From nobody Fri Dec 19 20:52:58 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 429A2231852; Thu, 5 Jun 2025 13:27:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1749130071; cv=none; b=i+00GUBUCPxKap77XBzFzntvme6zji11NKarTBP0OYR2VdHTxmivcvyW87IGgRvr4ZWtdkhEyP/CWO6eVViU42Laj1y9ZoCzSFdt4ialxLLMm7GQKXm0lOt9agl4Yk+pksAiB9EdN2jlJJ7Cl3fJycO/mO69fBFe4F0APSGdgLc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1749130071; c=relaxed/simple; bh=nOuJ0zPf5iOtT5uJqMvTNsUEr2bIu+00SAIDOFCtLhs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=LvgVVFQ8Eseb6S4iOLikpp9Efzh5xynWW7+ZOStOrCz4ldmQk5qxiIeMfa9yASE9s1J2xheLSWw3b/2JG2sRKyw7Riweias+bcxaOK6vAlXKuEmn1HYusPINxkU6IMx4aKofsKybw30Anuo7G9Tm8mJOTYd929QhM0Bx4OaaUrg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=mY3s1kX9; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="mY3s1kX9" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 05325C4CEE7; Thu, 5 Jun 2025 13:27:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1749130070; bh=nOuJ0zPf5iOtT5uJqMvTNsUEr2bIu+00SAIDOFCtLhs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mY3s1kX90kdi556YKZ47+cO639qLHRXf0Kutj9qgWJfIIS0enSqL0XinoGtWHewJT 9sMiU+SiXZWFbHpn00AGw93KbFndwCZ29R7Y4AwI4AVJy9nxYVo02KDqAawXA8dKoQ fIPGHVEZiweUZYY5ZFR30ToppZlytWcDTYJyFEwJgDTDwq0LlmVlAPH0xeH0pR1ZD+ QTIqhY4QtVd6UQ7ZxAIU7P+uHmp8e0gitq1K/rJzGehmuXcqa7/ydHr6kk+cDK1zIP WC12rLf2SwpX9se/aN3ftNVPkfpu/3gnDmvmUQcOyGiaIDL0y9Gsdd0bfPiDkQqRmS IS6OGOvolXwfQ== From: Jiri Olsa To: Oleg Nesterov , Peter Zijlstra , Andrii Nakryiko Cc: Kees Cook , Eyal Birger , Kees Cook , bpf@vger.kernel.org, linux-kernel@vger.kernel.org, linux-trace-kernel@vger.kernel.org, x86@kernel.org, Song Liu , Yonghong Song , John Fastabend , Hao Luo , Steven Rostedt , Masami Hiramatsu , Alan Maguire , David Laight , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , Ingo Molnar Subject: [PATCHv3 perf/core 20/22] seccomp: passthrough uprobe systemcall without filtering Date: Thu, 5 Jun 2025 15:23:47 +0200 Message-ID: <20250605132350.1488129-21-jolsa@kernel.org> X-Mailer: git-send-email 2.49.0 In-Reply-To: <20250605132350.1488129-1-jolsa@kernel.org> References: <20250605132350.1488129-1-jolsa@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Adding uprobe as another exception to the seccomp filter alongside with the uretprobe syscall. Same as the uretprobe the uprobe syscall is installed by kernel as replacement for the breakpoint exception and is limited to x86_64 arch and isn't expected to ever be supported in i386. Cc: Kees Cook Cc: Eyal Birger Reviewed-by: Kees Cook Signed-off-by: Jiri Olsa --- kernel/seccomp.c | 32 +++++++++++++++++++++++++------- 1 file changed, 25 insertions(+), 7 deletions(-) diff --git a/kernel/seccomp.c b/kernel/seccomp.c index 41aa761c7738..7daf2da09e8e 100644 --- a/kernel/seccomp.c +++ b/kernel/seccomp.c @@ -741,6 +741,26 @@ seccomp_prepare_user_filter(const char __user *user_fi= lter) } =20 #ifdef SECCOMP_ARCH_NATIVE +static bool seccomp_uprobe_exception(struct seccomp_data *sd) +{ +#if defined __NR_uretprobe || defined __NR_uprobe +#ifdef SECCOMP_ARCH_COMPAT + if (sd->arch =3D=3D SECCOMP_ARCH_NATIVE) +#endif + { +#ifdef __NR_uretprobe + if (sd->nr =3D=3D __NR_uretprobe) + return true; +#endif +#ifdef __NR_uprobe + if (sd->nr =3D=3D __NR_uprobe) + return true; +#endif + } +#endif + return false; +} + /** * seccomp_is_const_allow - check if filter is constant allow with given d= ata * @fprog: The BPF programs @@ -758,13 +778,8 @@ static bool seccomp_is_const_allow(struct sock_fprog_k= ern *fprog, return false; =20 /* Our single exception to filtering. */ -#ifdef __NR_uretprobe -#ifdef SECCOMP_ARCH_COMPAT - if (sd->arch =3D=3D SECCOMP_ARCH_NATIVE) -#endif - if (sd->nr =3D=3D __NR_uretprobe) - return true; -#endif + if (seccomp_uprobe_exception(sd)) + return true; =20 for (pc =3D 0; pc < fprog->len; pc++) { struct sock_filter *insn =3D &fprog->filter[pc]; @@ -1042,6 +1057,9 @@ static const int mode1_syscalls[] =3D { __NR_seccomp_read, __NR_seccomp_write, __NR_seccomp_exit, __NR_seccomp_si= greturn, #ifdef __NR_uretprobe __NR_uretprobe, +#endif +#ifdef __NR_uprobe + __NR_uprobe, #endif -1, /* negative terminated */ }; --=20 2.49.0