projects/linux·blob v5.6 · refs

1829 lines · 46.2 KiB

1// SPDX-License-Identifier: GPL-2.0
2/*
3 * linux/kernel/seccomp.c
4 *
5 * Copyright 2004-2005 Andrea Arcangeli <[email protected]>
6 *
7 * Copyright (C) 2012 Google, Inc.
8 * Will Drewry <[email protected]>
9 *
10 * This defines a simple but solid secure-computing facility.
11 *
12 * Mode 1 uses a fixed list of allowed system calls.
13 * Mode 2 allows user-defined system call filters in the form
14 * of Berkeley Packet Filters/Linux Socket Filters.
15 */
16
17#include <linux/refcount.h>
18#include <linux/audit.h>
19#include <linux/compat.h>
20#include <linux/coredump.h>
21#include <linux/kmemleak.h>
22#include <linux/nospec.h>
23#include <linux/prctl.h>
24#include <linux/sched.h>
25#include <linux/sched/task_stack.h>
26#include <linux/seccomp.h>
27#include <linux/slab.h>
28#include <linux/syscalls.h>
29#include <linux/sysctl.h>
30
31#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
32#include <asm/syscall.h>
33#endif
34
35#ifdef CONFIG_SECCOMP_FILTER
36#include <linux/file.h>
37#include <linux/filter.h>
38#include <linux/pid.h>
39#include <linux/ptrace.h>
40#include <linux/security.h>
41#include <linux/tracehook.h>
42#include <linux/uaccess.h>
43#include <linux/anon_inodes.h>
44
45enum notify_state {
46 SECCOMP_NOTIFY_INIT,
47 SECCOMP_NOTIFY_SENT,
48 SECCOMP_NOTIFY_REPLIED,
49};
50
51struct seccomp_knotif {
52 /* The struct pid of the task whose filter triggered the notification */
53 struct task_struct *task;
54
55 /* The "cookie" for this request; this is unique for this filter. */
56 u64 id;
57
58 /*
59 * The seccomp data. This pointer is valid the entire time this
60 * notification is active, since it comes from __seccomp_filter which
61 * eclipses the entire lifecycle here.
62 */
63 const struct seccomp_data *data;
64
65 /*
66 * Notification states. When SECCOMP_RET_USER_NOTIF is returned, a
67 * struct seccomp_knotif is created and starts out in INIT. Once the
68 * handler reads the notification off of an FD, it transitions to SENT.
69 * If a signal is received the state transitions back to INIT and
70 * another message is sent. When the userspace handler replies, state
71 * transitions to REPLIED.
72 */
73 enum notify_state state;
74
75 /* The return values, only valid when in SECCOMP_NOTIFY_REPLIED */
76 int error;
77 long val;
78 u32 flags;
79
80 /* Signals when this has entered SECCOMP_NOTIFY_REPLIED */
81 struct completion ready;
82
83 struct list_head list;
84};
85
86/**
87 * struct notification - container for seccomp userspace notifications. Since
88 * most seccomp filters will not have notification listeners attached and this
89 * structure is fairly large, we store the notification-specific stuff in a
90 * separate structure.
91 *
92 * @request: A semaphore that users of this notification can wait on for
93 * changes. Actual reads and writes are still controlled with
94 * filter->notify_lock.
95 * @next_id: The id of the next request.
96 * @notifications: A list of struct seccomp_knotif elements.
97 * @wqh: A wait queue for poll.
98 */
99struct notification {
100 struct semaphore request;
101 u64 next_id;
102 struct list_head notifications;
103 wait_queue_head_t wqh;
104};
105
106/**
107 * struct seccomp_filter - container for seccomp BPF programs
108 *
109 * @usage: reference count to manage the object lifetime.
110 * get/put helpers should be used when accessing an instance
111 * outside of a lifetime-guarded section. In general, this
112 * is only needed for handling filters shared across tasks.
113 * @log: true if all actions except for SECCOMP_RET_ALLOW should be logged
114 * @prev: points to a previously installed, or inherited, filter
115 * @prog: the BPF program to evaluate
116 * @notif: the struct that holds all notification related information
117 * @notify_lock: A lock for all notification-related accesses.
118 *
119 * seccomp_filter objects are organized in a tree linked via the @prev
120 * pointer. For any task, it appears to be a singly-linked list starting
121 * with current->seccomp.filter, the most recently attached or inherited filter.
122 * However, multiple filters may share a @prev node, by way of fork(), which
123 * results in a unidirectional tree existing in memory. This is similar to
124 * how namespaces work.
125 *
126 * seccomp_filter objects should never be modified after being attached
127 * to a task_struct (other than @usage).
128 */
129struct seccomp_filter {
130 refcount_t usage;
131 bool log;
132 struct seccomp_filter *prev;
133 struct bpf_prog *prog;
134 struct notification *notif;
135 struct mutex notify_lock;
136};
137
138/* Limit any path through the tree to 256KB worth of instructions. */
139#define MAX_INSNS_PER_PATH ((1 << 18) / sizeof(struct sock_filter))
140
141/*
142 * Endianness is explicitly ignored and left for BPF program authors to manage
143 * as per the specific architecture.
144 */
145static void populate_seccomp_data(struct seccomp_data *sd)
146{
147 struct task_struct *task = current;
148 struct pt_regs *regs = task_pt_regs(task);
149 unsigned long args[6];
150
151 sd->nr = syscall_get_nr(task, regs);
152 sd->arch = syscall_get_arch(task);
153 syscall_get_arguments(task, regs, args);
154 sd->args[0] = args[0];
155 sd->args[1] = args[1];
156 sd->args[2] = args[2];
157 sd->args[3] = args[3];
158 sd->args[4] = args[4];
159 sd->args[5] = args[5];
160 sd->instruction_pointer = KSTK_EIP(task);
161}
162
163/**
164 * seccomp_check_filter - verify seccomp filter code
165 * @filter: filter to verify
166 * @flen: length of filter
167 *
168 * Takes a previously checked filter (by bpf_check_classic) and
169 * redirects all filter code that loads struct sk_buff data
170 * and related data through seccomp_bpf_load. It also
171 * enforces length and alignment checking of those loads.
172 *
173 * Returns 0 if the rule set is legal or -EINVAL if not.
