1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * linux/kernel/seccomp.c 4 * 5 * Copyright 2004-2005 Andrea Arcangeli <andrea@cpushare.com> 6 * 7 * Copyright (C) 2012 Google, Inc. 8 * Will Drewry <wad@chromium.org> 9 * 10 * This defines a simple but solid secure-computing facility. 11 * 12 * Mode 1 uses a fixed list of allowed system calls. 13 * Mode 2 allows user-defined system call filters in the form 14 * of Berkeley Packet Filters/Linux Socket Filters. 15 */ 16 #define pr_fmt(fmt) "seccomp: " fmt 17 18 #include <linux/refcount.h> 19 #include <linux/audit.h> 20 #include <linux/compat.h> 21 #include <linux/coredump.h> 22 #include <linux/kmemleak.h> 23 #include <linux/nospec.h> 24 #include <linux/prctl.h> 25 #include <linux/sched.h> 26 #include <linux/sched/task_stack.h> 27 #include <linux/seccomp.h> 28 #include <linux/slab.h> 29 #include <linux/syscalls.h> 30 #include <linux/sysctl.h> 31 32 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER 33 #include <asm/syscall.h> 34 #endif 35 36 #ifdef CONFIG_SECCOMP_FILTER 37 #include <linux/file.h> 38 #include <linux/filter.h> 39 #include <linux/pid.h> 40 #include <linux/ptrace.h> 41 #include <linux/capability.h> 42 #include <linux/tracehook.h> 43 #include <linux/uaccess.h> 44 #include <linux/anon_inodes.h> 45 #include <linux/lockdep.h> 46 47 /* 48 * When SECCOMP_IOCTL_NOTIF_ID_VALID was first introduced, it had the 49 * wrong direction flag in the ioctl number. This is the broken one, 50 * which the kernel needs to keep supporting until all userspaces stop 51 * using the wrong command number. 52 */ 53 #define SECCOMP_IOCTL_NOTIF_ID_VALID_WRONG_DIR SECCOMP_IOR(2, __u64) 54 55 enum notify_state { 56 SECCOMP_NOTIFY_INIT, 57 SECCOMP_NOTIFY_SENT, 58 SECCOMP_NOTIFY_REPLIED, 59 }; 60 61 struct seccomp_knotif { 62 /* The struct pid of the task whose filter triggered the notification */ 63 struct task_struct *task; 64 65 /* The "cookie" for this request; this is unique for this filter. */ 66 u64 id; 67 68 /* 69 * The seccomp data. This pointer is valid the entire time this 70 * notification is active, since it comes from __seccomp_filter which 71 * eclipses the entire lifecycle here. 72 */ 73 const struct seccomp_data *data; 74 75 /* 76 * Notification states. When SECCOMP_RET_USER_NOTIF is returned, a 77 * struct seccomp_knotif is created and starts out in INIT. Once the 78 * handler reads the notification off of an FD, it transitions to SENT. 79 * If a signal is received the state transitions back to INIT and 80 * another message is sent. When the userspace handler replies, state 81 * transitions to REPLIED. 82 */ 83 enum notify_state state; 84 85 /* The return values, only valid when in SECCOMP_NOTIFY_REPLIED */ 86 int error; 87 long val; 88 u32 flags; 89 90 /* 91 * Signals when this has changed states, such as the listener 92 * dying, a new seccomp addfd message, or changing to REPLIED 93 */ 94 struct completion ready; 95 96 struct list_head list; 97 98 /* outstanding addfd requests */ 99 struct list_head addfd; 100 }; 101 102 /** 103 * struct seccomp_kaddfd - container for seccomp_addfd ioctl messages 104 * 105 * @file: A reference to the file to install in the other task 106 * @fd: The fd number to install it at. If the fd number is -1, it means the 107 * installing process should allocate the fd as normal. 108 * @flags: The flags for the new file descriptor. At the moment, only O_CLOEXEC 109 * is allowed. 110 * @ioctl_flags: The flags used for the seccomp_addfd ioctl. 111 * @ret: The return value of the installing process. It is set to the fd num 112 * upon success (>= 0). 113 * @completion: Indicates that the installing process has completed fd 114 * installation, or gone away (either due to successful 115 * reply, or signal) 116 * 117 */ 118 struct seccomp_kaddfd { 119 struct file *file; 120 int fd; 121 unsigned int flags; 122 __u32 ioctl_flags; 123 124 union { 125 bool setfd; 126 /* To only be set on reply */ 127 int ret; 128 }; 129 struct completion completion; 130 struct list_head list; 131 }; 132 133 /** 134 * struct notification - container for seccomp userspace notifications. Since 135 * most seccomp filters will not have notification listeners attached and this 136 * structure is fairly large, we store the notification-specific stuff in a 137 * separate structure. 138 * 139 * @request: A semaphore that users of this notification can wait on for 140 * changes. Actual reads and writes are still controlled with 141 * filter->notify_lock. 142 * @next_id: The id of the next request. 143 * @notifications: A list of struct seccomp_knotif elements. 144 */ 145 struct notification { 146 struct semaphore request; 147 u64 next_id; 148 struct list_head notifications; 149 }; 150 151 #ifdef SECCOMP_ARCH_NATIVE 152 /** 153 * struct action_cache - per-filter cache of seccomp actions per 154 * arch/syscall pair 155 * 156 * @allow_native: A bitmap where each bit represents whether the 157 * filter will always allow the syscall, for the 158 * native architecture. 159 * @allow_compat: A bitmap where each bit represents whether the 160 * filter will always allow the syscall, for the 161 * compat architecture. 162 */ 163 struct action_cache { 164 DECLARE_BITMAP(allow_native, SECCOMP_ARCH_NATIVE_NR); 165 #ifdef SECCOMP_ARCH_COMPAT 166 DECLARE_BITMAP(allow_compat, SECCOMP_ARCH_COMPAT_NR); 167 #endif 168 }; 169 #else 170 struct action_cache { }; 171 172 static inline bool seccomp_cache_check_allow(const struct seccomp_filter *sfilter, 173 const struct seccomp_data *sd) 174 { 175 return false; 176 } 177 178 static inline void seccomp_cache_prepare(struct seccomp_filter *sfilter) 179 { 180 } 181 #endif /* SECCOMP_ARCH_NATIVE */ 182 183 /** 184 * struct seccomp_filter - container for seccomp BPF programs 185 * 186 * @refs: Reference count to manage the object lifetime. 187 * A filter's reference count is incremented for each directly 188 * attached task, once for the dependent filter, and if 189 * requested for the user notifier. When @refs reaches zero, 190 * the filter can be freed. 191 * @users: A filter's @users count is incremented for each directly 192 * attached task (filter installation, fork(), thread_sync), 193 * and once for the dependent filter (tracked in filter->prev). 194 * When it reaches zero it indicates that no direct or indirect 195 * users of that filter exist. No new tasks can get associated with 196 * this filter after reaching 0. The @users count is always smaller 197 * or equal to @refs. Hence, reaching 0 for @users does not mean 198 * the filter can be freed. 199 * @cache: cache of arch/syscall mappings to actions 200 * @log: true if all actions except for SECCOMP_RET_ALLOW should be logged 201 * @prev: points to a previously installed, or inherited, filter 202 * @prog: the BPF program to evaluate 203 * @notif: the struct that holds all notification related information 204 * @notify_lock: A lock for all notification-related accesses. 205 * @wqh: A wait queue for poll if a notifier is in use. 206 * 207 * seccomp_filter objects are organized in a tree linked via the @prev 208 * pointer. For any task, it appears to be a singly-linked list starting 209 * with current->seccomp.filter, the most recently attached or inherited filter. 