1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * linux/kernel/seccomp.c 4 * 5 * Copyright 2004-2005 Andrea Arcangeli <andrea@cpushare.com> 6 * 7 * Copyright (C) 2012 Google, Inc. 8 * Will Drewry <wad@chromium.org> 9 * 10 * This defines a simple but solid secure-computing facility. 11 * 12 * Mode 1 uses a fixed list of allowed system calls. 13 * Mode 2 allows user-defined system call filters in the form 14 * of Berkeley Packet Filters/Linux Socket Filters. 15 */ 16 #define pr_fmt(fmt) "seccomp: " fmt 17 18 #include <linux/refcount.h> 19 #include <linux/audit.h> 20 #include <linux/compat.h> 21 #include <linux/coredump.h> 22 #include <linux/kmemleak.h> 23 #include <linux/nospec.h> 24 #include <linux/prctl.h> 25 #include <linux/sched.h> 26 #include <linux/sched/task_stack.h> 27 #include <linux/seccomp.h> 28 #include <linux/slab.h> 29 #include <linux/syscalls.h> 30 #include <linux/sysctl.h> 31 32 /* Not exposed in headers: strictly internal use only. */ 33 #define SECCOMP_MODE_DEAD (SECCOMP_MODE_FILTER + 1) 34 35 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER 36 #include <asm/syscall.h> 37 #endif 38 39 #ifdef CONFIG_SECCOMP_FILTER 40 #include <linux/file.h> 41 #include <linux/filter.h> 42 #include <linux/pid.h> 43 #include <linux/ptrace.h> 44 #include <linux/capability.h> 45 #include <linux/tracehook.h> 46 #include <linux/uaccess.h> 47 #include <linux/anon_inodes.h> 48 #include <linux/lockdep.h> 49 50 /* 51 * When SECCOMP_IOCTL_NOTIF_ID_VALID was first introduced, it had the 52 * wrong direction flag in the ioctl number. This is the broken one, 53 * which the kernel needs to keep supporting until all userspaces stop 54 * using the wrong command number. 55 */ 56 #define SECCOMP_IOCTL_NOTIF_ID_VALID_WRONG_DIR SECCOMP_IOR(2, __u64) 57 58 enum notify_state { 59 SECCOMP_NOTIFY_INIT, 60 SECCOMP_NOTIFY_SENT, 61 SECCOMP_NOTIFY_REPLIED, 62 }; 63 64 struct seccomp_knotif { 65 /* The struct pid of the task whose filter triggered the notification */ 66 struct task_struct *task; 67 68 /* The "cookie" for this request; this is unique for this filter. */ 69 u64 id; 70 71 /* 72 * The seccomp data. This pointer is valid the entire time this 73 * notification is active, since it comes from __seccomp_filter which 74 * eclipses the entire lifecycle here. 75 */ 76 const struct seccomp_data *data; 77 78 /* 79 * Notification states. When SECCOMP_RET_USER_NOTIF is returned, a 80 * struct seccomp_knotif is created and starts out in INIT. Once the 81 * handler reads the notification off of an FD, it transitions to SENT. 82 * If a signal is received the state transitions back to INIT and 83 * another message is sent. When the userspace handler replies, state 84 * transitions to REPLIED. 85 */ 86 enum notify_state state; 87 88 /* The return values, only valid when in SECCOMP_NOTIFY_REPLIED */ 89 int error; 90 long val; 91 u32 flags; 92 93 /* 94 * Signals when this has changed states, such as the listener 95 * dying, a new seccomp addfd message, or changing to REPLIED 96 */ 97 struct completion ready; 98 99 struct list_head list; 100 101 /* outstanding addfd requests */ 102 struct list_head addfd; 103 }; 104 105 /** 106 * struct seccomp_kaddfd - container for seccomp_addfd ioctl messages 107 * 108 * @file: A reference to the file to install in the other task 109 * @fd: The fd number to install it at. If the fd number is -1, it means the 110 * installing process should allocate the fd as normal. 111 * @flags: The flags for the new file descriptor. At the moment, only O_CLOEXEC 112 * is allowed. 113 * @ioctl_flags: The flags used for the seccomp_addfd ioctl. 114 * @ret: The return value of the installing process. It is set to the fd num 115 * upon success (>= 0). 116 * @completion: Indicates that the installing process has completed fd 117 * installation, or gone away (either due to successful 118 * reply, or signal) 119 * 120 */ 121 struct seccomp_kaddfd { 122 struct file *file; 123 int fd; 124 unsigned int flags; 125 __u32 ioctl_flags; 126 127 union { 128 bool setfd; 129 /* To only be set on reply */ 130 int ret; 131 }; 132 struct completion completion; 133 struct list_head list; 134 }; 135 136 /** 137 * struct notification - container for seccomp userspace notifications. Since 138 * most seccomp filters will not have notification listeners attached and this 139 * structure is fairly large, we store the notification-specific stuff in a 140 * separate structure. 141 * 142 * @request: A semaphore that users of this notification can wait on for 143 * changes. Actual reads and writes are still controlled with 144 * filter->notify_lock. 145 * @next_id: The id of the next request. 146 * @notifications: A list of struct seccomp_knotif elements. 147 */ 148 struct notification { 149 struct semaphore request; 150 u64 next_id; 151 struct list_head notifications; 152 }; 153 154 #ifdef SECCOMP_ARCH_NATIVE 155 /** 156 * struct action_cache - per-filter cache of seccomp actions per 157 * arch/syscall pair 158 * 159 * @allow_native: A bitmap where each bit represents whether the 160 * filter will always allow the syscall, for the 161 * native architecture. 162 * @allow_compat: A bitmap where each bit represents whether the 163 * filter will always allow the syscall, for the 164 * compat architecture. 165 */ 166 struct action_cache { 167 DECLARE_BITMAP(allow_native, SECCOMP_ARCH_NATIVE_NR); 168 #ifdef SECCOMP_ARCH_COMPAT 169 DECLARE_BITMAP(allow_compat, SECCOMP_ARCH_COMPAT_NR); 170 #endif 171 }; 172 #else 173 struct action_cache { }; 174 175 static inline bool seccomp_cache_check_allow(const struct seccomp_filter *sfilter, 176 const struct seccomp_data *sd) 177 { 178 return false; 179 } 180 181 static inline void seccomp_cache_prepare(struct seccomp_filter *sfilter) 182 { 183 } 184 #endif /* SECCOMP_ARCH_NATIVE */ 185 186 /** 187 * struct seccomp_filter - container for seccomp BPF programs 188 * 189 * @refs: Reference count to manage the object lifetime. 190 * A filter's reference count is incremented for each directly 191 * attached task, once for the dependent filter, and if 192 * requested for the user notifier. When @refs reaches zero, 193 * the filter can be freed. 194 * @users: A filter's @users count is incremented for each directly 195 * attached task (filter installation, fork(), thread_sync), 196 * and once for the dependent filter (tracked in filter->prev). 197 * When it reaches zero it indicates that no direct or indirect 198 * users of that filter exist. No new tasks can get associated with 199 * this filter after reaching 0. The @users count is always smaller 200 * or equal to @refs. Hence, reaching 0 for @users does not mean 201 * the filter can be freed. 202 * @cache: cache of arch/syscall mappings to actions 203 * @log: true if all actions except for SECCOMP_RET_ALLOW should be logged 204 * @prev: points to a previously installed, or inherited, filter 205 * @prog: the BPF program to evaluate 206 * @notif: the struct that holds all notification related information 207 * @notify_lock: A lock for all notification-related accesses. 208 * @wqh: A wait queue for poll if a notifier is in use. 209 * 210 * seccomp_filter objects are organized in a tree linked via the @prev 211 * pointer. For any task, it appears to be a singly-linked list starting 212 * with current->seccomp.filter, the most recently attached or inherited filter. 213 * However, multiple filters may share a @prev node, by way of fork(), which 214 * results in a unidirectional tree existing in memory. This is similar to 215 * how namespaces work. 216 * 217 * seccomp_filter objects should never be modified after being attached 218 * to a task_struct (other than @refs). 219 */ 220 struct seccomp_filter { 221 refcount_t refs; 222 refcount_t users; 223 bool log; 224 struct action_cache cache; 225 struct seccomp_filter *prev; 226 struct bpf_prog *prog; 227 struct notification *notif; 228 struct mutex notify_lock; 229 wait_queue_head_t wqh; 230 }; 231 232 /* Limit any path through the tree to 256KB worth of instructions. */ 233 #define MAX_INSNS_PER_PATH ((1 << 18) / sizeof(struct sock_filter)) 234 235 /* 236 * Endianness is explicitly ignored and left for BPF program authors to manage 237 * as per the specific architecture. 238 */ 239 static void populate_seccomp_data(struct seccomp_data *sd) 240 { 241 /* 242 * Instead of using current_pt_reg(), we're already doing the work 243 * to safely fetch "current", so just use "task" everywhere below. 244 */ 245 struct task_struct *task = current; 246 struct pt_regs *regs = task_pt_regs(task); 247 unsigned long args[6]; 248 249 sd->nr = syscall_get_nr(task, regs); 250 sd->arch = syscall_get_arch(task); 251 syscall_get_arguments(task, regs, args); 252 sd->args[0] = args[0]; 253 sd->args[1] = args[1]; 254 sd->args[2] = args[2]; 255 sd->args[3] = args[3]; 256 sd->args[4] = args[4]; 257 sd->args[5] = args[5]; 258 sd->instruction_pointer = KSTK_EIP(task); 259 } 260 261 /** 262 * seccomp_check_filter - verify seccomp filter code 263 * @filter: filter to verify 264 * @flen: length of filter 265 * 266 * Takes a previously checked filter (by bpf_check_classic) and 267 * redirects all filter code that loads struct sk_buff data 268 * and related data through seccomp_bpf_load. It also 269 * enforces length and alignment checking of those loads. 