seccomp.c 60 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202220322042205220622072208220922102211221222132214221522162217221822192220222122222223222422252226222722282229223022312232223322342235223622372238223922402241224222432244224522462247224822492250225122522253225422552256225722582259226022612262226322642265226622672268226922702271227222732274227522762277227822792280228122822283228422852286228722882289229022912292229322942295229622972298229923002301230223032304230523062307230823092310231123122313231423152316231723182319232023212322232323242325232623272328232923302331233223332334233523362337233823392340
  1. // SPDX-License-Identifier: GPL-2.0
  2. /*
  3. * linux/kernel/seccomp.c
  4. *
  5. * Copyright 2004-2005 Andrea Arcangeli <andrea@cpushare.com>
  6. *
  7. * Copyright (C) 2012 Google, Inc.
  8. * Will Drewry <wad@chromium.org>
  9. *
  10. * This defines a simple but solid secure-computing facility.
  11. *
  12. * Mode 1 uses a fixed list of allowed system calls.
  13. * Mode 2 allows user-defined system call filters in the form
  14. * of Berkeley Packet Filters/Linux Socket Filters.
  15. */
  16. #define pr_fmt(fmt) "seccomp: " fmt
  17. #include <linux/refcount.h>
  18. #include <linux/audit.h>
  19. #include <linux/compat.h>
  20. #include <linux/coredump.h>
  21. #include <linux/kmemleak.h>
  22. #include <linux/nospec.h>
  23. #include <linux/prctl.h>
  24. #include <linux/sched.h>
  25. #include <linux/sched/task_stack.h>
  26. #include <linux/seccomp.h>
  27. #include <linux/slab.h>
  28. #include <linux/syscalls.h>
  29. #include <linux/sysctl.h>
  30. #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
  31. #include <asm/syscall.h>
  32. #endif
  33. #ifdef CONFIG_SECCOMP_FILTER
  34. #include <linux/file.h>
  35. #include <linux/filter.h>
  36. #include <linux/pid.h>
  37. #include <linux/ptrace.h>
  38. #include <linux/capability.h>
  39. #include <linux/tracehook.h>
  40. #include <linux/uaccess.h>
  41. #include <linux/anon_inodes.h>
  42. #include <linux/lockdep.h>
  43. /*
  44. * When SECCOMP_IOCTL_NOTIF_ID_VALID was first introduced, it had the
  45. * wrong direction flag in the ioctl number. This is the broken one,
  46. * which the kernel needs to keep supporting until all userspaces stop
  47. * using the wrong command number.
  48. */
  49. #define SECCOMP_IOCTL_NOTIF_ID_VALID_WRONG_DIR SECCOMP_IOR(2, __u64)
  50. enum notify_state {
  51. SECCOMP_NOTIFY_INIT,
  52. SECCOMP_NOTIFY_SENT,
  53. SECCOMP_NOTIFY_REPLIED,
  54. };
  55. struct seccomp_knotif {
  56. /* The struct pid of the task whose filter triggered the notification */
  57. struct task_struct *task;
  58. /* The "cookie" for this request; this is unique for this filter. */
  59. u64 id;
  60. /*
  61. * The seccomp data. This pointer is valid the entire time this
  62. * notification is active, since it comes from __seccomp_filter which
  63. * eclipses the entire lifecycle here.
  64. */
  65. const struct seccomp_data *data;
  66. /*
  67. * Notification states. When SECCOMP_RET_USER_NOTIF is returned, a
  68. * struct seccomp_knotif is created and starts out in INIT. Once the
  69. * handler reads the notification off of an FD, it transitions to SENT.
  70. * If a signal is received the state transitions back to INIT and
  71. * another message is sent. When the userspace handler replies, state
  72. * transitions to REPLIED.
  73. */
  74. enum notify_state state;
  75. /* The return values, only valid when in SECCOMP_NOTIFY_REPLIED */
  76. int error;
  77. long val;
  78. u32 flags;
  79. /*
  80. * Signals when this has changed states, such as the listener
  81. * dying, a new seccomp addfd message, or changing to REPLIED
  82. */
  83. struct completion ready;
  84. struct list_head list;
  85. /* outstanding addfd requests */
  86. struct list_head addfd;
  87. };
  88. /**
  89. * struct seccomp_kaddfd - container for seccomp_addfd ioctl messages
  90. *
  91. * @file: A reference to the file to install in the other task
  92. * @fd: The fd number to install it at. If the fd number is -1, it means the
  93. * installing process should allocate the fd as normal.
  94. * @flags: The flags for the new file descriptor. At the moment, only O_CLOEXEC
  95. * is allowed.
  96. * @ret: The return value of the installing process. It is set to the fd num
  97. * upon success (>= 0).
  98. * @completion: Indicates that the installing process has completed fd
  99. * installation, or gone away (either due to successful
  100. * reply, or signal)
  101. *
  102. */
  103. struct seccomp_kaddfd {
  104. struct file *file;
  105. int fd;
  106. unsigned int flags;
  107. /* To only be set on reply */
  108. int ret;
  109. struct completion completion;
  110. struct list_head list;
  111. };
  112. /**
  113. * struct notification - container for seccomp userspace notifications. Since
  114. * most seccomp filters will not have notification listeners attached and this
  115. * structure is fairly large, we store the notification-specific stuff in a
  116. * separate structure.
  117. *
  118. * @request: A semaphore that users of this notification can wait on for
  119. * changes. Actual reads and writes are still controlled with
  120. * filter->notify_lock.
  121. * @next_id: The id of the next request.
  122. * @notifications: A list of struct seccomp_knotif elements.
  123. */
  124. struct notification {
  125. struct semaphore request;
  126. u64 next_id;
  127. struct list_head notifications;
  128. };
  129. #ifdef SECCOMP_ARCH_NATIVE
  130. /**
  131. * struct action_cache - per-filter cache of seccomp actions per
  132. * arch/syscall pair
  133. *
  134. * @allow_native: A bitmap where each bit represents whether the
  135. * filter will always allow the syscall, for the
  136. * native architecture.
  137. * @allow_compat: A bitmap where each bit represents whether the
  138. * filter will always allow the syscall, for the
  139. * compat architecture.
  140. */
  141. struct action_cache {
  142. DECLARE_BITMAP(allow_native, SECCOMP_ARCH_NATIVE_NR);
  143. #ifdef SECCOMP_ARCH_COMPAT
  144. DECLARE_BITMAP(allow_compat, SECCOMP_ARCH_COMPAT_NR);
  145. #endif
  146. };
  147. #else
  148. struct action_cache { };
  149. static inline bool seccomp_cache_check_allow(const struct seccomp_filter *sfilter,
  150. const struct seccomp_data *sd)
  151. {
  152. return false;
  153. }
  154. static inline void seccomp_cache_prepare(struct seccomp_filter *sfilter)
  155. {
  156. }
  157. #endif /* SECCOMP_ARCH_NATIVE */
  158. /**
  159. * struct seccomp_filter - container for seccomp BPF programs
  160. *
  161. * @refs: Reference count to manage the object lifetime.
  162. * A filter's reference count is incremented for each directly
  163. * attached task, once for the dependent filter, and if
  164. * requested for the user notifier. When @refs reaches zero,
  165. * the filter can be freed.
  166. * @users: A filter's @users count is incremented for each directly
  167. * attached task (filter installation, fork(), thread_sync),
  168. * and once for the dependent filter (tracked in filter->prev).
  169. * When it reaches zero it indicates that no direct or indirect
  170. * users of that filter exist. No new tasks can get associated with
  171. * this filter after reaching 0. The @users count is always smaller
  172. * or equal to @refs. Hence, reaching 0 for @users does not mean
  173. * the filter can be freed.
  174. * @cache: cache of arch/syscall mappings to actions
  175. * @log: true if all actions except for SECCOMP_RET_ALLOW should be logged
  176. * @prev: points to a previously installed, or inherited, filter
  177. * @prog: the BPF program to evaluate
  178. * @notif: the struct that holds all notification related information
  179. * @notify_lock: A lock for all notification-related accesses.
  180. * @wqh: A wait queue for poll if a notifier is in use.
  181. *
  182. * seccomp_filter objects are organized in a tree linked via the @prev
  183. * pointer. For any task, it appears to be a singly-linked list starting
  184. * with current->seccomp.filter, the most recently attached or inherited filter.
  185. * However, multiple filters may share a @prev node, by way of fork(), which
  186. * results in a unidirectional tree existing in memory. This is similar to
  187. * how namespaces work.
  188. *
  189. * seccomp_filter objects should never be modified after being attached
  190. * to a task_struct (other than @refs).
  191. */
  192. struct seccomp_filter {
  193. refcount_t refs;
  194. refcount_t users;
  195. bool log;
  196. struct action_cache cache;
  197. struct seccomp_filter *prev;
  198. struct bpf_prog *prog;
  199. struct notification *notif;
  200. struct mutex notify_lock;
  201. wait_queue_head_t wqh;
  202. };
  203. /* Limit any path through the tree to 256KB worth of instructions. */
  204. #define MAX_INSNS_PER_PATH ((1 << 18) / sizeof(struct sock_filter))
  205. /*
  206. * Endianness is explicitly ignored and left for BPF program authors to manage
  207. * as per the specific architecture.
  208. */
  209. static void populate_seccomp_data(struct seccomp_data *sd)
  210. {
  211. /*
  212. * Instead of using current_pt_reg(), we're already doing the work
  213. * to safely fetch "current", so just use "task" everywhere below.
  214. */
  215. struct task_struct *task = current;
  216. struct pt_regs *regs = task_pt_regs(task);
  217. unsigned long args[6];
  218. sd->nr = syscall_get_nr(task, regs);
  219. sd->arch = syscall_get_arch(task);
  220. syscall_get_arguments(task, regs, args);
  221. sd->args[0] = args[0];
  222. sd->args[1] = args[1];
  223. sd->args[2] = args[2];
  224. sd->args[3] = args[3];
  225. sd->args[4] = args[4];
  226. sd->args[5] = args[5];
  227. sd->instruction_pointer = KSTK_EIP(task);
  228. }
  229. /**
  230. * seccomp_check_filter - verify seccomp filter code
  231. * @filter: filter to verify
  232. * @flen: length of filter
  233. *
  234. * Takes a previously checked filter (by bpf_check_classic) and
  235. * redirects all filter code that loads struct sk_buff data
  236. * and related data through seccomp_bpf_load. It also
  237. * enforces length and alignment checking of those loads.
  238. *
  239. * Returns 0 if the rule set is legal or -EINVAL if not.
