1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * linux/kernel/seccomp.c 4 * 5 * Copyright 2004-2005 Andrea Arcangeli <andrea@cpushare.com> 6 * 7 * Copyright (C) 2012 Google, Inc. 8 * Will Drewry <wad@chromium.org> 9 * 10 * This defines a simple but solid secure-computing facility. 11 * 12 * Mode 1 uses a fixed list of allowed system calls. 13 * Mode 2 allows user-defined system call filters in the form 14 * of Berkeley Packet Filters/Linux Socket Filters. 15 */ 16 17 #include <linux/refcount.h> 18 #include <linux/audit.h> 19 #include <linux/compat.h> 20 #include <linux/coredump.h> 21 #include <linux/kmemleak.h> 22 #include <linux/nospec.h> 23 #include <linux/prctl.h> 24 #include <linux/sched.h> 25 #include <linux/sched/task_stack.h> 26 #include <linux/seccomp.h> 27 #include <linux/slab.h> 28 #include <linux/syscalls.h> 29 #include <linux/sysctl.h> 30 31 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER 32 #include <asm/syscall.h> 33 #endif 34 35 #ifdef CONFIG_SECCOMP_FILTER 36 #include <linux/file.h> 37 #include <linux/filter.h> 38 #include <linux/pid.h> 39 #include <linux/ptrace.h> 40 #include <linux/security.h> 41 #include <linux/tracehook.h> 42 #include <linux/uaccess.h> 43 #include <linux/anon_inodes.h> 44 45 enum notify_state { 46 SECCOMP_NOTIFY_INIT, 47 SECCOMP_NOTIFY_SENT, 48 SECCOMP_NOTIFY_REPLIED, 49 }; 50 51 struct seccomp_knotif { 52 /* The struct pid of the task whose filter triggered the notification */ 53 struct task_struct *task; 54 55 /* The "cookie" for this request; this is unique for this filter. */ 56 u64 id; 57 58 /* 59 * The seccomp data. This pointer is valid the entire time this 60 * notification is active, since it comes from __seccomp_filter which 61 * eclipses the entire lifecycle here. 62 */ 63 const struct seccomp_data *data; 64 65 /* 66 * Notification states. When SECCOMP_RET_USER_NOTIF is returned, a 67 * struct seccomp_knotif is created and starts out in INIT. Once the 68 * handler reads the notification off of an FD, it transitions to SENT. 69 * If a signal is received the state transitions back to INIT and 70 * another message is sent. When the userspace handler replies, state 71 * transitions to REPLIED. 72 */ 73 enum notify_state state; 74 75 /* The return values, only valid when in SECCOMP_NOTIFY_REPLIED */ 76 int error; 77 long val; 78 79 /* Signals when this has entered SECCOMP_NOTIFY_REPLIED */ 80 struct completion ready; 81 82 struct list_head list; 83 }; 84 85 /** 86 * struct notification - container for seccomp userspace notifications. Since 87 * most seccomp filters will not have notification listeners attached and this 88 * structure is fairly large, we store the notification-specific stuff in a 89 * separate structure. 90 * 91 * @request: A semaphore that users of this notification can wait on for 92 * changes. Actual reads and writes are still controlled with 93 * filter->notify_lock. 94 * @next_id: The id of the next request. 95 * @notifications: A list of struct seccomp_knotif elements. 96 * @wqh: A wait queue for poll. 97 */ 98 struct notification { 99 struct semaphore request; 100 u64 next_id; 101 struct list_head notifications; 102 wait_queue_head_t wqh; 103 }; 104 105 /** 106 * struct seccomp_filter - container for seccomp BPF programs 107 * 108 * @usage: reference count to manage the object lifetime. 109 * get/put helpers should be used when accessing an instance 110 * outside of a lifetime-guarded section. In general, this 111 * is only needed for handling filters shared across tasks. 112 * @log: true if all actions except for SECCOMP_RET_ALLOW should be logged 113 * @prev: points to a previously installed, or inherited, filter 114 * @prog: the BPF program to evaluate 115 * @notif: the struct that holds all notification related information 116 * @notify_lock: A lock for all notification-related accesses. 117 * 118 * seccomp_filter objects are organized in a tree linked via the @prev 119 * pointer. For any task, it appears to be a singly-linked list starting 120 * with current->seccomp.filter, the most recently attached or inherited filter. 121 * However, multiple filters may share a @prev node, by way of fork(), which 122 * results in a unidirectional tree existing in memory. This is similar to 123 * how namespaces work. 124 * 125 * seccomp_filter objects should never be modified after being attached 126 * to a task_struct (other than @usage). 127 */ 128 struct seccomp_filter { 129 refcount_t usage; 130 bool log; 131 struct seccomp_filter *prev; 132 struct bpf_prog *prog; 133 struct notification *notif; 134 struct mutex notify_lock; 135 }; 136 137 /* Limit any path through the tree to 256KB worth of instructions. */ 138 #define MAX_INSNS_PER_PATH ((1 << 18) / sizeof(struct sock_filter)) 139 140 /* 141 * Endianness is explicitly ignored and left for BPF program authors to manage 142 * as per the specific architecture. 143 */ 144 static void populate_seccomp_data(struct seccomp_data *sd) 145 { 146 struct task_struct *task = current; 147 struct pt_regs *regs = task_pt_regs(task); 148 unsigned long args[6]; 149 150 sd->nr = syscall_get_nr(task, regs); 151 sd->arch = syscall_get_arch(); 152 syscall_get_arguments(task, regs, 0, 6, args); 153 sd->args[0] = args[0]; 154 sd->args[1] = args[1]; 155 sd->args[2] = args[2]; 156 sd->args[3] = args[3]; 157 sd->args[4] = args[4]; 158 sd->args[5] = args[5]; 159 sd->instruction_pointer = KSTK_EIP(task); 160 } 161 162 /** 163 * seccomp_check_filter - verify seccomp filter code 164 * @filter: filter to verify 165 * @flen: length of filter 166 * 167 * Takes a previously checked filter (by bpf_check_classic) and 168 * redirects all filter code that loads struct sk_buff data 169 * and related data through seccomp_bpf_load. It also 170 * enforces length and alignment checking of those loads. 