210 * However, multiple filters may share a @prev node, by way of fork(), which 211 * results in a unidirectional tree existing in memory. This is similar to 212 * how namespaces work. 213 * 214 * seccomp_filter objects should never be modified after being attached 215 * to a task_struct (other than @refs). 216 */ 217 struct seccomp_filter { 218 refcount_t refs; 219 refcount_t users; 220 bool log; 221 struct action_cache cache; 222 struct seccomp_filter *prev; 223 struct bpf_prog *prog; 224 struct notification *notif; 225 struct mutex notify_lock; 226 wait_queue_head_t wqh; 227 }; 228 229 /* Limit any path through the tree to 256KB worth of instructions. */ 230 #define MAX_INSNS_PER_PATH ((1 << 18) / sizeof(struct sock_filter)) 231 232 /* 233 * Endianness is explicitly ignored and left for BPF program authors to manage 234 * as per the specific architecture. 235 */ 236 static void populate_seccomp_data(struct seccomp_data *sd) 237 { 238 /* 239 * Instead of using current_pt_reg(), we're already doing the work 240 * to safely fetch "current", so just use "task" everywhere below. 241 */ 242 struct task_struct *task = current; 243 struct pt_regs *regs = task_pt_regs(task); 244 unsigned long args[6]; 245 246 sd->nr = syscall_get_nr(task, regs); 247 sd->arch = syscall_get_arch(task); 248 syscall_get_arguments(task, regs, args); 249 sd->args[0] = args[0]; 250 sd->args[1] = args[1]; 251 sd->args[2] = args[2]; 252 sd->args[3] = args[3]; 253 sd->args[4] = args[4]; 254 sd->args[5] = args[5]; 255 sd->instruction_pointer = KSTK_EIP(task); 256 } 257 258 /** 259 * seccomp_check_filter - verify seccomp filter code 260 * @filter: filter to verify 261 * @flen: length of filter 262 * 263 * Takes a previously checked filter (by bpf_check_classic) and 264 * redirects all filter code that loads struct sk_buff data 265 * and related data through seccomp_bpf_load. It also 266 * enforces length and alignment checking of those loads. 267 * 268 * Returns 0 if the rule set is legal or -EINVAL if not. 269 */ 270 static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen) 271 { 272 int pc; 273 for (pc = 0; pc < flen; pc++) { 274 struct sock_filter *ftest = &filter[pc]; 275 u16 code = ftest->code; 276 u32 k = ftest->k; 277 278 switch (code) { 279 case BPF_LD | BPF_W | BPF_ABS: 280 ftest->code = BPF_LDX | BPF_W | BPF_ABS; 281 /* 32-bit aligned and not out of bounds. */ 282 if (k >= sizeof(struct seccomp_data) || k & 3) 283 return -EINVAL; 284 continue; 285 case BPF_LD | BPF_W | BPF_LEN: 286 ftest->code = BPF_LD | BPF_IMM; 287 ftest->k = sizeof(struct seccomp_data); 288 continue; 289 case BPF_LDX | BPF_W | BPF_LEN: 290 ftest->code = BPF_LDX | BPF_IMM; 291 ftest->k = sizeof(struct seccomp_data); 292 continue; 293 /* Explicitly include allowed calls. */ 294 case BPF_RET | BPF_K: 295 case BPF_RET | BPF_A: 296 case BPF_ALU | BPF_ADD | BPF_K: 297 case BPF_ALU | BPF_ADD | BPF_X: 298 case BPF_ALU | BPF_SUB | BPF_K: 299 case BPF_ALU | BPF_SUB | BPF_X: 300 case BPF_ALU | BPF_MUL | BPF_K: 301 case BPF_ALU | BPF_MUL | BPF_X: 302 case BPF_ALU | BPF_DIV | BPF_K: 303 case BPF_ALU | BPF_DIV | BPF_X: 304 case BPF_ALU | BPF_AND | BPF_K: 305 case BPF_ALU | BPF_AND | BPF_X: 306 case BPF_ALU | BPF_OR | BPF_K: 307 case BPF_ALU | BPF_OR | BPF_X: 308 case BPF_ALU | BPF_XOR | BPF_K: 309 case BPF_ALU | BPF_XOR | BPF_X: 310 case BPF_ALU | BPF_LSH | BPF_K: 311 case BPF_ALU | BPF_LSH | BPF_X: 312 case BPF_ALU | BPF_RSH | BPF_K: 313 case BPF_ALU | BPF_RSH | BPF_X: 314 case BPF_ALU | BPF_NEG: 315 case BPF_LD | BPF_IMM: 316 case BPF_LDX | BPF_IMM: 317 case BPF_MISC | BPF_TAX: 318 case BPF_MISC | BPF_TXA: 319 case BPF_LD | BPF_MEM: 320 case BPF_LDX | BPF_MEM: 321 case BPF_ST: 322 case BPF_STX: 323 case BPF_JMP | BPF_JA: 324 case BPF_JMP | BPF_JEQ | BPF_K: 325 case BPF_JMP | BPF_JEQ | BPF_X: 326 case BPF_JMP | BPF_JGE | BPF_K: 327 case BPF_JMP | BPF_JGE | BPF_X: 328 case BPF_JMP | BPF_JGT | BPF_K: 329 case BPF_JMP | BPF_JGT | BPF_X: 330 case BPF_JMP | BPF_JSET | BPF_K: 331 case BPF_JMP | BPF_JSET | BPF_X: 332 continue; 333 default: 334 return -EINVAL; 335 } 336 } 337 return 0; 338 } 339 340 #ifdef SECCOMP_ARCH_NATIVE 341 static inline bool seccomp_cache_check_allow_bitmap(const void *bitmap, 342 size_t bitmap_size, 343 int syscall_nr) 344 { 345 if (unlikely(syscall_nr < 0 || syscall_nr >= bitmap_size)) 346 return false; 347 syscall_nr = array_index_nospec(syscall_nr, bitmap_size); 348 349 return test_bit(syscall_nr, bitmap); 350 } 351 352 /** 353 * seccomp_cache_check_allow - lookup seccomp cache 354 * @sfilter: The seccomp filter 355 * @sd: The seccomp data to lookup the cache with 356 * 357 * Returns true if the seccomp_data is cached and allowed. 358 */ 359 static inline bool seccomp_cache_check_allow(const struct seccomp_filter *sfilter, 360 const struct seccomp_data *sd) 361 { 362 int syscall_nr = sd->nr; 363 const struct action_cache *cache = &sfilter->cache; 364 365 #ifndef SECCOMP_ARCH_COMPAT 366 /* A native-only architecture doesn't need to check sd->arch. */ 367 return seccomp_cache_check_allow_bitmap(cache->allow_native, 368 SECCOMP_ARCH_NATIVE_NR, 369 syscall_nr); 370 #else 371 if (likely(sd->arch == SECCOMP_ARCH_NATIVE)) 372 return seccomp_cache_check_allow_bitmap(cache->allow_native, 373 SECCOMP_ARCH_NATIVE_NR, 374 syscall_nr); 375 if (likely(sd->arch == SECCOMP_ARCH_COMPAT)) 376 return seccomp_cache_check_allow_bitmap(cache->allow_compat, 377 SECCOMP_ARCH_COMPAT_NR, 378 syscall_nr); 379 #endif /* SECCOMP_ARCH_COMPAT */ 380 381 WARN_ON_ONCE(true); 382 return false; 383 } 384 #endif /* SECCOMP_ARCH_NATIVE */ 385 386 /** 387 * seccomp_run_filters - evaluates all seccomp filters against @sd 388 * @sd: optional seccomp data to be passed to filters 389 * @match: stores struct seccomp_filter that resulted in the return value, 390 * unless filter returned SECCOMP_RET_ALLOW, in which case it will 391 * be unchanged. 392 * 393 * Returns valid seccomp BPF response codes. 394 */ 395 #define ACTION_ONLY(ret) ((s32)((ret) & (SECCOMP_RET_ACTION_FULL))) 396 static u32 seccomp_run_filters(const struct seccomp_data *sd, 397 struct seccomp_filter **match) 398 { 399 u32 ret = SECCOMP_RET_ALLOW; 400 /* Make sure cross-thread synced filter points somewhere sane. */ 401 struct seccomp_filter *f = 402 READ_ONCE(current->seccomp.filter); 403 404 /* Ensure unexpected behavior doesn't result in failing open. */ 405 if (WARN_ON(f == NULL)) 406 return SECCOMP_RET_KILL_PROCESS; 407 408 if (seccomp_cache_check_allow(f, sd)) 409 return SECCOMP_RET_ALLOW; 410 411 /* 412 * All filters in the list are evaluated and the lowest BPF return 413 * value always takes priority (ignoring the DATA). 