1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * linux/kernel/seccomp.c 4 * 5 * Copyright 2004-2005 Andrea Arcangeli <andrea@cpushare.com> 6 * 7 * Copyright (C) 2012 Google, Inc. 8 * Will Drewry <wad@chromium.org> 9 * 10 * This defines a simple but solid secure-computing facility. 11 * 12 * Mode 1 uses a fixed list of allowed system calls. 13 * Mode 2 allows user-defined system call filters in the form 14 * of Berkeley Packet Filters/Linux Socket Filters. 15 */ 16 17 #include <linux/refcount.h> 18 #include <linux/audit.h> 19 #include <linux/compat.h> 20 #include <linux/coredump.h> 21 #include <linux/kmemleak.h> 22 #include <linux/nospec.h> 23 #include <linux/prctl.h> 24 #include <linux/sched.h> 25 #include <linux/sched/task_stack.h> 26 #include <linux/seccomp.h> 27 #include <linux/slab.h> 28 #include <linux/syscalls.h> 29 #include <linux/sysctl.h> 30 31 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER 32 #include <asm/syscall.h> 33 #endif 34 35 #ifdef CONFIG_SECCOMP_FILTER 36 #include <linux/file.h> 37 #include <linux/filter.h> 38 #include <linux/pid.h> 39 #include <linux/ptrace.h> 40 #include <linux/security.h> 41 #include <linux/tracehook.h> 42 #include <linux/uaccess.h> 43 #include <linux/anon_inodes.h> 44 45 enum notify_state { 46 SECCOMP_NOTIFY_INIT, 47 SECCOMP_NOTIFY_SENT, 48 SECCOMP_NOTIFY_REPLIED, 49 }; 50 51 struct seccomp_knotif { 52 /* The struct pid of the task whose filter triggered the notification */ 53 struct task_struct *task; 54 55 /* The "cookie" for this request; this is unique for this filter. */ 56 u64 id; 57 58 /* 59 * The seccomp data. This pointer is valid the entire time this 60 * notification is active, since it comes from __seccomp_filter which 61 * eclipses the entire lifecycle here. 62 */ 63 const struct seccomp_data *data; 64 65 /* 66 * Notification states. When SECCOMP_RET_USER_NOTIF is returned, a 67 * struct seccomp_knotif is created and starts out in INIT. Once the 68 * handler reads the notification off of an FD, it transitions to SENT. 69 * If a signal is received the state transitions back to INIT and 70 * another message is sent. When the userspace handler replies, state 71 * transitions to REPLIED. 72 */ 73 enum notify_state state; 74 75 /* The return values, only valid when in SECCOMP_NOTIFY_REPLIED */ 76 int error; 77 long val; 78 79 /* Signals when this has entered SECCOMP_NOTIFY_REPLIED */ 80 struct completion ready; 81 82 struct list_head list; 83 }; 84 85 /** 86 * struct notification - container for seccomp userspace notifications. Since 87 * most seccomp filters will not have notification listeners attached and this 88 * structure is fairly large, we store the notification-specific stuff in a 89 * separate structure. 90 * 91 * @request: A semaphore that users of this notification can wait on for 92 * changes. Actual reads and writes are still controlled with 93 * filter->notify_lock. 94 * @next_id: The id of the next request. 95 * @notifications: A list of struct seccomp_knotif elements. 96 * @wqh: A wait queue for poll. 97 */ 98 struct notification { 99 struct semaphore request; 100 u64 next_id; 101 struct list_head notifications; 102 wait_queue_head_t wqh; 103 }; 104 105 /** 106 * struct seccomp_filter - container for seccomp BPF programs 107 * 108 * @usage: reference count to manage the object lifetime. 109 * get/put helpers should be used when accessing an instance 110 * outside of a lifetime-guarded section. In general, this 111 * is only needed for handling filters shared across tasks. 112 * @log: true if all actions except for SECCOMP_RET_ALLOW should be logged 113 * @prev: points to a previously installed, or inherited, filter 114 * @prog: the BPF program to evaluate 115 * @notif: the struct that holds all notification related information 116 * @notify_lock: A lock for all notification-related accesses. 117 * 118 * seccomp_filter objects are organized in a tree linked via the @prev 119 * pointer. For any task, it appears to be a singly-linked list starting 120 * with current->seccomp.filter, the most recently attached or inherited filter. 121 * However, multiple filters may share a @prev node, by way of fork(), which 122 * results in a unidirectional tree existing in memory. This is similar to 123 * how namespaces work. 124 * 125 * seccomp_filter objects should never be modified after being attached 126 * to a task_struct (other than @usage). 127 */ 128 struct seccomp_filter { 129 refcount_t usage; 130 bool log; 131 struct seccomp_filter *prev; 132 struct bpf_prog *prog; 133 struct notification *notif; 134 struct mutex notify_lock; 135 }; 136 137 /* Limit any path through the tree to 256KB worth of instructions. */ 138 #define MAX_INSNS_PER_PATH ((1 << 18) / sizeof(struct sock_filter)) 139 140 /* 141 * Endianness is explicitly ignored and left for BPF program authors to manage 142 * as per the specific architecture. 143 */ 144 static void populate_seccomp_data(struct seccomp_data *sd) 145 { 146 struct task_struct *task = current; 147 struct pt_regs *regs = task_pt_regs(task); 148 unsigned long args[6]; 149 150 sd->nr = syscall_get_nr(task, regs); 151 sd->arch = syscall_get_arch(); 152 syscall_get_arguments(task, regs, args); 153 sd->args[0] = args[0]; 154 sd->args[1] = args[1]; 155 sd->args[2] = args[2]; 156 sd->args[3] = args[3]; 157 sd->args[4] = args[4]; 158 sd->args[5] = args[5]; 159 sd->instruction_pointer = KSTK_EIP(task); 160 } 161 162 /** 163 * seccomp_check_filter - verify seccomp filter code 164 * @filter: filter to verify 165 * @flen: length of filter 166 * 167 * Takes a previously checked filter (by bpf_check_classic) and 168 * redirects all filter code that loads struct sk_buff data 169 * and related data through seccomp_bpf_load. It also 170 * enforces length and alignment checking of those loads. 171 * 172 * Returns 0 if the rule set is legal or -EINVAL if not. 173 */ 174 static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen) 175 { 176 int pc; 177 for (pc = 0; pc < flen; pc++) { 178 struct sock_filter *ftest = &filter[pc]; 179 u16 code = ftest->code; 180 u32 k = ftest->k; 181 182 switch (code) { 183 case BPF_LD | BPF_W | BPF_ABS: 184 ftest->code = BPF_LDX | BPF_W | BPF_ABS; 185 /* 32-bit aligned and not out of bounds. */ 186 if (k >= sizeof(struct seccomp_data) || k & 3) 187 return -EINVAL; 188 continue; 189 case BPF_LD | BPF_W | BPF_LEN: 190 ftest->code = BPF_LD | BPF_IMM; 191 ftest->k = sizeof(struct seccomp_data); 192 continue; 193 case BPF_LDX | BPF_W | BPF_LEN: 194 ftest->code = BPF_LDX | BPF_IMM; 195 ftest->k = sizeof(struct seccomp_data); 196 continue; 197 /* Explicitly include allowed calls. */ 198 case BPF_RET | BPF_K: 199 case BPF_RET | BPF_A: 200 case BPF_ALU | BPF_ADD | BPF_K: 201 case BPF_ALU | BPF_ADD | BPF_X: 202 case BPF_ALU | BPF_SUB | BPF_K: 203 case BPF_ALU | BPF_SUB | BPF_X: 204 case BPF_ALU | BPF_MUL | BPF_K: 205 case BPF_ALU | BPF_MUL | BPF_X: 206 case BPF_ALU | BPF_DIV | BPF_K: 207 case BPF_ALU | BPF_DIV | BPF_X: 208 case BPF_ALU | BPF_AND | BPF_K: 209 case BPF_ALU | BPF_AND | BPF_X: 210 case BPF_ALU | BPF_OR | BPF_K: 211 case BPF_ALU | BPF_OR | BPF_X: 212 case BPF_ALU | BPF_XOR | BPF_K: 213 case BPF_ALU | BPF_XOR | BPF_X: 214 case BPF_ALU | BPF_LSH | BPF_K: 215 case BPF_ALU | BPF_LSH | BPF_X: 216 case BPF_ALU | BPF_RSH | BPF_K: 217 case BPF_ALU | BPF_RSH | BPF_X: 218 case BPF_ALU | BPF_NEG: 219 case BPF_LD | BPF_IMM: 220 case BPF_LDX | BPF_IMM: 221 case BPF_MISC | BPF_TAX: 222 case BPF_MISC | BPF_TXA: 223 case BPF_LD | BPF_MEM: 224 case BPF_LDX | BPF_MEM: 225 case BPF_ST: 226 case BPF_STX: 227 case BPF_JMP | BPF_JA: 228 case BPF_JMP | BPF_JEQ | BPF_K: 229 case BPF_JMP | BPF_JEQ | BPF_X: 230 case BPF_JMP | BPF_JGE | BPF_K: 231 case BPF_JMP | BPF_JGE | BPF_X: 232 case BPF_JMP | BPF_JGT | BPF_K: 233 case BPF_JMP | BPF_JGT | BPF_X: 234 case BPF_JMP | BPF_JSET | BPF_K: 235 case BPF_JMP | BPF_JSET | BPF_X: 236 continue; 237 default: 238 return -EINVAL; 239 } 240 } 241 return 0; 242 } 243 244 /** 245 * seccomp_run_filters - evaluates all seccomp filters against @sd 246 * @sd: optional seccomp data to be passed to filters 247 * @match: stores struct seccomp_filter that resulted in the return value, 248 * unless filter returned SECCOMP_RET_ALLOW, in which case it will 249 * be unchanged. 250 * 251 * Returns valid seccomp BPF response codes. 252 */ 253 #define ACTION_ONLY(ret) ((s32)((ret) & (SECCOMP_RET_ACTION_FULL))) 254 static u32 seccomp_run_filters(const struct seccomp_data *sd, 255 struct seccomp_filter **match) 256 { 257 u32 ret = SECCOMP_RET_ALLOW; 258 /* Make sure cross-thread synced filter points somewhere sane. */ 259 struct seccomp_filter *f = 260 READ_ONCE(current->seccomp.filter); 261 262 /* Ensure unexpected behavior doesn't result in failing open. */ 263 if (WARN_ON(f == NULL)) 264 return SECCOMP_RET_KILL_PROCESS; 265 266 /* 267 * All filters in the list are evaluated and the lowest BPF return 268 * value always takes priority (ignoring the DATA). 269 */ 270 preempt_disable(); 271 for (; f; f = f->prev) { 272 u32 cur_ret = BPF_PROG_RUN(f->prog, sd); 273 274 if (ACTION_ONLY(cur_ret) < ACTION_ONLY(ret)) { 275 ret = cur_ret; 276 *match = f; 277 } 278 } 279 preempt_enable(); 280 return ret; 281 } 282 #endif /* CONFIG_SECCOMP_FILTER */ 283 284 static inline bool seccomp_may_assign_mode(unsigned long seccomp_mode) 285 { 286 assert_spin_locked(¤t->sighand->siglock); 287 288 if (current->seccomp.mode && current->seccomp.mode != seccomp_mode) 289 return false; 290 291 return true; 292 } 293 294 void __weak arch_seccomp_spec_mitigate(struct task_struct *task) { } 295 296 static inline void seccomp_assign_mode(struct task_struct *task, 297 unsigned long seccomp_mode, 298 unsigned long flags) 299 { 300 assert_spin_locked(&task->sighand->siglock); 301 302 task->seccomp.mode = seccomp_mode; 303 /* 304 * Make sure TIF_SECCOMP cannot be set before the mode (and 305 * filter) is set. 306 */ 307 smp_mb__before_atomic(); 308 /* Assume default seccomp processes want spec flaw mitigation. */ 309 if ((flags & SECCOMP_FILTER_FLAG_SPEC_ALLOW) == 0) 310 arch_seccomp_spec_mitigate(task); 311 set_tsk_thread_flag(task, TIF_SECCOMP); 312 } 313 314 #ifdef CONFIG_SECCOMP_FILTER 315 /* Returns 1 if the parent is an ancestor of the child. */ 316 static int is_ancestor(struct seccomp_filter *parent, 317 struct seccomp_filter *child) 318 { 319 /* NULL is the root ancestor. */ 320 if (parent == NULL) 321 return 1; 322 for (; child; child = child->prev) 323 if (child == parent) 324 return 1; 325 return 0; 326 } 327 328 /** 329 * seccomp_can_sync_threads: checks if all threads can be synchronized 330 * 331 * Expects sighand and cred_guard_mutex locks to be held. 332 * 333 * Returns 0 on success, -ve on error, or the pid of a thread which was 334 * either not in the correct seccomp mode or it did not have an ancestral 335 * seccomp filter. 336 */ 337 static inline pid_t seccomp_can_sync_threads(void) 338 { 339 struct task_struct *thread, *caller; 340 341 BUG_ON(!mutex_is_locked(¤t->signal->cred_guard_mutex)); 342 assert_spin_locked(¤t->sighand->siglock); 343 344 /* Validate all threads being eligible for synchronization. */ 345 caller = current; 346 for_each_thread(caller, thread) { 347 pid_t failed; 348 349 /* Skip current, since it is initiating the sync. */ 350 if (thread == caller) 351 continue; 352 353 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED || 354 (thread->seccomp.mode == SECCOMP_MODE_FILTER && 355 is_ancestor(thread->seccomp.filter, 356 caller->seccomp.filter))) 357 continue; 358 359 /* Return the first thread that cannot be synchronized. */ 360 failed = task_pid_vnr(thread); 361 /* If the pid cannot be resolved, then return -ESRCH */ 362 if (WARN_ON(failed == 0)) 363 failed = -ESRCH; 364 return failed; 365 } 366 367 return 0; 368 } 369 370 /** 371 * seccomp_sync_threads: sets all threads to use current's filter 372 * 373 * Expects sighand and cred_guard_mutex locks to be held, and for 374 * seccomp_can_sync_threads() to have returned success already 375 * without dropping the locks. 376 * 377 */ 378 static inline void seccomp_sync_threads(unsigned long flags) 379 { 380 struct task_struct *thread, *caller; 381 382 BUG_ON(!mutex_is_locked(¤t->signal->cred_guard_mutex)); 383 assert_spin_locked(¤t->sighand->siglock); 384 385 /* Synchronize all threads. */ 386 caller = current; 387 for_each_thread(caller, thread) { 388 /* Skip current, since it needs no changes. */ 389 if (thread == caller) 390 continue; 391 392 /* Get a task reference for the new leaf node. */ 393 get_seccomp_filter(caller); 394 /* 395 * Drop the task reference to the shared ancestor since 396 * current's path will hold a reference. (This also 397 * allows a put before the assignment.) 398 */ 399 put_seccomp_filter(thread); 400 smp_store_release(&thread->seccomp.filter, 401 caller->seccomp.filter); 402 403 /* 404 * Don't let an unprivileged task work around 405 * the no_new_privs restriction by creating 406 * a thread that sets it up, enters seccomp, 407 * then dies. 408 */ 409 if (task_no_new_privs(caller)) 410 task_set_no_new_privs(thread); 411 412 /* 413 * Opt the other thread into seccomp if needed. 414 * As threads are considered to be trust-realm 415 * equivalent (see ptrace_may_access), it is safe to 416 * allow one thread to transition the other. 417 */ 418 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED) 419 seccomp_assign_mode(thread, SECCOMP_MODE_FILTER, 420 flags); 421 } 422 } 423 424 /** 425 * seccomp_prepare_filter: Prepares a seccomp filter for use. 426 * @fprog: BPF program to install 427 * 428 * Returns filter on success or an ERR_PTR on failure. 429 */ 430 static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog) 431 { 432 struct seccomp_filter *sfilter; 433 int ret; 434 const bool save_orig = IS_ENABLED(CONFIG_CHECKPOINT_RESTORE); 435 436 if (fprog->len == 0 || fprog->len > BPF_MAXINSNS) 437 return ERR_PTR(-EINVAL); 438 439 BUG_ON(INT_MAX / fprog->len < sizeof(struct sock_filter)); 440 441 /* 442 * Installing a seccomp filter requires that the task has 443 * CAP_SYS_ADMIN in its namespace or be running with no_new_privs. 444 * This avoids scenarios where unprivileged tasks can affect the 445 * behavior of privileged children. 446 */ 447 if (!task_no_new_privs(current) && 448 security_capable(current_cred(), current_user_ns(), 449 CAP_SYS_ADMIN, CAP_OPT_NOAUDIT) != 0) 450 return ERR_PTR(-EACCES); 451 452 /* Allocate a new seccomp_filter */ 453 sfilter = kzalloc(sizeof(*sfilter), GFP_KERNEL | __GFP_NOWARN); 454 if (!sfilter) 455 return ERR_PTR(-ENOMEM); 456 457 mutex_init(&sfilter->notify_lock); 458 ret = bpf_prog_create_from_user(&sfilter->prog, fprog, 459 seccomp_check_filter, save_orig); 460 if (ret < 0) { 461 kfree(sfilter); 462 return ERR_PTR(ret); 463 } 464 465 refcount_set(&sfilter->usage, 1); 466 467 return sfilter; 468 } 469 470 /** 471 * seccomp_prepare_user_filter - prepares a user-supplied sock_fprog 472 * @user_filter: pointer to the user data containing a sock_fprog. 473 * 474 * Returns 0 on success and non-zero otherwise. 475 */ 476 static struct seccomp_filter * 477 seccomp_prepare_user_filter(const char __user *user_filter) 478 { 479 struct sock_fprog fprog; 480 struct seccomp_filter *filter = ERR_PTR(-EFAULT); 481 482 #ifdef CONFIG_COMPAT 483 if (in_compat_syscall()) { 484 struct compat_sock_fprog fprog32; 485 if (copy_from_user(&fprog32, user_filter, sizeof(fprog32))) 486 goto out; 487 fprog.len = fprog32.len; 488 fprog.filter = compat_ptr(fprog32.filter); 489 } else /* falls through to the if below. */ 490 #endif 491 if (copy_from_user(&fprog, user_filter, sizeof(fprog))) 492 goto out; 493 filter = seccomp_prepare_filter(&fprog); 494 out: 495 return filter; 496 } 497 498 /** 499 * seccomp_attach_filter: validate and attach filter 500 * @flags: flags to change filter behavior 501 * @filter: seccomp filter to add to the current process 502 * 503 * Caller must be holding current->sighand->siglock lock. 504 * 505 * Returns 0 on success, -ve on error. 506 */ 507 static long seccomp_attach_filter(unsigned int flags, 508 struct seccomp_filter *filter) 509 { 510 unsigned long total_insns; 511 struct seccomp_filter *walker; 512 513 assert_spin_locked(¤t->sighand->siglock); 514 515 /* Validate resulting filter length. */ 516 total_insns = filter->prog->len; 517 for (walker = current->seccomp.filter; walker; walker = walker->prev) 518 total_insns += walker->prog->len + 4; /* 4 instr penalty */ 519 if (total_insns > MAX_INSNS_PER_PATH) 520 return -ENOMEM; 521 522 /* If thread sync has been requested, check that it is possible. */ 523 if (flags & SECCOMP_FILTER_FLAG_TSYNC) { 524 int ret; 525 526 ret = seccomp_can_sync_threads(); 527 if (ret) 528 return ret; 529 } 530 531 /* Set log flag, if present. */ 532 if (flags & SECCOMP_FILTER_FLAG_LOG) 533 filter->log = true; 534 535 /* 536 * If there is an existing filter, make it the prev and don't drop its 537 * task reference. 538 */ 539 filter->prev = current->seccomp.filter; 540 current->seccomp.filter = filter; 541 542 /* Now that the new filter is in place, synchronize to all threads. */ 543 if (flags & SECCOMP_FILTER_FLAG_TSYNC) 544 seccomp_sync_threads(flags); 545 546 return 0; 547 } 548 549 static void __get_seccomp_filter(struct seccomp_filter *filter) 550 { 551 refcount_inc(&filter->usage); 552 } 553 554 /* get_seccomp_filter - increments the reference count of the filter on @tsk */ 555 void get_seccomp_filter(struct task_struct *tsk) 556 { 557 struct seccomp_filter *orig = tsk->seccomp.filter; 558 if (!orig) 559 return; 560 __get_seccomp_filter(orig); 561 } 562 563 static inline void seccomp_filter_free(struct seccomp_filter *filter) 564 { 565 if (filter) { 566 bpf_prog_destroy(filter->prog); 567 kfree(filter); 568 } 569 } 570 571 static void __put_seccomp_filter(struct seccomp_filter *orig) 572 { 573 /* Clean up single-reference branches iteratively. */ 574 while (orig && refcount_dec_and_test(&orig->usage)) { 575 struct seccomp_filter *freeme = orig; 576 orig = orig->prev; 577 seccomp_filter_free(freeme); 578 } 579 } 580 581 /* put_seccomp_filter - decrements the ref count of tsk->seccomp.filter */ 582 void put_seccomp_filter(struct task_struct *tsk) 583 { 584 __put_seccomp_filter(tsk->seccomp.filter); 585 } 586 587 static void seccomp_init_siginfo(kernel_siginfo_t *info, int syscall, int reason) 588 { 589 clear_siginfo(info); 590 info->si_signo = SIGSYS; 591 info->si_code = SYS_SECCOMP; 592 info->si_call_addr = (void __user *)KSTK_EIP(current); 593 info->si_errno = reason; 594 info->si_arch = syscall_get_arch(); 595 info->si_syscall = syscall; 596 } 597 598 /** 599 * seccomp_send_sigsys - signals the task to allow in-process syscall emulation 600 * @syscall: syscall number to send to userland 601 * @reason: filter-supplied reason code to send to userland (via si_errno) 602 * 603 * Forces a SIGSYS with a code of SYS_SECCOMP and related sigsys info. 604 */ 605 static void seccomp_send_sigsys(int syscall, int reason) 606 { 607 struct kernel_siginfo info; 608 seccomp_init_siginfo(&info, syscall, reason); 609 force_sig_info(SIGSYS, &info, current); 610 } 611 #endif /* CONFIG_SECCOMP_FILTER */ 612 613 /* For use with seccomp_actions_logged */ 614 #define SECCOMP_LOG_KILL_PROCESS (1 << 0) 615 #define SECCOMP_LOG_KILL_THREAD (1 << 1) 616 #define SECCOMP_LOG_TRAP (1 << 2) 617 #define SECCOMP_LOG_ERRNO (1 << 3) 618 #define SECCOMP_LOG_TRACE (1 << 4) 619 #define SECCOMP_LOG_LOG (1 << 5) 620 #define SECCOMP_LOG_ALLOW (1 << 6) 621 #define SECCOMP_LOG_USER_NOTIF (1 << 7) 622 623 static u32 seccomp_actions_logged = SECCOMP_LOG_KILL_PROCESS | 624 SECCOMP_LOG_KILL_THREAD | 625 SECCOMP_LOG_TRAP | 626 SECCOMP_LOG_ERRNO | 627 SECCOMP_LOG_USER_NOTIF | 628 SECCOMP_LOG_TRACE | 629 SECCOMP_LOG_LOG; 630 631 static inline void seccomp_log(unsigned long syscall, long signr, u32 action, 632 bool requested) 633 { 634 bool log = false; 635 636 switch (action) { 637 case SECCOMP_RET_ALLOW: 638 break; 639 case SECCOMP_RET_TRAP: 640 log = requested && seccomp_actions_logged & SECCOMP_LOG_TRAP; 641 break; 642 case SECCOMP_RET_ERRNO: 643 log = requested && seccomp_actions_logged & SECCOMP_LOG_ERRNO; 644 break; 645 case SECCOMP_RET_TRACE: 646 log = requested && seccomp_actions_logged & SECCOMP_LOG_TRACE; 647 break; 648 case SECCOMP_RET_USER_NOTIF: 649 log = requested && seccomp_actions_logged & SECCOMP_LOG_USER_NOTIF; 650 break; 651 case SECCOMP_RET_LOG: 652 log = seccomp_actions_logged & SECCOMP_LOG_LOG; 653 break; 654 case SECCOMP_RET_KILL_THREAD: 655 log = seccomp_actions_logged & SECCOMP_LOG_KILL_THREAD; 656 break; 657 case SECCOMP_RET_KILL_PROCESS: 658 default: 659 log = seccomp_actions_logged & SECCOMP_LOG_KILL_PROCESS; 660 } 661 662 /* 663 * Emit an audit message when the action is RET_KILL_*, RET_LOG, or the 664 * FILTER_FLAG_LOG bit was set. The admin has the ability to silence 665 * any action from being logged by removing the action name from the 666 * seccomp_actions_logged sysctl. 667 */ 668 if (!log) 669 return; 670 671 audit_seccomp(syscall, signr, action); 672 } 673 674 /* 675 * Secure computing mode 1 allows only read/write/exit/sigreturn. 676 * To be fully secure this must be combined with rlimit 677 * to limit the stack allocations too. 678 */ 679 static const int mode1_syscalls[] = { 680 __NR_seccomp_read, __NR_seccomp_write, __NR_seccomp_exit, __NR_seccomp_sigreturn, 681 0, /* null terminated */ 682 }; 683 684 static void __secure_computing_strict(int this_syscall) 685 { 686 const int *syscall_whitelist = mode1_syscalls; 687 #ifdef CONFIG_COMPAT 688 if (in_compat_syscall()) 689 syscall_whitelist = get_compat_mode1_syscalls(); 690 #endif 691 do { 692 if (*syscall_whitelist == this_syscall) 693 return; 694 } while (*++syscall_whitelist); 695 696 #ifdef SECCOMP_DEBUG 697 dump_stack(); 698 #endif 699 seccomp_log(this_syscall, SIGKILL, SECCOMP_RET_KILL_THREAD, true); 700 do_exit(SIGKILL); 701 } 702 703 #ifndef CONFIG_HAVE_ARCH_SECCOMP_FILTER 704 void secure_computing_strict(int this_syscall) 705 { 706 int mode = current->seccomp.mode; 707 708 if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) && 709 unlikely(current->ptrace & PT_SUSPEND_SECCOMP)) 710 return; 711 712 if (mode == SECCOMP_MODE_DISABLED) 713 return; 714 else if (mode == SECCOMP_MODE_STRICT) 715 __secure_computing_strict(this_syscall); 716 else 717 BUG(); 718 } 719 #else 720 721 #ifdef CONFIG_SECCOMP_FILTER 722 static u64 seccomp_next_notify_id(struct seccomp_filter *filter) 723 { 724 /* 725 * Note: overflow is ok here, the id just needs to be unique per 726 * filter. 727 */ 728 lockdep_assert_held(&filter->notify_lock); 729 return filter->notif->next_id++; 730 } 731 732 static void seccomp_do_user_notification(int this_syscall, 733 struct seccomp_filter *match, 734 const struct seccomp_data *sd) 735 { 736 int err; 737 long ret = 0; 738 struct seccomp_knotif n = {}; 739 740 mutex_lock(&match->notify_lock); 741 err = -ENOSYS; 742 if (!match->notif) 743 goto out; 744 745 n.task = current; 746 n.state = SECCOMP_NOTIFY_INIT; 747 n.data = sd; 748 n.id = seccomp_next_notify_id(match); 749 init_completion(&n.ready); 750 list_add(&n.list, &match->notif->notifications); 751 752 up(&match->notif->request); 753 wake_up_poll(&match->notif->wqh, EPOLLIN | EPOLLRDNORM); 754 mutex_unlock(&match->notify_lock); 755 756 /* 757 * This is where we wait for a reply from userspace. 758 */ 759 err = wait_for_completion_interruptible(&n.ready); 760 mutex_lock(&match->notify_lock); 761 if (err == 0) { 762 ret = n.val; 763 err = n.error; 764 } 765 766 /* 767 * Note that it's possible the listener died in between the time when 768 * we were notified of a respons (or a signal) and when we were able to 769 * re-acquire the lock, so only delete from the list if the 770 * notification actually exists. 771 * 772 * Also note that this test is only valid because there's no way to 773 * *reattach* to a notifier right now. If one is added, we'll need to 774 * keep track of the notif itself and make sure they match here. 775 */ 776 if (match->notif) 777 list_del(&n.list); 778 out: 779 mutex_unlock(&match->notify_lock); 780 syscall_set_return_value(current, task_pt_regs(current), 781 err, ret); 782 } 783 784 static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd, 785 const bool recheck_after_trace) 786 { 787 u32 filter_ret, action; 788 struct seccomp_filter *match = NULL; 789 int data; 790 struct seccomp_data sd_local; 791 792 /* 793 * Make sure that any changes to mode from another thread have 794 * been seen after TIF_SECCOMP was seen. 795 */ 796 rmb(); 797 798 if (!sd) { 799 populate_seccomp_data(&sd_local); 800 sd = &sd_local; 801 } 802 803 filter_ret = seccomp_run_filters(sd, &match); 804 data = filter_ret & SECCOMP_RET_DATA; 805 action = filter_ret & SECCOMP_RET_ACTION_FULL; 806 807 switch (action) { 808 case SECCOMP_RET_ERRNO: 809 /* Set low-order bits as an errno, capped at MAX_ERRNO. */ 810 if (data > MAX_ERRNO) 811 data = MAX_ERRNO; 812 syscall_set_return_value(current, task_pt_regs(current), 813 -data, 0); 814 goto skip; 815 816 case SECCOMP_RET_TRAP: 817 /* Show the handler the original registers. */ 818 syscall_rollback(current, task_pt_regs(current)); 819 /* Let the filter pass back 16 bits of data. */ 820 seccomp_send_sigsys(this_syscall, data); 821 goto skip; 822 823 case SECCOMP_RET_TRACE: 824 /* We've been put in this state by the ptracer already. */ 825 if (recheck_after_trace) 826 return 0; 827 828 /* ENOSYS these calls if there is no tracer attached. */ 829 if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP)) { 830 syscall_set_return_value(current, 831 task_pt_regs(current), 832 -ENOSYS, 0); 833 goto skip; 834 } 835 836 /* Allow the BPF to provide the event message */ 837 ptrace_event(PTRACE_EVENT_SECCOMP, data); 838 /* 839 * The delivery of a fatal signal during event 840 * notification may silently skip tracer notification, 841 * which could leave us with a potentially unmodified 842 * syscall that the tracer would have liked to have 843 * changed. Since the process is about to die, we just 844 * force the syscall to be skipped and let the signal 845 * kill the process and correctly handle any tracer exit 846 * notifications. 