171 * 172 * Returns 0 if the rule set is legal or -EINVAL if not. 173 */ 174 static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen) 175 { 176 int pc; 177 for (pc = 0; pc < flen; pc++) { 178 struct sock_filter *ftest = &filter[pc]; 179 u16 code = ftest->code; 180 u32 k = ftest->k; 181 182 switch (code) { 183 case BPF_LD | BPF_W | BPF_ABS: 184 ftest->code = BPF_LDX | BPF_W | BPF_ABS; 185 /* 32-bit aligned and not out of bounds. */ 186 if (k >= sizeof(struct seccomp_data) || k & 3) 187 return -EINVAL; 188 continue; 189 case BPF_LD | BPF_W | BPF_LEN: 190 ftest->code = BPF_LD | BPF_IMM; 191 ftest->k = sizeof(struct seccomp_data); 192 continue; 193 case BPF_LDX | BPF_W | BPF_LEN: 194 ftest->code = BPF_LDX | BPF_IMM; 195 ftest->k = sizeof(struct seccomp_data); 196 continue; 197 /* Explicitly include allowed calls. */ 198 case BPF_RET | BPF_K: 199 case BPF_RET | BPF_A: 200 case BPF_ALU | BPF_ADD | BPF_K: 201 case BPF_ALU | BPF_ADD | BPF_X: 202 case BPF_ALU | BPF_SUB | BPF_K: 203 case BPF_ALU | BPF_SUB | BPF_X: 204 case BPF_ALU | BPF_MUL | BPF_K: 205 case BPF_ALU | BPF_MUL | BPF_X: 206 case BPF_ALU | BPF_DIV | BPF_K: 207 case BPF_ALU | BPF_DIV | BPF_X: 208 case BPF_ALU | BPF_AND | BPF_K: 209 case BPF_ALU | BPF_AND | BPF_X: 210 case BPF_ALU | BPF_OR | BPF_K: 211 case BPF_ALU | BPF_OR | BPF_X: 212 case BPF_ALU | BPF_XOR | BPF_K: 213 case BPF_ALU | BPF_XOR | BPF_X: 214 case BPF_ALU | BPF_LSH | BPF_K: 215 case BPF_ALU | BPF_LSH | BPF_X: 216 case BPF_ALU | BPF_RSH | BPF_K: 217 case BPF_ALU | BPF_RSH | BPF_X: 218 case BPF_ALU | BPF_NEG: 219 case BPF_LD | BPF_IMM: 220 case BPF_LDX | BPF_IMM: 221 case BPF_MISC | BPF_TAX: 222 case BPF_MISC | BPF_TXA: 223 case BPF_LD | BPF_MEM: 224 case BPF_LDX | BPF_MEM: 225 case BPF_ST: 226 case BPF_STX: 227 case BPF_JMP | BPF_JA: 228 case BPF_JMP | BPF_JEQ | BPF_K: 229 case BPF_JMP | BPF_JEQ | BPF_X: 230 case BPF_JMP | BPF_JGE | BPF_K: 231 case BPF_JMP | BPF_JGE | BPF_X: 232 case BPF_JMP | BPF_JGT | BPF_K: 233 case BPF_JMP | BPF_JGT | BPF_X: 234 case BPF_JMP | BPF_JSET | BPF_K: 235 case BPF_JMP | BPF_JSET | BPF_X: 236 continue; 237 default: 238 return -EINVAL; 239 } 240 } 241 return 0; 242 } 243 244 /** 245 * seccomp_run_filters - evaluates all seccomp filters against @sd 246 * @sd: optional seccomp data to be passed to filters 247 * @match: stores struct seccomp_filter that resulted in the return value, 248 * unless filter returned SECCOMP_RET_ALLOW, in which case it will 249 * be unchanged. 250 * 251 * Returns valid seccomp BPF response codes. 252 */ 253 #define ACTION_ONLY(ret) ((s32)((ret) & (SECCOMP_RET_ACTION_FULL))) 254 static u32 seccomp_run_filters(const struct seccomp_data *sd, 255 struct seccomp_filter **match) 256 { 257 u32 ret = SECCOMP_RET_ALLOW; 258 /* Make sure cross-thread synced filter points somewhere sane. */ 259 struct seccomp_filter *f = 260 READ_ONCE(current->seccomp.filter); 261 262 /* Ensure unexpected behavior doesn't result in failing open. */ 263 if (WARN_ON(f == NULL)) 264 return SECCOMP_RET_KILL_PROCESS; 265 266 /* 267 * All filters in the list are evaluated and the lowest BPF return 268 * value always takes priority (ignoring the DATA). 269 */ 270 for (; f; f = f->prev) { 271 u32 cur_ret = BPF_PROG_RUN(f->prog, sd); 272 273 if (ACTION_ONLY(cur_ret) < ACTION_ONLY(ret)) { 274 ret = cur_ret; 275 *match = f; 276 } 277 } 278 return ret; 279 } 280 #endif /* CONFIG_SECCOMP_FILTER */ 281 282 static inline bool seccomp_may_assign_mode(unsigned long seccomp_mode) 283 { 284 assert_spin_locked(¤t->sighand->siglock); 285 286 if (current->seccomp.mode && current->seccomp.mode != seccomp_mode) 287 return false; 288 289 return true; 290 } 291 292 void __weak arch_seccomp_spec_mitigate(struct task_struct *task) { } 293 294 static inline void seccomp_assign_mode(struct task_struct *task, 295 unsigned long seccomp_mode, 296 unsigned long flags) 297 { 298 assert_spin_locked(&task->sighand->siglock); 299 300 task->seccomp.mode = seccomp_mode; 301 /* 302 * Make sure TIF_SECCOMP cannot be set before the mode (and 303 * filter) is set. 304 */ 305 smp_mb__before_atomic(); 306 /* Assume default seccomp processes want spec flaw mitigation. */ 307 if ((flags & SECCOMP_FILTER_FLAG_SPEC_ALLOW) == 0) 308 arch_seccomp_spec_mitigate(task); 309 set_tsk_thread_flag(task, TIF_SECCOMP); 310 } 311 312 #ifdef CONFIG_SECCOMP_FILTER 313 /* Returns 1 if the parent is an ancestor of the child. */ 314 static int is_ancestor(struct seccomp_filter *parent, 315 struct seccomp_filter *child) 316 { 317 /* NULL is the root ancestor. */ 318 if (parent == NULL) 319 return 1; 320 for (; child; child = child->prev) 321 if (child == parent) 322 return 1; 323 return 0; 324 } 325 326 /** 327 * seccomp_can_sync_threads: checks if all threads can be synchronized 328 * 329 * Expects sighand and cred_guard_mutex locks to be held. 330 * 331 * Returns 0 on success, -ve on error, or the pid of a thread which was 332 * either not in the correct seccomp mode or it did not have an ancestral 333 * seccomp filter. 334 */ 335 static inline pid_t seccomp_can_sync_threads(void) 336 { 337 struct task_struct *thread, *caller; 338 339 BUG_ON(!mutex_is_locked(¤t->signal->cred_guard_mutex)); 340 assert_spin_locked(¤t->sighand->siglock); 341 342 /* Validate all threads being eligible for synchronization. */ 343 caller = current; 344 for_each_thread(caller, thread) { 345 pid_t failed; 346 347 /* Skip current, since it is initiating the sync. */ 348 if (thread == caller) 349 continue; 350 351 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED || 352 (thread->seccomp.mode == SECCOMP_MODE_FILTER && 353 is_ancestor(thread->seccomp.filter, 354 caller->seccomp.filter))) 355 continue; 356 357 /* Return the first thread that cannot be synchronized. */ 358 failed = task_pid_vnr(thread); 359 /* If the pid cannot be resolved, then return -ESRCH */ 360 if (WARN_ON(failed == 0)) 361 failed = -ESRCH; 362 return failed; 363 } 364 365 return 0; 366 } 367 368 /** 369 * seccomp_sync_threads: sets all threads to use current's filter 370 * 371 * Expects sighand and cred_guard_mutex locks to be held, and for 372 * seccomp_can_sync_threads() to have returned success already 373 * without dropping the locks. 374 * 375 */ 376 static inline void seccomp_sync_threads(unsigned long flags) 377 { 378 struct task_struct *thread, *caller; 379 380 BUG_ON(!mutex_is_locked(¤t->signal->cred_guard_mutex)); 381 assert_spin_locked(¤t->sighand->siglock); 382 383 /* Synchronize all threads. */ 384 caller = current; 385 for_each_thread(caller, thread) { 386 /* Skip current, since it needs no changes. */ 387 if (thread == caller) 388 continue; 389 390 /* Get a task reference for the new leaf node. */ 391 get_seccomp_filter(caller); 392 /* 393 * Drop the task reference to the shared ancestor since 394 * current's path will hold a reference. (This also 395 * allows a put before the assignment.) 