174 */
175static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen)
176{
177 int pc;
178 for (pc = 0; pc < flen; pc++) {
179 struct sock_filter *ftest = &filter[pc];
180 u16 code = ftest->code;
181 u32 k = ftest->k;
182
183 switch (code) {
184 case BPF_LD | BPF_W | BPF_ABS:
185 ftest->code = BPF_LDX | BPF_W | BPF_ABS;
186 /* 32-bit aligned and not out of bounds. */
187 if (k >= sizeof(struct seccomp_data) || k & 3)
188 return -EINVAL;
189 continue;
190 case BPF_LD | BPF_W | BPF_LEN:
191 ftest->code = BPF_LD | BPF_IMM;
192 ftest->k = sizeof(struct seccomp_data);
193 continue;
194 case BPF_LDX | BPF_W | BPF_LEN:
195 ftest->code = BPF_LDX | BPF_IMM;
196 ftest->k = sizeof(struct seccomp_data);
197 continue;
198 /* Explicitly include allowed calls. */
199 case BPF_RET | BPF_K:
200 case BPF_RET | BPF_A:
201 case BPF_ALU | BPF_ADD | BPF_K:
202 case BPF_ALU | BPF_ADD | BPF_X:
203 case BPF_ALU | BPF_SUB | BPF_K:
204 case BPF_ALU | BPF_SUB | BPF_X:
205 case BPF_ALU | BPF_MUL | BPF_K:
206 case BPF_ALU | BPF_MUL | BPF_X:
207 case BPF_ALU | BPF_DIV | BPF_K:
208 case BPF_ALU | BPF_DIV | BPF_X:
209 case BPF_ALU | BPF_AND | BPF_K:
210 case BPF_ALU | BPF_AND | BPF_X:
211 case BPF_ALU | BPF_OR | BPF_K:
212 case BPF_ALU | BPF_OR | BPF_X:
213 case BPF_ALU | BPF_XOR | BPF_K:
214 case BPF_ALU | BPF_XOR | BPF_X:
215 case BPF_ALU | BPF_LSH | BPF_K:
216 case BPF_ALU | BPF_LSH | BPF_X:
217 case BPF_ALU | BPF_RSH | BPF_K:
218 case BPF_ALU | BPF_RSH | BPF_X:
219 case BPF_ALU | BPF_NEG:
220 case BPF_LD | BPF_IMM:
221 case BPF_LDX | BPF_IMM:
222 case BPF_MISC | BPF_TAX:
223 case BPF_MISC | BPF_TXA:
224 case BPF_LD | BPF_MEM:
225 case BPF_LDX | BPF_MEM:
226 case BPF_ST:
227 case BPF_STX:
228 case BPF_JMP | BPF_JA:
229 case BPF_JMP | BPF_JEQ | BPF_K:
230 case BPF_JMP | BPF_JEQ | BPF_X:
231 case BPF_JMP | BPF_JGE | BPF_K:
232 case BPF_JMP | BPF_JGE | BPF_X:
233 case BPF_JMP | BPF_JGT | BPF_K:
234 case BPF_JMP | BPF_JGT | BPF_X:
235 case BPF_JMP | BPF_JSET | BPF_K:
236 case BPF_JMP | BPF_JSET | BPF_X:
237 continue;
238 default:
239 return -EINVAL;
240 }
241 }
242 return 0;
243}
244
245/**
246 * seccomp_run_filters - evaluates all seccomp filters against @sd
247 * @sd: optional seccomp data to be passed to filters
248 * @match: stores struct seccomp_filter that resulted in the return value,
249 * unless filter returned SECCOMP_RET_ALLOW, in which case it will
250 * be unchanged.
251 *
252 * Returns valid seccomp BPF response codes.
253 */
254#define ACTION_ONLY(ret) ((s32)((ret) & (SECCOMP_RET_ACTION_FULL)))
255static u32 seccomp_run_filters(const struct seccomp_data *sd,
256 struct seccomp_filter **match)
257{
258 u32 ret = SECCOMP_RET_ALLOW;
259 /* Make sure cross-thread synced filter points somewhere sane. */
260 struct seccomp_filter *f =
261 READ_ONCE(current->seccomp.filter);
262
263 /* Ensure unexpected behavior doesn't result in failing open. */
264 if (WARN_ON(f == NULL))
265 return SECCOMP_RET_KILL_PROCESS;
266
267 /*
268 * All filters in the list are evaluated and the lowest BPF return
269 * value always takes priority (ignoring the DATA).
270 */
271 preempt_disable();
272 for (; f; f = f->prev) {
273 u32 cur_ret = BPF_PROG_RUN(f->prog, sd);
274
275 if (ACTION_ONLY(cur_ret) < ACTION_ONLY(ret)) {
276 ret = cur_ret;
277 *match = f;
278 }
279 }
280 preempt_enable();
281 return ret;
282}
283#endif /* CONFIG_SECCOMP_FILTER */
284
285static inline bool seccomp_may_assign_mode(unsigned long seccomp_mode)
286{
287 assert_spin_locked(&current->sighand->siglock);
288
289 if (current->seccomp.mode && current->seccomp.mode != seccomp_mode)
290 return false;
291
292 return true;
293}
294
295void __weak arch_seccomp_spec_mitigate(struct task_struct *task) { }
296
297static inline void seccomp_assign_mode(struct task_struct *task,
298 unsigned long seccomp_mode,
299 unsigned long flags)
300{
301 assert_spin_locked(&task->sighand->siglock);
302
303 task->seccomp.mode = seccomp_mode;
304 /*
305 * Make sure TIF_SECCOMP cannot be set before the mode (and
306 * filter) is set.
307 */
308 smp_mb__before_atomic();
309 /* Assume default seccomp processes want spec flaw mitigation. */
310 if ((flags & SECCOMP_FILTER_FLAG_SPEC_ALLOW) == 0)
311 arch_seccomp_spec_mitigate(task);
312 set_tsk_thread_flag(task, TIF_SECCOMP);
313}
314
315#ifdef CONFIG_SECCOMP_FILTER
316/* Returns 1 if the parent is an ancestor of the child. */
317static int is_ancestor(struct seccomp_filter *parent,
318 struct seccomp_filter *child)
319{
320 /* NULL is the root ancestor. */
321 if (parent == NULL)
322 return 1;
323 for (; child; child = child->prev)
324 if (child == parent)
325 return 1;
326 return 0;
327}
328
329/**
330 * seccomp_can_sync_threads: checks if all threads can be synchronized
331 *
332 * Expects sighand and cred_guard_mutex locks to be held.
333 *
334 * Returns 0 on success, -ve on error, or the pid of a thread which was
335 * either not in the correct seccomp mode or did not have an ancestral
336 * seccomp filter.
337 */
338static inline pid_t seccomp_can_sync_threads(void)
339{
340 struct task_struct *thread, *caller;
341
342 BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
343 assert_spin_locked(&current->sighand->siglock);
344
345 /* Validate all threads being eligible for synchronization. */
346 caller = current;
347 for_each_thread(caller, thread) {
348 pid_t failed;
349
350 /* Skip current, since it is initiating the sync. */
351 if (thread == caller)
352 continue;
353
354 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED ||
355 (thread->seccomp.mode == SECCOMP_MODE_FILTER &&
356 is_ancestor(thread->seccomp.filter,
357 caller->seccomp.filter)))
358 continue;
359
360 /* Return the first thread that cannot be synchronized. */
361 failed = task_pid_vnr(thread);
362 /* If the pid cannot be resolved, then return -ESRCH */
363 if (WARN_ON(failed == 0))
364 failed = -ESRCH;
365 return failed;
366 }
367
368 return 0;
369}
370
371/**
372 * seccomp_sync_threads: sets all threads to use current's filter
373 *
374 * Expects sighand and cred_guard_mutex locks to be held, and for
375 * seccomp_can_sync_threads() to have returned success already
376 * without dropping the locks.
377 *
378 */
379static inline void seccomp_sync_threads(unsigned long flags)
380{
381 struct task_struct *thread, *caller;
382
383 BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
384 assert_spin_locked(&current->sighand->siglock);
385
386 /* Synchronize all threads. */
387 caller = current;
388 for_each_thread(caller, thread) {
389 /* Skip current, since it needs no changes. */
390 if (thread == caller)
391 continue;
392
393 /* Get a task reference for the new leaf node. */
394 get_seccomp_filter(caller);
395 /*
396 * Drop the task reference to the shared ancestor since
397 * current's path will hold a reference. (This also
398 * allows a put before the assignment.)
399 */
400 put_seccomp_filter(thread);
401 smp_store_release(&thread->seccomp.filter,
402 caller->seccomp.filter);
403
404 /*
405 * Don't let an unprivileged task work around
406 * the no_new_privs restriction by creating
407 * a thread that sets it up, enters seccomp,
408 * then dies.
409 */
410 if (task_no_new_privs(caller))
411 task_set_no_new_privs(thread);
412
413 /*
414 * Opt the other thread into seccomp if needed.
415 * As threads are considered to be trust-realm
416 * equivalent (see ptrace_may_access), it is safe to
417 * allow one thread to transition the other.
418 */
419 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED)
420 seccomp_assign_mode(thread, SECCOMP_MODE_FILTER,
421 flags);
422 }
423}
424
425/**
426 * seccomp_prepare_filter: Prepares a seccomp filter for use.
427 * @fprog: BPF program to install
428 *
429 * Returns filter on success or an ERR_PTR on failure.
430 */
431static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog)
432{
433 struct seccomp_filter *sfilter;
434 int ret;
435 const bool save_orig = IS_ENABLED(CONFIG_CHECKPOINT_RESTORE);
436
437 if (fprog->len == 0 || fprog->len > BPF_MAXINSNS)
438 return ERR_PTR(-EINVAL);
439
440 BUG_ON(INT_MAX / fprog->len < sizeof(struct sock_filter));
441
442 /*
443 * Installing a seccomp filter requires that the task has
444 * CAP_SYS_ADMIN in its namespace or be running with no_new_privs.
