Date: Sat, 13 Aug 2011 19:12:20 +0400 From: Vasiliy Kulikov <segoon@...nwall.com> To: kernel-hardening@...ts.openwall.com Subject: Re: 32/64 bitness restriction for pid namespace Solar, Re: slowdown - my assumptions are: 1) we don't want any slowdown for legitimate tasks - 64 bit tasks for 64 bit containers and 32 bit tasks for 32 bit containers. 2) slowdown of malicious (or broken) tasks is not important. Looking into asm code: ENTRY(ia32_sysenter_target) ... GET_THREAD_INFO(%r10) ... testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10) CFI_REMEMBER_STATE jnz sysenter_tracesys ... sysenter_tracesys: #ifdef CONFIG_AUDITSYSCALL testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%r10) jz sysenter_auditsys #endif ... call syscall_trace_enter ... /* work to do in syscall_trace_enter() */ #define _TIF_WORK_SYSCALL_ENTRY \ (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_EMU | _TIF_SYSCALL_AUDIT | \ _TIF_SECCOMP | _TIF_SINGLESTEP | _TIF_SYSCALL_TRACEPOINT) So, there is a mask, which is used to identify whether a syscall needs additional pre/post processing. If divide syscall_trace_enter() into 3 functions, we'll get what we want. This will result in zero impact on the legitimate code (relavite to current behaviour). One drawback - *tracesys clobbers EAX/RAX, so I still have to patch asm. Thanks, -- Vasiliy
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.