270 * 271 * Returns 0 if the rule set is legal or -EINVAL if not. 272 */ 273 static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen) 274 { 275 int pc; 276 for (pc = 0; pc < flen; pc++) { 277 struct sock_filter *ftest = &filter[pc]; 278 u16 code = ftest->code; 279 u32 k = ftest->k; 280 281 switch (code) { 282 case BPF_LD | BPF_W | BPF_ABS: 283 ftest->code = BPF_LDX | BPF_W | BPF_ABS; 284 /* 32-bit aligned and not out of bounds. */ 285 if (k >= sizeof(struct seccomp_data) || k & 3) 286 return -EINVAL; 287 continue; 288 case BPF_LD | BPF_W | BPF_LEN: 289 ftest->code = BPF_LD | BPF_IMM; 290 ftest->k = sizeof(struct seccomp_data); 291 continue; 292 case BPF_LDX | BPF_W | BPF_LEN: 293 ftest->code = BPF_LDX | BPF_IMM; 294 ftest->k = sizeof(struct seccomp_data); 295 continue; 296 /* Explicitly include allowed calls. */ 297 case BPF_RET | BPF_K: 298 case BPF_RET | BPF_A: 299 case BPF_ALU | BPF_ADD | BPF_K: 300 case BPF_ALU | BPF_ADD | BPF_X: 301 case BPF_ALU | BPF_SUB | BPF_K: 302 case BPF_ALU | BPF_SUB | BPF_X: 303 case BPF_ALU | BPF_MUL | BPF_K: 304 case BPF_ALU | BPF_MUL | BPF_X: 305 case BPF_ALU | BPF_DIV | BPF_K: 306 case BPF_ALU | BPF_DIV | BPF_X: 307 case BPF_ALU | BPF_AND | BPF_K: 308 case BPF_ALU | BPF_AND | BPF_X: 309 case BPF_ALU | BPF_OR | BPF_K: 310 case BPF_ALU | BPF_OR | BPF_X: 311 case BPF_ALU | BPF_XOR | BPF_K: 312 case BPF_ALU | BPF_XOR | BPF_X: 313 case BPF_ALU | BPF_LSH | BPF_K: 314 case BPF_ALU | BPF_LSH | BPF_X: 315 case BPF_ALU | BPF_RSH | BPF_K: 316 case BPF_ALU | BPF_RSH | BPF_X: 317 case BPF_ALU | BPF_NEG: 318 case BPF_LD | BPF_IMM: 319 case BPF_LDX | BPF_IMM: 320 case BPF_MISC | BPF_TAX: 321 case BPF_MISC | BPF_TXA: 322 case BPF_LD | BPF_MEM: 323 case BPF_LDX | BPF_MEM: 324 case BPF_ST: 325 case BPF_STX: 326 case BPF_JMP | BPF_JA: 327 case BPF_JMP | BPF_JEQ | BPF_K: 328 case BPF_JMP | BPF_JEQ | BPF_X: 329 case BPF_JMP | BPF_JGE | BPF_K: 330 case BPF_JMP | BPF_JGE | BPF_X: 331 case BPF_JMP | BPF_JGT | BPF_K: 332 case BPF_JMP | BPF_JGT | BPF_X: 333 case BPF_JMP | BPF_JSET | BPF_K: 334 case BPF_JMP | BPF_JSET | BPF_X: 335 continue; 336 default: 337 return -EINVAL; 338 } 339 } 340 return 0; 341 } 342 343 #ifdef SECCOMP_ARCH_NATIVE 344 static inline bool seccomp_cache_check_allow_bitmap(const void *bitmap, 345 size_t bitmap_size, 346 int syscall_nr) 347 { 348 if (unlikely(syscall_nr < 0 || syscall_nr >= bitmap_size)) 349 return false; 350 syscall_nr = array_index_nospec(syscall_nr, bitmap_size); 351 352 return test_bit(syscall_nr, bitmap); 353 } 354 355 /** 356 * seccomp_cache_check_allow - lookup seccomp cache 357 * @sfilter: The seccomp filter 358 * @sd: The seccomp data to lookup the cache with 359 * 360 * Returns true if the seccomp_data is cached and allowed. 361 */ 362 static inline bool seccomp_cache_check_allow(const struct seccomp_filter *sfilter, 363 const struct seccomp_data *sd) 364 { 365 int syscall_nr = sd->nr; 366 const struct action_cache *cache = &sfilter->cache; 367 368 #ifndef SECCOMP_ARCH_COMPAT 369 /* A native-only architecture doesn't need to check sd->arch. */ 370 return seccomp_cache_check_allow_bitmap(cache->allow_native, 371 SECCOMP_ARCH_NATIVE_NR, 372 syscall_nr); 373 #else 374 if (likely(sd->arch == SECCOMP_ARCH_NATIVE)) 375 return seccomp_cache_check_allow_bitmap(cache->allow_native, 376 SECCOMP_ARCH_NATIVE_NR, 377 syscall_nr); 378 if (likely(sd->arch == SECCOMP_ARCH_COMPAT)) 379 return seccomp_cache_check_allow_bitmap(cache->allow_compat, 380 SECCOMP_ARCH_COMPAT_NR, 381 syscall_nr); 382 #endif /* SECCOMP_ARCH_COMPAT */ 383 384 WARN_ON_ONCE(true); 385 return false; 386 } 387 #endif /* SECCOMP_ARCH_NATIVE */ 388 389 /** 390 * seccomp_run_filters - evaluates all seccomp filters against @sd 391 * @sd: optional seccomp data to be passed to filters 392 * @match: stores struct seccomp_filter that resulted in the return value, 393 * unless filter returned SECCOMP_RET_ALLOW, in which case it will 394 * be unchanged. 395 * 396 * Returns valid seccomp BPF response codes. 397 */ 398 #define ACTION_ONLY(ret) ((s32)((ret) & (SECCOMP_RET_ACTION_FULL))) 399 static u32 seccomp_run_filters(const struct seccomp_data *sd, 400 struct seccomp_filter **match) 401 { 402 u32 ret = SECCOMP_RET_ALLOW; 403 /* Make sure cross-thread synced filter points somewhere sane. */ 404 struct seccomp_filter *f = 405 READ_ONCE(current->seccomp.filter); 406 407 /* Ensure unexpected behavior doesn't result in failing open. */ 408 if (WARN_ON(f == NULL)) 409 return SECCOMP_RET_KILL_PROCESS; 410 411 if (seccomp_cache_check_allow(f, sd)) 412 return SECCOMP_RET_ALLOW; 413 414 /* 415 * All filters in the list are evaluated and the lowest BPF return 416 * value always takes priority (ignoring the DATA). 417 */ 418 for (; f; f = f->prev) { 419 u32 cur_ret = bpf_prog_run_pin_on_cpu(f->prog, sd); 420 421 if (ACTION_ONLY(cur_ret) < ACTION_ONLY(ret)) { 422 ret = cur_ret; 423 *match = f; 424 } 425 } 426 return ret; 427 } 428 #endif /* CONFIG_SECCOMP_FILTER */ 429 430 static inline bool seccomp_may_assign_mode(unsigned long seccomp_mode) 431 { 432 assert_spin_locked(¤t->sighand->siglock); 433 434 if (current->seccomp.mode && current->seccomp.mode != seccomp_mode) 435 return false; 436 437 return true; 438 } 439 440 void __weak arch_seccomp_spec_mitigate(struct task_struct *task) { } 441 442 static inline void seccomp_assign_mode(struct task_struct *task, 443 unsigned long seccomp_mode, 444 unsigned long flags) 445 { 446 assert_spin_locked(&task->sighand->siglock); 447 448 task->seccomp.mode = seccomp_mode; 449 /* 450 * Make sure SYSCALL_WORK_SECCOMP cannot be set before the mode (and 451 * filter) is set. 452 */ 453 smp_mb__before_atomic(); 454 /* Assume default seccomp processes want spec flaw mitigation. */ 455 if ((flags & SECCOMP_FILTER_FLAG_SPEC_ALLOW) == 0) 456 arch_seccomp_spec_mitigate(task); 457 set_task_syscall_work(task, SECCOMP); 458 } 459 460 #ifdef CONFIG_SECCOMP_FILTER 461 /* Returns 1 if the parent is an ancestor of the child. */ 462 static int is_ancestor(struct seccomp_filter *parent, 463 struct seccomp_filter *child) 464 { 465 /* NULL is the root ancestor. */ 466 if (parent == NULL) 467 return 1; 468 for (; child; child = child->prev) 469 if (child == parent) 470 return 1; 471 return 0; 472 } 473 474 /** 475 * seccomp_can_sync_threads: checks if all threads can be synchronized 476 * 477 * Expects sighand and cred_guard_mutex locks to be held. 478 * 479 * Returns 0 on success, -ve on error, or the pid of a thread which was 480 * either not in the correct seccomp mode or did not have an ancestral 481 * seccomp filter. 482 */ 483 static inline pid_t seccomp_can_sync_threads(void) 484 { 485 struct task_struct *thread, *caller; 486 487 BUG_ON(!mutex_is_locked(¤t->signal->cred_guard_mutex)); 488 assert_spin_locked(¤t->sighand->siglock); 489 490 /* Validate all threads being eligible for synchronization. */ 491 caller = current; 492 for_each_thread(caller, thread) { 493 pid_t failed; 494 495 /* Skip current, since it is initiating the sync. */ 496 if (thread == caller) 497 continue; 498 499 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED || 500 (thread->seccomp.mode == SECCOMP_MODE_FILTER && 501 is_ancestor(thread->seccomp.filter, 502 caller->seccomp.filter))) 503 continue; 504 505 /* Return the first thread that cannot be synchronized. */ 506 failed = task_pid_vnr(thread); 507 /* If the pid cannot be resolved, then return -ESRCH */ 508 if (WARN_ON(failed == 0)) 509 failed = -ESRCH; 510 return failed; 511 } 512 513 return 0; 514 } 515 516 static inline void seccomp_filter_free(struct seccomp_filter *filter) 517 { 518 if (filter) { 519 bpf_prog_destroy(filter->prog); 520 kfree(filter); 521 } 522 } 523 524 static void __seccomp_filter_orphan(struct seccomp_filter *orig) 525 { 526 while (orig && refcount_dec_and_test(&orig->users)) { 527 if (waitqueue_active(&orig->wqh)) 528 wake_up_poll(&orig->wqh, EPOLLHUP); 529 orig = orig->prev; 530 } 531 } 532 533 static void __put_seccomp_filter(struct seccomp_filter *orig) 534 { 535 /* Clean up single-reference branches iteratively. */ 536 while (orig && refcount_dec_and_test(&orig->refs)) { 537 struct seccomp_filter *freeme = orig; 538 orig = orig->prev; 539 seccomp_filter_free(freeme); 540 } 541 } 542 543 static void __seccomp_filter_release(struct seccomp_filter *orig) 544 { 545 /* Notify about any unused filters in the task's former filter tree. */ 546 __seccomp_filter_orphan(orig); 547 /* Finally drop all references to the task's former tree. */ 548 __put_seccomp_filter(orig); 549 } 550 551 /** 552 * seccomp_filter_release - Detach the task from its filter tree, 553 * drop its reference count, and notify 554 * about unused filters 555 * 556 * This function should only be called when the task is exiting as 557 * it detaches it from its filter tree. As such, READ_ONCE() and 558 * barriers are not needed here, as would normally be needed. 