445 * This avoids scenarios where unprivileged tasks can affect the
446 * behavior of privileged children.
447 */
448 if (!task_no_new_privs(current) &&
449 security_capable(current_cred(), current_user_ns(),
450 CAP_SYS_ADMIN, CAP_OPT_NOAUDIT) != 0)
451 return ERR_PTR(-EACCES);
452
453 /* Allocate a new seccomp_filter */
454 sfilter = kzalloc(sizeof(*sfilter), GFP_KERNEL | __GFP_NOWARN);
455 if (!sfilter)
456 return ERR_PTR(-ENOMEM);
457
458 mutex_init(&sfilter->notify_lock);
459 ret = bpf_prog_create_from_user(&sfilter->prog, fprog,
460 seccomp_check_filter, save_orig);
461 if (ret < 0) {
462 kfree(sfilter);
463 return ERR_PTR(ret);
464 }
465
466 refcount_set(&sfilter->usage, 1);
467
468 return sfilter;
469}
470
471/**
472 * seccomp_prepare_user_filter - prepares a user-supplied sock_fprog
473 * @user_filter: pointer to the user data containing a sock_fprog.
474 *
475 * Returns 0 on success and non-zero otherwise.
476 */
477static struct seccomp_filter *
478seccomp_prepare_user_filter(const char __user *user_filter)
479{
480 struct sock_fprog fprog;
481 struct seccomp_filter *filter = ERR_PTR(-EFAULT);
482
483#ifdef CONFIG_COMPAT
484 if (in_compat_syscall()) {
485 struct compat_sock_fprog fprog32;
486 if (copy_from_user(&fprog32, user_filter, sizeof(fprog32)))
487 goto out;
488 fprog.len = fprog32.len;
489 fprog.filter = compat_ptr(fprog32.filter);
490 } else /* falls through to the if below. */
491#endif
492 if (copy_from_user(&fprog, user_filter, sizeof(fprog)))
493 goto out;
494 filter = seccomp_prepare_filter(&fprog);
495out:
496 return filter;
497}
498
499/**
500 * seccomp_attach_filter: validate and attach filter
501 * @flags: flags to change filter behavior
502 * @filter: seccomp filter to add to the current process
503 *
504 * Caller must be holding current->sighand->siglock lock.
505 *
506 * Returns 0 on success, -ve on error, or
507 * - in TSYNC mode: the pid of a thread which was either not in the correct
508 * seccomp mode or did not have an ancestral seccomp filter
509 * - in NEW_LISTENER mode: the fd of the new listener
510 */
511static long seccomp_attach_filter(unsigned int flags,
512 struct seccomp_filter *filter)
513{
514 unsigned long total_insns;
515 struct seccomp_filter *walker;
516
517 assert_spin_locked(&current->sighand->siglock);
518
519 /* Validate resulting filter length. */
520 total_insns = filter->prog->len;
521 for (walker = current->seccomp.filter; walker; walker = walker->prev)
522 total_insns += walker->prog->len + 4; /* 4 instr penalty */
523 if (total_insns > MAX_INSNS_PER_PATH)
524 return -ENOMEM;
525
526 /* If thread sync has been requested, check that it is possible. */
527 if (flags & SECCOMP_FILTER_FLAG_TSYNC) {
528 int ret;
529
530 ret = seccomp_can_sync_threads();
531 if (ret)
532 return ret;
533 }
534
535 /* Set log flag, if present. */
536 if (flags & SECCOMP_FILTER_FLAG_LOG)
537 filter->log = true;
538
539 /*
540 * If there is an existing filter, make it the prev and don't drop its
541 * task reference.
542 */
543 filter->prev = current->seccomp.filter;
544 current->seccomp.filter = filter;
545
546 /* Now that the new filter is in place, synchronize to all threads. */
547 if (flags & SECCOMP_FILTER_FLAG_TSYNC)
548 seccomp_sync_threads(flags);
549
550 return 0;
551}
552
553static void __get_seccomp_filter(struct seccomp_filter *filter)
554{
555 refcount_inc(&filter->usage);
556}
557
558/* get_seccomp_filter - increments the reference count of the filter on @tsk */
559void get_seccomp_filter(struct task_struct *tsk)
560{
561 struct seccomp_filter *orig = tsk->seccomp.filter;
562 if (!orig)
563 return;
564 __get_seccomp_filter(orig);
565}
566
567static inline void seccomp_filter_free(struct seccomp_filter *filter)
568{
569 if (filter) {
570 bpf_prog_destroy(filter->prog);
571 kfree(filter);
572 }
573}
574
575static void __put_seccomp_filter(struct seccomp_filter *orig)
576{
577 /* Clean up single-reference branches iteratively. */
578 while (orig && refcount_dec_and_test(&orig->usage)) {
579 struct seccomp_filter *freeme = orig;
580 orig = orig->prev;
581 seccomp_filter_free(freeme);
582 }
583}
584
585/* put_seccomp_filter - decrements the ref count of tsk->seccomp.filter */
586void put_seccomp_filter(struct task_struct *tsk)
587{
588 __put_seccomp_filter(tsk->seccomp.filter);
589}
590
591static void seccomp_init_siginfo(kernel_siginfo_t *info, int syscall, int reason)
592{
593 clear_siginfo(info);
594 info->si_signo = SIGSYS;
595 info->si_code = SYS_SECCOMP;
596 info->si_call_addr = (void __user *)KSTK_EIP(current);
597 info->si_errno = reason;
598 info->si_arch = syscall_get_arch(current);
599 info->si_syscall = syscall;
600}
601
602/**
603 * seccomp_send_sigsys - signals the task to allow in-process syscall emulation
604 * @syscall: syscall number to send to userland
605 * @reason: filter-supplied reason code to send to userland (via si_errno)
606 *
607 * Forces a SIGSYS with a code of SYS_SECCOMP and related sigsys info.
608 */
609static void seccomp_send_sigsys(int syscall, int reason)
610{
611 struct kernel_siginfo info;
612 seccomp_init_siginfo(&info, syscall, reason);
613 force_sig_info(&info);
614}
615#endif /* CONFIG_SECCOMP_FILTER */
616
617/* For use with seccomp_actions_logged */
618#define SECCOMP_LOG_KILL_PROCESS (1 << 0)
619#define SECCOMP_LOG_KILL_THREAD (1 << 1)
620#define SECCOMP_LOG_TRAP (1 << 2)
621#define SECCOMP_LOG_ERRNO (1 << 3)
622#define SECCOMP_LOG_TRACE (1 << 4)
623#define SECCOMP_LOG_LOG (1 << 5)
624#define SECCOMP_LOG_ALLOW (1 << 6)
625#define SECCOMP_LOG_USER_NOTIF (1 << 7)
626
627static u32 seccomp_actions_logged = SECCOMP_LOG_KILL_PROCESS |
628 SECCOMP_LOG_KILL_THREAD |
629 SECCOMP_LOG_TRAP |
630 SECCOMP_LOG_ERRNO |
631 SECCOMP_LOG_USER_NOTIF |
632 SECCOMP_LOG_TRACE |
633 SECCOMP_LOG_LOG;
634
635static inline void seccomp_log(unsigned long syscall, long signr, u32 action,
636 bool requested)
637{
638 bool log = false;
639
640 switch (action) {
641 case SECCOMP_RET_ALLOW:
642 break;
643 case SECCOMP_RET_TRAP:
644 log = requested && seccomp_actions_logged & SECCOMP_LOG_TRAP;
645 break;
646 case SECCOMP_RET_ERRNO:
647 log = requested && seccomp_actions_logged & SECCOMP_LOG_ERRNO;
648 break;
649 case SECCOMP_RET_TRACE:
650 log = requested && seccomp_actions_logged & SECCOMP_LOG_TRACE;
651 break;
652 case SECCOMP_RET_USER_NOTIF:
653 log = requested && seccomp_actions_logged & SECCOMP_LOG_USER_NOTIF;
654 break;
655 case SECCOMP_RET_LOG:
656 log = seccomp_actions_logged & SECCOMP_LOG_LOG;
657 break;
658 case SECCOMP_RET_KILL_THREAD:
659 log = seccomp_actions_logged & SECCOMP_LOG_KILL_THREAD;
660 break;
661 case SECCOMP_RET_KILL_PROCESS:
662 default:
663 log = seccomp_actions_logged & SECCOMP_LOG_KILL_PROCESS;
664 }
665
666 /*
667 * Emit an audit message when the action is RET_KILL_*, RET_LOG, or the
668 * FILTER_FLAG_LOG bit was set. The admin has the ability to silence
669 * any action from being logged by removing the action name from the
670 * seccomp_actions_logged sysctl.
