Lines Matching full:filter
41 #include <linux/filter.h>
64 /* The struct pid of the task whose filter triggered the notification */
67 /* The "cookie" for this request; this is unique for this filter. */
145 * filter->notify_lock.
160 * struct action_cache - per-filter cache of seccomp actions per
164 * filter will always allow the syscall, for the
167 * filter will always allow the syscall, for the
194 * A filter's reference count is incremented for each directly
195 * attached task, once for the dependent filter, and if
197 * the filter can be freed.
198 * @users: A filter's @users count is incremented for each directly
199 * attached task (filter installation, fork(), thread_sync),
200 * and once for the dependent filter (tracked in filter->prev).
202 * users of that filter exist. No new tasks can get associated with
203 * this filter after reaching 0. The @users count is always smaller
205 * the filter can be freed.
210 * @prev: points to a previously installed, or inherited, filter
218 * with current->seccomp.filter, the most recently attached or inherited filter.
269 * seccomp_check_filter - verify seccomp filter code
270 * @filter: filter to verify
271 * @flen: length of filter
273 * Takes a previously checked filter (by bpf_check_classic) and
274 * redirects all filter code that loads struct sk_buff data
280 static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen) in seccomp_check_filter() argument
284 struct sock_filter *ftest = &filter[pc]; in seccomp_check_filter()
364 * @sfilter: The seccomp filter
401 * unless filter returned SECCOMP_RET_ALLOW, in which case it will
410 /* Make sure cross-thread synced filter points somewhere sane. */ in seccomp_run_filters()
412 READ_ONCE(current->seccomp.filter); in seccomp_run_filters()
458 * filter) is set. in seccomp_assign_mode()
488 * seccomp filter.
508 is_ancestor(thread->seccomp.filter, in seccomp_can_sync_threads()
509 caller->seccomp.filter))) in seccomp_can_sync_threads()
523 static inline void seccomp_filter_free(struct seccomp_filter *filter) in seccomp_filter_free() argument
525 if (filter) { in seccomp_filter_free()
526 bpf_prog_destroy(filter->prog); in seccomp_filter_free()
527 kfree(filter); in seccomp_filter_free()
552 /* Notify about any unused filters in the task's former filter tree. */ in __seccomp_filter_release()
559 * seccomp_filter_release - Detach the task from its filter tree,
563 * @tsk: task the filter should be released from.
566 * it detaches it from its filter tree. As such, READ_ONCE() and
571 struct seccomp_filter *orig = tsk->seccomp.filter; in seccomp_filter_release()
576 /* Detach task from its filter tree. */ in seccomp_filter_release()
577 tsk->seccomp.filter = NULL; in seccomp_filter_release()
582 * seccomp_sync_threads: sets all threads to use current's filter
613 __seccomp_filter_release(thread->seccomp.filter); in seccomp_sync_threads()
615 /* Make our new filter tree visible. */ in seccomp_sync_threads()
616 smp_store_release(&thread->seccomp.filter, in seccomp_sync_threads()
617 caller->seccomp.filter); in seccomp_sync_threads()
643 * seccomp_prepare_filter: Prepares a seccomp filter for use.
646 * Returns filter on success or an ERR_PTR on failure.