396 */ 397 put_seccomp_filter(thread); 398 smp_store_release(&thread->seccomp.filter, 399 caller->seccomp.filter); 400 401 /* 402 * Don't let an unprivileged task work around 403 * the no_new_privs restriction by creating 404 * a thread that sets it up, enters seccomp, 405 * then dies. 406 */ 407 if (task_no_new_privs(caller)) 408 task_set_no_new_privs(thread); 409 410 /* 411 * Opt the other thread into seccomp if needed. 412 * As threads are considered to be trust-realm 413 * equivalent (see ptrace_may_access), it is safe to 414 * allow one thread to transition the other. 415 */ 416 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED) 417 seccomp_assign_mode(thread, SECCOMP_MODE_FILTER, 418 flags); 419 } 420 } 421 422 /** 423 * seccomp_prepare_filter: Prepares a seccomp filter for use. 424 * @fprog: BPF program to install 425 * 426 * Returns filter on success or an ERR_PTR on failure. 427 */ 428 static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog) 429 { 430 struct seccomp_filter *sfilter; 431 int ret; 432 const bool save_orig = IS_ENABLED(CONFIG_CHECKPOINT_RESTORE); 433 434 if (fprog->len == 0 || fprog->len > BPF_MAXINSNS) 435 return ERR_PTR(-EINVAL); 436 437 BUG_ON(INT_MAX / fprog->len < sizeof(struct sock_filter)); 438 439 /* 440 * Installing a seccomp filter requires that the task has 441 * CAP_SYS_ADMIN in its namespace or be running with no_new_privs. 442 * This avoids scenarios where unprivileged tasks can affect the 443 * behavior of privileged children. 444 */ 445 if (!task_no_new_privs(current) && 446 security_capable_noaudit(current_cred(), current_user_ns(), 447 CAP_SYS_ADMIN) != 0) 448 return ERR_PTR(-EACCES); 449 450 /* Allocate a new seccomp_filter */ 451 sfilter = kzalloc(sizeof(*sfilter), GFP_KERNEL | __GFP_NOWARN); 452 if (!sfilter) 453 return ERR_PTR(-ENOMEM); 454 455 mutex_init(&sfilter->notify_lock); 456 ret = bpf_prog_create_from_user(&sfilter->prog, fprog, 457 seccomp_check_filter, save_orig); 458 if (ret < 0) { 459 kfree(sfilter); 460 return ERR_PTR(ret); 461 } 462 463 refcount_set(&sfilter->usage, 1); 464 465 return sfilter; 466 } 467 468 /** 469 * seccomp_prepare_user_filter - prepares a user-supplied sock_fprog 470 * @user_filter: pointer to the user data containing a sock_fprog. 471 * 472 * Returns 0 on success and non-zero otherwise. 473 */ 474 static struct seccomp_filter * 475 seccomp_prepare_user_filter(const char __user *user_filter) 476 { 477 struct sock_fprog fprog; 478 struct seccomp_filter *filter = ERR_PTR(-EFAULT); 479 480 #ifdef CONFIG_COMPAT 481 if (in_compat_syscall()) { 482 struct compat_sock_fprog fprog32; 483 if (copy_from_user(&fprog32, user_filter, sizeof(fprog32))) 484 goto out; 485 fprog.len = fprog32.len; 486 fprog.filter = compat_ptr(fprog32.filter); 487 } else /* falls through to the if below. */ 488 #endif 489 if (copy_from_user(&fprog, user_filter, sizeof(fprog))) 490 goto out; 491 filter = seccomp_prepare_filter(&fprog); 492 out: 493 return filter; 494 } 495 496 /** 497 * seccomp_attach_filter: validate and attach filter 498 * @flags: flags to change filter behavior 499 * @filter: seccomp filter to add to the current process 500 * 501 * Caller must be holding current->sighand->siglock lock. 502 * 503 * Returns 0 on success, -ve on error. 504 */ 505 static long seccomp_attach_filter(unsigned int flags, 506 struct seccomp_filter *filter) 507 { 508 unsigned long total_insns; 509 struct seccomp_filter *walker; 510 511 assert_spin_locked(¤t->sighand->siglock); 512 513 /* Validate resulting filter length. */ 514 total_insns = filter->prog->len; 515 for (walker = current->seccomp.filter; walker; walker = walker->prev) 516 total_insns += walker->prog->len + 4; /* 4 instr penalty */ 517 if (total_insns > MAX_INSNS_PER_PATH) 518 return -ENOMEM; 519 520 /* If thread sync has been requested, check that it is possible. */ 521 if (flags & SECCOMP_FILTER_FLAG_TSYNC) { 522 int ret; 523 524 ret = seccomp_can_sync_threads(); 525 if (ret) 526 return ret; 527 } 528 529 /* Set log flag, if present. */ 530 if (flags & SECCOMP_FILTER_FLAG_LOG) 531 filter->log = true; 532 533 /* 534 * If there is an existing filter, make it the prev and don't drop its 535 * task reference. 536 */ 537 filter->prev = current->seccomp.filter; 538 current->seccomp.filter = filter; 539 540 /* Now that the new filter is in place, synchronize to all threads. */ 541 if (flags & SECCOMP_FILTER_FLAG_TSYNC) 542 seccomp_sync_threads(flags); 543 544 return 0; 545 } 546 547 static void __get_seccomp_filter(struct seccomp_filter *filter) 548 { 549 refcount_inc(&filter->usage); 550 } 551 552 /* get_seccomp_filter - increments the reference count of the filter on @tsk */ 553 void get_seccomp_filter(struct task_struct *tsk) 554 { 555 struct seccomp_filter *orig = tsk->seccomp.filter; 556 if (!orig) 557 return; 558 __get_seccomp_filter(orig); 559 } 560 561 static inline void seccomp_filter_free(struct seccomp_filter *filter) 562 { 563 if (filter) { 564 bpf_prog_destroy(filter->prog); 565 kfree(filter); 566 } 567 } 568 569 static void __put_seccomp_filter(struct seccomp_filter *orig) 570 { 571 /* Clean up single-reference branches iteratively. */ 572 while (orig && refcount_dec_and_test(&orig->usage)) { 573 struct seccomp_filter *freeme = orig; 574 orig = orig->prev; 575 seccomp_filter_free(freeme); 576 } 577 } 578 579 /* put_seccomp_filter - decrements the ref count of tsk->seccomp.filter */ 580 void put_seccomp_filter(struct task_struct *tsk) 581 { 582 __put_seccomp_filter(tsk->seccomp.filter); 583 } 584 585 static void seccomp_init_siginfo(kernel_siginfo_t *info, int syscall, int reason) 586 { 587 clear_siginfo(info); 588 info->si_signo = SIGSYS; 589 info->si_code = SYS_SECCOMP; 590 info->si_call_addr = (void __user *)KSTK_EIP(current); 591 info->si_errno = reason; 592 info->si_arch = syscall_get_arch(); 593 info->si_syscall = syscall; 594 } 595 596 /** 597 * seccomp_send_sigsys - signals the task to allow in-process syscall emulation 598 * @syscall: syscall number to send to userland 599 * @reason: filter-supplied reason code to send to userland (via si_errno) 600 * 601 * Forces a SIGSYS with a code of SYS_SECCOMP and related sigsys info. 602 */ 603 static void seccomp_send_sigsys(int syscall, int reason) 604 { 605 struct kernel_siginfo info; 606 seccomp_init_siginfo(&info, syscall, reason); 607 force_sig_info(SIGSYS, &info, current); 608 } 609 #endif /* CONFIG_SECCOMP_FILTER */ 610 611 /* For use with seccomp_actions_logged */ 612 #define SECCOMP_LOG_KILL_PROCESS (1 << 0) 613 #define SECCOMP_LOG_KILL_THREAD (1 << 1) 614 #define SECCOMP_LOG_TRAP (1 << 2) 615 #define SECCOMP_LOG_ERRNO (1 << 3) 616 #define SECCOMP_LOG_TRACE (1 << 4) 617 #define SECCOMP_LOG_LOG (1 << 5) 618 #define SECCOMP_LOG_ALLOW (1 << 6) 619 #define SECCOMP_LOG_USER_NOTIF (1 << 7) 620 621 static u32 seccomp_actions_logged = SECCOMP_LOG_KILL_PROCESS | 622 SECCOMP_LOG_KILL_THREAD | 623 SECCOMP_LOG_TRAP | 624 SECCOMP_LOG_ERRNO | 625 SECCOMP_LOG_USER_NOTIF | 626 SECCOMP_LOG_TRACE | 627 SECCOMP_LOG_LOG; 628 629 static inline void seccomp_log(unsigned long syscall, long signr, u32 action, 630 bool requested) 631 { 632 bool log = false; 633 634 switch (action) { 635 case SECCOMP_RET_ALLOW: 636 break; 637 case SECCOMP_RET_TRAP: 638 log = requested && seccomp_actions_logged & SECCOMP_LOG_TRAP; 639 break; 640 case SECCOMP_RET_ERRNO: 641 log = requested && seccomp_actions_logged & SECCOMP_LOG_ERRNO; 642 break; 643 case SECCOMP_RET_TRACE: 644 log = requested && seccomp_actions_logged & SECCOMP_LOG_TRACE; 645 break; 646 case SECCOMP_RET_USER_NOTIF: 647 log = requested && seccomp_actions_logged & SECCOMP_LOG_USER_NOTIF; 648 break; 649 case SECCOMP_RET_LOG: 650 log = seccomp_actions_logged & SECCOMP_LOG_LOG; 651 break; 652 case SECCOMP_RET_KILL_THREAD: 653 log = seccomp_actions_logged & SECCOMP_LOG_KILL_THREAD; 654 break; 655 case SECCOMP_RET_KILL_PROCESS: 656 default: 657 log = seccomp_actions_logged & SECCOMP_LOG_KILL_PROCESS; 658 } 659 660 /* 661 * Emit an audit message when the action is RET_KILL_*, RET_LOG, or the 662 * FILTER_FLAG_LOG bit was set. The admin has the ability to silence 663 * any action from being logged by removing the action name from the 664 * seccomp_actions_logged sysctl. 665 */ 666 if (!log) 667 return; 668 669 audit_seccomp(syscall, signr, action); 670 } 671 672 /* 673 * Secure computing mode 1 allows only read/write/exit/sigreturn. 674 * To be fully secure this must be combined with rlimit 675 * to limit the stack allocations too. 676 */ 677 static const int mode1_syscalls[] = { 678 __NR_seccomp_read, __NR_seccomp_write, __NR_seccomp_exit, __NR_seccomp_sigreturn, 679 0, /* null terminated */ 680 }; 681 682 static void __secure_computing_strict(int this_syscall) 683 { 684 const int *syscall_whitelist = mode1_syscalls; 685 #ifdef CONFIG_COMPAT 686 if (in_compat_syscall()) 687 syscall_whitelist = get_compat_mode1_syscalls(); 688 #endif 689 do { 690 if (*syscall_whitelist == this_syscall) 691 return; 692 } while (*++syscall_whitelist); 693 694 #ifdef SECCOMP_DEBUG 695 dump_stack(); 696 #endif 697 seccomp_log(this_syscall, SIGKILL, SECCOMP_RET_KILL_THREAD, true); 698 do_exit(SIGKILL); 699 } 700 701 #ifndef CONFIG_HAVE_ARCH_SECCOMP_FILTER 702 void secure_computing_strict(int this_syscall) 703 { 704 int mode = current->seccomp.mode; 705 706 if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) && 707 unlikely(current->ptrace & PT_SUSPEND_SECCOMP)) 708 return; 709 710 if (mode == SECCOMP_MODE_DISABLED) 711 return; 712 else if (mode == SECCOMP_MODE_STRICT) 713 __secure_computing_strict(this_syscall); 714 else 715 BUG(); 716 } 717 #else 718 719 #ifdef CONFIG_SECCOMP_FILTER 720 static u64 seccomp_next_notify_id(struct seccomp_filter *filter) 721 { 722 /* 723 * Note: overflow is ok here, the id just needs to be unique per 724 * filter. 725 */ 726 lockdep_assert_held(&filter->notify_lock); 727 return filter->notif->next_id++; 728 } 729 730 static void seccomp_do_user_notification(int this_syscall, 731 struct seccomp_filter *match, 732 const struct seccomp_data *sd) 733 { 734 int err; 735 long ret = 0; 736 struct seccomp_knotif n = {}; 737 738 mutex_lock(&match->notify_lock); 739 err = -ENOSYS; 740 if (!match->notif) 741 goto out; 742 743 n.task = current; 744 n.state = SECCOMP_NOTIFY_INIT; 745 n.data = sd; 746 n.id = seccomp_next_notify_id(match); 747 init_completion(&n.ready); 748 list_add(&n.list, &match->notif->notifications); 749 750 up(&match->notif->request); 751 wake_up_poll(&match->notif->wqh, EPOLLIN | EPOLLRDNORM); 752 mutex_unlock(&match->notify_lock); 753 754 /* 755 * This is where we wait for a reply from userspace. 756 */ 757 err = wait_for_completion_interruptible(&n.ready); 758 mutex_lock(&match->notify_lock); 759 if (err == 0) { 760 ret = n.val; 761 err = n.error; 762 } 763 764 /* 765 * Note that it's possible the listener died in between the time when 766 * we were notified of a respons (or a signal) and when we were able to 767 * re-acquire the lock, so only delete from the list if the 768 * notification actually exists. 769 * 770 * Also note that this test is only valid because there's no way to 771 * *reattach* to a notifier right now. If one is added, we'll need to 772 * keep track of the notif itself and make sure they match here. 773 */ 774 if (match->notif) 775 list_del(&n.list); 776 out: 777 mutex_unlock(&match->notify_lock); 778 syscall_set_return_value(current, task_pt_regs(current), 779 err, ret); 780 } 781 782 static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd, 783 const bool recheck_after_trace) 784 { 785 u32 filter_ret, action; 786 struct seccomp_filter *match = NULL; 787 int data; 788 struct seccomp_data sd_local; 789 790 /* 791 * Make sure that any changes to mode from another thread have 792 * been seen after TIF_SECCOMP was seen. 793 */ 794 rmb(); 795 796 if (!sd) { 797 populate_seccomp_data(&sd_local); 798 sd = &sd_local; 799 } 800 801 filter_ret = seccomp_run_filters(sd, &match); 802 data = filter_ret & SECCOMP_RET_DATA; 803 action = filter_ret & SECCOMP_RET_ACTION_FULL; 804 805 switch (action) { 806 case SECCOMP_RET_ERRNO: 807 /* Set low-order bits as an errno, capped at MAX_ERRNO. */ 808 if (data > MAX_ERRNO) 809 data = MAX_ERRNO; 810 syscall_set_return_value(current, task_pt_regs(current), 811 -data, 0); 812 goto skip; 813 814 case SECCOMP_RET_TRAP: 815 /* Show the handler the original registers. */ 816 syscall_rollback(current, task_pt_regs(current)); 817 /* Let the filter pass back 16 bits of data. */ 818 seccomp_send_sigsys(this_syscall, data); 819 goto skip; 820 821 case SECCOMP_RET_TRACE: 822 /* We've been put in this state by the ptracer already. */ 823 if (recheck_after_trace) 824 return 0; 825 826 /* ENOSYS these calls if there is no tracer attached. */ 827 if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP)) { 828 syscall_set_return_value(current, 829 task_pt_regs(current), 830 -ENOSYS, 0); 831 goto skip; 832 } 833 834 /* Allow the BPF to provide the event message */ 835 ptrace_event(PTRACE_EVENT_SECCOMP, data); 836 /* 837 * The delivery of a fatal signal during event 838 * notification may silently skip tracer notification, 839 * which could leave us with a potentially unmodified 840 * syscall that the tracer would have liked to have 841 * changed. Since the process is about to die, we just 842 * force the syscall to be skipped and let the signal 843 * kill the process and correctly handle any tracer exit 844 * notifications. 845 */ 846 if (fatal_signal_pending(current)) 847 goto skip; 848 /* Check if the tracer forced the syscall to be skipped. */ 849 this_syscall = syscall_get_nr(current, task_pt_regs(current)); 850 if (this_syscall < 0) 851 goto skip; 852 853 /* 854 * Recheck the syscall, since it may have changed. This 855 * intentionally uses a NULL struct seccomp_data to force 856 * a reload of all registers. This does not goto skip since 857 * a skip would have already been reported. 858 */ 859 if (__seccomp_filter(this_syscall, NULL, true)) 860 return -1; 861 862 return 0; 863 864 case SECCOMP_RET_USER_NOTIF: 865 seccomp_do_user_notification(this_syscall, match, sd); 866 goto skip; 867 868 case SECCOMP_RET_LOG: 869 seccomp_log(this_syscall, 0, action, true); 870 return 0; 871 872 case SECCOMP_RET_ALLOW: 873 /* 874 * Note that the "match" filter will always be NULL for 875 * this action since SECCOMP_RET_ALLOW is the starting 876 * state in seccomp_run_filters(). 877 */ 878 return 0; 879 880 case SECCOMP_RET_KILL_THREAD: 881 case SECCOMP_RET_KILL_PROCESS: 882 default: 883 seccomp_log(this_syscall, SIGSYS, action, true); 884 /* Dump core only if this is the last remaining thread. */ 885 if (action == SECCOMP_RET_KILL_PROCESS || 886 get_nr_threads(current) == 1) { 887 kernel_siginfo_t info; 888 889 /* Show the original registers in the dump. */ 890 syscall_rollback(current, task_pt_regs(current)); 891 /* Trigger a manual coredump since do_exit skips it. */ 892 seccomp_init_siginfo(&info, this_syscall, data); 893 do_coredump(&info); 894 } 895 if (action == SECCOMP_RET_KILL_PROCESS) 896 do_group_exit(SIGSYS); 897 else 898 do_exit(SIGSYS); 899 } 900 901 unreachable(); 902 903 skip: 904 seccomp_log(this_syscall, 0, action, match ? match->log : false); 905 return -1; 906 } 907 #else 908 static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd, 909 const bool recheck_after_trace) 910 { 911 BUG(); 912 } 913 #endif 914 915 int __secure_computing(const struct seccomp_data *sd) 916 { 917 int mode = current->seccomp.mode; 918 int this_syscall; 919 920 if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) && 921 unlikely(current->ptrace & PT_SUSPEND_SECCOMP)) 922 return 0; 923 924 this_syscall = sd ? sd->nr : 925 syscall_get_nr(current, task_pt_regs(current)); 926 927 switch (mode) { 928 case SECCOMP_MODE_STRICT: 929 __secure_computing_strict(this_syscall); /* may call do_exit */ 930 return 0; 931 case SECCOMP_MODE_FILTER: 932 return __seccomp_filter(this_syscall, sd, false); 933 default: 934 BUG(); 935 } 936 } 937 #endif /* CONFIG_HAVE_ARCH_SECCOMP_FILTER */ 938 939 long prctl_get_seccomp(void) 940 { 941 return current->seccomp.mode; 942 } 943 944 /** 945 * seccomp_set_mode_strict: internal function for setting strict seccomp 946 * 947 * Once current->seccomp.mode is non-zero, it may not be changed. 948 * 949 * Returns 0 on success or -EINVAL on failure. 950 */ 951 static long seccomp_set_mode_strict(void) 952 { 953 const unsigned long seccomp_mode = SECCOMP_MODE_STRICT; 954 long ret = -EINVAL; 955 956 spin_lock_irq(¤t->sighand->siglock); 957 958 if (!seccomp_may_assign_mode(seccomp_mode)) 959 goto out; 960 961 #ifdef TIF_NOTSC 962 disable_TSC(); 963 #endif 964 seccomp_assign_mode(current, seccomp_mode, 0); 965 ret = 0; 966 967 out: 968 spin_unlock_irq(¤t->sighand->siglock); 969 970 return ret; 971 } 972 973 #ifdef CONFIG_SECCOMP_FILTER 974 static int seccomp_notify_release(struct inode *inode, struct file *file) 975 { 976 struct seccomp_filter *filter = file->private_data; 977 struct seccomp_knotif *knotif; 978 979 if (!filter) 980 return 0; 981 982 mutex_lock(&filter->notify_lock); 983 984 /* 985 * If this file is being closed because e.g. the task who owned it 986 * died, let's wake everyone up who was waiting on us. 987 */ 988 list_for_each_entry(knotif, &filter->notif->notifications, list) { 989 if (knotif->state == SECCOMP_NOTIFY_REPLIED) 990 continue; 991 992 knotif->state = SECCOMP_NOTIFY_REPLIED; 993 knotif->error = -ENOSYS; 994 knotif->val = 0; 995 996 complete(&knotif->ready); 997 } 998 999 kfree(filter->notif); 1000 filter->notif = NULL; 1001 mutex_unlock(&filter->notify_lock); 1002 __put_seccomp_filter(filter); 1003 return 0; 1004 } 1005 1006 static long seccomp_notify_recv(struct seccomp_filter *filter, 1007 void __user *buf) 1008 { 1009 struct seccomp_knotif *knotif = NULL, *cur; 1010 struct seccomp_notif unotif; 1011 ssize_t ret; 1012 1013 memset(&unotif, 0, sizeof(unotif)); 1014 1015 ret = down_interruptible(&filter->notif->request); 1016 if (ret < 0) 1017 return ret; 1018 1019 mutex_lock(&filter->notify_lock); 1020 list_for_each_entry(cur, &filter->notif->notifications, list) { 1021 if (cur->state == SECCOMP_NOTIFY_INIT) { 1022 knotif = cur; 1023 break; 1024 } 1025 } 1026 1027 /* 1028 * If we didn't find a notification, it could be that the task was 1029 * interrupted by a fatal signal between the time we were woken and 1030 * when we were able to acquire the rw lock. 1031 */ 1032 if (!knotif) { 1033 ret = -ENOENT; 1034 goto out; 1035 } 1036 1037 unotif.id = knotif->id; 1038 unotif.pid = task_pid_vnr(knotif->task); 1039 unotif.data = *(knotif->data); 1040 1041 knotif->state = SECCOMP_NOTIFY_SENT; 1042 wake_up_poll(&filter->notif->wqh, EPOLLOUT | EPOLLWRNORM); 1043 ret = 0; 1044 out: 1045 mutex_unlock(&filter->notify_lock); 1046 1047 if (ret == 0 && copy_to_user(buf, &unotif, sizeof(unotif))) { 1048 ret = -EFAULT; 1049 1050 /* 1051 * Userspace screwed up. To make sure that we keep this 1052 * notification alive, let's reset it back to INIT. It 1053 * may have died when we released the lock, so we need to make 1054 * sure it's still around. 