847 */ 848 if (fatal_signal_pending(current)) 849 goto skip; 850 /* Check if the tracer forced the syscall to be skipped. */ 851 this_syscall = syscall_get_nr(current, task_pt_regs(current)); 852 if (this_syscall < 0) 853 goto skip; 854 855 /* 856 * Recheck the syscall, since it may have changed. This 857 * intentionally uses a NULL struct seccomp_data to force 858 * a reload of all registers. This does not goto skip since 859 * a skip would have already been reported. 860 */ 861 if (__seccomp_filter(this_syscall, NULL, true)) 862 return -1; 863 864 return 0; 865 866 case SECCOMP_RET_USER_NOTIF: 867 seccomp_do_user_notification(this_syscall, match, sd); 868 goto skip; 869 870 case SECCOMP_RET_LOG: 871 seccomp_log(this_syscall, 0, action, true); 872 return 0; 873 874 case SECCOMP_RET_ALLOW: 875 /* 876 * Note that the "match" filter will always be NULL for 877 * this action since SECCOMP_RET_ALLOW is the starting 878 * state in seccomp_run_filters(). 879 */ 880 return 0; 881 882 case SECCOMP_RET_KILL_THREAD: 883 case SECCOMP_RET_KILL_PROCESS: 884 default: 885 seccomp_log(this_syscall, SIGSYS, action, true); 886 /* Dump core only if this is the last remaining thread. */ 887 if (action == SECCOMP_RET_KILL_PROCESS || 888 get_nr_threads(current) == 1) { 889 kernel_siginfo_t info; 890 891 /* Show the original registers in the dump. */ 892 syscall_rollback(current, task_pt_regs(current)); 893 /* Trigger a manual coredump since do_exit skips it. */ 894 seccomp_init_siginfo(&info, this_syscall, data); 895 do_coredump(&info); 896 } 897 if (action == SECCOMP_RET_KILL_PROCESS) 898 do_group_exit(SIGSYS); 899 else 900 do_exit(SIGSYS); 901 } 902 903 unreachable(); 904 905 skip: 906 seccomp_log(this_syscall, 0, action, match ? match->log : false); 907 return -1; 908 } 909 #else 910 static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd, 911 const bool recheck_after_trace) 912 { 913 BUG(); 914 } 915 #endif 916 917 int __secure_computing(const struct seccomp_data *sd) 918 { 919 int mode = current->seccomp.mode; 920 int this_syscall; 921 922 if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) && 923 unlikely(current->ptrace & PT_SUSPEND_SECCOMP)) 924 return 0; 925 926 this_syscall = sd ? sd->nr : 927 syscall_get_nr(current, task_pt_regs(current)); 928 929 switch (mode) { 930 case SECCOMP_MODE_STRICT: 931 __secure_computing_strict(this_syscall); /* may call do_exit */ 932 return 0; 933 case SECCOMP_MODE_FILTER: 934 return __seccomp_filter(this_syscall, sd, false); 935 default: 936 BUG(); 937 } 938 } 939 #endif /* CONFIG_HAVE_ARCH_SECCOMP_FILTER */ 940 941 long prctl_get_seccomp(void) 942 { 943 return current->seccomp.mode; 944 } 945 946 /** 947 * seccomp_set_mode_strict: internal function for setting strict seccomp 948 * 949 * Once current->seccomp.mode is non-zero, it may not be changed. 950 * 951 * Returns 0 on success or -EINVAL on failure. 952 */ 953 static long seccomp_set_mode_strict(void) 954 { 955 const unsigned long seccomp_mode = SECCOMP_MODE_STRICT; 956 long ret = -EINVAL; 957 958 spin_lock_irq(¤t->sighand->siglock); 959 960 if (!seccomp_may_assign_mode(seccomp_mode)) 961 goto out; 962 963 #ifdef TIF_NOTSC 964 disable_TSC(); 965 #endif 966 seccomp_assign_mode(current, seccomp_mode, 0); 967 ret = 0; 968 969 out: 970 spin_unlock_irq(¤t->sighand->siglock); 971 972 return ret; 973 } 974 975 #ifdef CONFIG_SECCOMP_FILTER 976 static int seccomp_notify_release(struct inode *inode, struct file *file) 977 { 978 struct seccomp_filter *filter = file->private_data; 979 struct seccomp_knotif *knotif; 980 981 if (!filter) 982 return 0; 983 984 mutex_lock(&filter->notify_lock); 985 986 /* 987 * If this file is being closed because e.g. the task who owned it 988 * died, let's wake everyone up who was waiting on us. 989 */ 990 list_for_each_entry(knotif, &filter->notif->notifications, list) { 991 if (knotif->state == SECCOMP_NOTIFY_REPLIED) 992 continue; 993 994 knotif->state = SECCOMP_NOTIFY_REPLIED; 995 knotif->error = -ENOSYS; 996 knotif->val = 0; 997 998 complete(&knotif->ready); 999 } 1000 1001 kfree(filter->notif); 1002 filter->notif = NULL; 1003 mutex_unlock(&filter->notify_lock); 1004 __put_seccomp_filter(filter); 1005 return 0; 1006 } 1007 1008 static long seccomp_notify_recv(struct seccomp_filter *filter, 1009 void __user *buf) 1010 { 1011 struct seccomp_knotif *knotif = NULL, *cur; 1012 struct seccomp_notif unotif; 1013 ssize_t ret; 1014 1015 memset(&unotif, 0, sizeof(unotif)); 1016 1017 ret = down_interruptible(&filter->notif->request); 1018 if (ret < 0) 1019 return ret; 1020 1021 mutex_lock(&filter->notify_lock); 1022 list_for_each_entry(cur, &filter->notif->notifications, list) { 1023 if (cur->state == SECCOMP_NOTIFY_INIT) { 1024 knotif = cur; 1025 break; 1026 } 1027 } 1028 1029 /* 1030 * If we didn't find a notification, it could be that the task was 1031 * interrupted by a fatal signal between the time we were woken and 1032 * when we were able to acquire the rw lock. 1033 */ 1034 if (!knotif) { 1035 ret = -ENOENT; 1036 goto out; 1037 } 1038 1039 unotif.id = knotif->id; 1040 unotif.pid = task_pid_vnr(knotif->task); 1041 unotif.data = *(knotif->data); 1042 1043 knotif->state = SECCOMP_NOTIFY_SENT; 1044 wake_up_poll(&filter->notif->wqh, EPOLLOUT | EPOLLWRNORM); 1045 ret = 0; 1046 out: 1047 mutex_unlock(&filter->notify_lock); 1048 1049 if (ret == 0 && copy_to_user(buf, &unotif, sizeof(unotif))) { 1050 ret = -EFAULT; 1051 1052 /* 1053 * Userspace screwed up. To make sure that we keep this 1054 * notification alive, let's reset it back to INIT. It 1055 * may have died when we released the lock, so we need to make 1056 * sure it's still around. 