  240. */
  241. static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen)
  242. {
  243. int pc;
  244. for (pc = 0; pc < flen; pc++) {
  245. struct sock_filter *ftest = &filter[pc];
  246. u16 code = ftest->code;
  247. u32 k = ftest->k;
  248. switch (code) {
  249. case BPF_LD | BPF_W | BPF_ABS:
  250. ftest->code = BPF_LDX | BPF_W | BPF_ABS;
  251. /* 32-bit aligned and not out of bounds. */
  252. if (k >= sizeof(struct seccomp_data) || k & 3)
  253. return -EINVAL;
  254. continue;
  255. case BPF_LD | BPF_W | BPF_LEN:
  256. ftest->code = BPF_LD | BPF_IMM;
  257. ftest->k = sizeof(struct seccomp_data);
  258. continue;
  259. case BPF_LDX | BPF_W | BPF_LEN:
  260. ftest->code = BPF_LDX | BPF_IMM;
  261. ftest->k = sizeof(struct seccomp_data);
  262. continue;
  263. /* Explicitly include allowed calls. */
  264. case BPF_RET | BPF_K:
  265. case BPF_RET | BPF_A:
  266. case BPF_ALU | BPF_ADD | BPF_K:
  267. case BPF_ALU | BPF_ADD | BPF_X:
  268. case BPF_ALU | BPF_SUB | BPF_K:
  269. case BPF_ALU | BPF_SUB | BPF_X:
  270. case BPF_ALU | BPF_MUL | BPF_K:
  271. case BPF_ALU | BPF_MUL | BPF_X:
  272. case BPF_ALU | BPF_DIV | BPF_K:
  273. case BPF_ALU | BPF_DIV | BPF_X:
  274. case BPF_ALU | BPF_AND | BPF_K:
  275. case BPF_ALU | BPF_AND | BPF_X:
  276. case BPF_ALU | BPF_OR | BPF_K:
  277. case BPF_ALU | BPF_OR | BPF_X:
  278. case BPF_ALU | BPF_XOR | BPF_K:
  279. case BPF_ALU | BPF_XOR | BPF_X:
  280. case BPF_ALU | BPF_LSH | BPF_K:
  281. case BPF_ALU | BPF_LSH | BPF_X:
  282. case BPF_ALU | BPF_RSH | BPF_K:
  283. case BPF_ALU | BPF_RSH | BPF_X:
  284. case BPF_ALU | BPF_NEG:
  285. case BPF_LD | BPF_IMM:
  286. case BPF_LDX | BPF_IMM:
  287. case BPF_MISC | BPF_TAX:
  288. case BPF_MISC | BPF_TXA:
  289. case BPF_LD | BPF_MEM:
  290. case BPF_LDX | BPF_MEM:
  291. case BPF_ST:
  292. case BPF_STX:
  293. case BPF_JMP | BPF_JA:
  294. case BPF_JMP | BPF_JEQ | BPF_K:
  295. case BPF_JMP | BPF_JEQ | BPF_X:
  296. case BPF_JMP | BPF_JGE | BPF_K:
  297. case BPF_JMP | BPF_JGE | BPF_X:
  298. case BPF_JMP | BPF_JGT | BPF_K:
  299. case BPF_JMP | BPF_JGT | BPF_X:
  300. case BPF_JMP | BPF_JSET | BPF_K:
  301. case BPF_JMP | BPF_JSET | BPF_X:
  302. continue;
  303. default:
  304. return -EINVAL;
  305. }
  306. }
  307. return 0;
  308. }
  309. #ifdef SECCOMP_ARCH_NATIVE
  310. static inline bool seccomp_cache_check_allow_bitmap(const void *bitmap,
  311. size_t bitmap_size,
  312. int syscall_nr)
  313. {
  314. if (unlikely(syscall_nr < 0 || syscall_nr >= bitmap_size))
  315. return false;
  316. syscall_nr = array_index_nospec(syscall_nr, bitmap_size);
  317. return test_bit(syscall_nr, bitmap);
  318. }
  319. /**
  320. * seccomp_cache_check_allow - lookup seccomp cache
  321. * @sfilter: The seccomp filter
  322. * @sd: The seccomp data to lookup the cache with
  323. *
  324. * Returns true if the seccomp_data is cached and allowed.
  325. */
  326. static inline bool seccomp_cache_check_allow(const struct seccomp_filter *sfilter,
  327. const struct seccomp_data *sd)
  328. {
  329. int syscall_nr = sd->nr;
  330. const struct action_cache *cache = &sfilter->cache;
  331. #ifndef SECCOMP_ARCH_COMPAT
  332. /* A native-only architecture doesn't need to check sd->arch. */
  333. return seccomp_cache_check_allow_bitmap(cache->allow_native,
  334. SECCOMP_ARCH_NATIVE_NR,
  335. syscall_nr);
  336. #else
  337. if (likely(sd->arch == SECCOMP_ARCH_NATIVE))
  338. return seccomp_cache_check_allow_bitmap(cache->allow_native,
  339. SECCOMP_ARCH_NATIVE_NR,
  340. syscall_nr);
  341. if (likely(sd->arch == SECCOMP_ARCH_COMPAT))
  342. return seccomp_cache_check_allow_bitmap(cache->allow_compat,
  343. SECCOMP_ARCH_COMPAT_NR,
  344. syscall_nr);
  345. #endif /* SECCOMP_ARCH_COMPAT */
  346. WARN_ON_ONCE(true);
  347. return false;
  348. }
  349. #endif /* SECCOMP_ARCH_NATIVE */
  350. /**
  351. * seccomp_run_filters - evaluates all seccomp filters against @sd
  352. * @sd: optional seccomp data to be passed to filters
  353. * @match: stores struct seccomp_filter that resulted in the return value,
  354. * unless filter returned SECCOMP_RET_ALLOW, in which case it will
  355. * be unchanged.
  356. *
  357. * Returns valid seccomp BPF response codes.
  358. */
  359. #define ACTION_ONLY(ret) ((s32)((ret) & (SECCOMP_RET_ACTION_FULL)))
  360. static u32 seccomp_run_filters(const struct seccomp_data *sd,
  361. struct seccomp_filter **match)
  362. {
  363. u32 ret = SECCOMP_RET_ALLOW;
  364. /* Make sure cross-thread synced filter points somewhere sane. */
  365. struct seccomp_filter *f =
  366. READ_ONCE(current->seccomp.filter);
  367. /* Ensure unexpected behavior doesn't result in failing open. */
  368. if (WARN_ON(f == NULL))
  369. return SECCOMP_RET_KILL_PROCESS;
  370. if (seccomp_cache_check_allow(f, sd))
  371. return SECCOMP_RET_ALLOW;
  372. /*
  373. * All filters in the list are evaluated and the lowest BPF return
  374. * value always takes priority (ignoring the DATA).
  375. */
  376. for (; f; f = f->prev) {
  377. u32 cur_ret = bpf_prog_run_pin_on_cpu(f->prog, sd);
  378. if (ACTION_ONLY(cur_ret) < ACTION_ONLY(ret)) {
  379. ret = cur_ret;
  380. *match = f;
  381. }
  382. }
  383. return ret;
  384. }
  385. #endif /* CONFIG_SECCOMP_FILTER */
  386. static inline bool seccomp_may_assign_mode(unsigned long seccomp_mode)
  387. {
  388. assert_spin_locked(&current->sighand->siglock);
  389. if (current->seccomp.mode && current->seccomp.mode != seccomp_mode)
  390. return false;
  391. return true;
  392. }
  393. void __weak arch_seccomp_spec_mitigate(struct task_struct *task) { }
  394. static inline void seccomp_assign_mode(struct task_struct *task,
  395. unsigned long seccomp_mode,
  396. unsigned long flags)
  397. {
  398. assert_spin_locked(&task->sighand->siglock);
  399. task->seccomp.mode = seccomp_mode;
  400. /*
  401. * Make sure TIF_SECCOMP cannot be set before the mode (and
  402. * filter) is set.
  403. */
  404. smp_mb__before_atomic();
  405. /* Assume default seccomp processes want spec flaw mitigation. */
  406. if ((flags & SECCOMP_FILTER_FLAG_SPEC_ALLOW) == 0)
  407. arch_seccomp_spec_mitigate(task);
  408. set_tsk_thread_flag(task, TIF_SECCOMP);
  409. }
  410. #ifdef CONFIG_SECCOMP_FILTER
  411. /* Returns 1 if the parent is an ancestor of the child. */
  412. static int is_ancestor(struct seccomp_filter *parent,
  413. struct seccomp_filter *child)
  414. {
  415. /* NULL is the root ancestor. */
  416. if (parent == NULL)
  417. return 1;
  418. for (; child; child = child->prev)
  419. if (child == parent)
  420. return 1;
  421. return 0;
  422. }
  423. /**
  424. * seccomp_can_sync_threads: checks if all threads can be synchronized
  425. *
  426. * Expects sighand and cred_guard_mutex locks to be held.
  427. *
  428. * Returns 0 on success, -ve on error, or the pid of a thread which was
  429. * either not in the correct seccomp mode or did not have an ancestral
  430. * seccomp filter.
  431. */
  432. static inline pid_t seccomp_can_sync_threads(void)
  433. {
  434. struct task_struct *thread, *caller;
  435. BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
  436. assert_spin_locked(&current->sighand->siglock);
  437. /* Validate all threads being eligible for synchronization. */
  438. caller = current;
  439. for_each_thread(caller, thread) {
  440. pid_t failed;
  441. /* Skip current, since it is initiating the sync. */
  442. if (thread == caller)
  443. continue;
  444. if (thread->seccomp.mode == SECCOMP_MODE_DISABLED ||
  445. (thread->seccomp.mode == SECCOMP_MODE_FILTER &&
  446. is_ancestor(thread->seccomp.filter,
  447. caller->seccomp.filter)))
  448. continue;
  449. /* Return the first thread that cannot be synchronized. */
  450. failed = task_pid_vnr(thread);
  451. /* If the pid cannot be resolved, then return -ESRCH */
  452. if (WARN_ON(failed == 0))
  453. failed = -ESRCH;
  454. return failed;
  455. }
  456. return 0;
  457. }
  458. static inline void seccomp_filter_free(struct seccomp_filter *filter)
  459. {
  460. if (filter) {
  461. bpf_prog_destroy(filter->prog);
  462. kfree(filter);
  463. }
  464. }
  465. static void __seccomp_filter_orphan(struct seccomp_filter *orig)
  466. {
  467. while (orig && refcount_dec_and_test(&orig->users)) {
  468. if (waitqueue_active(&orig->wqh))
  469. wake_up_poll(&orig->wqh, EPOLLHUP);
  470. orig = orig->prev;
  471. }
  472. }
  473. static void __put_seccomp_filter(struct seccomp_filter *orig)
  474. {
  475. /* Clean up single-reference branches iteratively. */
  476. while (orig && refcount_dec_and_test(&orig->refs)) {
  477. struct seccomp_filter *freeme = orig;
  478. orig = orig->prev;
  479. seccomp_filter_free(freeme);
  480. }
  481. }
  482. static void __seccomp_filter_release(struct seccomp_filter *orig)
  483. {
  484. /* Notify about any unused filters in the task's former filter tree. */
  485. __seccomp_filter_orphan(orig);
  486. /* Finally drop all references to the task's former tree. */
  487. __put_seccomp_filter(orig);
  488. }
  489. /**
  490. * seccomp_filter_release - Detach the task from its filter tree,
  491. * drop its reference count, and notify
  492. * about unused filters
  493. *
  494. * This function should only be called when the task is exiting as
  495. * it detaches it from its filter tree. As such, READ_ONCE() and
  496. * barriers are not needed here, as would normally be needed.