559 */ 560 void seccomp_filter_release(struct task_struct *tsk) 561 { 562 struct seccomp_filter *orig = tsk->seccomp.filter; 563 564 /* We are effectively holding the siglock by not having any sighand. */ 565 WARN_ON(tsk->sighand != NULL); 566 567 /* Detach task from its filter tree. */ 568 tsk->seccomp.filter = NULL; 569 __seccomp_filter_release(orig); 570 } 571 572 /** 573 * seccomp_sync_threads: sets all threads to use current's filter 574 * 575 * Expects sighand and cred_guard_mutex locks to be held, and for 576 * seccomp_can_sync_threads() to have returned success already 577 * without dropping the locks. 578 * 579 */ 580 static inline void seccomp_sync_threads(unsigned long flags) 581 { 582 struct task_struct *thread, *caller; 583 584 BUG_ON(!mutex_is_locked(¤t->signal->cred_guard_mutex)); 585 assert_spin_locked(¤t->sighand->siglock); 586 587 /* Synchronize all threads. */ 588 caller = current; 589 for_each_thread(caller, thread) { 590 /* Skip current, since it needs no changes. */ 591 if (thread == caller) 592 continue; 593 594 /* Get a task reference for the new leaf node. */ 595 get_seccomp_filter(caller); 596 597 /* 598 * Drop the task reference to the shared ancestor since 599 * current's path will hold a reference. (This also 600 * allows a put before the assignment.) 601 */ 602 __seccomp_filter_release(thread->seccomp.filter); 603 604 /* Make our new filter tree visible. */ 605 smp_store_release(&thread->seccomp.filter, 606 caller->seccomp.filter); 607 atomic_set(&thread->seccomp.filter_count, 608 atomic_read(&caller->seccomp.filter_count)); 609 610 /* 611 * Don't let an unprivileged task work around 612 * the no_new_privs restriction by creating 613 * a thread that sets it up, enters seccomp, 614 * then dies. 615 */ 616 if (task_no_new_privs(caller)) 617 task_set_no_new_privs(thread); 618 619 /* 620 * Opt the other thread into seccomp if needed. 621 * As threads are considered to be trust-realm 622 * equivalent (see ptrace_may_access), it is safe to 623 * allow one thread to transition the other. 624 */ 625 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED) 626 seccomp_assign_mode(thread, SECCOMP_MODE_FILTER, 627 flags); 628 } 629 } 630 631 /** 632 * seccomp_prepare_filter: Prepares a seccomp filter for use. 633 * @fprog: BPF program to install 634 * 635 * Returns filter on success or an ERR_PTR on failure. 636 */ 637 static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog) 638 { 639 struct seccomp_filter *sfilter; 640 int ret; 641 const bool save_orig = 642 #if defined(CONFIG_CHECKPOINT_RESTORE) || defined(SECCOMP_ARCH_NATIVE) 643 true; 644 #else 645 false; 646 #endif 647 648 if (fprog->len == 0 || fprog->len > BPF_MAXINSNS) 649 return ERR_PTR(-EINVAL); 650 651 BUG_ON(INT_MAX / fprog->len < sizeof(struct sock_filter)); 652 653 /* 654 * Installing a seccomp filter requires that the task has 655 * CAP_SYS_ADMIN in its namespace or be running with no_new_privs. 656 * This avoids scenarios where unprivileged tasks can affect the 657 * behavior of privileged children. 658 */ 659 if (!task_no_new_privs(current) && 660 !ns_capable_noaudit(current_user_ns(), CAP_SYS_ADMIN)) 661 return ERR_PTR(-EACCES); 662 663 /* Allocate a new seccomp_filter */ 664 sfilter = kzalloc(sizeof(*sfilter), GFP_KERNEL | __GFP_NOWARN); 665 if (!sfilter) 666 return ERR_PTR(-ENOMEM); 667 668 mutex_init(&sfilter->notify_lock); 669 ret = bpf_prog_create_from_user(&sfilter->prog, fprog, 670 seccomp_check_filter, save_orig); 671 if (ret < 0) { 672 kfree(sfilter); 673 return ERR_PTR(ret); 674 } 675 676 refcount_set(&sfilter->refs, 1); 677 refcount_set(&sfilter->users, 1); 678 init_waitqueue_head(&sfilter->wqh); 679 680 return sfilter; 681 } 682 683 /** 684 * seccomp_prepare_user_filter - prepares a user-supplied sock_fprog 685 * @user_filter: pointer to the user data containing a sock_fprog. 686 * 687 * Returns 0 on success and non-zero otherwise. 688 */ 689 static struct seccomp_filter * 690 seccomp_prepare_user_filter(const char __user *user_filter) 691 { 692 struct sock_fprog fprog; 693 struct seccomp_filter *filter = ERR_PTR(-EFAULT); 694 695 #ifdef CONFIG_COMPAT 696 if (in_compat_syscall()) { 697 struct compat_sock_fprog fprog32; 698 if (copy_from_user(&fprog32, user_filter, sizeof(fprog32))) 699 goto out; 700 fprog.len = fprog32.len; 701 fprog.filter = compat_ptr(fprog32.filter); 702 } else /* falls through to the if below. */ 703 #endif 704 if (copy_from_user(&fprog, user_filter, sizeof(fprog))) 705 goto out; 706 filter = seccomp_prepare_filter(&fprog); 707 out: 708 return filter; 709 } 710 711 #ifdef SECCOMP_ARCH_NATIVE 712 /** 713 * seccomp_is_const_allow - check if filter is constant allow with given data 714 * @fprog: The BPF programs 715 * @sd: The seccomp data to check against, only syscall number and arch 716 * number are considered constant. 717 */ 718 static bool seccomp_is_const_allow(struct sock_fprog_kern *fprog, 719 struct seccomp_data *sd) 720 { 721 unsigned int reg_value = 0; 722 unsigned int pc; 723 bool op_res; 724 725 if (WARN_ON_ONCE(!fprog)) 726 return false; 727 728 for (pc = 0; pc < fprog->len; pc++) { 729 struct sock_filter *insn = &fprog->filter[pc]; 730 u16 code = insn->code; 731 u32 k = insn->k; 732 733 switch (code) { 734 case BPF_LD | BPF_W | BPF_ABS: 735 switch (k) { 736 case offsetof(struct seccomp_data, nr): 737 reg_value = sd->nr; 738 break; 739 case offsetof(struct seccomp_data, arch): 740 reg_value = sd->arch; 741 break; 742 default: 743 /* can't optimize (non-constant value load) */ 744 return false; 745 } 746 break; 747 case BPF_RET | BPF_K: 748 /* reached return with constant values only, check allow */ 749 return k == SECCOMP_RET_ALLOW; 750 case BPF_JMP | BPF_JA: 751 pc += insn->k; 752 break; 753 case BPF_JMP | BPF_JEQ | BPF_K: 754 case BPF_JMP | BPF_JGE | BPF_K: 755 case BPF_JMP | BPF_JGT | BPF_K: 756 case BPF_JMP | BPF_JSET | BPF_K: 757 switch (BPF_OP(code)) { 758 case BPF_JEQ: 759 op_res = reg_value == k; 760 break; 761 case BPF_JGE: 762 op_res = reg_value >= k; 763 break; 764 case BPF_JGT: 765 op_res = reg_value > k; 766 break; 767 case BPF_JSET: 768 op_res = !!(reg_value & k); 769 break; 770 default: 771 /* can't optimize (unknown jump) */ 772 return false; 773 } 774 775 pc += op_res ? insn->jt : insn->jf; 776 break; 777 case BPF_ALU | BPF_AND | BPF_K: 778 reg_value &= k; 779 break; 780 default: 781 /* can't optimize (unknown insn) */ 782 return false; 783 } 784 } 785 786 /* ran off the end of the filter?! */ 787 WARN_ON(1); 788 return false; 789 } 790 791 static void seccomp_cache_prepare_bitmap(struct seccomp_filter *sfilter, 792 void *bitmap, const void *bitmap_prev, 793 size_t bitmap_size, int arch) 794 { 795 struct sock_fprog_kern *fprog = sfilter->prog->orig_prog; 796 struct seccomp_data sd; 797 int nr; 798 799 if (bitmap_prev) { 800 /* The new filter must be as restrictive as the last. */ 801 bitmap_copy(bitmap, bitmap_prev, bitmap_size); 802 } else { 803 /* Before any filters, all syscalls are always allowed. */ 804 bitmap_fill(bitmap, bitmap_size); 805 } 806 807 for (nr = 0; nr < bitmap_size; nr++) { 808 /* No bitmap change: not a cacheable action. */ 809 if (!test_bit(nr, bitmap)) 810 continue; 811 812 sd.nr = nr; 813 sd.arch = arch; 814 815 /* No bitmap change: continue to always allow. */ 816 if (seccomp_is_const_allow(fprog, &sd)) 817 continue; 818 819 /* 820 * Not a cacheable action: always run filters. 821 * atomic clear_bit() not needed, filter not visible yet. 822 */ 823 __clear_bit(nr, bitmap); 824 } 825 } 826 827 /** 828 * seccomp_cache_prepare - emulate the filter to find cacheable syscalls 829 * @sfilter: The seccomp filter 830 * 831 * Returns 0 if successful or -errno if error occurred. 