On Wed, Jan 29, 2025 at 9:27 AM Eyal Birger <eyal.birger@xxxxxxxxx> wrote: > > Hi, > > Thanks for the review! > > On Tue, Jan 28, 2025 at 5:41 PM Kees Cook <kees@xxxxxxxxxx> wrote: > > > > On Tue, Jan 28, 2025 at 06:58:06AM -0800, Eyal Birger wrote: > > > Note: uretprobe isn't supported in i386 and __NR_ia32_rt_tgsigqueueinfo > > > uses the same number as __NR_uretprobe so the syscall isn't forced in the > > > compat bitmap. > > > > So a 64-bit tracer cannot use uretprobe on a 32-bit process? Also is > > uretprobe strictly an x86_64 feature? > > > > My understanding is that they'd be able to do so, but use the int3 trap > instead of the uretprobe syscall. > Syscall-based uretprobe implementation is strictly x86-64 and I don't think we have any plans to expand it beyond x86-64. But uretprobes in general do work across many bitnesses and architectures, they are just implemented through a trap approach (int3 on x86), so none of that should be relevant to seccomp. It's just that trapping on x86-64 is that much slower that we had to do syscall to speed it up but quite a lot. > > > [...] > > > diff --git a/kernel/seccomp.c b/kernel/seccomp.c > > > index 385d48293a5f..23b594a68bc0 100644 > > > --- a/kernel/seccomp.c > > > +++ b/kernel/seccomp.c > > > @@ -734,13 +734,13 @@ seccomp_prepare_user_filter(const char __user *user_filter) > > > [...]
