linux - kernel/seccomp.c

2567 lines · 65.9 KiB

1	// SPDX-License-Identifier: GPL-2.0
2	/*
3	* linux/kernel/seccomp.c
4	*
5	* Copyright 2004-2005 Andrea Arcangeli <[email protected]>
6	*
7	* Copyright (C) 2012 Google, Inc.
8	* Will Drewry <[email protected]>
9	*
10	* This defines a simple but solid secure-computing facility.
11	*
12	* Mode 1 uses a fixed list of allowed system calls.
13	* Mode 2 allows user-defined system call filters in the form
14	* of Berkeley Packet Filters/Linux Socket Filters.
15	*/
16	#define pr_fmt(fmt) "seccomp: " fmt
17
18	#include <linux/refcount.h>
19	#include <linux/audit.h>
20	#include <linux/compat.h>
21	#include <linux/coredump.h>
22	#include <linux/kmemleak.h>
23	#include <linux/nospec.h>
24	#include <linux/prctl.h>
25	#include <linux/sched.h>
26	#include <linux/sched/task_stack.h>
27	#include <linux/seccomp.h>
28	#include <linux/slab.h>
29	#include <linux/syscalls.h>
30	#include <linux/sysctl.h>
31
32	#include <asm/syscall.h>
33
34	/* Not exposed in headers: strictly internal use only. */
35	#define SECCOMP_MODE_DEAD (SECCOMP_MODE_FILTER + 1)
36
37	#ifdef CONFIG_SECCOMP_FILTER
38	#include <linux/file.h>
39	#include <linux/filter.h>
40	#include <linux/pid.h>
41	#include <linux/ptrace.h>
42	#include <linux/capability.h>
43	#include <linux/uaccess.h>
44	#include <linux/anon_inodes.h>
45	#include <linux/lockdep.h>
46
47	/*
48	* When SECCOMP_IOCTL_NOTIF_ID_VALID was first introduced, it had the
49	* wrong direction flag in the ioctl number. This is the broken one,
50	* which the kernel needs to keep supporting until all userspaces stop
51	* using the wrong command number.
52	*/
53	#define SECCOMP_IOCTL_NOTIF_ID_VALID_WRONG_DIR SECCOMP_IOR(2, __u64)
54
55	enum notify_state {
56	SECCOMP_NOTIFY_INIT,
57	SECCOMP_NOTIFY_SENT,
58	SECCOMP_NOTIFY_REPLIED,
59	};
60
61	struct seccomp_knotif {
62	/* The struct pid of the task whose filter triggered the notification */
63	struct task_struct *task;
64
65	/* The "cookie" for this request; this is unique for this filter. */
66	u64 id;
67
68	/*
69	* The seccomp data. This pointer is valid the entire time this
70	* notification is active, since it comes from __seccomp_filter which
71	* eclipses the entire lifecycle here.
72	*/
73	const struct seccomp_data *data;
74
75	/*
76	* Notification states. When SECCOMP_RET_USER_NOTIF is returned, a
77	* struct seccomp_knotif is created and starts out in INIT. Once the
78	* handler reads the notification off of an FD, it transitions to SENT.
79	* If a signal is received the state transitions back to INIT and
80	* another message is sent. When the userspace handler replies, state
81	* transitions to REPLIED.
82	*/
83	enum notify_state state;
84
85	/* The return values, only valid when in SECCOMP_NOTIFY_REPLIED */
86	int error;
87	long val;
88	u32 flags;
89
90	/*
91	* Signals when this has changed states, such as the listener
92	* dying, a new seccomp addfd message, or changing to REPLIED
93	*/
94	struct completion ready;
95
96	struct list_head list;
97
98	/* outstanding addfd requests */
99	struct list_head addfd;
100	};
101
102	/**
103	* struct seccomp_kaddfd - container for seccomp_addfd ioctl messages
104	*
105	* @file: A reference to the file to install in the other task
106	* @fd: The fd number to install it at. If the fd number is -1, it means the
107	* installing process should allocate the fd as normal.
108	* @flags: The flags for the new file descriptor. At the moment, only O_CLOEXEC
109	* is allowed.
110	* @ioctl_flags: The flags used for the seccomp_addfd ioctl.
111	* @setfd: whether or not SECCOMP_ADDFD_FLAG_SETFD was set during notify_addfd
112	* @ret: The return value of the installing process. It is set to the fd num
113	* upon success (>= 0).
114	* @completion: Indicates that the installing process has completed fd
115	* installation, or gone away (either due to successful
116	* reply, or signal)
117	* @list: list_head for chaining seccomp_kaddfd together.
118	*
119	*/
120	struct seccomp_kaddfd {
121	struct file *file;
122	int fd;
123	unsigned int flags;
124	__u32 ioctl_flags;
125
126	union {
127	bool setfd;
128	/* To only be set on reply */
129	int ret;
130	};
131	struct completion completion;
132	struct list_head list;
133	};
134
135	/**
136	* struct notification - container for seccomp userspace notifications. Since
137	* most seccomp filters will not have notification listeners attached and this
138	* structure is fairly large, we store the notification-specific stuff in a
139	* separate structure.
140	*
141	* @requests: A semaphore that users of this notification can wait on for
142	* changes. Actual reads and writes are still controlled with
143	* filter->notify_lock.
144	* @flags: A set of SECCOMP_USER_NOTIF_FD_* flags.
145	* @next_id: The id of the next request.
146	* @notifications: A list of struct seccomp_knotif elements.
147	*/
148
149	struct notification {
150	atomic_t requests;
151	u32 flags;
152	u64 next_id;
153	struct list_head notifications;
154	};
155
156	#ifdef SECCOMP_ARCH_NATIVE
157	/**
158	* struct action_cache - per-filter cache of seccomp actions per
159	* arch/syscall pair
160	*
161	* @allow_native: A bitmap where each bit represents whether the
162	* filter will always allow the syscall, for the
163	* native architecture.
164	* @allow_compat: A bitmap where each bit represents whether the
165	* filter will always allow the syscall, for the
166	* compat architecture.
167	*/
168	struct action_cache {
169	DECLARE_BITMAP(allow_native, SECCOMP_ARCH_NATIVE_NR);
170	#ifdef SECCOMP_ARCH_COMPAT
171	DECLARE_BITMAP(allow_compat, SECCOMP_ARCH_COMPAT_NR);
172	#endif
173	};
174	#else
175	struct action_cache { };
176
177	static inline bool seccomp_cache_check_allow(const struct seccomp_filter *sfilter,
178	const struct seccomp_data *sd)
179	{
180	return false;
181	}
182
183	static inline void seccomp_cache_prepare(struct seccomp_filter *sfilter)
184	{
185	}
186	#endif /* SECCOMP_ARCH_NATIVE */
187
188	/**
189	* struct seccomp_filter - container for seccomp BPF programs
190	*
191	* @refs: Reference count to manage the object lifetime.
192	* A filter's reference count is incremented for each directly
193	* attached task, once for the dependent filter, and if
194	* requested for the user notifier. When @refs reaches zero,
195	* the filter can be freed.
196	* @users: A filter's @users count is incremented for each directly
197	* attached task (filter installation, fork(), thread_sync),
198	* and once for the dependent filter (tracked in filter->prev).
199	* When it reaches zero it indicates that no direct or indirect
200	* users of that filter exist. No new tasks can get associated with
201	* this filter after reaching 0. The @users count is always smaller
202	* or equal to @refs. Hence, reaching 0 for @users does not mean
203	* the filter can be freed.
204	* @cache: cache of arch/syscall mappings to actions
205	* @log: true if all actions except for SECCOMP_RET_ALLOW should be logged
206	* @wait_killable_recv: Put notifying process in killable state once the
207	* notification is received by the userspace listener.
208	* @prev: points to a previously installed, or inherited, filter
209	* @prog: the BPF program to evaluate
210	* @notif: the struct that holds all notification related information
211	* @notify_lock: A lock for all notification-related accesses.
212	* @wqh: A wait queue for poll if a notifier is in use.
213	*
214	* seccomp_filter objects are organized in a tree linked via the @prev
215	* pointer. For any task, it appears to be a singly-linked list starting
216	* with current->seccomp.filter, the most recently attached or inherited filter.
217	* However, multiple filters may share a @prev node, by way of fork(), which
218	* results in a unidirectional tree existing in memory. This is similar to
219	* how namespaces work.
220	*
221	* seccomp_filter objects should never be modified after being attached
222	* to a task_struct (other than @refs).
223	*/
224	struct seccomp_filter {
225	refcount_t refs;
226	refcount_t users;
227	bool log;
228	bool wait_killable_recv;
229	struct action_cache cache;
230	struct seccomp_filter *prev;
231	struct bpf_prog *prog;
232	struct notification *notif;
233	struct mutex notify_lock;
234	wait_queue_head_t wqh;
235	};
236
237	/* Limit any path through the tree to 256KB worth of instructions. */
238	#define MAX_INSNS_PER_PATH ((1 << 18) / sizeof(struct sock_filter))
239
240	/*
241	* Endianness is explicitly ignored and left for BPF program authors to manage
242	* as per the specific architecture.
243	*/
244	static void populate_seccomp_data(struct seccomp_data *sd)
245	{
246	/*
247	* Instead of using current_pt_reg(), we're already doing the work
248	* to safely fetch "current", so just use "task" everywhere below.
249	*/
250	struct task_struct *task = current;
251	struct pt_regs *regs = task_pt_regs(task);
252	unsigned long args[6];
253
254	sd->nr = syscall_get_nr(task, regs);
255	sd->arch = syscall_get_arch(task);
256	syscall_get_arguments(task, regs, args);
257	sd->args[0] = args[0];
258	sd->args[1] = args[1];
259	sd->args[2] = args[2];
260	sd->args[3] = args[3];
261	sd->args[4] = args[4];
262	sd->args[5] = args[5];
263	sd->instruction_pointer = KSTK_EIP(task);
264	}
265
266	/**
267	* seccomp_check_filter - verify seccomp filter code
268	* @filter: filter to verify
269	* @flen: length of filter
270	*
271	* Takes a previously checked filter (by bpf_check_classic) and
272	* redirects all filter code that loads struct sk_buff data
273	* and related data through seccomp_bpf_load. It also
274	* enforces length and alignment checking of those loads.
275	*
276	* Returns 0 if the rule set is legal or -EINVAL if not.
277	*/
278	static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen)
279	{
280	int pc;
281	for (pc = 0; pc < flen; pc++) {
282	struct sock_filter *ftest = &filter[pc];
283	u16 code = ftest->code;
284	u32 k = ftest->k;
285
286	switch (code) {
287	case BPF_LD \| BPF_W \| BPF_ABS:
288	ftest->code = BPF_LDX \| BPF_W \| BPF_ABS;
289	/* 32-bit aligned and not out of bounds. */
290	if (k >= sizeof(struct seccomp_data) \|\| k & 3)
291	return -EINVAL;
292	continue;
293	case BPF_LD \| BPF_W \| BPF_LEN:
294	ftest->code = BPF_LD \| BPF_IMM;
295	ftest->k = sizeof(struct seccomp_data);
296	continue;
297	case BPF_LDX \| BPF_W \| BPF_LEN:
298	ftest->code = BPF_LDX \| BPF_IMM;
299	ftest->k = sizeof(struct seccomp_data);
300	continue;
301	/* Explicitly include allowed calls. */
302	case BPF_RET \| BPF_K:
303	case BPF_RET \| BPF_A:
304	case BPF_ALU \| BPF_ADD \| BPF_K:
305	case BPF_ALU \| BPF_ADD \| BPF_X:
306	case BPF_ALU \| BPF_SUB \| BPF_K:
307	case BPF_ALU \| BPF_SUB \| BPF_X:
308	case BPF_ALU \| BPF_MUL \| BPF_K:
309	case BPF_ALU \| BPF_MUL \| BPF_X:
310	case BPF_ALU \| BPF_DIV \| BPF_K:
311	case BPF_ALU \| BPF_DIV \| BPF_X:
312	case BPF_ALU \| BPF_AND \| BPF_K:
313	case BPF_ALU \| BPF_AND \| BPF_X:
314	case BPF_ALU \| BPF_OR \| BPF_K:
315	case BPF_ALU \| BPF_OR \| BPF_X:
316	case BPF_ALU \| BPF_XOR \| BPF_K:
317	case BPF_ALU \| BPF_XOR \| BPF_X:
318	case BPF_ALU \| BPF_LSH \| BPF_K:
319	case BPF_ALU \| BPF_LSH \| BPF_X:
320	case BPF_ALU \| BPF_RSH \| BPF_K:
321	case BPF_ALU \| BPF_RSH \| BPF_X:
322	case BPF_ALU \| BPF_NEG:
323	case BPF_LD \| BPF_IMM:
324	case BPF_LDX \| BPF_IMM:
325	case BPF_MISC \| BPF_TAX:
326	case BPF_MISC \| BPF_TXA:
327	case BPF_LD \| BPF_MEM:
328	case BPF_LDX \| BPF_MEM:
329	case BPF_ST:
330	case BPF_STX:
331	case BPF_JMP \| BPF_JA:
332	case BPF_JMP \| BPF_JEQ \| BPF_K:
333	case BPF_JMP \| BPF_JEQ \| BPF_X:
334	case BPF_JMP \| BPF_JGE \| BPF_K:
335	case BPF_JMP \| BPF_JGE \| BPF_X:
336	case BPF_JMP \| BPF_JGT \| BPF_K:
337	case BPF_JMP \| BPF_JGT \| BPF_X:
338	case BPF_JMP \| BPF_JSET \| BPF_K:
339	case BPF_JMP \| BPF_JSET \| BPF_X:
340	continue;
341	default:
342	return -EINVAL;
343	}
344	}
345	return 0;
346	}
347
348	#ifdef SECCOMP_ARCH_NATIVE
349	static inline bool seccomp_cache_check_allow_bitmap(const void *bitmap,
350	size_t bitmap_size,
351	int syscall_nr)
352	{
353	if (unlikely(syscall_nr < 0 \|\| syscall_nr >= bitmap_size))
354	return false;
355	syscall_nr = array_index_nospec(syscall_nr, bitmap_size);
356
357	return test_bit(syscall_nr, bitmap);
358	}
359
360	/**
361	* seccomp_cache_check_allow - lookup seccomp cache
362	* @sfilter: The seccomp filter
363	* @sd: The seccomp data to lookup the cache with
364	*
365	* Returns true if the seccomp_data is cached and allowed.
366	*/
367	static inline bool seccomp_cache_check_allow(const struct seccomp_filter *sfilter,
368	const struct seccomp_data *sd)
369	{
370	int syscall_nr = sd->nr;
371	const struct action_cache *cache = &sfilter->cache;
372
373	#ifndef SECCOMP_ARCH_COMPAT
374	/* A native-only architecture doesn't need to check sd->arch. */
375	return seccomp_cache_check_allow_bitmap(cache->allow_native,
376	SECCOMP_ARCH_NATIVE_NR,
377	syscall_nr);
378	#else
379	if (likely(sd->arch == SECCOMP_ARCH_NATIVE))
380	return seccomp_cache_check_allow_bitmap(cache->allow_native,
381	SECCOMP_ARCH_NATIVE_NR,
382	syscall_nr);
383	if (likely(sd->arch == SECCOMP_ARCH_COMPAT))
384	return seccomp_cache_check_allow_bitmap(cache->allow_compat,
385	SECCOMP_ARCH_COMPAT_NR,
386	syscall_nr);
387	#endif /* SECCOMP_ARCH_COMPAT */
388
389	WARN_ON_ONCE(true);
390	return false;
391	}
392	#endif /* SECCOMP_ARCH_NATIVE */
393
394	#define ACTION_ONLY(ret) ((s32)((ret) & (SECCOMP_RET_ACTION_FULL)))
395	/**
396	* seccomp_run_filters - evaluates all seccomp filters against @sd
397	* @sd: optional seccomp data to be passed to filters
398	* @match: stores struct seccomp_filter that resulted in the return value,
399	* unless filter returned SECCOMP_RET_ALLOW, in which case it will
400	* be unchanged.
401	*
402	* Returns valid seccomp BPF response codes.
403	*/
404	static u32 seccomp_run_filters(const struct seccomp_data *sd,
405	struct seccomp_filter **match)
406	{
407	u32 ret = SECCOMP_RET_ALLOW;
408	/* Make sure cross-thread synced filter points somewhere sane. */
409	struct seccomp_filter *f =
410	READ_ONCE(current->seccomp.filter);
411
412	/* Ensure unexpected behavior doesn't result in failing open. */
413	if (WARN_ON(f == NULL))
414	return SECCOMP_RET_KILL_PROCESS;
415
416	if (seccomp_cache_check_allow(f, sd))
417	return SECCOMP_RET_ALLOW;
418
419	/*
420	* All filters in the list are evaluated and the lowest BPF return
421	* value always takes priority (ignoring the DATA).
422	*/
423	for (; f; f = f->prev) {
424	u32 cur_ret = bpf_prog_run_pin_on_cpu(f->prog, sd);
425
426	if (ACTION_ONLY(cur_ret) < ACTION_ONLY(ret)) {
427	ret = cur_ret;
428	*match = f;
429	}
430	}
431	return ret;
432	}
433	#endif /* CONFIG_SECCOMP_FILTER */
434
435	static inline bool seccomp_may_assign_mode(unsigned long seccomp_mode)
436	{
437	assert_spin_locked(&current->sighand->siglock);
438
439	if (current->seccomp.mode && current->seccomp.mode != seccomp_mode)
440	return false;
441
442	return true;
443	}
444
445	void __weak arch_seccomp_spec_mitigate(struct task_struct *task) { }
446
447	static inline void seccomp_assign_mode(struct task_struct *task,
448	unsigned long seccomp_mode,
449	unsigned long flags)
450	{
451	assert_spin_locked(&task->sighand->siglock);
452
453	task->seccomp.mode = seccomp_mode;
454	/*
455	* Make sure SYSCALL_WORK_SECCOMP cannot be set before the mode (and
456	* filter) is set.
457	*/
458	smp_mb__before_atomic();
459	/* Assume default seccomp processes want spec flaw mitigation. */
460	if ((flags & SECCOMP_FILTER_FLAG_SPEC_ALLOW) == 0)
461	arch_seccomp_spec_mitigate(task);
462	set_task_syscall_work(task, SECCOMP);
463	}
464
465	#ifdef CONFIG_SECCOMP_FILTER
466	/* Returns 1 if the parent is an ancestor of the child. */
467	static int is_ancestor(struct seccomp_filter *parent,
468	struct seccomp_filter *child)
469	{
470	/* NULL is the root ancestor. */
471	if (parent == NULL)
472	return 1;
473	for (; child; child = child->prev)
474	if (child == parent)
475	return 1;
476	return 0;
477	}
478
479	/**
480	* seccomp_can_sync_threads: checks if all threads can be synchronized
481	*
482	* Expects sighand and cred_guard_mutex locks to be held.
483	*
484	* Returns 0 on success, -ve on error, or the pid of a thread which was
485	* either not in the correct seccomp mode or did not have an ancestral
486	* seccomp filter.
487	*/
488	static inline pid_t seccomp_can_sync_threads(void)
489	{
490	struct task_struct thread, caller;
491
492	BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
493	assert_spin_locked(&current->sighand->siglock);
494
495	/* Validate all threads being eligible for synchronization. */
496	caller = current;
497	for_each_thread(caller, thread) {
498	pid_t failed;
499
500	/* Skip current, since it is initiating the sync. */
501	if (thread == caller)
502	continue;
503	/* Skip exited threads. */
504	if (thread->flags & PF_EXITING)
505	continue;
506
507	if (thread->seccomp.mode == SECCOMP_MODE_DISABLED \|\|
508	(thread->seccomp.mode == SECCOMP_MODE_FILTER &&
509	is_ancestor(thread->seccomp.filter,
510	caller->seccomp.filter)))
511	continue;
512
513	/* Return the first thread that cannot be synchronized. */
514	failed = task_pid_vnr(thread);
515	/* If the pid cannot be resolved, then return -ESRCH */
516	if (WARN_ON(failed == 0))
517	failed = -ESRCH;
518	return failed;
519	}
520
521	return 0;
522	}
523
524	static inline void seccomp_filter_free(struct seccomp_filter *filter)
525	{
526	if (filter) {
527	bpf_prog_destroy(filter->prog);
528	kfree(filter);
529	}
530	}
531
532	static void __seccomp_filter_orphan(struct seccomp_filter *orig)
533	{
534	while (orig && refcount_dec_and_test(&orig->users)) {
535	if (waitqueue_active(&orig->wqh))
536	wake_up_poll(&orig->wqh, EPOLLHUP);
537	orig = orig->prev;
538	}
539	}
540
541	static void __put_seccomp_filter(struct seccomp_filter *orig)
542	{
543	/* Clean up single-reference branches iteratively. */
544	while (orig && refcount_dec_and_test(&orig->refs)) {
545	struct seccomp_filter *freeme = orig;
546	orig = orig->prev;
547	seccomp_filter_free(freeme);
548	}
549	}
550
551	static void __seccomp_filter_release(struct seccomp_filter *orig)
552	{
553	/* Notify about any unused filters in the task's former filter tree. */
554	__seccomp_filter_orphan(orig);
555	/* Finally drop all references to the task's former tree. */
556	__put_seccomp_filter(orig);
557	}
558
559	/**
560	* seccomp_filter_release - Detach the task from its filter tree,
561	* drop its reference count, and notify
562	* about unused filters
563	*
564	* @tsk: task the filter should be released from.
565	*
566	* This function should only be called when the task is exiting as
567	* it detaches it from its filter tree. PF_EXITING has to be set
568	* for the task.
569	*/
570	void seccomp_filter_release(struct task_struct *tsk)
571	{
572	struct seccomp_filter *orig;
573
574	if (WARN_ON((tsk->flags & PF_EXITING) == 0))
575	return;
576
577	if (READ_ONCE(tsk->seccomp.filter) == NULL)
578	return;
579
580	spin_lock_irq(&tsk->sighand->siglock);
581	orig = tsk->seccomp.filter;
582	/* Detach task from its filter tree. */
583	tsk->seccomp.filter = NULL;
584	spin_unlock_irq(&tsk->sighand->siglock);
585	__seccomp_filter_release(orig);
586	}
587
588	/**
589	* seccomp_sync_threads: sets all threads to use current's filter
590	*
591	* @flags: SECCOMP_FILTER_FLAG_* flags to set during sync.
592	*
593	* Expects sighand and cred_guard_mutex locks to be held, and for
594	* seccomp_can_sync_threads() to have returned success already
595	* without dropping the locks.
596	*
597	*/
598	static inline void seccomp_sync_threads(unsigned long flags)
599	{
600	struct task_struct thread, caller;
601
602	BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
603	assert_spin_locked(&current->sighand->siglock);
604
605	/*
606	* Don't touch any of the threads if the process is being killed.
607	* This allows for a lockless check in seccomp_filter_release.
608	*/
609	if (current->signal->flags & SIGNAL_GROUP_EXIT)
610	return;
611
612	/* Synchronize all threads. */
613	caller = current;
614	for_each_thread(caller, thread) {
615	/* Skip current, since it needs no changes. */
616	if (thread == caller)
617	continue;
618
619	/*
620	* Skip exited threads. seccomp_filter_release could have
621	* been already called for this task.
622	*/
623	if (thread->flags & PF_EXITING)
624	continue;
625
626	/* Get a task reference for the new leaf node. */
627	get_seccomp_filter(caller);
628
629	/*
630	* Drop the task reference to the shared ancestor since
631	* current's path will hold a reference. (This also
632	* allows a put before the assignment.)
633	*/
634	__seccomp_filter_release(thread->seccomp.filter);
635
636	/* Make our new filter tree visible. */
637	smp_store_release(&thread->seccomp.filter,
638	caller->seccomp.filter);
639	atomic_set(&thread->seccomp.filter_count,
640	atomic_read(&caller->seccomp.filter_count));
641
642	/*
643	* Don't let an unprivileged task work around
644	* the no_new_privs restriction by creating
645	* a thread that sets it up, enters seccomp,
646	* then dies.
647	*/
648	if (task_no_new_privs(caller))
649	task_set_no_new_privs(thread);
650
651	/*
652	* Opt the other thread into seccomp if needed.
653	* As threads are considered to be trust-realm
654	* equivalent (see ptrace_may_access), it is safe to
655	* allow one thread to transition the other.
656	*/
657	if (thread->seccomp.mode == SECCOMP_MODE_DISABLED)
658	seccomp_assign_mode(thread, SECCOMP_MODE_FILTER,
659	flags);
660	}
661	}
662
663	/**
664	* seccomp_prepare_filter: Prepares a seccomp filter for use.
665	* @fprog: BPF program to install
666	*
667	* Returns filter on success or an ERR_PTR on failure.
668	*/
669	static struct seccomp_filter seccomp_prepare_filter(struct sock_fprog fprog)
670	{
671	struct seccomp_filter *sfilter;
672	int ret;
673	const bool save_orig =
674	#if defined(CONFIG_CHECKPOINT_RESTORE) \|\| defined(SECCOMP_ARCH_NATIVE)
675	true;
676	#else
677	false;
678	#endif
679
680	if (fprog->len == 0 \|\| fprog->len > BPF_MAXINSNS)
681	return ERR_PTR(-EINVAL);
682
683	BUG_ON(INT_MAX / fprog->len < sizeof(struct sock_filter));
684
685	/*
686	* Installing a seccomp filter requires that the task has
687	* CAP_SYS_ADMIN in its namespace or be running with no_new_privs.
688	* This avoids scenarios where unprivileged tasks can affect the
689	* behavior of privileged children.
690	*/
691	if (!task_no_new_privs(current) &&
692	!ns_capable_noaudit(current_user_ns(), CAP_SYS_ADMIN))
693	return ERR_PTR(-EACCES);
694
695	/* Allocate a new seccomp_filter */
696	sfilter = kzalloc_obj(*sfilter, GFP_KERNEL \| __GFP_NOWARN);
697	if (!sfilter)
698	return ERR_PTR(-ENOMEM);
699
700	mutex_init(&sfilter->notify_lock);
701	ret = bpf_prog_create_from_user(&sfilter->prog, fprog,
702	seccomp_check_filter, save_orig);
703	if (ret < 0) {
704	kfree(sfilter);
705	return ERR_PTR(ret);
706	}
707
708	refcount_set(&sfilter->refs, 1);
709	refcount_set(&sfilter->users, 1);
710	init_waitqueue_head(&sfilter->wqh);
711
712	return sfilter;
713	}
714
715	/**
716	* seccomp_prepare_user_filter - prepares a user-supplied sock_fprog
717	* @user_filter: pointer to the user data containing a sock_fprog.
718	*
719	* Returns 0 on success and non-zero otherwise.
720	*/
721	static struct seccomp_filter *
722	seccomp_prepare_user_filter(const char __user *user_filter)
723	{
724	struct sock_fprog fprog;
725	struct seccomp_filter *filter = ERR_PTR(-EFAULT);
726
727	#ifdef CONFIG_COMPAT
728	if (in_compat_syscall()) {
729	struct compat_sock_fprog fprog32;
730	if (copy_from_user(&fprog32, user_filter, sizeof(fprog32)))
731	goto out;
732	fprog.len = fprog32.len;
733	fprog.filter = compat_ptr(fprog32.filter);
734	} else /* falls through to the if below. */
735	#endif
736	if (copy_from_user(&fprog, user_filter, sizeof(fprog)))
737	goto out;
738	filter = seccomp_prepare_filter(&fprog);
739	out:
740	return filter;
741	}
742
743	#ifdef SECCOMP_ARCH_NATIVE
744	static bool seccomp_uprobe_exception(struct seccomp_data *sd)
745	{
746	#if defined __NR_uretprobe \|\| defined __NR_uprobe
747	#ifdef SECCOMP_ARCH_COMPAT
748	if (sd->arch == SECCOMP_ARCH_NATIVE)
749	#endif
750	{
751	#ifdef __NR_uretprobe
752	if (sd->nr == __NR_uretprobe)
753	return true;
754	#endif
755	#ifdef __NR_uprobe
756	if (sd->nr == __NR_uprobe)
757	return true;
758	#endif
759	}
760	#endif
761	return false;
762	}
763
764	/**
765	* seccomp_is_const_allow - check if filter is constant allow with given data
766	* @fprog: The BPF programs
767	* @sd: The seccomp data to check against, only syscall number and arch
768	* number are considered constant.
769	*/
770	static bool seccomp_is_const_allow(struct sock_fprog_kern *fprog,
771	struct seccomp_data *sd)
772	{
773	unsigned int reg_value = 0;
774	unsigned int pc;
775	bool op_res;
776
777	if (WARN_ON_ONCE(!fprog))
778	return false;
779
780	/* Our single exception to filtering. */
781	if (seccomp_uprobe_exception(sd))
782	return true;
783
784	for (pc = 0; pc < fprog->len; pc++) {
785	struct sock_filter *insn = &fprog->filter[pc];
786	u16 code = insn->code;
787	u32 k = insn->k;
788
789	switch (code) {
790	case BPF_LD \| BPF_W \| BPF_ABS:
791	switch (k) {
792	case offsetof(struct seccomp_data, nr):
793	reg_value = sd->nr;
794	break;
795	case offsetof(struct seccomp_data, arch):
796	reg_value = sd->arch;
797	break;
798	default:
799	/* can't optimize (non-constant value load) */
800	return false;
801	}
802	break;
803	case BPF_RET \| BPF_K:
804	/* reached return with constant values only, check allow */
805	return k == SECCOMP_RET_ALLOW;
806	case BPF_JMP \| BPF_JA:
807	pc += insn->k;
808	break;
809	case BPF_JMP \| BPF_JEQ \| BPF_K:
810	case BPF_JMP \| BPF_JGE \| BPF_K:
811	case BPF_JMP \| BPF_JGT \| BPF_K:
812	case BPF_JMP \| BPF_JSET \| BPF_K:
813	switch (BPF_OP(code)) {
814	case BPF_JEQ:
815	op_res = reg_value == k;
816	break;
817	case BPF_JGE:
818	op_res = reg_value >= k;
819	break;
820	case BPF_JGT:
821	op_res = reg_value > k;
822	break;
823	case BPF_JSET:
824	op_res = !!(reg_value & k);
825	break;
826	default:
827	/* can't optimize (unknown jump) */
828	return false;
829	}
830
831	pc += op_res ? insn->jt : insn->jf;
832	break;
833	case BPF_ALU \| BPF_AND \| BPF_K:
834	reg_value &= k;
835	break;
836	default:
837	/* can't optimize (unknown insn) */
838	return false;
839	}
840	}
841
842	/* ran off the end of the filter?! */
843	WARN_ON(1);
844	return false;
845	}
846
847	static void seccomp_cache_prepare_bitmap(struct seccomp_filter *sfilter,
848	void bitmap, const void bitmap_prev,
849	size_t bitmap_size, int arch)
850	{
851	struct sock_fprog_kern *fprog = sfilter->prog->orig_prog;
852	struct seccomp_data sd;
853	int nr;
854
855	if (bitmap_prev) {
856	/* The new filter must be as restrictive as the last. */
857	bitmap_copy(bitmap, bitmap_prev, bitmap_size);
858	} else {
859	/* Before any filters, all syscalls are always allowed. */
860	bitmap_fill(bitmap, bitmap_size);
861	}
862
863	for (nr = 0; nr < bitmap_size; nr++) {
864	/* No bitmap change: not a cacheable action. */
865	if (!test_bit(nr, bitmap))
866	continue;
867
868	sd.nr = nr;
869	sd.arch = arch;
870
871	/* No bitmap change: continue to always allow. */
872	if (seccomp_is_const_allow(fprog, &sd))
873	continue;
874
875	/*
876	* Not a cacheable action: always run filters.
877	* atomic clear_bit() not needed, filter not visible yet.
878	*/
879	__clear_bit(nr, bitmap);
880	}
881	}
882
883	/**
884	* seccomp_cache_prepare - emulate the filter to find cacheable syscalls
885	* @sfilter: The seccomp filter
886	*
887	* Returns 0 if successful or -errno if error occurred.
888	*/
889	static void seccomp_cache_prepare(struct seccomp_filter *sfilter)
890	{
891	struct action_cache *cache = &sfilter->cache;
892	const struct action_cache *cache_prev =
893	sfilter->prev ? &sfilter->prev->cache : NULL;
894
895	seccomp_cache_prepare_bitmap(sfilter, cache->allow_native,
896	cache_prev ? cache_prev->allow_native : NULL,
897	SECCOMP_ARCH_NATIVE_NR,
898	SECCOMP_ARCH_NATIVE);
899
900	#ifdef SECCOMP_ARCH_COMPAT
901	seccomp_cache_prepare_bitmap(sfilter, cache->allow_compat,
902	cache_prev ? cache_prev->allow_compat : NULL,
903	SECCOMP_ARCH_COMPAT_NR,
904	SECCOMP_ARCH_COMPAT);
905	#endif /* SECCOMP_ARCH_COMPAT */
906	}
907	#endif /* SECCOMP_ARCH_NATIVE */
908
909	/**
910	* seccomp_attach_filter: validate and attach filter
911	* @flags: flags to change filter behavior
912	* @filter: seccomp filter to add to the current process
913	*
914	* Caller must be holding current->sighand->siglock lock.
915	*
916	* Returns 0 on success, -ve on error, or
917	* - in TSYNC mode: the pid of a thread which was either not in the correct
918	* seccomp mode or did not have an ancestral seccomp filter
919	* - in NEW_LISTENER mode: the fd of the new listener
920	*/
921	static long seccomp_attach_filter(unsigned int flags,
922	struct seccomp_filter *filter)
923	{
924	unsigned long total_insns;
925	struct seccomp_filter *walker;
926
927	assert_spin_locked(&current->sighand->siglock);
928
929	/* Validate resulting filter length. */
930	total_insns = filter->prog->len;
931	for (walker = current->seccomp.filter; walker; walker = walker->prev)
932	total_insns += walker->prog->len + 4; /* 4 instr penalty */
933	if (total_insns > MAX_INSNS_PER_PATH)
934	return -ENOMEM;
935
936	/* If thread sync has been requested, check that it is possible. */
937	if (flags & SECCOMP_FILTER_FLAG_TSYNC) {
938	int ret;
939
940	ret = seccomp_can_sync_threads();
941	if (ret) {
942	if (flags & SECCOMP_FILTER_FLAG_TSYNC_ESRCH)
943	return -ESRCH;
944	else
945	return ret;
946	}
947	}
948
949	/* Set log flag, if present. */
950	if (flags & SECCOMP_FILTER_FLAG_LOG)
951	filter->log = true;
952
953	/* Set wait killable flag, if present. */
954	if (flags & SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV)
955	filter->wait_killable_recv = true;
956
957	/*
958	* If there is an existing filter, make it the prev and don't drop its
959	* task reference.
960	*/
961	filter->prev = current->seccomp.filter;
962	seccomp_cache_prepare(filter);
963	current->seccomp.filter = filter;
964	atomic_inc(&current->seccomp.filter_count);
965
966	/* Now that the new filter is in place, synchronize to all threads. */
967	if (flags & SECCOMP_FILTER_FLAG_TSYNC)
968	seccomp_sync_threads(flags);
969
970	return 0;
971	}
972
973	static void __get_seccomp_filter(struct seccomp_filter *filter)
974	{
975	refcount_inc(&filter->refs);
976	}
977
978	/* get_seccomp_filter - increments the reference count of the filter on @tsk */
979	void get_seccomp_filter(struct task_struct *tsk)
980	{
981	struct seccomp_filter *orig = tsk->seccomp.filter;
982	if (!orig)
983	return;
984	__get_seccomp_filter(orig);
985	refcount_inc(&orig->users);
986	}
987
988	#endif /* CONFIG_SECCOMP_FILTER */
989
990	/* For use with seccomp_actions_logged */
991	#define SECCOMP_LOG_KILL_PROCESS (1 << 0)
992	#define SECCOMP_LOG_KILL_THREAD (1 << 1)
993	#define SECCOMP_LOG_TRAP (1 << 2)
994	#define SECCOMP_LOG_ERRNO (1 << 3)
995	#define SECCOMP_LOG_TRACE (1 << 4)
996	#define SECCOMP_LOG_LOG (1 << 5)
997	#define SECCOMP_LOG_ALLOW (1 << 6)
998	#define SECCOMP_LOG_USER_NOTIF (1 << 7)
999
1000	static u32 seccomp_actions_logged = SECCOMP_LOG_KILL_PROCESS \|
1001	SECCOMP_LOG_KILL_THREAD \|
1002	SECCOMP_LOG_TRAP \|
1003	SECCOMP_LOG_ERRNO \|
1004	SECCOMP_LOG_USER_NOTIF \|
1005	SECCOMP_LOG_TRACE \|
1006	SECCOMP_LOG_LOG;
1007
1008	static inline void seccomp_log(unsigned long syscall, long signr, u32 action,
1009	bool requested)
1010	{
1011	bool log = false;
1012
1013	switch (action) {
1014	case SECCOMP_RET_ALLOW:
1015	break;
1016	case SECCOMP_RET_TRAP:
1017	log = requested && seccomp_actions_logged & SECCOMP_LOG_TRAP;
1018	break;
1019	case SECCOMP_RET_ERRNO:
1020	log = requested && seccomp_actions_logged & SECCOMP_LOG_ERRNO;
1021	break;
1022	case SECCOMP_RET_TRACE:
1023	log = requested && seccomp_actions_logged & SECCOMP_LOG_TRACE;
1024	break;
1025	case SECCOMP_RET_USER_NOTIF:
1026	log = requested && seccomp_actions_logged & SECCOMP_LOG_USER_NOTIF;
1027	break;
1028	case SECCOMP_RET_LOG:
1029	log = seccomp_actions_logged & SECCOMP_LOG_LOG;
1030	break;
1031	case SECCOMP_RET_KILL_THREAD:
1032	log = seccomp_actions_logged & SECCOMP_LOG_KILL_THREAD;
1033	break;
1034	case SECCOMP_RET_KILL_PROCESS:
1035	default:
1036	log = seccomp_actions_logged & SECCOMP_LOG_KILL_PROCESS;
1037	}
1038
1039	/*
1040	* Emit an audit message when the action is RET_KILL_*, RET_LOG, or the
1041	* FILTER_FLAG_LOG bit was set. The admin has the ability to silence
1042	* any action from being logged by removing the action name from the
1043	* seccomp_actions_logged sysctl.
1044	*/
1045	if (!log)
1046	return;
1047
1048	audit_seccomp(syscall, signr, action);
1049	}
1050
1051	/*
1052	* Secure computing mode 1 allows only read/write/exit/sigreturn.
1053	* To be fully secure this must be combined with rlimit
1054	* to limit the stack allocations too.
1055	*/
1056	static const int mode1_syscalls[] = {
1057	__NR_seccomp_read, __NR_seccomp_write, __NR_seccomp_exit, __NR_seccomp_sigreturn,
1058	#ifdef __NR_uretprobe
1059	__NR_uretprobe,
1060	#endif
1061	#ifdef __NR_uprobe
1062	__NR_uprobe,
1063	#endif
1064	-1, /* negative terminated */
1065	};
1066
1067	static void __secure_computing_strict(int this_syscall)
1068	{
1069	const int *allowed_syscalls = mode1_syscalls;
1070	#ifdef CONFIG_COMPAT
1071	if (in_compat_syscall())
1072	allowed_syscalls = get_compat_mode1_syscalls();
1073	#endif
1074	do {
1075	if (*allowed_syscalls == this_syscall)
1076	return;
1077	} while (*++allowed_syscalls != -1);
1078
1079	#ifdef SECCOMP_DEBUG
1080	dump_stack();
1081	#endif
1082	current->seccomp.mode = SECCOMP_MODE_DEAD;
1083	seccomp_log(this_syscall, SIGKILL, SECCOMP_RET_KILL_THREAD, true);
1084	do_exit(SIGKILL);
1085	}
1086
1087	#ifndef CONFIG_HAVE_ARCH_SECCOMP_FILTER
1088	void secure_computing_strict(int this_syscall)
1089	{
1090	int mode = current->seccomp.mode;
1091
1092	if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) &&
1093	unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
1094	return;
1095
1096	if (mode == SECCOMP_MODE_DISABLED)
1097	return;
1098	else if (mode == SECCOMP_MODE_STRICT)
1099	__secure_computing_strict(this_syscall);
1100	else
1101	BUG();
1102	}
1103
1104	bool __seccomp_permit_syscall(void)
1105	{
1106	int this_syscall = syscall_get_nr(current, current_pt_regs());
1107
1108	secure_computing_strict(this_syscall);
1109	return true;
1110	}
1111	#else
1112
1113	#ifdef CONFIG_SECCOMP_FILTER
1114	static u64 seccomp_next_notify_id(struct seccomp_filter *filter)
1115	{
1116	/*
1117	* Note: overflow is ok here, the id just needs to be unique per
1118	* filter.
1119	*/
1120	lockdep_assert_held(&filter->notify_lock);
1121	return filter->notif->next_id++;
1122	}
1123
1124	static void seccomp_handle_addfd(struct seccomp_kaddfd addfd, struct seccomp_knotif n)
1125	{
1126	int fd;
1127
1128	/*
1129	* Remove the notification, and reset the list pointers, indicating
1130	* that it has been handled.
1131	*/
1132	list_del_init(&addfd->list);
1133	if (!addfd->setfd)
1134	fd = receive_fd(addfd->file, NULL, addfd->flags);
1135	else
1136	fd = receive_fd_replace(addfd->fd, addfd->file, addfd->flags);
1137	addfd->ret = fd;
1138
1139	if (addfd->ioctl_flags & SECCOMP_ADDFD_FLAG_SEND) {
1140	/* If we fail reset and return an error to the notifier */
1141	if (fd < 0) {
1142	n->state = SECCOMP_NOTIFY_SENT;
1143	} else {
1144	/* Return the FD we just added */
1145	n->flags = 0;
1146	n->error = 0;
1147	n->val = fd;
1148	}
1149	}
1150
1151	/*
1152	* Mark the notification as completed. From this point, addfd mem
1153	* might be invalidated and we can't safely read it anymore.
1154	*/
1155	complete(&addfd->completion);
1156	}
1157
1158	static bool should_sleep_killable(struct seccomp_filter *match,
1159	struct seccomp_knotif *n)
1160	{
1161	return match->wait_killable_recv && n->state >= SECCOMP_NOTIFY_SENT;
1162	}
1163
1164	static int seccomp_do_user_notification(int this_syscall,
1165	struct seccomp_filter *match,
1166	const struct seccomp_data *sd)
1167	{
1168	int err;
1169	u32 flags = 0;
1170	long ret = 0;
1171	struct seccomp_knotif n = {};
1172	struct seccomp_kaddfd addfd, tmp;
1173
1174	mutex_lock(&match->notify_lock);
1175	err = -ENOSYS;
1176	if (!match->notif)
1177	goto out;
1178
1179	n.task = current;
1180	n.state = SECCOMP_NOTIFY_INIT;
1181	n.data = sd;
1182	n.id = seccomp_next_notify_id(match);
1183	init_completion(&n.ready);
1184	list_add_tail(&n.list, &match->notif->notifications);
1185	INIT_LIST_HEAD(&n.addfd);
1186
1187	atomic_inc(&match->notif->requests);
1188	if (match->notif->flags & SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP)
1189	wake_up_poll_on_current_cpu(&match->wqh, EPOLLIN \| EPOLLRDNORM);
1190	else
1191	wake_up_poll(&match->wqh, EPOLLIN \| EPOLLRDNORM);
1192
1193	/*
1194	* This is where we wait for a reply from userspace.
1195	*/
1196	do {
1197	bool wait_killable = should_sleep_killable(match, &n);
1198
1199	mutex_unlock(&match->notify_lock);
1200	if (wait_killable)
1201	err = wait_for_completion_killable(&n.ready);
1202	else
1203	err = wait_for_completion_interruptible(&n.ready);
1204	mutex_lock(&match->notify_lock);
1205
1206	if (err != 0) {
1207	/*
1208	* Check to see whether we should switch to wait
1209	* killable. Only return the interrupted error if not.
1210	*/
1211	if (!(!wait_killable && should_sleep_killable(match, &n)))
1212	goto interrupted;
1213	}
1214
1215	addfd = list_first_entry_or_null(&n.addfd,
1216	struct seccomp_kaddfd, list);
1217	/* Check if we were woken up by a addfd message */
1218	if (addfd)
1219	seccomp_handle_addfd(addfd, &n);
1220
1221	} while (n.state != SECCOMP_NOTIFY_REPLIED);
1222
1223	ret = n.val;
1224	err = n.error;
1225	flags = n.flags;
1226
1227	interrupted:
1228	/* If there were any pending addfd calls, clear them out */
1229	list_for_each_entry_safe(addfd, tmp, &n.addfd, list) {
1230	/* The process went away before we got a chance to handle it */
1231	addfd->ret = -ESRCH;
1232	list_del_init(&addfd->list);
1233	complete(&addfd->completion);
1234	}
1235
1236	/*
1237	* Note that it's possible the listener died in between the time when
1238	* we were notified of a response (or a signal) and when we were able to
1239	* re-acquire the lock, so only delete from the list if the
1240	* notification actually exists.
1241	*
1242	* Also note that this test is only valid because there's no way to
1243	* reattach to a notifier right now. If one is added, we'll need to
1244	* keep track of the notif itself and make sure they match here.
1245	*/
1246	if (match->notif)
1247	list_del(&n.list);
1248	out:
1249	mutex_unlock(&match->notify_lock);
1250
1251	/* Userspace requests to continue the syscall. */
1252	if (flags & SECCOMP_USER_NOTIF_FLAG_CONTINUE)
1253	return 0;
1254
1255	syscall_set_return_value(current, current_pt_regs(),
1256	err, ret);
1257	return -1;
1258	}
1259
1260	static bool __seccomp_filter(int this_syscall, const bool recheck_after_trace)
1261	{
1262	u32 filter_ret, action;
1263	struct seccomp_data sd;
1264	struct seccomp_filter *match = NULL;
1265	int data;
1266
1267	/*
1268	* Make sure that any changes to mode from another thread have
1269	* been seen after SYSCALL_WORK_SECCOMP was seen.
1270	*/
1271	smp_rmb();
1272
1273	populate_seccomp_data(&sd);
1274
1275	filter_ret = seccomp_run_filters(&sd, &match);
1276	data = filter_ret & SECCOMP_RET_DATA;
1277	action = filter_ret & SECCOMP_RET_ACTION_FULL;
1278
1279	switch (action) {
1280	case SECCOMP_RET_ERRNO:
1281	/* Set low-order bits as an errno, capped at MAX_ERRNO. */
1282	if (data > MAX_ERRNO)
1283	data = MAX_ERRNO;
1284	syscall_set_return_value(current, current_pt_regs(),
1285	-data, 0);
1286	goto skip;
1287
1288	case SECCOMP_RET_TRAP:
1289	/* Show the handler the original registers. */
1290	syscall_rollback(current, current_pt_regs());
1291	/* Let the filter pass back 16 bits of data. */
1292	force_sig_seccomp(this_syscall, data, false);
1293	goto skip;
1294
1295	case SECCOMP_RET_TRACE:
1296	/* We've been put in this state by the ptracer already. */
1297	if (recheck_after_trace)
1298	return true;
1299
1300	/* ENOSYS these calls if there is no tracer attached. */
1301	if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP)) {
1302	syscall_set_return_value(current,
1303	current_pt_regs(),
1304	-ENOSYS, 0);
1305	goto skip;
1306	}
1307
1308	/* Allow the BPF to provide the event message */
1309	ptrace_event(PTRACE_EVENT_SECCOMP, data);
1310	/*
1311	* The delivery of a fatal signal during event
1312	* notification may silently skip tracer notification,
1313	* which could leave us with a potentially unmodified
1314	* syscall that the tracer would have liked to have
1315	* changed. Since the process is about to die, we just
1316	* force the syscall to be skipped and let the signal
1317	* kill the process and correctly handle any tracer exit
1318	* notifications.
1319	*/
1320	if (fatal_signal_pending(current))
1321	goto skip;
1322	/* Check if the tracer forced the syscall to be skipped. */
1323	this_syscall = syscall_get_nr(current, current_pt_regs());
1324	if (this_syscall < 0)
1325	goto skip;
1326
1327	/*
1328	* Recheck the syscall, since it may have changed. This
1329	* intentionally uses a NULL struct seccomp_data to force
1330	* a reload of all registers. This does not goto skip since
1331	* a skip would have already been reported.
1332	*/
1333	return __seccomp_filter(this_syscall, true);
1334
1335	case SECCOMP_RET_USER_NOTIF:
1336	if (seccomp_do_user_notification(this_syscall, match, &sd))
1337	goto skip;
1338
1339	return true;
1340
1341	case SECCOMP_RET_LOG:
1342	seccomp_log(this_syscall, 0, action, true);
1343	return true;
1344
1345	case SECCOMP_RET_ALLOW:
1346	/*
1347	* Note that the "match" filter will always be NULL for
1348	* this action since SECCOMP_RET_ALLOW is the starting
1349	* state in seccomp_run_filters().
1350	*/
1351	return true;
1352
1353	case SECCOMP_RET_KILL_THREAD:
1354	case SECCOMP_RET_KILL_PROCESS:
1355	default:
1356	current->seccomp.mode = SECCOMP_MODE_DEAD;
1357	seccomp_log(this_syscall, SIGSYS, action, true);
1358	/* Dump core only if this is the last remaining thread. */
1359	if (action != SECCOMP_RET_KILL_THREAD \|\|
1360	(atomic_read(&current->signal->live) == 1)) {
1361	/* Show the original registers in the dump. */
1362	syscall_rollback(current, current_pt_regs());
1363	/* Trigger a coredump with SIGSYS */
1364	force_sig_seccomp(this_syscall, data, true);
1365	} else {
1366	do_exit(SIGSYS);
1367	}
1368	return false; /* skip the syscall go directly to signal handling */
1369	}
1370
1371	unreachable();
1372
1373	skip:
1374	seccomp_log(this_syscall, 0, action, match ? match->log : false);
1375	return false;
1376	}
1377	#else
1378	static bool __seccomp_filter(int this_syscall, const bool recheck_after_trace)
1379	{
1380	BUG();
1381
1382	return false;
1383	}
1384	#endif
1385
1386	bool __seccomp_permit_syscall(void)
1387	{
1388	int mode = current->seccomp.mode;
1389	int this_syscall;
1390
1391	if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) &&
1392	unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
1393	return true;
1394
1395	this_syscall = syscall_get_nr(current, current_pt_regs());
1396
1397	switch (mode) {
1398	case SECCOMP_MODE_STRICT:
1399	__secure_computing_strict(this_syscall); /* may call do_exit */
1400	return true;
1401	case SECCOMP_MODE_FILTER:
1402	return __seccomp_filter(this_syscall, false);
1403	/* Surviving SECCOMP_RET_KILL_* must be proactively impossible. */
1404	case SECCOMP_MODE_DEAD:
1405	WARN_ON_ONCE(1);
1406	do_exit(SIGKILL);
1407	return false;
1408	default:
1409	BUG();
1410	}
1411	}
1412	#endif /* CONFIG_HAVE_ARCH_SECCOMP_FILTER */
1413
1414	long prctl_get_seccomp(void)
1415	{
1416	return current->seccomp.mode;
1417	}
1418
1419	/**
1420	* seccomp_set_mode_strict: internal function for setting strict seccomp
1421	*
1422	* Once current->seccomp.mode is non-zero, it may not be changed.
1423	*
1424	* Returns 0 on success or -EINVAL on failure.
1425	*/
1426	static long seccomp_set_mode_strict(void)
1427	{
1428	const unsigned long seccomp_mode = SECCOMP_MODE_STRICT;
1429	long ret = -EINVAL;
1430
1431	spin_lock_irq(&current->sighand->siglock);
1432
1433	if (!seccomp_may_assign_mode(seccomp_mode))
1434	goto out;
1435
1436	#ifdef TIF_NOTSC
1437	disable_TSC();
1438	#endif
1439	seccomp_assign_mode(current, seccomp_mode, 0);
1440	ret = 0;
1441
1442	out:
1443	spin_unlock_irq(&current->sighand->siglock);
1444
1445	return ret;
1446	}
1447
1448	#ifdef CONFIG_SECCOMP_FILTER
1449	static void seccomp_notify_free(struct seccomp_filter *filter)
1450	{
1451	kfree(filter->notif);
1452	filter->notif = NULL;
1453	}
1454
1455	static void seccomp_notify_detach(struct seccomp_filter *filter)
1456	{
1457	struct seccomp_knotif *knotif;
1458
1459	if (!filter)
1460	return;
1461
1462	mutex_lock(&filter->notify_lock);
1463
1464	/*
1465	* If this file is being closed because e.g. the task who owned it
1466	* died, let's wake everyone up who was waiting on us.
1467	*/
1468	list_for_each_entry(knotif, &filter->notif->notifications, list) {
1469	if (knotif->state == SECCOMP_NOTIFY_REPLIED)
1470	continue;
1471
1472	knotif->state = SECCOMP_NOTIFY_REPLIED;
1473	knotif->error = -ENOSYS;
1474	knotif->val = 0;
1475
1476	/*
1477	* We do not need to wake up any pending addfd messages, as
1478	* the notifier will do that for us, as this just looks
1479	* like a standard reply.
1480	*/
1481	complete(&knotif->ready);
1482	}
1483
1484	seccomp_notify_free(filter);
1485	mutex_unlock(&filter->notify_lock);
1486	}
1487
1488	static int seccomp_notify_release(struct inode inode, struct file file)
1489	{
1490	struct seccomp_filter *filter = file->private_data;
1491
1492	seccomp_notify_detach(filter);
1493	__put_seccomp_filter(filter);
1494	return 0;
1495	}
1496
1497	/* must be called with notif_lock held */
1498	static inline struct seccomp_knotif *
1499	find_notification(struct seccomp_filter *filter, u64 id)
1500	{
1501	struct seccomp_knotif *cur;
1502
1503	lockdep_assert_held(&filter->notify_lock);
1504
1505	list_for_each_entry(cur, &filter->notif->notifications, list) {
1506	if (cur->id == id)
1507	return cur;
1508	}
1509
1510	return NULL;
1511	}
1512
1513	static int recv_wake_function(wait_queue_entry_t *wait, unsigned int mode, int sync,
1514	void *key)
1515	{
1516	/* Avoid a wakeup if event not interesting for us. */
1517	if (key && !(key_to_poll(key) & (EPOLLIN \| EPOLLERR \| EPOLLHUP)))
1518	return 0;
1519	return autoremove_wake_function(wait, mode, sync, key);
1520	}
1521
1522	static int recv_wait_event(struct seccomp_filter *filter)
1523	{
1524	DEFINE_WAIT_FUNC(wait, recv_wake_function);
1525	int ret;
1526
1527	if (refcount_read(&filter->users) == 0)
1528	return 0;
1529
1530	if (atomic_dec_if_positive(&filter->notif->requests) >= 0)
1531	return 0;
1532
1533	for (;;) {
1534	ret = prepare_to_wait_event(&filter->wqh, &wait, TASK_INTERRUPTIBLE);
1535
1536	if (atomic_dec_if_positive(&filter->notif->requests) >= 0)
1537	break;
1538	if (refcount_read(&filter->users) == 0)
1539	break;
1540
1541	if (ret)
1542	return ret;
1543
1544	schedule();
1545	}
1546	finish_wait(&filter->wqh, &wait);
1547	return 0;
1548	}
1549
1550	static long seccomp_notify_recv(struct seccomp_filter *filter,
1551	void __user *buf)
1552	{
1553	struct seccomp_knotif knotif = NULL, cur;
1554	struct seccomp_notif unotif;
1555	ssize_t ret;
1556
1557	/* Verify that we're not given garbage to keep struct extensible. */
1558	ret = check_zeroed_user(buf, sizeof(unotif));
1559	if (ret < 0)
1560	return ret;
1561	if (!ret)
1562	return -EINVAL;
1563
1564	memset(&unotif, 0, sizeof(unotif));
1565
1566	ret = recv_wait_event(filter);
1567	if (ret < 0)
1568	return ret;
1569
1570	mutex_lock(&filter->notify_lock);
1571	list_for_each_entry(cur, &filter->notif->notifications, list) {
1572	if (cur->state == SECCOMP_NOTIFY_INIT) {
1573	knotif = cur;
1574	break;
1575	}
1576	}
1577
1578	/*
1579	* If we didn't find a notification, it could be that the task was
1580	* interrupted by a fatal signal between the time we were woken and
1581	* when we were able to acquire the rw lock.
1582	*/
1583	if (!knotif) {
1584	ret = -ENOENT;
1585	goto out;
1586	}
1587
1588	unotif.id = knotif->id;
1589	unotif.pid = task_pid_vnr(knotif->task);
1590	unotif.data = *(knotif->data);
1591
1592	knotif->state = SECCOMP_NOTIFY_SENT;
1593	wake_up_poll(&filter->wqh, EPOLLOUT \| EPOLLWRNORM);
1594	ret = 0;
1595	out:
1596	mutex_unlock(&filter->notify_lock);
1597
1598	if (ret == 0 && copy_to_user(buf, &unotif, sizeof(unotif))) {
1599	ret = -EFAULT;
1600
1601	/*
1602	* Userspace screwed up. To make sure that we keep this
1603	* notification alive, let's reset it back to INIT. It
1604	* may have died when we released the lock, so we need to make
1605	* sure it's still around.
1606	*/
1607	mutex_lock(&filter->notify_lock);
1608	knotif = find_notification(filter, unotif.id);
1609	if (knotif) {
1610	/* Reset the process to make sure it's not stuck */
1611	if (should_sleep_killable(filter, knotif))
1612	complete(&knotif->ready);
1613	knotif->state = SECCOMP_NOTIFY_INIT;
1614	atomic_inc(&filter->notif->requests);
1615	wake_up_poll(&filter->wqh, EPOLLIN \| EPOLLRDNORM);
1616	}
1617	mutex_unlock(&filter->notify_lock);
1618	}
1619
1620	return ret;
1621	}
1622
1623	static long seccomp_notify_send(struct seccomp_filter *filter,
1624	void __user *buf)
1625	{
1626	struct seccomp_notif_resp resp = {};
1627	struct seccomp_knotif *knotif;
1628	long ret;
1629
1630	if (copy_from_user(&resp, buf, sizeof(resp)))
1631	return -EFAULT;
1632
1633	if (resp.flags & ~SECCOMP_USER_NOTIF_FLAG_CONTINUE)
1634	return -EINVAL;
1635
1636	if ((resp.flags & SECCOMP_USER_NOTIF_FLAG_CONTINUE) &&
1637	(resp.error \|\| resp.val))
1638	return -EINVAL;
1639
1640	ret = mutex_lock_interruptible(&filter->notify_lock);
1641	if (ret < 0)
1642	return ret;
1643
1644	knotif = find_notification(filter, resp.id);
1645	if (!knotif) {
1646	ret = -ENOENT;
1647	goto out;
1648	}
1649
1650	/* Allow exactly one reply. */
1651	if (knotif->state != SECCOMP_NOTIFY_SENT) {
1652	ret = -EINPROGRESS;
1653	goto out;
1654	}
1655
1656	ret = 0;
1657	knotif->state = SECCOMP_NOTIFY_REPLIED;
1658	knotif->error = resp.error;
1659	knotif->val = resp.val;
1660	knotif->flags = resp.flags;
1661	if (filter->notif->flags & SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP)
1662	complete_on_current_cpu(&knotif->ready);
1663	else
1664	complete(&knotif->ready);
1665	out:
1666	mutex_unlock(&filter->notify_lock);
1667	return ret;
1668	}
1669
1670	static long seccomp_notify_id_valid(struct seccomp_filter *filter,
1671	void __user *buf)
1672	{
1673	struct seccomp_knotif *knotif;
1674	u64 id;
1675	long ret;
1676
1677	if (copy_from_user(&id, buf, sizeof(id)))
1678	return -EFAULT;
1679
1680	ret = mutex_lock_interruptible(&filter->notify_lock);
1681	if (ret < 0)
1682	return ret;
1683
1684	knotif = find_notification(filter, id);
1685	if (knotif && knotif->state == SECCOMP_NOTIFY_SENT)
1686	ret = 0;
1687	else
1688	ret = -ENOENT;
1689
1690	mutex_unlock(&filter->notify_lock);
1691	return ret;
1692	}
1693
1694	static long seccomp_notify_set_flags(struct seccomp_filter *filter,
1695	unsigned long flags)
1696	{
1697	long ret;
1698
1699	if (flags & ~SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP)
1700	return -EINVAL;
1701
1702	ret = mutex_lock_interruptible(&filter->notify_lock);
1703	if (ret < 0)
1704	return ret;
1705	filter->notif->flags = flags;
1706	mutex_unlock(&filter->notify_lock);
1707	return 0;
1708	}
1709
1710	static long seccomp_notify_addfd(struct seccomp_filter *filter,
1711	struct seccomp_notif_addfd __user *uaddfd,
1712	unsigned int size)
1713	{
1714	struct seccomp_notif_addfd addfd;
1715	struct seccomp_knotif *knotif;
1716	struct seccomp_kaddfd kaddfd;
1717	int ret;
1718
1719	BUILD_BUG_ON(sizeof(addfd) < SECCOMP_NOTIFY_ADDFD_SIZE_VER0);
1720	BUILD_BUG_ON(sizeof(addfd) != SECCOMP_NOTIFY_ADDFD_SIZE_LATEST);
1721
1722	if (size < SECCOMP_NOTIFY_ADDFD_SIZE_VER0 \|\| size >= PAGE_SIZE)
1723	return -EINVAL;
1724
1725	ret = copy_struct_from_user(&addfd, sizeof(addfd), uaddfd, size);
1726	if (ret)
1727	return ret;
1728
1729	if (addfd.newfd_flags & ~O_CLOEXEC)
1730	return -EINVAL;
1731
1732	if (addfd.flags & ~(SECCOMP_ADDFD_FLAG_SETFD \| SECCOMP_ADDFD_FLAG_SEND))
1733	return -EINVAL;
1734
1735	if (addfd.newfd && !(addfd.flags & SECCOMP_ADDFD_FLAG_SETFD))
1736	return -EINVAL;
1737
1738	kaddfd.file = fget(addfd.srcfd);
1739	if (!kaddfd.file)
1740	return -EBADF;
1741
1742	kaddfd.ioctl_flags = addfd.flags;
1743	kaddfd.flags = addfd.newfd_flags;
1744	kaddfd.setfd = addfd.flags & SECCOMP_ADDFD_FLAG_SETFD;
1745	kaddfd.fd = addfd.newfd;
1746	init_completion(&kaddfd.completion);
1747
1748	ret = mutex_lock_interruptible(&filter->notify_lock);
1749	if (ret < 0)
1750	goto out;
1751
1752	knotif = find_notification(filter, addfd.id);
1753	if (!knotif) {
1754	ret = -ENOENT;
1755	goto out_unlock;
1756	}
1757
1758	/*
1759	* We do not want to allow for FD injection to occur before the
1760	* notification has been picked up by a userspace handler, or after
1761	* the notification has been replied to.
1762	*/
1763	if (knotif->state != SECCOMP_NOTIFY_SENT) {
1764	ret = -EINPROGRESS;
1765	goto out_unlock;
1766	}
1767
1768	if (addfd.flags & SECCOMP_ADDFD_FLAG_SEND) {
1769	/*
1770	* Disallow queuing an atomic addfd + send reply while there are
1771	* some addfd requests still to process.
1772	*
1773	* There is no clear reason to support it and allows us to keep
1774	* the loop on the other side straight-forward.
1775	*/
1776	if (!list_empty(&knotif->addfd)) {
1777	ret = -EBUSY;
1778	goto out_unlock;
1779	}
1780
1781	/* Allow exactly only one reply */
1782	knotif->state = SECCOMP_NOTIFY_REPLIED;
1783	}
1784
1785	list_add(&kaddfd.list, &knotif->addfd);
1786	complete(&knotif->ready);
1787	mutex_unlock(&filter->notify_lock);
1788
1789	/* Now we wait for it to be processed or be interrupted */
1790	ret = wait_for_completion_interruptible(&kaddfd.completion);
1791	if (ret == 0) {
1792	/*
1793	* We had a successful completion. The other side has already
1794	* removed us from the addfd queue, and
1795	* wait_for_completion_interruptible has a memory barrier upon
1796	* success that lets us read this value directly without
1797	* locking.
1798	*/
1799	ret = kaddfd.ret;
1800	goto out;
1801	}
1802
1803	mutex_lock(&filter->notify_lock);
1804	/*
1805	* Even though we were woken up by a signal and not a successful
1806	* completion, a completion may have happened in the mean time.
1807	*
1808	* We need to check again if the addfd request has been handled,
1809	* and if not, we will remove it from the queue.
1810	*/
1811	if (list_empty(&kaddfd.list))
1812	ret = kaddfd.ret;
1813	else
1814	list_del(&kaddfd.list);
1815
1816	out_unlock:
1817	mutex_unlock(&filter->notify_lock);
1818	out:
1819	fput(kaddfd.file);
1820
1821	return ret;
1822	}
1823
1824	static long seccomp_notify_ioctl(struct file *file, unsigned int cmd,
1825	unsigned long arg)
1826	{
1827	struct seccomp_filter *filter = file->private_data;
1828	void __user buf = (void __user )arg;
1829
1830	/* Fixed-size ioctls */
1831	switch (cmd) {
1832	case SECCOMP_IOCTL_NOTIF_RECV:
1833	return seccomp_notify_recv(filter, buf);
1834	case SECCOMP_IOCTL_NOTIF_SEND:
1835	return seccomp_notify_send(filter, buf);
1836	case SECCOMP_IOCTL_NOTIF_ID_VALID_WRONG_DIR:
1837	case SECCOMP_IOCTL_NOTIF_ID_VALID:
1838	return seccomp_notify_id_valid(filter, buf);
1839	case SECCOMP_IOCTL_NOTIF_SET_FLAGS:
1840	return seccomp_notify_set_flags(filter, arg);
1841	}
1842
1843	/* Extensible Argument ioctls */
1844	#define EA_IOCTL(cmd) ((cmd) & ~(IOC_INOUT \| IOCSIZE_MASK))
1845	switch (EA_IOCTL(cmd)) {
1846	case EA_IOCTL(SECCOMP_IOCTL_NOTIF_ADDFD):
1847	return seccomp_notify_addfd(filter, buf, _IOC_SIZE(cmd));
1848	default:
1849	return -EINVAL;
1850	}
1851	}
1852
1853	static __poll_t seccomp_notify_poll(struct file *file,
1854	struct poll_table_struct *poll_tab)
1855	{
1856	struct seccomp_filter *filter = file->private_data;
1857	__poll_t ret = 0;
1858	struct seccomp_knotif *cur;
1859
1860	poll_wait(file, &filter->wqh, poll_tab);
1861
1862	if (mutex_lock_interruptible(&filter->notify_lock) < 0)
1863	return EPOLLERR;
1864
1865	list_for_each_entry(cur, &filter->notif->notifications, list) {
1866	if (cur->state == SECCOMP_NOTIFY_INIT)
1867	ret \|= EPOLLIN \| EPOLLRDNORM;
1868	if (cur->state == SECCOMP_NOTIFY_SENT)
1869	ret \|= EPOLLOUT \| EPOLLWRNORM;
1870	if ((ret & EPOLLIN) && (ret & EPOLLOUT))
1871	break;
1872	}
1873
1874	mutex_unlock(&filter->notify_lock);
1875
1876	if (refcount_read(&filter->users) == 0)
1877	ret \|= EPOLLHUP;
1878
1879	return ret;
1880	}
1881
1882	static const struct file_operations seccomp_notify_ops = {
1883	.poll = seccomp_notify_poll,
1884	.release = seccomp_notify_release,
1885	.unlocked_ioctl = seccomp_notify_ioctl,
1886	.compat_ioctl = seccomp_notify_ioctl,
1887	};
1888
1889	static struct file init_listener(struct seccomp_filter filter)
1890	{
1891	struct file *ret;
1892
1893	ret = ERR_PTR(-ENOMEM);
1894	filter->notif = kzalloc_obj(*(filter->notif));
1895	if (!filter->notif)
1896	goto out;
1897
1898	filter->notif->next_id = get_random_u64();
1899	INIT_LIST_HEAD(&filter->notif->notifications);
1900
1901	ret = anon_inode_getfile("seccomp notify", &seccomp_notify_ops,
1902	filter, O_RDWR);
1903	if (IS_ERR(ret))
1904	goto out_notif;
1905
1906	/* The file has a reference to it now */
1907	__get_seccomp_filter(filter);
1908
1909	out_notif:
1910	if (IS_ERR(ret))
1911	seccomp_notify_free(filter);
1912	out:
1913	return ret;
1914	}
1915
1916	/*
1917	* Does @new_child have a listener while an ancestor also has a listener?
1918	* If so, we'll want to reject this filter.
1919	* This only has to be tested for the current process, even in the TSYNC case,
1920	* because TSYNC installs @child with the same parent on all threads.
1921	* Note that @new_child is not hooked up to its parent at this point yet, so
1922	* we use current->seccomp.filter.
1923	*/
1924	static bool has_duplicate_listener(struct seccomp_filter *new_child)
1925	{
1926	struct seccomp_filter *cur;
1927
1928	/* must be protected against concurrent TSYNC */
1929	lockdep_assert_held(&current->sighand->siglock);
1930
1931	if (!new_child->notif)
1932	return false;
1933	for (cur = current->seccomp.filter; cur; cur = cur->prev) {
1934	if (cur->notif)
1935	return true;
1936	}
1937
1938	return false;
1939	}
1940
1941	/**
1942	* seccomp_set_mode_filter: internal function for setting seccomp filter
1943	* @flags: flags to change filter behavior
1944	* @filter: struct sock_fprog containing filter
1945	*
1946	* This function may be called repeatedly to install additional filters.
1947	* Every filter successfully installed will be evaluated (in reverse order)
1948	* for each system call the task makes.
1949	*
1950	* Once current->seccomp.mode is non-zero, it may not be changed.
1951	*
1952	* Returns 0 on success or -EINVAL on failure.
1953	*/
1954	static long seccomp_set_mode_filter(unsigned int flags,
1955	const char __user *filter)
1956	{
1957	const unsigned long seccomp_mode = SECCOMP_MODE_FILTER;
1958	struct seccomp_filter *prepared = NULL;
1959	long ret = -EINVAL;
1960	int listener = -1;
1961	struct file *listener_f = NULL;
1962
1963	/* Validate flags. */
1964	if (flags & ~SECCOMP_FILTER_FLAG_MASK)
1965	return -EINVAL;
1966
1967	/*
1968	* In the successful case, NEW_LISTENER returns the new listener fd.
1969	* But in the failure case, TSYNC returns the thread that died. If you
1970	* combine these two flags, there's no way to tell whether something
1971	* succeeded or failed. So, let's disallow this combination if the user
1972	* has not explicitly requested no errors from TSYNC.
1973	*/
1974	if ((flags & SECCOMP_FILTER_FLAG_TSYNC) &&
1975	(flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) &&
1976	((flags & SECCOMP_FILTER_FLAG_TSYNC_ESRCH) == 0))
1977	return -EINVAL;
1978
1979	/*
1980	* The SECCOMP_FILTER_FLAG_WAIT_KILLABLE_SENT flag doesn't make sense
1981	* without the SECCOMP_FILTER_FLAG_NEW_LISTENER flag.
1982	*/
1983	if ((flags & SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV) &&
1984	((flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) == 0))
1985	return -EINVAL;
1986
1987	/* Prepare the new filter before holding any locks. */
1988	prepared = seccomp_prepare_user_filter(filter);
1989	if (IS_ERR(prepared))
1990	return PTR_ERR(prepared);
1991
1992	if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) {
1993	listener = get_unused_fd_flags(O_CLOEXEC);
1994	if (listener < 0) {
1995	ret = listener;
1996	goto out_free;
1997	}
1998
1999	listener_f = init_listener(prepared);
2000	if (IS_ERR(listener_f)) {
2001	put_unused_fd(listener);
2002	ret = PTR_ERR(listener_f);
2003	goto out_free;
2004	}
2005	}
2006
2007	/*
2008	* Make sure we cannot change seccomp or nnp state via TSYNC
2009	* while another thread is in the middle of calling exec.
2010	*/
2011	if (flags & SECCOMP_FILTER_FLAG_TSYNC &&
2012	mutex_lock_killable(&current->signal->cred_guard_mutex))
2013	goto out_put_fd;
2014
2015	spin_lock_irq(&current->sighand->siglock);
2016
2017	if (!seccomp_may_assign_mode(seccomp_mode))
2018	goto out;
2019
2020	if (has_duplicate_listener(prepared)) {
2021	ret = -EBUSY;
2022	goto out;
2023	}
2024
2025	ret = seccomp_attach_filter(flags, prepared);
2026	if (ret)
2027	goto out;
2028	/* Do not free the successfully attached filter. */
2029	prepared = NULL;
2030
2031	seccomp_assign_mode(current, seccomp_mode, flags);
2032	out:
2033	spin_unlock_irq(&current->sighand->siglock);
2034	if (flags & SECCOMP_FILTER_FLAG_TSYNC)
2035	mutex_unlock(&current->signal->cred_guard_mutex);
2036	out_put_fd:
2037	if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) {
2038	if (ret) {
2039	listener_f->private_data = NULL;
2040	fput(listener_f);
2041	put_unused_fd(listener);
2042	seccomp_notify_detach(prepared);
2043	} else {
2044	fd_install(listener, listener_f);
2045	ret = listener;
2046	}
2047	}
2048	out_free:
2049	seccomp_filter_free(prepared);
2050	return ret;
2051	}
2052	#else
2053	static inline long seccomp_set_mode_filter(unsigned int flags,
2054	const char __user *filter)
2055	{
2056	return -EINVAL;
2057	}
2058	#endif
2059
2060	static long seccomp_get_action_avail(const char __user *uaction)
2061	{
2062	u32 action;
2063
2064	if (copy_from_user(&action, uaction, sizeof(action)))
2065	return -EFAULT;
2066
2067	switch (action) {
2068	case SECCOMP_RET_KILL_PROCESS:
2069	case SECCOMP_RET_KILL_THREAD:
2070	case SECCOMP_RET_TRAP:
2071	case SECCOMP_RET_ERRNO:
2072	case SECCOMP_RET_USER_NOTIF:
2073	case SECCOMP_RET_TRACE:
2074	case SECCOMP_RET_LOG:
2075	case SECCOMP_RET_ALLOW:
2076	break;
2077	default:
2078	return -EOPNOTSUPP;
2079	}
2080
2081	return 0;
2082	}
2083
2084	static long seccomp_get_notif_sizes(void __user *usizes)
2085	{
2086	struct seccomp_notif_sizes sizes = {
2087	.seccomp_notif = sizeof(struct seccomp_notif),
2088	.seccomp_notif_resp = sizeof(struct seccomp_notif_resp),
2089	.seccomp_data = sizeof(struct seccomp_data),
2090	};
2091
2092	if (copy_to_user(usizes, &sizes, sizeof(sizes)))
2093	return -EFAULT;
2094
2095	return 0;
2096	}
2097
2098	/* Common entry point for both prctl and syscall. */
2099	static long do_seccomp(unsigned int op, unsigned int flags,
2100	void __user *uargs)
2101	{
2102	switch (op) {
2103	case SECCOMP_SET_MODE_STRICT:
2104	if (flags != 0 \|\| uargs != NULL)
2105	return -EINVAL;
2106	return seccomp_set_mode_strict();
2107	case SECCOMP_SET_MODE_FILTER:
2108	return seccomp_set_mode_filter(flags, uargs);
2109	case SECCOMP_GET_ACTION_AVAIL:
2110	if (flags != 0)
2111	return -EINVAL;
2112
2113	return seccomp_get_action_avail(uargs);
2114	case SECCOMP_GET_NOTIF_SIZES:
2115	if (flags != 0)
2116	return -EINVAL;
2117
2118	return seccomp_get_notif_sizes(uargs);
2119	default:
2120	return -EINVAL;
2121	}
2122	}
2123
2124	SYSCALL_DEFINE3(seccomp, unsigned int, op, unsigned int, flags,
2125	void __user *, uargs)
2126	{
2127	return do_seccomp(op, flags, uargs);
2128	}
2129
2130	/**
2131	* prctl_set_seccomp: configures current->seccomp.mode
2132	* @seccomp_mode: requested mode to use
2133	* @filter: optional struct sock_fprog for use with SECCOMP_MODE_FILTER
2134	*
2135	* Returns 0 on success or -EINVAL on failure.
2136	*/
2137	long prctl_set_seccomp(unsigned long seccomp_mode, void __user *filter)
2138	{
2139	unsigned int op;
2140	void __user *uargs;
2141
2142	switch (seccomp_mode) {
2143	case SECCOMP_MODE_STRICT:
2144	op = SECCOMP_SET_MODE_STRICT;
2145	/*
2146	* Setting strict mode through prctl always ignored filter,
2147	* so make sure it is always NULL here to pass the internal
2148	* check in do_seccomp().
2149	*/
2150	uargs = NULL;
2151	break;
2152	case SECCOMP_MODE_FILTER:
2153	op = SECCOMP_SET_MODE_FILTER;
2154	uargs = filter;
2155	break;
2156	default:
2157	return -EINVAL;
2158	}
2159
2160	/* prctl interface doesn't have flags, so they are always zero. */
2161	return do_seccomp(op, 0, uargs);
2162	}
2163
2164	#if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
2165	static struct seccomp_filter get_nth_filter(struct task_struct task,
2166	unsigned long filter_off)
2167	{
2168	struct seccomp_filter orig, filter;
2169	unsigned long count;
2170
2171	/*
2172	* Note: this is only correct because the caller should be the (ptrace)
2173	* tracer of the task, otherwise lock_task_sighand is needed.
2174	*/
2175	spin_lock_irq(&task->sighand->siglock);
2176
2177	if (task->seccomp.mode != SECCOMP_MODE_FILTER) {
2178	spin_unlock_irq(&task->sighand->siglock);
2179	return ERR_PTR(-EINVAL);
2180	}
2181
2182	orig = task->seccomp.filter;
2183	__get_seccomp_filter(orig);
2184	spin_unlock_irq(&task->sighand->siglock);
2185
2186	count = 0;
2187	for (filter = orig; filter; filter = filter->prev)
2188	count++;
2189
2190	if (filter_off >= count) {
2191	filter = ERR_PTR(-ENOENT);
2192	goto out;
2193	}
2194
2195	count -= filter_off;
2196	for (filter = orig; filter && count > 1; filter = filter->prev)
2197	count--;
2198
2199	if (WARN_ON(count != 1 \|\| !filter)) {
2200	filter = ERR_PTR(-ENOENT);
2201	goto out;
2202	}
2203
2204	__get_seccomp_filter(filter);
2205
2206	out:
2207	__put_seccomp_filter(orig);
2208	return filter;
2209	}
2210
2211	long seccomp_get_filter(struct task_struct *task, unsigned long filter_off,
2212	void __user *data)
2213	{
2214	struct seccomp_filter *filter;
2215	struct sock_fprog_kern *fprog;
2216	long ret;
2217
2218	if (!capable(CAP_SYS_ADMIN) \|\|
2219	current->seccomp.mode != SECCOMP_MODE_DISABLED) {
2220	return -EACCES;
2221	}
2222
2223	filter = get_nth_filter(task, filter_off);
2224	if (IS_ERR(filter))
2225	return PTR_ERR(filter);
2226
2227	fprog = filter->prog->orig_prog;
2228	if (!fprog) {
2229	/* This must be a new non-cBPF filter, since we save
2230	* every cBPF filter's orig_prog above when
2231	* CONFIG_CHECKPOINT_RESTORE is enabled.