665 * Installing a seccomp filter requires that the task has in seccomp_prepare_filter()
704 struct seccomp_filter *filter = ERR_PTR(-EFAULT); in seccomp_prepare_user_filter() local
712 fprog.filter = compat_ptr(fprog32.filter); in seccomp_prepare_user_filter()
717 filter = seccomp_prepare_filter(&fprog); in seccomp_prepare_user_filter()
719 return filter; in seccomp_prepare_user_filter()
724 * seccomp_is_const_allow - check if filter is constant allow with given data
740 struct sock_filter *insn = &fprog->filter[pc]; in seccomp_is_const_allow()
797 /* ran off the end of the filter?! */ in seccomp_is_const_allow()
811 /* The new filter must be as restrictive as the last. */ in seccomp_cache_prepare_bitmap()
832 * atomic clear_bit() not needed, filter not visible yet. in seccomp_cache_prepare_bitmap()
839 * seccomp_cache_prepare - emulate the filter to find cacheable syscalls
840 * @sfilter: The seccomp filter
865 * seccomp_attach_filter: validate and attach filter
866 * @flags: flags to change filter behavior
867 * @filter: seccomp filter to add to the current process
873 * seccomp mode or did not have an ancestral seccomp filter
877 struct seccomp_filter *filter) in seccomp_attach_filter() argument
884 /* Validate resulting filter length. */ in seccomp_attach_filter()
885 total_insns = filter->prog->len; in seccomp_attach_filter()
886 for (walker = current->seccomp.filter; walker; walker = walker->prev) in seccomp_attach_filter()
906 filter->log = true; in seccomp_attach_filter()
910 filter->wait_killable_recv = true; in seccomp_attach_filter()
913 * If there is an existing filter, make it the prev and don't drop its in seccomp_attach_filter()
916 filter->prev = current->seccomp.filter; in seccomp_attach_filter()
917 seccomp_cache_prepare(filter); in seccomp_attach_filter()
918 current->seccomp.filter = filter; in seccomp_attach_filter()
921 /* Now that the new filter is in place, synchronize to all threads. */ in seccomp_attach_filter()
928 static void __get_seccomp_filter(struct seccomp_filter *filter) in __get_seccomp_filter() argument
930 refcount_inc(&filter->refs); in __get_seccomp_filter()
933 /* get_seccomp_filter - increments the reference count of the filter on @tsk */
936 struct seccomp_filter *orig = tsk->seccomp.filter; in get_seccomp_filter()
1055 static u64 seccomp_next_notify_id(struct seccomp_filter *filter) in seccomp_next_notify_id() argument
1059 * filter. in seccomp_next_notify_id()
1061 lockdep_assert_held(&filter->notify_lock); in seccomp_next_notify_id()
1062 return filter->notif->next_id++; in seccomp_next_notify_id()
1238 /* Let the filter pass back 16 bits of data. */ in __seccomp_filter()
1297 * Note that the "match" filter will always be NULL for in __seccomp_filter()
1401 static void seccomp_notify_free(struct seccomp_filter *filter) in seccomp_notify_free() argument
1403 kfree(filter->notif); in seccomp_notify_free()
1404 filter->notif = NULL; in seccomp_notify_free()
1407 static void seccomp_notify_detach(struct seccomp_filter *filter) in seccomp_notify_detach() argument
1411 if (!filter) in seccomp_notify_detach()
1414 mutex_lock(&filter->notify_lock); in seccomp_notify_detach()
1420 list_for_each_entry(knotif, &filter->notif->notifications, list) { in seccomp_notify_detach()
1436 seccomp_notify_free(filter); in seccomp_notify_detach()
1437 mutex_unlock(&filter->notify_lock); in seccomp_notify_detach()
1442 struct seccomp_filter *filter = file->private_data; in seccomp_notify_release() local
1444 seccomp_notify_detach(filter); in seccomp_notify_release()
1445 __put_seccomp_filter(filter); in seccomp_notify_release()
1451 find_notification(struct seccomp_filter *filter, u64 id) in find_notification() argument
1455 lockdep_assert_held(&filter->notify_lock); in find_notification()
1457 list_for_each_entry(cur, &filter->notif->notifications, list) { in find_notification()
1474 static int recv_wait_event(struct seccomp_filter *filter) in recv_wait_event() argument
1479 if (atomic_dec_if_positive(&filter->notif->requests) >= 0) in recv_wait_event()
1483 ret = prepare_to_wait_event(&filter->wqh, &wait, TASK_INTERRUPTIBLE); in recv_wait_event()
