projects/linux·blob v3.17-rc7 · refs

813 lines · 21.4 KiB

1/*
2 * linux/kernel/seccomp.c
3 *
4 * Copyright 2004-2005 Andrea Arcangeli <[email protected]>
5 *
6 * Copyright (C) 2012 Google, Inc.
7 * Will Drewry <[email protected]>
8 *
9 * This defines a simple but solid secure-computing facility.
10 *
11 * Mode 1 uses a fixed list of allowed system calls.
12 * Mode 2 allows user-defined system call filters in the form
13 * of Berkeley Packet Filters/Linux Socket Filters.
14 */
15
16#include <linux/atomic.h>
17#include <linux/audit.h>
18#include <linux/compat.h>
19#include <linux/sched.h>
20#include <linux/seccomp.h>
21#include <linux/slab.h>
22#include <linux/syscalls.h>
23
24/* #define SECCOMP_DEBUG 1 */
25
26#ifdef CONFIG_SECCOMP_FILTER
27#include <asm/syscall.h>
28#include <linux/filter.h>
29#include <linux/pid.h>
30#include <linux/ptrace.h>
31#include <linux/security.h>
32#include <linux/tracehook.h>
33#include <linux/uaccess.h>
34
35/**
36 * struct seccomp_filter - container for seccomp BPF programs
37 *
38 * @usage: reference count to manage the object lifetime.
39 * get/put helpers should be used when accessing an instance
40 * outside of a lifetime-guarded section. In general, this
41 * is only needed for handling filters shared across tasks.
42 * @prev: points to a previously installed, or inherited, filter
43 * @len: the number of instructions in the program
44 * @insnsi: the BPF program instructions to evaluate
45 *
46 * seccomp_filter objects are organized in a tree linked via the @prev
47 * pointer. For any task, it appears to be a singly-linked list starting
48 * with current->seccomp.filter, the most recently attached or inherited filter.
49 * However, multiple filters may share a @prev node, by way of fork(), which
50 * results in a unidirectional tree existing in memory. This is similar to
51 * how namespaces work.
52 *
53 * seccomp_filter objects should never be modified after being attached
54 * to a task_struct (other than @usage).
55 */
56struct seccomp_filter {
57 atomic_t usage;
58 struct seccomp_filter *prev;
59 struct bpf_prog *prog;
60};
61
62/* Limit any path through the tree to 256KB worth of instructions. */
63#define MAX_INSNS_PER_PATH ((1 << 18) / sizeof(struct sock_filter))
64
65/*
66 * Endianness is explicitly ignored and left for BPF program authors to manage
67 * as per the specific architecture.
68 */
69static void populate_seccomp_data(struct seccomp_data *sd)
70{
71 struct task_struct *task = current;
72 struct pt_regs *regs = task_pt_regs(task);
73 unsigned long args[6];
74
75 sd->nr = syscall_get_nr(task, regs);
76 sd->arch = syscall_get_arch();
77 syscall_get_arguments(task, regs, 0, 6, args);
78 sd->args[0] = args[0];
79 sd->args[1] = args[1];
80 sd->args[2] = args[2];
81 sd->args[3] = args[3];
82 sd->args[4] = args[4];
83 sd->args[5] = args[5];
84 sd->instruction_pointer = KSTK_EIP(task);
85}
86
87/**
88 * seccomp_check_filter - verify seccomp filter code
89 * @filter: filter to verify
90 * @flen: length of filter
91 *
92 * Takes a previously checked filter (by bpf_check_classic) and
93 * redirects all filter code that loads struct sk_buff data
94 * and related data through seccomp_bpf_load. It also
95 * enforces length and alignment checking of those loads.
96 *
97 * Returns 0 if the rule set is legal or -EINVAL if not.
