WIP/fixbpf #13

Closed
crtxcr wants to merge 0 commits from WIP/fixbpf into master
Owner

TODO:

  • EACCES is hardcoded
  • Shrink BPF filter.
TODO: - EACCES is hardcoded - Shrink BPF filter.
crtxcr added 3 commits 2021-08-12 12:31:00 +02:00
We generally want to kill the process not the thread.
The filter was missing this check for arch, allowing bypasses
by using different calling conventions of other architectures.

A trivial example is execve() of x86 from and x86_64 process.
The arch field is the same for x86_64 and x32, thus checking it
is not enough.

Simply using x32 system calls would allow a bypass. Thus,
we must check whether the system call number is in __X32_SYSCALL_BIT.

This is of course a lazy solution, we could also add the
same system call number + _X32_SYSCALL_BIT to our black/whitelists.

For now however, this however will do.
crtxcr force-pushed WIP/fixbpf from 89c5496fab to 83487c1699 2021-09-05 12:32:25 +02:00 Compare
crtxcr force-pushed WIP/fixbpf from 91a9b778eb to 8a9b1730de 2021-09-05 17:14:14 +02:00 Compare
crtxcr added 1 commit 2021-09-05 17:24:46 +02:00
crtxcr added 1 commit 2021-09-06 21:53:45 +02:00
crtxcr closed this pull request 2021-09-06 21:58:06 +02:00

Pull request closed

Sign in to join this conversation.
No reviewers
No Milestone
No Assignees
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: crtxcr/exile.h#13
No description provided.