1485 if (atomic_dec_if_positive(&filter->notif->requests) >= 0) in recv_wait_event()
1493 finish_wait(&filter->wqh, &wait); in recv_wait_event()
1497 static long seccomp_notify_recv(struct seccomp_filter *filter, in seccomp_notify_recv() argument
1513 ret = recv_wait_event(filter); in seccomp_notify_recv()
1517 mutex_lock(&filter->notify_lock); in seccomp_notify_recv()
1518 list_for_each_entry(cur, &filter->notif->notifications, list) { in seccomp_notify_recv()
1540 wake_up_poll(&filter->wqh, EPOLLOUT | EPOLLWRNORM); in seccomp_notify_recv()
1543 mutex_unlock(&filter->notify_lock); in seccomp_notify_recv()
1554 mutex_lock(&filter->notify_lock); in seccomp_notify_recv()
1555 knotif = find_notification(filter, unotif.id); in seccomp_notify_recv()
1558 if (should_sleep_killable(filter, knotif)) in seccomp_notify_recv()
1561 atomic_inc(&filter->notif->requests); in seccomp_notify_recv()
1562 wake_up_poll(&filter->wqh, EPOLLIN | EPOLLRDNORM); in seccomp_notify_recv()
1564 mutex_unlock(&filter->notify_lock); in seccomp_notify_recv()
1570 static long seccomp_notify_send(struct seccomp_filter *filter, in seccomp_notify_send() argument
1587 ret = mutex_lock_interruptible(&filter->notify_lock); in seccomp_notify_send()
1591 knotif = find_notification(filter, resp.id); in seccomp_notify_send()
1608 if (filter->notif->flags & SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP) in seccomp_notify_send()
1613 mutex_unlock(&filter->notify_lock); in seccomp_notify_send()
1617 static long seccomp_notify_id_valid(struct seccomp_filter *filter, in seccomp_notify_id_valid() argument
1627 ret = mutex_lock_interruptible(&filter->notify_lock); in seccomp_notify_id_valid()
1631 knotif = find_notification(filter, id); in seccomp_notify_id_valid()
1637 mutex_unlock(&filter->notify_lock); in seccomp_notify_id_valid()
1641 static long seccomp_notify_set_flags(struct seccomp_filter *filter, in seccomp_notify_set_flags() argument
1649 ret = mutex_lock_interruptible(&filter->notify_lock); in seccomp_notify_set_flags()
1652 filter->notif->flags = flags; in seccomp_notify_set_flags()
1653 mutex_unlock(&filter->notify_lock); in seccomp_notify_set_flags()
1657 static long seccomp_notify_addfd(struct seccomp_filter *filter, in seccomp_notify_addfd() argument
1695 ret = mutex_lock_interruptible(&filter->notify_lock); in seccomp_notify_addfd()
1699 knotif = find_notification(filter, addfd.id); in seccomp_notify_addfd()
1734 mutex_unlock(&filter->notify_lock); in seccomp_notify_addfd()
1750 mutex_lock(&filter->notify_lock); in seccomp_notify_addfd()
1764 mutex_unlock(&filter->notify_lock); in seccomp_notify_addfd()
1774 struct seccomp_filter *filter = file->private_data; in seccomp_notify_ioctl() local
1780 return seccomp_notify_recv(filter, buf); in seccomp_notify_ioctl()
1782 return seccomp_notify_send(filter, buf); in seccomp_notify_ioctl()
1785 return seccomp_notify_id_valid(filter, buf); in seccomp_notify_ioctl()
1787 return seccomp_notify_set_flags(filter, arg); in seccomp_notify_ioctl()
1794 return seccomp_notify_addfd(filter, buf, _IOC_SIZE(cmd)); in seccomp_notify_ioctl()
1803 struct seccomp_filter *filter = file->private_data; in seccomp_notify_poll() local
1807 poll_wait(file, &filter->wqh, poll_tab); in seccomp_notify_poll()
1809 if (mutex_lock_interruptible(&filter->notify_lock) < 0) in seccomp_notify_poll()
1812 list_for_each_entry(cur, &filter->notif->notifications, list) { in seccomp_notify_poll()
1821 mutex_unlock(&filter->notify_lock); in seccomp_notify_poll()
1823 if (refcount_read(&filter->users) == 0) in seccomp_notify_poll()
1836 static struct file *init_listener(struct seccomp_filter *filter) in init_listener() argument
1841 filter->notif = kzalloc(sizeof(*(filter->notif)), GFP_KERNEL); in init_listener()
1842 if (!filter->notif) in init_listener()
1845 filter->notif->next_id = get_random_u64(); in init_listener()
1846 INIT_LIST_HEAD(&filter->notif->notifications); in init_listener()
1849 filter, O_RDWR); in init_listener()
1854 __get_seccomp_filter(filter); in init_listener()
1858 seccomp_notify_free(filter); in init_listener()
1865 * If so, we'll want to reject this filter.
