`SECCOMP_RET_KILL` under rr reports the terminating signal as `SIGKILL` instead of `SIGSYS`

Open
#2,100 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
25/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Stale
Tech stack
cpp, linux
Domain
devtools, operating-systems, security

Research direction

Start by tracing how rr handles SECCOMP_RET_KILL and how waitpid status is reported, with particular attention to RecordTask::emulated_stop_code. The fix must make termination report SIGSYS rather than SIGKILL while preserving behavior when SIGSYS is blocked or handled and when the syscall is buffered.

Written by the indexing model from the issue text.

Description

This is tricky to fix because SIGSYS can be blocked or handled, unlike SIGKILL, so we can't just send SIGSYS instead of SIGKILL. We can try unblocking SIGSYS and setting its handler to default, and then sending it or stashing it, but that could behave oddly when SECCOMP_RET_KILL is used for a buffered syscall.

We could try to send SIGKILL and then try to lie about the waitpid status using RecordTask::emulated_stop_code. That is perhaps the best approach.

Dominant language
C++
Stars
10.7k
Forks
662
Avg merge
2d 3h
Merged PRs (30d)
2

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from rr-debugger/rr

All issues in rr-debugger/rr

Similar issues

More C++ issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.