98 */
99static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen)
100{
101 int pc;
102 for (pc = 0; pc < flen; pc++) {
103 struct sock_filter *ftest = &filter[pc];
104 u16 code = ftest->code;
105 u32 k = ftest->k;
106
107 switch (code) {
108 case BPF_LD | BPF_W | BPF_ABS:
109 ftest->code = BPF_LDX | BPF_W | BPF_ABS;
110 /* 32-bit aligned and not out of bounds. */
111 if (k >= sizeof(struct seccomp_data) || k & 3)
112 return -EINVAL;
113 continue;
114 case BPF_LD | BPF_W | BPF_LEN:
115 ftest->code = BPF_LD | BPF_IMM;
116 ftest->k = sizeof(struct seccomp_data);
117 continue;
118 case BPF_LDX | BPF_W | BPF_LEN:
119 ftest->code = BPF_LDX | BPF_IMM;
120 ftest->k = sizeof(struct seccomp_data);
121 continue;
122 /* Explicitly include allowed calls. */
123 case BPF_RET | BPF_K:
124 case BPF_RET | BPF_A:
125 case BPF_ALU | BPF_ADD | BPF_K:
126 case BPF_ALU | BPF_ADD | BPF_X:
127 case BPF_ALU | BPF_SUB | BPF_K:
128 case BPF_ALU | BPF_SUB | BPF_X:
129 case BPF_ALU | BPF_MUL | BPF_K:
130 case BPF_ALU | BPF_MUL | BPF_X:
131 case BPF_ALU | BPF_DIV | BPF_K:
132 case BPF_ALU | BPF_DIV | BPF_X:
133 case BPF_ALU | BPF_AND | BPF_K:
134 case BPF_ALU | BPF_AND | BPF_X:
135 case BPF_ALU | BPF_OR | BPF_K:
136 case BPF_ALU | BPF_OR | BPF_X:
137 case BPF_ALU | BPF_XOR | BPF_K:
138 case BPF_ALU | BPF_XOR | BPF_X:
139 case BPF_ALU | BPF_LSH | BPF_K:
140 case BPF_ALU | BPF_LSH | BPF_X:
141 case BPF_ALU | BPF_RSH | BPF_K:
142 case BPF_ALU | BPF_RSH | BPF_X:
143 case BPF_ALU | BPF_NEG:
144 case BPF_LD | BPF_IMM:
145 case BPF_LDX | BPF_IMM:
146 case BPF_MISC | BPF_TAX:
147 case BPF_MISC | BPF_TXA:
148 case BPF_LD | BPF_MEM:
149 case BPF_LDX | BPF_MEM:
150 case BPF_ST:
151 case BPF_STX:
152 case BPF_JMP | BPF_JA:
153 case BPF_JMP | BPF_JEQ | BPF_K:
154 case BPF_JMP | BPF_JEQ | BPF_X:
155 case BPF_JMP | BPF_JGE | BPF_K:
156 case BPF_JMP | BPF_JGE | BPF_X:
157 case BPF_JMP | BPF_JGT | BPF_K:
158 case BPF_JMP | BPF_JGT | BPF_X:
159 case BPF_JMP | BPF_JSET | BPF_K:
160 case BPF_JMP | BPF_JSET | BPF_X:
161 continue;
162 default:
163 return -EINVAL;
164 }
165 }
166 return 0;
167}
168
169/**
170 * seccomp_run_filters - evaluates all seccomp filters against @syscall
171 * @syscall: number of the current system call
172 *
173 * Returns valid seccomp BPF response codes.
174 */
175static u32 seccomp_run_filters(int syscall)
176{
177 struct seccomp_filter *f = ACCESS_ONCE(current->seccomp.filter);
178 struct seccomp_data sd;
179 u32 ret = SECCOMP_RET_ALLOW;
180
181 /* Ensure unexpected behavior doesn't result in failing open. */
182 if (unlikely(WARN_ON(f == NULL)))
183 return SECCOMP_RET_KILL;
184
185 /* Make sure cross-thread synced filter points somewhere sane. */
186 smp_read_barrier_depends();
187
188 populate_seccomp_data(&sd);
189
190 /*
191 * All filters in the list are evaluated and the lowest BPF return
192 * value always takes priority (ignoring the DATA).
