Skip to content

Commit c38904e

Browse files
melverkees
authored andcommitted
tracing: Add task_prctl_unknown tracepoint
prctl() is a complex syscall which multiplexes its functionality based on a large set of PR_* options. Currently we count 64 such options. The return value of unknown options is -EINVAL, and doesn't distinguish from known options that were passed invalid args that also return -EINVAL. To understand if programs are attempting to use prctl() options not yet available on the running kernel, provide the task_prctl_unknown tracepoint. Note, this tracepoint is in an unlikely cold path, and would therefore be suitable for continuous monitoring (e.g. via perf_event_open). While the above is likely the simplest usecase, additionally this tracepoint can help unlock some testing scenarios (where probing sys_enter or sys_exit causes undesirable performance overheads): a. unprivileged triggering of a test module: test modules may register a probe to be called back on task_prctl_unknown, and pick a very large unknown prctl() option upon which they perform a test function for an unprivileged user; b. unprivileged triggering of an eBPF program function: similar as idea (a). Example trace_pipe output: test-380 [001] ..... 78.142904: task_prctl_unknown: option=1234 arg2=101 arg3=102 arg4=103 arg5=104 Signed-off-by: Marco Elver <elver@google.com> Reviewed-by: Alexander Potapenko <glider@google.com> Link: https://lore.kernel.org/r/20241108113455.2924361-1-elver@google.com Signed-off-by: Kees Cook <kees@kernel.org>
1 parent 4bbf902 commit c38904e

File tree

2 files changed

+40
-0
lines changed

2 files changed

+40
-0
lines changed

include/trace/events/task.h

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,43 @@ TRACE_EVENT(task_rename,
5656
__entry->newcomm, __entry->oom_score_adj)
5757
);
5858

59+
/**
60+
* task_prctl_unknown - called on unknown prctl() option
61+
* @option: option passed
62+
* @arg2: arg2 passed
63+
* @arg3: arg3 passed
64+
* @arg4: arg4 passed
65+
* @arg5: arg5 passed
66+
*
67+
* Called on an unknown prctl() option.
68+
*/
69+
TRACE_EVENT(task_prctl_unknown,
70+
71+
TP_PROTO(int option, unsigned long arg2, unsigned long arg3,
72+
unsigned long arg4, unsigned long arg5),
73+
74+
TP_ARGS(option, arg2, arg3, arg4, arg5),
75+
76+
TP_STRUCT__entry(
77+
__field( int, option)
78+
__field( unsigned long, arg2)
79+
__field( unsigned long, arg3)
80+
__field( unsigned long, arg4)
81+
__field( unsigned long, arg5)
82+
),
83+
84+
TP_fast_assign(
85+
__entry->option = option;
86+
__entry->arg2 = arg2;
87+
__entry->arg3 = arg3;
88+
__entry->arg4 = arg4;
89+
__entry->arg5 = arg5;
90+
),
91+
92+
TP_printk("option=%d arg2=%ld arg3=%ld arg4=%ld arg5=%ld",
93+
__entry->option, __entry->arg2, __entry->arg3, __entry->arg4, __entry->arg5)
94+
);
95+
5996
#endif
6097

6198
/* This part must be outside protection */

kernel/sys.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,8 @@
7575
#include <asm/io.h>
7676
#include <asm/unistd.h>
7777

78+
#include <trace/events/task.h>
79+
7880
#include "uid16.h"
7981

8082
#ifndef SET_UNALIGN_CTL
@@ -2810,6 +2812,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
28102812
error = arch_lock_shadow_stack_status(me, arg2);
28112813
break;
28122814
default:
2815+
trace_task_prctl_unknown(option, arg2, arg3, arg4, arg5);
28132816
error = -EINVAL;
28142817
break;
28152818
}

0 commit comments

Comments
 (0)