xref: /openbmc/linux/kernel/seccomp.c (revision 0edbfea5)
1 /*
2  * linux/kernel/seccomp.c
3  *
4  * Copyright 2004-2005  Andrea Arcangeli <andrea@cpushare.com>
5  *
6  * Copyright (C) 2012 Google, Inc.
7  * Will Drewry <wad@chromium.org>
8  *
9  * This defines a simple but solid secure-computing facility.
10  *
11  * Mode 1 uses a fixed list of allowed system calls.
12  * Mode 2 allows user-defined system call filters in the form
13  *        of Berkeley Packet Filters/Linux Socket Filters.
14  */
15 
16 #include <linux/atomic.h>
17 #include <linux/audit.h>
18 #include <linux/compat.h>
19 #include <linux/sched.h>
20 #include <linux/seccomp.h>
21 #include <linux/slab.h>
22 #include <linux/syscalls.h>
23 
24 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
25 #include <asm/syscall.h>
26 #endif
27 
28 #ifdef CONFIG_SECCOMP_FILTER
29 #include <linux/filter.h>
30 #include <linux/pid.h>
31 #include <linux/ptrace.h>
32 #include <linux/security.h>
33 #include <linux/tracehook.h>
34 #include <linux/uaccess.h>
35 
36 /**
37  * struct seccomp_filter - container for seccomp BPF programs
38  *
39  * @usage: reference count to manage the object lifetime.
40  *         get/put helpers should be used when accessing an instance
41  *         outside of a lifetime-guarded section.  In general, this
42  *         is only needed for handling filters shared across tasks.
43  * @prev: points to a previously installed, or inherited, filter
44  * @len: the number of instructions in the program
45  * @insnsi: the BPF program instructions to evaluate
46  *
47  * seccomp_filter objects are organized in a tree linked via the @prev
48  * pointer.  For any task, it appears to be a singly-linked list starting
49  * with current->seccomp.filter, the most recently attached or inherited filter.
50  * However, multiple filters may share a @prev node, by way of fork(), which
51  * results in a unidirectional tree existing in memory.  This is similar to
52  * how namespaces work.
53  *
54  * seccomp_filter objects should never be modified after being attached
55  * to a task_struct (other than @usage).
56  */
57 struct seccomp_filter {
58 	atomic_t usage;
59 	struct seccomp_filter *prev;
60 	struct bpf_prog *prog;
61 };
62 
63 /* Limit any path through the tree to 256KB worth of instructions. */
64 #define MAX_INSNS_PER_PATH ((1 << 18) / sizeof(struct sock_filter))
65 
66 /*
67  * Endianness is explicitly ignored and left for BPF program authors to manage
68  * as per the specific architecture.
69  */
70 static void populate_seccomp_data(struct seccomp_data *sd)
71 {
72 	struct task_struct *task = current;
73 	struct pt_regs *regs = task_pt_regs(task);
74 	unsigned long args[6];
75 
76 	sd->nr = syscall_get_nr(task, regs);
77 	sd->arch = syscall_get_arch();
78 	syscall_get_arguments(task, regs, 0, 6, args);
79 	sd->args[0] = args[0];
80 	sd->args[1] = args[1];
81 	sd->args[2] = args[2];
82 	sd->args[3] = args[3];
83 	sd->args[4] = args[4];
84 	sd->args[5] = args[5];
85 	sd->instruction_pointer = KSTK_EIP(task);
86 }
87 
88 /**
89  *	seccomp_check_filter - verify seccomp filter code
90  *	@filter: filter to verify
91  *	@flen: length of filter
92  *
93  * Takes a previously checked filter (by bpf_check_classic) and
94  * redirects all filter code that loads struct sk_buff data
95  * and related data through seccomp_bpf_load.  It also
96  * enforces length and alignment checking of those loads.
97  *
98  * Returns 0 if the rule set is legal or -EINVAL if not.