193 */
194 for (; f; f = f->prev) {
195 u32 cur_ret = BPF_PROG_RUN(f->prog, (void *)&sd);
196
197 if ((cur_ret & SECCOMP_RET_ACTION) < (ret & SECCOMP_RET_ACTION))
198 ret = cur_ret;
199 }
200 return ret;
201}
202#endif /* CONFIG_SECCOMP_FILTER */
203
204static inline bool seccomp_may_assign_mode(unsigned long seccomp_mode)
205{
206 assert_spin_locked(&current->sighand->siglock);
207
208 if (current->seccomp.mode && current->seccomp.mode != seccomp_mode)
209 return false;
210
211 return true;
212}
213
214static inline void seccomp_assign_mode(struct task_struct *task,
215 unsigned long seccomp_mode)
216{
217 assert_spin_locked(&task->sighand->siglock);
218
219 task->seccomp.mode = seccomp_mode;
220 /*
221 * Make sure TIF_SECCOMP cannot be set before the mode (and
222 * filter) is set.
223 */
224 smp_mb__before_atomic();
225 set_tsk_thread_flag(task, TIF_SECCOMP);
226}
227
228#ifdef CONFIG_SECCOMP_FILTER
229/* Returns 1 if the parent is an ancestor of the child. */
230static int is_ancestor(struct seccomp_filter *parent,
231 struct seccomp_filter *child)
232{
233 /* NULL is the root ancestor. */
234 if (parent == NULL)
235 return 1;
236 for (; child; child = child->prev)
237 if (child == parent)
238 return 1;
239 return 0;
240}
241
242/**
243 * seccomp_can_sync_threads: checks if all threads can be synchronized
244 *
245 * Expects sighand and cred_guard_mutex locks to be held.
246 *
247 * Returns 0 on success, -ve on error, or the pid of a thread which was
248 * either not in the correct seccomp mode or it did not have an ancestral
249 * seccomp filter.
250 */
251static inline pid_t seccomp_can_sync_threads(void)
252{
253 struct task_struct *thread, *caller;
254
255 BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
256 assert_spin_locked(&current->sighand->siglock);
257
258 /* Validate all threads being eligible for synchronization. */
259 caller = current;
260 for_each_thread(caller, thread) {
261 pid_t failed;
262
263 /* Skip current, since it is initiating the sync. */
264 if (thread == caller)
265 continue;
266
267 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED ||
268 (thread->seccomp.mode == SECCOMP_MODE_FILTER &&
269 is_ancestor(thread->seccomp.filter,
270 caller->seccomp.filter)))
271 continue;
272
273 /* Return the first thread that cannot be synchronized. */
274 failed = task_pid_vnr(thread);
275 /* If the pid cannot be resolved, then return -ESRCH */
276 if (unlikely(WARN_ON(failed == 0)))
277 failed = -ESRCH;
278 return failed;
279 }
280
281 return 0;
282}
283
284/**
285 * seccomp_sync_threads: sets all threads to use current's filter
286 *
287 * Expects sighand and cred_guard_mutex locks to be held, and for
288 * seccomp_can_sync_threads() to have returned success already
289 * without dropping the locks.
290 *
291 */
292static inline void seccomp_sync_threads(void)
293{
294 struct task_struct *thread, *caller;
295
296 BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
297 assert_spin_locked(&current->sighand->siglock);
298
299 /* Synchronize all threads. */
300 caller = current;
301 for_each_thread(caller, thread) {
302 /* Skip current, since it needs no changes. */
303 if (thread == caller)
304 continue;
305
306 /* Get a task reference for the new leaf node. */
307 get_seccomp_filter(caller);
308 /*
309 * Drop the task reference to the shared ancestor since
310 * current's path will hold a reference. (This also
311 * allows a put before the assignment.)
312 */
313 put_seccomp_filter(thread);
314 smp_store_release(&thread->seccomp.filter,
315 caller->seccomp.filter);
316 /*
317 * Opt the other thread into seccomp if needed.
318 * As threads are considered to be trust-realm
319 * equivalent (see ptrace_may_access), it is safe to
320 * allow one thread to transition the other.
321 */
322 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED) {
323 /*
324 * Don't let an unprivileged task work around
325 * the no_new_privs restriction by creating
326 * a thread that sets it up, enters seccomp,
327 * then dies.