  497. */
  498. void seccomp_filter_release(struct task_struct *tsk)
  499. {
  500. struct seccomp_filter *orig = tsk->seccomp.filter;
  501. /* Detach task from its filter tree. */
  502. tsk->seccomp.filter = NULL;
  503. __seccomp_filter_release(orig);
  504. }
  505. /**
  506. * seccomp_sync_threads: sets all threads to use current's filter
  507. *
  508. * Expects sighand and cred_guard_mutex locks to be held, and for
  509. * seccomp_can_sync_threads() to have returned success already
  510. * without dropping the locks.
  511. *
  512. */
  513. static inline void seccomp_sync_threads(unsigned long flags)
  514. {
  515. struct task_struct *thread, *caller;
  516. BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
  517. assert_spin_locked(&current->sighand->siglock);
  518. /* Synchronize all threads. */
  519. caller = current;
  520. for_each_thread(caller, thread) {
  521. /* Skip current, since it needs no changes. */
  522. if (thread == caller)
  523. continue;
  524. /* Get a task reference for the new leaf node. */
  525. get_seccomp_filter(caller);
  526. /*
  527. * Drop the task reference to the shared ancestor since
  528. * current's path will hold a reference. (This also
  529. * allows a put before the assignment.)
  530. */
  531. __seccomp_filter_release(thread->seccomp.filter);
  532. /* Make our new filter tree visible. */
  533. smp_store_release(&thread->seccomp.filter,
  534. caller->seccomp.filter);
  535. atomic_set(&thread->seccomp.filter_count,
  536. atomic_read(&caller->seccomp.filter_count));
  537. /*
  538. * Don't let an unprivileged task work around
  539. * the no_new_privs restriction by creating
  540. * a thread that sets it up, enters seccomp,
  541. * then dies.
  542. */
  543. if (task_no_new_privs(caller))
  544. task_set_no_new_privs(thread);
  545. /*
  546. * Opt the other thread into seccomp if needed.
  547. * As threads are considered to be trust-realm
  548. * equivalent (see ptrace_may_access), it is safe to
  549. * allow one thread to transition the other.
  550. */
  551. if (thread->seccomp.mode == SECCOMP_MODE_DISABLED)
  552. seccomp_assign_mode(thread, SECCOMP_MODE_FILTER,
  553. flags);
  554. }
  555. }
  556. /**
  557. * seccomp_prepare_filter: Prepares a seccomp filter for use.
  558. * @fprog: BPF program to install
  559. *
  560. * Returns filter on success or an ERR_PTR on failure.
  561. */
  562. static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog)
  563. {
  564. struct seccomp_filter *sfilter;
  565. int ret;
  566. const bool save_orig =
  567. #if defined(CONFIG_CHECKPOINT_RESTORE) || defined(SECCOMP_ARCH_NATIVE)
  568. true;
  569. #else
  570. false;
  571. #endif
  572. if (fprog->len == 0 || fprog->len > BPF_MAXINSNS)
  573. return ERR_PTR(-EINVAL);
  574. BUG_ON(INT_MAX / fprog->len < sizeof(struct sock_filter));
  575. /*
  576. * Installing a seccomp filter requires that the task has
  577. * CAP_SYS_ADMIN in its namespace or be running with no_new_privs.
  578. * This avoids scenarios where unprivileged tasks can affect the
  579. * behavior of privileged children.
  580. */
  581. if (!task_no_new_privs(current) &&
  582. !ns_capable_noaudit(current_user_ns(), CAP_SYS_ADMIN))
  583. return ERR_PTR(-EACCES);
  584. /* Allocate a new seccomp_filter */
  585. sfilter = kzalloc(sizeof(*sfilter), GFP_KERNEL | __GFP_NOWARN);
  586. if (!sfilter)
  587. return ERR_PTR(-ENOMEM);
  588. mutex_init(&sfilter->notify_lock);
  589. ret = bpf_prog_create_from_user(&sfilter->prog, fprog,
  590. seccomp_check_filter, save_orig);
  591. if (ret < 0) {
  592. kfree(sfilter);
  593. return ERR_PTR(ret);
  594. }
  595. refcount_set(&sfilter->refs, 1);
  596. refcount_set(&sfilter->users, 1);
  597. init_waitqueue_head(&sfilter->wqh);
  598. return sfilter;
  599. }
  600. /**
  601. * seccomp_prepare_user_filter - prepares a user-supplied sock_fprog
  602. * @user_filter: pointer to the user data containing a sock_fprog.
  603. *
  604. * Returns 0 on success and non-zero otherwise.
  605. */
  606. static struct seccomp_filter *
  607. seccomp_prepare_user_filter(const char __user *user_filter)
  608. {
  609. struct sock_fprog fprog;
  610. struct seccomp_filter *filter = ERR_PTR(-EFAULT);
  611. #ifdef CONFIG_COMPAT
  612. if (in_compat_syscall()) {
  613. struct compat_sock_fprog fprog32;
  614. if (copy_from_user(&fprog32, user_filter, sizeof(fprog32)))
  615. goto out;
  616. fprog.len = fprog32.len;
  617. fprog.filter = compat_ptr(fprog32.filter);
  618. } else /* falls through to the if below. */
  619. #endif
  620. if (copy_from_user(&fprog, user_filter, sizeof(fprog)))
  621. goto out;
  622. filter = seccomp_prepare_filter(&fprog);
  623. out:
  624. return filter;
  625. }
  626. #ifdef SECCOMP_ARCH_NATIVE
  627. /**
  628. * seccomp_is_const_allow - check if filter is constant allow with given data
  629. * @fprog: The BPF programs
  630. * @sd: The seccomp data to check against, only syscall number and arch
  631. * number are considered constant.
  632. */
  633. static bool seccomp_is_const_allow(struct sock_fprog_kern *fprog,
  634. struct seccomp_data *sd)
  635. {
  636. unsigned int reg_value = 0;
  637. unsigned int pc;
  638. bool op_res;
  639. if (WARN_ON_ONCE(!fprog))
  640. return false;
  641. for (pc = 0; pc < fprog->len; pc++) {
  642. struct sock_filter *insn = &fprog->filter[pc];
  643. u16 code = insn->code;
  644. u32 k = insn->k;
  645. switch (code) {
  646. case BPF_LD | BPF_W | BPF_ABS:
  647. switch (k) {
  648. case offsetof(struct seccomp_data, nr):
  649. reg_value = sd->nr;
  650. break;
  651. case offsetof(struct seccomp_data, arch):
  652. reg_value = sd->arch;
  653. break;
  654. default:
  655. /* can't optimize (non-constant value load) */
  656. return false;
  657. }
  658. break;
  659. case BPF_RET | BPF_K:
  660. /* reached return with constant values only, check allow */
  661. return k == SECCOMP_RET_ALLOW;
  662. case BPF_JMP | BPF_JA:
  663. pc += insn->k;
  664. break;
  665. case BPF_JMP | BPF_JEQ | BPF_K:
  666. case BPF_JMP | BPF_JGE | BPF_K:
  667. case BPF_JMP | BPF_JGT | BPF_K:
  668. case BPF_JMP | BPF_JSET | BPF_K:
  669. switch (BPF_OP(code)) {
  670. case BPF_JEQ:
  671. op_res = reg_value == k;
  672. break;
  673. case BPF_JGE:
  674. op_res = reg_value >= k;
  675. break;
  676. case BPF_JGT:
  677. op_res = reg_value > k;
  678. break;
  679. case BPF_JSET:
  680. op_res = !!(reg_value & k);
  681. break;
  682. default:
  683. /* can't optimize (unknown jump) */
  684. return false;
  685. }
  686. pc += op_res ? insn->jt : insn->jf;
  687. break;
  688. case BPF_ALU | BPF_AND | BPF_K:
  689. reg_value &= k;
  690. break;
  691. default:
  692. /* can't optimize (unknown insn) */
  693. return false;
  694. }
  695. }
  696. /* ran off the end of the filter?! */
  697. WARN_ON(1);
  698. return false;
  699. }
  700. static void seccomp_cache_prepare_bitmap(struct seccomp_filter *sfilter,
  701. void *bitmap, const void *bitmap_prev,
  702. size_t bitmap_size, int arch)
  703. {
  704. struct sock_fprog_kern *fprog = sfilter->prog->orig_prog;
  705. struct seccomp_data sd;
  706. int nr;
  707. if (bitmap_prev) {
  708. /* The new filter must be as restrictive as the last. */
  709. bitmap_copy(bitmap, bitmap_prev, bitmap_size);
  710. } else {
  711. /* Before any filters, all syscalls are always allowed. */
  712. bitmap_fill(bitmap, bitmap_size);
  713. }
  714. for (nr = 0; nr < bitmap_size; nr++) {
  715. /* No bitmap change: not a cacheable action. */
  716. if (!test_bit(nr, bitmap))
  717. continue;
  718. sd.nr = nr;
  719. sd.arch = arch;
  720. /* No bitmap change: continue to always allow. */
  721. if (seccomp_is_const_allow(fprog, &sd))
  722. continue;
  723. /*
  724. * Not a cacheable action: always run filters.
  725. * atomic clear_bit() not needed, filter not visible yet.
  726. */
  727. __clear_bit(nr, bitmap);
  728. }
  729. }
  730. /**
  731. * seccomp_cache_prepare - emulate the filter to find cachable syscalls
  732. * @sfilter: The seccomp filter
  733. *
  734. * Returns 0 if successful or -errno if error occurred.
  735. */
  736. static void seccomp_cache_prepare(struct seccomp_filter *sfilter)
  737. {
  738. struct action_cache *cache = &sfilter->cache;
  739. const struct action_cache *cache_prev =
  740. sfilter->prev ? &sfilter->prev->cache : NULL;
  741. seccomp_cache_prepare_bitmap(sfilter, cache->allow_native,
  742. cache_prev ? cache_prev->allow_native : NULL,
  743. SECCOMP_ARCH_NATIVE_NR,
  744. SECCOMP_ARCH_NATIVE);
  745. #ifdef SECCOMP_ARCH_COMPAT
  746. seccomp_cache_prepare_bitmap(sfilter, cache->allow_compat,
  747. cache_prev ? cache_prev->allow_compat : NULL,
  748. SECCOMP_ARCH_COMPAT_NR,
  749. SECCOMP_ARCH_COMPAT);
  750. #endif /* SECCOMP_ARCH_COMPAT */
  751. }
  752. #endif /* SECCOMP_ARCH_NATIVE */
  753. /**
  754. * seccomp_attach_filter: validate and attach filter
  755. * @flags: flags to change filter behavior
  756. * @filter: seccomp filter to add to the current process
  757. *
  758. * Caller must be holding current->sighand->siglock lock.
