v6
2026-07-16
seccomp非协作式参数重定向 · v6
通过SECCOMP_IOCTL_NOTIF_PIN_INSTALL在目标进程安装密封只读映射，关闭seccomp用户通知的TOCTOU漏洞。
原始补丁链接
子 Patch（7）
1/7
mm: pass the target mm parameter through get_unmapped_area family
From: Cong Wang cwang@multikernel.io Every placement callback in the mmap path implicitly resolves against current->mm, so a placement cannot be computed in another task’s address space. vm_mmap_re
2/7
mm: add __do_mmap() and vm_mmap_remote()/vm_munmap_remote()
From: Cong Wang cwang@multikernel.io Add __do_mmap(), a variant of do_mmap() that installs the mapping into a caller-supplied mm rather than current->mm; do_mmap() becomes a wrapper passing current
3/7
seccomp: introduce SECCOMP_IOCTL_NOTIF_PIN_INSTALL
From: Cong Wang cwang@multikernel.io SECCOMP_IOCTL_NOTIF_PIN_INSTALL maps a supervisor-owned @memfd at @target_addr in the trapped task’s mm via vm_mmap_remote(), PROT_READ, MAP_SHARED, MAP_FIXED_N
4/7
seccomp: add __NR_seccomp_* aliases for rt_sigreturn and clone/fork
From: Cong Wang cwang@multikernel.io The existing _NR_seccomp* aliases name only the strict-mode syscalls (read/write/exit/sigreturn). SEND_REDIRECT must also recognise rt_sigreturn and the clone
5/7
seccomp: add kernel-installed pinned-memfd redirect
From: Cong Wang cwang@multikernel.io Add SECCOMP_IOCTL_NOTIF_SEND_REDIRECT, which resumes a trapped syscall (like SECCOMP_USER_NOTIF_FLAG_CONTINUE) with selected argument registers rewritten to poi
6/7
seccomp: re-validate a redirected syscall against outer filters
From: Cong Wang cwang@multikernel.io Stacked filters compose by taking the most restrictive verdict over one evaluation of a single seccomp_data, assuming the syscall they voted on is the syscall t
7/7
docs/seccomp: document pinned-memfd redirect ioctls
From: Cong Wang cwang@multikernel.io Document SECCOMP_IOCTL_NOTIF_PIN_INSTALL and SECCOMP_IOCTL_NOTIF_SEND_REDIRECT in the userspace API guide: the SECCOMP_FILTER_FLAG_REDIRECT opt-in and the singl