linux - kernel/seccomp.c

2532 lines · 65.2 KiB

1	// SPDX-License-Identifier: GPL-2.0
2	/*
3	* linux/kernel/seccomp.c
4	*
5	* Copyright 2004-2005 Andrea Arcangeli <[email protected]>
6	*
7	* Copyright (C) 2012 Google, Inc.
8	* Will Drewry <[email protected]>
9	*
10	* This defines a simple but solid secure-computing facility.
11	*
12	* Mode 1 uses a fixed list of allowed system calls.
13	* Mode 2 allows user-defined system call filters in the form
14	* of Berkeley Packet Filters/Linux Socket Filters.
15	*/
16	#define pr_fmt(fmt) "seccomp: " fmt
17
18	#include <linux/refcount.h>
19	#include <linux/audit.h>
20	#include <linux/compat.h>
21	#include <linux/coredump.h>
22	#include <linux/kmemleak.h>
23	#include <linux/nospec.h>
24	#include <linux/prctl.h>
25	#include <linux/sched.h>
26	#include <linux/sched/task_stack.h>
27	#include <linux/seccomp.h>
28	#include <linux/slab.h>
29	#include <linux/syscalls.h>
30	#include <linux/sysctl.h>
31
32	/* Not exposed in headers: strictly internal use only. */
33	#define SECCOMP_MODE_DEAD (SECCOMP_MODE_FILTER + 1)
34
35	#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
36	#include <asm/syscall.h>
37	#endif
38
39	#ifdef CONFIG_SECCOMP_FILTER
40	#include <linux/file.h>
41	#include <linux/filter.h>
42	#include <linux/pid.h>
43	#include <linux/ptrace.h>
44	#include <linux/capability.h>
45	#include <linux/uaccess.h>
46	#include <linux/anon_inodes.h>
47	#include <linux/lockdep.h>
48
49	/*
50	* When SECCOMP_IOCTL_NOTIF_ID_VALID was first introduced, it had the
51	* wrong direction flag in the ioctl number. This is the broken one,
52	* which the kernel needs to keep supporting until all userspaces stop
53	* using the wrong command number.
54	*/
55	#define SECCOMP_IOCTL_NOTIF_ID_VALID_WRONG_DIR SECCOMP_IOR(2, __u64)
56
57	enum notify_state {
58	SECCOMP_NOTIFY_INIT,
59	SECCOMP_NOTIFY_SENT,
60	SECCOMP_NOTIFY_REPLIED,
61	};
62
63	struct seccomp_knotif {
64	/* The struct pid of the task whose filter triggered the notification */
65	struct task_struct *task;
66
67	/* The "cookie" for this request; this is unique for this filter. */
68	u64 id;
69
70	/*
71	* The seccomp data. This pointer is valid the entire time this
72	* notification is active, since it comes from __seccomp_filter which
73	* eclipses the entire lifecycle here.
74	*/
75	const struct seccomp_data *data;
76
77	/*
78	* Notification states. When SECCOMP_RET_USER_NOTIF is returned, a
79	* struct seccomp_knotif is created and starts out in INIT. Once the
80	* handler reads the notification off of an FD, it transitions to SENT.
81	* If a signal is received the state transitions back to INIT and
82	* another message is sent. When the userspace handler replies, state
83	* transitions to REPLIED.
84	*/
85	enum notify_state state;
86
87	/* The return values, only valid when in SECCOMP_NOTIFY_REPLIED */
88	int error;
89	long val;
90	u32 flags;
91
92	/*
93	* Signals when this has changed states, such as the listener
94	* dying, a new seccomp addfd message, or changing to REPLIED
95	*/
96	struct completion ready;
97
98	struct list_head list;
99
100	/* outstanding addfd requests */
101	struct list_head addfd;
102	};
103
104	/**
105	* struct seccomp_kaddfd - container for seccomp_addfd ioctl messages
106	*
107	* @file: A reference to the file to install in the other task
108	* @fd: The fd number to install it at. If the fd number is -1, it means the
109	* installing process should allocate the fd as normal.
110	* @flags: The flags for the new file descriptor. At the moment, only O_CLOEXEC
111	* is allowed.
112	* @ioctl_flags: The flags used for the seccomp_addfd ioctl.
113	* @setfd: whether or not SECCOMP_ADDFD_FLAG_SETFD was set during notify_addfd
114	* @ret: The return value of the installing process. It is set to the fd num
115	* upon success (>= 0).
116	* @completion: Indicates that the installing process has completed fd
117	* installation, or gone away (either due to successful
118	* reply, or signal)
119	* @list: list_head for chaining seccomp_kaddfd together.
120	*
121	*/
122	struct seccomp_kaddfd {
123	struct file *file;
124	int fd;
125	unsigned int flags;
126	__u32 ioctl_flags;
127
128	union {
129	bool setfd;
130	/* To only be set on reply */
131	int ret;
132	};
133	struct completion completion;
134	struct list_head list;
135	};
136
137	/**
138	* struct notification - container for seccomp userspace notifications. Since
139	* most seccomp filters will not have notification listeners attached and this
140	* structure is fairly large, we store the notification-specific stuff in a
141	* separate structure.
142	*
143	* @requests: A semaphore that users of this notification can wait on for
144	* changes. Actual reads and writes are still controlled with
145	* filter->notify_lock.
146	* @flags: A set of SECCOMP_USER_NOTIF_FD_* flags.
147	* @next_id: The id of the next request.
148	* @notifications: A list of struct seccomp_knotif elements.
149	*/
150
151	struct notification {
152	atomic_t requests;
153	u32 flags;
154	u64 next_id;
155	struct list_head notifications;
156	};
157
158	#ifdef SECCOMP_ARCH_NATIVE
159	/**
160	* struct action_cache - per-filter cache of seccomp actions per
161	* arch/syscall pair
162	*
163	* @allow_native: A bitmap where each bit represents whether the
164	* filter will always allow the syscall, for the
165	* native architecture.
166	* @allow_compat: A bitmap where each bit represents whether the
167	* filter will always allow the syscall, for the
168	* compat architecture.
169	*/
170	struct action_cache {
171	DECLARE_BITMAP(allow_native, SECCOMP_ARCH_NATIVE_NR);
172	#ifdef SECCOMP_ARCH_COMPAT
173	DECLARE_BITMAP(allow_compat, SECCOMP_ARCH_COMPAT_NR);
174	#endif
175	};
176	#else
177	struct action_cache { };
178
179	static inline bool seccomp_cache_check_allow(const struct seccomp_filter *sfilter,
180	const struct seccomp_data *sd)
181	{
182	return false;
183	}
184
185	static inline void seccomp_cache_prepare(struct seccomp_filter *sfilter)
186	{
187	}
188	#endif /* SECCOMP_ARCH_NATIVE */
189
190	/**
191	* struct seccomp_filter - container for seccomp BPF programs
192	*
193	* @refs: Reference count to manage the object lifetime.
194	* A filter's reference count is incremented for each directly
195	* attached task, once for the dependent filter, and if
196	* requested for the user notifier. When @refs reaches zero,
197	* the filter can be freed.
198	* @users: A filter's @users count is incremented for each directly
199	* attached task (filter installation, fork(), thread_sync),
200	* and once for the dependent filter (tracked in filter->prev).
201	* When it reaches zero it indicates that no direct or indirect
202	* users of that filter exist. No new tasks can get associated with
203	* this filter after reaching 0. The @users count is always smaller
204	* or equal to @refs. Hence, reaching 0 for @users does not mean
205	* the filter can be freed.
206	* @cache: cache of arch/syscall mappings to actions
207	* @log: true if all actions except for SECCOMP_RET_ALLOW should be logged
208	* @wait_killable_recv: Put notifying process in killable state once the
209	* notification is received by the userspace listener.
210	* @prev: points to a previously installed, or inherited, filter
211	* @prog: the BPF program to evaluate
212	* @notif: the struct that holds all notification related information
213	* @notify_lock: A lock for all notification-related accesses.
214	* @wqh: A wait queue for poll if a notifier is in use.
215	*
216	* seccomp_filter objects are organized in a tree linked via the @prev
217	* pointer. For any task, it appears to be a singly-linked list starting
218	* with current->seccomp.filter, the most recently attached or inherited filter.
219	* However, multiple filters may share a @prev node, by way of fork(), which
220	* results in a unidirectional tree existing in memory. This is similar to
221	* how namespaces work.
222	*
223	* seccomp_filter objects should never be modified after being attached
224	* to a task_struct (other than @refs).
225	*/
226	struct seccomp_filter {
227	refcount_t refs;
228	refcount_t users;
229	bool log;
230	bool wait_killable_recv;
231	struct action_cache cache;
232	struct seccomp_filter *prev;
233	struct bpf_prog *prog;
234	struct notification *notif;
235	struct mutex notify_lock;
236	wait_queue_head_t wqh;
237	};
238
239	/* Limit any path through the tree to 256KB worth of instructions. */
240	#define MAX_INSNS_PER_PATH ((1 << 18) / sizeof(struct sock_filter))
241
242	/*
243	* Endianness is explicitly ignored and left for BPF program authors to manage
244	* as per the specific architecture.
245	*/
246	static void populate_seccomp_data(struct seccomp_data *sd)
247	{
248	/*
249	* Instead of using current_pt_reg(), we're already doing the work
250	* to safely fetch "current", so just use "task" everywhere below.
251	*/
252	struct task_struct *task = current;
253	struct pt_regs *regs = task_pt_regs(task);
254	unsigned long args[6];
255
256	sd->nr = syscall_get_nr(task, regs);
257	sd->arch = syscall_get_arch(task);
258	syscall_get_arguments(task, regs, args);
259	sd->args[0] = args[0];
260	sd->args[1] = args[1];
261	sd->args[2] = args[2];
262	sd->args[3] = args[3];
263	sd->args[4] = args[4];
264	sd->args[5] = args[5];
265	sd->instruction_pointer = KSTK_EIP(task);
266	}
267
268	/**
269	* seccomp_check_filter - verify seccomp filter code
270	* @filter: filter to verify
271	* @flen: length of filter
272	*
273	* Takes a previously checked filter (by bpf_check_classic) and
274	* redirects all filter code that loads struct sk_buff data
275	* and related data through seccomp_bpf_load. It also
276	* enforces length and alignment checking of those loads.
277	*
278	* Returns 0 if the rule set is legal or -EINVAL if not.
279	*/
280	static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen)
281	{
282	int pc;
283	for (pc = 0; pc < flen; pc++) {
284	struct sock_filter *ftest = &filter[pc];
285	u16 code = ftest->code;
286	u32 k = ftest->k;
287
288	switch (code) {
289	case BPF_LD \| BPF_W \| BPF_ABS:
290	ftest->code = BPF_LDX \| BPF_W \| BPF_ABS;
291	/* 32-bit aligned and not out of bounds. */
292	if (k >= sizeof(struct seccomp_data) \|\| k & 3)
293	return -EINVAL;
294	continue;
295	case BPF_LD \| BPF_W \| BPF_LEN:
296	ftest->code = BPF_LD \| BPF_IMM;
297	ftest->k = sizeof(struct seccomp_data);
298	continue;
299	case BPF_LDX \| BPF_W \| BPF_LEN:
300	ftest->code = BPF_LDX \| BPF_IMM;
301	ftest->k = sizeof(struct seccomp_data);
302	continue;
303	/* Explicitly include allowed calls. */
304	case BPF_RET \| BPF_K:
305	case BPF_RET \| BPF_A:
306	case BPF_ALU \| BPF_ADD \| BPF_K:
307	case BPF_ALU \| BPF_ADD \| BPF_X:
308	case BPF_ALU \| BPF_SUB \| BPF_K:
309	case BPF_ALU \| BPF_SUB \| BPF_X:
310	case BPF_ALU \| BPF_MUL \| BPF_K:
311	case BPF_ALU \| BPF_MUL \| BPF_X:
312	case BPF_ALU \| BPF_DIV \| BPF_K:
313	case BPF_ALU \| BPF_DIV \| BPF_X:
314	case BPF_ALU \| BPF_AND \| BPF_K:
315	case BPF_ALU \| BPF_AND \| BPF_X:
316	case BPF_ALU \| BPF_OR \| BPF_K:
317	case BPF_ALU \| BPF_OR \| BPF_X:
318	case BPF_ALU \| BPF_XOR \| BPF_K:
319	case BPF_ALU \| BPF_XOR \| BPF_X:
320	case BPF_ALU \| BPF_LSH \| BPF_K:
321	case BPF_ALU \| BPF_LSH \| BPF_X:
322	case BPF_ALU \| BPF_RSH \| BPF_K:
323	case BPF_ALU \| BPF_RSH \| BPF_X:
324	case BPF_ALU \| BPF_NEG:
325	case BPF_LD \| BPF_IMM:
326	case BPF_LDX \| BPF_IMM:
327	case BPF_MISC \| BPF_TAX:
328	case BPF_MISC \| BPF_TXA:
329	case BPF_LD \| BPF_MEM:
330	case BPF_LDX \| BPF_MEM:
331	case BPF_ST:
332	case BPF_STX:
333	case BPF_JMP \| BPF_JA:
334	case BPF_JMP \| BPF_JEQ \| BPF_K:
335	case BPF_JMP \| BPF_JEQ \| BPF_X:
336	case BPF_JMP \| BPF_JGE \| BPF_K:
337	case BPF_JMP \| BPF_JGE \| BPF_X:
338	case BPF_JMP \| BPF_JGT \| BPF_K:
339	case BPF_JMP \| BPF_JGT \| BPF_X:
340	case BPF_JMP \| BPF_JSET \| BPF_K:
341	case BPF_JMP \| BPF_JSET \| BPF_X:
342	continue;
343	default:
344	return -EINVAL;
345	}
346	}
347	return 0;
348	}
349
350	#ifdef SECCOMP_ARCH_NATIVE
351	static inline bool seccomp_cache_check_allow_bitmap(const void *bitmap,
352	size_t bitmap_size,
353	int syscall_nr)
354	{
355	if (unlikely(syscall_nr < 0 \|\| syscall_nr >= bitmap_size))
356	return false;
357	syscall_nr = array_index_nospec(syscall_nr, bitmap_size);
358
359	return test_bit(syscall_nr, bitmap);
360	}
361
362	/**
363	* seccomp_cache_check_allow - lookup seccomp cache
364	* @sfilter: The seccomp filter
365	* @sd: The seccomp data to lookup the cache with
366	*
367	* Returns true if the seccomp_data is cached and allowed.
368	*/
369	static inline bool seccomp_cache_check_allow(const struct seccomp_filter *sfilter,
370	const struct seccomp_data *sd)
371	{
372	int syscall_nr = sd->nr;
373	const struct action_cache *cache = &sfilter->cache;
374
375	#ifndef SECCOMP_ARCH_COMPAT
376	/* A native-only architecture doesn't need to check sd->arch. */
377	return seccomp_cache_check_allow_bitmap(cache->allow_native,
378	SECCOMP_ARCH_NATIVE_NR,
379	syscall_nr);
380	#else
381	if (likely(sd->arch == SECCOMP_ARCH_NATIVE))
382	return seccomp_cache_check_allow_bitmap(cache->allow_native,
383	SECCOMP_ARCH_NATIVE_NR,
384	syscall_nr);
385	if (likely(sd->arch == SECCOMP_ARCH_COMPAT))
386	return seccomp_cache_check_allow_bitmap(cache->allow_compat,
387	SECCOMP_ARCH_COMPAT_NR,
388	syscall_nr);
389	#endif /* SECCOMP_ARCH_COMPAT */
390
391	WARN_ON_ONCE(true);
392	return false;
393	}
394	#endif /* SECCOMP_ARCH_NATIVE */
395
396	#define ACTION_ONLY(ret) ((s32)((ret) & (SECCOMP_RET_ACTION_FULL)))
397	/**
398	* seccomp_run_filters - evaluates all seccomp filters against @sd
399	* @sd: optional seccomp data to be passed to filters
400	* @match: stores struct seccomp_filter that resulted in the return value,
401	* unless filter returned SECCOMP_RET_ALLOW, in which case it will
402	* be unchanged.
403	*
404	* Returns valid seccomp BPF response codes.
405	*/
406	static u32 seccomp_run_filters(const struct seccomp_data *sd,
407	struct seccomp_filter **match)
408	{
409	u32 ret = SECCOMP_RET_ALLOW;
410	/* Make sure cross-thread synced filter points somewhere sane. */
411	struct seccomp_filter *f =
412	READ_ONCE(current->seccomp.filter);
413
414	/* Ensure unexpected behavior doesn't result in failing open. */
415	if (WARN_ON(f == NULL))
416	return SECCOMP_RET_KILL_PROCESS;
417
418	if (seccomp_cache_check_allow(f, sd))
419	return SECCOMP_RET_ALLOW;
420
421	/*
422	* All filters in the list are evaluated and the lowest BPF return
423	* value always takes priority (ignoring the DATA).
424	*/
425	for (; f; f = f->prev) {
426	u32 cur_ret = bpf_prog_run_pin_on_cpu(f->prog, sd);
427
428	if (ACTION_ONLY(cur_ret) < ACTION_ONLY(ret)) {
429	ret = cur_ret;
430	*match = f;
431	}
432	}
433	return ret;
434	}
435	#endif /* CONFIG_SECCOMP_FILTER */
436
437	static inline bool seccomp_may_assign_mode(unsigned long seccomp_mode)
438	{
439	assert_spin_locked(&current->sighand->siglock);
440
441	if (current->seccomp.mode && current->seccomp.mode != seccomp_mode)
442	return false;
443
444	return true;
445	}
446
447	void __weak arch_seccomp_spec_mitigate(struct task_struct *task) { }
448
449	static inline void seccomp_assign_mode(struct task_struct *task,
450	unsigned long seccomp_mode,
451	unsigned long flags)
452	{
453	assert_spin_locked(&task->sighand->siglock);
454
455	task->seccomp.mode = seccomp_mode;
456	/*
457	* Make sure SYSCALL_WORK_SECCOMP cannot be set before the mode (and
458	* filter) is set.
459	*/
460	smp_mb__before_atomic();
461	/* Assume default seccomp processes want spec flaw mitigation. */
462	if ((flags & SECCOMP_FILTER_FLAG_SPEC_ALLOW) == 0)
463	arch_seccomp_spec_mitigate(task);
464	set_task_syscall_work(task, SECCOMP);
465	}
466
467	#ifdef CONFIG_SECCOMP_FILTER
468	/* Returns 1 if the parent is an ancestor of the child. */
469	static int is_ancestor(struct seccomp_filter *parent,
470	struct seccomp_filter *child)
471	{
472	/* NULL is the root ancestor. */
473	if (parent == NULL)
474	return 1;
475	for (; child; child = child->prev)
476	if (child == parent)
477	return 1;
478	return 0;
479	}
480
481	/**
482	* seccomp_can_sync_threads: checks if all threads can be synchronized
483	*
484	* Expects sighand and cred_guard_mutex locks to be held.
485	*
486	* Returns 0 on success, -ve on error, or the pid of a thread which was
487	* either not in the correct seccomp mode or did not have an ancestral
488	* seccomp filter.
489	*/
490	static inline pid_t seccomp_can_sync_threads(void)
491	{
492	struct task_struct thread, caller;
493
494	BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
495	assert_spin_locked(&current->sighand->siglock);
496
497	/* Validate all threads being eligible for synchronization. */
498	caller = current;
499	for_each_thread(caller, thread) {
500	pid_t failed;
501
502	/* Skip current, since it is initiating the sync. */
503	if (thread == caller)
504	continue;
505	/* Skip exited threads. */
506	if (thread->flags & PF_EXITING)
507	continue;
508
509	if (thread->seccomp.mode == SECCOMP_MODE_DISABLED \|\|
510	(thread->seccomp.mode == SECCOMP_MODE_FILTER &&
511	is_ancestor(thread->seccomp.filter,
512	caller->seccomp.filter)))
513	continue;
514
515	/* Return the first thread that cannot be synchronized. */
516	failed = task_pid_vnr(thread);
517	/* If the pid cannot be resolved, then return -ESRCH */
518	if (WARN_ON(failed == 0))
519	failed = -ESRCH;
520	return failed;
521	}
522
523	return 0;
524	}
525
526	static inline void seccomp_filter_free(struct seccomp_filter *filter)
527	{
528	if (filter) {
529	bpf_prog_destroy(filter->prog);
530	kfree(filter);
531	}
532	}
533
534	static void __seccomp_filter_orphan(struct seccomp_filter *orig)
535	{
536	while (orig && refcount_dec_and_test(&orig->users)) {
537	if (waitqueue_active(&orig->wqh))
538	wake_up_poll(&orig->wqh, EPOLLHUP);
539	orig = orig->prev;
540	}
541	}
542
543	static void __put_seccomp_filter(struct seccomp_filter *orig)
544	{
545	/* Clean up single-reference branches iteratively. */
546	while (orig && refcount_dec_and_test(&orig->refs)) {
547	struct seccomp_filter *freeme = orig;
548	orig = orig->prev;
549	seccomp_filter_free(freeme);
550	}
551	}
552
553	static void __seccomp_filter_release(struct seccomp_filter *orig)
554	{
555	/* Notify about any unused filters in the task's former filter tree. */
556	__seccomp_filter_orphan(orig);
557	/* Finally drop all references to the task's former tree. */
558	__put_seccomp_filter(orig);
559	}
560
561	/**
562	* seccomp_filter_release - Detach the task from its filter tree,
563	* drop its reference count, and notify
564	* about unused filters
565	*
566	* @tsk: task the filter should be released from.
567	*
568	* This function should only be called when the task is exiting as
569	* it detaches it from its filter tree. PF_EXITING has to be set
570	* for the task.
571	*/
572	void seccomp_filter_release(struct task_struct *tsk)
573	{
574	struct seccomp_filter *orig;
575
576	if (WARN_ON((tsk->flags & PF_EXITING) == 0))
577	return;
578
579	spin_lock_irq(&tsk->sighand->siglock);
580	orig = tsk->seccomp.filter;
581	/* Detach task from its filter tree. */
582	tsk->seccomp.filter = NULL;
583	spin_unlock_irq(&tsk->sighand->siglock);
584	__seccomp_filter_release(orig);
585	}
586
587	/**
588	* seccomp_sync_threads: sets all threads to use current's filter
589	*
590	* @flags: SECCOMP_FILTER_FLAG_* flags to set during sync.
591	*
592	* Expects sighand and cred_guard_mutex locks to be held, and for
593	* seccomp_can_sync_threads() to have returned success already
594	* without dropping the locks.
595	*
596	*/
597	static inline void seccomp_sync_threads(unsigned long flags)
598	{
599	struct task_struct thread, caller;
600
601	BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
602	assert_spin_locked(&current->sighand->siglock);
603
604	/* Synchronize all threads. */
605	caller = current;
606	for_each_thread(caller, thread) {
607	/* Skip current, since it needs no changes. */
608	if (thread == caller)
609	continue;
610
611	/*
612	* Skip exited threads. seccomp_filter_release could have
613	* been already called for this task.
614	*/
615	if (thread->flags & PF_EXITING)
616	continue;
617
618	/* Get a task reference for the new leaf node. */
619	get_seccomp_filter(caller);
620
621	/*
622	* Drop the task reference to the shared ancestor since
623	* current's path will hold a reference. (This also
624	* allows a put before the assignment.)
625	*/
626	__seccomp_filter_release(thread->seccomp.filter);
627
628	/* Make our new filter tree visible. */
629	smp_store_release(&thread->seccomp.filter,
630	caller->seccomp.filter);
631	atomic_set(&thread->seccomp.filter_count,
632	atomic_read(&caller->seccomp.filter_count));
633
634	/*
635	* Don't let an unprivileged task work around
636	* the no_new_privs restriction by creating
637	* a thread that sets it up, enters seccomp,
638	* then dies.
639	*/
640	if (task_no_new_privs(caller))
641	task_set_no_new_privs(thread);
642
643	/*
644	* Opt the other thread into seccomp if needed.
645	* As threads are considered to be trust-realm
646	* equivalent (see ptrace_may_access), it is safe to
647	* allow one thread to transition the other.
648	*/
649	if (thread->seccomp.mode == SECCOMP_MODE_DISABLED)
650	seccomp_assign_mode(thread, SECCOMP_MODE_FILTER,
651	flags);
652	}
653	}
654
655	/**
656	* seccomp_prepare_filter: Prepares a seccomp filter for use.
657	* @fprog: BPF program to install
658	*
659	* Returns filter on success or an ERR_PTR on failure.
660	*/
661	static struct seccomp_filter seccomp_prepare_filter(struct sock_fprog fprog)
662	{
663	struct seccomp_filter *sfilter;
664	int ret;
665	const bool save_orig =
666	#if defined(CONFIG_CHECKPOINT_RESTORE) \|\| defined(SECCOMP_ARCH_NATIVE)
667	true;
668	#else
669	false;
670	#endif
671
672	if (fprog->len == 0 \|\| fprog->len > BPF_MAXINSNS)
673	return ERR_PTR(-EINVAL);
674
675	BUG_ON(INT_MAX / fprog->len < sizeof(struct sock_filter));
676
677	/*
678	* Installing a seccomp filter requires that the task has
679	* CAP_SYS_ADMIN in its namespace or be running with no_new_privs.
680	* This avoids scenarios where unprivileged tasks can affect the
681	* behavior of privileged children.
682	*/
683	if (!task_no_new_privs(current) &&
684	!ns_capable_noaudit(current_user_ns(), CAP_SYS_ADMIN))
685	return ERR_PTR(-EACCES);
686
687	/* Allocate a new seccomp_filter */
688	sfilter = kzalloc(sizeof(*sfilter), GFP_KERNEL \| __GFP_NOWARN);
689	if (!sfilter)
690	return ERR_PTR(-ENOMEM);
691
692	mutex_init(&sfilter->notify_lock);
693	ret = bpf_prog_create_from_user(&sfilter->prog, fprog,
694	seccomp_check_filter, save_orig);
695	if (ret < 0) {
696	kfree(sfilter);
697	return ERR_PTR(ret);
698	}
699
700	refcount_set(&sfilter->refs, 1);
701	refcount_set(&sfilter->users, 1);
702	init_waitqueue_head(&sfilter->wqh);
703
704	return sfilter;
705	}
706
707	/**
708	* seccomp_prepare_user_filter - prepares a user-supplied sock_fprog
709	* @user_filter: pointer to the user data containing a sock_fprog.
710	*
711	* Returns 0 on success and non-zero otherwise.
712	*/
713	static struct seccomp_filter *
714	seccomp_prepare_user_filter(const char __user *user_filter)
715	{
716	struct sock_fprog fprog;
717	struct seccomp_filter *filter = ERR_PTR(-EFAULT);
718
719	#ifdef CONFIG_COMPAT
720	if (in_compat_syscall()) {
721	struct compat_sock_fprog fprog32;
722	if (copy_from_user(&fprog32, user_filter, sizeof(fprog32)))
723	goto out;
724	fprog.len = fprog32.len;
725	fprog.filter = compat_ptr(fprog32.filter);
726	} else /* falls through to the if below. */
727	#endif
728	if (copy_from_user(&fprog, user_filter, sizeof(fprog)))
729	goto out;
730	filter = seccomp_prepare_filter(&fprog);
731	out:
732	return filter;
733	}
734
735	#ifdef SECCOMP_ARCH_NATIVE
736	/**
737	* seccomp_is_const_allow - check if filter is constant allow with given data
738	* @fprog: The BPF programs
739	* @sd: The seccomp data to check against, only syscall number and arch
740	* number are considered constant.
741	*/
742	static bool seccomp_is_const_allow(struct sock_fprog_kern *fprog,
743	struct seccomp_data *sd)
744	{
745	unsigned int reg_value = 0;
746	unsigned int pc;
747	bool op_res;
748
749	if (WARN_ON_ONCE(!fprog))
750	return false;
751
752	for (pc = 0; pc < fprog->len; pc++) {
753	struct sock_filter *insn = &fprog->filter[pc];
754	u16 code = insn->code;
755	u32 k = insn->k;
756
757	switch (code) {
758	case BPF_LD \| BPF_W \| BPF_ABS:
759	switch (k) {
760	case offsetof(struct seccomp_data, nr):
761	reg_value = sd->nr;
762	break;
763	case offsetof(struct seccomp_data, arch):
764	reg_value = sd->arch;
765	break;
766	default:
767	/* can't optimize (non-constant value load) */
768	return false;
769	}
770	break;
771	case BPF_RET \| BPF_K:
772	/* reached return with constant values only, check allow */
773	return k == SECCOMP_RET_ALLOW;
774	case BPF_JMP \| BPF_JA:
775	pc += insn->k;
776	break;
777	case BPF_JMP \| BPF_JEQ \| BPF_K:
778	case BPF_JMP \| BPF_JGE \| BPF_K:
779	case BPF_JMP \| BPF_JGT \| BPF_K:
780	case BPF_JMP \| BPF_JSET \| BPF_K:
781	switch (BPF_OP(code)) {
782	case BPF_JEQ:
783	op_res = reg_value == k;
784	break;
785	case BPF_JGE:
786	op_res = reg_value >= k;
787	break;
788	case BPF_JGT:
789	op_res = reg_value > k;
790	break;
791	case BPF_JSET:
792	op_res = !!(reg_value & k);
793	break;
794	default:
795	/* can't optimize (unknown jump) */
796	return false;
797	}
798
799	pc += op_res ? insn->jt : insn->jf;
800	break;
801	case BPF_ALU \| BPF_AND \| BPF_K:
802	reg_value &= k;
803	break;
804	default:
805	/* can't optimize (unknown insn) */
806	return false;
807	}
808	}
809
810	/* ran off the end of the filter?! */
811	WARN_ON(1);
812	return false;
813	}
814
815	static void seccomp_cache_prepare_bitmap(struct seccomp_filter *sfilter,
816	void bitmap, const void bitmap_prev,
817	size_t bitmap_size, int arch)
818	{
819	struct sock_fprog_kern *fprog = sfilter->prog->orig_prog;
820	struct seccomp_data sd;
821	int nr;
822
823	if (bitmap_prev) {
824	/* The new filter must be as restrictive as the last. */
825	bitmap_copy(bitmap, bitmap_prev, bitmap_size);
826	} else {
827	/* Before any filters, all syscalls are always allowed. */
828	bitmap_fill(bitmap, bitmap_size);
829	}
830
831	for (nr = 0; nr < bitmap_size; nr++) {
832	/* No bitmap change: not a cacheable action. */
833	if (!test_bit(nr, bitmap))
834	continue;
835
836	sd.nr = nr;
837	sd.arch = arch;
838
839	/* No bitmap change: continue to always allow. */
840	if (seccomp_is_const_allow(fprog, &sd))
841	continue;
842
843	/*
844	* Not a cacheable action: always run filters.
845	* atomic clear_bit() not needed, filter not visible yet.
846	*/
847	__clear_bit(nr, bitmap);
848	}
849	}
850
851	/**
852	* seccomp_cache_prepare - emulate the filter to find cacheable syscalls
853	* @sfilter: The seccomp filter
854	*
855	* Returns 0 if successful or -errno if error occurred.
856	*/
857	static void seccomp_cache_prepare(struct seccomp_filter *sfilter)
858	{
859	struct action_cache *cache = &sfilter->cache;
860	const struct action_cache *cache_prev =
861	sfilter->prev ? &sfilter->prev->cache : NULL;
862
863	seccomp_cache_prepare_bitmap(sfilter, cache->allow_native,
864	cache_prev ? cache_prev->allow_native : NULL,
865	SECCOMP_ARCH_NATIVE_NR,
866	SECCOMP_ARCH_NATIVE);
867
868	#ifdef SECCOMP_ARCH_COMPAT
869	seccomp_cache_prepare_bitmap(sfilter, cache->allow_compat,
870	cache_prev ? cache_prev->allow_compat : NULL,
871	SECCOMP_ARCH_COMPAT_NR,
872	SECCOMP_ARCH_COMPAT);
873	#endif /* SECCOMP_ARCH_COMPAT */
874	}
875	#endif /* SECCOMP_ARCH_NATIVE */
876
877	/**
878	* seccomp_attach_filter: validate and attach filter
879	* @flags: flags to change filter behavior
880	* @filter: seccomp filter to add to the current process
881	*
882	* Caller must be holding current->sighand->siglock lock.
883	*
884	* Returns 0 on success, -ve on error, or
885	* - in TSYNC mode: the pid of a thread which was either not in the correct
886	* seccomp mode or did not have an ancestral seccomp filter
887	* - in NEW_LISTENER mode: the fd of the new listener
888	*/
889	static long seccomp_attach_filter(unsigned int flags,
890	struct seccomp_filter *filter)
891	{
892	unsigned long total_insns;
893	struct seccomp_filter *walker;
894
895	assert_spin_locked(&current->sighand->siglock);
896
897	/* Validate resulting filter length. */
898	total_insns = filter->prog->len;
899	for (walker = current->seccomp.filter; walker; walker = walker->prev)
900	total_insns += walker->prog->len + 4; /* 4 instr penalty */
901	if (total_insns > MAX_INSNS_PER_PATH)
902	return -ENOMEM;
903
904	/* If thread sync has been requested, check that it is possible. */
905	if (flags & SECCOMP_FILTER_FLAG_TSYNC) {
906	int ret;
907
908	ret = seccomp_can_sync_threads();
909	if (ret) {
910	if (flags & SECCOMP_FILTER_FLAG_TSYNC_ESRCH)
911	return -ESRCH;
912	else
913	return ret;
914	}
915	}
916
917	/* Set log flag, if present. */
918	if (flags & SECCOMP_FILTER_FLAG_LOG)
919	filter->log = true;
920
921	/* Set wait killable flag, if present. */
922	if (flags & SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV)
923	filter->wait_killable_recv = true;
924
925	/*
926	* If there is an existing filter, make it the prev and don't drop its
927	* task reference.
928	*/
929	filter->prev = current->seccomp.filter;
930	seccomp_cache_prepare(filter);
931	current->seccomp.filter = filter;
932	atomic_inc(&current->seccomp.filter_count);
933
934	/* Now that the new filter is in place, synchronize to all threads. */
935	if (flags & SECCOMP_FILTER_FLAG_TSYNC)
936	seccomp_sync_threads(flags);
937
938	return 0;
939	}
940
941	static void __get_seccomp_filter(struct seccomp_filter *filter)
942	{
943	refcount_inc(&filter->refs);
944	}
945
946	/* get_seccomp_filter - increments the reference count of the filter on @tsk */
947	void get_seccomp_filter(struct task_struct *tsk)
948	{
949	struct seccomp_filter *orig = tsk->seccomp.filter;
950	if (!orig)
951	return;
952	__get_seccomp_filter(orig);
953	refcount_inc(&orig->users);
954	}
955
956	#endif /* CONFIG_SECCOMP_FILTER */
957
958	/* For use with seccomp_actions_logged */
959	#define SECCOMP_LOG_KILL_PROCESS (1 << 0)
960	#define SECCOMP_LOG_KILL_THREAD (1 << 1)
961	#define SECCOMP_LOG_TRAP (1 << 2)
962	#define SECCOMP_LOG_ERRNO (1 << 3)
963	#define SECCOMP_LOG_TRACE (1 << 4)
964	#define SECCOMP_LOG_LOG (1 << 5)
965	#define SECCOMP_LOG_ALLOW (1 << 6)
966	#define SECCOMP_LOG_USER_NOTIF (1 << 7)
967
968	static u32 seccomp_actions_logged = SECCOMP_LOG_KILL_PROCESS \|
969	SECCOMP_LOG_KILL_THREAD \|
970	SECCOMP_LOG_TRAP \|
971	SECCOMP_LOG_ERRNO \|
972	SECCOMP_LOG_USER_NOTIF \|
973	SECCOMP_LOG_TRACE \|
974	SECCOMP_LOG_LOG;
975
976	static inline void seccomp_log(unsigned long syscall, long signr, u32 action,
977	bool requested)
978	{
979	bool log = false;
980
981	switch (action) {
982	case SECCOMP_RET_ALLOW:
983	break;
984	case SECCOMP_RET_TRAP:
985	log = requested && seccomp_actions_logged & SECCOMP_LOG_TRAP;
986	break;
987	case SECCOMP_RET_ERRNO:
988	log = requested && seccomp_actions_logged & SECCOMP_LOG_ERRNO;
989	break;
990	case SECCOMP_RET_TRACE:
991	log = requested && seccomp_actions_logged & SECCOMP_LOG_TRACE;
992	break;
993	case SECCOMP_RET_USER_NOTIF:
994	log = requested && seccomp_actions_logged & SECCOMP_LOG_USER_NOTIF;
995	break;
996	case SECCOMP_RET_LOG:
997	log = seccomp_actions_logged & SECCOMP_LOG_LOG;
998	break;
999	case SECCOMP_RET_KILL_THREAD:
1000	log = seccomp_actions_logged & SECCOMP_LOG_KILL_THREAD;
1001	break;
1002	case SECCOMP_RET_KILL_PROCESS:
1003	default:
1004	log = seccomp_actions_logged & SECCOMP_LOG_KILL_PROCESS;
1005	}
1006
1007	/*
1008	* Emit an audit message when the action is RET_KILL_*, RET_LOG, or the
1009	* FILTER_FLAG_LOG bit was set. The admin has the ability to silence
1010	* any action from being logged by removing the action name from the
1011	* seccomp_actions_logged sysctl.
1012	*/
1013	if (!log)
1014	return;
1015
1016	audit_seccomp(syscall, signr, action);
1017	}
1018
1019	/*
1020	* Secure computing mode 1 allows only read/write/exit/sigreturn.
1021	* To be fully secure this must be combined with rlimit
1022	* to limit the stack allocations too.
1023	*/
1024	static const int mode1_syscalls[] = {
1025	__NR_seccomp_read, __NR_seccomp_write, __NR_seccomp_exit, __NR_seccomp_sigreturn,
1026	-1, /* negative terminated */
1027	};
1028
1029	static void __secure_computing_strict(int this_syscall)
1030	{
1031	const int *allowed_syscalls = mode1_syscalls;
1032	#ifdef CONFIG_COMPAT
1033	if (in_compat_syscall())
1034	allowed_syscalls = get_compat_mode1_syscalls();
1035	#endif
1036	do {
1037	if (*allowed_syscalls == this_syscall)
1038	return;
1039	} while (*++allowed_syscalls != -1);
1040
1041	#ifdef SECCOMP_DEBUG
1042	dump_stack();
1043	#endif
1044	current->seccomp.mode = SECCOMP_MODE_DEAD;
1045	seccomp_log(this_syscall, SIGKILL, SECCOMP_RET_KILL_THREAD, true);
1046	do_exit(SIGKILL);
1047	}
1048
1049	#ifndef CONFIG_HAVE_ARCH_SECCOMP_FILTER
1050	void secure_computing_strict(int this_syscall)
1051	{
1052	int mode = current->seccomp.mode;
1053
1054	if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) &&
1055	unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
1056	return;
1057
1058	if (mode == SECCOMP_MODE_DISABLED)
1059	return;
1060	else if (mode == SECCOMP_MODE_STRICT)
1061	__secure_computing_strict(this_syscall);
1062	else
1063	BUG();
1064	}
1065	#else
1066
1067	#ifdef CONFIG_SECCOMP_FILTER
1068	static u64 seccomp_next_notify_id(struct seccomp_filter *filter)
1069	{
1070	/*
1071	* Note: overflow is ok here, the id just needs to be unique per
1072	* filter.
1073	*/
1074	lockdep_assert_held(&filter->notify_lock);
1075	return filter->notif->next_id++;
1076	}
1077
1078	static void seccomp_handle_addfd(struct seccomp_kaddfd addfd, struct seccomp_knotif n)
1079	{
1080	int fd;
1081
1082	/*
1083	* Remove the notification, and reset the list pointers, indicating
1084	* that it has been handled.
1085	*/
1086	list_del_init(&addfd->list);
1087	if (!addfd->setfd)
1088	fd = receive_fd(addfd->file, NULL, addfd->flags);
1089	else
1090	fd = receive_fd_replace(addfd->fd, addfd->file, addfd->flags);
1091	addfd->ret = fd;
1092
1093	if (addfd->ioctl_flags & SECCOMP_ADDFD_FLAG_SEND) {
1094	/* If we fail reset and return an error to the notifier */
1095	if (fd < 0) {
1096	n->state = SECCOMP_NOTIFY_SENT;
1097	} else {
1098	/* Return the FD we just added */
1099	n->flags = 0;
1100	n->error = 0;
1101	n->val = fd;
1102	}
1103	}
1104
1105	/*
1106	* Mark the notification as completed. From this point, addfd mem
1107	* might be invalidated and we can't safely read it anymore.
1108	*/
1109	complete(&addfd->completion);
1110	}
1111
1112	static bool should_sleep_killable(struct seccomp_filter *match,
1113	struct seccomp_knotif *n)
1114	{
1115	return match->wait_killable_recv && n->state == SECCOMP_NOTIFY_SENT;
1116	}
1117
1118	static int seccomp_do_user_notification(int this_syscall,
1119	struct seccomp_filter *match,
1120	const struct seccomp_data *sd)
1121	{
1122	int err;
1123	u32 flags = 0;
1124	long ret = 0;
1125	struct seccomp_knotif n = {};
1126	struct seccomp_kaddfd addfd, tmp;
1127
1128	mutex_lock(&match->notify_lock);
1129	err = -ENOSYS;
1130	if (!match->notif)
1131	goto out;
1132
1133	n.task = current;
1134	n.state = SECCOMP_NOTIFY_INIT;
1135	n.data = sd;
1136	n.id = seccomp_next_notify_id(match);
1137	init_completion(&n.ready);
1138	list_add_tail(&n.list, &match->notif->notifications);
1139	INIT_LIST_HEAD(&n.addfd);
1140
1141	atomic_inc(&match->notif->requests);
1142	if (match->notif->flags & SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP)
1143	wake_up_poll_on_current_cpu(&match->wqh, EPOLLIN \| EPOLLRDNORM);
1144	else
1145	wake_up_poll(&match->wqh, EPOLLIN \| EPOLLRDNORM);
1146
1147	/*
1148	* This is where we wait for a reply from userspace.
1149	*/
1150	do {
1151	bool wait_killable = should_sleep_killable(match, &n);
1152
1153	mutex_unlock(&match->notify_lock);
1154	if (wait_killable)
1155	err = wait_for_completion_killable(&n.ready);
1156	else
1157	err = wait_for_completion_interruptible(&n.ready);
1158	mutex_lock(&match->notify_lock);
1159
1160	if (err != 0) {
1161	/*
1162	* Check to see if the notifcation got picked up and
1163	* whether we should switch to wait killable.
1164	*/
1165	if (!wait_killable && should_sleep_killable(match, &n))
1166	continue;
1167
1168	goto interrupted;
1169	}
1170
1171	addfd = list_first_entry_or_null(&n.addfd,
1172	struct seccomp_kaddfd, list);
1173	/* Check if we were woken up by a addfd message */
1174	if (addfd)
1175	seccomp_handle_addfd(addfd, &n);
1176
1177	} while (n.state != SECCOMP_NOTIFY_REPLIED);
1178
1179	ret = n.val;
1180	err = n.error;
1181	flags = n.flags;
1182
1183	interrupted:
1184	/* If there were any pending addfd calls, clear them out */
1185	list_for_each_entry_safe(addfd, tmp, &n.addfd, list) {
1186	/* The process went away before we got a chance to handle it */
1187	addfd->ret = -ESRCH;
1188	list_del_init(&addfd->list);
1189	complete(&addfd->completion);
1190	}
1191
1192	/*
1193	* Note that it's possible the listener died in between the time when
1194	* we were notified of a response (or a signal) and when we were able to
1195	* re-acquire the lock, so only delete from the list if the
1196	* notification actually exists.
1197	*
1198	* Also note that this test is only valid because there's no way to
1199	* reattach to a notifier right now. If one is added, we'll need to
1200	* keep track of the notif itself and make sure they match here.
1201	*/
1202	if (match->notif)
1203	list_del(&n.list);
1204	out:
1205	mutex_unlock(&match->notify_lock);
1206
1207	/* Userspace requests to continue the syscall. */
1208	if (flags & SECCOMP_USER_NOTIF_FLAG_CONTINUE)
1209	return 0;
1210
1211	syscall_set_return_value(current, current_pt_regs(),
1212	err, ret);
1213	return -1;
1214	}
1215
1216	static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
1217	const bool recheck_after_trace)
1218	{
1219	u32 filter_ret, action;
1220	struct seccomp_filter *match = NULL;
1221	int data;
1222	struct seccomp_data sd_local;
1223
1224	/*
1225	* Make sure that any changes to mode from another thread have
1226	* been seen after SYSCALL_WORK_SECCOMP was seen.
1227	*/
1228	smp_rmb();
1229
1230	if (!sd) {
1231	populate_seccomp_data(&sd_local);
1232	sd = &sd_local;
1233	}
1234
1235	filter_ret = seccomp_run_filters(sd, &match);
1236	data = filter_ret & SECCOMP_RET_DATA;
1237	action = filter_ret & SECCOMP_RET_ACTION_FULL;
1238
1239	switch (action) {
1240	case SECCOMP_RET_ERRNO:
1241	/* Set low-order bits as an errno, capped at MAX_ERRNO. */
1242	if (data > MAX_ERRNO)
1243	data = MAX_ERRNO;
1244	syscall_set_return_value(current, current_pt_regs(),
1245	-data, 0);
1246	goto skip;
1247
1248	case SECCOMP_RET_TRAP:
1249	/* Show the handler the original registers. */
1250	syscall_rollback(current, current_pt_regs());
1251	/* Let the filter pass back 16 bits of data. */
1252	force_sig_seccomp(this_syscall, data, false);
1253	goto skip;
1254
1255	case SECCOMP_RET_TRACE:
1256	/* We've been put in this state by the ptracer already. */
1257	if (recheck_after_trace)
1258	return 0;
1259
1260	/* ENOSYS these calls if there is no tracer attached. */
1261	if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP)) {
1262	syscall_set_return_value(current,
1263	current_pt_regs(),
1264	-ENOSYS, 0);
1265	goto skip;
1266	}
1267
1268	/* Allow the BPF to provide the event message */
1269	ptrace_event(PTRACE_EVENT_SECCOMP, data);
1270	/*
1271	* The delivery of a fatal signal during event
1272	* notification may silently skip tracer notification,
1273	* which could leave us with a potentially unmodified
1274	* syscall that the tracer would have liked to have
1275	* changed. Since the process is about to die, we just
1276	* force the syscall to be skipped and let the signal
1277	* kill the process and correctly handle any tracer exit
1278	* notifications.
1279	*/
1280	if (fatal_signal_pending(current))
1281	goto skip;
1282	/* Check if the tracer forced the syscall to be skipped. */
1283	this_syscall = syscall_get_nr(current, current_pt_regs());
1284	if (this_syscall < 0)
1285	goto skip;
1286
1287	/*
1288	* Recheck the syscall, since it may have changed. This
1289	* intentionally uses a NULL struct seccomp_data to force
1290	* a reload of all registers. This does not goto skip since
1291	* a skip would have already been reported.
1292	*/
1293	if (__seccomp_filter(this_syscall, NULL, true))
1294	return -1;
1295
1296	return 0;
1297
1298	case SECCOMP_RET_USER_NOTIF:
1299	if (seccomp_do_user_notification(this_syscall, match, sd))
1300	goto skip;
1301
1302	return 0;
1303
1304	case SECCOMP_RET_LOG:
1305	seccomp_log(this_syscall, 0, action, true);
1306	return 0;
1307
1308	case SECCOMP_RET_ALLOW:
1309	/*
1310	* Note that the "match" filter will always be NULL for
1311	* this action since SECCOMP_RET_ALLOW is the starting
1312	* state in seccomp_run_filters().
1313	*/
1314	return 0;
1315
1316	case SECCOMP_RET_KILL_THREAD:
1317	case SECCOMP_RET_KILL_PROCESS:
1318	default:
1319	current->seccomp.mode = SECCOMP_MODE_DEAD;
1320	seccomp_log(this_syscall, SIGSYS, action, true);
1321	/* Dump core only if this is the last remaining thread. */
1322	if (action != SECCOMP_RET_KILL_THREAD \|\|
1323	(atomic_read(&current->signal->live) == 1)) {
1324	/* Show the original registers in the dump. */
1325	syscall_rollback(current, current_pt_regs());
1326	/* Trigger a coredump with SIGSYS */
1327	force_sig_seccomp(this_syscall, data, true);
1328	} else {
1329	do_exit(SIGSYS);
1330	}
1331	return -1; /* skip the syscall go directly to signal handling */
1332	}
1333
1334	unreachable();
1335
1336	skip:
1337	seccomp_log(this_syscall, 0, action, match ? match->log : false);
1338	return -1;
1339	}
1340	#else
1341	static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
1342	const bool recheck_after_trace)
1343	{
1344	BUG();
1345
1346	return -1;
1347	}
1348	#endif
1349
1350	int __secure_computing(const struct seccomp_data *sd)
1351	{
1352	int mode = current->seccomp.mode;
1353	int this_syscall;
1354
1355	if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) &&
1356	unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
1357	return 0;
1358
1359	this_syscall = sd ? sd->nr :
1360	syscall_get_nr(current, current_pt_regs());
1361
1362	switch (mode) {
1363	case SECCOMP_MODE_STRICT:
1364	__secure_computing_strict(this_syscall); /* may call do_exit */
1365	return 0;
1366	case SECCOMP_MODE_FILTER:
1367	return __seccomp_filter(this_syscall, sd, false);
1368	/* Surviving SECCOMP_RET_KILL_* must be proactively impossible. */
1369	case SECCOMP_MODE_DEAD:
1370	WARN_ON_ONCE(1);
1371	do_exit(SIGKILL);
1372	return -1;
1373	default:
1374	BUG();
1375	}
1376	}
1377	#endif /* CONFIG_HAVE_ARCH_SECCOMP_FILTER */
1378
1379	long prctl_get_seccomp(void)
1380	{
1381	return current->seccomp.mode;
1382	}
1383
1384	/**
1385	* seccomp_set_mode_strict: internal function for setting strict seccomp
1386	*
1387	* Once current->seccomp.mode is non-zero, it may not be changed.
1388	*
1389	* Returns 0 on success or -EINVAL on failure.
1390	*/
1391	static long seccomp_set_mode_strict(void)
1392	{
1393	const unsigned long seccomp_mode = SECCOMP_MODE_STRICT;
1394	long ret = -EINVAL;
1395
1396	spin_lock_irq(&current->sighand->siglock);
1397
1398	if (!seccomp_may_assign_mode(seccomp_mode))
1399	goto out;
1400
1401	#ifdef TIF_NOTSC
1402	disable_TSC();
1403	#endif
1404	seccomp_assign_mode(current, seccomp_mode, 0);
1405	ret = 0;
1406
1407	out:
1408	spin_unlock_irq(&current->sighand->siglock);
1409
1410	return ret;
1411	}
1412
1413	#ifdef CONFIG_SECCOMP_FILTER
1414	static void seccomp_notify_free(struct seccomp_filter *filter)
1415	{
1416	kfree(filter->notif);
1417	filter->notif = NULL;
1418	}
1419
1420	static void seccomp_notify_detach(struct seccomp_filter *filter)
1421	{
1422	struct seccomp_knotif *knotif;
1423
1424	if (!filter)
1425	return;
1426
1427	mutex_lock(&filter->notify_lock);
1428
1429	/*
1430	* If this file is being closed because e.g. the task who owned it
1431	* died, let's wake everyone up who was waiting on us.
1432	*/
1433	list_for_each_entry(knotif, &filter->notif->notifications, list) {
1434	if (knotif->state == SECCOMP_NOTIFY_REPLIED)
1435	continue;
1436
1437	knotif->state = SECCOMP_NOTIFY_REPLIED;
1438	knotif->error = -ENOSYS;
1439	knotif->val = 0;
1440
1441	/*
1442	* We do not need to wake up any pending addfd messages, as
1443	* the notifier will do that for us, as this just looks
1444	* like a standard reply.
1445	*/
1446	complete(&knotif->ready);
1447	}
1448
1449	seccomp_notify_free(filter);
1450	mutex_unlock(&filter->notify_lock);
1451	}
1452
1453	static int seccomp_notify_release(struct inode inode, struct file file)
1454	{
1455	struct seccomp_filter *filter = file->private_data;
1456
1457	seccomp_notify_detach(filter);
1458	__put_seccomp_filter(filter);
1459	return 0;
1460	}
1461
1462	/* must be called with notif_lock held */
1463	static inline struct seccomp_knotif *
1464	find_notification(struct seccomp_filter *filter, u64 id)
1465	{
1466	struct seccomp_knotif *cur;
1467
1468	lockdep_assert_held(&filter->notify_lock);
1469
1470	list_for_each_entry(cur, &filter->notif->notifications, list) {
1471	if (cur->id == id)
1472	return cur;
1473	}
1474
1475	return NULL;
1476	}
1477
1478	static int recv_wake_function(wait_queue_entry_t *wait, unsigned int mode, int sync,
1479	void *key)
1480	{
1481	/* Avoid a wakeup if event not interesting for us. */
1482	if (key && !(key_to_poll(key) & (EPOLLIN \| EPOLLERR \| EPOLLHUP)))
1483	return 0;
1484	return autoremove_wake_function(wait, mode, sync, key);
1485	}
1486
1487	static int recv_wait_event(struct seccomp_filter *filter)
1488	{
1489	DEFINE_WAIT_FUNC(wait, recv_wake_function);
1490	int ret;
1491
1492	if (refcount_read(&filter->users) == 0)
1493	return 0;
1494
1495	if (atomic_dec_if_positive(&filter->notif->requests) >= 0)
1496	return 0;
1497
1498	for (;;) {
1499	ret = prepare_to_wait_event(&filter->wqh, &wait, TASK_INTERRUPTIBLE);
1500
1501	if (atomic_dec_if_positive(&filter->notif->requests) >= 0)
1502	break;
1503	if (refcount_read(&filter->users) == 0)
1504	break;
1505
1506	if (ret)
1507	return ret;
1508
1509	schedule();
1510	}
1511	finish_wait(&filter->wqh, &wait);
1512	return 0;
1513	}
1514
1515	static long seccomp_notify_recv(struct seccomp_filter *filter,
1516	void __user *buf)
1517	{
1518	struct seccomp_knotif knotif = NULL, cur;
1519	struct seccomp_notif unotif;
1520	ssize_t ret;
1521
1522	/* Verify that we're not given garbage to keep struct extensible. */
1523	ret = check_zeroed_user(buf, sizeof(unotif));
1524	if (ret < 0)
1525	return ret;
1526	if (!ret)
1527	return -EINVAL;
1528
1529	memset(&unotif, 0, sizeof(unotif));
1530
1531	ret = recv_wait_event(filter);
1532	if (ret < 0)
1533	return ret;
1534
1535	mutex_lock(&filter->notify_lock);
1536	list_for_each_entry(cur, &filter->notif->notifications, list) {
1537	if (cur->state == SECCOMP_NOTIFY_INIT) {
1538	knotif = cur;
1539	break;
1540	}
1541	}
1542
1543	/*
1544	* If we didn't find a notification, it could be that the task was
1545	* interrupted by a fatal signal between the time we were woken and
1546	* when we were able to acquire the rw lock.
1547	*/
1548	if (!knotif) {
1549	ret = -ENOENT;
1550	goto out;
1551	}
1552
1553	unotif.id = knotif->id;
1554	unotif.pid = task_pid_vnr(knotif->task);
1555	unotif.data = *(knotif->data);
1556
1557	knotif->state = SECCOMP_NOTIFY_SENT;
1558	wake_up_poll(&filter->wqh, EPOLLOUT \| EPOLLWRNORM);
1559	ret = 0;
1560	out:
1561	mutex_unlock(&filter->notify_lock);
1562
1563	if (ret == 0 && copy_to_user(buf, &unotif, sizeof(unotif))) {
1564	ret = -EFAULT;
1565
1566	/*
1567	* Userspace screwed up. To make sure that we keep this
1568	* notification alive, let's reset it back to INIT. It
1569	* may have died when we released the lock, so we need to make
1570	* sure it's still around.
1571	*/
1572	mutex_lock(&filter->notify_lock);
1573	knotif = find_notification(filter, unotif.id);
1574	if (knotif) {
1575	/* Reset the process to make sure it's not stuck */
1576	if (should_sleep_killable(filter, knotif))
1577	complete(&knotif->ready);
1578	knotif->state = SECCOMP_NOTIFY_INIT;
1579	atomic_inc(&filter->notif->requests);
1580	wake_up_poll(&filter->wqh, EPOLLIN \| EPOLLRDNORM);
1581	}
1582	mutex_unlock(&filter->notify_lock);
1583	}
1584
1585	return ret;
1586	}
1587
1588	static long seccomp_notify_send(struct seccomp_filter *filter,
1589	void __user *buf)
1590	{
1591	struct seccomp_notif_resp resp = {};
1592	struct seccomp_knotif *knotif;
1593	long ret;
1594
1595	if (copy_from_user(&resp, buf, sizeof(resp)))
1596	return -EFAULT;
1597
1598	if (resp.flags & ~SECCOMP_USER_NOTIF_FLAG_CONTINUE)
1599	return -EINVAL;
1600
1601	if ((resp.flags & SECCOMP_USER_NOTIF_FLAG_CONTINUE) &&
1602	(resp.error \|\| resp.val))
1603	return -EINVAL;
1604
1605	ret = mutex_lock_interruptible(&filter->notify_lock);
1606	if (ret < 0)
1607	return ret;
1608
1609	knotif = find_notification(filter, resp.id);
1610	if (!knotif) {
1611	ret = -ENOENT;
1612	goto out;
1613	}
1614
1615	/* Allow exactly one reply. */
1616	if (knotif->state != SECCOMP_NOTIFY_SENT) {
1617	ret = -EINPROGRESS;
1618	goto out;
1619	}
1620
1621	ret = 0;
1622	knotif->state = SECCOMP_NOTIFY_REPLIED;
1623	knotif->error = resp.error;
1624	knotif->val = resp.val;
1625	knotif->flags = resp.flags;
1626	if (filter->notif->flags & SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP)
1627	complete_on_current_cpu(&knotif->ready);
1628	else
1629	complete(&knotif->ready);
1630	out:
1631	mutex_unlock(&filter->notify_lock);
1632	return ret;
1633	}
1634
1635	static long seccomp_notify_id_valid(struct seccomp_filter *filter,
1636	void __user *buf)
1637	{
1638	struct seccomp_knotif *knotif;
1639	u64 id;
1640	long ret;
1641
1642	if (copy_from_user(&id, buf, sizeof(id)))
1643	return -EFAULT;
1644
1645	ret = mutex_lock_interruptible(&filter->notify_lock);
1646	if (ret < 0)
1647	return ret;
1648
1649	knotif = find_notification(filter, id);
1650	if (knotif && knotif->state == SECCOMP_NOTIFY_SENT)
1651	ret = 0;
1652	else
1653	ret = -ENOENT;
1654
1655	mutex_unlock(&filter->notify_lock);
1656	return ret;
1657	}
1658
1659	static long seccomp_notify_set_flags(struct seccomp_filter *filter,
1660	unsigned long flags)
1661	{
1662	long ret;
1663
1664	if (flags & ~SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP)
1665	return -EINVAL;
1666
1667	ret = mutex_lock_interruptible(&filter->notify_lock);
1668	if (ret < 0)
1669	return ret;
1670	filter->notif->flags = flags;
1671	mutex_unlock(&filter->notify_lock);
1672	return 0;
1673	}
1674
1675	static long seccomp_notify_addfd(struct seccomp_filter *filter,
1676	struct seccomp_notif_addfd __user *uaddfd,
1677	unsigned int size)
1678	{
1679	struct seccomp_notif_addfd addfd;
1680	struct seccomp_knotif *knotif;
1681	struct seccomp_kaddfd kaddfd;
1682	int ret;
1683
1684	BUILD_BUG_ON(sizeof(addfd) < SECCOMP_NOTIFY_ADDFD_SIZE_VER0);
1685	BUILD_BUG_ON(sizeof(addfd) != SECCOMP_NOTIFY_ADDFD_SIZE_LATEST);
1686
1687	if (size < SECCOMP_NOTIFY_ADDFD_SIZE_VER0 \|\| size >= PAGE_SIZE)
1688	return -EINVAL;
1689
1690	ret = copy_struct_from_user(&addfd, sizeof(addfd), uaddfd, size);
1691	if (ret)
1692	return ret;
1693
1694	if (addfd.newfd_flags & ~O_CLOEXEC)
1695	return -EINVAL;
1696
1697	if (addfd.flags & ~(SECCOMP_ADDFD_FLAG_SETFD \| SECCOMP_ADDFD_FLAG_SEND))
1698	return -EINVAL;
1699
1700	if (addfd.newfd && !(addfd.flags & SECCOMP_ADDFD_FLAG_SETFD))
1701	return -EINVAL;
1702
1703	kaddfd.file = fget(addfd.srcfd);
1704	if (!kaddfd.file)
1705	return -EBADF;
1706
1707	kaddfd.ioctl_flags = addfd.flags;
1708	kaddfd.flags = addfd.newfd_flags;
1709	kaddfd.setfd = addfd.flags & SECCOMP_ADDFD_FLAG_SETFD;
1710	kaddfd.fd = addfd.newfd;
1711	init_completion(&kaddfd.completion);
1712
1713	ret = mutex_lock_interruptible(&filter->notify_lock);
1714	if (ret < 0)
1715	goto out;
1716
1717	knotif = find_notification(filter, addfd.id);
1718	if (!knotif) {
1719	ret = -ENOENT;
1720	goto out_unlock;
1721	}
1722
1723	/*
1724	* We do not want to allow for FD injection to occur before the
1725	* notification has been picked up by a userspace handler, or after
1726	* the notification has been replied to.
1727	*/
1728	if (knotif->state != SECCOMP_NOTIFY_SENT) {
1729	ret = -EINPROGRESS;
1730	goto out_unlock;
1731	}
1732
1733	if (addfd.flags & SECCOMP_ADDFD_FLAG_SEND) {
1734	/*
1735	* Disallow queuing an atomic addfd + send reply while there are
1736	* some addfd requests still to process.
1737	*
1738	* There is no clear reason to support it and allows us to keep
1739	* the loop on the other side straight-forward.
1740	*/
1741	if (!list_empty(&knotif->addfd)) {
1742	ret = -EBUSY;
1743	goto out_unlock;
1744	}
1745
1746	/* Allow exactly only one reply */
1747	knotif->state = SECCOMP_NOTIFY_REPLIED;
1748	}
1749
1750	list_add(&kaddfd.list, &knotif->addfd);
1751	complete(&knotif->ready);
1752	mutex_unlock(&filter->notify_lock);
1753
1754	/* Now we wait for it to be processed or be interrupted */
1755	ret = wait_for_completion_interruptible(&kaddfd.completion);
1756	if (ret == 0) {
1757	/*
1758	* We had a successful completion. The other side has already
1759	* removed us from the addfd queue, and
1760	* wait_for_completion_interruptible has a memory barrier upon
1761	* success that lets us read this value directly without
1762	* locking.
1763	*/
1764	ret = kaddfd.ret;
1765	goto out;
1766	}
1767
1768	mutex_lock(&filter->notify_lock);
1769	/*
1770	* Even though we were woken up by a signal and not a successful
1771	* completion, a completion may have happened in the mean time.
1772	*
1773	* We need to check again if the addfd request has been handled,
1774	* and if not, we will remove it from the queue.
1775	*/
1776	if (list_empty(&kaddfd.list))
1777	ret = kaddfd.ret;
1778	else
1779	list_del(&kaddfd.list);
1780
1781	out_unlock:
1782	mutex_unlock(&filter->notify_lock);
1783	out:
1784	fput(kaddfd.file);
1785
1786	return ret;
1787	}
1788
1789	static long seccomp_notify_ioctl(struct file *file, unsigned int cmd,
1790	unsigned long arg)
1791	{
1792	struct seccomp_filter *filter = file->private_data;
1793	void __user buf = (void __user )arg;
1794
1795	/* Fixed-size ioctls */
1796	switch (cmd) {
1797	case SECCOMP_IOCTL_NOTIF_RECV:
1798	return seccomp_notify_recv(filter, buf);
1799	case SECCOMP_IOCTL_NOTIF_SEND:
1800	return seccomp_notify_send(filter, buf);
1801	case SECCOMP_IOCTL_NOTIF_ID_VALID_WRONG_DIR:
1802	case SECCOMP_IOCTL_NOTIF_ID_VALID:
1803	return seccomp_notify_id_valid(filter, buf);
1804	case SECCOMP_IOCTL_NOTIF_SET_FLAGS:
1805	return seccomp_notify_set_flags(filter, arg);
1806	}
1807
1808	/* Extensible Argument ioctls */
1809	#define EA_IOCTL(cmd) ((cmd) & ~(IOC_INOUT \| IOCSIZE_MASK))
1810	switch (EA_IOCTL(cmd)) {
1811	case EA_IOCTL(SECCOMP_IOCTL_NOTIF_ADDFD):
1812	return seccomp_notify_addfd(filter, buf, _IOC_SIZE(cmd));
1813	default:
1814	return -EINVAL;
1815	}
1816	}
1817
1818	static __poll_t seccomp_notify_poll(struct file *file,
1819	struct poll_table_struct *poll_tab)
1820	{
1821	struct seccomp_filter *filter = file->private_data;
1822	__poll_t ret = 0;
1823	struct seccomp_knotif *cur;
1824
1825	poll_wait(file, &filter->wqh, poll_tab);
1826
1827	if (mutex_lock_interruptible(&filter->notify_lock) < 0)
1828	return EPOLLERR;
1829
1830	list_for_each_entry(cur, &filter->notif->notifications, list) {
1831	if (cur->state == SECCOMP_NOTIFY_INIT)
1832	ret \|= EPOLLIN \| EPOLLRDNORM;
1833	if (cur->state == SECCOMP_NOTIFY_SENT)
1834	ret \|= EPOLLOUT \| EPOLLWRNORM;
1835	if ((ret & EPOLLIN) && (ret & EPOLLOUT))
1836	break;
1837	}
1838
1839	mutex_unlock(&filter->notify_lock);
1840
1841	if (refcount_read(&filter->users) == 0)
1842	ret \|= EPOLLHUP;
1843
1844	return ret;
1845	}
1846
1847	static const struct file_operations seccomp_notify_ops = {
1848	.poll = seccomp_notify_poll,
1849	.release = seccomp_notify_release,
1850	.unlocked_ioctl = seccomp_notify_ioctl,
1851	.compat_ioctl = seccomp_notify_ioctl,
1852	};
1853
1854	static struct file init_listener(struct seccomp_filter filter)
1855	{
1856	struct file *ret;
1857
1858	ret = ERR_PTR(-ENOMEM);
1859	filter->notif = kzalloc(sizeof(*(filter->notif)), GFP_KERNEL);
1860	if (!filter->notif)
1861	goto out;
1862
1863	filter->notif->next_id = get_random_u64();
1864	INIT_LIST_HEAD(&filter->notif->notifications);
1865
1866	ret = anon_inode_getfile("seccomp notify", &seccomp_notify_ops,
1867	filter, O_RDWR);
1868	if (IS_ERR(ret))
1869	goto out_notif;
1870
1871	/* The file has a reference to it now */
1872	__get_seccomp_filter(filter);
1873
1874	out_notif:
1875	if (IS_ERR(ret))
1876	seccomp_notify_free(filter);
1877	out:
1878	return ret;
1879	}
1880
1881	/*
1882	* Does @new_child have a listener while an ancestor also has a listener?
1883	* If so, we'll want to reject this filter.
1884	* This only has to be tested for the current process, even in the TSYNC case,
1885	* because TSYNC installs @child with the same parent on all threads.
1886	* Note that @new_child is not hooked up to its parent at this point yet, so
1887	* we use current->seccomp.filter.