832 */ 833 static void seccomp_cache_prepare(struct seccomp_filter *sfilter) 834 { 835 struct action_cache *cache = &sfilter->cache; 836 const struct action_cache *cache_prev = 837 sfilter->prev ? &sfilter->prev->cache : NULL; 838 839 seccomp_cache_prepare_bitmap(sfilter, cache->allow_native, 840 cache_prev ? cache_prev->allow_native : NULL, 841 SECCOMP_ARCH_NATIVE_NR, 842 SECCOMP_ARCH_NATIVE); 843 844 #ifdef SECCOMP_ARCH_COMPAT 845 seccomp_cache_prepare_bitmap(sfilter, cache->allow_compat, 846 cache_prev ? cache_prev->allow_compat : NULL, 847 SECCOMP_ARCH_COMPAT_NR, 848 SECCOMP_ARCH_COMPAT); 849 #endif /* SECCOMP_ARCH_COMPAT */ 850 } 851 #endif /* SECCOMP_ARCH_NATIVE */ 852 853 /** 854 * seccomp_attach_filter: validate and attach filter 855 * @flags: flags to change filter behavior 856 * @filter: seccomp filter to add to the current process 857 * 858 * Caller must be holding current->sighand->siglock lock. 859 * 860 * Returns 0 on success, -ve on error, or 861 * - in TSYNC mode: the pid of a thread which was either not in the correct 862 * seccomp mode or did not have an ancestral seccomp filter 863 * - in NEW_LISTENER mode: the fd of the new listener 864 */ 865 static long seccomp_attach_filter(unsigned int flags, 866 struct seccomp_filter *filter) 867 { 868 unsigned long total_insns; 869 struct seccomp_filter *walker; 870 871 assert_spin_locked(¤t->sighand->siglock); 872 873 /* Validate resulting filter length. */ 874 total_insns = filter->prog->len; 875 for (walker = current->seccomp.filter; walker; walker = walker->prev) 876 total_insns += walker->prog->len + 4; /* 4 instr penalty */ 877 if (total_insns > MAX_INSNS_PER_PATH) 878 return -ENOMEM; 879 880 /* If thread sync has been requested, check that it is possible. */ 881 if (flags & SECCOMP_FILTER_FLAG_TSYNC) { 882 int ret; 883 884 ret = seccomp_can_sync_threads(); 885 if (ret) { 886 if (flags & SECCOMP_FILTER_FLAG_TSYNC_ESRCH) 887 return -ESRCH; 888 else 889 return ret; 890 } 891 } 892 893 /* Set log flag, if present. */ 894 if (flags & SECCOMP_FILTER_FLAG_LOG) 895 filter->log = true; 896 897 /* 898 * If there is an existing filter, make it the prev and don't drop its 899 * task reference. 900 */ 901 filter->prev = current->seccomp.filter; 902 seccomp_cache_prepare(filter); 903 current->seccomp.filter = filter; 904 atomic_inc(¤t->seccomp.filter_count); 905 906 /* Now that the new filter is in place, synchronize to all threads. */ 907 if (flags & SECCOMP_FILTER_FLAG_TSYNC) 908 seccomp_sync_threads(flags); 909 910 return 0; 911 } 912 913 static void __get_seccomp_filter(struct seccomp_filter *filter) 914 { 915 refcount_inc(&filter->refs); 916 } 917 918 /* get_seccomp_filter - increments the reference count of the filter on @tsk */ 919 void get_seccomp_filter(struct task_struct *tsk) 920 { 921 struct seccomp_filter *orig = tsk->seccomp.filter; 922 if (!orig) 923 return; 924 __get_seccomp_filter(orig); 925 refcount_inc(&orig->users); 926 } 927 928 #endif /* CONFIG_SECCOMP_FILTER */ 929 930 /* For use with seccomp_actions_logged */ 931 #define SECCOMP_LOG_KILL_PROCESS (1 << 0) 932 #define SECCOMP_LOG_KILL_THREAD (1 << 1) 933 #define SECCOMP_LOG_TRAP (1 << 2) 934 #define SECCOMP_LOG_ERRNO (1 << 3) 935 #define SECCOMP_LOG_TRACE (1 << 4) 936 #define SECCOMP_LOG_LOG (1 << 5) 937 #define SECCOMP_LOG_ALLOW (1 << 6) 938 #define SECCOMP_LOG_USER_NOTIF (1 << 7) 939 940 static u32 seccomp_actions_logged = SECCOMP_LOG_KILL_PROCESS | 941 SECCOMP_LOG_KILL_THREAD | 942 SECCOMP_LOG_TRAP | 943 SECCOMP_LOG_ERRNO | 944 SECCOMP_LOG_USER_NOTIF | 945 SECCOMP_LOG_TRACE | 946 SECCOMP_LOG_LOG; 947 948 static inline void seccomp_log(unsigned long syscall, long signr, u32 action, 949 bool requested) 950 { 951 bool log = false; 952 953 switch (action) { 954 case SECCOMP_RET_ALLOW: 955 break; 956 case SECCOMP_RET_TRAP: 957 log = requested && seccomp_actions_logged & SECCOMP_LOG_TRAP; 958 break; 959 case SECCOMP_RET_ERRNO: 960 log = requested && seccomp_actions_logged & SECCOMP_LOG_ERRNO; 961 break; 962 case SECCOMP_RET_TRACE: 963 log = requested && seccomp_actions_logged & SECCOMP_LOG_TRACE; 964 break; 965 case SECCOMP_RET_USER_NOTIF: 966 log = requested && seccomp_actions_logged & SECCOMP_LOG_USER_NOTIF; 967 break; 968 case SECCOMP_RET_LOG: 969 log = seccomp_actions_logged & SECCOMP_LOG_LOG; 970 break; 971 case SECCOMP_RET_KILL_THREAD: 972 log = seccomp_actions_logged & SECCOMP_LOG_KILL_THREAD; 973 break; 974 case SECCOMP_RET_KILL_PROCESS: 975 default: 976 log = seccomp_actions_logged & SECCOMP_LOG_KILL_PROCESS; 977 } 978 979 /* 980 * Emit an audit message when the action is RET_KILL_*, RET_LOG, or the 981 * FILTER_FLAG_LOG bit was set. The admin has the ability to silence 982 * any action from being logged by removing the action name from the 983 * seccomp_actions_logged sysctl. 984 */ 985 if (!log) 986 return; 987 988 audit_seccomp(syscall, signr, action); 989 } 990 991 /* 992 * Secure computing mode 1 allows only read/write/exit/sigreturn. 993 * To be fully secure this must be combined with rlimit 994 * to limit the stack allocations too. 995 */ 996 static const int mode1_syscalls[] = { 997 __NR_seccomp_read, __NR_seccomp_write, __NR_seccomp_exit, __NR_seccomp_sigreturn, 998 -1, /* negative terminated */ 999 }; 1000 1001 static void __secure_computing_strict(int this_syscall) 1002 { 1003 const int *allowed_syscalls = mode1_syscalls; 1004 #ifdef CONFIG_COMPAT 1005 if (in_compat_syscall()) 1006 allowed_syscalls = get_compat_mode1_syscalls(); 1007 #endif 1008 do { 1009 if (*allowed_syscalls == this_syscall) 1010 return; 1011 } while (*++allowed_syscalls != -1); 1012 1013 #ifdef SECCOMP_DEBUG 1014 dump_stack(); 1015 #endif 1016 current->seccomp.mode = SECCOMP_MODE_DEAD; 1017 seccomp_log(this_syscall, SIGKILL, SECCOMP_RET_KILL_THREAD, true); 1018 do_exit(SIGKILL); 1019 } 1020 1021 #ifndef CONFIG_HAVE_ARCH_SECCOMP_FILTER 1022 void secure_computing_strict(int this_syscall) 1023 { 1024 int mode = current->seccomp.mode; 1025 1026 if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) && 1027 unlikely(current->ptrace & PT_SUSPEND_SECCOMP)) 1028 return; 1029 1030 if (mode == SECCOMP_MODE_DISABLED) 1031 return; 1032 else if (mode == SECCOMP_MODE_STRICT) 1033 __secure_computing_strict(this_syscall); 1034 else 1035 BUG(); 1036 } 1037 #else 1038 1039 #ifdef CONFIG_SECCOMP_FILTER 1040 static u64 seccomp_next_notify_id(struct seccomp_filter *filter) 1041 { 1042 /* 1043 * Note: overflow is ok here, the id just needs to be unique per 1044 * filter. 1045 */ 1046 lockdep_assert_held(&filter->notify_lock); 1047 return filter->notif->next_id++; 1048 } 1049 1050 static void seccomp_handle_addfd(struct seccomp_kaddfd *addfd, struct seccomp_knotif *n) 1051 { 1052 int fd; 1053 1054 /* 1055 * Remove the notification, and reset the list pointers, indicating 1056 * that it has been handled. 1057 */ 1058 list_del_init(&addfd->list); 1059 if (!addfd->setfd) 1060 fd = receive_fd(addfd->file, addfd->flags); 1061 else 1062 fd = receive_fd_replace(addfd->fd, addfd->file, addfd->flags); 1063 addfd->ret = fd; 1064 1065 if (addfd->ioctl_flags & SECCOMP_ADDFD_FLAG_SEND) { 1066 /* If we fail reset and return an error to the notifier */ 1067 if (fd < 0) { 1068 n->state = SECCOMP_NOTIFY_SENT; 1069 } else { 1070 /* Return the FD we just added */ 1071 n->flags = 0; 1072 n->error = 0; 1073 n->val = fd; 1074 } 1075 } 1076 1077 /* 1078 * Mark the notification as completed. From this point, addfd mem 1079 * might be invalidated and we can't safely read it anymore. 1080 */ 1081 complete(&addfd->completion); 1082 } 1083 1084 static int seccomp_do_user_notification(int this_syscall, 1085 struct seccomp_filter *match, 1086 const struct seccomp_data *sd) 1087 { 1088 int err; 1089 u32 flags = 0; 1090 long ret = 0; 1091 struct seccomp_knotif n = {}; 1092 struct seccomp_kaddfd *addfd, *tmp; 1093 1094 mutex_lock(&match->notify_lock); 1095 err = -ENOSYS; 1096 if (!match->notif) 1097 goto out; 1098 1099 n.task = current; 1100 n.state = SECCOMP_NOTIFY_INIT; 1101 n.data = sd; 1102 n.id = seccomp_next_notify_id(match); 1103 init_completion(&n.ready); 1104 list_add(&n.list, &match->notif->notifications); 1105 INIT_LIST_HEAD(&n.addfd); 1106 1107 up(&match->notif->request); 1108 wake_up_poll(&match->wqh, EPOLLIN | EPOLLRDNORM); 1109 1110 /* 1111 * This is where we wait for a reply from userspace. 1112 */ 1113 do { 1114 mutex_unlock(&match->notify_lock); 1115 err = wait_for_completion_interruptible(&n.ready); 1116 mutex_lock(&match->notify_lock); 1117 if (err != 0) 1118 goto interrupted; 1119 1120 addfd = list_first_entry_or_null(&n.addfd, 1121 struct seccomp_kaddfd, list); 1122 /* Check if we were woken up by a addfd message */ 1123 if (addfd) 1124 seccomp_handle_addfd(addfd, &n); 1125 1126 } while (n.state != SECCOMP_NOTIFY_REPLIED); 1127 1128 ret = n.val; 1129 err = n.error; 1130 flags = n.flags; 1131 1132 interrupted: 1133 /* If there were any pending addfd calls, clear them out */ 1134 list_for_each_entry_safe(addfd, tmp, &n.addfd, list) { 1135 /* The process went away before we got a chance to handle it */ 1136 addfd->ret = -ESRCH; 1137 list_del_init(&addfd->list); 1138 complete(&addfd->completion); 1139 } 1140 1141 /* 1142 * Note that it's possible the listener died in between the time when 1143 * we were notified of a response (or a signal) and when we were able to 1144 * re-acquire the lock, so only delete from the list if the 1145 * notification actually exists. 