|
|
Log in / Subscribe / Register

ptrace_set_syscall_info: add support for seccomp syscall skipping and instruction pointer modification

From:  Renzo Davoli <renzo-AT-cs.unibo.it>
To:  linux-kernel-AT-vger.kernel.org
Subject:  [PATCH 0/5] ptrace_set_syscall_info: add support for seccomp syscall skipping and instruction pointer modification
Date:  Wed, 01 Jul 2026 17:05:53 +0200
Message-ID:  <20260701150558.330348-1-renzo@cs.unibo.it>
Cc:  Renzo Davoli <renzo-AT-cs.unibo.it>, Andrew Morton <akpm-AT-linux-foundation.org>, Oleg Nesterov <oleg-AT-redhat.com>, Shuah Khan <shuah-AT-kernel.org>, Alexey Gladkov <legion-AT-kernel.org>, Eugene Syromyatnikov <evgsyr-AT-gmail.com>, Mike Frysinger <vapier-AT-gentoo.org>, Davide Berardi <berardi.dav-AT-gmail.com>, strace-devel-AT-lists.strace.io
Archive-link:  Article

PTRACE_SET_SYSCALL_INFO is a generic ptrace API that complements
PTRACE_GET_SYSCALL_INFO by allowing a tracer to modify details of a
system call in which the tracee is currently blocked.

The API is designed to let tracers inspect and modify system call
information in a simple, architecture-agnostic manner.

The current implementation only supports modifying the subset of
system call information needed by strace: the system call number,
arguments, and return value.

This patch set extends PTRACE_SET_SYSCALL_INFO with support for:

    Skipping a system call triggered via seccomp

    Modifying the tracee's instruction pointer

1. Seccomp system call skip

When a seccomp filter returns SECCOMP_RET_TRACE, the tracer receives,
via PTRACE_GET_SYSCALL_INFO, a struct ptrace_syscall_info with
op == PTRACE_SYSCALL_INFO_SECCOMP.

The tracer can skip the system call by setting the system call number
to -1. However, the current PTRACE_SET_SYSCALL_INFO interface does not
provide a way to specify the return value or error code that should be
reported to the tracee after skipping the call.

Patch 1/5 introduces a new op value,
PTRACE_SYSCALL_INFO_SECCOMP_SKIP, for use with
PTRACE_SET_SYSCALL_INFO.

When the tracer retrieves a ptrace_syscall_info structure with
op == PTRACE_SYSCALL_INFO_SECCOMP, it may choose to skip the system
call by changing op to PTRACE_SYSCALL_INFO_SECCOMP_SKIP and
populating the exit union fields (rval and is_error) to define
the return value and error status for the tracee.

2. Setting the instruction pointer

Patch 4/5 adds support for modifying the tracee's instruction pointer.

To do this, the tracer stores the new instruction pointer value in the
instruction_pointer field of the ptrace_syscall_info structure and
sets the PTRACE_SYSCALL_INFO_FLAG_SET_IP flag in the flags field.

This flag is introduced to avoid breaking existing code that uses
PTRACE_SET_SYSCALL_INFO and currently ignores the
instruction_pointer field.

Renzo Davoli (5):
  ptrace: add PTRACE_SYSCALL_INFO_SECCOMP_SKIP
  selftests/ptrace: add a test case for PTRACE_SYSCALL_INFO_SECCOMP_SKIP
  asm/ptrace.h: add instruction_pointer_set
  ptrace: add PTRACE_SYSCALL_INFO_FLAG_SET_IP
  selftests/ptrace: add a test case for PTRACE_SYSCALL_INFO_FLAG_SET_IP

 arch/alpha/include/asm/ptrace.h               |   6 +
 arch/hexagon/include/asm/ptrace.h             |   6 +
 arch/m68k/include/asm/ptrace.h                |   6 +
 arch/microblaze/include/asm/ptrace.h          |   6 +
 arch/nios2/include/asm/ptrace.h               |   6 +
 arch/um/include/asm/ptrace-generic.h          |   6 +
 arch/xtensa/include/asm/ptrace.h              |   6 +
 include/uapi/linux/ptrace.h                   |   5 +
 kernel/ptrace.c                               |  39 ++-
 .../selftests/ptrace/set_syscall_info.c       | 321 +++++++++++++++++-
 10 files changed, 401 insertions(+), 6 deletions(-)

-- 
2.53.0




Copyright © 2026, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds