Version:  2.0.40 2.2.26 2.4.37 3.2 3.3 3.4 3.5 3.6 3.7 3.8 3.9 3.10 3.11 3.12 3.13 3.14 3.15 3.16 3.17 3.18

Linux/kernel/seccomp.c

Diff markup

Differences between /kernel/seccomp.c (Version 3.18) and /kernel/seccomp.c (Version 3.6)


  1 /*                                                  1 /*
  2  * linux/kernel/seccomp.c                           2  * linux/kernel/seccomp.c
  3  *                                                  3  *
  4  * Copyright 2004-2005  Andrea Arcangeli <andr      4  * Copyright 2004-2005  Andrea Arcangeli <andrea@cpushare.com>
  5  *                                                  5  *
  6  * Copyright (C) 2012 Google, Inc.                  6  * Copyright (C) 2012 Google, Inc.
  7  * Will Drewry <wad@chromium.org>                   7  * Will Drewry <wad@chromium.org>
  8  *                                                  8  *
  9  * This defines a simple but solid secure-comp      9  * This defines a simple but solid secure-computing facility.
 10  *                                                 10  *
 11  * Mode 1 uses a fixed list of allowed system      11  * Mode 1 uses a fixed list of allowed system calls.
 12  * Mode 2 allows user-defined system call filt     12  * Mode 2 allows user-defined system call filters in the form
 13  *        of Berkeley Packet Filters/Linux Soc     13  *        of Berkeley Packet Filters/Linux Socket Filters.
 14  */                                                14  */
 15                                                    15 
 16 #include <linux/atomic.h>                          16 #include <linux/atomic.h>
 17 #include <linux/audit.h>                           17 #include <linux/audit.h>
 18 #include <linux/compat.h>                          18 #include <linux/compat.h>
 19 #include <linux/sched.h>                           19 #include <linux/sched.h>
 20 #include <linux/seccomp.h>                         20 #include <linux/seccomp.h>
 21 #include <linux/slab.h>                        << 
 22 #include <linux/syscalls.h>                    << 
 23                                                    21 
 24 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER         !!  22 /* #define SECCOMP_DEBUG 1 */
 25 #include <asm/syscall.h>                       << 
 26 #endif                                         << 
 27                                                    23 
 28 #ifdef CONFIG_SECCOMP_FILTER                       24 #ifdef CONFIG_SECCOMP_FILTER
                                                   >>  25 #include <asm/syscall.h>
 29 #include <linux/filter.h>                          26 #include <linux/filter.h>
 30 #include <linux/pid.h>                         << 
 31 #include <linux/ptrace.h>                          27 #include <linux/ptrace.h>
 32 #include <linux/security.h>                        28 #include <linux/security.h>
                                                   >>  29 #include <linux/slab.h>
 33 #include <linux/tracehook.h>                       30 #include <linux/tracehook.h>
 34 #include <linux/uaccess.h>                         31 #include <linux/uaccess.h>
 35                                                    32 
 36 /**                                                33 /**
 37  * struct seccomp_filter - container for secco     34  * struct seccomp_filter - container for seccomp BPF programs
 38  *                                                 35  *
 39  * @usage: reference count to manage the objec     36  * @usage: reference count to manage the object lifetime.
 40  *         get/put helpers should be used when     37  *         get/put helpers should be used when accessing an instance
 41  *         outside of a lifetime-guarded secti     38  *         outside of a lifetime-guarded section.  In general, this
 42  *         is only needed for handling filters     39  *         is only needed for handling filters shared across tasks.
 43  * @prev: points to a previously installed, or     40  * @prev: points to a previously installed, or inherited, filter
 44  * @len: the number of instructions in the pro     41  * @len: the number of instructions in the program
 45  * @insnsi: the BPF program instructions to ev !!  42  * @insns: the BPF program instructions to evaluate
 46  *                                                 43  *
 47  * seccomp_filter objects are organized in a t     44  * seccomp_filter objects are organized in a tree linked via the @prev
 48  * pointer.  For any task, it appears to be a      45  * pointer.  For any task, it appears to be a singly-linked list starting
 49  * with current->seccomp.filter, the most rece     46  * with current->seccomp.filter, the most recently attached or inherited filter.
 50  * However, multiple filters may share a @prev     47  * However, multiple filters may share a @prev node, by way of fork(), which
 51  * results in a unidirectional tree existing i     48  * results in a unidirectional tree existing in memory.  This is similar to
 52  * how namespaces work.                            49  * how namespaces work.
 53  *                                                 50  *
 54  * seccomp_filter objects should never be modi     51  * seccomp_filter objects should never be modified after being attached
 55  * to a task_struct (other than @usage).           52  * to a task_struct (other than @usage).
 56  */                                                53  */
 57 struct seccomp_filter {                            54 struct seccomp_filter {
 58         atomic_t usage;                            55         atomic_t usage;
 59         struct seccomp_filter *prev;               56         struct seccomp_filter *prev;
 60         struct bpf_prog *prog;                 !!  57         unsigned short len;  /* Instruction count */
                                                   >>  58         struct sock_filter insns[];
 61 };                                                 59 };
 62                                                    60 
 63 /* Limit any path through the tree to 256KB wo     61 /* Limit any path through the tree to 256KB worth of instructions. */
 64 #define MAX_INSNS_PER_PATH ((1 << 18) / sizeof     62 #define MAX_INSNS_PER_PATH ((1 << 18) / sizeof(struct sock_filter))
 65                                                    63 
 66 /*                                             !!  64 /**
                                                   >>  65  * get_u32 - returns a u32 offset into data
                                                   >>  66  * @data: a unsigned 64 bit value
                                                   >>  67  * @index: 0 or 1 to return the first or second 32-bits
                                                   >>  68  *
                                                   >>  69  * This inline exists to hide the length of unsigned long.  If a 32-bit
                                                   >>  70  * unsigned long is passed in, it will be extended and the top 32-bits will be
                                                   >>  71  * 0. If it is a 64-bit unsigned long, then whatever data is resident will be
                                                   >>  72  * properly returned.
                                                   >>  73  *
 67  * Endianness is explicitly ignored and left f     74  * Endianness is explicitly ignored and left for BPF program authors to manage
 68  * as per the specific architecture.               75  * as per the specific architecture.
 69  */                                                76  */
 70 static void populate_seccomp_data(struct secco !!  77 static inline u32 get_u32(u64 data, int index)
                                                   >>  78 {
                                                   >>  79         return ((u32 *)&data)[index];
                                                   >>  80 }
                                                   >>  81 
                                                   >>  82 /* Helper for bpf_load below. */
                                                   >>  83 #define BPF_DATA(_name) offsetof(struct seccomp_data, _name)
                                                   >>  84 /**
                                                   >>  85  * bpf_load: checks and returns a pointer to the requested offset
                                                   >>  86  * @off: offset into struct seccomp_data to load from
                                                   >>  87  *
                                                   >>  88  * Returns the requested 32-bits of data.
                                                   >>  89  * seccomp_check_filter() should assure that @off is 32-bit aligned
                                                   >>  90  * and not out of bounds.  Failure to do so is a BUG.