1146 * 1147 * Also note that this test is only valid because there's no way to 1148 * *reattach* to a notifier right now. If one is added, we'll need to 1149 * keep track of the notif itself and make sure they match here. 1150 */ 1151 if (match->notif) 1152 list_del(&n.list); 1153 out: 1154 mutex_unlock(&match->notify_lock); 1155 1156 /* Userspace requests to continue the syscall. */ 1157 if (flags & SECCOMP_USER_NOTIF_FLAG_CONTINUE) 1158 return 0; 1159 1160 syscall_set_return_value(current, current_pt_regs(), 1161 err, ret); 1162 return -1; 1163 } 1164 1165 static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd, 1166 const bool recheck_after_trace) 1167 { 1168 u32 filter_ret, action; 1169 struct seccomp_filter *match = NULL; 1170 int data; 1171 struct seccomp_data sd_local; 1172 1173 /* 1174 * Make sure that any changes to mode from another thread have 1175 * been seen after SYSCALL_WORK_SECCOMP was seen. 1176 */ 1177 smp_rmb(); 1178 1179 if (!sd) { 1180 populate_seccomp_data(&sd_local); 1181 sd = &sd_local; 1182 } 1183 1184 filter_ret = seccomp_run_filters(sd, &match); 1185 data = filter_ret & SECCOMP_RET_DATA; 1186 action = filter_ret & SECCOMP_RET_ACTION_FULL; 1187 1188 switch (action) { 1189 case SECCOMP_RET_ERRNO: 1190 /* Set low-order bits as an errno, capped at MAX_ERRNO. */ 1191 if (data > MAX_ERRNO) 1192 data = MAX_ERRNO; 1193 syscall_set_return_value(current, current_pt_regs(), 1194 -data, 0); 1195 goto skip; 1196 1197 case SECCOMP_RET_TRAP: 1198 /* Show the handler the original registers. */ 1199 syscall_rollback(current, current_pt_regs()); 1200 /* Let the filter pass back 16 bits of data. */ 1201 force_sig_seccomp(this_syscall, data, false); 1202 goto skip; 1203 1204 case SECCOMP_RET_TRACE: 1205 /* We've been put in this state by the ptracer already. */ 1206 if (recheck_after_trace) 1207 return 0; 1208 1209 /* ENOSYS these calls if there is no tracer attached. */ 1210 if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP)) { 1211 syscall_set_return_value(current, 1212 current_pt_regs(), 1213 -ENOSYS, 0); 1214 goto skip; 1215 } 1216 1217 /* Allow the BPF to provide the event message */ 1218 ptrace_event(PTRACE_EVENT_SECCOMP, data); 1219 /* 1220 * The delivery of a fatal signal during event 1221 * notification may silently skip tracer notification, 1222 * which could leave us with a potentially unmodified 1223 * syscall that the tracer would have liked to have 1224 * changed. Since the process is about to die, we just 1225 * force the syscall to be skipped and let the signal 1226 * kill the process and correctly handle any tracer exit 1227 * notifications. 1228 */ 1229 if (fatal_signal_pending(current)) 1230 goto skip; 1231 /* Check if the tracer forced the syscall to be skipped. */ 1232 this_syscall = syscall_get_nr(current, current_pt_regs()); 1233 if (this_syscall < 0) 1234 goto skip; 1235 1236 /* 1237 * Recheck the syscall, since it may have changed. This 1238 * intentionally uses a NULL struct seccomp_data to force 1239 * a reload of all registers. This does not goto skip since 1240 * a skip would have already been reported. 1241 */ 1242 if (__seccomp_filter(this_syscall, NULL, true)) 1243 return -1; 1244 1245 return 0; 1246 1247 case SECCOMP_RET_USER_NOTIF: 1248 if (seccomp_do_user_notification(this_syscall, match, sd)) 1249 goto skip; 1250 1251 return 0; 1252 1253 case SECCOMP_RET_LOG: 1254 seccomp_log(this_syscall, 0, action, true); 1255 return 0; 1256 1257 case SECCOMP_RET_ALLOW: 1258 /* 1259 * Note that the "match" filter will always be NULL for 1260 * this action since SECCOMP_RET_ALLOW is the starting 1261 * state in seccomp_run_filters(). 1262 */ 1263 return 0; 1264 1265 case SECCOMP_RET_KILL_THREAD: 1266 case SECCOMP_RET_KILL_PROCESS: 1267 default: 1268 current->seccomp.mode = SECCOMP_MODE_DEAD; 1269 seccomp_log(this_syscall, SIGSYS, action, true); 1270 /* Dump core only if this is the last remaining thread. */ 1271 if (action != SECCOMP_RET_KILL_THREAD || 1272 (atomic_read(¤t->signal->live) == 1)) { 1273 /* Show the original registers in the dump. */ 1274 syscall_rollback(current, current_pt_regs()); 1275 /* Trigger a coredump with SIGSYS */ 1276 force_sig_seccomp(this_syscall, data, true); 1277 } else { 1278 do_exit(SIGSYS); 1279 } 1280 return -1; /* skip the syscall go directly to signal handling */ 1281 } 1282 1283 unreachable(); 1284 1285 skip: 1286 seccomp_log(this_syscall, 0, action, match ? match->log : false); 1287 return -1; 1288 } 1289 #else 1290 static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd, 1291 const bool recheck_after_trace) 1292 { 1293 BUG(); 1294 1295 return -1; 1296 } 1297 #endif 1298 1299 int __secure_computing(const struct seccomp_data *sd) 1300 { 1301 int mode = current->seccomp.mode; 1302 int this_syscall; 1303 1304 if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) && 1305 unlikely(current->ptrace & PT_SUSPEND_SECCOMP)) 1306 return 0; 1307 1308 this_syscall = sd ? sd->nr : 1309 syscall_get_nr(current, current_pt_regs()); 1310 1311 switch (mode) { 1312 case SECCOMP_MODE_STRICT: 1313 __secure_computing_strict(this_syscall); /* may call do_exit */ 1314 return 0; 1315 case SECCOMP_MODE_FILTER: 1316 return __seccomp_filter(this_syscall, sd, false); 1317 /* Surviving SECCOMP_RET_KILL_* must be proactively impossible. */ 1318 case SECCOMP_MODE_DEAD: 1319 WARN_ON_ONCE(1); 1320 do_exit(SIGKILL); 1321 return -1; 1322 default: 1323 BUG(); 1324 } 1325 } 1326 #endif /* CONFIG_HAVE_ARCH_SECCOMP_FILTER */ 1327 1328 long prctl_get_seccomp(void) 1329 { 1330 return current->seccomp.mode; 1331 } 1332 1333 /** 1334 * seccomp_set_mode_strict: internal function for setting strict seccomp 1335 * 1336 * Once current->seccomp.mode is non-zero, it may not be changed. 1337 * 1338 * Returns 0 on success or -EINVAL on failure. 1339 */ 1340 static long seccomp_set_mode_strict(void) 1341 { 1342 const unsigned long seccomp_mode = SECCOMP_MODE_STRICT; 1343 long ret = -EINVAL; 1344 1345 spin_lock_irq(¤t->sighand->siglock); 1346 1347 if (!seccomp_may_assign_mode(seccomp_mode)) 1348 goto out; 1349 1350 #ifdef TIF_NOTSC 1351 disable_TSC(); 1352 #endif 1353 seccomp_assign_mode(current, seccomp_mode, 0); 1354 ret = 0; 1355 1356 out: 1357 spin_unlock_irq(¤t->sighand->siglock); 1358 1359 return ret; 1360 } 1361 1362 #ifdef CONFIG_SECCOMP_FILTER 1363 static void seccomp_notify_free(struct seccomp_filter *filter) 1364 { 1365 kfree(filter->notif); 1366 filter->notif = NULL; 1367 } 1368 1369 static void seccomp_notify_detach(struct seccomp_filter *filter) 1370 { 1371 struct seccomp_knotif *knotif; 1372 1373 if (!filter) 1374 return; 1375 1376 mutex_lock(&filter->notify_lock); 1377 1378 /* 1379 * If this file is being closed because e.g. the task who owned it 1380 * died, let's wake everyone up who was waiting on us. 1381 */ 1382 list_for_each_entry(knotif, &filter->notif->notifications, list) { 1383 if (knotif->state == SECCOMP_NOTIFY_REPLIED) 1384 continue; 1385 1386 knotif->state = SECCOMP_NOTIFY_REPLIED; 1387 knotif->error = -ENOSYS; 1388 knotif->val = 0; 1389 1390 /* 1391 * We do not need to wake up any pending addfd messages, as 1392 * the notifier will do that for us, as this just looks 1393 * like a standard reply. 1394 */ 1395 complete(&knotif->ready); 1396 } 1397 1398 seccomp_notify_free(filter); 1399 mutex_unlock(&filter->notify_lock); 1400 } 1401 1402 static int seccomp_notify_release(struct inode *inode, struct file *file) 1403 { 1404 struct seccomp_filter *filter = file->private_data; 1405 1406 seccomp_notify_detach(filter); 1407 __put_seccomp_filter(filter); 1408 return 0; 1409 } 1410 1411 /* must be called with notif_lock held */ 1412 static inline struct seccomp_knotif * 1413 find_notification(struct seccomp_filter *filter, u64 id) 1414 { 1415 struct seccomp_knotif *cur; 1416 1417 lockdep_assert_held(&filter->notify_lock); 1418 1419 list_for_each_entry(cur, &filter->notif->notifications, list) { 1420 if (cur->id == id) 1421 return cur; 1422 } 1423 1424 return NULL; 1425 } 1426 1427 1428 static long seccomp_notify_recv(struct seccomp_filter *filter, 1429 void __user *buf) 1430 { 1431 struct seccomp_knotif *knotif = NULL, *cur; 1432 struct seccomp_notif unotif; 1433 ssize_t ret; 1434 1435 /* Verify that we're not given garbage to keep struct extensible. */ 1436 ret = check_zeroed_user(buf, sizeof(unotif)); 1437 if (ret < 0) 1438 return ret; 1439 if (!ret) 1440 return -EINVAL; 1441 1442 memset(&unotif, 0, sizeof(unotif)); 1443 1444 ret = down_interruptible(&filter->notif->request); 1445 if (ret < 0) 1446 return ret; 1447 1448 mutex_lock(&filter->notify_lock); 1449 list_for_each_entry(cur, &filter->notif->notifications, list) { 1450 if (cur->state == SECCOMP_NOTIFY_INIT) { 1451 knotif = cur; 1452 break; 1453 } 1454 } 1455 1456 /* 1457 * If we didn't find a notification, it could be that the task was 1458 * interrupted by a fatal signal between the time we were woken and 1459 * when we were able to acquire the rw lock. 1460 */ 1461 if (!knotif) { 1462 ret = -ENOENT; 1463 goto out; 1464 } 1465 1466 unotif.id = knotif->id; 1467 unotif.pid = task_pid_vnr(knotif->task); 1468 unotif.data = *(knotif->data); 1469 1470 knotif->state = SECCOMP_NOTIFY_SENT; 1471 wake_up_poll(&filter->wqh, EPOLLOUT | EPOLLWRNORM); 1472 ret = 0; 1473 out: 1474 mutex_unlock(&filter->notify_lock); 1475 1476 if (ret == 0 && copy_to_user(buf, &unotif, sizeof(unotif))) { 1477 ret = -EFAULT; 1478 1479 /* 1480 * Userspace screwed up. To make sure that we keep this 1481 * notification alive, let's reset it back to INIT. It 1482 * may have died when we released the lock, so we need to make 1483 * sure it's still around. 