  759. *
  760. * Returns 0 on success, -ve on error, or
  761. * - in TSYNC mode: the pid of a thread which was either not in the correct
  762. * seccomp mode or did not have an ancestral seccomp filter
  763. * - in NEW_LISTENER mode: the fd of the new listener
  764. */
  765. static long seccomp_attach_filter(unsigned int flags,
  766. struct seccomp_filter *filter)
  767. {
  768. unsigned long total_insns;
  769. struct seccomp_filter *walker;
  770. assert_spin_locked(&current->sighand->siglock);
  771. /* Validate resulting filter length. */
  772. total_insns = filter->prog->len;
  773. for (walker = current->seccomp.filter; walker; walker = walker->prev)
  774. total_insns += walker->prog->len + 4; /* 4 instr penalty */
  775. if (total_insns > MAX_INSNS_PER_PATH)
  776. return -ENOMEM;
  777. /* If thread sync has been requested, check that it is possible. */
  778. if (flags & SECCOMP_FILTER_FLAG_TSYNC) {
  779. int ret;
  780. ret = seccomp_can_sync_threads();
  781. if (ret) {
  782. if (flags & SECCOMP_FILTER_FLAG_TSYNC_ESRCH)
  783. return -ESRCH;
  784. else
  785. return ret;
  786. }
  787. }
  788. /* Set log flag, if present. */
  789. if (flags & SECCOMP_FILTER_FLAG_LOG)
  790. filter->log = true;
  791. /*
  792. * If there is an existing filter, make it the prev and don't drop its
  793. * task reference.
  794. */
  795. filter->prev = current->seccomp.filter;
  796. seccomp_cache_prepare(filter);
  797. current->seccomp.filter = filter;
  798. atomic_inc(&current->seccomp.filter_count);
  799. /* Now that the new filter is in place, synchronize to all threads. */
  800. if (flags & SECCOMP_FILTER_FLAG_TSYNC)
  801. seccomp_sync_threads(flags);
  802. return 0;
  803. }
  804. static void __get_seccomp_filter(struct seccomp_filter *filter)
  805. {
  806. refcount_inc(&filter->refs);
  807. }
  808. /* get_seccomp_filter - increments the reference count of the filter on @tsk */
  809. void get_seccomp_filter(struct task_struct *tsk)
  810. {
  811. struct seccomp_filter *orig = tsk->seccomp.filter;
  812. if (!orig)
  813. return;
  814. __get_seccomp_filter(orig);
  815. refcount_inc(&orig->users);
  816. }
  817. static void seccomp_init_siginfo(kernel_siginfo_t *info, int syscall, int reason)
  818. {
  819. clear_siginfo(info);
  820. info->si_signo = SIGSYS;
  821. info->si_code = SYS_SECCOMP;
  822. info->si_call_addr = (void __user *)KSTK_EIP(current);
  823. info->si_errno = reason;
  824. info->si_arch = syscall_get_arch(current);
  825. info->si_syscall = syscall;
  826. }
  827. /**
  828. * seccomp_send_sigsys - signals the task to allow in-process syscall emulation
  829. * @syscall: syscall number to send to userland
  830. * @reason: filter-supplied reason code to send to userland (via si_errno)
  831. *
  832. * Forces a SIGSYS with a code of SYS_SECCOMP and related sigsys info.
  833. */
  834. static void seccomp_send_sigsys(int syscall, int reason)
  835. {
  836. struct kernel_siginfo info;
  837. seccomp_init_siginfo(&info, syscall, reason);
  838. force_sig_info(&info);
  839. }
  840. #endif /* CONFIG_SECCOMP_FILTER */
  841. /* For use with seccomp_actions_logged */
  842. #define SECCOMP_LOG_KILL_PROCESS (1 << 0)
  843. #define SECCOMP_LOG_KILL_THREAD (1 << 1)
  844. #define SECCOMP_LOG_TRAP (1 << 2)
  845. #define SECCOMP_LOG_ERRNO (1 << 3)
  846. #define SECCOMP_LOG_TRACE (1 << 4)
  847. #define SECCOMP_LOG_LOG (1 << 5)
  848. #define SECCOMP_LOG_ALLOW (1 << 6)
  849. #define SECCOMP_LOG_USER_NOTIF (1 << 7)
  850. static u32 seccomp_actions_logged = SECCOMP_LOG_KILL_PROCESS |
  851. SECCOMP_LOG_KILL_THREAD |
  852. SECCOMP_LOG_TRAP |
  853. SECCOMP_LOG_ERRNO |
  854. SECCOMP_LOG_USER_NOTIF |
  855. SECCOMP_LOG_TRACE |
  856. SECCOMP_LOG_LOG;
  857. static inline void seccomp_log(unsigned long syscall, long signr, u32 action,
  858. bool requested)
  859. {
  860. bool log = false;
  861. switch (action) {
  862. case SECCOMP_RET_ALLOW:
  863. break;
  864. case SECCOMP_RET_TRAP:
  865. log = requested && seccomp_actions_logged & SECCOMP_LOG_TRAP;
  866. break;
  867. case SECCOMP_RET_ERRNO:
  868. log = requested && seccomp_actions_logged & SECCOMP_LOG_ERRNO;
  869. break;
  870. case SECCOMP_RET_TRACE:
  871. log = requested && seccomp_actions_logged & SECCOMP_LOG_TRACE;
  872. break;
  873. case SECCOMP_RET_USER_NOTIF:
  874. log = requested && seccomp_actions_logged & SECCOMP_LOG_USER_NOTIF;
  875. break;
  876. case SECCOMP_RET_LOG:
  877. log = seccomp_actions_logged & SECCOMP_LOG_LOG;
  878. break;
  879. case SECCOMP_RET_KILL_THREAD:
  880. log = seccomp_actions_logged & SECCOMP_LOG_KILL_THREAD;
  881. break;
  882. case SECCOMP_RET_KILL_PROCESS:
  883. default:
  884. log = seccomp_actions_logged & SECCOMP_LOG_KILL_PROCESS;
  885. }
  886. /*
  887. * Emit an audit message when the action is RET_KILL_*, RET_LOG, or the
  888. * FILTER_FLAG_LOG bit was set. The admin has the ability to silence
  889. * any action from being logged by removing the action name from the
  890. * seccomp_actions_logged sysctl.
  891. */
  892. if (!log)
  893. return;
  894. audit_seccomp(syscall, signr, action);
  895. }
  896. /*
  897. * Secure computing mode 1 allows only read/write/exit/sigreturn.
  898. * To be fully secure this must be combined with rlimit
  899. * to limit the stack allocations too.
  900. */
  901. static const int mode1_syscalls[] = {
  902. __NR_seccomp_read, __NR_seccomp_write, __NR_seccomp_exit, __NR_seccomp_sigreturn,
  903. -1, /* negative terminated */
  904. };
  905. static void __secure_computing_strict(int this_syscall)
  906. {
  907. const int *allowed_syscalls = mode1_syscalls;
  908. #ifdef CONFIG_COMPAT
  909. if (in_compat_syscall())
  910. allowed_syscalls = get_compat_mode1_syscalls();
  911. #endif
  912. do {
  913. if (*allowed_syscalls == this_syscall)
  914. return;
  915. } while (*++allowed_syscalls != -1);
  916. #ifdef SECCOMP_DEBUG
  917. dump_stack();
  918. #endif
  919. seccomp_log(this_syscall, SIGKILL, SECCOMP_RET_KILL_THREAD, true);
  920. do_exit(SIGKILL);
  921. }
  922. #ifndef CONFIG_HAVE_ARCH_SECCOMP_FILTER
  923. void secure_computing_strict(int this_syscall)
  924. {
  925. int mode = current->seccomp.mode;
  926. if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) &&
  927. unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
  928. return;
  929. if (mode == SECCOMP_MODE_DISABLED)
  930. return;
  931. else if (mode == SECCOMP_MODE_STRICT)
  932. __secure_computing_strict(this_syscall);
  933. else
  934. BUG();
  935. }
  936. #else
  937. #ifdef CONFIG_SECCOMP_FILTER
  938. static u64 seccomp_next_notify_id(struct seccomp_filter *filter)
  939. {
  940. /*
  941. * Note: overflow is ok here, the id just needs to be unique per
  942. * filter.
  943. */
  944. lockdep_assert_held(&filter->notify_lock);
  945. return filter->notif->next_id++;
  946. }
  947. static void seccomp_handle_addfd(struct seccomp_kaddfd *addfd)
  948. {
  949. /*
  950. * Remove the notification, and reset the list pointers, indicating
  951. * that it has been handled.
  952. */
  953. list_del_init(&addfd->list);
  954. addfd->ret = receive_fd_replace(addfd->fd, addfd->file, addfd->flags);
  955. complete(&addfd->completion);
  956. }
  957. static int seccomp_do_user_notification(int this_syscall,
  958. struct seccomp_filter *match,
  959. const struct seccomp_data *sd)
  960. {
  961. int err;
  962. u32 flags = 0;
  963. long ret = 0;
  964. struct seccomp_knotif n = {};
  965. struct seccomp_kaddfd *addfd, *tmp;
  966. mutex_lock(&match->notify_lock);
  967. err = -ENOSYS;
  968. if (!match->notif)
  969. goto out;
  970. n.task = current;
  971. n.state = SECCOMP_NOTIFY_INIT;
  972. n.data = sd;
  973. n.id = seccomp_next_notify_id(match);
  974. init_completion(&n.ready);
  975. list_add(&n.list, &match->notif->notifications);
  976. INIT_LIST_HEAD(&n.addfd);
  977. up(&match->notif->request);
  978. wake_up_poll(&match->wqh, EPOLLIN | EPOLLRDNORM);
  979. /*
  980. * This is where we wait for a reply from userspace.
  981. */
  982. do {
  983. mutex_unlock(&match->notify_lock);
  984. err = wait_for_completion_interruptible(&n.ready);
  985. mutex_lock(&match->notify_lock);
  986. if (err != 0)
  987. goto interrupted;
  988. addfd = list_first_entry_or_null(&n.addfd,
  989. struct seccomp_kaddfd, list);
  990. /* Check if we were woken up by a addfd message */
  991. if (addfd)
  992. seccomp_handle_addfd(addfd);
  993. } while (n.state != SECCOMP_NOTIFY_REPLIED);
  994. ret = n.val;
  995. err = n.error;
  996. flags = n.flags;
  997. interrupted:
  998. /* If there were any pending addfd calls, clear them out */
  999. list_for_each_entry_safe(addfd, tmp, &n.addfd, list) {
  1000. /* The process went away before we got a chance to handle it */
  1001. addfd->ret = -ESRCH;
  1002. list_del_init(&addfd->list);
  1003. complete(&addfd->completion);
  1004. }
  1005. /*
  1006. * Note that it's possible the listener died in between the time when
  1007. * we were notified of a response (or a signal) and when we were able to
  1008. * re-acquire the lock, so only delete from the list if the
  1009. * notification actually exists.