414 */ 415 for (; f; f = f->prev) { 416 u32 cur_ret = bpf_prog_run_pin_on_cpu(f->prog, sd); 417 418 if (ACTION_ONLY(cur_ret) < ACTION_ONLY(ret)) { 419 ret = cur_ret; 420 *match = f; 421 } 422 } 423 return ret; 424 } 425 #endif /* CONFIG_SECCOMP_FILTER */ 426 427 static inline bool seccomp_may_assign_mode(unsigned long seccomp_mode) 428 { 429 assert_spin_locked(¤t->sighand->siglock); 430 431 if (current->seccomp.mode && current->seccomp.mode != seccomp_mode) 432 return false; 433 434 return true; 435 } 436 437 void __weak arch_seccomp_spec_mitigate(struct task_struct *task) { } 438 439 static inline void seccomp_assign_mode(struct task_struct *task, 440 unsigned long seccomp_mode, 441 unsigned long flags) 442 { 443 assert_spin_locked(&task->sighand->siglock); 444 445 task->seccomp.mode = seccomp_mode; 446 /* 447 * Make sure SYSCALL_WORK_SECCOMP cannot be set before the mode (and 448 * filter) is set. 449 */ 450 smp_mb__before_atomic(); 451 /* Assume default seccomp processes want spec flaw mitigation. */ 452 if ((flags & SECCOMP_FILTER_FLAG_SPEC_ALLOW) == 0) 453 arch_seccomp_spec_mitigate(task); 454 set_task_syscall_work(task, SECCOMP); 455 } 456 457 #ifdef CONFIG_SECCOMP_FILTER 458 /* Returns 1 if the parent is an ancestor of the child. */ 459 static int is_ancestor(struct seccomp_filter *parent, 460 struct seccomp_filter *child) 461 { 462 /* NULL is the root ancestor. */ 463 if (parent == NULL) 464 return 1; 465 for (; child; child = child->prev) 466 if (child == parent) 467 return 1; 468 return 0; 469 } 470 471 /** 472 * seccomp_can_sync_threads: checks if all threads can be synchronized 473 * 474 * Expects sighand and cred_guard_mutex locks to be held. 475 * 476 * Returns 0 on success, -ve on error, or the pid of a thread which was 477 * either not in the correct seccomp mode or did not have an ancestral 478 * seccomp filter. 479 */ 480 static inline pid_t seccomp_can_sync_threads(void) 481 { 482 struct task_struct *thread, *caller; 483 484 BUG_ON(!mutex_is_locked(¤t->signal->cred_guard_mutex)); 485 assert_spin_locked(¤t->sighand->siglock); 486 487 /* Validate all threads being eligible for synchronization. */ 488 caller = current; 489 for_each_thread(caller, thread) { 490 pid_t failed; 491 492 /* Skip current, since it is initiating the sync. */ 493 if (thread == caller) 494 continue; 495 496 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED || 497 (thread->seccomp.mode == SECCOMP_MODE_FILTER && 498 is_ancestor(thread->seccomp.filter, 499 caller->seccomp.filter))) 500 continue; 501 502 /* Return the first thread that cannot be synchronized. */ 503 failed = task_pid_vnr(thread); 504 /* If the pid cannot be resolved, then return -ESRCH */ 505 if (WARN_ON(failed == 0)) 506 failed = -ESRCH; 507 return failed; 508 } 509 510 return 0; 511 } 512 513 static inline void seccomp_filter_free(struct seccomp_filter *filter) 514 { 515 if (filter) { 516 bpf_prog_destroy(filter->prog); 517 kfree(filter); 518 } 519 } 520 521 static void __seccomp_filter_orphan(struct seccomp_filter *orig) 522 { 523 while (orig && refcount_dec_and_test(&orig->users)) { 524 if (waitqueue_active(&orig->wqh)) 525 wake_up_poll(&orig->wqh, EPOLLHUP); 526 orig = orig->prev; 527 } 528 } 529 530 static void __put_seccomp_filter(struct seccomp_filter *orig) 531 { 532 /* Clean up single-reference branches iteratively. */ 533 while (orig && refcount_dec_and_test(&orig->refs)) { 534 struct seccomp_filter *freeme = orig; 535 orig = orig->prev; 536 seccomp_filter_free(freeme); 537 } 538 } 539 540 static void __seccomp_filter_release(struct seccomp_filter *orig) 541 { 542 /* Notify about any unused filters in the task's former filter tree. */ 543 __seccomp_filter_orphan(orig); 544 /* Finally drop all references to the task's former tree. */ 545 __put_seccomp_filter(orig); 546 } 547 548 /** 549 * seccomp_filter_release - Detach the task from its filter tree, 550 * drop its reference count, and notify 551 * about unused filters 552 * 553 * This function should only be called when the task is exiting as 554 * it detaches it from its filter tree. As such, READ_ONCE() and 555 * barriers are not needed here, as would normally be needed. 