3 ms·
I’m not really familiar with ptrace, but does this if regs.Orig_rax == 0 { mean it only intercepts the read syscall? Seems like any security someone was hop
by minitech 7y ago
I’m not really familiar with ptrace, but does this
if regs.Orig_rax == 0 {
mean it only intercepts the read syscall? Seems like any security someone was hoping to provide with this could be bypassed entirely by accident (e.g. a script in a language that always uses readv).
Anyway if that is what it means you should probably not describe this as “to run untrusted code”.
- saagarjha 7y agoYes. There's a number of other ways to get around this too, one that comes to mind is mmap. Plus I'm fairly sure spawning a new thread would work as well: one because it's possible to do so without it being watched, and two because you can TOCTOU, from another thread, the registers while they're being verified.
- tyingq 7y agoYes, that's right, SYS_READ is 0. So pread(), readv() and preadv() would go around this. Edit: A sibling comment mentioned mmap() as another workaround. That made me think of yet another....sendfile().