  1010. *
  1011. * Also note that this test is only valid because there's no way to
  1012. * *reattach* to a notifier right now. If one is added, we'll need to
  1013. * keep track of the notif itself and make sure they match here.
  1014. */
  1015. if (match->notif)
  1016. list_del(&n.list);
  1017. out:
  1018. mutex_unlock(&match->notify_lock);
  1019. /* Userspace requests to continue the syscall. */
  1020. if (flags & SECCOMP_USER_NOTIF_FLAG_CONTINUE)
  1021. return 0;
  1022. syscall_set_return_value(current, current_pt_regs(),
  1023. err, ret);
  1024. return -1;
  1025. }
  1026. static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
  1027. const bool recheck_after_trace)
  1028. {
  1029. u32 filter_ret, action;
  1030. struct seccomp_filter *match = NULL;
  1031. int data;
  1032. struct seccomp_data sd_local;
  1033. /*
  1034. * Make sure that any changes to mode from another thread have
  1035. * been seen after TIF_SECCOMP was seen.
  1036. */
  1037. rmb();
  1038. if (!sd) {
  1039. populate_seccomp_data(&sd_local);
  1040. sd = &sd_local;
  1041. }
  1042. filter_ret = seccomp_run_filters(sd, &match);
  1043. data = filter_ret & SECCOMP_RET_DATA;
  1044. action = filter_ret & SECCOMP_RET_ACTION_FULL;
  1045. switch (action) {
  1046. case SECCOMP_RET_ERRNO:
  1047. /* Set low-order bits as an errno, capped at MAX_ERRNO. */
  1048. if (data > MAX_ERRNO)
  1049. data = MAX_ERRNO;
  1050. syscall_set_return_value(current, current_pt_regs(),
  1051. -data, 0);
  1052. goto skip;
  1053. case SECCOMP_RET_TRAP:
  1054. /* Show the handler the original registers. */
  1055. syscall_rollback(current, current_pt_regs());
  1056. /* Let the filter pass back 16 bits of data. */
  1057. seccomp_send_sigsys(this_syscall, data);
  1058. goto skip;
  1059. case SECCOMP_RET_TRACE:
  1060. /* We've been put in this state by the ptracer already. */
  1061. if (recheck_after_trace)
  1062. return 0;
  1063. /* ENOSYS these calls if there is no tracer attached. */
  1064. if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP)) {
  1065. syscall_set_return_value(current,
  1066. current_pt_regs(),
  1067. -ENOSYS, 0);
  1068. goto skip;
  1069. }
  1070. /* Allow the BPF to provide the event message */
  1071. ptrace_event(PTRACE_EVENT_SECCOMP, data);
  1072. /*
  1073. * The delivery of a fatal signal during event
  1074. * notification may silently skip tracer notification,
  1075. * which could leave us with a potentially unmodified
  1076. * syscall that the tracer would have liked to have
  1077. * changed. Since the process is about to die, we just
  1078. * force the syscall to be skipped and let the signal
  1079. * kill the process and correctly handle any tracer exit
  1080. * notifications.
  1081. */
  1082. if (fatal_signal_pending(current))
  1083. goto skip;
  1084. /* Check if the tracer forced the syscall to be skipped. */
  1085. this_syscall = syscall_get_nr(current, current_pt_regs());
  1086. if (this_syscall < 0)
  1087. goto skip;
  1088. /*
  1089. * Recheck the syscall, since it may have changed. This
  1090. * intentionally uses a NULL struct seccomp_data to force
  1091. * a reload of all registers. This does not goto skip since
  1092. * a skip would have already been reported.
  1093. */
  1094. if (__seccomp_filter(this_syscall, NULL, true))
  1095. return -1;
  1096. return 0;
  1097. case SECCOMP_RET_USER_NOTIF:
  1098. if (seccomp_do_user_notification(this_syscall, match, sd))
  1099. goto skip;
  1100. return 0;
  1101. case SECCOMP_RET_LOG:
  1102. seccomp_log(this_syscall, 0, action, true);
  1103. return 0;
  1104. case SECCOMP_RET_ALLOW:
  1105. /*
  1106. * Note that the "match" filter will always be NULL for
  1107. * this action since SECCOMP_RET_ALLOW is the starting
  1108. * state in seccomp_run_filters().
  1109. */
  1110. return 0;
  1111. case SECCOMP_RET_KILL_THREAD:
  1112. case SECCOMP_RET_KILL_PROCESS:
  1113. default:
  1114. seccomp_log(this_syscall, SIGSYS, action, true);
  1115. /* Dump core only if this is the last remaining thread. */
  1116. if (action != SECCOMP_RET_KILL_THREAD ||
  1117. get_nr_threads(current) == 1) {
  1118. kernel_siginfo_t info;
  1119. /* Show the original registers in the dump. */
  1120. syscall_rollback(current, current_pt_regs());
  1121. /* Trigger a manual coredump since do_exit skips it. */
  1122. seccomp_init_siginfo(&info, this_syscall, data);
  1123. do_coredump(&info);
  1124. }
  1125. if (action == SECCOMP_RET_KILL_THREAD)
  1126. do_exit(SIGSYS);
  1127. else
  1128. do_group_exit(SIGSYS);
  1129. }
  1130. unreachable();
  1131. skip:
  1132. seccomp_log(this_syscall, 0, action, match ? match->log : false);
  1133. return -1;
  1134. }
  1135. #else
  1136. static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
  1137. const bool recheck_after_trace)
  1138. {
  1139. BUG();
  1140. return -1;
  1141. }
  1142. #endif
  1143. int __secure_computing(const struct seccomp_data *sd)
  1144. {
  1145. int mode = current->seccomp.mode;
  1146. int this_syscall;
  1147. if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) &&
  1148. unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
  1149. return 0;
  1150. this_syscall = sd ? sd->nr :
  1151. syscall_get_nr(current, current_pt_regs());
  1152. switch (mode) {
  1153. case SECCOMP_MODE_STRICT:
  1154. __secure_computing_strict(this_syscall); /* may call do_exit */
  1155. return 0;
  1156. case SECCOMP_MODE_FILTER:
  1157. return __seccomp_filter(this_syscall, sd, false);
  1158. default:
  1159. BUG();
  1160. }
  1161. }
  1162. #endif /* CONFIG_HAVE_ARCH_SECCOMP_FILTER */
  1163. long prctl_get_seccomp(void)
  1164. {
  1165. return current->seccomp.mode;
  1166. }
  1167. /**
  1168. * seccomp_set_mode_strict: internal function for setting strict seccomp
  1169. *
  1170. * Once current->seccomp.mode is non-zero, it may not be changed.
  1171. *
  1172. * Returns 0 on success or -EINVAL on failure.
  1173. */
  1174. static long seccomp_set_mode_strict(void)
  1175. {
  1176. const unsigned long seccomp_mode = SECCOMP_MODE_STRICT;
  1177. long ret = -EINVAL;
  1178. spin_lock_irq(&current->sighand->siglock);
  1179. if (!seccomp_may_assign_mode(seccomp_mode))
  1180. goto out;
  1181. #ifdef TIF_NOTSC
  1182. disable_TSC();
  1183. #endif
  1184. seccomp_assign_mode(current, seccomp_mode, 0);
  1185. ret = 0;
  1186. out:
  1187. spin_unlock_irq(&current->sighand->siglock);
  1188. return ret;
  1189. }
  1190. #ifdef CONFIG_SECCOMP_FILTER
  1191. static void seccomp_notify_free(struct seccomp_filter *filter)
  1192. {
  1193. kfree(filter->notif);
  1194. filter->notif = NULL;
  1195. }
  1196. static void seccomp_notify_detach(struct seccomp_filter *filter)
  1197. {
  1198. struct seccomp_knotif *knotif;
  1199. if (!filter)
  1200. return;
  1201. mutex_lock(&filter->notify_lock);
  1202. /*
  1203. * If this file is being closed because e.g. the task who owned it
  1204. * died, let's wake everyone up who was waiting on us.
  1205. */
  1206. list_for_each_entry(knotif, &filter->notif->notifications, list) {
  1207. if (knotif->state == SECCOMP_NOTIFY_REPLIED)
  1208. continue;
  1209. knotif->state = SECCOMP_NOTIFY_REPLIED;
  1210. knotif->error = -ENOSYS;
  1211. knotif->val = 0;
  1212. /*
  1213. * We do not need to wake up any pending addfd messages, as
  1214. * the notifier will do that for us, as this just looks
  1215. * like a standard reply.
  1216. */
  1217. complete(&knotif->ready);
  1218. }
  1219. seccomp_notify_free(filter);
  1220. mutex_unlock(&filter->notify_lock);
  1221. }
  1222. static int seccomp_notify_release(struct inode *inode, struct file *file)
  1223. {
  1224. struct seccomp_filter *filter = file->private_data;
  1225. seccomp_notify_detach(filter);
  1226. __put_seccomp_filter(filter);
  1227. return 0;
  1228. }
  1229. /* must be called with notif_lock held */
  1230. static inline struct seccomp_knotif *
  1231. find_notification(struct seccomp_filter *filter, u64 id)
  1232. {
  1233. struct seccomp_knotif *cur;
  1234. lockdep_assert_held(&filter->notify_lock);
  1235. list_for_each_entry(cur, &filter->notif->notifications, list) {
  1236. if (cur->id == id)
  1237. return cur;
  1238. }
  1239. return NULL;
  1240. }
  1241. static long seccomp_notify_recv(struct seccomp_filter *filter,
  1242. void __user *buf)
  1243. {
  1244. struct seccomp_knotif *knotif = NULL, *cur;
  1245. struct seccomp_notif unotif;
  1246. ssize_t ret;
  1247. /* Verify that we're not given garbage to keep struct extensible. */
  1248. ret = check_zeroed_user(buf, sizeof(unotif));
  1249. if (ret < 0)
  1250. return ret;
  1251. if (!ret)
  1252. return -EINVAL;
  1253. memset(&unotif, 0, sizeof(unotif));
  1254. ret = down_interruptible(&filter->notif->request);
  1255. if (ret < 0)
  1256. return ret;
  1257. mutex_lock(&filter->notify_lock);
  1258. list_for_each_entry(cur, &filter->notif->notifications, list) {
  1259. if (cur->state == SECCOMP_NOTIFY_INIT) {
  1260. knotif = cur;
  1261. break;
  1262. }
  1263. }
  1264. /*
  1265. * If we didn't find a notification, it could be that the task was
  1266. * interrupted by a fatal signal between the time we were woken and
  1267. * when we were able to acquire the rw lock.