                                                   >>  91  */
                                                   >>  92 u32 seccomp_bpf_load(int off)
 71 {                                                  93 {
 72         struct task_struct *task = current;    !!  94         struct pt_regs *regs = task_pt_regs(current);
 73         struct pt_regs *regs = task_pt_regs(ta !!  95         if (off == BPF_DATA(nr))
 74         unsigned long args[6];                 !!  96                 return syscall_get_nr(current, regs);
 75                                                !!  97         if (off == BPF_DATA(arch))
 76         sd->nr = syscall_get_nr(task, regs);   !!  98                 return syscall_get_arch(current, regs);
 77         sd->arch = syscall_get_arch();         !!  99         if (off >= BPF_DATA(args[0]) && off < BPF_DATA(args[6])) {
 78         syscall_get_arguments(task, regs, 0, 6 !! 100                 unsigned long value;
 79         sd->args[0] = args[0];                 !! 101                 int arg = (off - BPF_DATA(args[0])) / sizeof(u64);
 80         sd->args[1] = args[1];                 !! 102                 int index = !!(off % sizeof(u64));
 81         sd->args[2] = args[2];                 !! 103                 syscall_get_arguments(current, regs, arg, 1, &value);
 82         sd->args[3] = args[3];                 !! 104                 return get_u32(value, index);
 83         sd->args[4] = args[4];                 !! 105         }
 84         sd->args[5] = args[5];                 !! 106         if (off == BPF_DATA(instruction_pointer))
 85         sd->instruction_pointer = KSTK_EIP(tas !! 107                 return get_u32(KSTK_EIP(current), 0);
                                                   >> 108         if (off == BPF_DATA(instruction_pointer) + sizeof(u32))
                                                   >> 109                 return get_u32(KSTK_EIP(current), 1);
                                                   >> 110         /* seccomp_check_filter should make this impossible. */
                                                   >> 111         BUG();
 86 }                                                 112 }
 87                                                   113 
 88 /**                                               114 /**
 89  *      seccomp_check_filter - verify seccomp     115  *      seccomp_check_filter - verify seccomp filter code
 90  *      @filter: filter to verify                 116  *      @filter: filter to verify
 91  *      @flen: length of filter                   117  *      @flen: length of filter
 92  *                                                118  *
 93  * Takes a previously checked filter (by bpf_c !! 119  * Takes a previously checked filter (by sk_chk_filter) and
 94  * redirects all filter code that loads struct    120  * redirects all filter code that loads struct sk_buff data
 95  * and related data through seccomp_bpf_load.     121  * and related data through seccomp_bpf_load.  It also
 96  * enforces length and alignment checking of t    122  * enforces length and alignment checking of those loads.
 97  *                                                123  *
 98  * Returns 0 if the rule set is legal or -EINV    124  * Returns 0 if the rule set is legal or -EINVAL if not.
 99  */                                               125  */
100 static int seccomp_check_filter(struct sock_fi    126 static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen)
101 {                                                 127 {
102         int pc;                                   128         int pc;
103         for (pc = 0; pc < flen; pc++) {           129         for (pc = 0; pc < flen; pc++) {
104                 struct sock_filter *ftest = &f    130                 struct sock_filter *ftest = &filter[pc];
105                 u16 code = ftest->code;           131                 u16 code = ftest->code;
106                 u32 k = ftest->k;                 132                 u32 k = ftest->k;
107                                                   133 
108                 switch (code) {                   134                 switch (code) {
109                 case BPF_LD | BPF_W | BPF_ABS: !! 135                 case BPF_S_LD_W_ABS:
110                         ftest->code = BPF_LDX  !! 136                         ftest->code = BPF_S_ANC_SECCOMP_LD_W;
111                         /* 32-bit aligned and     137                         /* 32-bit aligned and not out of bounds. */
112                         if (k >= sizeof(struct    138                         if (k >= sizeof(struct seccomp_data) || k & 3)
113                                 return -EINVAL    139                                 return -EINVAL;
114                         continue;                 140                         continue;
115                 case BPF_LD | BPF_W | BPF_LEN: !! 141                 case BPF_S_LD_W_LEN:
116                         ftest->code = BPF_LD | !! 142                         ftest->code = BPF_S_LD_IMM;
117                         ftest->k = sizeof(stru    143                         ftest->k = sizeof(struct seccomp_data);
118                         continue;                 144                         continue;
119                 case BPF_LDX | BPF_W | BPF_LEN !! 145                 case BPF_S_LDX_W_LEN:
120                         ftest->code = BPF_LDX  !! 146                         ftest->code = BPF_S_LDX_IMM;
121                         ftest->k = sizeof(stru    147                         ftest->k = sizeof(struct seccomp_data);
122                         continue;                 148                         continue;
123                 /* Explicitly include allowed     149                 /* Explicitly include allowed calls. */
124                 case BPF_RET | BPF_K:          !! 150                 case BPF_S_RET_K:
125                 case BPF_RET | BPF_A:          !! 151                 case BPF_S_RET_A:
126                 case BPF_ALU | BPF_ADD | BPF_K !! 152                 case BPF_S_ALU_ADD_K:
127                 case BPF_ALU | BPF_ADD | BPF_X !! 153                 case BPF_S_ALU_ADD_X:
128                 case BPF_ALU | BPF_SUB | BPF_K !! 154                 case BPF_S_ALU_SUB_K:
129                 case BPF_ALU | BPF_SUB | BPF_X !! 155                 case BPF_S_ALU_SUB_X:
130                 case BPF_ALU | BPF_MUL | BPF_K !! 156                 case BPF_S_ALU_MUL_K:
131                 case BPF_ALU | BPF_MUL | BPF_X !! 157                 case BPF_S_ALU_MUL_X:
132                 case BPF_ALU | BPF_DIV | BPF_K !! 158                 case BPF_S_ALU_DIV_X:
133                 case BPF_ALU | BPF_DIV | BPF_X !! 159                 case BPF_S_ALU_AND_K:
134                 case BPF_ALU | BPF_AND | BPF_K !! 160                 case BPF_S_ALU_AND_X:
135                 case BPF_ALU | BPF_AND | BPF_X !! 161                 case BPF_S_ALU_OR_K:
136                 case BPF_ALU | BPF_OR | BPF_K: !! 162                 case BPF_S_ALU_OR_X:
137                 case BPF_ALU | BPF_OR | BPF_X: !! 163                 case BPF_S_ALU_LSH_K:
138                 case BPF_ALU | BPF_XOR | BPF_K !! 164                 case BPF_S_ALU_LSH_X:
139                 case BPF_ALU | BPF_XOR | BPF_X !! 165                 case BPF_S_ALU_RSH_K:
140                 case BPF_ALU | BPF_LSH | BPF_K !! 166                 case BPF_S_ALU_RSH_X:
141                 case BPF_ALU | BPF_LSH | BPF_X !! 167                 case BPF_S_ALU_NEG:
142                 case BPF_ALU | BPF_RSH | BPF_K !! 168                 case BPF_S_LD_IMM:
