Version:  2.0.40 2.2.26 2.4.37 2.6.39 3.0 3.1 3.2 3.3 3.4 3.5 3.6 3.7 3.8 3.9 3.10 3.11 3.12 3.13 3.14 3.15

Linux/kernel/seccomp.c

Diff markup

Differences between /kernel/seccomp.c (Version 3.15) and /kernel/seccomp.c (Version 3.6)


  1 /*                                                  1 /*
  2  * linux/kernel/seccomp.c                           2  * linux/kernel/seccomp.c
  3  *                                                  3  *
  4  * Copyright 2004-2005  Andrea Arcangeli <andr      4  * Copyright 2004-2005  Andrea Arcangeli <andrea@cpushare.com>
  5  *                                                  5  *
  6  * Copyright (C) 2012 Google, Inc.                  6  * Copyright (C) 2012 Google, Inc.
  7  * Will Drewry <wad@chromium.org>                   7  * Will Drewry <wad@chromium.org>
  8  *                                                  8  *
  9  * This defines a simple but solid secure-comp      9  * This defines a simple but solid secure-computing facility.
 10  *                                                 10  *
 11  * Mode 1 uses a fixed list of allowed system      11  * Mode 1 uses a fixed list of allowed system calls.
 12  * Mode 2 allows user-defined system call filt     12  * Mode 2 allows user-defined system call filters in the form
 13  *        of Berkeley Packet Filters/Linux Soc     13  *        of Berkeley Packet Filters/Linux Socket Filters.
 14  */                                                14  */
 15                                                    15 
 16 #include <linux/atomic.h>                          16 #include <linux/atomic.h>
 17 #include <linux/audit.h>                           17 #include <linux/audit.h>
 18 #include <linux/compat.h>                          18 #include <linux/compat.h>
 19 #include <linux/sched.h>                           19 #include <linux/sched.h>
 20 #include <linux/seccomp.h>                         20 #include <linux/seccomp.h>
 21                                                    21 
 22 /* #define SECCOMP_DEBUG 1 */                      22 /* #define SECCOMP_DEBUG 1 */
 23                                                    23 
 24 #ifdef CONFIG_SECCOMP_FILTER                       24 #ifdef CONFIG_SECCOMP_FILTER
 25 #include <asm/syscall.h>                           25 #include <asm/syscall.h>
 26 #include <linux/filter.h>                          26 #include <linux/filter.h>
 27 #include <linux/ptrace.h>                          27 #include <linux/ptrace.h>
 28 #include <linux/security.h>                        28 #include <linux/security.h>
 29 #include <linux/slab.h>                            29 #include <linux/slab.h>
 30 #include <linux/tracehook.h>                       30 #include <linux/tracehook.h>
 31 #include <linux/uaccess.h>                         31 #include <linux/uaccess.h>
 32                                                    32 
 33 /**                                                33 /**
 34  * struct seccomp_filter - container for secco     34  * struct seccomp_filter - container for seccomp BPF programs
 35  *                                                 35  *
 36  * @usage: reference count to manage the objec     36  * @usage: reference count to manage the object lifetime.
 37  *         get/put helpers should be used when     37  *         get/put helpers should be used when accessing an instance
 38  *         outside of a lifetime-guarded secti     38  *         outside of a lifetime-guarded section.  In general, this
 39  *         is only needed for handling filters     39  *         is only needed for handling filters shared across tasks.
 40  * @prev: points to a previously installed, or     40  * @prev: points to a previously installed, or inherited, filter
 41  * @len: the number of instructions in the pro     41  * @len: the number of instructions in the program
 42  * @insns: the BPF program instructions to eva     42  * @insns: the BPF program instructions to evaluate
 43  *                                                 43  *
 44  * seccomp_filter objects are organized in a t     44  * seccomp_filter objects are organized in a tree linked via the @prev
 45  * pointer.  For any task, it appears to be a      45  * pointer.  For any task, it appears to be a singly-linked list starting
 46  * with current->seccomp.filter, the most rece     46  * with current->seccomp.filter, the most recently attached or inherited filter.
 47  * However, multiple filters may share a @prev     47  * However, multiple filters may share a @prev node, by way of fork(), which
 48  * results in a unidirectional tree existing i     48  * results in a unidirectional tree existing in memory.  This is similar to
 49  * how namespaces work.                            49  * how namespaces work.
 50  *                                                 50  *
 51  * seccomp_filter objects should never be modi     51  * seccomp_filter objects should never be modified after being attached
 52  * to a task_struct (other than @usage).           52  * to a task_struct (other than @usage).
