From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932219AbbCLNHN (ORCPT ); Thu, 12 Mar 2015 09:07:13 -0400 Received: from thejh.net ([37.221.195.125]:41909 "EHLO thejh.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932148AbbCLNHG (ORCPT ); Thu, 12 Mar 2015 09:07:06 -0400 Date: Thu, 12 Mar 2015 14:07:01 +0100 From: Jann Horn To: Michael Kerrisk , Mikael Pettersson Cc: linux-man@vger.kernel.org, linux-api@vger.kernel.org, linux-kernel@vger.kernel.org, Michael Kerrisk , Russell King , Catalin Marinas , Will Deacon , Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , x86@kernel.org, Jeff Dike , Richard Weinberger , Kees Cook , Andy Lutomirski , Will Drewry Subject: [PATCH] seccomp.2: Add note about alarm(2) not being sufficient to limit runtime Message-ID: <20150312130701.GA11073@pc.thejh.net> References: <20150311174204.GA5712@pc.thejh.net> <21760.46870.338764.599348@gargle.gargle.HOWL> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <21760.46870.338764.599348@gargle.gargle.HOWL> User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Mar 11, 2015 at 10:43:50PM +0100, Mikael Pettersson wrote: > Jann Horn writes: > > Or should I throw this patch away and write a patch > > for the prctl() manpage instead that documents that > > being able to call sigreturn() implies being able to > > effectively call sigprocmask(), at least on some > > architectures like X86? > > Well, that is the semantics of sigreturn(). It is essentially > setcontext() [which includes the actions of sigprocmask()], but > with restrictions on parameter placement (at least on x86). > > You could introduce some setting to restrict that aspect for > seccomp processes, but you can't change this for normal processes > without breaking things. Then I think it's probably better and easier to just document the existing behavior? If a new setting would have to be introduced and developers would need to be aware of that, it's probably easier to just tell everyone to use SIGKILL. Does this manpage patch look good? --- man2/seccomp.2 | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/man2/seccomp.2 b/man2/seccomp.2 index 702ceb8..f762d07 100644 --- a/man2/seccomp.2 +++ b/man2/seccomp.2 @@ -64,6 +64,31 @@ Strict secure computing mode is useful for number-crunching applications that may need to execute untrusted byte code, perhaps obtained by reading from a pipe or socket. +Note that although the calling thread can no longer call +.BR sigprocmask (2), +it can use +.BR sigreturn (2) +to block all signals apart from +.BR SIGKILL +and +.BR SIGSTOP . +Therefore, to reliably terminate it, +.BR SIGKILL +has to be used, meaning that e.g. +.BR alarm (2) +is not sufficient for restricting its runtime. Instead, use +.BR timer_create (2) +with +.BR SIGEV_SIGNAL +and +.BR sigev_signo +set to +.BR SIGKILL +or use +.BR setrlimit (2) +to set the hard limit for +.BR RLIMIT_CPU . + This operation is available only if the kernel is configured with .BR CONFIG_SECCOMP enabled. -- 2.1.4