  1268. */
  1269. if (!knotif) {
  1270. ret = -ENOENT;
  1271. goto out;
  1272. }
  1273. unotif.id = knotif->id;
  1274. unotif.pid = task_pid_vnr(knotif->task);
  1275. unotif.data = *(knotif->data);
  1276. knotif->state = SECCOMP_NOTIFY_SENT;
  1277. wake_up_poll(&filter->wqh, EPOLLOUT | EPOLLWRNORM);
  1278. ret = 0;
  1279. out:
  1280. mutex_unlock(&filter->notify_lock);
  1281. if (ret == 0 && copy_to_user(buf, &unotif, sizeof(unotif))) {
  1282. ret = -EFAULT;
  1283. /*
  1284. * Userspace screwed up. To make sure that we keep this
  1285. * notification alive, let's reset it back to INIT. It
  1286. * may have died when we released the lock, so we need to make
  1287. * sure it's still around.
  1288. */
  1289. mutex_lock(&filter->notify_lock);
  1290. knotif = find_notification(filter, unotif.id);
  1291. if (knotif) {
  1292. knotif->state = SECCOMP_NOTIFY_INIT;
  1293. up(&filter->notif->request);
  1294. }
  1295. mutex_unlock(&filter->notify_lock);
  1296. }
  1297. return ret;
  1298. }
  1299. static long seccomp_notify_send(struct seccomp_filter *filter,
  1300. void __user *buf)
  1301. {
  1302. struct seccomp_notif_resp resp = {};
  1303. struct seccomp_knotif *knotif;
  1304. long ret;
  1305. if (copy_from_user(&resp, buf, sizeof(resp)))
  1306. return -EFAULT;
  1307. if (resp.flags & ~SECCOMP_USER_NOTIF_FLAG_CONTINUE)
  1308. return -EINVAL;
  1309. if ((resp.flags & SECCOMP_USER_NOTIF_FLAG_CONTINUE) &&
  1310. (resp.error || resp.val))
  1311. return -EINVAL;
  1312. ret = mutex_lock_interruptible(&filter->notify_lock);
  1313. if (ret < 0)
  1314. return ret;
  1315. knotif = find_notification(filter, resp.id);
  1316. if (!knotif) {
  1317. ret = -ENOENT;
  1318. goto out;
  1319. }
  1320. /* Allow exactly one reply. */
  1321. if (knotif->state != SECCOMP_NOTIFY_SENT) {
  1322. ret = -EINPROGRESS;
  1323. goto out;
  1324. }
  1325. ret = 0;
  1326. knotif->state = SECCOMP_NOTIFY_REPLIED;
  1327. knotif->error = resp.error;
  1328. knotif->val = resp.val;
  1329. knotif->flags = resp.flags;
  1330. complete(&knotif->ready);
  1331. out:
  1332. mutex_unlock(&filter->notify_lock);
  1333. return ret;
  1334. }
  1335. static long seccomp_notify_id_valid(struct seccomp_filter *filter,
  1336. void __user *buf)
  1337. {
  1338. struct seccomp_knotif *knotif;
  1339. u64 id;
  1340. long ret;
  1341. if (copy_from_user(&id, buf, sizeof(id)))
  1342. return -EFAULT;
  1343. ret = mutex_lock_interruptible(&filter->notify_lock);
  1344. if (ret < 0)
  1345. return ret;
  1346. knotif = find_notification(filter, id);
  1347. if (knotif && knotif->state == SECCOMP_NOTIFY_SENT)
  1348. ret = 0;
  1349. else
  1350. ret = -ENOENT;
  1351. mutex_unlock(&filter->notify_lock);
  1352. return ret;
  1353. }
  1354. static long seccomp_notify_addfd(struct seccomp_filter *filter,
  1355. struct seccomp_notif_addfd __user *uaddfd,
  1356. unsigned int size)
  1357. {
  1358. struct seccomp_notif_addfd addfd;
  1359. struct seccomp_knotif *knotif;
  1360. struct seccomp_kaddfd kaddfd;
  1361. int ret;
  1362. BUILD_BUG_ON(sizeof(addfd) < SECCOMP_NOTIFY_ADDFD_SIZE_VER0);
  1363. BUILD_BUG_ON(sizeof(addfd) != SECCOMP_NOTIFY_ADDFD_SIZE_LATEST);
  1364. if (size < SECCOMP_NOTIFY_ADDFD_SIZE_VER0 || size >= PAGE_SIZE)
  1365. return -EINVAL;
  1366. ret = copy_struct_from_user(&addfd, sizeof(addfd), uaddfd, size);
  1367. if (ret)
  1368. return ret;
  1369. if (addfd.newfd_flags & ~O_CLOEXEC)
  1370. return -EINVAL;
  1371. if (addfd.flags & ~SECCOMP_ADDFD_FLAG_SETFD)
  1372. return -EINVAL;
  1373. if (addfd.newfd && !(addfd.flags & SECCOMP_ADDFD_FLAG_SETFD))
  1374. return -EINVAL;
  1375. kaddfd.file = fget(addfd.srcfd);
  1376. if (!kaddfd.file)
  1377. return -EBADF;
  1378. kaddfd.flags = addfd.newfd_flags;
  1379. kaddfd.fd = (addfd.flags & SECCOMP_ADDFD_FLAG_SETFD) ?
  1380. addfd.newfd : -1;
  1381. init_completion(&kaddfd.completion);
  1382. ret = mutex_lock_interruptible(&filter->notify_lock);
  1383. if (ret < 0)
  1384. goto out;
  1385. knotif = find_notification(filter, addfd.id);
  1386. if (!knotif) {
  1387. ret = -ENOENT;
  1388. goto out_unlock;
  1389. }
  1390. /*
  1391. * We do not want to allow for FD injection to occur before the
  1392. * notification has been picked up by a userspace handler, or after
  1393. * the notification has been replied to.
  1394. */
  1395. if (knotif->state != SECCOMP_NOTIFY_SENT) {
  1396. ret = -EINPROGRESS;
  1397. goto out_unlock;
  1398. }
  1399. list_add(&kaddfd.list, &knotif->addfd);
  1400. complete(&knotif->ready);
  1401. mutex_unlock(&filter->notify_lock);
  1402. /* Now we wait for it to be processed or be interrupted */
  1403. ret = wait_for_completion_interruptible(&kaddfd.completion);
  1404. if (ret == 0) {
  1405. /*
  1406. * We had a successful completion. The other side has already
  1407. * removed us from the addfd queue, and
  1408. * wait_for_completion_interruptible has a memory barrier upon
  1409. * success that lets us read this value directly without
  1410. * locking.
  1411. */
  1412. ret = kaddfd.ret;
  1413. goto out;
  1414. }
  1415. mutex_lock(&filter->notify_lock);
  1416. /*
  1417. * Even though we were woken up by a signal and not a successful
  1418. * completion, a completion may have happened in the mean time.
  1419. *
  1420. * We need to check again if the addfd request has been handled,
  1421. * and if not, we will remove it from the queue.
  1422. */
  1423. if (list_empty(&kaddfd.list))
  1424. ret = kaddfd.ret;
  1425. else
  1426. list_del(&kaddfd.list);
  1427. out_unlock:
  1428. mutex_unlock(&filter->notify_lock);
  1429. out:
  1430. fput(kaddfd.file);
  1431. return ret;
  1432. }
  1433. static long seccomp_notify_ioctl(struct file *file, unsigned int cmd,
  1434. unsigned long arg)
  1435. {
  1436. struct seccomp_filter *filter = file->private_data;
  1437. void __user *buf = (void __user *)arg;
  1438. /* Fixed-size ioctls */
  1439. switch (cmd) {
  1440. case SECCOMP_IOCTL_NOTIF_RECV:
  1441. return seccomp_notify_recv(filter, buf);
  1442. case SECCOMP_IOCTL_NOTIF_SEND:
  1443. return seccomp_notify_send(filter, buf);
  1444. case SECCOMP_IOCTL_NOTIF_ID_VALID_WRONG_DIR:
  1445. case SECCOMP_IOCTL_NOTIF_ID_VALID:
  1446. return seccomp_notify_id_valid(filter, buf);
  1447. }
  1448. /* Extensible Argument ioctls */
  1449. #define EA_IOCTL(cmd) ((cmd) & ~(IOC_INOUT | IOCSIZE_MASK))
  1450. switch (EA_IOCTL(cmd)) {
  1451. case EA_IOCTL(SECCOMP_IOCTL_NOTIF_ADDFD):
  1452. return seccomp_notify_addfd(filter, buf, _IOC_SIZE(cmd));
  1453. default:
  1454. return -EINVAL;
  1455. }
  1456. }
  1457. static __poll_t seccomp_notify_poll(struct file *file,
  1458. struct poll_table_struct *poll_tab)
  1459. {
  1460. struct seccomp_filter *filter = file->private_data;
  1461. __poll_t ret = 0;
  1462. struct seccomp_knotif *cur;
  1463. poll_wait(file, &filter->wqh, poll_tab);
  1464. if (mutex_lock_interruptible(&filter->notify_lock) < 0)
  1465. return EPOLLERR;
  1466. list_for_each_entry(cur, &filter->notif->notifications, list) {
  1467. if (cur->state == SECCOMP_NOTIFY_INIT)
  1468. ret |= EPOLLIN | EPOLLRDNORM;
  1469. if (cur->state == SECCOMP_NOTIFY_SENT)
  1470. ret |= EPOLLOUT | EPOLLWRNORM;
  1471. if ((ret & EPOLLIN) && (ret & EPOLLOUT))
  1472. break;
  1473. }
  1474. mutex_unlock(&filter->notify_lock);
  1475. if (refcount_read(&filter->users) == 0)
  1476. ret |= EPOLLHUP;
  1477. return ret;
  1478. }
  1479. static const struct file_operations seccomp_notify_ops = {
  1480. .poll = seccomp_notify_poll,
  1481. .release = seccomp_notify_release,
  1482. .unlocked_ioctl = seccomp_notify_ioctl,
  1483. .compat_ioctl = seccomp_notify_ioctl,
  1484. };
  1485. static struct file *init_listener(struct seccomp_filter *filter)
  1486. {
  1487. struct file *ret;
  1488. ret = ERR_PTR(-ENOMEM);
  1489. filter->notif = kzalloc(sizeof(*(filter->notif)), GFP_KERNEL);
  1490. if (!filter->notif)
  1491. goto out;
  1492. sema_init(&filter->notif->request, 0);
  1493. filter->notif->next_id = get_random_u64();
  1494. INIT_LIST_HEAD(&filter->notif->notifications);
  1495. ret = anon_inode_getfile("seccomp notify", &seccomp_notify_ops,
  1496. filter, O_RDWR);
  1497. if (IS_ERR(ret))
  1498. goto out_notif;
  1499. /* The file has a reference to it now */
  1500. __get_seccomp_filter(filter);
  1501. out_notif:
  1502. if (IS_ERR(ret))
  1503. seccomp_notify_free(filter);
  1504. out:
  1505. return ret;
  1506. }
  1507. /*
  1508. * Does @new_child have a listener while an ancestor also has a listener?