1888	*/
1889	static bool has_duplicate_listener(struct seccomp_filter *new_child)
1890	{
1891	struct seccomp_filter *cur;
1892
1893	/* must be protected against concurrent TSYNC */
1894	lockdep_assert_held(&current->sighand->siglock);
1895
1896	if (!new_child->notif)
1897	return false;
1898	for (cur = current->seccomp.filter; cur; cur = cur->prev) {
1899	if (cur->notif)
1900	return true;
1901	}
1902
1903	return false;
1904	}
1905
1906	/**
1907	* seccomp_set_mode_filter: internal function for setting seccomp filter
1908	* @flags: flags to change filter behavior
1909	* @filter: struct sock_fprog containing filter
1910	*
1911	* This function may be called repeatedly to install additional filters.
1912	* Every filter successfully installed will be evaluated (in reverse order)
1913	* for each system call the task makes.
1914	*
1915	* Once current->seccomp.mode is non-zero, it may not be changed.
1916	*
1917	* Returns 0 on success or -EINVAL on failure.
1918	*/
1919	static long seccomp_set_mode_filter(unsigned int flags,
1920	const char __user *filter)
1921	{
1922	const unsigned long seccomp_mode = SECCOMP_MODE_FILTER;
1923	struct seccomp_filter *prepared = NULL;
1924	long ret = -EINVAL;
1925	int listener = -1;
1926	struct file *listener_f = NULL;
1927
1928	/* Validate flags. */
1929	if (flags & ~SECCOMP_FILTER_FLAG_MASK)
1930	return -EINVAL;
1931
1932	/*
1933	* In the successful case, NEW_LISTENER returns the new listener fd.
1934	* But in the failure case, TSYNC returns the thread that died. If you
1935	* combine these two flags, there's no way to tell whether something
1936	* succeeded or failed. So, let's disallow this combination if the user
1937	* has not explicitly requested no errors from TSYNC.
1938	*/
1939	if ((flags & SECCOMP_FILTER_FLAG_TSYNC) &&
1940	(flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) &&
1941	((flags & SECCOMP_FILTER_FLAG_TSYNC_ESRCH) == 0))
1942	return -EINVAL;
1943
1944	/*
1945	* The SECCOMP_FILTER_FLAG_WAIT_KILLABLE_SENT flag doesn't make sense
1946	* without the SECCOMP_FILTER_FLAG_NEW_LISTENER flag.
1947	*/
1948	if ((flags & SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV) &&
1949	((flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) == 0))
1950	return -EINVAL;
1951
1952	/* Prepare the new filter before holding any locks. */
1953	prepared = seccomp_prepare_user_filter(filter);
1954	if (IS_ERR(prepared))
1955	return PTR_ERR(prepared);
1956
1957	if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) {
1958	listener = get_unused_fd_flags(O_CLOEXEC);
1959	if (listener < 0) {
1960	ret = listener;
1961	goto out_free;
1962	}
1963
1964	listener_f = init_listener(prepared);
1965	if (IS_ERR(listener_f)) {
1966	put_unused_fd(listener);
1967	ret = PTR_ERR(listener_f);
1968	goto out_free;
1969	}
1970	}
1971
1972	/*
1973	* Make sure we cannot change seccomp or nnp state via TSYNC
1974	* while another thread is in the middle of calling exec.
1975	*/
1976	if (flags & SECCOMP_FILTER_FLAG_TSYNC &&
1977	mutex_lock_killable(&current->signal->cred_guard_mutex))
1978	goto out_put_fd;
1979
1980	spin_lock_irq(&current->sighand->siglock);
1981
1982	if (!seccomp_may_assign_mode(seccomp_mode))
1983	goto out;
1984
1985	if (has_duplicate_listener(prepared)) {
1986	ret = -EBUSY;
1987	goto out;
1988	}
1989
1990	ret = seccomp_attach_filter(flags, prepared);
1991	if (ret)
1992	goto out;
1993	/* Do not free the successfully attached filter. */
1994	prepared = NULL;
1995
1996	seccomp_assign_mode(current, seccomp_mode, flags);
1997	out:
1998	spin_unlock_irq(&current->sighand->siglock);
1999	if (flags & SECCOMP_FILTER_FLAG_TSYNC)
2000	mutex_unlock(&current->signal->cred_guard_mutex);
2001	out_put_fd:
2002	if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) {
2003	if (ret) {
2004	listener_f->private_data = NULL;
2005	fput(listener_f);
2006	put_unused_fd(listener);
2007	seccomp_notify_detach(prepared);
2008	} else {
2009	fd_install(listener, listener_f);
2010	ret = listener;
2011	}
2012	}
2013	out_free:
2014	seccomp_filter_free(prepared);
2015	return ret;
2016	}
2017	#else
2018	static inline long seccomp_set_mode_filter(unsigned int flags,
2019	const char __user *filter)
2020	{
2021	return -EINVAL;
2022	}
2023	#endif
2024
2025	static long seccomp_get_action_avail(const char __user *uaction)
2026	{
2027	u32 action;
2028
2029	if (copy_from_user(&action, uaction, sizeof(action)))
2030	return -EFAULT;
2031
2032	switch (action) {
2033	case SECCOMP_RET_KILL_PROCESS:
2034	case SECCOMP_RET_KILL_THREAD:
2035	case SECCOMP_RET_TRAP:
2036	case SECCOMP_RET_ERRNO:
2037	case SECCOMP_RET_USER_NOTIF:
2038	case SECCOMP_RET_TRACE:
2039	case SECCOMP_RET_LOG:
2040	case SECCOMP_RET_ALLOW:
2041	break;
2042	default:
2043	return -EOPNOTSUPP;
2044	}
2045
2046	return 0;
2047	}
2048
2049	static long seccomp_get_notif_sizes(void __user *usizes)
2050	{
2051	struct seccomp_notif_sizes sizes = {
2052	.seccomp_notif = sizeof(struct seccomp_notif),
2053	.seccomp_notif_resp = sizeof(struct seccomp_notif_resp),
2054	.seccomp_data = sizeof(struct seccomp_data),
2055	};
2056
2057	if (copy_to_user(usizes, &sizes, sizeof(sizes)))
2058	return -EFAULT;
2059
2060	return 0;
2061	}
2062
2063	/* Common entry point for both prctl and syscall. */
2064	static long do_seccomp(unsigned int op, unsigned int flags,
2065	void __user *uargs)
2066	{
2067	switch (op) {
2068	case SECCOMP_SET_MODE_STRICT:
2069	if (flags != 0 \|\| uargs != NULL)
2070	return -EINVAL;
2071	return seccomp_set_mode_strict();
2072	case SECCOMP_SET_MODE_FILTER:
2073	return seccomp_set_mode_filter(flags, uargs);
2074	case SECCOMP_GET_ACTION_AVAIL:
2075	if (flags != 0)
2076	return -EINVAL;
2077
2078	return seccomp_get_action_avail(uargs);
2079	case SECCOMP_GET_NOTIF_SIZES:
2080	if (flags != 0)
2081	return -EINVAL;
2082
2083	return seccomp_get_notif_sizes(uargs);
2084	default:
2085	return -EINVAL;
2086	}
2087	}
2088
2089	SYSCALL_DEFINE3(seccomp, unsigned int, op, unsigned int, flags,
2090	void __user *, uargs)
2091	{
2092	return do_seccomp(op, flags, uargs);
2093	}
2094
2095	/**
2096	* prctl_set_seccomp: configures current->seccomp.mode
2097	* @seccomp_mode: requested mode to use
2098	* @filter: optional struct sock_fprog for use with SECCOMP_MODE_FILTER
2099	*
2100	* Returns 0 on success or -EINVAL on failure.
2101	*/
2102	long prctl_set_seccomp(unsigned long seccomp_mode, void __user *filter)
2103	{
2104	unsigned int op;
2105	void __user *uargs;
2106
2107	switch (seccomp_mode) {
2108	case SECCOMP_MODE_STRICT:
2109	op = SECCOMP_SET_MODE_STRICT;
2110	/*
2111	* Setting strict mode through prctl always ignored filter,
2112	* so make sure it is always NULL here to pass the internal
2113	* check in do_seccomp().
2114	*/
2115	uargs = NULL;
2116	break;
2117	case SECCOMP_MODE_FILTER:
2118	op = SECCOMP_SET_MODE_FILTER;
2119	uargs = filter;
2120	break;
2121	default:
2122	return -EINVAL;
2123	}
2124
2125	/* prctl interface doesn't have flags, so they are always zero. */
2126	return do_seccomp(op, 0, uargs);
2127	}
2128
2129	#if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
2130	static struct seccomp_filter get_nth_filter(struct task_struct task,
2131	unsigned long filter_off)
2132	{
2133	struct seccomp_filter orig, filter;
2134	unsigned long count;
2135
2136	/*
2137	* Note: this is only correct because the caller should be the (ptrace)
2138	* tracer of the task, otherwise lock_task_sighand is needed.
2139	*/
2140	spin_lock_irq(&task->sighand->siglock);
2141
2142	if (task->seccomp.mode != SECCOMP_MODE_FILTER) {
2143	spin_unlock_irq(&task->sighand->siglock);
2144	return ERR_PTR(-EINVAL);
2145	}
2146
2147	orig = task->seccomp.filter;
2148	__get_seccomp_filter(orig);
2149	spin_unlock_irq(&task->sighand->siglock);
2150
2151	count = 0;
2152	for (filter = orig; filter; filter = filter->prev)
2153	count++;
2154
2155	if (filter_off >= count) {
2156	filter = ERR_PTR(-ENOENT);
2157	goto out;
2158	}
2159
2160	count -= filter_off;
2161	for (filter = orig; filter && count > 1; filter = filter->prev)
2162	count--;
2163
2164	if (WARN_ON(count != 1 \|\| !filter)) {
2165	filter = ERR_PTR(-ENOENT);
2166	goto out;
2167	}
2168
2169	__get_seccomp_filter(filter);
2170
2171	out:
2172	__put_seccomp_filter(orig);
2173	return filter;
2174	}
2175
2176	long seccomp_get_filter(struct task_struct *task, unsigned long filter_off,
2177	void __user *data)
2178	{
2179	struct seccomp_filter *filter;
2180	struct sock_fprog_kern *fprog;
2181	long ret;
2182
2183	if (!capable(CAP_SYS_ADMIN) \|\|
2184	current->seccomp.mode != SECCOMP_MODE_DISABLED) {
2185	return -EACCES;
2186	}
2187
2188	filter = get_nth_filter(task, filter_off);
2189	if (IS_ERR(filter))
2190	return PTR_ERR(filter);
2191
2192	fprog = filter->prog->orig_prog;
2193	if (!fprog) {
2194	/* This must be a new non-cBPF filter, since we save
2195	* every cBPF filter's orig_prog above when
2196	* CONFIG_CHECKPOINT_RESTORE is enabled.