1055 */ 1056 knotif = NULL; 1057 mutex_lock(&filter->notify_lock); 1058 list_for_each_entry(cur, &filter->notif->notifications, list) { 1059 if (cur->id == unotif.id) { 1060 knotif = cur; 1061 break; 1062 } 1063 } 1064 1065 if (knotif) { 1066 knotif->state = SECCOMP_NOTIFY_INIT; 1067 up(&filter->notif->request); 1068 } 1069 mutex_unlock(&filter->notify_lock); 1070 } 1071 1072 return ret; 1073 } 1074 1075 static long seccomp_notify_send(struct seccomp_filter *filter, 1076 void __user *buf) 1077 { 1078 struct seccomp_notif_resp resp = {}; 1079 struct seccomp_knotif *knotif = NULL, *cur; 1080 long ret; 1081 1082 if (copy_from_user(&resp, buf, sizeof(resp))) 1083 return -EFAULT; 1084 1085 if (resp.flags) 1086 return -EINVAL; 1087 1088 ret = mutex_lock_interruptible(&filter->notify_lock); 1089 if (ret < 0) 1090 return ret; 1091 1092 list_for_each_entry(cur, &filter->notif->notifications, list) { 1093 if (cur->id == resp.id) { 1094 knotif = cur; 1095 break; 1096 } 1097 } 1098 1099 if (!knotif) { 1100 ret = -ENOENT; 1101 goto out; 1102 } 1103 1104 /* Allow exactly one reply. */ 1105 if (knotif->state != SECCOMP_NOTIFY_SENT) { 1106 ret = -EINPROGRESS; 1107 goto out; 1108 } 1109 1110 ret = 0; 1111 knotif->state = SECCOMP_NOTIFY_REPLIED; 1112 knotif->error = resp.error; 1113 knotif->val = resp.val; 1114 complete(&knotif->ready); 1115 out: 1116 mutex_unlock(&filter->notify_lock); 1117 return ret; 1118 } 1119 1120 static long seccomp_notify_id_valid(struct seccomp_filter *filter, 1121 void __user *buf) 1122 { 1123 struct seccomp_knotif *knotif = NULL; 1124 u64 id; 1125 long ret; 1126 1127 if (copy_from_user(&id, buf, sizeof(id))) 1128 return -EFAULT; 1129 1130 ret = mutex_lock_interruptible(&filter->notify_lock); 1131 if (ret < 0) 1132 return ret; 1133 1134 ret = -ENOENT; 1135 list_for_each_entry(knotif, &filter->notif->notifications, list) { 1136 if (knotif->id == id) { 1137 if (knotif->state == SECCOMP_NOTIFY_SENT) 1138 ret = 0; 1139 goto out; 1140 } 1141 } 1142 1143 out: 1144 mutex_unlock(&filter->notify_lock); 1145 return ret; 1146 } 1147 1148 static long seccomp_notify_ioctl(struct file *file, unsigned int cmd, 1149 unsigned long arg) 1150 { 1151 struct seccomp_filter *filter = file->private_data; 1152 void __user *buf = (void __user *)arg; 1153 1154 switch (cmd) { 1155 case SECCOMP_IOCTL_NOTIF_RECV: 1156 return seccomp_notify_recv(filter, buf); 1157 case SECCOMP_IOCTL_NOTIF_SEND: 1158 return seccomp_notify_send(filter, buf); 1159 case SECCOMP_IOCTL_NOTIF_ID_VALID: 1160 return seccomp_notify_id_valid(filter, buf); 1161 default: 1162 return -EINVAL; 1163 } 1164 } 1165 1166 static __poll_t seccomp_notify_poll(struct file *file, 1167 struct poll_table_struct *poll_tab) 1168 { 1169 struct seccomp_filter *filter = file->private_data; 1170 __poll_t ret = 0; 1171 struct seccomp_knotif *cur; 1172 1173 poll_wait(file, &filter->notif->wqh, poll_tab); 1174 1175 if (mutex_lock_interruptible(&filter->notify_lock) < 0) 1176 return EPOLLERR; 1177 1178 list_for_each_entry(cur, &filter->notif->notifications, list) { 1179 if (cur->state == SECCOMP_NOTIFY_INIT) 1180 ret |= EPOLLIN | EPOLLRDNORM; 1181 if (cur->state == SECCOMP_NOTIFY_SENT) 1182 ret |= EPOLLOUT | EPOLLWRNORM; 1183 if ((ret & EPOLLIN) && (ret & EPOLLOUT)) 1184 break; 1185 } 1186 1187 mutex_unlock(&filter->notify_lock); 1188 1189 return ret; 1190 } 1191 1192 static const struct file_operations seccomp_notify_ops = { 1193 .poll = seccomp_notify_poll, 1194 .release = seccomp_notify_release, 1195 .unlocked_ioctl = seccomp_notify_ioctl, 1196 }; 1197 1198 static struct file *init_listener(struct seccomp_filter *filter) 1199 { 1200 struct file *ret = ERR_PTR(-EBUSY); 1201 struct seccomp_filter *cur; 1202 1203 for (cur = current->seccomp.filter; cur; cur = cur->prev) { 1204 if (cur->notif) 1205 goto out; 1206 } 1207 1208 ret = ERR_PTR(-ENOMEM); 1209 filter->notif = kzalloc(sizeof(*(filter->notif)), GFP_KERNEL); 1210 if (!filter->notif) 1211 goto out; 1212 1213 sema_init(&filter->notif->request, 0); 1214 filter->notif->next_id = get_random_u64(); 1215 INIT_LIST_HEAD(&filter->notif->notifications); 1216 init_waitqueue_head(&filter->notif->wqh); 1217 1218 ret = anon_inode_getfile("seccomp notify", &seccomp_notify_ops, 1219 filter, O_RDWR); 1220 if (IS_ERR(ret)) 1221 goto out_notif; 1222 1223 /* The file has a reference to it now */ 1224 __get_seccomp_filter(filter); 1225 1226 out_notif: 1227 if (IS_ERR(ret)) 1228 kfree(filter->notif); 1229 out: 1230 return ret; 1231 } 1232 1233 /** 1234 * seccomp_set_mode_filter: internal function for setting seccomp filter 1235 * @flags: flags to change filter behavior 1236 * @filter: struct sock_fprog containing filter 1237 * 1238 * This function may be called repeatedly to install additional filters. 1239 * Every filter successfully installed will be evaluated (in reverse order) 1240 * for each system call the task makes. 1241 * 1242 * Once current->seccomp.mode is non-zero, it may not be changed. 1243 * 1244 * Returns 0 on success or -EINVAL on failure. 1245 */ 1246 static long seccomp_set_mode_filter(unsigned int flags, 1247 const char __user *filter) 1248 { 1249 const unsigned long seccomp_mode = SECCOMP_MODE_FILTER; 1250 struct seccomp_filter *prepared = NULL; 1251 long ret = -EINVAL; 1252 int listener = -1; 1253 struct file *listener_f = NULL; 1254 1255 /* Validate flags. */ 1256 if (flags & ~SECCOMP_FILTER_FLAG_MASK) 1257 return -EINVAL; 1258 1259 /* Prepare the new filter before holding any locks. */ 1260 prepared = seccomp_prepare_user_filter(filter); 1261 if (IS_ERR(prepared)) 1262 return PTR_ERR(prepared); 1263 1264 if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) { 1265 listener = get_unused_fd_flags(O_CLOEXEC); 1266 if (listener < 0) { 1267 ret = listener; 1268 goto out_free; 1269 } 1270 1271 listener_f = init_listener(prepared); 1272 if (IS_ERR(listener_f)) { 1273 put_unused_fd(listener); 1274 ret = PTR_ERR(listener_f); 1275 goto out_free; 1276 } 1277 } 1278 1279 /* 1280 * Make sure we cannot change seccomp or nnp state via TSYNC 1281 * while another thread is in the middle of calling exec. 1282 */ 1283 if (flags & SECCOMP_FILTER_FLAG_TSYNC && 1284 mutex_lock_killable(¤t->signal->cred_guard_mutex)) 1285 goto out_put_fd; 1286 1287 spin_lock_irq(¤t->sighand->siglock); 1288 1289 if (!seccomp_may_assign_mode(seccomp_mode)) 1290 goto out; 1291 1292 ret = seccomp_attach_filter(flags, prepared); 1293 if (ret) 1294 goto out; 1295 /* Do not free the successfully attached filter. */ 1296 prepared = NULL; 1297 1298 seccomp_assign_mode(current, seccomp_mode, flags); 1299 out: 1300 spin_unlock_irq(¤t->sighand->siglock); 1301 if (flags & SECCOMP_FILTER_FLAG_TSYNC) 1302 mutex_unlock(¤t->signal->cred_guard_mutex); 1303 