99  */
100 static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen)
101 {
102 	int pc;
103 	for (pc = 0; pc < flen; pc++) {
104 		struct sock_filter *ftest = &filter[pc];
105 		u16 code = ftest->code;
106 		u32 k = ftest->k;
107 
108 		switch (code) {
109 		case BPF_LD | BPF_W | BPF_ABS:
110 			ftest->code = BPF_LDX | BPF_W | BPF_ABS;
111 			/* 32-bit aligned and not out of bounds. */
112 			if (k >= sizeof(struct seccomp_data) || k & 3)
113 				return -EINVAL;
114 			continue;
115 		case BPF_LD | BPF_W | BPF_LEN:
116 			ftest->code = BPF_LD | BPF_IMM;
117 			ftest->k = sizeof(struct seccomp_data);
118 			continue;
119 		case BPF_LDX | BPF_W | BPF_LEN:
120 			ftest->code = BPF_LDX | BPF_IMM;
121 			ftest->k = sizeof(struct seccomp_data);
122 			continue;
123 		/* Explicitly include allowed calls. */
124 		case BPF_RET | BPF_K:
125 		case BPF_RET | BPF_A:
126 		case BPF_ALU | BPF_ADD | BPF_K:
127 		case BPF_ALU | BPF_ADD | BPF_X:
128 		case BPF_ALU | BPF_SUB | BPF_K:
129 		case BPF_ALU | BPF_SUB | BPF_X:
130 		case BPF_ALU | BPF_MUL | BPF_K:
131 		case BPF_ALU | BPF_MUL | BPF_X:
132 		case BPF_ALU | BPF_DIV | BPF_K:
133 		case BPF_ALU | BPF_DIV | BPF_X:
134 		case BPF_ALU | BPF_AND | BPF_K:
135 		case BPF_ALU | BPF_AND | BPF_X:
136 		case BPF_ALU | BPF_OR | BPF_K:
137 		case BPF_ALU | BPF_OR | BPF_X:
138 		case BPF_ALU | BPF_XOR | BPF_K:
139 		case BPF_ALU | BPF_XOR | BPF_X:
140 		case BPF_ALU | BPF_LSH | BPF_K:
141 		case BPF_ALU | BPF_LSH | BPF_X:
142 		case BPF_ALU | BPF_RSH | BPF_K:
143 		case BPF_ALU | BPF_RSH | BPF_X:
144 		case BPF_ALU | BPF_NEG:
145 		case BPF_LD | BPF_IMM:
146 		case BPF_LDX | BPF_IMM:
147 		case BPF_MISC | BPF_TAX:
148 		case BPF_MISC | BPF_TXA:
149 		case BPF_LD | BPF_MEM:
150 		case BPF_LDX | BPF_MEM:
151 		case BPF_ST:
152 		case BPF_STX:
153 		case BPF_JMP | BPF_JA:
154 		case BPF_JMP | BPF_JEQ | BPF_K:
155 		case BPF_JMP | BPF_JEQ | BPF_X:
156 		case BPF_JMP | BPF_JGE | BPF_K:
157 		case BPF_JMP | BPF_JGE | BPF_X:
158 		case BPF_JMP | BPF_JGT | BPF_K:
159 		case BPF_JMP | BPF_JGT | BPF_X:
160 		case BPF_JMP | BPF_JSET | BPF_K:
161 		case BPF_JMP | BPF_JSET | BPF_X:
162 			continue;
163 		default:
164 			return -EINVAL;
165 		}
166 	}
167 	return 0;
168 }
169 
170 /**
171  * seccomp_run_filters - evaluates all seccomp filters against @syscall
172  * @syscall: number of the current system call
173  *
174  * Returns valid seccomp BPF response codes.
175  */
176 static u32 seccomp_run_filters(const struct seccomp_data *sd)
177 {
178 	struct seccomp_data sd_local;
179 	u32 ret = SECCOMP_RET_ALLOW;
180 	/* Make sure cross-thread synced filter points somewhere sane. */
181 	struct seccomp_filter *f =
182 			lockless_dereference(current->seccomp.filter);
183 
184 	/* Ensure unexpected behavior doesn't result in failing open. */
185 	if (unlikely(WARN_ON(f == NULL)))
186 		return SECCOMP_RET_KILL;
187 
188 	if (!sd) {
189 		populate_seccomp_data(&sd_local);
190 		sd = &sd_local;
191 	}
192 
193 	/*
194 	 * All filters in the list are evaluated and the lowest BPF return
195 	 * value always takes priority (ignoring the DATA).