328 */
329 if (task_no_new_privs(caller))
330 task_set_no_new_privs(thread);
331
332 seccomp_assign_mode(thread, SECCOMP_MODE_FILTER);
333 }
334 }
335}
336
337/**
338 * seccomp_prepare_filter: Prepares a seccomp filter for use.
339 * @fprog: BPF program to install
340 *
341 * Returns filter on success or an ERR_PTR on failure.
342 */
343static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog)
344{
345 struct seccomp_filter *filter;
346 unsigned long fp_size;
347 struct sock_filter *fp;
348 int new_len;
349 long ret;
350
351 if (fprog->len == 0 || fprog->len > BPF_MAXINSNS)
352 return ERR_PTR(-EINVAL);
353 BUG_ON(INT_MAX / fprog->len < sizeof(struct sock_filter));
354 fp_size = fprog->len * sizeof(struct sock_filter);
355
356 /*
357 * Installing a seccomp filter requires that the task has
358 * CAP_SYS_ADMIN in its namespace or be running with no_new_privs.
359 * This avoids scenarios where unprivileged tasks can affect the
360 * behavior of privileged children.
361 */
362 if (!task_no_new_privs(current) &&
363 security_capable_noaudit(current_cred(), current_user_ns(),
364 CAP_SYS_ADMIN) != 0)
365 return ERR_PTR(-EACCES);
366
367 fp = kzalloc(fp_size, GFP_KERNEL|__GFP_NOWARN);
368 if (!fp)
369 return ERR_PTR(-ENOMEM);
370
371 /* Copy the instructions from fprog. */
372 ret = -EFAULT;
373 if (copy_from_user(fp, fprog->filter, fp_size))
374 goto free_prog;
375
376 /* Check and rewrite the fprog via the skb checker */
377 ret = bpf_check_classic(fp, fprog->len);
378 if (ret)
379 goto free_prog;
380
381 /* Check and rewrite the fprog for seccomp use */
382 ret = seccomp_check_filter(fp, fprog->len);
383 if (ret)
384 goto free_prog;
385
386 /* Convert 'sock_filter' insns to 'bpf_insn' insns */
387 ret = bpf_convert_filter(fp, fprog->len, NULL, &new_len);
388 if (ret)
389 goto free_prog;
390
391 /* Allocate a new seccomp_filter */
392 ret = -ENOMEM;
393 filter = kzalloc(sizeof(struct seccomp_filter),
394 GFP_KERNEL|__GFP_NOWARN);
395 if (!filter)
396 goto free_prog;
397
398 filter->prog = kzalloc(bpf_prog_size(new_len),
399 GFP_KERNEL|__GFP_NOWARN);
400 if (!filter->prog)
401 goto free_filter;
402
403 ret = bpf_convert_filter(fp, fprog->len, filter->prog->insnsi, &new_len);
404 if (ret)
405 goto free_filter_prog;
406 kfree(fp);
407
408 atomic_set(&filter->usage, 1);
409 filter->prog->len = new_len;
410
411 bpf_prog_select_runtime(filter->prog);
412
413 return filter;
414
415free_filter_prog:
416 kfree(filter->prog);
417free_filter:
418 kfree(filter);
419free_prog:
420 kfree(fp);
421 return ERR_PTR(ret);
422}
423
424/**
425 * seccomp_prepare_user_filter - prepares a user-supplied sock_fprog
426 * @user_filter: pointer to the user data containing a sock_fprog.
427 *
428 * Returns 0 on success and non-zero otherwise.
429 */
430static struct seccomp_filter *
431seccomp_prepare_user_filter(const char __user *user_filter)
432{
433 struct sock_fprog fprog;
434 struct seccomp_filter *filter = ERR_PTR(-EFAULT);
435
436#ifdef CONFIG_COMPAT
437 if (is_compat_task()) {
438 struct compat_sock_fprog fprog32;
439 if (copy_from_user(&fprog32, user_filter, sizeof(fprog32)))
440 goto out;
441 fprog.len = fprog32.len;
442 fprog.filter = compat_ptr(fprog32.filter);
443 } else /* falls through to the if below. */
444#endif
445 if (copy_from_user(&fprog, user_filter, sizeof(fprog)))
446 goto out;
447 filter = seccomp_prepare_filter(&fprog);
448out:
449 return filter;
450}
451
452/**
453 * seccomp_attach_filter: validate and attach filter
454 * @flags: flags to change filter behavior
455 * @filter: seccomp filter to add to the current process
456 *
457 * Caller must be holding current->sighand->siglock lock.