1484 */ 1485 mutex_lock(&filter->notify_lock); 1486 knotif = find_notification(filter, unotif.id); 1487 if (knotif) { 1488 knotif->state = SECCOMP_NOTIFY_INIT; 1489 up(&filter->notif->request); 1490 } 1491 mutex_unlock(&filter->notify_lock); 1492 } 1493 1494 return ret; 1495 } 1496 1497 static long seccomp_notify_send(struct seccomp_filter *filter, 1498 void __user *buf) 1499 { 1500 struct seccomp_notif_resp resp = {}; 1501 struct seccomp_knotif *knotif; 1502 long ret; 1503 1504 if (copy_from_user(&resp, buf, sizeof(resp))) 1505 return -EFAULT; 1506 1507 if (resp.flags & ~SECCOMP_USER_NOTIF_FLAG_CONTINUE) 1508 return -EINVAL; 1509 1510 if ((resp.flags & SECCOMP_USER_NOTIF_FLAG_CONTINUE) && 1511 (resp.error || resp.val)) 1512 return -EINVAL; 1513 1514 ret = mutex_lock_interruptible(&filter->notify_lock); 1515 if (ret < 0) 1516 return ret; 1517 1518 knotif = find_notification(filter, resp.id); 1519 if (!knotif) { 1520 ret = -ENOENT; 1521 goto out; 1522 } 1523 1524 /* Allow exactly one reply. */ 1525 if (knotif->state != SECCOMP_NOTIFY_SENT) { 1526 ret = -EINPROGRESS; 1527 goto out; 1528 } 1529 1530 ret = 0; 1531 knotif->state = SECCOMP_NOTIFY_REPLIED; 1532 knotif->error = resp.error; 1533 knotif->val = resp.val; 1534 knotif->flags = resp.flags; 1535 complete(&knotif->ready); 1536 out: 1537 mutex_unlock(&filter->notify_lock); 1538 return ret; 1539 } 1540 1541 static long seccomp_notify_id_valid(struct seccomp_filter *filter, 1542 void __user *buf) 1543 { 1544 struct seccomp_knotif *knotif; 1545 u64 id; 1546 long ret; 1547 1548 if (copy_from_user(&id, buf, sizeof(id))) 1549 return -EFAULT; 1550 1551 ret = mutex_lock_interruptible(&filter->notify_lock); 1552 if (ret < 0) 1553 return ret; 1554 1555 knotif = find_notification(filter, id); 1556 if (knotif && knotif->state == SECCOMP_NOTIFY_SENT) 1557 ret = 0; 1558 else 1559 ret = -ENOENT; 1560 1561 mutex_unlock(&filter->notify_lock); 1562 return ret; 1563 } 1564 1565 static long seccomp_notify_addfd(struct seccomp_filter *filter, 1566 struct seccomp_notif_addfd __user *uaddfd, 1567 unsigned int size) 1568 { 1569 struct seccomp_notif_addfd addfd; 1570 struct seccomp_knotif *knotif; 1571 struct seccomp_kaddfd kaddfd; 1572 int ret; 1573 1574 BUILD_BUG_ON(sizeof(addfd) < SECCOMP_NOTIFY_ADDFD_SIZE_VER0); 1575 BUILD_BUG_ON(sizeof(addfd) != SECCOMP_NOTIFY_ADDFD_SIZE_LATEST); 1576 1577 if (size < SECCOMP_NOTIFY_ADDFD_SIZE_VER0 || size >= PAGE_SIZE) 1578 return -EINVAL; 1579 1580 ret = copy_struct_from_user(&addfd, sizeof(addfd), uaddfd, size); 1581 if (ret) 1582 return ret; 1583 1584 if (addfd.newfd_flags & ~O_CLOEXEC) 1585 return -EINVAL; 1586 1587 if (addfd.flags & ~(SECCOMP_ADDFD_FLAG_SETFD | SECCOMP_ADDFD_FLAG_SEND)) 1588 return -EINVAL; 1589 1590 if (addfd.newfd && !(addfd.flags & SECCOMP_ADDFD_FLAG_SETFD)) 1591 return -EINVAL; 1592 1593 kaddfd.file = fget(addfd.srcfd); 1594 if (!kaddfd.file) 1595 return -EBADF; 1596 1597 kaddfd.ioctl_flags = addfd.flags; 1598 kaddfd.flags = addfd.newfd_flags; 1599 kaddfd.setfd = addfd.flags & SECCOMP_ADDFD_FLAG_SETFD; 1600 kaddfd.fd = addfd.newfd; 1601 init_completion(&kaddfd.completion); 1602 1603 ret = mutex_lock_interruptible(&filter->notify_lock); 1604 if (ret < 0) 1605 goto out; 1606 1607 knotif = find_notification(filter, addfd.id); 1608 if (!knotif) { 1609 ret = -ENOENT; 1610 goto out_unlock; 1611 } 1612 1613 /* 1614 * We do not want to allow for FD injection to occur before the 1615 * notification has been picked up by a userspace handler, or after 1616 * the notification has been replied to. 1617 */ 1618 if (knotif->state != SECCOMP_NOTIFY_SENT) { 1619 ret = -EINPROGRESS; 1620 goto out_unlock; 1621 } 1622 1623 if (addfd.flags & SECCOMP_ADDFD_FLAG_SEND) { 1624 /* 1625 * Disallow queuing an atomic addfd + send reply while there are 1626 * some addfd requests still to process. 1627 * 1628 * There is no clear reason to support it and allows us to keep 1629 * the loop on the other side straight-forward. 1630 */ 1631 if (!list_empty(&knotif->addfd)) { 1632 ret = -EBUSY; 1633 goto out_unlock; 1634 } 1635 1636 /* Allow exactly only one reply */ 1637 knotif->state = SECCOMP_NOTIFY_REPLIED; 1638 } 1639 1640 list_add(&kaddfd.list, &knotif->addfd); 1641 complete(&knotif->ready); 1642 mutex_unlock(&filter->notify_lock); 1643 1644 /* Now we wait for it to be processed or be interrupted */ 1645 ret = wait_for_completion_interruptible(&kaddfd.completion); 1646 if (ret == 0) { 1647 /* 1648 * We had a successful completion. The other side has already 1649 * removed us from the addfd queue, and 1650 * wait_for_completion_interruptible has a memory barrier upon 1651 * success that lets us read this value directly without 1652 * locking. 1653 */ 1654 ret = kaddfd.ret; 1655 goto out; 1656 } 1657 1658 mutex_lock(&filter->notify_lock); 1659 /* 1660 * Even though we were woken up by a signal and not a successful 1661 * completion, a completion may have happened in the mean time. 1662 * 1663 * We need to check again if the addfd request has been handled, 1664 * and if not, we will remove it from the queue. 1665 */ 1666 if (list_empty(&kaddfd.list)) 1667 ret = kaddfd.ret; 1668 else 1669 list_del(&kaddfd.list); 1670 1671 out_unlock: 1672 mutex_unlock(&filter->notify_lock); 1673 out: 1674 fput(kaddfd.file); 1675 1676 return ret; 1677 } 1678 1679 static long seccomp_notify_ioctl(struct file *file, unsigned int cmd, 1680 unsigned long arg) 1681 { 1682 struct seccomp_filter *filter = file->private_data; 1683 void __user *buf = (void __user *)arg; 1684 1685 /* Fixed-size ioctls */ 1686 switch (cmd) { 1687 case SECCOMP_IOCTL_NOTIF_RECV: 1688 return seccomp_notify_recv(filter, buf); 1689 case SECCOMP_IOCTL_NOTIF_SEND: 1690 return seccomp_notify_send(filter, buf); 1691 case SECCOMP_IOCTL_NOTIF_ID_VALID_WRONG_DIR: 1692 case SECCOMP_IOCTL_NOTIF_ID_VALID: 1693 return seccomp_notify_id_valid(filter, buf); 1694 } 1695 1696 /* Extensible Argument ioctls */ 1697 #define EA_IOCTL(cmd) ((cmd) & ~(IOC_INOUT | IOCSIZE_MASK)) 1698 switch (EA_IOCTL(cmd)) { 1699 case EA_IOCTL(SECCOMP_IOCTL_NOTIF_ADDFD): 1700 return seccomp_notify_addfd(filter, buf, _IOC_SIZE(cmd)); 1701 default: 1702 return -EINVAL; 1703 } 1704 } 1705 1706 static __poll_t seccomp_notify_poll(struct file *file, 1707 struct poll_table_struct *poll_tab) 1708 { 1709 struct seccomp_filter *filter = file->private_data; 1710 __poll_t ret = 0; 1711 struct seccomp_knotif *cur; 1712 1713 poll_wait(file, &filter->wqh, poll_tab); 1714 1715 if (mutex_lock_interruptible(&filter->notify_lock) < 0) 1716 return EPOLLERR; 1717 1718 list_for_each_entry(cur, &filter->notif->notifications, list) { 1719 if (cur->state == SECCOMP_NOTIFY_INIT) 1720 ret |= EPOLLIN | EPOLLRDNORM; 1721 if (cur->state == SECCOMP_NOTIFY_SENT) 1722 ret |= EPOLLOUT | EPOLLWRNORM; 1723 if ((ret & EPOLLIN) && (ret & EPOLLOUT)) 1724 break; 1725 } 1726 1727 mutex_unlock(&filter->notify_lock); 1728 1729 if (refcount_read(&filter->users) == 0) 1730 ret |= EPOLLHUP; 1731 1732 return ret; 1733 } 1734 1735 static const struct file_operations seccomp_notify_ops = { 1736 .poll = seccomp_notify_poll, 1737 .release = seccomp_notify_release, 1738 .unlocked_ioctl = seccomp_notify_ioctl, 1739 .compat_ioctl = seccomp_notify_ioctl, 1740 }; 1741 1742 static struct file *init_listener(struct seccomp_filter *filter) 1743 { 1744 struct file *ret; 1745 1746 ret = ERR_PTR(-ENOMEM); 1747 filter->notif = kzalloc(sizeof(*(filter->notif)), GFP_KERNEL); 1748 if (!filter->notif) 1749 goto out; 1750 1751 sema_init(&filter->notif->request, 0); 1752 filter->notif->next_id = get_random_u64(); 1753 INIT_LIST_HEAD(&filter->notif->notifications); 1754 1755 ret = anon_inode_getfile("seccomp notify", &seccomp_notify_ops, 1756 filter, O_RDWR); 1757 if (IS_ERR(ret)) 1758 goto out_notif; 1759 1760 /* The file has a reference to it now */ 1761 __get_seccomp_filter(filter); 1762 1763 out_notif: 1764 if (IS_ERR(ret)) 1765 seccomp_notify_free(filter); 1766 out: 1767 return ret; 1768 } 1769 1770 /* 1771 * Does @new_child have a listener while an ancestor also has a listener? 1772 * If so, we'll want to reject this filter. 1773 * This only has to be tested for the current process, even in the TSYNC case, 1774 * because TSYNC installs @child with the same parent on all threads. 1775 * Note that @new_child is not hooked up to its parent at this point yet, so 1776 * we use current->seccomp.filter. 