1057 */ 1058 knotif = NULL; 1059 mutex_lock(&filter->notify_lock); 1060 list_for_each_entry(cur, &filter->notif->notifications, list) { 1061 if (cur->id == unotif.id) { 1062 knotif = cur; 1063 break; 1064 } 1065 } 1066 1067 if (knotif) { 1068 knotif->state = SECCOMP_NOTIFY_INIT; 1069 up(&filter->notif->request); 1070 } 1071 mutex_unlock(&filter->notify_lock); 1072 } 1073 1074 return ret; 1075 } 1076 1077 static long seccomp_notify_send(struct seccomp_filter *filter, 1078 void __user *buf) 1079 { 1080 struct seccomp_notif_resp resp = {}; 1081 struct seccomp_knotif *knotif = NULL, *cur; 1082 long ret; 1083 1084 if (copy_from_user(&resp, buf, sizeof(resp))) 1085 return -EFAULT; 1086 1087 if (resp.flags) 1088 return -EINVAL; 1089 1090 ret = mutex_lock_interruptible(&filter->notify_lock); 1091 if (ret < 0) 1092 return ret; 1093 1094 list_for_each_entry(cur, &filter->notif->notifications, list) { 1095 if (cur->id == resp.id) { 1096 knotif = cur; 1097 break; 1098 } 1099 } 1100 1101 if (!knotif) { 1102 ret = -ENOENT; 1103 goto out; 1104 } 1105 1106 /* Allow exactly one reply. */ 1107 if (knotif->state != SECCOMP_NOTIFY_SENT) { 1108 ret = -EINPROGRESS; 1109 goto out; 1110 } 1111 1112 ret = 0; 1113 knotif->state = SECCOMP_NOTIFY_REPLIED; 1114 knotif->error = resp.error; 1115 knotif->val = resp.val; 1116 complete(&knotif->ready); 1117 out: 1118 mutex_unlock(&filter->notify_lock); 1119 return ret; 1120 } 1121 1122 static long seccomp_notify_id_valid(struct seccomp_filter *filter, 1123 void __user *buf) 1124 { 1125 struct seccomp_knotif *knotif = NULL; 1126 u64 id; 1127 long ret; 1128 1129 if (copy_from_user(&id, buf, sizeof(id))) 1130 return -EFAULT; 1131 1132 ret = mutex_lock_interruptible(&filter->notify_lock); 1133 if (ret < 0) 1134 return ret; 1135 1136 ret = -ENOENT; 1137 list_for_each_entry(knotif, &filter->notif->notifications, list) { 1138 if (knotif->id == id) { 1139 if (knotif->state == SECCOMP_NOTIFY_SENT) 1140 ret = 0; 1141 goto out; 1142 } 1143 } 1144 1145 out: 1146 mutex_unlock(&filter->notify_lock); 1147 return ret; 1148 } 1149 1150 static long seccomp_notify_ioctl(struct file *file, unsigned int cmd, 1151 unsigned long arg) 1152 { 1153 struct seccomp_filter *filter = file->private_data; 1154 void __user *buf = (void __user *)arg; 1155 1156 switch (cmd) { 1157 case SECCOMP_IOCTL_NOTIF_RECV: 1158 return seccomp_notify_recv(filter, buf); 1159 case SECCOMP_IOCTL_NOTIF_SEND: 1160 return seccomp_notify_send(filter, buf); 1161 case SECCOMP_IOCTL_NOTIF_ID_VALID: 1162 return seccomp_notify_id_valid(filter, buf); 1163 default: 1164 return -EINVAL; 1165 } 1166 } 1167 1168 static __poll_t seccomp_notify_poll(struct file *file, 1169 struct poll_table_struct *poll_tab) 1170 { 1171 struct seccomp_filter *filter = file->private_data; 1172 __poll_t ret = 0; 1173 struct seccomp_knotif *cur; 1174 1175 poll_wait(file, &filter->notif->wqh, poll_tab); 1176 1177 if (mutex_lock_interruptible(&filter->notify_lock) < 0) 1178 return EPOLLERR; 1179 1180 list_for_each_entry(cur, &filter->notif->notifications, list) { 1181 if (cur->state == SECCOMP_NOTIFY_INIT) 1182 ret |= EPOLLIN | EPOLLRDNORM; 1183 if (cur->state == SECCOMP_NOTIFY_SENT) 1184 ret |= EPOLLOUT | EPOLLWRNORM; 1185 if ((ret & EPOLLIN) && (ret & EPOLLOUT)) 1186 break; 1187 } 1188 1189 mutex_unlock(&filter->notify_lock); 1190 1191 return ret; 1192 } 1193 1194 static const struct file_operations seccomp_notify_ops = { 1195 .poll = seccomp_notify_poll, 1196 .release = seccomp_notify_release, 1197 .unlocked_ioctl = seccomp_notify_ioctl, 1198 }; 1199 1200 static struct file *init_listener(struct seccomp_filter *filter) 1201 { 1202 struct file *ret = ERR_PTR(-EBUSY); 1203 struct seccomp_filter *cur; 1204 1205 for (cur = current->seccomp.filter; cur; cur = cur->prev) { 1206 if (cur->notif) 1207 goto out; 1208 } 1209 1210 ret = ERR_PTR(-ENOMEM); 1211 filter->notif = kzalloc(sizeof(*(filter->notif)), GFP_KERNEL); 1212 if (!filter->notif) 1213 goto out; 1214 1215 sema_init(&filter->notif->request, 0); 1216 filter->notif->next_id = get_random_u64(); 1217 INIT_LIST_HEAD(&filter->notif->notifications); 1218 init_waitqueue_head(&filter->notif->wqh); 1219 1220 ret = anon_inode_getfile("seccomp notify", &seccomp_notify_ops, 1221 filter, O_RDWR); 1222 if (IS_ERR(ret)) 1223 goto out_notif; 1224 1225 /* The file has a reference to it now */ 1226 __get_seccomp_filter(filter); 1227 1228 out_notif: 1229 if (IS_ERR(ret)) 1230 kfree(filter->notif); 1231 out: 1232 return ret; 1233 } 1234 1235 /** 1236 * seccomp_set_mode_filter: internal function for setting seccomp filter 1237 * @flags: flags to change filter behavior 1238 * @filter: struct sock_fprog containing filter 1239 * 1240 * This function may be called repeatedly to install additional filters. 1241 * Every filter successfully installed will be evaluated (in reverse order) 1242 * for each system call the task makes. 1243 * 1244 * Once current->seccomp.mode is non-zero, it may not be changed. 1245 * 1246 * Returns 0 on success or -EINVAL on failure. 1247 */ 1248 static long seccomp_set_mode_filter(unsigned int flags, 1249 const char __user *filter) 1250 { 1251 const unsigned long seccomp_mode = SECCOMP_MODE_FILTER; 1252 struct seccomp_filter *prepared = NULL; 1253 long ret = -EINVAL; 1254 int listener = -1; 1255 struct file *listener_f = NULL; 1256 1257 /* Validate flags. */ 1258 if (flags & ~SECCOMP_FILTER_FLAG_MASK) 1259 return -EINVAL; 1260 1261 /* Prepare the new filter before holding any locks. */ 1262 prepared = seccomp_prepare_user_filter(filter); 1263 if (IS_ERR(prepared)) 1264 return PTR_ERR(prepared); 1265 1266 if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) { 1267 listener = get_unused_fd_flags(O_CLOEXEC); 1268 if (listener < 0) { 1269 ret = listener; 1270 goto out_free; 1271 } 1272 1273 listener_f = init_listener(prepared); 1274 if (IS_ERR(listener_f)) { 1275 put_unused_fd(listener); 1276 ret = PTR_ERR(listener_f); 1277 goto out_free; 1278 } 1279 } 1280 1281 /* 1282 * Make sure we cannot change seccomp or nnp state via TSYNC 1283 * while another thread is in the middle of calling exec. 1284 */ 1285 if (flags & SECCOMP_FILTER_FLAG_TSYNC && 1286 mutex_lock_killable(¤t->signal->cred_guard_mutex)) 1287 goto out_put_fd; 1288 1289 spin_lock_irq(¤t->sighand->siglock); 1290 1291 if (!seccomp_may_assign_mode(seccomp_mode)) 1292 goto out; 1293 1294 ret = seccomp_attach_filter(flags, prepared); 1295 if (ret) 1296 goto out; 1297 /* Do not free the successfully attached filter. */ 1298 prepared = NULL; 1299 1300 seccomp_assign_mode(current, seccomp_mode, flags); 1301 out: 1302 spin_unlock_irq(¤t->sighand->siglock); 1303 if (flags & SECCOMP_FILTER_FLAG_TSYNC) 1304 mutex_unlock(¤t->signal->cred_guard_mutex); 