196 	 */
197 	for (; f; f = f->prev) {
198 		u32 cur_ret = BPF_PROG_RUN(f->prog, (void *)sd);
199 
200 		if ((cur_ret & SECCOMP_RET_ACTION) < (ret & SECCOMP_RET_ACTION))
201 			ret = cur_ret;
202 	}
203 	return ret;
204 }
205 #endif /* CONFIG_SECCOMP_FILTER */
206 
207 static inline bool seccomp_may_assign_mode(unsigned long seccomp_mode)
208 {
209 	assert_spin_locked(&current->sighand->siglock);
210 
211 	if (current->seccomp.mode && current->seccomp.mode != seccomp_mode)
212 		return false;
213 
214 	return true;
215 }
216 
217 static inline void seccomp_assign_mode(struct task_struct *task,
218 				       unsigned long seccomp_mode)
219 {
220 	assert_spin_locked(&task->sighand->siglock);
221 
222 	task->seccomp.mode = seccomp_mode;
223 	/*
224 	 * Make sure TIF_SECCOMP cannot be set before the mode (and
225 	 * filter) is set.
226 	 */
227 	smp_mb__before_atomic();
228 	set_tsk_thread_flag(task, TIF_SECCOMP);
229 }
230 
231 #ifdef CONFIG_SECCOMP_FILTER
232 /* Returns 1 if the parent is an ancestor of the child. */
233 static int is_ancestor(struct seccomp_filter *parent,
234 		       struct seccomp_filter *child)
235 {
236 	/* NULL is the root ancestor. */
237 	if (parent == NULL)
238 		return 1;
239 	for (; child; child = child->prev)
240 		if (child == parent)
241 			return 1;
242 	return 0;
243 }
244 
245 /**
246  * seccomp_can_sync_threads: checks if all threads can be synchronized
247  *
248  * Expects sighand and cred_guard_mutex locks to be held.
249  *
250  * Returns 0 on success, -ve on error, or the pid of a thread which was
251  * either not in the correct seccomp mode or it did not have an ancestral
252  * seccomp filter.
253  */
254 static inline pid_t seccomp_can_sync_threads(void)
255 {
256 	struct task_struct *thread, *caller;
257 
258 	BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
259 	assert_spin_locked(&current->sighand->siglock);
260 
261 	/* Validate all threads being eligible for synchronization. */
262 	caller = current;
263 	for_each_thread(caller, thread) {
264 		pid_t failed;
265 
266 		/* Skip current, since it is initiating the sync. */
267 		if (thread == caller)
268 			continue;
269 
270 		if (thread->seccomp.mode == SECCOMP_MODE_DISABLED ||
271 		    (thread->seccomp.mode == SECCOMP_MODE_FILTER &&
272 		     is_ancestor(thread->seccomp.filter,
273 				 caller->seccomp.filter)))
274 			continue;
275 
276 		/* Return the first thread that cannot be synchronized. */
277 		failed = task_pid_vnr(thread);
278 		/* If the pid cannot be resolved, then return -ESRCH */
279 		if (unlikely(WARN_ON(failed == 0)))
280 			failed = -ESRCH;
281 		return failed;
282 	}
283 
284 	return 0;
285 }
286 
287 /**
288  * seccomp_sync_threads: sets all threads to use current's filter
289  *
290  * Expects sighand and cred_guard_mutex locks to be held, and for
291  * seccomp_can_sync_threads() to have returned success already
292  * without dropping the locks.
293  *
294  */
295 static inline void seccomp_sync_threads(void)
296 {
297 	struct task_struct *thread, *caller;
298 
299 	BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
300 	assert_spin_locked(&current->sighand->siglock);
301 
302 	/* Synchronize all threads. */
303 	caller = current;
304 	for_each_thread(caller, thread) {
305 		/* Skip current, since it needs no changes. */
306 		if (thread == caller)
307 			continue;
308 
309 		/* Get a task reference for the new leaf node. */
310 		get_seccomp_filter(caller);
311 		/*
312 		 * Drop the task reference to the shared ancestor since
313 		 * current's path will hold a reference.  (This also
314 		 * allows a put before the assignment.)