671 */
672 if (!log)
673 return;
674
675 audit_seccomp(syscall, signr, action);
676}
677
678/*
679 * Secure computing mode 1 allows only read/write/exit/sigreturn.
680 * To be fully secure this must be combined with rlimit
681 * to limit the stack allocations too.
682 */
683static const int mode1_syscalls[] = {
684 __NR_seccomp_read, __NR_seccomp_write, __NR_seccomp_exit, __NR_seccomp_sigreturn,
685 0, /* null terminated */
686};
687
688static void __secure_computing_strict(int this_syscall)
689{
690 const int *syscall_whitelist = mode1_syscalls;
691#ifdef CONFIG_COMPAT
692 if (in_compat_syscall())
693 syscall_whitelist = get_compat_mode1_syscalls();
694#endif
695 do {
696 if (*syscall_whitelist == this_syscall)
697 return;
698 } while (*++syscall_whitelist);
699
700#ifdef SECCOMP_DEBUG
701 dump_stack();
702#endif
703 seccomp_log(this_syscall, SIGKILL, SECCOMP_RET_KILL_THREAD, true);
704 do_exit(SIGKILL);
705}
706
707#ifndef CONFIG_HAVE_ARCH_SECCOMP_FILTER
708void secure_computing_strict(int this_syscall)
709{
710 int mode = current->seccomp.mode;
711
712 if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) &&
713 unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
714 return;
715
716 if (mode == SECCOMP_MODE_DISABLED)
717 return;
718 else if (mode == SECCOMP_MODE_STRICT)
719 __secure_computing_strict(this_syscall);
720 else
721 BUG();
722}
723#else
724
725#ifdef CONFIG_SECCOMP_FILTER
726static u64 seccomp_next_notify_id(struct seccomp_filter *filter)
727{
728 /*
729 * Note: overflow is ok here, the id just needs to be unique per
730 * filter.
731 */
732 lockdep_assert_held(&filter->notify_lock);
733 return filter->notif->next_id++;
734}
735
736static int seccomp_do_user_notification(int this_syscall,
737 struct seccomp_filter *match,
738 const struct seccomp_data *sd)
739{
740 int err;
741 u32 flags = 0;
742 long ret = 0;
743 struct seccomp_knotif n = {};
744
745 mutex_lock(&match->notify_lock);
746 err = -ENOSYS;
747 if (!match->notif)
748 goto out;
749
750 n.task = current;
751 n.state = SECCOMP_NOTIFY_INIT;
752 n.data = sd;
753 n.id = seccomp_next_notify_id(match);
754 init_completion(&n.ready);
755 list_add(&n.list, &match->notif->notifications);
756
757 up(&match->notif->request);
758 wake_up_poll(&match->notif->wqh, EPOLLIN | EPOLLRDNORM);
759 mutex_unlock(&match->notify_lock);
760
761 /*
762 * This is where we wait for a reply from userspace.
763 */
764 err = wait_for_completion_interruptible(&n.ready);
765 mutex_lock(&match->notify_lock);
766 if (err == 0) {
767 ret = n.val;
768 err = n.error;
769 flags = n.flags;
770 }
771
772 /*
773 * Note that it's possible the listener died in between the time when
774 * we were notified of a respons (or a signal) and when we were able to
775 * re-acquire the lock, so only delete from the list if the
776 * notification actually exists.
777 *
778 * Also note that this test is only valid because there's no way to
779 * *reattach* to a notifier right now. If one is added, we'll need to
780 * keep track of the notif itself and make sure they match here.
781 */
782 if (match->notif)
783 list_del(&n.list);
784out:
785 mutex_unlock(&match->notify_lock);
786
787 /* Userspace requests to continue the syscall. */
788 if (flags & SECCOMP_USER_NOTIF_FLAG_CONTINUE)
789 return 0;
790
791 syscall_set_return_value(current, task_pt_regs(current),
792 err, ret);
793 return -1;
794}
795
796static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
797 const bool recheck_after_trace)
798{
799 u32 filter_ret, action;
800 struct seccomp_filter *match = NULL;
801 int data;
802 struct seccomp_data sd_local;
803
804 /*
805 * Make sure that any changes to mode from another thread have
806 * been seen after TIF_SECCOMP was seen.
807 */
808 rmb();
809
810 if (!sd) {
811 populate_seccomp_data(&sd_local);
812 sd = &sd_local;
813 }
814
815 filter_ret = seccomp_run_filters(sd, &match);
816 data = filter_ret & SECCOMP_RET_DATA;
817 action = filter_ret & SECCOMP_RET_ACTION_FULL;
818
819 switch (action) {
820 case SECCOMP_RET_ERRNO:
821 /* Set low-order bits as an errno, capped at MAX_ERRNO. */
822 if (data > MAX_ERRNO)
823 data = MAX_ERRNO;
824 syscall_set_return_value(current, task_pt_regs(current),
825 -data, 0);
826 goto skip;
827
828 case SECCOMP_RET_TRAP:
829 /* Show the handler the original registers. */
830 syscall_rollback(current, task_pt_regs(current));
831 /* Let the filter pass back 16 bits of data. */
832 seccomp_send_sigsys(this_syscall, data);
833 goto skip;
834
835 case SECCOMP_RET_TRACE:
836 /* We've been put in this state by the ptracer already. */
837 if (recheck_after_trace)
838 return 0;
839
840 /* ENOSYS these calls if there is no tracer attached. */
841 if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP)) {
842 syscall_set_return_value(current,
843 task_pt_regs(current),
844 -ENOSYS, 0);
845 goto skip;
846 }
847
848 /* Allow the BPF to provide the event message */
849 ptrace_event(PTRACE_EVENT_SECCOMP, data);
850 /*
851 * The delivery of a fatal signal during event
852 * notification may silently skip tracer notification,
853 * which could leave us with a potentially unmodified
854 * syscall that the tracer would have liked to have
855 * changed. Since the process is about to die, we just
856 * force the syscall to be skipped and let the signal
857 * kill the process and correctly handle any tracer exit
858 * notifications.
859 */
860 if (fatal_signal_pending(current))
861 goto skip;
862 /* Check if the tracer forced the syscall to be skipped. */
863 this_syscall = syscall_get_nr(current, task_pt_regs(current));
864 if (this_syscall < 0)
865 goto skip;
866
867 /*
868 * Recheck the syscall, since it may have changed. This
869 * intentionally uses a NULL struct seccomp_data to force
870 * a reload of all registers. This does not goto skip since
871 * a skip would have already been reported.
872 */
873 if (__seccomp_filter(this_syscall, NULL, true))
874 return -1;
875
876 return 0;
877
878 case SECCOMP_RET_USER_NOTIF:
879 if (seccomp_do_user_notification(this_syscall, match, sd))
880 goto skip;
881
882 return 0;
883
884 case SECCOMP_RET_LOG:
885 seccomp_log(this_syscall, 0, action, true);
886 return 0;
887
888 case SECCOMP_RET_ALLOW:
889 /*
890 * Note that the "match" filter will always be NULL for
891 * this action since SECCOMP_RET_ALLOW is the starting
892 * state in seccomp_run_filters().