 53  */                                                53  */
 54 struct seccomp_filter {                            54 struct seccomp_filter {
 55         atomic_t usage;                            55         atomic_t usage;
 56         struct seccomp_filter *prev;               56         struct seccomp_filter *prev;
 57         unsigned short len;  /* Instruction co     57         unsigned short len;  /* Instruction count */
 58         struct sock_filter_int insnsi[];       !!  58         struct sock_filter insns[];
 59 };                                                 59 };
 60                                                    60 
 61 /* Limit any path through the tree to 256KB wo     61 /* Limit any path through the tree to 256KB worth of instructions. */
 62 #define MAX_INSNS_PER_PATH ((1 << 18) / sizeof     62 #define MAX_INSNS_PER_PATH ((1 << 18) / sizeof(struct sock_filter))
 63                                                    63 
 64 /*                                             !!  64 /**
                                                   >>  65  * get_u32 - returns a u32 offset into data
                                                   >>  66  * @data: a unsigned 64 bit value
                                                   >>  67  * @index: 0 or 1 to return the first or second 32-bits
                                                   >>  68  *
                                                   >>  69  * This inline exists to hide the length of unsigned long.  If a 32-bit
                                                   >>  70  * unsigned long is passed in, it will be extended and the top 32-bits will be
                                                   >>  71  * 0. If it is a 64-bit unsigned long, then whatever data is resident will be
                                                   >>  72  * properly returned.
                                                   >>  73  *
 65  * Endianness is explicitly ignored and left f     74  * Endianness is explicitly ignored and left for BPF program authors to manage
 66  * as per the specific architecture.               75  * as per the specific architecture.
 67  */                                                76  */
 68 static void populate_seccomp_data(struct secco !!  77 static inline u32 get_u32(u64 data, int index)
                                                   >>  78 {
                                                   >>  79         return ((u32 *)&data)[index];
                                                   >>  80 }
                                                   >>  81 
                                                   >>  82 /* Helper for bpf_load below. */
                                                   >>  83 #define BPF_DATA(_name) offsetof(struct seccomp_data, _name)
                                                   >>  84 /**
                                                   >>  85  * bpf_load: checks and returns a pointer to the requested offset
                                                   >>  86  * @off: offset into struct seccomp_data to load from
                                                   >>  87  *
                                                   >>  88  * Returns the requested 32-bits of data.
                                                   >>  89  * seccomp_check_filter() should assure that @off is 32-bit aligned
                                                   >>  90  * and not out of bounds.  Failure to do so is a BUG.
                                                   >>  91  */
                                                   >>  92 u32 seccomp_bpf_load(int off)
 69 {                                                  93 {
 70         struct task_struct *task = current;    !!  94         struct pt_regs *regs = task_pt_regs(current);
 71         struct pt_regs *regs = task_pt_regs(ta !!  95         if (off == BPF_DATA(nr))
 72         unsigned long args[6];                 !!  96                 return syscall_get_nr(current, regs);
 73                                                !!  97         if (off == BPF_DATA(arch))
 74         sd->nr = syscall_get_nr(task, regs);   !!  98                 return syscall_get_arch(current, regs);
 75         sd->arch = syscall_get_arch();         !!  99         if (off >= BPF_DATA(args[0]) && off < BPF_DATA(args[6])) {
 76         syscall_get_arguments(task, regs, 0, 6 !! 100                 unsigned long value;
 77         sd->args[0] = args[0];                 !! 101                 int arg = (off - BPF_DATA(args[0])) / sizeof(u64);
 78         sd->args[1] = args[1];                 !! 102                 int index = !!(off % sizeof(u64));
 79         sd->args[2] = args[2];                 !! 103                 syscall_get_arguments(current, regs, arg, 1, &value);
 80         sd->args[3] = args[3];                 !! 104                 return get_u32(value, index);
 81         sd->args[4] = args[4];                 !! 105         }
 82         sd->args[5] = args[5];                 !! 106         if (off == BPF_DATA(instruction_pointer))
 83         sd->instruction_pointer = KSTK_EIP(tas !! 107                 return get_u32(KSTK_EIP(current), 0);
                                                   >> 108         if (off == BPF_DATA(instruction_pointer) + sizeof(u32))
                                                   >> 109                 return get_u32(KSTK_EIP(current), 1);
                                                   >> 110         /* seccomp_check_filter should make this impossible. */
                                                   >> 111         BUG();
 84 }                                                 112 }
 85                                                   113 
 86 /**                                               114 /**
 87  *      seccomp_check_filter - verify seccomp     115  *      seccomp_check_filter - verify seccomp filter code
 88  *      @filter: filter to verify                 116  *      @filter: filter to verify
 89  *      @flen: length of filter                   117  *      @flen: length of filter
 90  *                                                118  *
 91  * Takes a previously checked filter (by sk_ch    119  * Takes a previously checked filter (by sk_chk_filter) and
 92  * redirects all filter code that loads struct    120  * redirects all filter code that loads struct sk_buff data
 93  * and related data through seccomp_bpf_load.     121  * and related data through seccomp_bpf_load.  It also
 94  * enforces length and alignment checking of t    122  * enforces length and alignment checking of those loads.