315 		 */
316 		put_seccomp_filter(thread);
317 		smp_store_release(&thread->seccomp.filter,
318 				  caller->seccomp.filter);
319 
320 		/*
321 		 * Don't let an unprivileged task work around
322 		 * the no_new_privs restriction by creating
323 		 * a thread that sets it up, enters seccomp,
324 		 * then dies.
325 		 */
326 		if (task_no_new_privs(caller))
327 			task_set_no_new_privs(thread);
328 
329 		/*
330 		 * Opt the other thread into seccomp if needed.
331 		 * As threads are considered to be trust-realm
332 		 * equivalent (see ptrace_may_access), it is safe to
333 		 * allow one thread to transition the other.
334 		 */
335 		if (thread->seccomp.mode == SECCOMP_MODE_DISABLED)
336 			seccomp_assign_mode(thread, SECCOMP_MODE_FILTER);
337 	}
338 }
339 
340 /**
341  * seccomp_prepare_filter: Prepares a seccomp filter for use.
342  * @fprog: BPF program to install
343  *
344  * Returns filter on success or an ERR_PTR on failure.
345  */
346 static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog)
347 {
348 	struct seccomp_filter *sfilter;
349 	int ret;
350 	const bool save_orig = config_enabled(CONFIG_CHECKPOINT_RESTORE);
351 
352 	if (fprog->len == 0 || fprog->len > BPF_MAXINSNS)
353 		return ERR_PTR(-EINVAL);
354 
355 	BUG_ON(INT_MAX / fprog->len < sizeof(struct sock_filter));
356 
357 	/*
358 	 * Installing a seccomp filter requires that the task has
359 	 * CAP_SYS_ADMIN in its namespace or be running with no_new_privs.
360 	 * This avoids scenarios where unprivileged tasks can affect the
361 	 * behavior of privileged children.
362 	 */
363 	if (!task_no_new_privs(current) &&
364 	    security_capable_noaudit(current_cred(), current_user_ns(),
365 				     CAP_SYS_ADMIN) != 0)
366 		return ERR_PTR(-EACCES);
367 
368 	/* Allocate a new seccomp_filter */
369 	sfilter = kzalloc(sizeof(*sfilter), GFP_KERNEL | __GFP_NOWARN);
370 	if (!sfilter)
371 		return ERR_PTR(-ENOMEM);
372 
373 	ret = bpf_prog_create_from_user(&sfilter->prog, fprog,
374 					seccomp_check_filter, save_orig);
375 	if (ret < 0) {
376 		kfree(sfilter);
377 		return ERR_PTR(ret);
378 	}
379 
380 	atomic_set(&sfilter->usage, 1);
381 
382 	return sfilter;
383 }
384 
385 /**
386  * seccomp_prepare_user_filter - prepares a user-supplied sock_fprog
387  * @user_filter: pointer to the user data containing a sock_fprog.
388  *
389  * Returns 0 on success and non-zero otherwise.
390  */
391 static struct seccomp_filter *
392 seccomp_prepare_user_filter(const char __user *user_filter)
393 {
394 	struct sock_fprog fprog;
395 	struct seccomp_filter *filter = ERR_PTR(-EFAULT);
396 
397 #ifdef CONFIG_COMPAT
398 	if (in_compat_syscall()) {
399 		struct compat_sock_fprog fprog32;
400 		if (copy_from_user(&fprog32, user_filter, sizeof(fprog32)))
401 			goto out;
402 		fprog.len = fprog32.len;
403 		fprog.filter = compat_ptr(fprog32.filter);
404 	} else /* falls through to the if below. */
405 #endif
406 	if (copy_from_user(&fprog, user_filter, sizeof(fprog)))
407 		goto out;
408 	filter = seccomp_prepare_filter(&fprog);
409 out:
410 	return filter;
411 }
412 
413 /**
414  * seccomp_attach_filter: validate and attach filter
415  * @flags:  flags to change filter behavior
416  * @filter: seccomp filter to add to the current process
417  *
418  * Caller must be holding current->sighand->siglock lock.
419  *
420  * Returns 0 on success, -ve on error.