1305 out_put_fd: 1306 if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) { 1307 if (ret < 0) { 1308 listener_f->private_data = NULL; 1309 fput(listener_f); 1310 put_unused_fd(listener); 1311 } else { 1312 fd_install(listener, listener_f); 1313 ret = listener; 1314 } 1315 } 1316 out_free: 1317 seccomp_filter_free(prepared); 1318 return ret; 1319 } 1320 #else 1321 static inline long seccomp_set_mode_filter(unsigned int flags, 1322 const char __user *filter) 1323 { 1324 return -EINVAL; 1325 } 1326 #endif 1327 1328 static long seccomp_get_action_avail(const char __user *uaction) 1329 { 1330 u32 action; 1331 1332 if (copy_from_user(&action, uaction, sizeof(action))) 1333 return -EFAULT; 1334 1335 switch (action) { 1336 case SECCOMP_RET_KILL_PROCESS: 1337 case SECCOMP_RET_KILL_THREAD: 1338 case SECCOMP_RET_TRAP: 1339 case SECCOMP_RET_ERRNO: 1340 case SECCOMP_RET_USER_NOTIF: 1341 case SECCOMP_RET_TRACE: 1342 case SECCOMP_RET_LOG: 1343 case SECCOMP_RET_ALLOW: 1344 break; 1345 default: 1346 return -EOPNOTSUPP; 1347 } 1348 1349 return 0; 1350 } 1351 1352 static long seccomp_get_notif_sizes(void __user *usizes) 1353 { 1354 struct seccomp_notif_sizes sizes = { 1355 .seccomp_notif = sizeof(struct seccomp_notif), 1356 .seccomp_notif_resp = sizeof(struct seccomp_notif_resp), 1357 .seccomp_data = sizeof(struct seccomp_data), 1358 }; 1359 1360 if (copy_to_user(usizes, &sizes, sizeof(sizes))) 1361 return -EFAULT; 1362 1363 return 0; 1364 } 1365 1366 /* Common entry point for both prctl and syscall. */ 1367 static long do_seccomp(unsigned int op, unsigned int flags, 1368 void __user *uargs) 1369 { 1370 switch (op) { 1371 case SECCOMP_SET_MODE_STRICT: 1372 if (flags != 0 || uargs != NULL) 1373 return -EINVAL; 1374 return seccomp_set_mode_strict(); 1375 case SECCOMP_SET_MODE_FILTER: 1376 return seccomp_set_mode_filter(flags, uargs); 1377 case SECCOMP_GET_ACTION_AVAIL: 1378 if (flags != 0) 1379 return -EINVAL; 1380 1381 return seccomp_get_action_avail(uargs); 1382 case SECCOMP_GET_NOTIF_SIZES: 1383 if (flags != 0) 1384 return -EINVAL; 1385 1386 return seccomp_get_notif_sizes(uargs); 1387 default: 1388 return -EINVAL; 1389 } 1390 } 1391 1392 SYSCALL_DEFINE3(seccomp, unsigned int, op, unsigned int, flags, 1393 void __user *, uargs) 1394 { 1395 return do_seccomp(op, flags, uargs); 1396 } 1397 1398 /** 1399 * prctl_set_seccomp: configures current->seccomp.mode 1400 * @seccomp_mode: requested mode to use 1401 * @filter: optional struct sock_fprog for use with SECCOMP_MODE_FILTER 1402 * 1403 * Returns 0 on success or -EINVAL on failure. 1404 */ 1405 long prctl_set_seccomp(unsigned long seccomp_mode, void __user *filter) 1406 { 1407 unsigned int op; 1408 void __user *uargs; 1409 1410 switch (seccomp_mode) { 1411 case SECCOMP_MODE_STRICT: 1412 op = SECCOMP_SET_MODE_STRICT; 1413 /* 1414 * Setting strict mode through prctl always ignored filter, 1415 * so make sure it is always NULL here to pass the internal 1416 * check in do_seccomp(). 1417 */ 1418 uargs = NULL; 1419 break; 1420 case SECCOMP_MODE_FILTER: 1421 op = SECCOMP_SET_MODE_FILTER; 1422 uargs = filter; 1423 break; 1424 default: 1425 return -EINVAL; 1426 } 1427 1428 /* prctl interface doesn't have flags, so they are always zero. */ 1429 return do_seccomp(op, 0, uargs); 1430 } 1431 1432 #if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE) 1433 static struct seccomp_filter *get_nth_filter(struct task_struct *task, 1434 unsigned long filter_off) 1435 { 1436 struct seccomp_filter *orig, *filter; 1437 unsigned long count; 1438 1439 /* 1440 * Note: this is only correct because the caller should be the (ptrace) 1441 * tracer of the task, otherwise lock_task_sighand is needed. 1442 */ 1443 spin_lock_irq(&task->sighand->siglock); 1444 1445 if (task->seccomp.mode != SECCOMP_MODE_FILTER) { 1446 spin_unlock_irq(&task->sighand->siglock); 1447 return ERR_PTR(-EINVAL); 1448 } 1449 1450 orig = task->seccomp.filter; 1451 __get_seccomp_filter(orig); 1452 spin_unlock_irq(&task->sighand->siglock); 1453 1454 count = 0; 1455 for (filter = orig; filter; filter = filter->prev) 1456 count++; 1457 1458 if (filter_off >= count) { 1459 filter = ERR_PTR(-ENOENT); 1460 goto out; 1461 } 1462 1463 count -= filter_off; 1464 for (filter = orig; filter && count > 1; filter = filter->prev) 1465 count--; 1466 1467 if (WARN_ON(count != 1 || !filter)) { 1468 filter = ERR_PTR(-ENOENT); 1469 goto out; 1470 } 1471 1472 __get_seccomp_filter(filter); 1473 1474 out: 1475 __put_seccomp_filter(orig); 1476 return filter; 1477 } 1478 1479 long seccomp_get_filter(struct task_struct *task, unsigned long filter_off, 1480 void __user *data) 1481 { 1482 struct seccomp_filter *filter; 1483 struct sock_fprog_kern *fprog; 1484 long ret; 1485 1486 if (!capable(CAP_SYS_ADMIN) || 1487 current->seccomp.mode != SECCOMP_MODE_DISABLED) { 1488 return -EACCES; 1489 } 1490 1491 filter = get_nth_filter(task, filter_off); 1492 if (IS_ERR(filter)) 1493 return PTR_ERR(filter); 1494 1495 fprog = filter->prog->orig_prog; 1496 if (!fprog) { 1497 /* This must be a new non-cBPF filter, since we save 1498 * every cBPF filter's orig_prog above when 1499 * CONFIG_CHECKPOINT_RESTORE is enabled. 1500 */ 1501 ret = -EMEDIUMTYPE; 1502 goto out; 1503 } 1504 1505 ret = fprog->len; 1506 if (!data) 1507 goto out; 1508 1509 if (copy_to_user(data, fprog->filter, bpf_classic_proglen(fprog))) 1510 ret = -EFAULT; 1511 1512 out: 1513 __put_seccomp_filter(filter); 1514 return ret; 1515 } 1516 1517 long seccomp_get_metadata(struct task_struct *task, 1518 unsigned long size, void __user *data) 1519 { 1520 long ret; 1521 struct seccomp_filter *filter; 1522 struct seccomp_metadata kmd = {}; 1523 1524 if (!capable(CAP_SYS_ADMIN) || 1525 current->seccomp.mode != SECCOMP_MODE_DISABLED) { 1526 return -EACCES; 1527 } 1528 1529 size = min_t(unsigned long, size, sizeof(kmd)); 1530 1531 if (size < sizeof(kmd.filter_off)) 1532 return -EINVAL; 1533 1534 if (copy_from_user(&kmd.filter_off, data, sizeof(kmd.filter_off))) 1535 return -EFAULT; 1536 1537 filter = get_nth_filter(task, kmd.filter_off); 1538 if (IS_ERR(filter)) 1539 return PTR_ERR(filter); 1540 1541 if (filter->log) 1542 kmd.flags |= SECCOMP_FILTER_FLAG_LOG; 1543 1544 ret = size; 1545 if (copy_to_user(data, &kmd, size)) 1546 ret = -EFAULT; 1547 1548 __put_seccomp_filter(filter); 1549 return ret; 1550 } 1551 #endif 1552 1553 #ifdef CONFIG_SYSCTL 1554 1555 /* Human readable action names for