458 *
459 * Returns 0 on success, -ve on error.
460 */
461static long seccomp_attach_filter(unsigned int flags,
462 struct seccomp_filter *filter)
463{
464 unsigned long total_insns;
465 struct seccomp_filter *walker;
466
467 assert_spin_locked(&current->sighand->siglock);
468
469 /* Validate resulting filter length. */
470 total_insns = filter->prog->len;
471 for (walker = current->seccomp.filter; walker; walker = walker->prev)
472 total_insns += walker->prog->len + 4; /* 4 instr penalty */
473 if (total_insns > MAX_INSNS_PER_PATH)
474 return -ENOMEM;
475
476 /* If thread sync has been requested, check that it is possible. */
477 if (flags & SECCOMP_FILTER_FLAG_TSYNC) {
478 int ret;
479
480 ret = seccomp_can_sync_threads();
481 if (ret)
482 return ret;
483 }
484
485 /*
486 * If there is an existing filter, make it the prev and don't drop its
487 * task reference.
488 */
489 filter->prev = current->seccomp.filter;
490 current->seccomp.filter = filter;
491
492 /* Now that the new filter is in place, synchronize to all threads. */
493 if (flags & SECCOMP_FILTER_FLAG_TSYNC)
494 seccomp_sync_threads();
495
496 return 0;
497}
498
499/* get_seccomp_filter - increments the reference count of the filter on @tsk */
500void get_seccomp_filter(struct task_struct *tsk)
501{
502 struct seccomp_filter *orig = tsk->seccomp.filter;
503 if (!orig)
504 return;
505 /* Reference count is bounded by the number of total processes. */
506 atomic_inc(&orig->usage);
507}
508
509static inline void seccomp_filter_free(struct seccomp_filter *filter)
510{
511 if (filter) {
512 bpf_prog_free(filter->prog);
513 kfree(filter);
514 }
515}
516
517/* put_seccomp_filter - decrements the ref count of tsk->seccomp.filter */
518void put_seccomp_filter(struct task_struct *tsk)
519{
520 struct seccomp_filter *orig = tsk->seccomp.filter;
521 /* Clean up single-reference branches iteratively. */
522 while (orig && atomic_dec_and_test(&orig->usage)) {
523 struct seccomp_filter *freeme = orig;
524 orig = orig->prev;
525 seccomp_filter_free(freeme);
526 }
527}
528
529/**
530 * seccomp_send_sigsys - signals the task to allow in-process syscall emulation
531 * @syscall: syscall number to send to userland
532 * @reason: filter-supplied reason code to send to userland (via si_errno)
533 *
534 * Forces a SIGSYS with a code of SYS_SECCOMP and related sigsys info.
535 */
536static void seccomp_send_sigsys(int syscall, int reason)
537{
538 struct siginfo info;
539 memset(&info, 0, sizeof(info));
540 info.si_signo = SIGSYS;
541 info.si_code = SYS_SECCOMP;
542 info.si_call_addr = (void __user *)KSTK_EIP(current);
543 info.si_errno = reason;
544 info.si_arch = syscall_get_arch();
545 info.si_syscall = syscall;
546 force_sig_info(SIGSYS, &info, current);
547}
548#endif /* CONFIG_SECCOMP_FILTER */
549
550/*
551 * Secure computing mode 1 allows only read/write/exit/sigreturn.
552 * To be fully secure this must be combined with rlimit
553 * to limit the stack allocations too.