893 */
894 return 0;
895
896 case SECCOMP_RET_KILL_THREAD:
897 case SECCOMP_RET_KILL_PROCESS:
898 default:
899 seccomp_log(this_syscall, SIGSYS, action, true);
900 /* Dump core only if this is the last remaining thread. */
901 if (action == SECCOMP_RET_KILL_PROCESS ||
902 get_nr_threads(current) == 1) {
903 kernel_siginfo_t info;
904
905 /* Show the original registers in the dump. */
906 syscall_rollback(current, task_pt_regs(current));
907 /* Trigger a manual coredump since do_exit skips it. */
908 seccomp_init_siginfo(&info, this_syscall, data);
909 do_coredump(&info);
910 }
911 if (action == SECCOMP_RET_KILL_PROCESS)
912 do_group_exit(SIGSYS);
913 else
914 do_exit(SIGSYS);
915 }
916
917 unreachable();
918
919skip:
920 seccomp_log(this_syscall, 0, action, match ? match->log : false);
921 return -1;
922}
923#else
924static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
925 const bool recheck_after_trace)
926{
927 BUG();
928}
929#endif
930
931int __secure_computing(const struct seccomp_data *sd)
932{
933 int mode = current->seccomp.mode;
934 int this_syscall;
935
936 if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) &&
937 unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
938 return 0;
939
940 this_syscall = sd ? sd->nr :
941 syscall_get_nr(current, task_pt_regs(current));
942
943 switch (mode) {
944 case SECCOMP_MODE_STRICT:
945 __secure_computing_strict(this_syscall); /* may call do_exit */
946 return 0;
947 case SECCOMP_MODE_FILTER:
948 return __seccomp_filter(this_syscall, sd, false);
949 default:
950 BUG();
951 }
952}
953#endif /* CONFIG_HAVE_ARCH_SECCOMP_FILTER */
954
955long prctl_get_seccomp(void)
956{
957 return current->seccomp.mode;
958}
959
960/**
961 * seccomp_set_mode_strict: internal function for setting strict seccomp
962 *
963 * Once current->seccomp.mode is non-zero, it may not be changed.
964 *
965 * Returns 0 on success or -EINVAL on failure.
966 */
967static long seccomp_set_mode_strict(void)
968{
969 const unsigned long seccomp_mode = SECCOMP_MODE_STRICT;
970 long ret = -EINVAL;
971
972 spin_lock_irq(&current->sighand->siglock);
973
974 if (!seccomp_may_assign_mode(seccomp_mode))
975 goto out;
976
977#ifdef TIF_NOTSC
978 disable_TSC();
979#endif
980 seccomp_assign_mode(current, seccomp_mode, 0);
981 ret = 0;
982
983out:
984 spin_unlock_irq(&current->sighand->siglock);
985
986 return ret;
987}
988
989#ifdef CONFIG_SECCOMP_FILTER
990static int seccomp_notify_release(struct inode *inode, struct file *file)
991{
992 struct seccomp_filter *filter = file->private_data;
993 struct seccomp_knotif *knotif;
994
995 if (!filter)
996 return 0;
997
998 mutex_lock(&filter->notify_lock);
999
1000 /*
1001 * If this file is being closed because e.g. the task who owned it
1002 * died, let's wake everyone up who was waiting on us.
1003 */
1004 list_for_each_entry(knotif, &filter->notif->notifications, list) {
1005 if (knotif->state == SECCOMP_NOTIFY_REPLIED)
1006 continue;
1007
1008 knotif->state = SECCOMP_NOTIFY_REPLIED;
1009 knotif->error = -ENOSYS;
1010 knotif->val = 0;
1011
1012 complete(&knotif->ready);
1013 }
1014
1015 kfree(filter->notif);
1016 filter->notif = NULL;
1017 mutex_unlock(&filter->notify_lock);
1018 __put_seccomp_filter(filter);
1019 return 0;
1020}
1021
1022static long seccomp_notify_recv(struct seccomp_filter *filter,
1023 void __user *buf)
1024{
1025 struct seccomp_knotif *knotif = NULL, *cur;
1026 struct seccomp_notif unotif;
1027 ssize_t ret;
1028
1029 /* Verify that we're not given garbage to keep struct extensible. */
1030 ret = check_zeroed_user(buf, sizeof(unotif));
1031 if (ret < 0)
1032 return ret;
1033 if (!ret)
1034 return -EINVAL;
1035
1036 memset(&unotif, 0, sizeof(unotif));
1037
1038 ret = down_interruptible(&filter->notif->request);
1039 if (ret < 0)
1040 return ret;
1041
1042 mutex_lock(&filter->notify_lock);
1043 list_for_each_entry(cur, &filter->notif->notifications, list) {
1044 if (cur->state == SECCOMP_NOTIFY_INIT) {
1045 knotif = cur;
1046 break;
1047 }
1048 }
1049
1050 /*
1051 * If we didn't find a notification, it could be that the task was
1052 * interrupted by a fatal signal between the time we were woken and
1053 * when we were able to acquire the rw lock.
1054 */
1055 if (!knotif) {
1056 ret = -ENOENT;
1057 goto out;
1058 }
1059
1060 unotif.id = knotif->id;
1061 unotif.pid = task_pid_vnr(knotif->task);
1062 unotif.data = *(knotif->data);
1063
1064 knotif->state = SECCOMP_NOTIFY_SENT;
1065 wake_up_poll(&filter->notif->wqh, EPOLLOUT | EPOLLWRNORM);
1066 ret = 0;
1067out:
1068 mutex_unlock(&filter->notify_lock);
1069
1070 if (ret == 0 && copy_to_user(buf, &unotif, sizeof(unotif))) {
1071 ret = -EFAULT;
1072
1073 /*
1074 * Userspace screwed up. To make sure that we keep this
1075 * notification alive, let's reset it back to INIT. It
1076 * may have died when we released the lock, so we need to make
1077 * sure it's still around.