143                 case BPF_ALU | BPF_RSH | BPF_X !! 169                 case BPF_S_LDX_IMM:
144                 case BPF_ALU | BPF_NEG:        !! 170                 case BPF_S_MISC_TAX:
145                 case BPF_LD | BPF_IMM:         !! 171                 case BPF_S_MISC_TXA:
146                 case BPF_LDX | BPF_IMM:        !! 172                 case BPF_S_ALU_DIV_K:
147                 case BPF_MISC | BPF_TAX:       !! 173                 case BPF_S_LD_MEM:
148                 case BPF_MISC | BPF_TXA:       !! 174                 case BPF_S_LDX_MEM:
149                 case BPF_LD | BPF_MEM:         !! 175                 case BPF_S_ST:
150                 case BPF_LDX | BPF_MEM:        !! 176                 case BPF_S_STX:
151                 case BPF_ST:                   !! 177                 case BPF_S_JMP_JA:
152                 case BPF_STX:                  !! 178                 case BPF_S_JMP_JEQ_K:
153                 case BPF_JMP | BPF_JA:         !! 179                 case BPF_S_JMP_JEQ_X:
154                 case BPF_JMP | BPF_JEQ | BPF_K !! 180                 case BPF_S_JMP_JGE_K:
155                 case BPF_JMP | BPF_JEQ | BPF_X !! 181                 case BPF_S_JMP_JGE_X:
156                 case BPF_JMP | BPF_JGE | BPF_K !! 182                 case BPF_S_JMP_JGT_K:
157                 case BPF_JMP | BPF_JGE | BPF_X !! 183                 case BPF_S_JMP_JGT_X:
158                 case BPF_JMP | BPF_JGT | BPF_K !! 184                 case BPF_S_JMP_JSET_K:
159                 case BPF_JMP | BPF_JGT | BPF_X !! 185                 case BPF_S_JMP_JSET_X:
160                 case BPF_JMP | BPF_JSET | BPF_ << 
161                 case BPF_JMP | BPF_JSET | BPF_ << 
162                         continue;                 186                         continue;
163                 default:                          187                 default:
164                         return -EINVAL;           188                         return -EINVAL;
165                 }                                 189                 }
166         }                                         190         }
167         return 0;                                 191         return 0;
168 }                                                 192 }
169                                                   193 
170 /**                                               194 /**
171  * seccomp_run_filters - evaluates all seccomp    195  * seccomp_run_filters - evaluates all seccomp filters against @syscall
172  * @syscall: number of the current system call    196  * @syscall: number of the current system call
173  *                                                197  *
174  * Returns valid seccomp BPF response codes.      198  * Returns valid seccomp BPF response codes.
175  */                                               199  */
176 static u32 seccomp_run_filters(struct seccomp_ !! 200 static u32 seccomp_run_filters(int syscall)
177 {                                                 201 {
178         struct seccomp_filter *f = ACCESS_ONCE !! 202         struct seccomp_filter *f;
179         struct seccomp_data sd_local;          << 
180         u32 ret = SECCOMP_RET_ALLOW;              203         u32 ret = SECCOMP_RET_ALLOW;
181                                                   204 
182         /* Ensure unexpected behavior doesn't     205         /* Ensure unexpected behavior doesn't result in failing open. */
183         if (unlikely(WARN_ON(f == NULL)))      !! 206         if (WARN_ON(current->seccomp.filter == NULL))
184                 return SECCOMP_RET_KILL;          207                 return SECCOMP_RET_KILL;
185                                                   208 
186         /* Make sure cross-thread synced filte << 
187         smp_read_barrier_depends();            << 
188                                                << 
189         if (!sd) {                             << 
190                 populate_seccomp_data(&sd_loca << 
191                 sd = &sd_local;                << 
192         }                                      << 
193                                                << 
194         /*                                        209         /*
195          * All filters in the list are evaluat    210          * All filters in the list are evaluated and the lowest BPF return
196          * value always takes priority (ignori    211          * value always takes priority (ignoring the DATA).
197          */                                       212          */
198         for (; f; f = f->prev) {               !! 213         for (f = current->seccomp.filter; f; f = f->prev) {
199                 u32 cur_ret = BPF_PROG_RUN(f-> !! 214                 u32 cur_ret = sk_run_filter(NULL, f->insns);
200                                                << 
201                 if ((cur_ret & SECCOMP_RET_ACT    215                 if ((cur_ret & SECCOMP_RET_ACTION) < (ret & SECCOMP_RET_ACTION))
202                         ret = cur_ret;            216                         ret = cur_ret;
203         }                                         217         }
204         return ret;                               218         return ret;
205 }                                                 219 }
206 #endif /* CONFIG_SECCOMP_FILTER */             << 
207                                                << 
208 static inline bool seccomp_may_assign_mode(uns << 
209 {                                              << 
210         assert_spin_locked(&current->sighand-> << 
211                                                << 
212         if (current->seccomp.mode && current-> << 
213                 return false;                  << 
214                                                << 
215         return true;                           << 
216 }                                              << 
217                                                << 
218 static inline void seccomp_assign_mode(struct  << 
219                                        unsigne << 
220 {                                              << 
221         assert_spin_locked(&task->sighand->sig << 
222                                                << 
223         task->seccomp.mode = seccomp_mode;     << 
224         /*                                     << 
225          * Make sure TIF_SECCOMP cannot be set << 
226          * filter) is set.                     << 
227          */                                    << 
228         smp_mb__before_atomic();               << 
229         set_tsk_thread_flag(task, TIF_SECCOMP) << 
230 }                                              << 
231                                                << 
232 #ifdef CONFIG_SECCOMP_FILTER                   << 
233 /* Returns 1 if the parent is an ancestor of t << 
234 static int is_ancestor(struct seccomp_filter * << 
235                        struct seccomp_filter * << 
236 {                                              << 
237         /* NULL is the root ancestor. */       << 
238         if (parent == NULL)                    << 
239                 return 1;                      << 
240         for (; child; child = child->prev)     << 
241                 if (child == parent)           << 
242                         return 1;              << 
243         return 0;                              << 
244 }                                              << 
245                                                   220 
246 /**                                               221 /**
247  * seccomp_can_sync_threads: checks if all thr !! 222  * seccomp_attach_filter: Attaches a seccomp filter to current.