 95  *                                                123  *
 96  * Returns 0 if the rule set is legal or -EINV    124  * Returns 0 if the rule set is legal or -EINVAL if not.
 97  */                                               125  */
 98 static int seccomp_check_filter(struct sock_fi    126 static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen)
 99 {                                                 127 {
100         int pc;                                   128         int pc;
101         for (pc = 0; pc < flen; pc++) {           129         for (pc = 0; pc < flen; pc++) {
102                 struct sock_filter *ftest = &f    130                 struct sock_filter *ftest = &filter[pc];
103                 u16 code = ftest->code;           131                 u16 code = ftest->code;
104                 u32 k = ftest->k;                 132                 u32 k = ftest->k;
105                                                   133 
106                 switch (code) {                   134                 switch (code) {
107                 case BPF_S_LD_W_ABS:              135                 case BPF_S_LD_W_ABS:
108                         ftest->code = BPF_LDX  !! 136                         ftest->code = BPF_S_ANC_SECCOMP_LD_W;
109                         /* 32-bit aligned and     137                         /* 32-bit aligned and not out of bounds. */
110                         if (k >= sizeof(struct    138                         if (k >= sizeof(struct seccomp_data) || k & 3)
111                                 return -EINVAL    139                                 return -EINVAL;
112                         continue;                 140                         continue;
113                 case BPF_S_LD_W_LEN:              141                 case BPF_S_LD_W_LEN:
114                         ftest->code = BPF_LD | !! 142                         ftest->code = BPF_S_LD_IMM;
115                         ftest->k = sizeof(stru    143                         ftest->k = sizeof(struct seccomp_data);
116                         continue;                 144                         continue;
117                 case BPF_S_LDX_W_LEN:             145                 case BPF_S_LDX_W_LEN:
118                         ftest->code = BPF_LDX  !! 146                         ftest->code = BPF_S_LDX_IMM;
119                         ftest->k = sizeof(stru    147                         ftest->k = sizeof(struct seccomp_data);
120                         continue;                 148                         continue;
121                 /* Explicitly include allowed     149                 /* Explicitly include allowed calls. */
122                 case BPF_S_RET_K:                 150                 case BPF_S_RET_K:
123                 case BPF_S_RET_A:                 151                 case BPF_S_RET_A:
124                 case BPF_S_ALU_ADD_K:             152                 case BPF_S_ALU_ADD_K:
125                 case BPF_S_ALU_ADD_X:             153                 case BPF_S_ALU_ADD_X:
126                 case BPF_S_ALU_SUB_K:             154                 case BPF_S_ALU_SUB_K:
127                 case BPF_S_ALU_SUB_X:             155                 case BPF_S_ALU_SUB_X:
128                 case BPF_S_ALU_MUL_K:             156                 case BPF_S_ALU_MUL_K:
129                 case BPF_S_ALU_MUL_X:             157                 case BPF_S_ALU_MUL_X:
130                 case BPF_S_ALU_DIV_X:             158                 case BPF_S_ALU_DIV_X:
131                 case BPF_S_ALU_AND_K:             159                 case BPF_S_ALU_AND_K:
132                 case BPF_S_ALU_AND_X:             160                 case BPF_S_ALU_AND_X:
133                 case BPF_S_ALU_OR_K:              161                 case BPF_S_ALU_OR_K:
134                 case BPF_S_ALU_OR_X:              162                 case BPF_S_ALU_OR_X:
135                 case BPF_S_ALU_XOR_K:          << 
136                 case BPF_S_ALU_XOR_X:          << 
137                 case BPF_S_ALU_LSH_K:             163                 case BPF_S_ALU_LSH_K:
138                 case BPF_S_ALU_LSH_X:             164                 case BPF_S_ALU_LSH_X:
139                 case BPF_S_ALU_RSH_K:             165                 case BPF_S_ALU_RSH_K:
140                 case BPF_S_ALU_RSH_X:             166                 case BPF_S_ALU_RSH_X:
141                 case BPF_S_ALU_NEG:               167                 case BPF_S_ALU_NEG:
142                 case BPF_S_LD_IMM:                168                 case BPF_S_LD_IMM:
143                 case BPF_S_LDX_IMM:               169                 case BPF_S_LDX_IMM:
144                 case BPF_S_MISC_TAX:              170                 case BPF_S_MISC_TAX:
145                 case BPF_S_MISC_TXA:              171                 case BPF_S_MISC_TXA:
146                 case BPF_S_ALU_DIV_K:             172                 case BPF_S_ALU_DIV_K:
147                 case BPF_S_LD_MEM:                173                 case BPF_S_LD_MEM:
148                 case BPF_S_LDX_MEM:               174                 case BPF_S_LDX_MEM:
149                 case BPF_S_ST:                    175                 case BPF_S_ST:
150                 case BPF_S_STX:                   176                 case BPF_S_STX:
151                 case BPF_S_JMP_JA:                177                 case BPF_S_JMP_JA:
152                 case BPF_S_JMP_JEQ_K:             178                 case BPF_S_JMP_JEQ_K:
153                 case BPF_S_JMP_JEQ_X:             179                 case BPF_S_JMP_JEQ_X:
154                 case BPF_S_JMP_JGE_K:             180                 case BPF_S_JMP_JGE_K:
155                 case BPF_S_JMP_JGE_X:             181                 case BPF_S_JMP_JGE_X:
156                 case BPF_S_JMP_JGT_K:             182                 case BPF_S_JMP_JGT_K:
157                 case BPF_S_JMP_JGT_X:             183                 case BPF_S_JMP_JGT_X:
158                 case BPF_S_JMP_JSET_K:            184                 case BPF_S_JMP_JSET_K:
159                 case BPF_S_JMP_JSET_X:            185                 case BPF_S_JMP_JSET_X:
160                         sk_decode_filter(ftest << 
161                         continue;                 186                         continue;
162                 default:                          187                 default:
163                         return -EINVAL;           188                         return -EINVAL;
164                 }                                 189                 }
165         }                                         190         }
166         return 0;                                 191         return 0;
167 }                                                 192 }
168                                                   193 
169 /**                                               194 /**
170  * seccomp_run_filters - evaluates all seccomp    195  * seccomp_run_filters - evaluates all seccomp filters against @syscall
171  * @syscall: number of the current system call    196  * @syscall: number of the current system call
172  *                                                197  *
173  * Returns valid seccomp BPF response codes.      198  * Returns valid seccomp BPF response codes.
174  */                                               199  */
175 static u32 seccomp_run_filters(int syscall)       200 static u32 seccomp_run_filters(int syscall)
176 {                                                 201 {
177         struct seccomp_filter *f;                 202         struct seccomp_filter *f;
178         struct seccomp_data sd;                << 
179         u32 ret = SECCOMP_RET_ALLOW;              203         u32 ret = SECCOMP_RET_ALLOW;
180                                                   204 
181         /* Ensure unexpected behavior doesn't     205         /* Ensure unexpected behavior doesn't result in failing open. */
182         if (WARN_ON(current->seccomp.filter ==    206         if (WARN_ON(current->seccomp.filter == NULL))
183                 return SECCOMP_RET_KILL;          207                 return SECCOMP_RET_KILL;
184                                                   208 
185         populate_seccomp_data(&sd);            << 
186                                                << 
187         /*                                        209         /*
188          * All filters in the list are evaluat    210          * All filters in the list are evaluated and the lowest BPF return
189          * value always takes priority (ignori    211          * value always takes priority (ignoring the DATA).
190          */                                       212          */
191         for (f = current->seccomp.filter; f; f    213         for (f = current->seccomp.filter; f; f = f->prev) {
192                 u32 cur_ret = sk_run_filter_in !! 214                 u32 cur_ret = sk_run_filter(NULL, f->insns);
193                 if ((cur_ret & SECCOMP_RET_ACT    215                 if ((cur_ret & SECCOMP_RET_ACTION) < (ret & SECCOMP_RET_ACTION))
194                         ret = cur_ret;            216                         ret = cur_ret;
195         }                                         217         }
196         return ret;                               218         return ret;
197 }                                                 219 }
198                                                   220 
199 /**                                               221 /**
200  * seccomp_attach_filter: Attaches a seccomp f    222  * seccomp_attach_filter: Attaches a seccomp filter to current.
201  * @fprog: BPF program to install                 223  * @fprog: BPF program to install
202  *                                                224  *
203  * Returns 0 on success or an errno on failure    225  * Returns 0 on success or an errno on failure.
204  */                                               226  */
205 static long seccomp_attach_filter(struct sock_    227 static long seccomp_attach_filter(struct sock_fprog *fprog)
206 {                                                 228 {
207         struct seccomp_filter *filter;            229         struct seccomp_filter *filter;
208         unsigned long fp_size = fprog->len * s    230         unsigned long fp_size = fprog->len * sizeof(struct sock_filter);
209         unsigned long total_insns = fprog->len    231         unsigned long total_insns = fprog->len;
210         struct sock_filter *fp;                << 
211         int new_len;                           << 
212         long ret;                                 232         long ret;
213                                                   233 
214         if (fprog->len == 0 || fprog->len > BP    234         if (fprog->len == 0 || fprog->len > BPF_MAXINSNS)
215                 return -EINVAL;                   235                 return -EINVAL;
216                                                   236 
217         for (filter = current->seccomp.filter;    237         for (filter = current->seccomp.filter; filter; filter = filter->prev)
218                 total_insns += filter->len + 4    238                 total_insns += filter->len + 4;  /* include a 4 instr penalty */
219         if (total_insns > MAX_INSNS_PER_PATH)     239         if (total_insns > MAX_INSNS_PER_PATH)
220                 return -ENOMEM;                   240                 return -ENOMEM;
221                                                   241 
222         /*                                        242         /*
223          * Installing a seccomp filter require    243          * Installing a seccomp filter requires that the task have
224          * CAP_SYS_ADMIN in its namespace or b    244          * CAP_SYS_ADMIN in its namespace or be running with no_new_privs.
225          * This avoids scenarios where unprivi    245          * This avoids scenarios where unprivileged tasks can affect the
226          * behavior of privileged children.       246          * behavior of privileged children.
227          */                                       247          */
228         if (!current->no_new_privs &&             248         if (!current->no_new_privs &&
229             security_capable_noaudit(current_c    249             security_capable_noaudit(current_cred(), current_user_ns(),
230                                      CAP_SYS_A    250                                      CAP_SYS_ADMIN) != 0)
231                 return -EACCES;                   251                 return -EACCES;
232                                                   252 
233         fp = kzalloc(fp_size, GFP_KERNEL|__GFP !! 253         /* Allocate a new seccomp_filter */
234         if (!fp)                               !! 254         filter = kzalloc(sizeof(struct seccomp_filter) + fp_size,
                                                   >> 255                          GFP_KERNEL|__GFP_NOWARN);
                                                   >> 256         if (!filter)
235                 return -ENOMEM;                   257                 return -ENOMEM;
                                                   >> 258         atomic_set(&filter->usage, 1);
                                                   >> 259         filter->len = fprog->len;
236                                                   260 
237         /* Copy the instructions from fprog. *    261         /* Copy the instructions from fprog. */
238         ret = -EFAULT;                            262         ret = -EFAULT;
239         if (copy_from_user(fp, fprog->filter,  !! 263         if (copy_from_user(filter->insns, fprog->filter, fp_size))
240                 goto free_prog;                !! 264                 goto fail;
241                                                   265 
242         /* Check and rewrite the fprog via the    266         /* Check and rewrite the fprog via the skb checker */
243         ret = sk_chk_filter(fp, fprog->len);   !! 267         ret = sk_chk_filter(filter->insns, filter->len);
244         if (ret)                                  268         if (ret)
245                 goto free_prog;                !! 269                 goto fail;
246                                                   270 
247         /* Check and rewrite the fprog for sec    271         /* Check and rewrite the fprog for seccomp use */
248         ret = seccomp_check_filter(fp, fprog-> !! 272         ret = seccomp_check_filter(filter->insns, filter->len);
249         if (ret)                               << 
250                 goto free_prog;                << 
251                                                << 
252         /* Convert 'sock_filter' insns to 'soc << 
253         ret = sk_convert_filter(fp, fprog->len << 
254         if (ret)                               << 
255                 goto free_prog;                << 
256                                                << 
257         /* Allocate a new seccomp_filter */    << 
258         ret = -ENOMEM;                         << 
259         filter = kzalloc(sizeof(struct seccomp << 
260                          sizeof(struct sock_fi << 
261                          GFP_KERNEL|__GFP_NOWA << 
262         if (!filter)                           << 
263                 goto free_prog;                << 
264                                                << 
265         ret = sk_convert_filter(fp, fprog->len << 
266         if (ret)                                  273         if (ret)
267                 goto free_filter;              !! 274                 goto fail;
268         kfree(fp);                             << 
269                                                << 
270         atomic_set(&filter->usage, 1);         << 
271         filter->len = new_len;                 << 
272                                                   275 
273         /*                                        276         /*
274          * If there is an existing filter, mak    277          * If there is an existing filter, make it the prev and don't drop its
275          * task reference.                        278          * task reference.
276          */                                       279          */
277         filter->prev = current->seccomp.filter    280         filter->prev = current->seccomp.filter;
278         current->seccomp.filter = filter;         281         current->seccomp.filter = filter;
279         return 0;                                 282         return 0;
280                                                !! 283 fail:
281 free_filter:                                   << 
282         kfree(filter);                            284         kfree(filter);
283 free_prog:                                     << 
284         kfree(fp);                             << 
285         return ret;                               285         return ret;
286 }                                                 286 }
287                                                   287 
288 /**                                               288 /**
289  * seccomp_attach_user_filter - attaches a use    289  * seccomp_attach_user_filter - attaches a user-supplied sock_fprog
290  * @user_filter: pointer to the user data cont    290  * @user_filter: pointer to the user data containing a sock_fprog.
291  *                                                291  *
292  * Returns 0 on success and non-zero otherwise    292  * Returns 0 on success and non-zero otherwise.
293  */                                               293  */
294 static long seccomp_attach_user_filter(char __ !! 294 long seccomp_attach_user_filter(char __user *user_filter)
295 {                                                 295 {
296         struct sock_fprog fprog;                  296         struct sock_fprog fprog;
297         long ret = -EFAULT;                       297         long ret = -EFAULT;
298                                                   298 
299 #ifdef CONFIG_COMPAT                              299 #ifdef CONFIG_COMPAT
300         if (is_compat_task()) {                   300         if (is_compat_task()) {
301                 struct compat_sock_fprog fprog    301                 struct compat_sock_fprog fprog32;
302                 if (copy_from_user(&fprog32, u    302                 if (copy_from_user(&fprog32, user_filter, sizeof(fprog32)))
303                         goto out;                 303                         goto out;
304                 fprog.len = fprog32.len;          304                 fprog.len = fprog32.len;
305                 fprog.filter = compat_ptr(fpro    305                 fprog.filter = compat_ptr(fprog32.filter);
306         } else /* falls through to the if belo    306         } else /* falls through to the if below. */
307 #endif                                            307 #endif
308         if (copy_from_user(&fprog, user_filter    308         if (copy_from_user(&fprog, user_filter, sizeof(fprog)))
309                 goto out;                         309                 goto out;
310         ret = seccomp_attach_filter(&fprog);      310         ret = seccomp_attach_filter(&fprog);
311 out:                                              311 out:
312         return ret;                               312         return ret;
313 }                                                 313 }
314                                                   314 
315 /* get_seccomp_filter - increments the referen    315 /* get_seccomp_filter - increments the reference count of the filter on @tsk */
316 void get_seccomp_filter(struct task_struct *ts    316 void get_seccomp_filter(struct task_struct *tsk)
317 {                                                 317 {
318         struct seccomp_filter *orig = tsk->sec    318         struct seccomp_filter *orig = tsk->seccomp.filter;
319         if (!orig)                                319         if (!orig)
320                 return;                           320                 return;
321         /* Reference count is bounded by the n    321         /* Reference count is bounded by the number of total processes. */
322         atomic_inc(&orig->usage);                 322         atomic_inc(&orig->usage);
323 }                                                 323 }
324                                                   324 
325 /* put_seccomp_filter - decrements the ref cou    325 /* put_seccomp_filter - decrements the ref count of tsk->seccomp.filter */
326 void put_seccomp_filter(struct task_struct *ts    326 void put_seccomp_filter(struct task_struct *tsk)
327 {                                                 327 {
328         struct seccomp_filter *orig = tsk->sec    328         struct seccomp_filter *orig = tsk->seccomp.filter;
329         /* Clean up single-reference branches     329         /* Clean up single-reference branches iteratively. */
330         while (orig && atomic_dec_and_test(&or    330         while (orig && atomic_dec_and_test(&orig->usage)) {
331                 struct seccomp_filter *freeme     331                 struct seccomp_filter *freeme = orig;
332                 orig = orig->prev;                332                 orig = orig->prev;
333                 kfree(freeme);                    333                 kfree(freeme);
334         }                                         334         }
335 }                                                 335 }
336                                                   336 
337 /**                                               337 /**
338  * seccomp_send_sigsys - signals the task to a    338  * seccomp_send_sigsys - signals the task to allow in-process syscall emulation
339  * @syscall: syscall number to send to userlan    339  * @syscall: syscall number to send to userland
340  * @reason: filter-supplied reason code to sen    340  * @reason: filter-supplied reason code to send to userland (via si_errno)
341  *                                                341  *
342  * Forces a SIGSYS with a code of SYS_SECCOMP     342  * Forces a SIGSYS with a code of SYS_SECCOMP and related sigsys info.
343  */                                               343  */
344 static void seccomp_send_sigsys(int syscall, i    344 static void seccomp_send_sigsys(int syscall, int reason)
345 {                                                 345 {
346         struct siginfo info;                      346         struct siginfo info;
347         memset(&info, 0, sizeof(info));           347         memset(&info, 0, sizeof(info));
348         info.si_signo = SIGSYS;                   348         info.si_signo = SIGSYS;
349         info.si_code = SYS_SECCOMP;               349         info.si_code = SYS_SECCOMP;
350         info.si_call_addr = (void __user *)KST    350         info.si_call_addr = (void __user *)KSTK_EIP(current);
351         info.si_errno = reason;                   351         info.si_errno = reason;
352         info.si_arch = syscall_get_arch();     !! 352         info.si_arch = syscall_get_arch(current, task_pt_regs(current));
353         info.si_syscall = syscall;                353         info.si_syscall = syscall;
354         force_sig_info(SIGSYS, &info, current)    354         force_sig_info(SIGSYS, &info, current);
355 }                                                 355 }
356 #endif  /* CONFIG_SECCOMP_FILTER */               356 #endif  /* CONFIG_SECCOMP_FILTER */
357                                                   357 
358 /*                                                358 /*
359  * Secure computing mode 1 allows only read/wr    359  * Secure computing mode 1 allows only read/write/exit/sigreturn.
360  * To be fully secure this must be combined wi    360  * To be fully secure this must be combined with rlimit
361  * to limit the stack allocations too.            361  * to limit the stack allocations too.