1777 */ 1778 static bool has_duplicate_listener(struct seccomp_filter *new_child) 1779 { 1780 struct seccomp_filter *cur; 1781 1782 /* must be protected against concurrent TSYNC */ 1783 lockdep_assert_held(¤t->sighand->siglock); 1784 1785 if (!new_child->notif) 1786 return false; 1787 for (cur = current->seccomp.filter; cur; cur = cur->prev) { 1788 if (cur->notif) 1789 return true; 1790 } 1791 1792 return false; 1793 } 1794 1795 /** 1796 * seccomp_set_mode_filter: internal function for setting seccomp filter 1797 * @flags: flags to change filter behavior 1798 * @filter: struct sock_fprog containing filter 1799 * 1800 * This function may be called repeatedly to install additional filters. 1801 * Every filter successfully installed will be evaluated (in reverse order) 1802 * for each system call the task makes. 1803 * 1804 * Once current->seccomp.mode is non-zero, it may not be changed. 1805 * 1806 * Returns 0 on success or -EINVAL on failure. 1807 */ 1808 static long seccomp_set_mode_filter(unsigned int flags, 1809 const char __user *filter) 1810 { 1811 const unsigned long seccomp_mode = SECCOMP_MODE_FILTER; 1812 struct seccomp_filter *prepared = NULL; 1813 long ret = -EINVAL; 1814 int listener = -1; 1815 struct file *listener_f = NULL; 1816 1817 /* Validate flags. */ 1818 if (flags & ~SECCOMP_FILTER_FLAG_MASK) 1819 return -EINVAL; 1820 1821 /* 1822 * In the successful case, NEW_LISTENER returns the new listener fd. 1823 * But in the failure case, TSYNC returns the thread that died. If you 1824 * combine these two flags, there's no way to tell whether something 1825 * succeeded or failed. So, let's disallow this combination if the user 1826 * has not explicitly requested no errors from TSYNC. 1827 */ 1828 if ((flags & SECCOMP_FILTER_FLAG_TSYNC) && 1829 (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) && 1830 ((flags & SECCOMP_FILTER_FLAG_TSYNC_ESRCH) == 0)) 1831 return -EINVAL; 1832 1833 /* Prepare the new filter before holding any locks. */ 1834 prepared = seccomp_prepare_user_filter(filter); 1835 if (IS_ERR(prepared)) 1836 return PTR_ERR(prepared); 1837 1838 if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) { 1839 listener = get_unused_fd_flags(O_CLOEXEC); 1840 if (listener < 0) { 1841 ret = listener; 1842 goto out_free; 1843 } 1844 1845 listener_f = init_listener(prepared); 1846 if (IS_ERR(listener_f)) { 1847 put_unused_fd(listener); 1848 ret = PTR_ERR(listener_f); 1849 goto out_free; 1850 } 1851 } 1852 1853 /* 1854 * Make sure we cannot change seccomp or nnp state via TSYNC 1855 * while another thread is in the middle of calling exec. 1856 */ 1857 if (flags & SECCOMP_FILTER_FLAG_TSYNC && 1858 mutex_lock_killable(¤t->signal->cred_guard_mutex)) 1859 goto out_put_fd; 1860 1861 spin_lock_irq(¤t->sighand->siglock); 1862 1863 if (!seccomp_may_assign_mode(seccomp_mode)) 1864 goto out; 1865 1866 if (has_duplicate_listener(prepared)) { 1867 ret = -EBUSY; 1868 goto out; 1869 } 1870 1871 ret = seccomp_attach_filter(flags, prepared); 1872 if (ret) 1873 goto out; 1874 /* Do not free the successfully attached filter. */ 1875 prepared = NULL; 1876 1877 seccomp_assign_mode(current, seccomp_mode, flags); 1878 out: 1879 spin_unlock_irq(¤t->sighand->siglock); 1880 if (flags & SECCOMP_FILTER_FLAG_TSYNC) 1881 mutex_unlock(¤t->signal->cred_guard_mutex); 1882 out_put_fd: 1883 if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) { 1884 if (ret) { 1885 listener_f->private_data = NULL; 1886 fput(listener_f); 1887 put_unused_fd(listener); 1888 seccomp_notify_detach(prepared); 1889 } else { 1890 fd_install(listener, listener_f); 1891 ret = listener; 1892 } 1893 } 1894 out_free: 1895 seccomp_filter_free(prepared); 1896 return ret; 1897 } 1898 #else 1899 static inline long seccomp_set_mode_filter(unsigned int flags, 1900 const char __user *filter) 1901 { 1902 return -EINVAL; 1903 } 1904 #endif 1905 1906 static long seccomp_get_action_avail(const char __user *uaction) 1907 { 1908 u32 action; 1909 1910 if (copy_from_user(&action, uaction, sizeof(action))) 1911 return -EFAULT; 1912 1913 switch (action) { 1914 case SECCOMP_RET_KILL_PROCESS: 1915 case SECCOMP_RET_KILL_THREAD: 1916 case SECCOMP_RET_TRAP: 1917 case SECCOMP_RET_ERRNO: 1918 case SECCOMP_RET_USER_NOTIF: 1919 case SECCOMP_RET_TRACE: 1920 case SECCOMP_RET_LOG: 1921 case SECCOMP_RET_ALLOW: 1922 break; 1923 default: 1924 return -EOPNOTSUPP; 1925 } 1926 1927 return 0; 1928 } 1929 1930 static long seccomp_get_notif_sizes(void __user *usizes) 1931 { 1932 struct seccomp_notif_sizes sizes = { 1933 .seccomp_notif = sizeof(struct seccomp_notif), 1934 .seccomp_notif_resp = sizeof(struct seccomp_notif_resp), 1935 .seccomp_data = sizeof(struct seccomp_data), 1936 }; 1937 1938 if (copy_to_user(usizes, &sizes, sizeof(sizes))) 1939 return -EFAULT; 1940 1941 return 0; 1942 } 1943 1944 /* Common entry point for both prctl and syscall. */ 1945 static long do_seccomp(unsigned int op, unsigned int flags, 1946 void __user *uargs) 1947 { 1948 switch (op) { 1949 case SECCOMP_SET_MODE_STRICT: 1950 if (flags != 0 || uargs != NULL) 1951 return -EINVAL; 1952 return seccomp_set_mode_strict(); 1953 case SECCOMP_SET_MODE_FILTER: 1954 return seccomp_set_mode_filter(flags, uargs); 1955 case SECCOMP_GET_ACTION_AVAIL: 1956 if (flags != 0) 1957 return -EINVAL; 1958 1959 return seccomp_get_action_avail(uargs); 1960 case SECCOMP_GET_NOTIF_SIZES: 1961 if (flags != 0) 1962 return -EINVAL; 1963 1964 return seccomp_get_notif_sizes(uargs); 1965 default: 1966 return -EINVAL; 1967 } 1968 } 1969 1970 SYSCALL_DEFINE3(seccomp, unsigned int, op, unsigned int, flags, 1971 void __user *, uargs) 1972 { 1973 return do_seccomp(op, flags, uargs); 1974 } 1975 1976 /** 1977 * prctl_set_seccomp: configures current->seccomp.mode 1978 * @seccomp_mode: requested mode to use 1979 * @filter: optional struct sock_fprog for use with SECCOMP_MODE_FILTER 1980 * 1981 * Returns 0 on success or -EINVAL on failure. 1982 */ 1983 long prctl_set_seccomp(unsigned long seccomp_mode, void __user *filter) 1984 { 1985 unsigned int op; 1986 void __user *uargs; 1987 1988 switch (seccomp_mode) { 1989 case SECCOMP_MODE_STRICT: 1990 op = SECCOMP_SET_MODE_STRICT; 1991 /* 1992 * Setting strict mode through prctl always ignored filter, 1993 * so make sure it is always NULL here to pass the internal 1994 * check in do_seccomp(). 1995 */ 1996 uargs = NULL; 1997 break; 1998 case SECCOMP_MODE_FILTER: 1999 op = SECCOMP_SET_MODE_FILTER; 2000 uargs = filter; 2001 break; 2002 default: 2003 return -EINVAL; 2004 } 2005 2006 /* prctl interface doesn't have flags, so they are always zero. */ 2007 return do_seccomp(op, 0, uargs); 2008 } 2009 2010 #if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE) 2011 static struct seccomp_filter *get_nth_filter(struct task_struct *task, 2012 unsigned long filter_off) 2013 { 2014 struct seccomp_filter *orig, *filter; 2015 unsigned long count; 2016 2017 /* 2018 * Note: this is only correct because the caller should be the (ptrace) 2019 * tracer of the task, otherwise lock_task_sighand is needed. 2020 */ 2021 spin_lock_irq(&task->sighand->siglock); 2022 2023 if (task->seccomp.mode != SECCOMP_MODE_FILTER) { 2024 spin_unlock_irq(&task->sighand->siglock); 2025 return ERR_PTR(-EINVAL); 2026 } 2027 2028 orig = task->seccomp.filter; 2029 __get_seccomp_filter(orig); 2030 spin_unlock_irq(&task->sighand->siglock); 2031 2032 count = 0; 2033 for (filter = orig; filter; filter = filter->prev) 2034 count++; 2035 2036 if (filter_off >= count) { 2037 filter = ERR_PTR(-ENOENT); 2038 goto out; 2039 } 2040 2041 count -= filter_off; 2042 for (filter = orig; filter && count > 1; filter = filter->prev) 2043 count--; 2044 2045 if (WARN_ON(count != 1 || !filter)) { 2046 filter = ERR_PTR(-ENOENT); 2047 goto out; 2048 } 2049 2050 __get_seccomp_filter(filter); 2051 2052 out: 2053 __put_seccomp_filter(orig); 2054 return filter; 2055 } 2056 2057 long seccomp_get_filter(struct task_struct *task, unsigned long filter_off, 2058 void __user *data) 2059 { 2060 struct seccomp_filter *filter; 2061 struct sock_fprog_kern *fprog; 2062 long ret; 2063 2064 if (!capable(CAP_SYS_ADMIN) || 2065 current->seccomp.mode != SECCOMP_MODE_DISABLED) { 2066 return -EACCES; 2067 } 2068 2069 filter = get_nth_filter(task, filter_off); 2070 if (IS_ERR(filter)) 2071 return PTR_ERR(filter); 2072 2073 fprog = filter->prog->orig_prog; 2074 if (!fprog) { 2075 /* This must be a new non-cBPF filter, since we save 2076 * every cBPF filter's orig_prog above when 2077 * CONFIG_CHECKPOINT_RESTORE is enabled. 