out_put_fd: 1304 if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) { 1305 if (ret < 0) { 1306 listener_f->private_data = NULL; 1307 fput(listener_f); 1308 put_unused_fd(listener); 1309 } else { 1310 fd_install(listener, listener_f); 1311 ret = listener; 1312 } 1313 } 1314 out_free: 1315 seccomp_filter_free(prepared); 1316 return ret; 1317 } 1318 #else 1319 static inline long seccomp_set_mode_filter(unsigned int flags, 1320 const char __user *filter) 1321 { 1322 return -EINVAL; 1323 } 1324 #endif 1325 1326 static long seccomp_get_action_avail(const char __user *uaction) 1327 { 1328 u32 action; 1329 1330 if (copy_from_user(&action, uaction, sizeof(action))) 1331 return -EFAULT; 1332 1333 switch (action) { 1334 case SECCOMP_RET_KILL_PROCESS: 1335 case SECCOMP_RET_KILL_THREAD: 1336 case SECCOMP_RET_TRAP: 1337 case SECCOMP_RET_ERRNO: 1338 case SECCOMP_RET_USER_NOTIF: 1339 case SECCOMP_RET_TRACE: 1340 case SECCOMP_RET_LOG: 1341 case SECCOMP_RET_ALLOW: 1342 break; 1343 default: 1344 return -EOPNOTSUPP; 1345 } 1346 1347 return 0; 1348 } 1349 1350 static long seccomp_get_notif_sizes(void __user *usizes) 1351 { 1352 struct seccomp_notif_sizes sizes = { 1353 .seccomp_notif = sizeof(struct seccomp_notif), 1354 .seccomp_notif_resp = sizeof(struct seccomp_notif_resp), 1355 .seccomp_data = sizeof(struct seccomp_data), 1356 }; 1357 1358 if (copy_to_user(usizes, &sizes, sizeof(sizes))) 1359 return -EFAULT; 1360 1361 return 0; 1362 } 1363 1364 /* Common entry point for both prctl and syscall. */ 1365 static long do_seccomp(unsigned int op, unsigned int flags, 1366 void __user *uargs) 1367 { 1368 switch (op) { 1369 case SECCOMP_SET_MODE_STRICT: 1370 if (flags != 0 || uargs != NULL) 1371 return -EINVAL; 1372 return seccomp_set_mode_strict(); 1373 case SECCOMP_SET_MODE_FILTER: 1374 return seccomp_set_mode_filter(flags, uargs); 1375 case SECCOMP_GET_ACTION_AVAIL: 1376 if (flags != 0) 1377 return -EINVAL; 1378 1379 return seccomp_get_action_avail(uargs); 1380 case SECCOMP_GET_NOTIF_SIZES: 1381 if (flags != 0) 1382 return -EINVAL; 1383 1384 return seccomp_get_notif_sizes(uargs); 1385 default: 1386 return -EINVAL; 1387 } 1388 } 1389 1390 SYSCALL_DEFINE3(seccomp, unsigned int, op, unsigned int, flags, 1391 void __user *, uargs) 1392 { 1393 return do_seccomp(op, flags, uargs); 1394 } 1395 1396 /** 1397 * prctl_set_seccomp: configures current->seccomp.mode 1398 * @seccomp_mode: requested mode to use 1399 * @filter: optional struct sock_fprog for use with SECCOMP_MODE_FILTER 1400 * 1401 * Returns 0 on success or -EINVAL on failure. 1402 */ 1403 long prctl_set_seccomp(unsigned long seccomp_mode, void __user *filter) 1404 { 1405 unsigned int op; 1406 void __user *uargs; 1407 1408 switch (seccomp_mode) { 1409 case SECCOMP_MODE_STRICT: 1410 op = SECCOMP_SET_MODE_STRICT; 1411 /* 1412 * Setting strict mode through prctl always ignored filter, 1413 * so make sure it is always NULL here to pass the internal 1414 * check in do_seccomp(). 1415 */ 1416 uargs = NULL; 1417 break; 1418 case SECCOMP_MODE_FILTER: 1419 op = SECCOMP_SET_MODE_FILTER; 1420 uargs = filter; 1421 break; 1422 default: 1423 return -EINVAL; 1424 } 1425 1426 /* prctl interface doesn't have flags, so they are always zero. */ 1427 return do_seccomp(op, 0, uargs); 1428 } 1429 1430 #if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE) 1431 static struct seccomp_filter *get_nth_filter(struct task_struct *task, 1432 unsigned long filter_off) 1433 { 1434 struct seccomp_filter *orig, *filter; 1435 unsigned long count; 1436 1437 /* 1438 * Note: this is only correct because the caller should be the (ptrace) 1439 * tracer of the task, otherwise lock_task_sighand is needed. 1440 */ 1441 spin_lock_irq(&task->sighand->siglock); 1442 1443 if (task->seccomp.mode != SECCOMP_MODE_FILTER) { 1444 spin_unlock_irq(&task->sighand->siglock); 1445 return ERR_PTR(-EINVAL); 1446 } 1447 1448 orig = task->seccomp.filter; 1449 __get_seccomp_filter(orig); 1450 spin_unlock_irq(&task->sighand->siglock); 1451 1452 count = 0; 1453 for (filter = orig; filter; filter = filter->prev) 1454 count++; 1455 1456 if (filter_off >= count) { 1457 filter = ERR_PTR(-ENOENT); 1458 goto out; 1459 } 1460 1461 count -= filter_off; 1462 for (filter = orig; filter && count > 1; filter = filter->prev) 1463 count--; 1464 1465 if (WARN_ON(count != 1 || !filter)) { 1466 filter = ERR_PTR(-ENOENT); 1467 goto out; 1468 } 1469 1470 __get_seccomp_filter(filter); 1471 1472 out: 1473 __put_seccomp_filter(orig); 1474 return filter; 1475 } 1476 1477 long seccomp_get_filter(struct task_struct *task, unsigned long filter_off, 1478 void __user *data) 1479 { 1480 struct seccomp_filter *filter; 1481 struct sock_fprog_kern *fprog; 1482 long ret; 1483 1484 if (!capable(CAP_SYS_ADMIN) || 1485 current->seccomp.mode != SECCOMP_MODE_DISABLED) { 1486 return -EACCES; 1487 } 1488 1489 filter = get_nth_filter(task, filter_off); 1490 if (IS_ERR(filter)) 1491 return PTR_ERR(filter); 1492 1493 fprog = filter->prog->orig_prog; 1494 if (!fprog) { 1495 /* This must be a new non-cBPF filter, since we save 1496 * every cBPF filter's orig_prog above when 1497 * CONFIG_CHECKPOINT_RESTORE is enabled. 1498 */ 1499 ret = -EMEDIUMTYPE; 1500 goto out; 1501 } 1502 1503 ret = fprog->len; 1504 if (!data) 1505 goto out; 1506 1507 if (copy_to_user(data, fprog->filter, bpf_classic_proglen(fprog))) 1508 ret = -EFAULT; 1509 1510 out: 1511 __put_seccomp_filter(filter); 1512 return ret; 1513 } 1514 1515 long seccomp_get_metadata(struct task_struct *task, 1516 unsigned long size, void __user *data) 1517 { 1518 long ret; 1519 struct seccomp_filter *filter; 1520 struct seccomp_metadata kmd = {}; 1521 1522 if (!capable(CAP_SYS_ADMIN) || 1523 current->seccomp.mode != SECCOMP_MODE_DISABLED) { 1524 return -EACCES; 1525 } 1526 1527 size = min_t(unsigned long, size, sizeof(kmd)); 1528 1529 if (size < sizeof(kmd.filter_off)) 1530 return -EINVAL; 1531 1532 if (copy_from_user(&kmd.filter_off, data, sizeof(kmd.filter_off))) 1533 return -EFAULT; 1534 1535 filter = get_nth_filter(task, kmd.filter_off); 1536 if (IS_ERR(filter)) 1537 return PTR_ERR(filter); 1538 1539 if (filter->log) 1540 kmd.flags |= SECCOMP_FILTER_FLAG_LOG; 1541 1542 ret = size; 1543 if (copy_to_user(data, &kmd, size)) 1544 ret = -EFAULT; 1545 1546 __put_seccomp_filter(filter); 1547 return ret; 1548 } 1549 #endif 1550 1551 #ifdef CONFIG_SYSCTL 1552 1553 /* Human readable action names for friendly