362  */                                               362  */
363 static int mode1_syscalls[] = {                   363 static int mode1_syscalls[] = {
364         __NR_seccomp_read, __NR_seccomp_write,    364         __NR_seccomp_read, __NR_seccomp_write, __NR_seccomp_exit, __NR_seccomp_sigreturn,
365         0, /* null terminated */                  365         0, /* null terminated */
366 };                                                366 };
367                                                   367 
368 #ifdef CONFIG_COMPAT                              368 #ifdef CONFIG_COMPAT
369 static int mode1_syscalls_32[] = {                369 static int mode1_syscalls_32[] = {
370         __NR_seccomp_read_32, __NR_seccomp_wri    370         __NR_seccomp_read_32, __NR_seccomp_write_32, __NR_seccomp_exit_32, __NR_seccomp_sigreturn_32,
371         0, /* null terminated */                  371         0, /* null terminated */
372 };                                                372 };
373 #endif                                            373 #endif
374                                                   374 
375 int __secure_computing(int this_syscall)          375 int __secure_computing(int this_syscall)
376 {                                                 376 {
377         int mode = current->seccomp.mode;         377         int mode = current->seccomp.mode;
378         int exit_sig = 0;                         378         int exit_sig = 0;
379         int *syscall;                             379         int *syscall;
380         u32 ret;                                  380         u32 ret;
381                                                   381 
382         switch (mode) {                           382         switch (mode) {
383         case SECCOMP_MODE_STRICT:                 383         case SECCOMP_MODE_STRICT:
384                 syscall = mode1_syscalls;         384                 syscall = mode1_syscalls;
385 #ifdef CONFIG_COMPAT                              385 #ifdef CONFIG_COMPAT
386                 if (is_compat_task())             386                 if (is_compat_task())
387                         syscall = mode1_syscal    387                         syscall = mode1_syscalls_32;
388 #endif                                            388 #endif
389                 do {                              389                 do {
390                         if (*syscall == this_s    390                         if (*syscall == this_syscall)
391                                 return 0;         391                                 return 0;
392                 } while (*++syscall);             392                 } while (*++syscall);
393                 exit_sig = SIGKILL;               393                 exit_sig = SIGKILL;
394                 ret = SECCOMP_RET_KILL;           394                 ret = SECCOMP_RET_KILL;
395                 break;                            395                 break;
396 #ifdef CONFIG_SECCOMP_FILTER                      396 #ifdef CONFIG_SECCOMP_FILTER
397         case SECCOMP_MODE_FILTER: {               397         case SECCOMP_MODE_FILTER: {
398                 int data;                         398                 int data;
399                 struct pt_regs *regs = task_pt << 
400                 ret = seccomp_run_filters(this    399                 ret = seccomp_run_filters(this_syscall);
401                 data = ret & SECCOMP_RET_DATA;    400                 data = ret & SECCOMP_RET_DATA;
402                 ret &= SECCOMP_RET_ACTION;        401                 ret &= SECCOMP_RET_ACTION;
403                 switch (ret) {                    402                 switch (ret) {
404                 case SECCOMP_RET_ERRNO:           403                 case SECCOMP_RET_ERRNO:
405                         /* Set the low-order 1    404                         /* Set the low-order 16-bits as a errno. */
406                         syscall_set_return_val !! 405                         syscall_set_return_value(current, task_pt_regs(current),
407                                                   406                                                  -data, 0);
408                         goto skip;                407                         goto skip;
409                 case SECCOMP_RET_TRAP:            408                 case SECCOMP_RET_TRAP:
410                         /* Show the handler th    409                         /* Show the handler the original registers. */
411                         syscall_rollback(curre !! 410                         syscall_rollback(current, task_pt_regs(current));
412                         /* Let the filter pass    411                         /* Let the filter pass back 16 bits of data. */
413                         seccomp_send_sigsys(th    412                         seccomp_send_sigsys(this_syscall, data);
414                         goto skip;                413                         goto skip;
415                 case SECCOMP_RET_TRACE:           414                 case SECCOMP_RET_TRACE:
416                         /* Skip these calls if    415                         /* Skip these calls if there is no tracer. */
417                         if (!ptrace_event_enab !! 416                         if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP))
418                                 syscall_set_re << 
419                                                << 
420                                 goto skip;        417                                 goto skip;
421                         }                      << 
422                         /* Allow the BPF to pr    418                         /* Allow the BPF to provide the event message */
423                         ptrace_event(PTRACE_EV    419                         ptrace_event(PTRACE_EVENT_SECCOMP, data);
424                         /*                        420                         /*
425                          * The delivery of a f    421                          * The delivery of a fatal signal during event
426                          * notification may si    422                          * notification may silently skip tracer notification.
427                          * Terminating the tas    423                          * Terminating the task now avoids executing a system
428                          * call that may not b    424                          * call that may not be intended.