1078 */
1079 knotif = NULL;
1080 mutex_lock(&filter->notify_lock);
1081 list_for_each_entry(cur, &filter->notif->notifications, list) {
1082 if (cur->id == unotif.id) {
1083 knotif = cur;
1084 break;
1085 }
1086 }
1087
1088 if (knotif) {
1089 knotif->state = SECCOMP_NOTIFY_INIT;
1090 up(&filter->notif->request);
1091 }
1092 mutex_unlock(&filter->notify_lock);
1093 }
1094
1095 return ret;
1096}
1097
1098static long seccomp_notify_send(struct seccomp_filter *filter,
1099 void __user *buf)
1100{
1101 struct seccomp_notif_resp resp = {};
1102 struct seccomp_knotif *knotif = NULL, *cur;
1103 long ret;
1104
1105 if (copy_from_user(&resp, buf, sizeof(resp)))
1106 return -EFAULT;
1107
1108 if (resp.flags & ~SECCOMP_USER_NOTIF_FLAG_CONTINUE)
1109 return -EINVAL;
1110
1111 if ((resp.flags & SECCOMP_USER_NOTIF_FLAG_CONTINUE) &&
1112 (resp.error || resp.val))
1113 return -EINVAL;
1114
1115 ret = mutex_lock_interruptible(&filter->notify_lock);
1116 if (ret < 0)
1117 return ret;
1118
1119 list_for_each_entry(cur, &filter->notif->notifications, list) {
1120 if (cur->id == resp.id) {
1121 knotif = cur;
1122 break;
1123 }
1124 }
1125
1126 if (!knotif) {
1127 ret = -ENOENT;
1128 goto out;
1129 }
1130
1131 /* Allow exactly one reply. */
1132 if (knotif->state != SECCOMP_NOTIFY_SENT) {
1133 ret = -EINPROGRESS;
1134 goto out;
1135 }
1136
1137 ret = 0;
1138 knotif->state = SECCOMP_NOTIFY_REPLIED;
1139 knotif->error = resp.error;
1140 knotif->val = resp.val;
1141 knotif->flags = resp.flags;
1142 complete(&knotif->ready);
1143out:
1144 mutex_unlock(&filter->notify_lock);
1145 return ret;
1146}
1147
1148static long seccomp_notify_id_valid(struct seccomp_filter *filter,
1149 void __user *buf)
1150{
1151 struct seccomp_knotif *knotif = NULL;
1152 u64 id;
1153 long ret;
1154
1155 if (copy_from_user(&id, buf, sizeof(id)))
1156 return -EFAULT;
1157
1158 ret = mutex_lock_interruptible(&filter->notify_lock);
1159 if (ret < 0)
1160 return ret;
1161
1162 ret = -ENOENT;
1163 list_for_each_entry(knotif, &filter->notif->notifications, list) {
1164 if (knotif->id == id) {
1165 if (knotif->state == SECCOMP_NOTIFY_SENT)
1166 ret = 0;
1167 goto out;
1168 }
1169 }
1170
1171out:
1172 mutex_unlock(&filter->notify_lock);
1173 return ret;
1174}
1175
1176static long seccomp_notify_ioctl(struct file *file, unsigned int cmd,
1177 unsigned long arg)
1178{
1179 struct seccomp_filter *filter = file->private_data;
1180 void __user *buf = (void __user *)arg;
1181
1182 switch (cmd) {
1183 case SECCOMP_IOCTL_NOTIF_RECV:
1184 return seccomp_notify_recv(filter, buf);
1185 case SECCOMP_IOCTL_NOTIF_SEND:
1186 return seccomp_notify_send(filter, buf);
1187 case SECCOMP_IOCTL_NOTIF_ID_VALID:
1188 return seccomp_notify_id_valid(filter, buf);
1189 default:
1190 return -EINVAL;
1191 }
1192}
1193
1194static __poll_t seccomp_notify_poll(struct file *file,
1195 struct poll_table_struct *poll_tab)
1196{
1197 struct seccomp_filter *filter = file->private_data;
1198 __poll_t ret = 0;
1199 struct seccomp_knotif *cur;
1200
1201 poll_wait(file, &filter->notif->wqh, poll_tab);
1202
1203 if (mutex_lock_interruptible(&filter->notify_lock) < 0)
1204 return EPOLLERR;
1205
1206 list_for_each_entry(cur, &filter->notif->notifications, list) {
1207 if (cur->state == SECCOMP_NOTIFY_INIT)
1208 ret |= EPOLLIN | EPOLLRDNORM;
1209 if (cur->state == SECCOMP_NOTIFY_SENT)
1210 ret |= EPOLLOUT | EPOLLWRNORM;
1211 if ((ret & EPOLLIN) && (ret & EPOLLOUT))
1212 break;
1213 }
1214
1215 mutex_unlock(&filter->notify_lock);
1216
1217 return ret;
1218}
1219
1220static const struct file_operations seccomp_notify_ops = {
1221 .poll = seccomp_notify_poll,
1222 .release = seccomp_notify_release,
1223 .unlocked_ioctl = seccomp_notify_ioctl,
1224};
1225
1226static struct file *init_listener(struct seccomp_filter *filter)
1227{
1228 struct file *ret = ERR_PTR(-EBUSY);
1229 struct seccomp_filter *cur;
1230
1231 for (cur = current->seccomp.filter; cur; cur = cur->prev) {
1232 if (cur->notif)
1233 goto out;
1234 }
1235
1236 ret = ERR_PTR(-ENOMEM);
1237 filter->notif = kzalloc(sizeof(*(filter->notif)), GFP_KERNEL);
1238 if (!filter->notif)
1239 goto out;
1240
1241 sema_init(&filter->notif->request, 0);
1242 filter->notif->next_id = get_random_u64();
1243 INIT_LIST_HEAD(&filter->notif->notifications);
1244 init_waitqueue_head(&filter->notif->wqh);
1245
1246 ret = anon_inode_getfile("seccomp notify", &seccomp_notify_ops,
1247 filter, O_RDWR);
1248 if (IS_ERR(ret))
1249 goto out_notif;
1250
1251 /* The file has a reference to it now */
1252 __get_seccomp_filter(filter);
1253
1254out_notif:
1255 if (IS_ERR(ret))
1256 kfree(filter->notif);
1257out:
1258 return ret;
1259}
1260
1261/**
1262 * seccomp_set_mode_filter: internal function for setting seccomp filter
1263 * @flags: flags to change filter behavior
1264 * @filter: struct sock_fprog containing filter
1265 *
1266 * This function may be called repeatedly to install additional filters.
1267 * Every filter successfully installed will be evaluated (in reverse order)
1268 * for each system call the task makes.
1269 *
1270 * Once current->seccomp.mode is non-zero, it may not be changed.
1271 *
1272 * Returns 0 on success or -EINVAL on failure.
1273 */
1274static long seccomp_set_mode_filter(unsigned int flags,
1275 const char __user *filter)
1276{
1277 const unsigned long seccomp_mode = SECCOMP_MODE_FILTER;
1278 struct seccomp_filter *prepared = NULL;
1279 long ret = -EINVAL;
1280 int listener = -1;
1281 struct file *listener_f = NULL;
1282
1283 /* Validate flags. */
1284 if (flags & ~SECCOMP_FILTER_FLAG_MASK)
1285 return -EINVAL;
1286
1287 /*
1288 * In the successful case, NEW_LISTENER returns the new listener fd.
1289 * But in the failure case, TSYNC returns the thread that died. If you
1290 * combine these two flags, there's no way to tell whether something
1291 * succeeded or failed. So, let's disallow this combination.
1292 */
1293 if ((flags & SECCOMP_FILTER_FLAG_TSYNC) &&
1294 (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER))
1295 return -EINVAL;
1296
1297 /* Prepare the new filter before holding any locks. */
1298 prepared = seccomp_prepare_user_filter(filter);
1299 if (IS_ERR(prepared))
1300 return PTR_ERR(prepared);
1301
1302 if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) {
1303 listener = get_unused_fd_flags(O_CLOEXEC);
1304 if (listener < 0) {
1305 ret = listener;
1306 goto out_free;
1307 }
1308
1309 listener_f = init_listener(prepared);
1310 if (IS_ERR(listener_f)) {
1311 put_unused_fd(listener);
1312 ret = PTR_ERR(listener_f);
1313 goto out_free;
1314 }
1315 }
1316
1317 /*
1318 * Make sure we cannot change seccomp or nnp state via TSYNC
1319 * while another thread is in the middle of calling exec.