sysctl interaction */ 1554 #define SECCOMP_RET_KILL_PROCESS_NAME "kill_process" 1555 #define SECCOMP_RET_KILL_THREAD_NAME "kill_thread" 1556 #define SECCOMP_RET_TRAP_NAME "trap" 1557 #define SECCOMP_RET_ERRNO_NAME "errno" 1558 #define SECCOMP_RET_USER_NOTIF_NAME "user_notif" 1559 #define SECCOMP_RET_TRACE_NAME "trace" 1560 #define SECCOMP_RET_LOG_NAME "log" 1561 #define SECCOMP_RET_ALLOW_NAME "allow" 1562 1563 static const char seccomp_actions_avail[] = 1564 SECCOMP_RET_KILL_PROCESS_NAME " " 1565 SECCOMP_RET_KILL_THREAD_NAME " " 1566 SECCOMP_RET_TRAP_NAME " " 1567 SECCOMP_RET_ERRNO_NAME " " 1568 SECCOMP_RET_USER_NOTIF_NAME " " 1569 SECCOMP_RET_TRACE_NAME " " 1570 SECCOMP_RET_LOG_NAME " " 1571 SECCOMP_RET_ALLOW_NAME; 1572 1573 struct seccomp_log_name { 1574 u32 log; 1575 const char *name; 1576 }; 1577 1578 static const struct seccomp_log_name seccomp_log_names[] = { 1579 { SECCOMP_LOG_KILL_PROCESS, SECCOMP_RET_KILL_PROCESS_NAME }, 1580 { SECCOMP_LOG_KILL_THREAD, SECCOMP_RET_KILL_THREAD_NAME }, 1581 { SECCOMP_LOG_TRAP, SECCOMP_RET_TRAP_NAME }, 1582 { SECCOMP_LOG_ERRNO, SECCOMP_RET_ERRNO_NAME }, 1583 { SECCOMP_LOG_USER_NOTIF, SECCOMP_RET_USER_NOTIF_NAME }, 1584 { SECCOMP_LOG_TRACE, SECCOMP_RET_TRACE_NAME }, 1585 { SECCOMP_LOG_LOG, SECCOMP_RET_LOG_NAME }, 1586 { SECCOMP_LOG_ALLOW, SECCOMP_RET_ALLOW_NAME }, 1587 { } 1588 }; 1589 1590 static bool seccomp_names_from_actions_logged(char *names, size_t size, 1591 u32 actions_logged, 1592 const char *sep) 1593 { 1594 const struct seccomp_log_name *cur; 1595 bool append_sep = false; 1596 1597 for (cur = seccomp_log_names; cur->name && size; cur++) { 1598 ssize_t ret; 1599 1600 if (!(actions_logged & cur->log)) 1601 continue; 1602 1603 if (append_sep) { 1604 ret = strscpy(names, sep, size); 1605 if (ret < 0) 1606 return false; 1607 1608 names += ret; 1609 size -= ret; 1610 } else 1611 append_sep = true; 1612 1613 ret = strscpy(names, cur->name, size); 1614 if (ret < 0) 1615 return false; 1616 1617 names += ret; 1618 size -= ret; 1619 } 1620 1621 return true; 1622 } 1623 1624 static bool seccomp_action_logged_from_name(u32 *action_logged, 1625 const char *name) 1626 { 1627 const struct seccomp_log_name *cur; 1628 1629 for (cur = seccomp_log_names; cur->name; cur++) { 1630 if (!strcmp(cur->name, name)) { 1631 *action_logged = cur->log; 1632 return true; 1633 } 1634 } 1635 1636 return false; 1637 } 1638 1639 static bool seccomp_actions_logged_from_names(u32 *actions_logged, char *names) 1640 { 1641 char *name; 1642 1643 *actions_logged = 0; 1644 while ((name = strsep(&names, " ")) && *name) { 1645 u32 action_logged = 0; 1646 1647 if (!seccomp_action_logged_from_name(&action_logged, name)) 1648 return false; 1649 1650 *actions_logged |= action_logged; 1651 } 1652 1653 return true; 1654 } 1655 1656 static int read_actions_logged(struct ctl_table *ro_table, void __user *buffer, 1657 size_t *lenp, loff_t *ppos) 1658 { 1659 char names[sizeof(seccomp_actions_avail)]; 1660 struct ctl_table table; 1661 1662 memset(names, 0, sizeof(names)); 1663 1664 if (!seccomp_names_from_actions_logged(names, sizeof(names), 1665 seccomp_actions_logged, " ")) 1666 return -EINVAL; 1667 1668 table = *ro_table; 1669 table.data = names; 1670 table.maxlen = sizeof(names); 1671 return proc_dostring(&table, 0, buffer, lenp, ppos); 1672 } 1673 1674 static int write_actions_logged(struct ctl_table *ro_table, void __user *buffer, 1675 size_t *lenp, loff_t *ppos, u32 *actions_logged) 1676 { 1677 char names[sizeof(seccomp_actions_avail)]; 1678 struct ctl_table table; 1679 int ret; 1680 1681 if (!capable(CAP_SYS_ADMIN)) 1682 return -EPERM; 1683 1684 memset(names, 0, sizeof(names)); 1685 1686 table = *ro_table; 1687 table.data = names; 1688 table.maxlen = sizeof(names); 1689 ret = proc_dostring(&table, 1, buffer, lenp, ppos); 1690 if (ret) 1691 return ret; 1692 1693 if (!seccomp_actions_logged_from_names(actions_logged, table.data)) 1694 return -EINVAL; 1695 1696 if (*actions_logged & SECCOMP_LOG_ALLOW) 1697 return -EINVAL; 1698 1699 seccomp_actions_logged = *actions_logged; 1700 return 0; 1701 } 1702 1703 static void audit_actions_logged(u32 actions_logged, u32 old_actions_logged, 1704 int ret) 1705 { 1706 char names[sizeof(seccomp_actions_avail)]; 1707 char old_names[sizeof(seccomp_actions_avail)]; 1708 const char *new = names; 1709 const char *old = old_names; 1710 1711 if (!audit_enabled) 1712 return; 1713 1714 memset(names, 0, sizeof(names)); 1715 memset(old_names, 0, sizeof(old_names)); 1716 1717 if (ret) 1718 new = "?"; 1719 else if (!actions_logged) 1720 new = "(none)"; 1721 else if (!seccomp_names_from_actions_logged(names, sizeof(names), 1722 actions_logged, ",")) 1723 new = "?"; 1724 1725 if (!old_actions_logged) 1726 old = "(none)"; 1727 else if (!seccomp_names_from_actions_logged(old_names, 1728 sizeof(old_names), 1729 old_actions_logged, ",")) 1730 old = "?"; 1731 1732 return audit_seccomp_actions_logged(new, old, !ret); 1733 } 1734 1735 static int seccomp_actions_logged_handler(struct ctl_table *ro_table, int write, 1736 void __user *buffer, size_t *lenp, 1737 loff_t *ppos) 1738 { 1739 int ret; 1740 1741 if (write) { 1742 u32 actions_logged = 0; 1743 u32 old_actions_logged = seccomp_actions_logged; 1744 1745 ret = write_actions_logged(ro_table, buffer, lenp, ppos, 1746 &actions_logged); 1747 audit_actions_logged(actions_logged, old_actions_logged, ret); 1748 } else 1749 ret = read_actions_logged(ro_table, buffer, lenp, ppos); 1750 1751 return ret; 1752 } 1753 1754 static struct ctl_path seccomp_sysctl_path[] = { 1755 { .procname = "kernel", }, 1756 { .procname = "seccomp", }, 1757 { } 1758 }; 1759 1760 static struct ctl_table seccomp_sysctl_table[] = { 1761 { 1762 .procname = "actions_avail", 1763 .data = (void *) &seccomp_actions_avail, 1764 .maxlen = sizeof(seccomp_actions_avail), 1765 .mode = 0444, 1766 .proc_handler = proc_dostring, 1767 }, 1768 { 1769 .procname = "actions_logged", 1770 .mode = 0644, 1771 .proc_handler = seccomp_actions_logged_handler, 1772 }, 1773 { } 1774 }; 1775 1776 static int __init seccomp_sysctl_init(void) 1777 { 1778 struct ctl_table_header *hdr; 1779 1780 hdr = register_sysctl_paths(seccomp_sysctl_path, seccomp_sysctl_table); 1781 if (!hdr) 1782 pr_warn("seccomp: sysctl registration failed\n"); 1783 else 1784 kmemleak_not_leak(hdr); 1785 1786 return 0; 1787 } 1788 1789 device_initcall(seccomp_sysctl_init) 1790 1791 #endif /* CONFIG_SYSCTL */ 1792