248  *                                             << 
249  * Expects sighand and cred_guard_mutex locks  << 
250  *                                             << 
251  * Returns 0 on success, -ve on error, or the  << 
252  * either not in the correct seccomp mode or i << 
253  * seccomp filter.                             << 
254  */                                            << 
255 static inline pid_t seccomp_can_sync_threads(v << 
256 {                                              << 
257         struct task_struct *thread, *caller;   << 
258                                                << 
259         BUG_ON(!mutex_is_locked(&current->sign << 
260         assert_spin_locked(&current->sighand-> << 
261                                                << 
262         /* Validate all threads being eligible << 
263         caller = current;                      << 
264         for_each_thread(caller, thread) {      << 
265                 pid_t failed;                  << 
266                                                << 
267                 /* Skip current, since it is i << 
268                 if (thread == caller)          << 
269                         continue;              << 
270                                                << 
271                 if (thread->seccomp.mode == SE << 
272                     (thread->seccomp.mode == S << 
273                      is_ancestor(thread->secco << 
274                                  caller->secco << 
275                         continue;              << 
276                                                << 
277                 /* Return the first thread tha << 
278                 failed = task_pid_vnr(thread); << 
279                 /* If the pid cannot be resolv << 
280                 if (unlikely(WARN_ON(failed == << 
281                         failed = -ESRCH;       << 
282                 return failed;                 << 
283         }                                      << 
284                                                << 
285         return 0;                              << 
286 }                                              << 
287                                                << 
288 /**                                            << 
289  * seccomp_sync_threads: sets all threads to u << 
290  *                                             << 
291  * Expects sighand and cred_guard_mutex locks  << 
292  * seccomp_can_sync_threads() to have returned << 
293  * without dropping the locks.                 << 
294  *                                             << 
295  */                                            << 
296 static inline void seccomp_sync_threads(void)  << 
297 {                                              << 
298         struct task_struct *thread, *caller;   << 
299                                                << 
300         BUG_ON(!mutex_is_locked(&current->sign << 
301         assert_spin_locked(&current->sighand-> << 
302                                                << 
303         /* Synchronize all threads. */         << 
304         caller = current;                      << 
305         for_each_thread(caller, thread) {      << 
306                 /* Skip current, since it need << 
307                 if (thread == caller)          << 
308                         continue;              << 
309                                                << 
310                 /* Get a task reference for th << 
311                 get_seccomp_filter(caller);    << 
312                 /*                             << 
313                  * Drop the task reference to  << 
314                  * current's path will hold a  << 
315                  * allows a put before the ass << 
316                  */                            << 
317                 put_seccomp_filter(thread);    << 
318                 smp_store_release(&thread->sec << 
319                                   caller->secc << 
320                 /*                             << 
321                  * Opt the other thread into s << 
322                  * As threads are considered t << 
323                  * equivalent (see ptrace_may_ << 
324                  * allow one thread to transit << 
325                  */                            << 
326                 if (thread->seccomp.mode == SE << 
327                         /*                     << 
328                          * Don't let an unpriv << 
329                          * the no_new_privs re << 
330                          * a thread that sets  << 
331                          * then dies.          << 
332                          */                    << 
333                         if (task_no_new_privs( << 
334                                 task_set_no_ne << 
335                                                << 
336                         seccomp_assign_mode(th << 
337                 }                              << 
338         }                                      << 
339 }                                              << 
340                                                << 
341 /**                                            << 
342  * seccomp_prepare_filter: Prepares a seccomp  << 
343  * @fprog: BPF program to install                 223  * @fprog: BPF program to install
344  *                                                224  *
345  * Returns filter on success or an ERR_PTR on  !! 225  * Returns 0 on success or an errno on failure.
346  */                                               226  */
347 static struct seccomp_filter *seccomp_prepare_ !! 227 static long seccomp_attach_filter(struct sock_fprog *fprog)
348 {                                                 228 {
349         struct seccomp_filter *filter;            229         struct seccomp_filter *filter;
350         unsigned long fp_size;                 !! 230         unsigned long fp_size = fprog->len * sizeof(struct sock_filter);
351         struct sock_filter *fp;                !! 231         unsigned long total_insns = fprog->len;
352         int new_len;                           << 
353         long ret;                                 232         long ret;
354                                                   233 
355         if (fprog->len == 0 || fprog->len > BP    234         if (fprog->len == 0 || fprog->len > BPF_MAXINSNS)
356                 return ERR_PTR(-EINVAL);       !! 235                 return -EINVAL;
357         BUG_ON(INT_MAX / fprog->len < sizeof(s !! 236 
358         fp_size = fprog->len * sizeof(struct s !! 237         for (filter = current->seccomp.filter; filter; filter = filter->prev)
                                                   >> 238                 total_insns += filter->len + 4;  /* include a 4 instr penalty */
                                                   >> 239         if (total_insns > MAX_INSNS_PER_PATH)
                                                   >> 240                 return -ENOMEM;
359                                                   241 
360         /*                                        242         /*
361          * Installing a seccomp filter require !! 243          * Installing a seccomp filter requires that the task have
362          * CAP_SYS_ADMIN in its namespace or b    244          * CAP_SYS_ADMIN in its namespace or be running with no_new_privs.
363          * This avoids scenarios where unprivi    245          * This avoids scenarios where unprivileged tasks can affect the
364          * behavior of privileged children.       246          * behavior of privileged children.
365          */                                       247          */
366         if (!task_no_new_privs(current) &&     !! 248         if (!current->no_new_privs &&
367             security_capable_noaudit(current_c    249             security_capable_noaudit(current_cred(), current_user_ns(),
368                                      CAP_SYS_A    250                                      CAP_SYS_ADMIN) != 0)
369                 return ERR_PTR(-EACCES);       !! 251                 return -EACCES;
370                                                   252 
371         fp = kzalloc(fp_size, GFP_KERNEL|__GFP !! 253         /* Allocate a new seccomp_filter */
372         if (!fp)                               !! 254         filter = kzalloc(sizeof(struct seccomp_filter) + fp_size,
373                 return ERR_PTR(-ENOMEM);       !! 255                          GFP_KERNEL|__GFP_NOWARN);
                                                   >> 256         if (!filter)
                                                   >> 257                 return -ENOMEM;
                                                   >> 258         atomic_set(&filter->usage, 1);
                                                   >> 259         filter->len = fprog->len;
374                                                   260 
375         /* Copy the instructions from fprog. *    261         /* Copy the instructions from fprog. */
376         ret = -EFAULT;                            262         ret = -EFAULT;
377         if (copy_from_user(fp, fprog->filter,  !! 263         if (copy_from_user(filter->insns, fprog->filter, fp_size))
378                 goto free_prog;                !! 264                 goto fail;
379                                                   265 
380         /* Check and rewrite the fprog via the    266         /* Check and rewrite the fprog via the skb checker */
381         ret = bpf_check_classic(fp, fprog->len !! 267         ret = sk_chk_filter(filter->insns, filter->len);
382         if (ret)                                  268         if (ret)
383                 goto free_prog;                !! 269                 goto fail;
384                                                   270 
385         /* Check and rewrite the fprog for sec    271         /* Check and rewrite the fprog for seccomp use */
386         ret = seccomp_check_filter(fp, fprog-> !! 272         ret = seccomp_check_filter(filter->insns, filter->len);
387         if (ret)                               << 
388                 goto free_prog;                << 
389                                                << 
390         /* Convert 'sock_filter' insns to 'bpf << 
391         ret = bpf_convert_filter(fp, fprog->le << 
392         if (ret)                                  273         if (ret)
393                 goto free_prog;                !! 274                 goto fail;
394                                                << 
395         /* Allocate a new seccomp_filter */    << 
396         ret = -ENOMEM;                         << 
397         filter = kzalloc(sizeof(struct seccomp << 
398                          GFP_KERNEL|__GFP_NOWA << 
399         if (!filter)                           << 
400                 goto free_prog;                << 
401                                                << 
402         filter->prog = bpf_prog_alloc(bpf_prog << 
403         if (!filter->prog)                     << 
404                 goto free_filter;              << 
405                                                << 
406         ret = bpf_convert_filter(fp, fprog->le << 
407         if (ret)                               << 
408                 goto free_filter_prog;         << 
409                                                << 
410         kfree(fp);                             << 
411         atomic_set(&filter->usage, 1);         << 
412         filter->prog->len = new_len;           << 
413                                                << 
414         bpf_prog_select_runtime(filter->prog); << 
415                                                << 
416         return filter;                         << 
417                                                   275 
418 free_filter_prog:                              !! 276         /*
419         __bpf_prog_free(filter->prog);         !! 277          * If there is an existing filter, make it the prev and don't drop its
420 free_filter:                                   !! 278          * task reference.