  1509. * If so, we'll want to reject this filter.
  1510. * This only has to be tested for the current process, even in the TSYNC case,
  1511. * because TSYNC installs @child with the same parent on all threads.
  1512. * Note that @new_child is not hooked up to its parent at this point yet, so
  1513. * we use current->seccomp.filter.
  1514. */
  1515. static bool has_duplicate_listener(struct seccomp_filter *new_child)
  1516. {
  1517. struct seccomp_filter *cur;
  1518. /* must be protected against concurrent TSYNC */
  1519. lockdep_assert_held(&current->sighand->siglock);
  1520. if (!new_child->notif)
  1521. return false;
  1522. for (cur = current->seccomp.filter; cur; cur = cur->prev) {
  1523. if (cur->notif)
  1524. return true;
  1525. }
  1526. return false;
  1527. }
  1528. /**
  1529. * seccomp_set_mode_filter: internal function for setting seccomp filter
  1530. * @flags: flags to change filter behavior
  1531. * @filter: struct sock_fprog containing filter
  1532. *
  1533. * This function may be called repeatedly to install additional filters.
  1534. * Every filter successfully installed will be evaluated (in reverse order)
  1535. * for each system call the task makes.
  1536. *
  1537. * Once current->seccomp.mode is non-zero, it may not be changed.
  1538. *
  1539. * Returns 0 on success or -EINVAL on failure.
  1540. */
  1541. static long seccomp_set_mode_filter(unsigned int flags,
  1542. const char __user *filter)
  1543. {
  1544. const unsigned long seccomp_mode = SECCOMP_MODE_FILTER;
  1545. struct seccomp_filter *prepared = NULL;
  1546. long ret = -EINVAL;
  1547. int listener = -1;
  1548. struct file *listener_f = NULL;
  1549. /* Validate flags. */
  1550. if (flags & ~SECCOMP_FILTER_FLAG_MASK)
  1551. return -EINVAL;
  1552. /*
  1553. * In the successful case, NEW_LISTENER returns the new listener fd.
  1554. * But in the failure case, TSYNC returns the thread that died. If you
  1555. * combine these two flags, there's no way to tell whether something
  1556. * succeeded or failed. So, let's disallow this combination if the user
  1557. * has not explicitly requested no errors from TSYNC.
  1558. */
  1559. if ((flags & SECCOMP_FILTER_FLAG_TSYNC) &&
  1560. (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) &&
  1561. ((flags & SECCOMP_FILTER_FLAG_TSYNC_ESRCH) == 0))
  1562. return -EINVAL;
  1563. /* Prepare the new filter before holding any locks. */
  1564. prepared = seccomp_prepare_user_filter(filter);
  1565. if (IS_ERR(prepared))
  1566. return PTR_ERR(prepared);
  1567. if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) {
  1568. listener = get_unused_fd_flags(O_CLOEXEC);
  1569. if (listener < 0) {
  1570. ret = listener;
  1571. goto out_free;
  1572. }
  1573. listener_f = init_listener(prepared);
  1574. if (IS_ERR(listener_f)) {
  1575. put_unused_fd(listener);
  1576. ret = PTR_ERR(listener_f);
  1577. goto out_free;
  1578. }
  1579. }
  1580. /*
  1581. * Make sure we cannot change seccomp or nnp state via TSYNC
  1582. * while another thread is in the middle of calling exec.
  1583. */
  1584. if (flags & SECCOMP_FILTER_FLAG_TSYNC &&
  1585. mutex_lock_killable(&current->signal->cred_guard_mutex))
  1586. goto out_put_fd;
  1587. spin_lock_irq(&current->sighand->siglock);
  1588. if (!seccomp_may_assign_mode(seccomp_mode))
  1589. goto out;
  1590. if (has_duplicate_listener(prepared)) {
  1591. ret = -EBUSY;
  1592. goto out;
  1593. }
  1594. ret = seccomp_attach_filter(flags, prepared);
  1595. if (ret)
  1596. goto out;
  1597. /* Do not free the successfully attached filter. */
  1598. prepared = NULL;
  1599. seccomp_assign_mode(current, seccomp_mode, flags);
  1600. out:
  1601. spin_unlock_irq(&current->sighand->siglock);
  1602. if (flags & SECCOMP_FILTER_FLAG_TSYNC)
  1603. mutex_unlock(&current->signal->cred_guard_mutex);
  1604. out_put_fd:
  1605. if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) {
  1606. if (ret) {
  1607. listener_f->private_data = NULL;
  1608. fput(listener_f);
  1609. put_unused_fd(listener);
  1610. seccomp_notify_detach(prepared);
  1611. } else {
  1612. fd_install(listener, listener_f);
  1613. ret = listener;
  1614. }
  1615. }
  1616. out_free:
  1617. seccomp_filter_free(prepared);
  1618. return ret;
  1619. }
  1620. #else
  1621. static inline long seccomp_set_mode_filter(unsigned int flags,
  1622. const char __user *filter)
  1623. {
  1624. return -EINVAL;
  1625. }
  1626. #endif
  1627. static long seccomp_get_action_avail(const char __user *uaction)
  1628. {
  1629. u32 action;
  1630. if (copy_from_user(&action, uaction, sizeof(action)))
  1631. return -EFAULT;
  1632. switch (action) {
  1633. case SECCOMP_RET_KILL_PROCESS:
  1634. case SECCOMP_RET_KILL_THREAD:
  1635. case SECCOMP_RET_TRAP:
  1636. case SECCOMP_RET_ERRNO:
  1637. case SECCOMP_RET_USER_NOTIF:
  1638. case SECCOMP_RET_TRACE:
  1639. case SECCOMP_RET_LOG:
  1640. case SECCOMP_RET_ALLOW:
  1641. break;
  1642. default:
  1643. return -EOPNOTSUPP;
  1644. }
  1645. return 0;
  1646. }
  1647. static long seccomp_get_notif_sizes(void __user *usizes)
  1648. {
  1649. struct seccomp_notif_sizes sizes = {
  1650. .seccomp_notif = sizeof(struct seccomp_notif),
  1651. .seccomp_notif_resp = sizeof(struct seccomp_notif_resp),
  1652. .seccomp_data = sizeof(struct seccomp_data),
  1653. };
  1654. if (copy_to_user(usizes, &sizes, sizeof(sizes)))
  1655. return -EFAULT;
  1656. return 0;
  1657. }
  1658. /* Common entry point for both prctl and syscall. */
  1659. static long do_seccomp(unsigned int op, unsigned int flags,
  1660. void __user *uargs)
  1661. {
  1662. switch (op) {
  1663. case SECCOMP_SET_MODE_STRICT:
  1664. if (flags != 0 || uargs != NULL)
  1665. return -EINVAL;
  1666. return seccomp_set_mode_strict();
  1667. case SECCOMP_SET_MODE_FILTER:
  1668. return seccomp_set_mode_filter(flags, uargs);
  1669. case SECCOMP_GET_ACTION_AVAIL:
  1670. if (flags != 0)
  1671. return -EINVAL;
  1672. return seccomp_get_action_avail(uargs);
  1673. case SECCOMP_GET_NOTIF_SIZES:
  1674. if (flags != 0)
  1675. return -EINVAL;
  1676. return seccomp_get_notif_sizes(uargs);
  1677. default:
  1678. return -EINVAL;
  1679. }
  1680. }
  1681. SYSCALL_DEFINE3(seccomp, unsigned int, op, unsigned int, flags,
  1682. void __user *, uargs)
  1683. {
  1684. return do_seccomp(op, flags, uargs);
  1685. }
  1686. /**
  1687. * prctl_set_seccomp: configures current->seccomp.mode
  1688. * @seccomp_mode: requested mode to use
  1689. * @filter: optional struct sock_fprog for use with SECCOMP_MODE_FILTER
  1690. *
  1691. * Returns 0 on success or -EINVAL on failure.
  1692. */
  1693. long prctl_set_seccomp(unsigned long seccomp_mode, void __user *filter)
  1694. {
  1695. unsigned int op;
  1696. void __user *uargs;
  1697. switch (seccomp_mode) {
  1698. case SECCOMP_MODE_STRICT:
  1699. op = SECCOMP_SET_MODE_STRICT;
  1700. /*
  1701. * Setting strict mode through prctl always ignored filter,
  1702. * so make sure it is always NULL here to pass the internal
  1703. * check in do_seccomp().
  1704. */
  1705. uargs = NULL;
  1706. break;
  1707. case SECCOMP_MODE_FILTER:
  1708. op = SECCOMP_SET_MODE_FILTER;
  1709. uargs = filter;
  1710. break;
  1711. default:
  1712. return -EINVAL;
  1713. }
  1714. /* prctl interface doesn't have flags, so they are always zero. */
  1715. return do_seccomp(op, 0, uargs);
  1716. }
  1717. #if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
  1718. static struct seccomp_filter *get_nth_filter(struct task_struct *task,
  1719. unsigned long filter_off)
  1720. {
  1721. struct seccomp_filter *orig, *filter;
  1722. unsigned long count;
  1723. /*
  1724. * Note: this is only correct because the caller should be the (ptrace)
  1725. * tracer of the task, otherwise lock_task_sighand is needed.
  1726. */
  1727. spin_lock_irq(&task->sighand->siglock);
  1728. if (task->seccomp.mode != SECCOMP_MODE_FILTER) {
  1729. spin_unlock_irq(&task->sighand->siglock);
  1730. return ERR_PTR(-EINVAL);
  1731. }
  1732. orig = task->seccomp.filter;
  1733. __get_seccomp_filter(orig);
  1734. spin_unlock_irq(&task->sighand->siglock);
  1735. count = 0;
  1736. for (filter = orig; filter; filter = filter->prev)
  1737. count++;
  1738. if (filter_off >= count) {
  1739. filter = ERR_PTR(-ENOENT);
  1740. goto out;
  1741. }
  1742. count -= filter_off;
  1743. for (filter = orig; filter && count > 1; filter = filter->prev)
  1744. count--;
  1745. if (WARN_ON(count != 1 || !filter)) {
  1746. filter = ERR_PTR(-ENOENT);
  1747. goto out;
  1748. }
  1749. __get_seccomp_filter(filter);
  1750. out:
  1751. __put_seccomp_filter(orig);
  1752. return filter;
  1753. }
  1754. long seccomp_get_filter(struct task_struct *task, unsigned long filter_off,
  1755. void __user *data)
  1756. {
  1757. struct seccomp_filter *filter;
  1758. struct sock_fprog_kern *fprog;
  1759. long ret;
  1760. if (!capable(CAP_SYS_ADMIN) ||
  1761. current->seccomp.mode != SECCOMP_MODE_DISABLED) {
  1762. return -EACCES;
  1763. }
  1764. filter = get_nth_filter(task, filter_off);
  1765. if (IS_ERR(filter))
  1766. return PTR_ERR(filter);
  1767. fprog = filter->prog->orig_prog;
  1768. if (!fprog) {
  1769. /* This must be a new non-cBPF filter, since we save
  1770. * every cBPF filter's orig_prog above when
  1771. * CONFIG_CHECKPOINT_RESTORE is enabled.