1320 */
1321 if (flags & SECCOMP_FILTER_FLAG_TSYNC &&
1322 mutex_lock_killable(&current->signal->cred_guard_mutex))
1323 goto out_put_fd;
1324
1325 spin_lock_irq(&current->sighand->siglock);
1326
1327 if (!seccomp_may_assign_mode(seccomp_mode))
1328 goto out;
1329
1330 ret = seccomp_attach_filter(flags, prepared);
1331 if (ret)
1332 goto out;
1333 /* Do not free the successfully attached filter. */
1334 prepared = NULL;
1335
1336 seccomp_assign_mode(current, seccomp_mode, flags);
1337out:
1338 spin_unlock_irq(&current->sighand->siglock);
1339 if (flags & SECCOMP_FILTER_FLAG_TSYNC)
1340 mutex_unlock(&current->signal->cred_guard_mutex);
1341out_put_fd:
1342 if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) {
1343 if (ret) {
1344 listener_f->private_data = NULL;
1345 fput(listener_f);
1346 put_unused_fd(listener);
1347 } else {
1348 fd_install(listener, listener_f);
1349 ret = listener;
1350 }
1351 }
1352out_free:
1353 seccomp_filter_free(prepared);
1354 return ret;
1355}
1356#else
1357static inline long seccomp_set_mode_filter(unsigned int flags,
1358 const char __user *filter)
1359{
1360 return -EINVAL;
1361}
1362#endif
1363
1364static long seccomp_get_action_avail(const char __user *uaction)
1365{
1366 u32 action;
1367
1368 if (copy_from_user(&action, uaction, sizeof(action)))
1369 return -EFAULT;
1370
1371 switch (action) {
1372 case SECCOMP_RET_KILL_PROCESS:
1373 case SECCOMP_RET_KILL_THREAD:
1374 case SECCOMP_RET_TRAP:
1375 case SECCOMP_RET_ERRNO:
1376 case SECCOMP_RET_USER_NOTIF:
1377 case SECCOMP_RET_TRACE:
1378 case SECCOMP_RET_LOG:
1379 case SECCOMP_RET_ALLOW:
1380 break;
1381 default:
1382 return -EOPNOTSUPP;
1383 }
1384
1385 return 0;
1386}
1387
1388static long seccomp_get_notif_sizes(void __user *usizes)
1389{
1390 struct seccomp_notif_sizes sizes = {
1391 .seccomp_notif = sizeof(struct seccomp_notif),
1392 .seccomp_notif_resp = sizeof(struct seccomp_notif_resp),
1393 .seccomp_data = sizeof(struct seccomp_data),
1394 };
1395
1396 if (copy_to_user(usizes, &sizes, sizeof(sizes)))
1397 return -EFAULT;
1398
1399 return 0;
1400}
1401
1402/* Common entry point for both prctl and syscall. */
1403static long do_seccomp(unsigned int op, unsigned int flags,
1404 void __user *uargs)
1405{
1406 switch (op) {
1407 case SECCOMP_SET_MODE_STRICT:
1408 if (flags != 0 || uargs != NULL)
1409 return -EINVAL;
1410 return seccomp_set_mode_strict();
1411 case SECCOMP_SET_MODE_FILTER:
1412 return seccomp_set_mode_filter(flags, uargs);
1413 case SECCOMP_GET_ACTION_AVAIL:
1414 if (flags != 0)
1415 return -EINVAL;
1416
1417 return seccomp_get_action_avail(uargs);
1418 case SECCOMP_GET_NOTIF_SIZES:
1419 if (flags != 0)
1420 return -EINVAL;
1421
1422 return seccomp_get_notif_sizes(uargs);
1423 default:
1424 return -EINVAL;
1425 }
1426}
1427
1428SYSCALL_DEFINE3(seccomp, unsigned int, op, unsigned int, flags,
1429 void __user *, uargs)
1430{
1431 return do_seccomp(op, flags, uargs);
1432}
1433
1434/**
1435 * prctl_set_seccomp: configures current->seccomp.mode
1436 * @seccomp_mode: requested mode to use
1437 * @filter: optional struct sock_fprog for use with SECCOMP_MODE_FILTER
1438 *
1439 * Returns 0 on success or -EINVAL on failure.
1440 */
1441long prctl_set_seccomp(unsigned long seccomp_mode, void __user *filter)
1442{
1443 unsigned int op;
1444 void __user *uargs;
1445
1446 switch (seccomp_mode) {
1447 case SECCOMP_MODE_STRICT:
1448 op = SECCOMP_SET_MODE_STRICT;
1449 /*
1450 * Setting strict mode through prctl always ignored filter,
1451 * so make sure it is always NULL here to pass the internal
1452 * check in do_seccomp().
1453 */
1454 uargs = NULL;
1455 break;
1456 case SECCOMP_MODE_FILTER:
1457 op = SECCOMP_SET_MODE_FILTER;
1458 uargs = filter;
1459 break;
1460 default:
1461 return -EINVAL;
1462 }
1463
1464 /* prctl interface doesn't have flags, so they are always zero. */
1465 return do_seccomp(op, 0, uargs);
1466}
1467
1468#if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
1469static struct seccomp_filter *get_nth_filter(struct task_struct *task,
1470 unsigned long filter_off)
1471{
1472 struct seccomp_filter *orig, *filter;
1473 unsigned long count;
1474
1475 /*
1476 * Note: this is only correct because the caller should be the (ptrace)
1477 * tracer of the task, otherwise lock_task_sighand is needed.
1478 */
1479 spin_lock_irq(&task->sighand->siglock);
1480
1481 if (task->seccomp.mode != SECCOMP_MODE_FILTER) {
1482 spin_unlock_irq(&task->sighand->siglock);
1483 return ERR_PTR(-EINVAL);
1484 }
1485
1486 orig = task->seccomp.filter;
1487 __get_seccomp_filter(orig);
1488 spin_unlock_irq(&task->sighand->siglock);
1489
1490 count = 0;
1491 for (filter = orig; filter; filter = filter->prev)
1492 count++;
1493
1494 if (filter_off >= count) {
1495 filter = ERR_PTR(-ENOENT);
1496 goto out;
1497 }
1498
1499 count -= filter_off;
1500 for (filter = orig; filter && count > 1; filter = filter->prev)
1501 count--;
1502
1503 if (WARN_ON(count != 1 || !filter)) {
1504 filter = ERR_PTR(-ENOENT);
1505 goto out;
1506 }
1507
1508 __get_seccomp_filter(filter);
1509
1510out:
1511 __put_seccomp_filter(orig);
1512 return filter;
1513}
1514
1515long seccomp_get_filter(struct task_struct *task, unsigned long filter_off,
1516 void __user *data)
1517{
1518 struct seccomp_filter *filter;
1519 struct sock_fprog_kern *fprog;
1520 long ret;
1521
1522 if (!capable(CAP_SYS_ADMIN) ||
1523 current->seccomp.mode != SECCOMP_MODE_DISABLED) {
1524 return -EACCES;
1525 }
1526
1527 filter = get_nth_filter(task, filter_off);
1528 if (IS_ERR(filter))
1529 return PTR_ERR(filter);
1530
1531 fprog = filter->prog->orig_prog;
1532 if (!fprog) {
1533 /* This must be a new non-cBPF filter, since we save
1534 * every cBPF filter's orig_prog above when
1535 * CONFIG_CHECKPOINT_RESTORE is enabled.