421  */
422 static long seccomp_attach_filter(unsigned int flags,
423 				  struct seccomp_filter *filter)
424 {
425 	unsigned long total_insns;
426 	struct seccomp_filter *walker;
427 
428 	assert_spin_locked(&current->sighand->siglock);
429 
430 	/* Validate resulting filter length. */
431 	total_insns = filter->prog->len;
432 	for (walker = current->seccomp.filter; walker; walker = walker->prev)
433 		total_insns += walker->prog->len + 4;  /* 4 instr penalty */
434 	if (total_insns > MAX_INSNS_PER_PATH)
435 		return -ENOMEM;
436 
437 	/* If thread sync has been requested, check that it is possible. */
438 	if (flags & SECCOMP_FILTER_FLAG_TSYNC) {
439 		int ret;
440 
441 		ret = seccomp_can_sync_threads();
442 		if (ret)
443 			return ret;
444 	}
445 
446 	/*
447 	 * If there is an existing filter, make it the prev and don't drop its
448 	 * task reference.
449 	 */
450 	filter->prev = current->seccomp.filter;
451 	current->seccomp.filter = filter;
452 
453 	/* Now that the new filter is in place, synchronize to all threads. */
454 	if (flags & SECCOMP_FILTER_FLAG_TSYNC)
455 		seccomp_sync_threads();
456 
457 	return 0;
458 }
459 
460 /* get_seccomp_filter - increments the reference count of the filter on @tsk */
461 void get_seccomp_filter(struct task_struct *tsk)
462 {
463 	struct seccomp_filter *orig = tsk->seccomp.filter;
464 	if (!orig)
465 		return;
466 	/* Reference count is bounded by the number of total processes. */
467 	atomic_inc(&orig->usage);
468 }
469 
470 static inline void seccomp_filter_free(struct seccomp_filter *filter)
471 {
472 	if (filter) {
473 		bpf_prog_destroy(filter->prog);
474 		kfree(filter);
475 	}
476 }
477 
478 /* put_seccomp_filter - decrements the ref count of tsk->seccomp.filter */
479 void put_seccomp_filter(struct task_struct *tsk)
480 {
481 	struct seccomp_filter *orig = tsk->seccomp.filter;
482 	/* Clean up single-reference branches iteratively. */
483 	while (orig && atomic_dec_and_test(&orig->usage)) {
484 		struct seccomp_filter *freeme = orig;
485 		orig = orig->prev;
486 		seccomp_filter_free(freeme);
487 	}
488 }
489 
490 /**
491  * seccomp_send_sigsys - signals the task to allow in-process syscall emulation
492  * @syscall: syscall number to send to userland
493  * @reason: filter-supplied reason code to send to userland (via si_errno)
494  *
495  * Forces a SIGSYS with a code of SYS_SECCOMP and related sigsys info.
496  */
497 static void seccomp_send_sigsys(int syscall, int reason)
498 {
499 	struct siginfo info;
500 	memset(&info, 0, sizeof(info));
501 	info.si_signo = SIGSYS;
502 	info.si_code = SYS_SECCOMP;
503 	info.si_call_addr = (void __user *)KSTK_EIP(current);
504 	info.si_errno = reason;
505 	info.si_arch = syscall_get_arch();
506 	info.si_syscall = syscall;
507 	force_sig_info(SIGSYS, &info, current);
508 }
509 #endif	/* CONFIG_SECCOMP_FILTER */
510 
511 /*
512  * Secure computing mode 1 allows only read/write/exit/sigreturn.
513  * To be fully secure this must be combined with rlimit
514  * to limit the stack allocations too.
