Re: Process killed by seccomp looks live by tracer

[Oleg Nesterov]

Hi Max,

On 03/05, Max Ver wrote:
>
> >This is expected; PTRACE_GET_SYSCALL_INFO is at syscall entry before seccomp filtering has run.
>
> It also happens at the syscall exit. Take a look at the result, it
> shows 'exit ok' twice.

Why do you think this is wrong? (and I don't think this has something to
do with seccomp, btw).

> If we can agree on this is a bug, I suggest the kernel give a hint
> about tracee exit in waitpid return value, what do you think?

But the kernel already gives you a hint, no?

Perhaps I missed your point, but see the change of your test-case below.

Oleg.


--- /tmp/PT.c~	2026-03-05 15:18:18.397319905 +0100
+++ /tmp/PT.c	2026-03-05 15:40:11.044415647 +0100
@@ -15,6 +15,8 @@
 #include <sys/wait.h>
 #include <threads.h>
 #include <unistd.h>
+#include <assert.h>
+#include <errno.h>
 
 void
 child ()
@@ -57,6 +59,14 @@
       puts ("child exit");
       exit (1);
     }
+
+	if (WIFSIGNALED(status)) {
+		printf("signalled pid=%d sig=%d\n", pid, WTERMSIG(status));
+		assert(kill(pid, 0) == -1 && errno == ESRCH);
+		exit(0);
+	}
+
+
   if (ptrace (PTRACE_GET_SYSCALL_INFO, pid,
               sizeof (struct ptrace_syscall_info), &info)
       == -1)