{
if (entered)
{
// If we had already entered before, then current SIGTRAP signal means exiting
break;
}
entered = true;
}
else if (WIFEXITED(status) || WIFSIGNALED(status) || WCOREDUMP(status))
{
std::cerr << "The child has unexpectedly exited." << std::endl;
return false;
}
}
return true;
}
PTRACE_SYSCALL
使用时,进程将停止两次(第一次进入系统调用后,下一次和最后一次退出后)。只有在系统调用实际完成后才能获取结果,因此在第二个进程停止之后。是的,您只能通过手动读取寄存器来执行此操作,因为seccomp结构只能在此事件的seccomp跟踪处理程序中使用。甚至结构本身也不包含与系统调用结果相关的任何内容,并且手册页也没有提到获取结果值。
推荐阅读
- report - 在运行机器人框架脚本之前设置目录以将我的结果(报告,日志)保存在特定文件夹中
- python - 根据 Python 中的 lambda 层测试 lambda
- msdn - Direct2D widthIncludingTrailingWhitespace == 0 而宽度 > 0?
- wordpress - 在链接之前将 div 插入菜单项等
- java - 如何断言某些 Java 方法是无垃圾的?
- html - Nuxt / Vue 2 更改后覆盖输入值
- javascript - 如何使用 node.js 更新动态 JSON 文件的属性值
- csv - D3 使用 CSV 文件过滤和计数值
- java - 如何与 Comparator.comparing 进行比较?
- javascript - 如何按种族过滤?- 从 JSON API 获取数据并使用 JavaScript 显示在 HTML 表上以传递数据