                                                   >> 279          */
                                                   >> 280         filter->prev = current->seccomp.filter;
                                                   >> 281         current->seccomp.filter = filter;
                                                   >> 282         return 0;
                                                   >> 283 fail:
421         kfree(filter);                            284         kfree(filter);
422 free_prog:                                     !! 285         return ret;
423         kfree(fp);                             << 
424         return ERR_PTR(ret);                   << 
425 }                                                 286 }
426                                                   287 
427 /**                                               288 /**
428  * seccomp_prepare_user_filter - prepares a us !! 289  * seccomp_attach_user_filter - attaches a user-supplied sock_fprog
429  * @user_filter: pointer to the user data cont    290  * @user_filter: pointer to the user data containing a sock_fprog.
430  *                                                291  *
431  * Returns 0 on success and non-zero otherwise    292  * Returns 0 on success and non-zero otherwise.
432  */                                               293  */
433 static struct seccomp_filter *                 !! 294 long seccomp_attach_user_filter(char __user *user_filter)
434 seccomp_prepare_user_filter(const char __user  << 
435 {                                                 295 {
436         struct sock_fprog fprog;                  296         struct sock_fprog fprog;
437         struct seccomp_filter *filter = ERR_PT !! 297         long ret = -EFAULT;
438                                                   298 
439 #ifdef CONFIG_COMPAT                              299 #ifdef CONFIG_COMPAT
440         if (is_compat_task()) {                   300         if (is_compat_task()) {
441                 struct compat_sock_fprog fprog    301                 struct compat_sock_fprog fprog32;
442                 if (copy_from_user(&fprog32, u    302                 if (copy_from_user(&fprog32, user_filter, sizeof(fprog32)))
443                         goto out;                 303                         goto out;
444                 fprog.len = fprog32.len;          304                 fprog.len = fprog32.len;
445                 fprog.filter = compat_ptr(fpro    305                 fprog.filter = compat_ptr(fprog32.filter);
446         } else /* falls through to the if belo    306         } else /* falls through to the if below. */
447 #endif                                            307 #endif
448         if (copy_from_user(&fprog, user_filter    308         if (copy_from_user(&fprog, user_filter, sizeof(fprog)))
449                 goto out;                         309                 goto out;
450         filter = seccomp_prepare_filter(&fprog !! 310         ret = seccomp_attach_filter(&fprog);
451 out:                                              311 out:
452         return filter;                         !! 312         return ret;
453 }                                              << 
454                                                << 
455 /**                                            << 
456  * seccomp_attach_filter: validate and attach  << 
457  * @flags:  flags to change filter behavior    << 
458  * @filter: seccomp filter to add to the curre << 
459  *                                             << 
460  * Caller must be holding current->sighand->si << 
461  *                                             << 
462  * Returns 0 on success, -ve on error.         << 
463  */                                            << 
464 static long seccomp_attach_filter(unsigned int << 
465                                   struct secco << 
466 {                                              << 
467         unsigned long total_insns;             << 
468         struct seccomp_filter *walker;         << 
469                                                << 
470         assert_spin_locked(&current->sighand-> << 
471                                                << 
472         /* Validate resulting filter length. * << 
473         total_insns = filter->prog->len;       << 
474         for (walker = current->seccomp.filter; << 
475                 total_insns += walker->prog->l << 
476         if (total_insns > MAX_INSNS_PER_PATH)  << 
477                 return -ENOMEM;                << 
478                                                << 
479         /* If thread sync has been requested,  << 
480         if (flags & SECCOMP_FILTER_FLAG_TSYNC) << 
481                 int ret;                       << 
482                                                << 
483                 ret = seccomp_can_sync_threads << 
484                 if (ret)                       << 
485                         return ret;            << 
486         }                                      << 
487                                                << 
488         /*                                     << 
489          * If there is an existing filter, mak << 
490          * task reference.                     << 
491          */                                    << 
492         filter->prev = current->seccomp.filter << 
493         current->seccomp.filter = filter;      << 
494                                                << 
495         /* Now that the new filter is in place << 
496         if (flags & SECCOMP_FILTER_FLAG_TSYNC) << 
497                 seccomp_sync_threads();        << 
498                                                << 
499         return 0;                              << 
500 }                                                 313 }
501                                                   314 
502 /* get_seccomp_filter - increments the referen    315 /* get_seccomp_filter - increments the reference count of the filter on @tsk */
503 void get_seccomp_filter(struct task_struct *ts    316 void get_seccomp_filter(struct task_struct *tsk)
504 {                                                 317 {
505         struct seccomp_filter *orig = tsk->sec    318         struct seccomp_filter *orig = tsk->seccomp.filter;
506         if (!orig)                                319         if (!orig)
507                 return;                           320                 return;
508         /* Reference count is bounded by the n    321         /* Reference count is bounded by the number of total processes. */
509         atomic_inc(&orig->usage);                 322         atomic_inc(&orig->usage);
510 }                                                 323 }
511                                                   324 
512 static inline void seccomp_filter_free(struct  << 
513 {                                              << 
514         if (filter) {                          << 
515                 bpf_prog_free(filter->prog);   << 
516                 kfree(filter);                 << 
517         }                                      << 
518 }                                              << 
519                                                << 
520 /* put_seccomp_filter - decrements the ref cou    325 /* put_seccomp_filter - decrements the ref count of tsk->seccomp.filter */
521 void put_seccomp_filter(struct task_struct *ts    326 void put_seccomp_filter(struct task_struct *tsk)
522 {                                                 327 {
523         struct seccomp_filter *orig = tsk->sec    328         struct seccomp_filter *orig = tsk->seccomp.filter;
524         /* Clean up single-reference branches     329         /* Clean up single-reference branches iteratively. */
525         while (orig && atomic_dec_and_test(&or    330         while (orig && atomic_dec_and_test(&orig->usage)) {
526                 struct seccomp_filter *freeme     331                 struct seccomp_filter *freeme = orig;
527                 orig = orig->prev;                332                 orig = orig->prev;
528                 seccomp_filter_free(freeme);   !! 333                 kfree(freeme);
529         }                                         334         }
530 }                                                 335 }
531                                                   336 
532 /**                                               337 /**
533  * seccomp_send_sigsys - signals the task to a    338  * seccomp_send_sigsys - signals the task to allow in-process syscall emulation
534  * @syscall: syscall number to send to userlan    339  * @syscall: syscall number to send to userland
535  * @reason: filter-supplied reason code to sen    340  * @reason: filter-supplied reason code to send to userland (via si_errno)
536  *                                                341  *
537  * Forces a SIGSYS with a code of SYS_SECCOMP     342  * Forces a SIGSYS with a code of SYS_SECCOMP and related sigsys info.