  1772. */
  1773. ret = -EMEDIUMTYPE;
  1774. goto out;
  1775. }
  1776. ret = fprog->len;
  1777. if (!data)
  1778. goto out;
  1779. if (copy_to_user(data, fprog->filter, bpf_classic_proglen(fprog)))
  1780. ret = -EFAULT;
  1781. out:
  1782. __put_seccomp_filter(filter);
  1783. return ret;
  1784. }
  1785. long seccomp_get_metadata(struct task_struct *task,
  1786. unsigned long size, void __user *data)
  1787. {
  1788. long ret;
  1789. struct seccomp_filter *filter;
  1790. struct seccomp_metadata kmd = {};
  1791. if (!capable(CAP_SYS_ADMIN) ||
  1792. current->seccomp.mode != SECCOMP_MODE_DISABLED) {
  1793. return -EACCES;
  1794. }
  1795. size = min_t(unsigned long, size, sizeof(kmd));
  1796. if (size < sizeof(kmd.filter_off))
  1797. return -EINVAL;
  1798. if (copy_from_user(&kmd.filter_off, data, sizeof(kmd.filter_off)))
  1799. return -EFAULT;
  1800. filter = get_nth_filter(task, kmd.filter_off);
  1801. if (IS_ERR(filter))
  1802. return PTR_ERR(filter);
  1803. if (filter->log)
  1804. kmd.flags |= SECCOMP_FILTER_FLAG_LOG;
  1805. ret = size;
  1806. if (copy_to_user(data, &kmd, size))
  1807. ret = -EFAULT;
  1808. __put_seccomp_filter(filter);
  1809. return ret;
  1810. }
  1811. #endif
  1812. #ifdef CONFIG_SYSCTL
  1813. /* Human readable action names for friendly sysctl interaction */
  1814. #define SECCOMP_RET_KILL_PROCESS_NAME "kill_process"
  1815. #define SECCOMP_RET_KILL_THREAD_NAME "kill_thread"
  1816. #define SECCOMP_RET_TRAP_NAME "trap"
  1817. #define SECCOMP_RET_ERRNO_NAME "errno"
  1818. #define SECCOMP_RET_USER_NOTIF_NAME "user_notif"
  1819. #define SECCOMP_RET_TRACE_NAME "trace"
  1820. #define SECCOMP_RET_LOG_NAME "log"
  1821. #define SECCOMP_RET_ALLOW_NAME "allow"
  1822. static const char seccomp_actions_avail[] =
  1823. SECCOMP_RET_KILL_PROCESS_NAME " "
  1824. SECCOMP_RET_KILL_THREAD_NAME " "
  1825. SECCOMP_RET_TRAP_NAME " "
  1826. SECCOMP_RET_ERRNO_NAME " "
  1827. SECCOMP_RET_USER_NOTIF_NAME " "
  1828. SECCOMP_RET_TRACE_NAME " "
  1829. SECCOMP_RET_LOG_NAME " "
  1830. SECCOMP_RET_ALLOW_NAME;
  1831. struct seccomp_log_name {
  1832. u32 log;
  1833. const char *name;
  1834. };
  1835. static const struct seccomp_log_name seccomp_log_names[] = {
  1836. { SECCOMP_LOG_KILL_PROCESS, SECCOMP_RET_KILL_PROCESS_NAME },
  1837. { SECCOMP_LOG_KILL_THREAD, SECCOMP_RET_KILL_THREAD_NAME },
  1838. { SECCOMP_LOG_TRAP, SECCOMP_RET_TRAP_NAME },
  1839. { SECCOMP_LOG_ERRNO, SECCOMP_RET_ERRNO_NAME },
  1840. { SECCOMP_LOG_USER_NOTIF, SECCOMP_RET_USER_NOTIF_NAME },
  1841. { SECCOMP_LOG_TRACE, SECCOMP_RET_TRACE_NAME },
  1842. { SECCOMP_LOG_LOG, SECCOMP_RET_LOG_NAME },
  1843. { SECCOMP_LOG_ALLOW, SECCOMP_RET_ALLOW_NAME },
  1844. { }
  1845. };
  1846. static bool seccomp_names_from_actions_logged(char *names, size_t size,
  1847. u32 actions_logged,
  1848. const char *sep)
  1849. {
  1850. const struct seccomp_log_name *cur;
  1851. bool append_sep = false;
  1852. for (cur = seccomp_log_names; cur->name && size; cur++) {
  1853. ssize_t ret;
  1854. if (!(actions_logged & cur->log))
  1855. continue;
  1856. if (append_sep) {
  1857. ret = strscpy(names, sep, size);
  1858. if (ret < 0)
  1859. return false;
  1860. names += ret;
  1861. size -= ret;
  1862. } else
  1863. append_sep = true;
  1864. ret = strscpy(names, cur->name, size);
  1865. if (ret < 0)
  1866. return false;
  1867. names += ret;
  1868. size -= ret;
  1869. }
  1870. return true;
  1871. }
  1872. static bool seccomp_action_logged_from_name(u32 *action_logged,
  1873. const char *name)
  1874. {
  1875. const struct seccomp_log_name *cur;
  1876. for (cur = seccomp_log_names; cur->name; cur++) {
  1877. if (!strcmp(cur->name, name)) {
  1878. *action_logged = cur->log;
  1879. return true;
  1880. }
  1881. }
  1882. return false;
  1883. }
  1884. static bool seccomp_actions_logged_from_names(u32 *actions_logged, char *names)
  1885. {
  1886. char *name;
  1887. *actions_logged = 0;
  1888. while ((name = strsep(&names, " ")) && *name) {
  1889. u32 action_logged = 0;
  1890. if (!seccomp_action_logged_from_name(&action_logged, name))
  1891. return false;
  1892. *actions_logged |= action_logged;
  1893. }
  1894. return true;
  1895. }
  1896. static int read_actions_logged(struct ctl_table *ro_table, void *buffer,
  1897. size_t *lenp, loff_t *ppos)
  1898. {
  1899. char names[sizeof(seccomp_actions_avail)];
  1900. struct ctl_table table;
  1901. memset(names, 0, sizeof(names));
  1902. if (!seccomp_names_from_actions_logged(names, sizeof(names),
  1903. seccomp_actions_logged, " "))
  1904. return -EINVAL;
  1905. table = *ro_table;
  1906. table.data = names;
  1907. table.maxlen = sizeof(names);
  1908. return proc_dostring(&table, 0, buffer, lenp, ppos);
  1909. }
  1910. static int write_actions_logged(struct ctl_table *ro_table, void *buffer,
  1911. size_t *lenp, loff_t *ppos, u32 *actions_logged)
  1912. {
  1913. char names[sizeof(seccomp_actions_avail)];
  1914. struct ctl_table table;
  1915. int ret;
  1916. if (!capable(CAP_SYS_ADMIN))
  1917. return -EPERM;
  1918. memset(names, 0, sizeof(names));
  1919. table = *ro_table;
  1920. table.data = names;
  1921. table.maxlen = sizeof(names);
  1922. ret = proc_dostring(&table, 1, buffer, lenp, ppos);
  1923. if (ret)
  1924. return ret;
  1925. if (!seccomp_actions_logged_from_names(actions_logged, table.data))
  1926. return -EINVAL;
  1927. if (*actions_logged & SECCOMP_LOG_ALLOW)
  1928. return -EINVAL;
  1929. seccomp_actions_logged = *actions_logged;
  1930. return 0;
  1931. }
  1932. static void audit_actions_logged(u32 actions_logged, u32 old_actions_logged,
  1933. int ret)
  1934. {
  1935. char names[sizeof(seccomp_actions_avail)];
  1936. char old_names[sizeof(seccomp_actions_avail)];
  1937. const char *new = names;
  1938. const char *old = old_names;
  1939. if (!audit_enabled)
  1940. return;
  1941. memset(names, 0, sizeof(names));
  1942. memset(old_names, 0, sizeof(old_names));
  1943. if (ret)
  1944. new = "?";
  1945. else if (!actions_logged)
  1946. new = "(none)";
  1947. else if (!seccomp_names_from_actions_logged(names, sizeof(names),
  1948. actions_logged, ","))
  1949. new = "?";
  1950. if (!old_actions_logged)
  1951. old = "(none)";
  1952. else if (!seccomp_names_from_actions_logged(old_names,
  1953. sizeof(old_names),
  1954. old_actions_logged, ","))
  1955. old = "?";
  1956. return audit_seccomp_actions_logged(new, old, !ret);
  1957. }
  1958. static int seccomp_actions_logged_handler(struct ctl_table *ro_table, int write,
  1959. void *buffer, size_t *lenp,
  1960. loff_t *ppos)
  1961. {
  1962. int ret;
  1963. if (write) {
  1964. u32 actions_logged = 0;
  1965. u32 old_actions_logged = seccomp_actions_logged;
  1966. ret = write_actions_logged(ro_table, buffer, lenp, ppos,
  1967. &actions_logged);
  1968. audit_actions_logged(actions_logged, old_actions_logged, ret);
  1969. } else
  1970. ret = read_actions_logged(ro_table, buffer, lenp, ppos);
  1971. return ret;
  1972. }
  1973. static struct ctl_path seccomp_sysctl_path[] = {
  1974. { .procname = "kernel", },
  1975. { .procname = "seccomp", },
  1976. { }
  1977. };
  1978. static struct ctl_table seccomp_sysctl_table[] = {
  1979. {
  1980. .procname = "actions_avail",
  1981. .data = (void *) &seccomp_actions_avail,
  1982. .maxlen = sizeof(seccomp_actions_avail),
  1983. .mode = 0444,
  1984. .proc_handler = proc_dostring,
  1985. },
  1986. {
  1987. .procname = "actions_logged",
  1988. .mode = 0644,
  1989. .proc_handler = seccomp_actions_logged_handler,
  1990. },
  1991. { }
  1992. };
  1993. static int __init seccomp_sysctl_init(void)
  1994. {
  1995. struct ctl_table_header *hdr;
  1996. hdr = register_sysctl_paths(seccomp_sysctl_path, seccomp_sysctl_table);
  1997. if (!hdr)
  1998. pr_warn("sysctl registration failed\n");
  1999. else
  2000. kmemleak_not_leak(hdr);
  2001. return 0;
  2002. }
  2003. device_initcall(seccomp_sysctl_init)
  2004. #endif /* CONFIG_SYSCTL */