554 */
555static int mode1_syscalls[] = {
556 __NR_seccomp_read, __NR_seccomp_write, __NR_seccomp_exit, __NR_seccomp_sigreturn,
557 0, /* null terminated */
558};
559
560#ifdef CONFIG_COMPAT
561static int mode1_syscalls_32[] = {
562 __NR_seccomp_read_32, __NR_seccomp_write_32, __NR_seccomp_exit_32, __NR_seccomp_sigreturn_32,
563 0, /* null terminated */
564};
565#endif
566
567int __secure_computing(int this_syscall)
568{
569 int exit_sig = 0;
570 int *syscall;
571 u32 ret;
572
573 /*
574 * Make sure that any changes to mode from another thread have
575 * been seen after TIF_SECCOMP was seen.
576 */
577 rmb();
578
579 switch (current->seccomp.mode) {
580 case SECCOMP_MODE_STRICT:
581 syscall = mode1_syscalls;
582#ifdef CONFIG_COMPAT
583 if (is_compat_task())
584 syscall = mode1_syscalls_32;
585#endif
586 do {
587 if (*syscall == this_syscall)
588 return 0;
589 } while (*++syscall);
590 exit_sig = SIGKILL;
591 ret = SECCOMP_RET_KILL;
592 break;
593#ifdef CONFIG_SECCOMP_FILTER
594 case SECCOMP_MODE_FILTER: {
595 int data;
596 struct pt_regs *regs = task_pt_regs(current);
597 ret = seccomp_run_filters(this_syscall);
598 data = ret & SECCOMP_RET_DATA;
599 ret &= SECCOMP_RET_ACTION;
600 switch (ret) {
601 case SECCOMP_RET_ERRNO:
602 /* Set the low-order 16-bits as a errno. */
603 syscall_set_return_value(current, regs,
604 -data, 0);
605 goto skip;
606 case SECCOMP_RET_TRAP:
607 /* Show the handler the original registers. */
608 syscall_rollback(current, regs);
609 /* Let the filter pass back 16 bits of data. */
610 seccomp_send_sigsys(this_syscall, data);
611 goto skip;
612 case SECCOMP_RET_TRACE:
613 /* Skip these calls if there is no tracer. */
614 if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP)) {
615 syscall_set_return_value(current, regs,
616 -ENOSYS, 0);
617 goto skip;
618 }
619 /* Allow the BPF to provide the event message */
620 ptrace_event(PTRACE_EVENT_SECCOMP, data);
621 /*
622 * The delivery of a fatal signal during event
623 * notification may silently skip tracer notification.
624 * Terminating the task now avoids executing a system
625 * call that may not be intended.
626 */
627 if (fatal_signal_pending(current))
628 break;
629 if (syscall_get_nr(current, regs) < 0)
630 goto skip; /* Explicit request to skip. */
631
632 return 0;
633 case SECCOMP_RET_ALLOW:
634 return 0;
635 case SECCOMP_RET_KILL:
636 default:
637 break;
638 }
639 exit_sig = SIGSYS;
640 break;
641 }
642#endif
643 default:
644 BUG();
645 }
646
647#ifdef SECCOMP_DEBUG
648 dump_stack();
649#endif
650 audit_seccomp(this_syscall, exit_sig, ret);
651 do_exit(exit_sig);
652#ifdef CONFIG_SECCOMP_FILTER
653skip:
654 audit_seccomp(this_syscall, exit_sig, ret);
655#endif
656 return -1;
657}
658
659long prctl_get_seccomp(void)
660{
661 return current->seccomp.mode;
662}
663
664/**
665 * seccomp_set_mode_strict: internal function for setting strict seccomp
666 *
667 * Once current->seccomp.mode is non-zero, it may not be changed.
668 *
669 * Returns 0 on success or -EINVAL on failure.
670 */
671static long seccomp_set_mode_strict(void)
672{
673 const unsigned long seccomp_mode = SECCOMP_MODE_STRICT;
674 long ret = -EINVAL;
675
676 spin_lock_irq(&current->sighand->siglock);
677
678 if (!seccomp_may_assign_mode(seccomp_mode))
679 goto out;
680
681#ifdef TIF_NOTSC
682 disable_TSC();
683#endif
684 seccomp_assign_mode(current, seccomp_mode);
685 ret = 0;
686
687out:
688 spin_unlock_irq(&current->sighand->siglock);
689
690 return ret;
691}
692
693#ifdef CONFIG_SECCOMP_FILTER
694/**
695 * seccomp_set_mode_filter: internal function for setting seccomp filter
696 * @flags: flags to change filter behavior
697 * @filter: struct sock_fprog containing filter
698 *
699 * This function may be called repeatedly to install additional filters.