538  */                                               343  */
539 static void seccomp_send_sigsys(int syscall, i    344 static void seccomp_send_sigsys(int syscall, int reason)
540 {                                                 345 {
541         struct siginfo info;                      346         struct siginfo info;
542         memset(&info, 0, sizeof(info));           347         memset(&info, 0, sizeof(info));
543         info.si_signo = SIGSYS;                   348         info.si_signo = SIGSYS;
544         info.si_code = SYS_SECCOMP;               349         info.si_code = SYS_SECCOMP;
545         info.si_call_addr = (void __user *)KST    350         info.si_call_addr = (void __user *)KSTK_EIP(current);
546         info.si_errno = reason;                   351         info.si_errno = reason;
547         info.si_arch = syscall_get_arch();     !! 352         info.si_arch = syscall_get_arch(current, task_pt_regs(current));
548         info.si_syscall = syscall;                353         info.si_syscall = syscall;
549         force_sig_info(SIGSYS, &info, current)    354         force_sig_info(SIGSYS, &info, current);
550 }                                                 355 }
551 #endif  /* CONFIG_SECCOMP_FILTER */               356 #endif  /* CONFIG_SECCOMP_FILTER */
552                                                   357 
553 /*                                                358 /*
554  * Secure computing mode 1 allows only read/wr    359  * Secure computing mode 1 allows only read/write/exit/sigreturn.
555  * To be fully secure this must be combined wi    360  * To be fully secure this must be combined with rlimit
556  * to limit the stack allocations too.            361  * to limit the stack allocations too.
557  */                                               362  */
558 static int mode1_syscalls[] = {                   363 static int mode1_syscalls[] = {
559         __NR_seccomp_read, __NR_seccomp_write,    364         __NR_seccomp_read, __NR_seccomp_write, __NR_seccomp_exit, __NR_seccomp_sigreturn,
560         0, /* null terminated */                  365         0, /* null terminated */
561 };                                                366 };
562                                                   367 
563 #ifdef CONFIG_COMPAT                              368 #ifdef CONFIG_COMPAT
564 static int mode1_syscalls_32[] = {                369 static int mode1_syscalls_32[] = {
565         __NR_seccomp_read_32, __NR_seccomp_wri    370         __NR_seccomp_read_32, __NR_seccomp_write_32, __NR_seccomp_exit_32, __NR_seccomp_sigreturn_32,
566         0, /* null terminated */                  371         0, /* null terminated */
567 };                                                372 };
568 #endif                                            373 #endif
569                                                   374 
570 static void __secure_computing_strict(int this !! 375 int __secure_computing(int this_syscall)
571 {                                              << 
572         int *syscall_whitelist = mode1_syscall << 
573 #ifdef CONFIG_COMPAT                           << 
574         if (is_compat_task())                  << 
575                 syscall_whitelist = mode1_sysc << 
576 #endif                                         << 
577         do {                                   << 
578                 if (*syscall_whitelist == this << 
579                         return;                << 
580         } while (*++syscall_whitelist);        << 
581                                                << 
582 #ifdef SECCOMP_DEBUG                           << 
583         dump_stack();                          << 
584 #endif                                         << 
585         audit_seccomp(this_syscall, SIGKILL, S << 
586         do_exit(SIGKILL);                      << 
587 }                                              << 
588                                                << 
589 #ifndef CONFIG_HAVE_ARCH_SECCOMP_FILTER        << 
590 void secure_computing_strict(int this_syscall) << 
591 {                                                 376 {
592         int mode = current->seccomp.mode;         377         int mode = current->seccomp.mode;
593                                                !! 378         int exit_sig = 0;
594         if (mode == 0)                         !! 379         int *syscall;
595                 return;                        !! 380         u32 ret;
596         else if (mode == SECCOMP_MODE_STRICT)  << 
597                 __secure_computing_strict(this << 
598         else                                   << 
599                 BUG();                         << 
600 }                                              << 
601 #else                                          << 
602 int __secure_computing(void)                   << 
603 {                                              << 
604         u32 phase1_result = seccomp_phase1(NUL << 
605                                                << 
606         if (likely(phase1_result == SECCOMP_PH << 
607                 return 0;                      << 
608         else if (likely(phase1_result == SECCO << 
609                 return -1;                     << 
610         else                                   << 
611                 return seccomp_phase2(phase1_r << 
612 }                                              << 
613                                                << 
614 #ifdef CONFIG_SECCOMP_FILTER                   << 
615 static u32 __seccomp_phase1_filter(int this_sy << 
616 {                                              << 
617         u32 filter_ret, action;                << 
618         int data;                              << 
619                                                << 
620         /*                                     << 
621          * Make sure that any changes to mode  << 
622          * been seen after TIF_SECCOMP was see << 
623          */                                    << 
624         rmb();                                 << 
625                                                << 
626         filter_ret = seccomp_run_filters(sd);  << 
627         data = filter_ret & SECCOMP_RET_DATA;  << 
628         action = filter_ret & SECCOMP_RET_ACTI << 
629                                                << 
630         switch (action) {                      << 
631         case SECCOMP_RET_ERRNO:                << 
632                 /* Set the low-order 16-bits a << 
633                 syscall_set_return_value(curre << 
634                                          -data << 
635                 goto skip;                     << 
636                                                << 
637         case SECCOMP_RET_TRAP:                 << 
638                 /* Show the handler the origin << 
639                 syscall_rollback(current, task << 
640                 /* Let the filter pass back 16 << 
641                 seccomp_send_sigsys(this_sysca << 
642                 goto skip;                     << 
643                                                << 
644         case SECCOMP_RET_TRACE:                << 
645                 return filter_ret;  /* Save th << 
646                                                << 
647         case SECCOMP_RET_ALLOW:                << 
648                 return SECCOMP_PHASE1_OK;      << 
649                                                << 
650         case SECCOMP_RET_KILL:                 << 
651         default:                               << 
652                 audit_seccomp(this_syscall, SI << 
653                 do_exit(SIGSYS);               << 
654         }                                      << 
655                                                << 
656         unreachable();                         << 
657                                                << 
658 skip:                                          << 
659         audit_seccomp(this_syscall, 0, action) << 
660         return SECCOMP_PHASE1_SKIP;            << 
661 }                                              << 
662 #endif                                         << 
663                                                << 
664 /**                                            << 
665  * seccomp_phase1() - run fast path seccomp ch << 
666  * @arg sd: The seccomp_data or NULL           << 
667  *                                             << 
668  * This only reads pt_regs via the syscall_xyz << 
669  * it will make to pt_regs is via syscall_set_ << 
670  * only do that if it returns SECCOMP_PHASE1_S << 
671  *                                             << 
672  * If sd is provided, it will not read pt_regs << 
673  *                                             << 
674  * It may also call do_exit or force a signal; << 
675  * safe.                                       << 
676  *                                             << 
677  * If it returns SECCOMP_PHASE1_OK, the syscal << 
678  * be processed normally.                      << 
679  *                                             << 
680  * If it returns SECCOMP_PHASE1_SKIP, then the << 
681  * invoked.  In this case, seccomp_phase1 will << 
682  * using syscall_set_return_value.             << 
683  *                                             << 
684  * If it returns anything else, then the retur << 
685  * to seccomp_phase2 from a context in which p << 
686  */                                            << 
687 u32 seccomp_phase1(struct seccomp_data *sd)    << 
688 {                                              << 
689         int mode = current->seccomp.mode;      << 
690         int this_syscall = sd ? sd->nr :       << 
691                 syscall_get_nr(current, task_p << 
692                                                   381 
693         switch (mode) {                           382         switch (mode) {