2232	*/
2233	ret = -EMEDIUMTYPE;
2234	goto out;
2235	}
2236
2237	ret = fprog->len;
2238	if (!data)
2239	goto out;
2240
2241	if (copy_to_user(data, fprog->filter, bpf_classic_proglen(fprog)))
2242	ret = -EFAULT;
2243
2244	out:
2245	__put_seccomp_filter(filter);
2246	return ret;
2247	}
2248
2249	long seccomp_get_metadata(struct task_struct *task,
2250	unsigned long size, void __user *data)
2251	{
2252	long ret;
2253	struct seccomp_filter *filter;
2254	struct seccomp_metadata kmd = {};
2255
2256	if (!capable(CAP_SYS_ADMIN) \|\|
2257	current->seccomp.mode != SECCOMP_MODE_DISABLED) {
2258	return -EACCES;
2259	}
2260
2261	size = min_t(unsigned long, size, sizeof(kmd));
2262
2263	if (size < sizeof(kmd.filter_off))
2264	return -EINVAL;
2265
2266	if (copy_from_user(&kmd.filter_off, data, sizeof(kmd.filter_off)))
2267	return -EFAULT;
2268
2269	filter = get_nth_filter(task, kmd.filter_off);
2270	if (IS_ERR(filter))
2271	return PTR_ERR(filter);
2272
2273	if (filter->log)
2274	kmd.flags \|= SECCOMP_FILTER_FLAG_LOG;
2275
2276	ret = size;
2277	if (copy_to_user(data, &kmd, size))
2278	ret = -EFAULT;
2279
2280	__put_seccomp_filter(filter);
2281	return ret;
2282	}
2283	#endif
2284
2285	#ifdef CONFIG_SYSCTL
2286
2287	/* Human readable action names for friendly sysctl interaction */
2288	#define SECCOMP_RET_KILL_PROCESS_NAME "kill_process"
2289	#define SECCOMP_RET_KILL_THREAD_NAME "kill_thread"
2290	#define SECCOMP_RET_TRAP_NAME "trap"
2291	#define SECCOMP_RET_ERRNO_NAME "errno"
2292	#define SECCOMP_RET_USER_NOTIF_NAME "user_notif"
2293	#define SECCOMP_RET_TRACE_NAME "trace"
2294	#define SECCOMP_RET_LOG_NAME "log"
2295	#define SECCOMP_RET_ALLOW_NAME "allow"
2296
2297	static const char seccomp_actions_avail[] =
2298	SECCOMP_RET_KILL_PROCESS_NAME " "
2299	SECCOMP_RET_KILL_THREAD_NAME " "
2300	SECCOMP_RET_TRAP_NAME " "
2301	SECCOMP_RET_ERRNO_NAME " "
2302	SECCOMP_RET_USER_NOTIF_NAME " "
2303	SECCOMP_RET_TRACE_NAME " "
2304	SECCOMP_RET_LOG_NAME " "
2305	SECCOMP_RET_ALLOW_NAME;
2306
2307	struct seccomp_log_name {
2308	u32 log;
2309	const char *name;
2310	};
2311
2312	static const struct seccomp_log_name seccomp_log_names[] = {
2313	{ SECCOMP_LOG_KILL_PROCESS, SECCOMP_RET_KILL_PROCESS_NAME },
2314	{ SECCOMP_LOG_KILL_THREAD, SECCOMP_RET_KILL_THREAD_NAME },
2315	{ SECCOMP_LOG_TRAP, SECCOMP_RET_TRAP_NAME },
2316	{ SECCOMP_LOG_ERRNO, SECCOMP_RET_ERRNO_NAME },
2317	{ SECCOMP_LOG_USER_NOTIF, SECCOMP_RET_USER_NOTIF_NAME },
2318	{ SECCOMP_LOG_TRACE, SECCOMP_RET_TRACE_NAME },
2319	{ SECCOMP_LOG_LOG, SECCOMP_RET_LOG_NAME },
2320	{ SECCOMP_LOG_ALLOW, SECCOMP_RET_ALLOW_NAME },
2321	{ }
2322	};
2323
2324	static bool seccomp_names_from_actions_logged(char *names, size_t size,
2325	u32 actions_logged,
2326	const char *sep)
2327	{
2328	const struct seccomp_log_name *cur;
2329	bool append_sep = false;
2330
2331	for (cur = seccomp_log_names; cur->name && size; cur++) {
2332	ssize_t ret;
2333
2334	if (!(actions_logged & cur->log))
2335	continue;
2336
2337	if (append_sep) {
2338	ret = strscpy(names, sep, size);
2339	if (ret < 0)
2340	return false;
2341
2342	names += ret;
2343	size -= ret;
2344	} else
2345	append_sep = true;
2346
2347	ret = strscpy(names, cur->name, size);
2348	if (ret < 0)
2349	return false;
2350
2351	names += ret;
2352	size -= ret;
2353	}
2354
2355	return true;
2356	}
2357
2358	static bool seccomp_action_logged_from_name(u32 *action_logged,
2359	const char *name)
2360	{
2361	const struct seccomp_log_name *cur;
2362
2363	for (cur = seccomp_log_names; cur->name; cur++) {
2364	if (!strcmp(cur->name, name)) {
2365	*action_logged = cur->log;
2366	return true;
2367	}
2368	}
2369
2370	return false;
2371	}
2372
2373	static bool seccomp_actions_logged_from_names(u32 actions_logged, char names)
2374	{
2375	char *name;
2376
2377	*actions_logged = 0;
2378	while ((name = strsep(&names, " ")) && *name) {
2379	u32 action_logged = 0;
2380
2381	if (!seccomp_action_logged_from_name(&action_logged, name))
2382	return false;
2383
2384	*actions_logged \|= action_logged;
2385	}
2386
2387	return true;
2388	}
2389
2390	static int read_actions_logged(const struct ctl_table ro_table, void buffer,
2391	size_t lenp, loff_t ppos)
2392	{
2393	char names[sizeof(seccomp_actions_avail)];
2394	struct ctl_table table;
2395
2396	memset(names, 0, sizeof(names));
2397
2398	if (!seccomp_names_from_actions_logged(names, sizeof(names),
2399	seccomp_actions_logged, " "))
2400	return -EINVAL;
2401
2402	table = *ro_table;
2403	table.data = names;
2404	table.maxlen = sizeof(names);
2405	return proc_dostring(&table, 0, buffer, lenp, ppos);
2406	}
2407
2408	static int write_actions_logged(const struct ctl_table ro_table, void buffer,
2409	size_t lenp, loff_t ppos, u32 *actions_logged)
2410	{
2411	char names[sizeof(seccomp_actions_avail)];
2412	struct ctl_table table;
2413	int ret;
2414
2415	if (!capable(CAP_SYS_ADMIN))
2416	return -EPERM;
2417
2418	memset(names, 0, sizeof(names));
2419
2420	table = *ro_table;
2421	table.data = names;
2422	table.maxlen = sizeof(names);
2423	ret = proc_dostring(&table, 1, buffer, lenp, ppos);
2424	if (ret)
2425	return ret;
2426
2427	if (!seccomp_actions_logged_from_names(actions_logged, table.data))
2428	return -EINVAL;
2429
2430	if (*actions_logged & SECCOMP_LOG_ALLOW)
2431	return -EINVAL;
2432
2433	seccomp_actions_logged = *actions_logged;
2434	return 0;
2435	}
2436
2437	static void audit_actions_logged(u32 actions_logged, u32 old_actions_logged,
2438	int ret)
2439	{
2440	char names[sizeof(seccomp_actions_avail)];
2441	char old_names[sizeof(seccomp_actions_avail)];
2442	const char *new = names;
2443	const char *old = old_names;
2444
2445	if (!audit_enabled)
2446	return;
2447
2448	memset(names, 0, sizeof(names));
2449	memset(old_names, 0, sizeof(old_names));
2450
2451	if (ret)
2452	new = "?";
2453	else if (!actions_logged)
2454	new = "(none)";
2455	else if (!seccomp_names_from_actions_logged(names, sizeof(names),
2456	actions_logged, ","))
2457	new = "?";
2458
2459	if (!old_actions_logged)
2460	old = "(none)";
2461	else if (!seccomp_names_from_actions_logged(old_names,
2462	sizeof(old_names),
2463	old_actions_logged, ","))
2464	old = "?";
2465
2466	return audit_seccomp_actions_logged(new, old, !ret);
2467	}
2468
2469	static int seccomp_actions_logged_handler(const struct ctl_table *ro_table, int write,
2470	void buffer, size_t lenp,
2471	loff_t *ppos)
2472	{
2473	int ret;
2474
2475	if (write) {
2476	u32 actions_logged = 0;
2477	u32 old_actions_logged = seccomp_actions_logged;
2478
2479	ret = write_actions_logged(ro_table, buffer, lenp, ppos,
2480	&actions_logged);
2481	audit_actions_logged(actions_logged, old_actions_logged, ret);
2482	} else
2483	ret = read_actions_logged(ro_table, buffer, lenp, ppos);
2484
2485	return ret;
2486	}
2487
2488	static const struct ctl_table seccomp_sysctl_table[] = {
2489	{
2490	.procname = "actions_avail",
2491	.data = (void *) &seccomp_actions_avail,
2492	.maxlen = sizeof(seccomp_actions_avail),
2493	.mode = 0444,
2494	.proc_handler = proc_dostring,
2495	},
2496	{
2497	.procname = "actions_logged",
2498	.mode = 0644,
2499	.proc_handler = seccomp_actions_logged_handler,
2500	},
2501	};
2502
2503	static int __init seccomp_sysctl_init(void)
2504	{
2505	register_sysctl_init("kernel/seccomp", seccomp_sysctl_table);
2506	return 0;
2507	}
2508
2509	device_initcall(seccomp_sysctl_init)
2510
2511	#endif /* CONFIG_SYSCTL */
2512
2513	#ifdef CONFIG_SECCOMP_CACHE_DEBUG
2514	/* Currently CONFIG_SECCOMP_CACHE_DEBUG implies SECCOMP_ARCH_NATIVE */
2515	static void proc_pid_seccomp_cache_arch(struct seq_file m, const char name,
2516	const void *bitmap, size_t bitmap_size)
2517	{
2518	int nr;
2519
2520	for (nr = 0; nr < bitmap_size; nr++) {
2521	bool cached = test_bit(nr, bitmap);
2522	char *status = cached ? "ALLOW" : "FILTER";
2523
2524	seq_printf(m, "%s %d %s\n", name, nr, status);
2525	}
2526	}
2527
2528	int proc_pid_seccomp_cache(struct seq_file m, struct pid_namespace ns,
2529	struct pid pid, struct task_struct task)
2530	{
2531	struct seccomp_filter *f;
2532	unsigned long flags;
2533
2534	/*
2535	* We don't want some sandboxed process to know what their seccomp
2536	* filters consist of.
2537	*/
2538	if (!file_ns_capable(m->file, &init_user_ns, CAP_SYS_ADMIN))
2539	return -EACCES;
2540
2541	if (!lock_task_sighand(task, &flags))
2542	return -ESRCH;
2543
2544	f = READ_ONCE(task->seccomp.filter);
2545	if (!f) {
2546	unlock_task_sighand(task, &flags);
2547	return 0;
2548	}
2549
2550	/* prevent filter from being freed while we are printing it */
2551	__get_seccomp_filter(f);
2552	unlock_task_sighand(task, &flags);
2553
2554	proc_pid_seccomp_cache_arch(m, SECCOMP_ARCH_NATIVE_NAME,
2555	f->cache.allow_native,
2556	SECCOMP_ARCH_NATIVE_NR);
2557
2558	#ifdef SECCOMP_ARCH_COMPAT
2559	proc_pid_seccomp_cache_arch(m, SECCOMP_ARCH_COMPAT_NAME,
2560	f->cache.allow_compat,
2561	SECCOMP_ARCH_COMPAT_NR);
2562	#endif /* SECCOMP_ARCH_COMPAT */
2563
2564	__put_seccomp_filter(f);
2565	return 0;
2566	}
2567	#endif /* CONFIG_SECCOMP_CACHE_DEBUG */