2078 */ 2079 ret = -EMEDIUMTYPE; 2080 goto out; 2081 } 2082 2083 ret = fprog->len; 2084 if (!data) 2085 goto out; 2086 2087 if (copy_to_user(data, fprog->filter, bpf_classic_proglen(fprog))) 2088 ret = -EFAULT; 2089 2090 out: 2091 __put_seccomp_filter(filter); 2092 return ret; 2093 } 2094 2095 long seccomp_get_metadata(struct task_struct *task, 2096 unsigned long size, void __user *data) 2097 { 2098 long ret; 2099 struct seccomp_filter *filter; 2100 struct seccomp_metadata kmd = {}; 2101 2102 if (!capable(CAP_SYS_ADMIN) || 2103 current->seccomp.mode != SECCOMP_MODE_DISABLED) { 2104 return -EACCES; 2105 } 2106 2107 size = min_t(unsigned long, size, sizeof(kmd)); 2108 2109 if (size < sizeof(kmd.filter_off)) 2110 return -EINVAL; 2111 2112 if (copy_from_user(&kmd.filter_off, data, sizeof(kmd.filter_off))) 2113 return -EFAULT; 2114 2115 filter = get_nth_filter(task, kmd.filter_off); 2116 if (IS_ERR(filter)) 2117 return PTR_ERR(filter); 2118 2119 if (filter->log) 2120 kmd.flags |= SECCOMP_FILTER_FLAG_LOG; 2121 2122 ret = size; 2123 if (copy_to_user(data, &kmd, size)) 2124 ret = -EFAULT; 2125 2126 __put_seccomp_filter(filter); 2127 return ret; 2128 } 2129 #endif 2130 2131 #ifdef CONFIG_SYSCTL 2132 2133 /* Human readable action names for friendly sysctl interaction */ 2134 #define SECCOMP_RET_KILL_PROCESS_NAME "kill_process" 2135 #define SECCOMP_RET_KILL_THREAD_NAME "kill_thread" 2136 #define SECCOMP_RET_TRAP_NAME "trap" 2137 #define SECCOMP_RET_ERRNO_NAME "errno" 2138 #define SECCOMP_RET_USER_NOTIF_NAME "user_notif" 2139 #define SECCOMP_RET_TRACE_NAME "trace" 2140 #define SECCOMP_RET_LOG_NAME "log" 2141 #define SECCOMP_RET_ALLOW_NAME "allow" 2142 2143 static const char seccomp_actions_avail[] = 2144 SECCOMP_RET_KILL_PROCESS_NAME " " 2145 SECCOMP_RET_KILL_THREAD_NAME " " 2146 SECCOMP_RET_TRAP_NAME " " 2147 SECCOMP_RET_ERRNO_NAME " " 2148 SECCOMP_RET_USER_NOTIF_NAME " " 2149 SECCOMP_RET_TRACE_NAME " " 2150 SECCOMP_RET_LOG_NAME " " 2151 SECCOMP_RET_ALLOW_NAME; 2152 2153 struct seccomp_log_name { 2154 u32 log; 2155 const char *name; 2156 }; 2157 2158 static const struct seccomp_log_name seccomp_log_names[] = { 2159 { SECCOMP_LOG_KILL_PROCESS, SECCOMP_RET_KILL_PROCESS_NAME }, 2160 { SECCOMP_LOG_KILL_THREAD, SECCOMP_RET_KILL_THREAD_NAME }, 2161 { SECCOMP_LOG_TRAP, SECCOMP_RET_TRAP_NAME }, 2162 { SECCOMP_LOG_ERRNO, SECCOMP_RET_ERRNO_NAME }, 2163 { SECCOMP_LOG_USER_NOTIF, SECCOMP_RET_USER_NOTIF_NAME }, 2164 { SECCOMP_LOG_TRACE, SECCOMP_RET_TRACE_NAME }, 2165 { SECCOMP_LOG_LOG, SECCOMP_RET_LOG_NAME }, 2166 { SECCOMP_LOG_ALLOW, SECCOMP_RET_ALLOW_NAME }, 2167 { } 2168 }; 2169 2170 static bool seccomp_names_from_actions_logged(char *names, size_t size, 2171 u32 actions_logged, 2172 const char *sep) 2173 { 2174 const struct seccomp_log_name *cur; 2175 bool append_sep = false; 2176 2177 for (cur = seccomp_log_names; cur->name && size; cur++) { 2178 ssize_t ret; 2179 2180 if (!(actions_logged & cur->log)) 2181 continue; 2182 2183 if (append_sep) { 2184 ret = strscpy(names, sep, size); 2185 if (ret < 0) 2186 return false; 2187 2188 names += ret; 2189 size -= ret; 2190 } else 2191 append_sep = true; 2192 2193 ret = strscpy(names, cur->name, size); 2194 if (ret < 0) 2195 return false; 2196 2197 names += ret; 2198 size -= ret; 2199 } 2200 2201 return true; 2202 } 2203 2204 static bool seccomp_action_logged_from_name(u32 *action_logged, 2205 const char *name) 2206 { 2207 const struct seccomp_log_name *cur; 2208 2209 for (cur = seccomp_log_names; cur->name; cur++) { 2210 if (!strcmp(cur->name, name)) { 2211 *action_logged = cur->log; 2212 return true; 2213 } 2214 } 2215 2216 return false; 2217 } 2218 2219 static bool seccomp_actions_logged_from_names(u32 *actions_logged, char *names) 2220 { 2221 char *name; 2222 2223 *actions_logged = 0; 2224 while ((name = strsep(&names, " ")) && *name) { 2225 u32 action_logged = 0; 2226 2227 if (!seccomp_action_logged_from_name(&action_logged, name)) 2228 return false; 2229 2230 *actions_logged |= action_logged; 2231 } 2232 2233 return true; 2234 } 2235 2236 static int read_actions_logged(struct ctl_table *ro_table, void *buffer, 2237 size_t *lenp, loff_t *ppos) 2238 { 2239 char names[sizeof(seccomp_actions_avail)]; 2240 struct ctl_table table; 2241 2242 memset(names, 0, sizeof(names)); 2243 2244 if (!seccomp_names_from_actions_logged(names, sizeof(names), 2245 seccomp_actions_logged, " ")) 2246 return -EINVAL; 2247 2248 table = *ro_table; 2249 table.data = names; 2250 table.maxlen = sizeof(names); 2251 return proc_dostring(&table, 0, buffer, lenp, ppos); 2252 } 2253 2254 static int write_actions_logged(struct ctl_table *ro_table, void *buffer, 2255 size_t *lenp, loff_t *ppos, u32 *actions_logged) 2256 { 2257 char names[sizeof(seccomp_actions_avail)]; 2258 struct ctl_table table; 2259 int ret; 2260 2261 if (!capable(CAP_SYS_ADMIN)) 2262 return -EPERM; 2263 2264 memset(names, 0, sizeof(names)); 2265 2266 table = *ro_table; 2267 table.data = names; 2268 table.maxlen = sizeof(names); 2269 ret = proc_dostring(&table, 1, buffer, lenp, ppos); 2270 if (ret) 2271 return ret; 2272 2273 if (!seccomp_actions_logged_from_names(actions_logged, table.data)) 2274 return -EINVAL; 2275 2276 if (*actions_logged & SECCOMP_LOG_ALLOW) 2277 return -EINVAL; 2278 2279 seccomp_actions_logged = *actions_logged; 2280 return 0; 2281 } 2282 2283 static void audit_actions_logged(u32 actions_logged, u32 old_actions_logged, 2284 int ret) 2285 { 2286 char names[sizeof(seccomp_actions_avail)]; 2287 char old_names[sizeof(seccomp_actions_avail)]; 2288 const char *new = names; 2289 const char *old = old_names; 2290 2291 if (!audit_enabled) 2292 return; 2293 2294 memset(names, 0, sizeof(names)); 2295 memset(old_names, 0, sizeof(old_names)); 2296 2297 if (ret) 2298 new = "?"; 2299 else if (!actions_logged) 2300 new = "(none)"; 2301 else if (!seccomp_names_from_actions_logged(names, sizeof(names), 2302 actions_logged, ",")) 2303 new = "?"; 2304 2305 if (!old_actions_logged) 2306 old = "(none)"; 2307 else if (!seccomp_names_from_actions_logged(old_names, 2308 sizeof(old_names), 2309 old_actions_logged, ",")) 2310 old = "?"; 2311 2312 return audit_seccomp_actions_logged(new, old, !ret); 2313 } 2314 2315 static int seccomp_actions_logged_handler(struct ctl_table *ro_table, int write, 2316 void *buffer, size_t *lenp, 2317 loff_t *ppos) 2318 { 2319 int ret; 2320 2321 if (write) { 2322 u32 actions_logged = 0; 2323 u32 old_actions_logged = seccomp_actions_logged; 2324 2325 ret = write_actions_logged(ro_table, buffer, lenp, ppos, 2326 &actions_logged); 2327 audit_actions_logged(actions_logged, old_actions_logged, ret); 2328 } else 2329 ret = read_actions_logged(ro_table, buffer, lenp, ppos); 2330 2331 return ret; 2332 } 2333 2334 static struct ctl_path seccomp_sysctl_path[] = { 2335 { .procname = "kernel", }, 2336 { .procname = "seccomp", }, 2337 { } 2338 }; 2339 2340 static struct ctl_table seccomp_sysctl_table[] = { 2341 { 2342 .procname = "actions_avail", 2343 .data = (void *) &seccomp_actions_avail, 2344 .maxlen = sizeof(seccomp_actions_avail), 2345 .mode = 0444, 2346 .proc_handler = proc_dostring, 2347 }, 2348 { 2349 .procname = "actions_logged", 2350 .mode = 0644, 2351 .proc_handler = seccomp_actions_logged_handler, 2352 }, 2353 { } 2354 }; 2355 2356 static int __init seccomp_sysctl_init(void) 2357 { 2358 struct ctl_table_header *hdr; 2359 2360 hdr = register_sysctl_paths(seccomp_sysctl_path, seccomp_sysctl_table); 2361 if (!hdr) 2362 pr_warn("sysctl registration failed\n"); 2363 else 2364 kmemleak_not_leak(hdr); 2365 2366 return 0; 2367 } 2368 2369 device_initcall(seccomp_sysctl_init) 2370 2371 #endif /* CONFIG_SYSCTL */ 2372 2373 #ifdef CONFIG_SECCOMP_CACHE_DEBUG 2374 /* Currently CONFIG_SECCOMP_CACHE_DEBUG implies SECCOMP_ARCH_NATIVE */ 2375 static void proc_pid_seccomp_cache_arch(struct seq_file *m, const char *name, 2376 const void *bitmap, size_t bitmap_size) 2377 { 2378 int nr; 2379 2380 for (nr = 0; nr < bitmap_size; nr++) { 2381 bool cached = test_bit(nr, bitmap); 2382 char *status = cached ? "ALLOW" : "FILTER"; 2383 2384 seq_printf(m, "%s %d %s\n", name, nr, status); 2385 } 2386 } 2387 2388 int proc_pid_seccomp_cache(struct seq_file *m, struct pid_namespace *ns, 2389 struct pid *pid, struct task_struct *task) 2390 { 2391 struct seccomp_filter *f; 2392 unsigned long flags; 2393 2394 /* 2395 * We don't want some sandboxed process to know what their seccomp 2396 * filters consist of. 2397 */ 2398 if (!file_ns_capable(m->file, &init_user_ns, CAP_SYS_ADMIN)) 2399 return -EACCES; 2400 2401 if (!lock_task_sighand(task, &flags)) 2402 return -ESRCH; 2403 2404 f = READ_ONCE(task->seccomp.filter); 2405 if (!f) { 2406 unlock_task_sighand(task, &flags); 2407 return 0; 2408 } 2409 2410 /* prevent filter from being freed while we are printing it */ 2411 __get_seccomp_filter(f); 2412 unlock_task_sighand(task, &flags); 2413 2414 proc_pid_seccomp_cache_arch(m, SECCOMP_ARCH_NATIVE_NAME, 2415 f->cache.allow_native, 2416 SECCOMP_ARCH_NATIVE_NR); 2417 2418 #ifdef SECCOMP_ARCH_COMPAT 2419 proc_pid_seccomp_cache_arch(m, SECCOMP_ARCH_COMPAT_NAME, 2420 f->cache.allow_compat, 2421 SECCOMP_ARCH_COMPAT_NR); 2422 #endif /* SECCOMP_ARCH_COMPAT */ 2423 2424 __put_seccomp_filter(f); 2425 return 0; 2426 } 2427 #endif /* CONFIG_SECCOMP_CACHE_DEBUG */ 2428