694         case SECCOMP_MODE_STRICT:                 383         case SECCOMP_MODE_STRICT:
695                 __secure_computing_strict(this !! 384                 syscall = mode1_syscalls;
696                 return SECCOMP_PHASE1_OK;      !! 385 #ifdef CONFIG_COMPAT
                                                   >> 386                 if (is_compat_task())
                                                   >> 387                         syscall = mode1_syscalls_32;
                                                   >> 388 #endif
                                                   >> 389                 do {
                                                   >> 390                         if (*syscall == this_syscall)
                                                   >> 391                                 return 0;
                                                   >> 392                 } while (*++syscall);
                                                   >> 393                 exit_sig = SIGKILL;
                                                   >> 394                 ret = SECCOMP_RET_KILL;
                                                   >> 395                 break;
697 #ifdef CONFIG_SECCOMP_FILTER                      396 #ifdef CONFIG_SECCOMP_FILTER
698         case SECCOMP_MODE_FILTER:              !! 397         case SECCOMP_MODE_FILTER: {
699                 return __seccomp_phase1_filter !! 398                 int data;
                                                   >> 399                 ret = seccomp_run_filters(this_syscall);
                                                   >> 400                 data = ret & SECCOMP_RET_DATA;
                                                   >> 401                 ret &= SECCOMP_RET_ACTION;
                                                   >> 402                 switch (ret) {
                                                   >> 403                 case SECCOMP_RET_ERRNO:
                                                   >> 404                         /* Set the low-order 16-bits as a errno. */
                                                   >> 405                         syscall_set_return_value(current, task_pt_regs(current),
                                                   >> 406                                                  -data, 0);
                                                   >> 407                         goto skip;
                                                   >> 408                 case SECCOMP_RET_TRAP:
                                                   >> 409                         /* Show the handler the original registers. */
                                                   >> 410                         syscall_rollback(current, task_pt_regs(current));
                                                   >> 411                         /* Let the filter pass back 16 bits of data. */
                                                   >> 412                         seccomp_send_sigsys(this_syscall, data);
                                                   >> 413                         goto skip;
                                                   >> 414                 case SECCOMP_RET_TRACE:
                                                   >> 415                         /* Skip these calls if there is no tracer. */
                                                   >> 416                         if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP))
                                                   >> 417                                 goto skip;
                                                   >> 418                         /* Allow the BPF to provide the event message */
                                                   >> 419                         ptrace_event(PTRACE_EVENT_SECCOMP, data);
                                                   >> 420                         /*
                                                   >> 421                          * The delivery of a fatal signal during event
                                                   >> 422                          * notification may silently skip tracer notification.
                                                   >> 423                          * Terminating the task now avoids executing a system
                                                   >> 424                          * call that may not be intended.
                                                   >> 425                          */
                                                   >> 426                         if (fatal_signal_pending(current))
                                                   >> 427                                 break;
                                                   >> 428                         return 0;
                                                   >> 429                 case SECCOMP_RET_ALLOW:
                                                   >> 430                         return 0;
                                                   >> 431                 case SECCOMP_RET_KILL:
                                                   >> 432                 default:
                                                   >> 433                         break;
                                                   >> 434                 }
                                                   >> 435                 exit_sig = SIGSYS;
                                                   >> 436                 break;
                                                   >> 437         }
700 #endif                                            438 #endif
701         default:                                  439         default:
702                 BUG();                            440                 BUG();
703         }                                         441         }
704 }                                              << 
705                                                << 
706 /**                                            << 
707  * seccomp_phase2() - finish slow path seccomp << 
708  * @phase1_result: The return value from secco << 
709  *                                             << 
710  * This must be called from a context in which << 
711  *                                             << 
712  * Returns 0 if the syscall should be processe << 
713  */                                            << 
714 int seccomp_phase2(u32 phase1_result)          << 
715 {                                              << 
716         struct pt_regs *regs = task_pt_regs(cu << 
717         u32 action = phase1_result & SECCOMP_R << 
718         int data = phase1_result & SECCOMP_RET << 
719                                                << 
720         BUG_ON(action != SECCOMP_RET_TRACE);   << 
721                                                << 
722         audit_seccomp(syscall_get_nr(current,  << 
723                                                << 
724         /* Skip these calls if there is no tra << 
725         if (!ptrace_event_enabled(current, PTR << 
726                 syscall_set_return_value(curre << 
727                                          -ENOS << 
728                 return -1;                     << 
729         }                                      << 
730                                                   442 
731         /* Allow the BPF to provide the event  !! 443 #ifdef SECCOMP_DEBUG
732         ptrace_event(PTRACE_EVENT_SECCOMP, dat !! 444         dump_stack();
733         /*                                     !! 445 #endif
734          * The delivery of a fatal signal duri !! 446         audit_seccomp(this_syscall, exit_sig, ret);
735          * notification may silently skip trac !! 447         do_exit(exit_sig);
736          * Terminating the task now avoids exe !! 448 #ifdef CONFIG_SECCOMP_FILTER
737          * call that may not be intended.      !! 449 skip:
738          */                                    !! 450         audit_seccomp(this_syscall, exit_sig, ret);
739         if (fatal_signal_pending(current))     !! 451 #endif
740                 do_exit(SIGSYS);               !! 452         return -1;
741         if (syscall_get_nr(current, regs) < 0) << 
742                 return -1;  /* Explicit reques << 
743                                                << 
744         return 0;                              << 
745 }                                                 453 }
746 #endif /* CONFIG_HAVE_ARCH_SECCOMP_FILTER */   << 
747                                                   454 
748 long prctl_get_seccomp(void)                      455 long prctl_get_seccomp(void)
749 {                                                 456 {
750         return current->seccomp.mode;             457         return current->seccomp.mode;
751 }                                                 458 }
752                                                   459 
753 /**                                               460 /**
754  * seccomp_set_mode_strict: internal function  !! 461  * prctl_set_seccomp: configures current->seccomp.mode
755  *                                             !! 462  * @seccomp_mode: requested mode to use
756  * Once current->seccomp.mode is non-zero, it  !! 463  * @filter: optional struct sock_fprog for use with SECCOMP_MODE_FILTER
757  *                                                464  *
758  * Returns 0 on success or -EINVAL on failure. !! 465  * This function may be called repeatedly with a @seccomp_mode of
759  */                                            !! 466  * SECCOMP_MODE_FILTER to install additional filters.  Every filter
760 static long seccomp_set_mode_strict(void)      !! 467  * successfully installed will be evaluated (in reverse order) for each system
761 {                                              !! 468  * call the task makes.