2197	*/
2198	ret = -EMEDIUMTYPE;
2199	goto out;
2200	}
2201
2202	ret = fprog->len;
2203	if (!data)
2204	goto out;
2205
2206	if (copy_to_user(data, fprog->filter, bpf_classic_proglen(fprog)))
2207	ret = -EFAULT;
2208
2209	out:
2210	__put_seccomp_filter(filter);
2211	return ret;
2212	}
2213
2214	long seccomp_get_metadata(struct task_struct *task,
2215	unsigned long size, void __user *data)
2216	{
2217	long ret;
2218	struct seccomp_filter *filter;
2219	struct seccomp_metadata kmd = {};
2220
2221	if (!capable(CAP_SYS_ADMIN) \|\|
2222	current->seccomp.mode != SECCOMP_MODE_DISABLED) {
2223	return -EACCES;
2224	}
2225
2226	size = min_t(unsigned long, size, sizeof(kmd));
2227
2228	if (size < sizeof(kmd.filter_off))
2229	return -EINVAL;
2230
2231	if (copy_from_user(&kmd.filter_off, data, sizeof(kmd.filter_off)))
2232	return -EFAULT;
2233
2234	filter = get_nth_filter(task, kmd.filter_off);
2235	if (IS_ERR(filter))
2236	return PTR_ERR(filter);
2237
2238	if (filter->log)
2239	kmd.flags \|= SECCOMP_FILTER_FLAG_LOG;
2240
2241	ret = size;
2242	if (copy_to_user(data, &kmd, size))
2243	ret = -EFAULT;
2244
2245	__put_seccomp_filter(filter);
2246	return ret;
2247	}
2248	#endif
2249
2250	#ifdef CONFIG_SYSCTL
2251
2252	/* Human readable action names for friendly sysctl interaction */
2253	#define SECCOMP_RET_KILL_PROCESS_NAME "kill_process"
2254	#define SECCOMP_RET_KILL_THREAD_NAME "kill_thread"
2255	#define SECCOMP_RET_TRAP_NAME "trap"
2256	#define SECCOMP_RET_ERRNO_NAME "errno"
2257	#define SECCOMP_RET_USER_NOTIF_NAME "user_notif"
2258	#define SECCOMP_RET_TRACE_NAME "trace"
2259	#define SECCOMP_RET_LOG_NAME "log"
2260	#define SECCOMP_RET_ALLOW_NAME "allow"
2261
2262	static const char seccomp_actions_avail[] =
2263	SECCOMP_RET_KILL_PROCESS_NAME " "
2264	SECCOMP_RET_KILL_THREAD_NAME " "
2265	SECCOMP_RET_TRAP_NAME " "
2266	SECCOMP_RET_ERRNO_NAME " "
2267	SECCOMP_RET_USER_NOTIF_NAME " "
2268	SECCOMP_RET_TRACE_NAME " "
2269	SECCOMP_RET_LOG_NAME " "
2270	SECCOMP_RET_ALLOW_NAME;
2271
2272	struct seccomp_log_name {
2273	u32 log;
2274	const char *name;
2275	};
2276
2277	static const struct seccomp_log_name seccomp_log_names[] = {
2278	{ SECCOMP_LOG_KILL_PROCESS, SECCOMP_RET_KILL_PROCESS_NAME },
2279	{ SECCOMP_LOG_KILL_THREAD, SECCOMP_RET_KILL_THREAD_NAME },
2280	{ SECCOMP_LOG_TRAP, SECCOMP_RET_TRAP_NAME },
2281	{ SECCOMP_LOG_ERRNO, SECCOMP_RET_ERRNO_NAME },
2282	{ SECCOMP_LOG_USER_NOTIF, SECCOMP_RET_USER_NOTIF_NAME },
2283	{ SECCOMP_LOG_TRACE, SECCOMP_RET_TRACE_NAME },
2284	{ SECCOMP_LOG_LOG, SECCOMP_RET_LOG_NAME },
2285	{ SECCOMP_LOG_ALLOW, SECCOMP_RET_ALLOW_NAME },
2286	{ }
2287	};
2288
2289	static bool seccomp_names_from_actions_logged(char *names, size_t size,
2290	u32 actions_logged,
2291	const char *sep)
2292	{
2293	const struct seccomp_log_name *cur;
2294	bool append_sep = false;
2295
2296	for (cur = seccomp_log_names; cur->name && size; cur++) {
2297	ssize_t ret;
2298
2299	if (!(actions_logged & cur->log))
2300	continue;
2301
2302	if (append_sep) {
2303	ret = strscpy(names, sep, size);
2304	if (ret < 0)
2305	return false;
2306
2307	names += ret;
2308	size -= ret;
2309	} else
2310	append_sep = true;
2311
2312	ret = strscpy(names, cur->name, size);
2313	if (ret < 0)
2314	return false;
2315
2316	names += ret;
2317	size -= ret;
2318	}
2319
2320	return true;
2321	}
2322
2323	static bool seccomp_action_logged_from_name(u32 *action_logged,
2324	const char *name)
2325	{
2326	const struct seccomp_log_name *cur;
2327
2328	for (cur = seccomp_log_names; cur->name; cur++) {
2329	if (!strcmp(cur->name, name)) {
2330	*action_logged = cur->log;
2331	return true;
2332	}
2333	}
2334
2335	return false;
2336	}
2337
2338	static bool seccomp_actions_logged_from_names(u32 actions_logged, char names)
2339	{
2340	char *name;
2341
2342	*actions_logged = 0;
2343	while ((name = strsep(&names, " ")) && *name) {
2344	u32 action_logged = 0;
2345
2346	if (!seccomp_action_logged_from_name(&action_logged, name))
2347	return false;
2348
2349	*actions_logged \|= action_logged;
2350	}
2351
2352	return true;
2353	}
2354
2355	static int read_actions_logged(const struct ctl_table ro_table, void buffer,
2356	size_t lenp, loff_t ppos)
2357	{
2358	char names[sizeof(seccomp_actions_avail)];
2359	struct ctl_table table;
2360
2361	memset(names, 0, sizeof(names));
2362
2363	if (!seccomp_names_from_actions_logged(names, sizeof(names),
2364	seccomp_actions_logged, " "))
2365	return -EINVAL;
2366
2367	table = *ro_table;
2368	table.data = names;
2369	table.maxlen = sizeof(names);
2370	return proc_dostring(&table, 0, buffer, lenp, ppos);
2371	}
2372
2373	static int write_actions_logged(const struct ctl_table ro_table, void buffer,
2374	size_t lenp, loff_t ppos, u32 *actions_logged)
2375	{
2376	char names[sizeof(seccomp_actions_avail)];
2377	struct ctl_table table;
2378	int ret;
2379
2380	if (!capable(CAP_SYS_ADMIN))
2381	return -EPERM;
2382
2383	memset(names, 0, sizeof(names));
2384
2385	table = *ro_table;
2386	table.data = names;
2387	table.maxlen = sizeof(names);
2388	ret = proc_dostring(&table, 1, buffer, lenp, ppos);
2389	if (ret)
2390	return ret;
2391
2392	if (!seccomp_actions_logged_from_names(actions_logged, table.data))
2393	return -EINVAL;
2394
2395	if (*actions_logged & SECCOMP_LOG_ALLOW)
2396	return -EINVAL;
2397
2398	seccomp_actions_logged = *actions_logged;
2399	return 0;
2400	}
2401
2402	static void audit_actions_logged(u32 actions_logged, u32 old_actions_logged,
2403	int ret)
2404	{
2405	char names[sizeof(seccomp_actions_avail)];
2406	char old_names[sizeof(seccomp_actions_avail)];
2407	const char *new = names;
2408	const char *old = old_names;
2409
2410	if (!audit_enabled)
2411	return;
2412
2413	memset(names, 0, sizeof(names));
2414	memset(old_names, 0, sizeof(old_names));
2415
2416	if (ret)
2417	new = "?";
2418	else if (!actions_logged)
2419	new = "(none)";
2420	else if (!seccomp_names_from_actions_logged(names, sizeof(names),
2421	actions_logged, ","))
2422	new = "?";
2423
2424	if (!old_actions_logged)
2425	old = "(none)";
2426	else if (!seccomp_names_from_actions_logged(old_names,
2427	sizeof(old_names),
2428	old_actions_logged, ","))
2429	old = "?";
2430
2431	return audit_seccomp_actions_logged(new, old, !ret);
2432	}
2433
2434	static int seccomp_actions_logged_handler(const struct ctl_table *ro_table, int write,
2435	void buffer, size_t lenp,
2436	loff_t *ppos)
2437	{
2438	int ret;
2439
2440	if (write) {
2441	u32 actions_logged = 0;
2442	u32 old_actions_logged = seccomp_actions_logged;
2443
2444	ret = write_actions_logged(ro_table, buffer, lenp, ppos,
2445	&actions_logged);
2446	audit_actions_logged(actions_logged, old_actions_logged, ret);
2447	} else
2448	ret = read_actions_logged(ro_table, buffer, lenp, ppos);
2449
2450	return ret;
2451	}
2452
2453	static struct ctl_table seccomp_sysctl_table[] = {
2454	{
2455	.procname = "actions_avail",
2456	.data = (void *) &seccomp_actions_avail,
2457	.maxlen = sizeof(seccomp_actions_avail),
2458	.mode = 0444,
2459	.proc_handler = proc_dostring,
2460	},
2461	{
2462	.procname = "actions_logged",
2463	.mode = 0644,
2464	.proc_handler = seccomp_actions_logged_handler,
2465	},
2466	};
2467
2468	static int __init seccomp_sysctl_init(void)
2469	{
2470	register_sysctl_init("kernel/seccomp", seccomp_sysctl_table);
2471	return 0;
2472	}
2473
2474	device_initcall(seccomp_sysctl_init)
2475
2476	#endif /* CONFIG_SYSCTL */
2477
2478	#ifdef CONFIG_SECCOMP_CACHE_DEBUG
2479	/* Currently CONFIG_SECCOMP_CACHE_DEBUG implies SECCOMP_ARCH_NATIVE */
2480	static void proc_pid_seccomp_cache_arch(struct seq_file m, const char name,
2481	const void *bitmap, size_t bitmap_size)
2482	{
2483	int nr;
2484
2485	for (nr = 0; nr < bitmap_size; nr++) {
2486	bool cached = test_bit(nr, bitmap);
2487	char *status = cached ? "ALLOW" : "FILTER";
2488
2489	seq_printf(m, "%s %d %s\n", name, nr, status);
2490	}
2491	}
2492
2493	int proc_pid_seccomp_cache(struct seq_file m, struct pid_namespace ns,
2494	struct pid pid, struct task_struct task)
2495	{
2496	struct seccomp_filter *f;
2497	unsigned long flags;
2498
2499	/*
2500	* We don't want some sandboxed process to know what their seccomp
2501	* filters consist of.
2502	*/
2503	if (!file_ns_capable(m->file, &init_user_ns, CAP_SYS_ADMIN))
2504	return -EACCES;
2505
2506	if (!lock_task_sighand(task, &flags))
2507	return -ESRCH;
2508
2509	f = READ_ONCE(task->seccomp.filter);
2510	if (!f) {
2511	unlock_task_sighand(task, &flags);
2512	return 0;
2513	}
2514
2515	/* prevent filter from being freed while we are printing it */
2516	__get_seccomp_filter(f);
2517	unlock_task_sighand(task, &flags);
2518
2519	proc_pid_seccomp_cache_arch(m, SECCOMP_ARCH_NATIVE_NAME,
2520	f->cache.allow_native,
2521	SECCOMP_ARCH_NATIVE_NR);
2522
2523	#ifdef SECCOMP_ARCH_COMPAT
2524	proc_pid_seccomp_cache_arch(m, SECCOMP_ARCH_COMPAT_NAME,
2525	f->cache.allow_compat,
2526	SECCOMP_ARCH_COMPAT_NR);
2527	#endif /* SECCOMP_ARCH_COMPAT */
2528
2529	__put_seccomp_filter(f);
2530	return 0;
2531	}
2532	#endif /* CONFIG_SECCOMP_CACHE_DEBUG */