429                          */                       425                          */
430                         if (fatal_signal_pendi    426                         if (fatal_signal_pending(current))
431                                 break;            427                                 break;
432                         if (syscall_get_nr(cur << 
433                                 goto skip;  /* << 
434                                                << 
435                         return 0;                 428                         return 0;
436                 case SECCOMP_RET_ALLOW:           429                 case SECCOMP_RET_ALLOW:
437                         return 0;                 430                         return 0;
438                 case SECCOMP_RET_KILL:            431                 case SECCOMP_RET_KILL:
439                 default:                          432                 default:
440                         break;                    433                         break;
441                 }                                 434                 }
442                 exit_sig = SIGSYS;                435                 exit_sig = SIGSYS;
443                 break;                            436                 break;
444         }                                         437         }
445 #endif                                            438 #endif
446         default:                                  439         default:
447                 BUG();                            440                 BUG();
448         }                                         441         }
449                                                   442 
450 #ifdef SECCOMP_DEBUG                              443 #ifdef SECCOMP_DEBUG
451         dump_stack();                             444         dump_stack();
452 #endif                                            445 #endif
453         audit_seccomp(this_syscall, exit_sig,     446         audit_seccomp(this_syscall, exit_sig, ret);
454         do_exit(exit_sig);                        447         do_exit(exit_sig);
455 #ifdef CONFIG_SECCOMP_FILTER                      448 #ifdef CONFIG_SECCOMP_FILTER
456 skip:                                             449 skip:
457         audit_seccomp(this_syscall, exit_sig,     450         audit_seccomp(this_syscall, exit_sig, ret);
458 #endif                                            451 #endif
459         return -1;                                452         return -1;
460 }                                                 453 }
461                                                   454 
462 long prctl_get_seccomp(void)                      455 long prctl_get_seccomp(void)
463 {                                                 456 {
464         return current->seccomp.mode;             457         return current->seccomp.mode;
465 }                                                 458 }
466                                                   459 
467 /**                                               460 /**
468  * prctl_set_seccomp: configures current->secc    461  * prctl_set_seccomp: configures current->seccomp.mode
469  * @seccomp_mode: requested mode to use           462  * @seccomp_mode: requested mode to use
470  * @filter: optional struct sock_fprog for use    463  * @filter: optional struct sock_fprog for use with SECCOMP_MODE_FILTER
471  *                                                464  *
472  * This function may be called repeatedly with    465  * This function may be called repeatedly with a @seccomp_mode of
473  * SECCOMP_MODE_FILTER to install additional f    466  * SECCOMP_MODE_FILTER to install additional filters.  Every filter
474  * successfully installed will be evaluated (i    467  * successfully installed will be evaluated (in reverse order) for each system
475  * call the task makes.                           468  * call the task makes.
476  *                                                469  *
477  * Once current->seccomp.mode is non-zero, it     470  * Once current->seccomp.mode is non-zero, it may not be changed.
478  *                                                471  *
479  * Returns 0 on success or -EINVAL on failure.    472  * Returns 0 on success or -EINVAL on failure.
480  */                                               473  */
481 long prctl_set_seccomp(unsigned long seccomp_m    474 long prctl_set_seccomp(unsigned long seccomp_mode, char __user *filter)
482 {                                                 475 {
483         long ret = -EINVAL;                       476         long ret = -EINVAL;
484                                                   477 
485         if (current->seccomp.mode &&              478         if (current->seccomp.mode &&
486             current->seccomp.mode != seccomp_m    479             current->seccomp.mode != seccomp_mode)
487                 goto out;                         480                 goto out;
488                                                   481 
489         switch (seccomp_mode) {                   482         switch (seccomp_mode) {
490         case SECCOMP_MODE_STRICT:                 483         case SECCOMP_MODE_STRICT:
491                 ret = 0;                          484                 ret = 0;
492 #ifdef TIF_NOTSC                                  485 #ifdef TIF_NOTSC
493                 disable_TSC();                    486                 disable_TSC();
494 #endif                                            487 #endif
495                 break;                            488                 break;
496 #ifdef CONFIG_SECCOMP_FILTER                      489 #ifdef CONFIG_SECCOMP_FILTER
497         case SECCOMP_MODE_FILTER:                 490         case SECCOMP_MODE_FILTER:
498                 ret = seccomp_attach_user_filt    491                 ret = seccomp_attach_user_filter(filter);
499                 if (ret)                          492                 if (ret)
500                         goto out;                 493                         goto out;
501                 break;                            494                 break;
502 #endif                                            495 #endif
503         default:                                  496         default:
504                 goto out;                         497                 goto out;
505         }                                         498         }
506                                                   499 
507         current->seccomp.mode = seccomp_mode;     500         current->seccomp.mode = seccomp_mode;
508         set_thread_flag(TIF_SECCOMP);             501         set_thread_flag(TIF_SECCOMP);
509 out:                                              502 out:
510         return ret;                               503         return ret;
511 }                                                 504 }
512                                                   505 

This page was automatically generated by LXR 0.3.1 (source).  •  Linux is a registered trademark of Linus Torvalds  •  Contact us