515  */
516 static const int mode1_syscalls[] = {
517 	__NR_seccomp_read, __NR_seccomp_write, __NR_seccomp_exit, __NR_seccomp_sigreturn,
518 	0, /* null terminated */
519 };
520 
521 static void __secure_computing_strict(int this_syscall)
522 {
523 	const int *syscall_whitelist = mode1_syscalls;
524 #ifdef CONFIG_COMPAT
525 	if (in_compat_syscall())
526 		syscall_whitelist = get_compat_mode1_syscalls();
527 #endif
528 	do {
529 		if (*syscall_whitelist == this_syscall)
530 			return;
531 	} while (*++syscall_whitelist);
532 
533 #ifdef SECCOMP_DEBUG
534 	dump_stack();
535 #endif
536 	audit_seccomp(this_syscall, SIGKILL, SECCOMP_RET_KILL);
537 	do_exit(SIGKILL);
538 }
539 
540 #ifndef CONFIG_HAVE_ARCH_SECCOMP_FILTER
541 void secure_computing_strict(int this_syscall)
542 {
543 	int mode = current->seccomp.mode;
544 
545 	if (config_enabled(CONFIG_CHECKPOINT_RESTORE) &&
546 	    unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
547 		return;
548 
549 	if (mode == SECCOMP_MODE_DISABLED)
550 		return;
551 	else if (mode == SECCOMP_MODE_STRICT)
552 		__secure_computing_strict(this_syscall);
553 	else
554 		BUG();
555 }
556 #else
557 
558 #ifdef CONFIG_SECCOMP_FILTER
559 static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
560 			    const bool recheck_after_trace)
561 {
562 	u32 filter_ret, action;
563 	int data;
564 
565 	/*
566 	 * Make sure that any changes to mode from another thread have
567 	 * been seen after TIF_SECCOMP was seen.
568 	 */
569 	rmb();
570 
571 	filter_ret = seccomp_run_filters(sd);
572 	data = filter_ret & SECCOMP_RET_DATA;
573 	action = filter_ret & SECCOMP_RET_ACTION;
574 
575 	switch (action) {
576 	case SECCOMP_RET_ERRNO:
577 		/* Set low-order bits as an errno, capped at MAX_ERRNO. */
578 		if (data > MAX_ERRNO)
579 			data = MAX_ERRNO;
580 		syscall_set_return_value(current, task_pt_regs(current),
581 					 -data, 0);
582 		goto skip;
583 
584 	case SECCOMP_RET_TRAP:
585 		/* Show the handler the original registers. */
586 		syscall_rollback(current, task_pt_regs(current));
587 		/* Let the filter pass back 16 bits of data. */
588 		seccomp_send_sigsys(this_syscall, data);
589 		goto skip;
590 
591 	case SECCOMP_RET_TRACE:
592 		/* We've been put in this state by the ptracer already. */
593 		if (recheck_after_trace)
594 			return 0;
595 
596 		/* ENOSYS these calls if there is no tracer attached. */
597 		if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP)) {
598 			syscall_set_return_value(current,
599 						 task_pt_regs(current),
600 						 -ENOSYS, 0);
601 			goto skip;
602 		}
603 
604 		/* Allow the BPF to provide the event message */
605 		ptrace_event(PTRACE_EVENT_SECCOMP, data);
606 		/*
607 		 * The delivery of a fatal signal during event
608 		 * notification may silently skip tracer notification.
609 		 * Terminating the task now avoids executing a system
610 		 * call that may not be intended.
611 		 */
612 		if (fatal_signal_pending(current))
613 			do_exit(SIGSYS);
614 		/* Check if the tracer forced the syscall to be skipped. */
615 		this_syscall = syscall_get_nr(current, task_pt_regs(current));
616 		if (this_syscall < 0)
617 			goto skip;
618 
619 		/*
620 		 * Recheck the syscall, since it may have changed. This
621 		 * intentionally uses a NULL struct seccomp_data to force
622 		 * a reload of all registers. This does not goto skip since
623 		 * a skip would have already been reported.
