Re: Process killed by seccomp looks live by tracer

[Oleg Nesterov]

On 03/06, Max Ver wrote:
>
> I suppose it's more reasonable for kernel to give a hint just after
> the syscall killed by seccomp at the fourth loop. So that we can know
> the syscall is rollbacked, or else we can only assume the syscall may
> succeed.

Perhaps you are right, but this is a question for seccomp experts...

Kees, Andy, what do you think?

Say, we can do something like

	--- a/kernel/ptrace.c
	+++ b/kernel/ptrace.c
	@@ -951,11 +951,20 @@ ptrace_get_syscall_info_seccomp(struct task_struct *child, struct pt_regs *regs,
		return offsetofend(struct ptrace_syscall_info, seccomp.ret_data);
	 }
	 
	+// currently not exposed
	+#define SECCOMP_MODE_DEAD	(SECCOMP_MODE_FILTER + 1)
	+
	+static long xxx_get_error(struct task_struct *task, struct pt_regs *regs)
	+{
	+	return task->seccomp.mode == SECCOMP_MODE_DEAD
	+		? -EINTR : syscall_get_error(task, regs);
	+}
	+
	 static unsigned long
	 ptrace_get_syscall_info_exit(struct task_struct *child, struct pt_regs *regs,
				     struct ptrace_syscall_info *info)
	 {
	-	info->exit.rval = syscall_get_error(child, regs);
	+	info->exit.rval = xxx_get_error(child, regs);
		info->exit.is_error = !!info->exit.rval;
		if (!info->exit.is_error)
			info->exit.rval = syscall_get_return_value(child, regs);

but probably this is not a good solution.

Perhaps we can add a new "killed_by_seccomp" member into ptrace_syscall_info.exit ?

Or even add a new ptrace_syscall_info.op = PTRACE_SYSCALL_INFO_KILLED_BY_SECCOMP ?

Or change ptrace_report_syscall(PTRACE_EVENTMSG_SYSCALL_EXIT) to not report the event
if the tracee was killed by force_sig_seccomp(force_coredump => true) ?

Oleg.

>
> Oleg Nesterov <oleg@xxxxxxxxxx> 于2026年3月6日周五 01:46写道：
> >
> > That said...
> >
> > __seccomp_filter() does
> >
> >         case SECCOMP_RET_KILL_PROCESS:
> >         ...
> >                 /* Show the original registers in the dump. */
> >                 syscall_rollback(current, current_pt_regs());
> >
> >                 /* Trigger a coredump with SIGSYS */
> >                 force_sig_seccomp(this_syscall, data, true);
> >
> > This means that after syscall_rollback() regs->ax == orig_ax, so
> > ptrace_get_syscall_info_exit() will always report .is_error == 0.
> >
> > And since force_sig_seccomp() uses force_coredump == true, SIGSYS
> > won't be reported (see the SA_IMMUTABLE check in get_signal()).
> >
> > Again, it is not that I think this wrong. But perhaps Kees and Andy
> > can take a look and confirm that this is what we actually want.
> >
> > Oleg.