700 * Every filter successfully installed will be evaluated (in reverse order)
701 * for each system call the task makes.
702 *
703 * Once current->seccomp.mode is non-zero, it may not be changed.
704 *
705 * Returns 0 on success or -EINVAL on failure.
706 */
707static long seccomp_set_mode_filter(unsigned int flags,
708 const char __user *filter)
709{
710 const unsigned long seccomp_mode = SECCOMP_MODE_FILTER;
711 struct seccomp_filter *prepared = NULL;
712 long ret = -EINVAL;
713
714 /* Validate flags. */
715 if (flags & ~SECCOMP_FILTER_FLAG_MASK)
716 return -EINVAL;
717
718 /* Prepare the new filter before holding any locks. */
719 prepared = seccomp_prepare_user_filter(filter);
720 if (IS_ERR(prepared))
721 return PTR_ERR(prepared);
722
723 /*
724 * Make sure we cannot change seccomp or nnp state via TSYNC
725 * while another thread is in the middle of calling exec.
726 */
727 if (flags & SECCOMP_FILTER_FLAG_TSYNC &&
728 mutex_lock_killable(&current->signal->cred_guard_mutex))
729 goto out_free;
730
731 spin_lock_irq(&current->sighand->siglock);
732
733 if (!seccomp_may_assign_mode(seccomp_mode))
734 goto out;
735
736 ret = seccomp_attach_filter(flags, prepared);
737 if (ret)
738 goto out;
739 /* Do not free the successfully attached filter. */
740 prepared = NULL;
741
742 seccomp_assign_mode(current, seccomp_mode);
743out:
744 spin_unlock_irq(&current->sighand->siglock);
745 if (flags & SECCOMP_FILTER_FLAG_TSYNC)
746 mutex_unlock(&current->signal->cred_guard_mutex);
747out_free:
748 seccomp_filter_free(prepared);
749 return ret;
750}
751#else
752static inline long seccomp_set_mode_filter(unsigned int flags,
753 const char __user *filter)
754{
755 return -EINVAL;
756}
757#endif
758
759/* Common entry point for both prctl and syscall. */
760static long do_seccomp(unsigned int op, unsigned int flags,
761 const char __user *uargs)
762{
763 switch (op) {
764 case SECCOMP_SET_MODE_STRICT:
765 if (flags != 0 || uargs != NULL)
766 return -EINVAL;
767 return seccomp_set_mode_strict();
768 case SECCOMP_SET_MODE_FILTER:
769 return seccomp_set_mode_filter(flags, uargs);
770 default:
771 return -EINVAL;
772 }
773}
774
775SYSCALL_DEFINE3(seccomp, unsigned int, op, unsigned int, flags,
776 const char __user *, uargs)
777{
778 return do_seccomp(op, flags, uargs);
779}
780
781/**
782 * prctl_set_seccomp: configures current->seccomp.mode
783 * @seccomp_mode: requested mode to use
784 * @filter: optional struct sock_fprog for use with SECCOMP_MODE_FILTER
785 *
786 * Returns 0 on success or -EINVAL on failure.
787 */
788long prctl_set_seccomp(unsigned long seccomp_mode, char __user *filter)
789{
790 unsigned int op;
791 char __user *uargs;
792
793 switch (seccomp_mode) {
794 case SECCOMP_MODE_STRICT:
795 op = SECCOMP_SET_MODE_STRICT;
796 /*
797 * Setting strict mode through prctl always ignored filter,
798 * so make sure it is always NULL here to pass the internal
799 * check in do_seccomp().
800 */
801 uargs = NULL;
802 break;
803 case SECCOMP_MODE_FILTER:
804 op = SECCOMP_SET_MODE_FILTER;
805 uargs = filter;
806 break;
807 default:
808 return -EINVAL;
809 }
810
811 /* prctl interface doesn't have flags, so they are always zero. */
812 return do_seccomp(op, 0, uargs);
813}