624 		 */
625 		if (__seccomp_filter(this_syscall, NULL, true))
626 			return -1;
627 
628 		return 0;
629 
630 	case SECCOMP_RET_ALLOW:
631 		return 0;
632 
633 	case SECCOMP_RET_KILL:
634 	default:
635 		audit_seccomp(this_syscall, SIGSYS, action);
636 		do_exit(SIGSYS);
637 	}
638 
639 	unreachable();
640 
641 skip:
642 	audit_seccomp(this_syscall, 0, action);
643 	return -1;
644 }
645 #else
646 static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
647 			    const bool recheck_after_trace)
648 {
649 	BUG();
650 }
651 #endif
652 
653 int __secure_computing(const struct seccomp_data *sd)
654 {
655 	int mode = current->seccomp.mode;
656 	int this_syscall;
657 
658 	if (config_enabled(CONFIG_CHECKPOINT_RESTORE) &&
659 	    unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
660 		return 0;
661 
662 	this_syscall = sd ? sd->nr :
663 		syscall_get_nr(current, task_pt_regs(current));
664 
665 	switch (mode) {
666 	case SECCOMP_MODE_STRICT:
667 		__secure_computing_strict(this_syscall);  /* may call do_exit */
668 		return 0;
669 	case SECCOMP_MODE_FILTER:
670 		return __seccomp_filter(this_syscall, sd, false);
671 	default:
672 		BUG();
673 	}
674 }
675 #endif /* CONFIG_HAVE_ARCH_SECCOMP_FILTER */
676 
677 long prctl_get_seccomp(void)
678 {
679 	return current->seccomp.mode;
680 }
681 
682 /**
683  * seccomp_set_mode_strict: internal function for setting strict seccomp
684  *
685  * Once current->seccomp.mode is non-zero, it may not be changed.
686  *
687  * Returns 0 on success or -EINVAL on failure.
688  */
689 static long seccomp_set_mode_strict(void)
690 {
691 	const unsigned long seccomp_mode = SECCOMP_MODE_STRICT;
692 	long ret = -EINVAL;
693 
694 	spin_lock_irq(&current->sighand->siglock);
695 
696 	if (!seccomp_may_assign_mode(seccomp_mode))
697 		goto out;
698 
699 #ifdef TIF_NOTSC
700 	disable_TSC();
701 #endif
702 	seccomp_assign_mode(current, seccomp_mode);
703 	ret = 0;
704 
705 out:
706 	spin_unlock_irq(&current->sighand->siglock);
707 
708 	return ret;
709 }
710 
711 #ifdef CONFIG_SECCOMP_FILTER
712 /**
713  * seccomp_set_mode_filter: internal function for setting seccomp filter
714  * @flags:  flags to change filter behavior
715  * @filter: struct sock_fprog containing filter
716  *
717  * This function may be called repeatedly to install additional filters.
718  * Every filter successfully installed will be evaluated (in reverse order)
719  * for each system call the task makes.
720  *
721  * Once current->seccomp.mode is non-zero, it may not be changed.
722  *
723  * Returns 0 on success or -EINVAL on failure.
724  */
725 static long seccomp_set_mode_filter(unsigned int flags,
726 				    const char __user *filter)
727 {
728 	const unsigned long seccomp_mode = SECCOMP_MODE_FILTER;
729 	struct seccomp_filter *prepared = NULL;
730 	long ret = -EINVAL;
731 
732 	/* Validate flags. */
733 	if (flags & ~SECCOMP_FILTER_FLAG_MASK)
734 		return -EINVAL;
735 
736 	/* Prepare the new filter before holding any locks. */
737 	prepared = seccomp_prepare_user_filter(filter);
738 	if (IS_ERR(prepared))
739 		return PTR_ERR(prepared);
740 
741 	/*
742 	 * Make sure we cannot change seccomp or nnp state via TSYNC
743 	 * while another thread is in the middle of calling exec.
744 	 */
745 	if (flags & SECCOMP_FILTER_FLAG_TSYNC &&
746 	    mutex_lock_killable(&current->signal->cred_guard_mutex))
747 		goto out_free;
748 
749 	spin_lock_irq(&current->sighand->siglock);
750 
751 	if (!seccomp_may_assign_mode(seccomp_mode))
752 		goto out;
753 
754 	ret = seccomp_attach_filter(flags, prepared);
755 	if (ret)
756 		goto out;
757 	/* Do not free the successfully attached filter. */
758 	prepared = NULL;
759 
760 	seccomp_assign_mode(current, seccomp_mode);
761 out:
762 	spin_unlock_irq(&current->sighand->siglock);
763 	if (flags & SECCOMP_FILTER_FLAG_TSYNC)
764 		mutex_unlock(&current->signal->cred_guard_mutex);
765 out_free:
766 	seccomp_filter_free(prepared);
767 	return ret;
768 }
769 #else
770 static inline long seccomp_set_mode_filter(unsigned int flags,
771 					   const char __user *filter)
772 {
773 	return -EINVAL;
774 }
775 #endif
776 
777 /* Common entry point for both prctl and syscall. */
778 static long do_seccomp(unsigned int op, unsigned int flags,
779 		       const char __user *uargs)
780 {
781 	switch (op) {
782 	case SECCOMP_SET_MODE_STRICT:
783 		if (flags != 0 || uargs != NULL)
784 			return -EINVAL;
785 		return seccomp_set_mode_strict();
786 	case SECCOMP_SET_MODE_FILTER:
787 		return seccomp_set_mode_filter(flags, uargs);
788 	default:
789 		return -EINVAL;
790 	}
791 }
792 
793 SYSCALL_DEFINE3(seccomp, unsigned int, op, unsigned int, flags,
794 			 const char __user *, uargs)
795 {
796 	return do_seccomp(op, flags, uargs);
797 }
798 
799 /**
800  * prctl_set_seccomp: configures current->seccomp.mode
801  * @seccomp_mode: requested mode to use
802  * @filter: optional struct sock_fprog for use with SECCOMP_MODE_FILTER
803  *
804  * Returns 0 on success or -EINVAL on failure.