friendly sysctl interaction */ 1556 #define SECCOMP_RET_KILL_PROCESS_NAME "kill_process" 1557 #define SECCOMP_RET_KILL_THREAD_NAME "kill_thread" 1558 #define SECCOMP_RET_TRAP_NAME "trap" 1559 #define SECCOMP_RET_ERRNO_NAME "errno" 1560 #define SECCOMP_RET_USER_NOTIF_NAME "user_notif" 1561 #define SECCOMP_RET_TRACE_NAME "trace" 1562 #define SECCOMP_RET_LOG_NAME "log" 1563 #define SECCOMP_RET_ALLOW_NAME "allow" 1564 1565 static const char seccomp_actions_avail[] = 1566 SECCOMP_RET_KILL_PROCESS_NAME " " 1567 SECCOMP_RET_KILL_THREAD_NAME " " 1568 SECCOMP_RET_TRAP_NAME " " 1569 SECCOMP_RET_ERRNO_NAME " " 1570 SECCOMP_RET_USER_NOTIF_NAME " " 1571 SECCOMP_RET_TRACE_NAME " " 1572 SECCOMP_RET_LOG_NAME " " 1573 SECCOMP_RET_ALLOW_NAME; 1574 1575 struct seccomp_log_name { 1576 u32 log; 1577 const char *name; 1578 }; 1579 1580 static const struct seccomp_log_name seccomp_log_names[] = { 1581 { SECCOMP_LOG_KILL_PROCESS, SECCOMP_RET_KILL_PROCESS_NAME }, 1582 { SECCOMP_LOG_KILL_THREAD, SECCOMP_RET_KILL_THREAD_NAME }, 1583 { SECCOMP_LOG_TRAP, SECCOMP_RET_TRAP_NAME }, 1584 { SECCOMP_LOG_ERRNO, SECCOMP_RET_ERRNO_NAME }, 1585 { SECCOMP_LOG_USER_NOTIF, SECCOMP_RET_USER_NOTIF_NAME }, 1586 { SECCOMP_LOG_TRACE, SECCOMP_RET_TRACE_NAME }, 1587 { SECCOMP_LOG_LOG, SECCOMP_RET_LOG_NAME }, 1588 { SECCOMP_LOG_ALLOW, SECCOMP_RET_ALLOW_NAME }, 1589 { } 1590 }; 1591 1592 static bool seccomp_names_from_actions_logged(char *names, size_t size, 1593 u32 actions_logged, 1594 const char *sep) 1595 { 1596 const struct seccomp_log_name *cur; 1597 bool append_sep = false; 1598 1599 for (cur = seccomp_log_names; cur->name && size; cur++) { 1600 ssize_t ret; 1601 1602 if (!(actions_logged & cur->log)) 1603 continue; 1604 1605 if (append_sep) { 1606 ret = strscpy(names, sep, size); 1607 if (ret < 0) 1608 return false; 1609 1610 names += ret; 1611 size -= ret; 1612 } else 1613 append_sep = true; 1614 1615 ret = strscpy(names, cur->name, size); 1616 if (ret < 0) 1617 return false; 1618 1619 names += ret; 1620 size -= ret; 1621 } 1622 1623 return true; 1624 } 1625 1626 static bool seccomp_action_logged_from_name(u32 *action_logged, 1627 const char *name) 1628 { 1629 const struct seccomp_log_name *cur; 1630 1631 for (cur = seccomp_log_names; cur->name; cur++) { 1632 if (!strcmp(cur->name, name)) { 1633 *action_logged = cur->log; 1634 return true; 1635 } 1636 } 1637 1638 return false; 1639 } 1640 1641 static bool seccomp_actions_logged_from_names(u32 *actions_logged, char *names) 1642 { 1643 char *name; 1644 1645 *actions_logged = 0; 1646 while ((name = strsep(&names, " ")) && *name) { 1647 u32 action_logged = 0; 1648 1649 if (!seccomp_action_logged_from_name(&action_logged, name)) 1650 return false; 1651 1652 *actions_logged |= action_logged; 1653 } 1654 1655 return true; 1656 } 1657 1658 static int read_actions_logged(struct ctl_table *ro_table, void __user *buffer, 1659 size_t *lenp, loff_t *ppos) 1660 { 1661 char names[sizeof(seccomp_actions_avail)]; 1662 struct ctl_table table; 1663 1664 memset(names, 0, sizeof(names)); 1665 1666 if (!seccomp_names_from_actions_logged(names, sizeof(names), 1667 seccomp_actions_logged, " ")) 1668 return -EINVAL; 1669 1670 table = *ro_table; 1671 table.data = names; 1672 table.maxlen = sizeof(names); 1673 return proc_dostring(&table, 0, buffer, lenp, ppos); 1674 } 1675 1676 static int write_actions_logged(struct ctl_table *ro_table, void __user *buffer, 1677 size_t *lenp, loff_t *ppos, u32 *actions_logged) 1678 { 1679 char names[sizeof(seccomp_actions_avail)]; 1680 struct ctl_table table; 1681 int ret; 1682 1683 if (!capable(CAP_SYS_ADMIN)) 1684 return -EPERM; 1685 1686 memset(names, 0, sizeof(names)); 1687 1688 table = *ro_table; 1689 table.data = names; 1690 table.maxlen = sizeof(names); 1691 ret = proc_dostring(&table, 1, buffer, lenp, ppos); 1692 if (ret) 1693 return ret; 1694 1695 if (!seccomp_actions_logged_from_names(actions_logged, table.data)) 1696 return -EINVAL; 1697 1698 if (*actions_logged & SECCOMP_LOG_ALLOW) 1699 return -EINVAL; 1700 1701 seccomp_actions_logged = *actions_logged; 1702 return 0; 1703 } 1704 1705 static void audit_actions_logged(u32 actions_logged, u32 old_actions_logged, 1706 int ret) 1707 { 1708 char names[sizeof(seccomp_actions_avail)]; 1709 char old_names[sizeof(seccomp_actions_avail)]; 1710 const char *new = names; 1711 const char *old = old_names; 1712 1713 if (!audit_enabled) 1714 return; 1715 1716 memset(names, 0, sizeof(names)); 1717 memset(old_names, 0, sizeof(old_names)); 1718 1719 if (ret) 1720 new = "?"; 1721 else if (!actions_logged) 1722 new = "(none)"; 1723 else if (!seccomp_names_from_actions_logged(names, sizeof(names), 1724 actions_logged, ",")) 1725 new = "?"; 1726 1727 if (!old_actions_logged) 1728 old = "(none)"; 1729 else if (!seccomp_names_from_actions_logged(old_names, 1730 sizeof(old_names), 1731 old_actions_logged, ",")) 1732 old = "?"; 1733 1734 return audit_seccomp_actions_logged(new, old, !ret); 1735 } 1736 1737 static int seccomp_actions_logged_handler(struct ctl_table *ro_table, int write, 1738 void __user *buffer, size_t *lenp, 1739 loff_t *ppos) 1740 { 1741 int ret; 1742 1743 if (write) { 1744 u32 actions_logged = 0; 1745 u32 old_actions_logged = seccomp_actions_logged; 1746 1747 ret = write_actions_logged(ro_table, buffer, lenp, ppos, 1748 &actions_logged); 1749 audit_actions_logged(actions_logged, old_actions_logged, ret); 1750 } else 1751 ret = read_actions_logged(ro_table, buffer, lenp, ppos); 1752 1753 return ret; 1754 } 1755 1756 static struct ctl_path seccomp_sysctl_path[] = { 1757 { .procname = "kernel", }, 1758 { .procname = "seccomp", }, 1759 { } 1760 }; 1761 1762 static struct ctl_table seccomp_sysctl_table[] = { 1763 { 1764 .procname = "actions_avail", 1765 .data = (void *) &seccomp_actions_avail, 1766 .maxlen = sizeof(seccomp_actions_avail), 1767 .mode = 0444, 1768 .proc_handler = proc_dostring, 1769 }, 1770 { 1771 .procname = "actions_logged", 1772 .mode = 0644, 1773 .proc_handler = seccomp_actions_logged_handler, 1774 }, 1775 { } 1776 }; 1777 1778 static int __init seccomp_sysctl_init(void) 1779 { 1780 struct ctl_table_header *hdr; 1781 1782 hdr = register_sysctl_paths(seccomp_sysctl_path, seccomp_sysctl_table); 1783 if (!hdr) 1784 pr_warn("seccomp: sysctl registration failed\n"); 1785 else 1786 kmemleak_not_leak(hdr); 1787 1788 return 0; 1789 } 1790 1791 device_initcall(seccomp_sysctl_init) 1792 1793 #endif /* CONFIG_SYSCTL */ 1794