1536 */
1537 ret = -EMEDIUMTYPE;
1538 goto out;
1539 }
1540
1541 ret = fprog->len;
1542 if (!data)
1543 goto out;
1544
1545 if (copy_to_user(data, fprog->filter, bpf_classic_proglen(fprog)))
1546 ret = -EFAULT;
1547
1548out:
1549 __put_seccomp_filter(filter);
1550 return ret;
1551}
1552
1553long seccomp_get_metadata(struct task_struct *task,
1554 unsigned long size, void __user *data)
1555{
1556 long ret;
1557 struct seccomp_filter *filter;
1558 struct seccomp_metadata kmd = {};
1559
1560 if (!capable(CAP_SYS_ADMIN) ||
1561 current->seccomp.mode != SECCOMP_MODE_DISABLED) {
1562 return -EACCES;
1563 }
1564
1565 size = min_t(unsigned long, size, sizeof(kmd));
1566
1567 if (size < sizeof(kmd.filter_off))
1568 return -EINVAL;
1569
1570 if (copy_from_user(&kmd.filter_off, data, sizeof(kmd.filter_off)))
1571 return -EFAULT;
1572
1573 filter = get_nth_filter(task, kmd.filter_off);
1574 if (IS_ERR(filter))
1575 return PTR_ERR(filter);
1576
1577 if (filter->log)
1578 kmd.flags |= SECCOMP_FILTER_FLAG_LOG;
1579
1580 ret = size;
1581 if (copy_to_user(data, &kmd, size))
1582 ret = -EFAULT;
1583
1584 __put_seccomp_filter(filter);
1585 return ret;
1586}
1587#endif
1588
1589#ifdef CONFIG_SYSCTL
1590
1591/* Human readable action names for friendly sysctl interaction */
1592#define SECCOMP_RET_KILL_PROCESS_NAME "kill_process"
1593#define SECCOMP_RET_KILL_THREAD_NAME "kill_thread"
1594#define SECCOMP_RET_TRAP_NAME "trap"
1595#define SECCOMP_RET_ERRNO_NAME "errno"
1596#define SECCOMP_RET_USER_NOTIF_NAME "user_notif"
1597#define SECCOMP_RET_TRACE_NAME "trace"
1598#define SECCOMP_RET_LOG_NAME "log"
1599#define SECCOMP_RET_ALLOW_NAME "allow"
1600
1601static const char seccomp_actions_avail[] =
1602 SECCOMP_RET_KILL_PROCESS_NAME " "
1603 SECCOMP_RET_KILL_THREAD_NAME " "
1604 SECCOMP_RET_TRAP_NAME " "
1605 SECCOMP_RET_ERRNO_NAME " "
1606 SECCOMP_RET_USER_NOTIF_NAME " "
1607 SECCOMP_RET_TRACE_NAME " "
1608 SECCOMP_RET_LOG_NAME " "
1609 SECCOMP_RET_ALLOW_NAME;
1610
1611struct seccomp_log_name {
1612 u32 log;
1613 const char *name;
1614};
1615
1616static const struct seccomp_log_name seccomp_log_names[] = {
1617 { SECCOMP_LOG_KILL_PROCESS, SECCOMP_RET_KILL_PROCESS_NAME },
1618 { SECCOMP_LOG_KILL_THREAD, SECCOMP_RET_KILL_THREAD_NAME },
1619 { SECCOMP_LOG_TRAP, SECCOMP_RET_TRAP_NAME },
1620 { SECCOMP_LOG_ERRNO, SECCOMP_RET_ERRNO_NAME },
1621 { SECCOMP_LOG_USER_NOTIF, SECCOMP_RET_USER_NOTIF_NAME },
1622 { SECCOMP_LOG_TRACE, SECCOMP_RET_TRACE_NAME },
1623 { SECCOMP_LOG_LOG, SECCOMP_RET_LOG_NAME },
1624 { SECCOMP_LOG_ALLOW, SECCOMP_RET_ALLOW_NAME },
1625 { }
1626};
1627
1628static bool seccomp_names_from_actions_logged(char *names, size_t size,
1629 u32 actions_logged,
1630 const char *sep)
1631{
1632 const struct seccomp_log_name *cur;
1633 bool append_sep = false;
1634
1635 for (cur = seccomp_log_names; cur->name && size; cur++) {
1636 ssize_t ret;
1637
1638 if (!(actions_logged & cur->log))
1639 continue;
1640
1641 if (append_sep) {
1642 ret = strscpy(names, sep, size);
1643 if (ret < 0)
1644 return false;
1645
1646 names += ret;
1647 size -= ret;
1648 } else
1649 append_sep = true;
1650
1651 ret = strscpy(names, cur->name, size);
1652 if (ret < 0)
1653 return false;
1654
1655 names += ret;
1656 size -= ret;
1657 }
1658
1659 return true;
1660}
1661
1662static bool seccomp_action_logged_from_name(u32 *action_logged,
1663 const char *name)
1664{
1665 const struct seccomp_log_name *cur;
1666
1667 for (cur = seccomp_log_names; cur->name; cur++) {
1668 if (!strcmp(cur->name, name)) {
1669 *action_logged = cur->log;
1670 return true;
1671 }
1672 }
1673
1674 return false;
1675}
1676
1677static bool seccomp_actions_logged_from_names(u32 *actions_logged, char *names)
1678{
1679 char *name;
1680
1681 *actions_logged = 0;
1682 while ((name = strsep(&names, " ")) && *name) {
1683 u32 action_logged = 0;
1684
1685 if (!seccomp_action_logged_from_name(&action_logged, name))
1686 return false;
1687
1688 *actions_logged |= action_logged;
1689 }
1690
1691 return true;
1692}
1693
1694static int read_actions_logged(struct ctl_table *ro_table, void __user *buffer,
1695 size_t *lenp, loff_t *ppos)
1696{
1697 char names[sizeof(seccomp_actions_avail)];
1698 struct ctl_table table;
1699
1700 memset(names, 0, sizeof(names));
1701
1702 if (!seccomp_names_from_actions_logged(names, sizeof(names),
1703 seccomp_actions_logged, " "))
1704 return -EINVAL;
1705
1706 table = *ro_table;
1707 table.data = names;
1708 table.maxlen = sizeof(names);
1709 return proc_dostring(&table, 0, buffer, lenp, ppos);
1710}
1711
1712static int write_actions_logged(struct ctl_table *ro_table, void __user *buffer,
1713 size_t *lenp, loff_t *ppos, u32 *actions_logged)
1714{
1715 char names[sizeof(seccomp_actions_avail)];
1716 struct ctl_table table;
1717 int ret;
1718
1719 if (!capable(CAP_SYS_ADMIN))
1720 return -EPERM;
1721
1722 memset(names, 0, sizeof(names));
1723
1724 table = *ro_table;
1725 table.data = names;
1726 table.maxlen = sizeof(names);
1727 ret = proc_dostring(&table, 1, buffer, lenp, ppos);
1728 if (ret)
1729 return ret;
1730
1731 if (!seccomp_actions_logged_from_names(actions_logged, table.data))
1732 return -EINVAL;
1733
1734 if (*actions_logged & SECCOMP_LOG_ALLOW)
1735 return -EINVAL;
1736
1737 seccomp_actions_logged = *actions_logged;
1738 return 0;
1739}
1740
1741static void audit_actions_logged(u32 actions_logged, u32 old_actions_logged,
1742 int ret)
1743{
1744 char names[sizeof(seccomp_actions_avail)];
1745 char old_names[sizeof(seccomp_actions_avail)];
1746 const char *new = names;
1747 const char *old = old_names;
1748
1749 if (!audit_enabled)
1750 return;
1751
1752 memset(names, 0, sizeof(names));
1753 memset(old_names, 0, sizeof(old_names));
1754
1755 if (ret)
1756 new = "?";
1757 else if (!actions_logged)
1758 new = "(none)";
1759 else if (!seccomp_names_from_actions_logged(names, sizeof(names),
1760 actions_logged, ","))
1761 new = "?";
1762
1763 if (!old_actions_logged)
1764 old = "(none)";
1765 else if (!seccomp_names_from_actions_logged(old_names,
1766 sizeof(old_names),
1767 old_actions_logged, ","))
1768 old = "?";
1769
1770 return audit_seccomp_actions_logged(new, old, !ret);
1771}
1772
1773static int seccomp_actions_logged_handler(struct ctl_table *ro_table, int write,
1774 void __user *buffer, size_t *lenp,
1775 loff_t *ppos)
1776{
1777 int ret;
1778
1779 if (write) {
1780 u32 actions_logged = 0;
1781 u32 old_actions_logged = seccomp_actions_logged;
1782
1783 ret = write_actions_logged(ro_table, buffer, lenp, ppos,
1784 &actions_logged);
1785 audit_actions_logged(actions_logged, old_actions_logged, ret);
1786 } else
1787 ret = read_actions_logged(ro_table, buffer, lenp, ppos);
1788
1789 return ret;
1790}
1791
1792static struct ctl_path seccomp_sysctl_path[] = {
1793 { .procname = "kernel", },
1794 { .procname = "seccomp", },
1795 { }
1796};
1797
1798static struct ctl_table seccomp_sysctl_table[] = {
1799 {
1800 .procname = "actions_avail",
1801 .data = (void *) &seccomp_actions_avail,
1802 .maxlen = sizeof(seccomp_actions_avail),
1803 .mode = 0444,
1804 .proc_handler = proc_dostring,
1805 },
1806 {
1807 .procname = "actions_logged",
1808 .mode = 0644,
1809 .proc_handler = seccomp_actions_logged_handler,
1810 },
1811 { }
1812};
1813
1814static int __init seccomp_sysctl_init(void)
1815{
1816 struct ctl_table_header *hdr;
1817
1818 hdr = register_sysctl_paths(seccomp_sysctl_path, seccomp_sysctl_table);
1819 if (!hdr)
1820 pr_warn("seccomp: sysctl registration failed\n");
1821 else
1822 kmemleak_not_leak(hdr);
1823
1824 return 0;
1825}
1826
1827device_initcall(seccomp_sysctl_init)
1828
1829#endif /* CONFIG_SYSCTL */