805  */
806 long prctl_set_seccomp(unsigned long seccomp_mode, char __user *filter)
807 {
808 	unsigned int op;
809 	char __user *uargs;
810 
811 	switch (seccomp_mode) {
812 	case SECCOMP_MODE_STRICT:
813 		op = SECCOMP_SET_MODE_STRICT;
814 		/*
815 		 * Setting strict mode through prctl always ignored filter,
816 		 * so make sure it is always NULL here to pass the internal
817 		 * check in do_seccomp().
818 		 */
819 		uargs = NULL;
820 		break;
821 	case SECCOMP_MODE_FILTER:
822 		op = SECCOMP_SET_MODE_FILTER;
823 		uargs = filter;
824 		break;
825 	default:
826 		return -EINVAL;
827 	}
828 
829 	/* prctl interface doesn't have flags, so they are always zero. */
830 	return do_seccomp(op, 0, uargs);
831 }
832 
833 #if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
834 long seccomp_get_filter(struct task_struct *task, unsigned long filter_off,
835 			void __user *data)
836 {
837 	struct seccomp_filter *filter;
838 	struct sock_fprog_kern *fprog;
839 	long ret;
840 	unsigned long count = 0;
841 
842 	if (!capable(CAP_SYS_ADMIN) ||
843 	    current->seccomp.mode != SECCOMP_MODE_DISABLED) {
844 		return -EACCES;
845 	}
846 
847 	spin_lock_irq(&task->sighand->siglock);
848 	if (task->seccomp.mode != SECCOMP_MODE_FILTER) {
849 		ret = -EINVAL;
850 		goto out;
851 	}
852 
853 	filter = task->seccomp.filter;
854 	while (filter) {
855 		filter = filter->prev;
856 		count++;
857 	}
858 
859 	if (filter_off >= count) {
860 		ret = -ENOENT;
861 		goto out;
862 	}
863 	count -= filter_off;
864 
865 	filter = task->seccomp.filter;
866 	while (filter && count > 1) {
867 		filter = filter->prev;
868 		count--;
869 	}
870 
871 	if (WARN_ON(count != 1 || !filter)) {
872 		/* The filter tree shouldn't shrink while we're using it. */
873 		ret = -ENOENT;
874 		goto out;
875 	}
876 
877 	fprog = filter->prog->orig_prog;
878 	if (!fprog) {
879 		/* This must be a new non-cBPF filter, since we save
880 		 * every cBPF filter's orig_prog above when
881 		 * CONFIG_CHECKPOINT_RESTORE is enabled.
882 		 */
883 		ret = -EMEDIUMTYPE;
884 		goto out;
885 	}
886 
887 	ret = fprog->len;
888 	if (!data)
889 		goto out;
890 
891 	get_seccomp_filter(task);
892 	spin_unlock_irq(&task->sighand->siglock);
893 
894 	if (copy_to_user(data, fprog->filter, bpf_classic_proglen(fprog)))
895 		ret = -EFAULT;
896 
897 	put_seccomp_filter(task);
898 	return ret;
899 
900 out:
901 	spin_unlock_irq(&task->sighand->siglock);
902 	return ret;
903 }
904 #endif
905