762         const unsigned long seccomp_mode = SEC << 
763         long ret = -EINVAL;                    << 
764                                                << 
765         spin_lock_irq(&current->sighand->siglo << 
766                                                << 
767         if (!seccomp_may_assign_mode(seccomp_m << 
768                 goto out;                      << 
769                                                << 
770 #ifdef TIF_NOTSC                               << 
771         disable_TSC();                         << 
772 #endif                                         << 
773         seccomp_assign_mode(current, seccomp_m << 
774         ret = 0;                               << 
775                                                << 
776 out:                                           << 
777         spin_unlock_irq(&current->sighand->sig << 
778                                                << 
779         return ret;                            << 
780 }                                              << 
781                                                << 
782 #ifdef CONFIG_SECCOMP_FILTER                   << 
783 /**                                            << 
784  * seccomp_set_mode_filter: internal function  << 
785  * @flags:  flags to change filter behavior    << 
786  * @filter: struct sock_fprog containing filte << 
787  *                                             << 
788  * This function may be called repeatedly to i << 
789  * Every filter successfully installed will be << 
790  * for each system call the task makes.        << 
791  *                                                469  *
792  * Once current->seccomp.mode is non-zero, it     470  * Once current->seccomp.mode is non-zero, it may not be changed.
793  *                                                471  *
794  * Returns 0 on success or -EINVAL on failure.    472  * Returns 0 on success or -EINVAL on failure.
795  */                                               473  */
796 static long seccomp_set_mode_filter(unsigned i !! 474 long prctl_set_seccomp(unsigned long seccomp_mode, char __user *filter)
797                                     const char << 
798 {                                                 475 {
799         const unsigned long seccomp_mode = SEC << 
800         struct seccomp_filter *prepared = NULL << 
801         long ret = -EINVAL;                       476         long ret = -EINVAL;
802                                                   477 
803         /* Validate flags. */                  !! 478         if (current->seccomp.mode &&
804         if (flags & ~SECCOMP_FILTER_FLAG_MASK) !! 479             current->seccomp.mode != seccomp_mode)
805                 return -EINVAL;                << 
806                                                << 
807         /* Prepare the new filter before holdi << 
808         prepared = seccomp_prepare_user_filter << 
809         if (IS_ERR(prepared))                  << 
810                 return PTR_ERR(prepared);      << 
811                                                << 
812         /*                                     << 
813          * Make sure we cannot change seccomp  << 
814          * while another thread is in the midd << 
815          */                                    << 
816         if (flags & SECCOMP_FILTER_FLAG_TSYNC  << 
817             mutex_lock_killable(&current->sign << 
818                 goto out_free;                 << 
819                                                << 
820         spin_lock_irq(&current->sighand->siglo << 
821                                                << 
822         if (!seccomp_may_assign_mode(seccomp_m << 
823                 goto out;                      << 
824                                                << 
825         ret = seccomp_attach_filter(flags, pre << 
826         if (ret)                               << 
827                 goto out;                         480                 goto out;
828         /* Do not free the successfully attach << 
829         prepared = NULL;                       << 
830                                                << 
831         seccomp_assign_mode(current, seccomp_m << 
832 out:                                           << 
833         spin_unlock_irq(&current->sighand->sig << 
834         if (flags & SECCOMP_FILTER_FLAG_TSYNC) << 
835                 mutex_unlock(&current->signal- << 
836 out_free:                                      << 
837         seccomp_filter_free(prepared);         << 
838         return ret;                            << 
839 }                                              << 
840 #else                                          << 
841 static inline long seccomp_set_mode_filter(uns << 
842                                            con << 
843 {                                              << 
844         return -EINVAL;                        << 
845 }                                              << 
846 #endif                                         << 
847                                                << 
848 /* Common entry point for both prctl and sysca << 
849 static long do_seccomp(unsigned int op, unsign << 
850                        const char __user *uarg << 
851 {                                              << 
852         switch (op) {                          << 
853         case SECCOMP_SET_MODE_STRICT:          << 
854                 if (flags != 0 || uargs != NUL << 
855                         return -EINVAL;        << 
856                 return seccomp_set_mode_strict << 
857         case SECCOMP_SET_MODE_FILTER:          << 
858                 return seccomp_set_mode_filter << 
859         default:                               << 
860                 return -EINVAL;                << 
861         }                                      << 
862 }                                              << 
863                                                << 
864 SYSCALL_DEFINE3(seccomp, unsigned int, op, uns << 
865                          const char __user *,  << 
866 {                                              << 
867         return do_seccomp(op, flags, uargs);   << 
868 }                                              << 
869                                                << 
870 /**                                            << 
871  * prctl_set_seccomp: configures current->secc << 
872  * @seccomp_mode: requested mode to use        << 
873  * @filter: optional struct sock_fprog for use << 
874  *                                             << 
875  * Returns 0 on success or -EINVAL on failure. << 
876  */                                            << 
877 long prctl_set_seccomp(unsigned long seccomp_m << 
878 {                                              << 
879         unsigned int op;                       << 
880         char __user *uargs;                    << 
881                                                   481 
882         switch (seccomp_mode) {                   482         switch (seccomp_mode) {
883         case SECCOMP_MODE_STRICT:                 483         case SECCOMP_MODE_STRICT:
884                 op = SECCOMP_SET_MODE_STRICT;  !! 484                 ret = 0;
885                 /*                             !! 485 #ifdef TIF_NOTSC
886                  * Setting strict mode through !! 486                 disable_TSC();
887                  * so make sure it is always N !! 487 #endif
888                  * check in do_seccomp().      << 
889                  */                            << 
890                 uargs = NULL;                  << 
891                 break;                            488                 break;
                                                   >> 489 #ifdef CONFIG_SECCOMP_FILTER
892         case SECCOMP_MODE_FILTER:                 490         case SECCOMP_MODE_FILTER:
893                 op = SECCOMP_SET_MODE_FILTER;  !! 491                 ret = seccomp_attach_user_filter(filter);
894                 uargs = filter;                !! 492                 if (ret)
                                                   >> 493                         goto out;
895                 break;                            494                 break;
                                                   >> 495 #endif
896         default:                                  496         default:
897                 return -EINVAL;                !! 497                 goto out;
898         }                                         498         }
899                                                   499 
900         /* prctl interface doesn't have flags, !! 500         current->seccomp.mode = seccomp_mode;
901         return do_seccomp(op, 0, uargs);       !! 501         set_thread_flag(TIF_SECCOMP);
                                                   >> 502 out:
                                                   >> 503         return ret;
902 }                                                 504 }
903                                                   505 

This page was automatically generated by LXR 0.3.1 (source).  •  Linux is a registered trademark of Linus Torvalds  •  Contact us