1869 * we use current->seccomp.filter.
1880 for (cur = current->seccomp.filter; cur; cur = cur->prev) { in has_duplicate_listener()
1889 * seccomp_set_mode_filter: internal function for setting seccomp filter
1890 * @flags: flags to change filter behavior
1891 * @filter: struct sock_fprog containing filter
1894 * Every filter successfully installed will be evaluated (in reverse order)
1902 const char __user *filter) in seccomp_set_mode_filter() argument
1934 /* Prepare the new filter before holding any locks. */ in seccomp_set_mode_filter()
1935 prepared = seccomp_prepare_user_filter(filter); in seccomp_set_mode_filter()
1975 /* Do not free the successfully attached filter. */ in seccomp_set_mode_filter()
2001 const char __user *filter) in seccomp_set_mode_filter() argument
2080 * @filter: optional struct sock_fprog for use with SECCOMP_MODE_FILTER
2084 long prctl_set_seccomp(unsigned long seccomp_mode, void __user *filter) in prctl_set_seccomp() argument
2093 * Setting strict mode through prctl always ignored filter, in prctl_set_seccomp()
2101 uargs = filter; in prctl_set_seccomp()
2115 struct seccomp_filter *orig, *filter; in get_nth_filter() local
2129 orig = task->seccomp.filter; in get_nth_filter()
2134 for (filter = orig; filter; filter = filter->prev) in get_nth_filter()
2138 filter = ERR_PTR(-ENOENT); in get_nth_filter()
2143 for (filter = orig; filter && count > 1; filter = filter->prev) in get_nth_filter()
2146 if (WARN_ON(count != 1 || !filter)) { in get_nth_filter()
2147 filter = ERR_PTR(-ENOENT); in get_nth_filter()
2151 __get_seccomp_filter(filter); in get_nth_filter()
2155 return filter; in get_nth_filter()
2161 struct seccomp_filter *filter; in seccomp_get_filter() local
2170 filter = get_nth_filter(task, filter_off); in seccomp_get_filter()
2171 if (IS_ERR(filter)) in seccomp_get_filter()
2172 return PTR_ERR(filter); in seccomp_get_filter()
2174 fprog = filter->prog->orig_prog; in seccomp_get_filter()
2176 /* This must be a new non-cBPF filter, since we save in seccomp_get_filter()
2177 * every cBPF filter's orig_prog above when in seccomp_get_filter()
2188 if (copy_to_user(data, fprog->filter, bpf_classic_proglen(fprog))) in seccomp_get_filter()
2192 __put_seccomp_filter(filter); in seccomp_get_filter()
2200 struct seccomp_filter *filter; in seccomp_get_metadata() local
2216 filter = get_nth_filter(task, kmd.filter_off); in seccomp_get_metadata()
2217 if (IS_ERR(filter)) in seccomp_get_metadata()
2218 return PTR_ERR(filter); in seccomp_get_metadata()
2220 if (filter->log) in seccomp_get_metadata()
2227 __put_seccomp_filter(filter); in seccomp_get_metadata()
2470 char *status = cached ? "ALLOW" : "FILTER"; in device_initcall()
2492 f = READ_ONCE(task->seccomp.filter); in proc_pid_seccomp_cache()
2498 /* prevent filter from being freed while we are printing it */ in proc_pid_seccomp_cache()