556 */ 557 void seccomp_filter_release(struct task_struct *tsk) 558 { 559 struct seccomp_filter *orig = tsk->seccomp.filter; 560 561 /* We are effectively holding the siglock by not having any sighand. */ 562 WARN_ON(tsk->sighand != NULL); 563 564 /* Detach task from its filter tree. */ 565 tsk->seccomp.filter = NULL; 566 __seccomp_filter_release(orig); 567 } 568 569 /** 570 * seccomp_sync_threads: sets all threads to use current's filter 571 * 572 * Expects sighand and cred_guard_mutex locks to be held, and for 573 * seccomp_can_sync_threads() to have returned success already 574 * without dropping the locks. 575 * 576 */ 577 static inline void seccomp_sync_threads(unsigned long flags) 578 { 579 struct task_struct *thread, *caller; 580 581 BUG_ON(!mutex_is_locked(¤t->signal->cred_guard_mutex)); 582 assert_spin_locked(¤t->sighand->siglock); 583 584 /* Synchronize all threads. */ 585 caller = current; 586 for_each_thread(caller, thread) { 587 /* Skip current, since it needs no changes. */ 588 if (thread == caller) 589 continue; 590 591 /* Get a task reference for the new leaf node. */ 592 get_seccomp_filter(caller); 593 594 /* 595 * Drop the task reference to the shared ancestor since 596 * current's path will hold a reference. (This also 597 * allows a put before the assignment.) 598 */ 599 __seccomp_filter_release(thread->seccomp.filter); 600 601 /* Make our new filter tree visible. */ 602 smp_store_release(&thread->seccomp.filter, 603 caller->seccomp.filter); 604 atomic_set(&thread->seccomp.filter_count, 605 atomic_read(&thread->seccomp.filter_count)); 606 607 /* 608 * Don't let an unprivileged task work around 609 * the no_new_privs restriction by creating 610 * a thread that sets it up, enters seccomp, 611 * then dies. 612 */ 613 if (task_no_new_privs(caller)) 614 task_set_no_new_privs(thread); 615 616 /* 617 * Opt the other thread into seccomp if needed. 618 * As threads are considered to be trust-realm 619 * equivalent (see ptrace_may_access), it is safe to 620 * allow one thread to transition the other. 621 */ 622 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED) 623 seccomp_assign_mode(thread, SECCOMP_MODE_FILTER, 624 flags); 625 } 626 } 627 628 /** 629 * seccomp_prepare_filter: Prepares a seccomp filter for use. 630 * @fprog: BPF program to install 631 * 632 * Returns filter on success or an ERR_PTR on failure. 633 */ 634 static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog) 635 { 636 struct seccomp_filter *sfilter; 637 int ret; 638 const bool save_orig = 639 #if defined(CONFIG_CHECKPOINT_RESTORE) || defined(SECCOMP_ARCH_NATIVE) 640 true; 641 #else 642 false; 643 #endif 644 645 if (fprog->len == 0 || fprog->len > BPF_MAXINSNS) 646 return ERR_PTR(-EINVAL); 647 648 BUG_ON(INT_MAX / fprog->len < sizeof(struct sock_filter)); 649 650 /* 651 * Installing a seccomp filter requires that the task has 652 * CAP_SYS_ADMIN in its namespace or be running with no_new_privs. 653 * This avoids scenarios where unprivileged tasks can affect the 654 * behavior of privileged children. 655 */ 656 if (!task_no_new_privs(current) && 657 !ns_capable_noaudit(current_user_ns(), CAP_SYS_ADMIN)) 658 return ERR_PTR(-EACCES); 659 660 /* Allocate a new seccomp_filter */ 661 sfilter = kzalloc(sizeof(*sfilter), GFP_KERNEL | __GFP_NOWARN); 662 if (!sfilter) 663 return ERR_PTR(-ENOMEM); 664 665 mutex_init(&sfilter->notify_lock); 666 ret = bpf_prog_create_from_user(&sfilter->prog, fprog, 667 seccomp_check_filter, save_orig); 668 if (ret < 0) { 669 kfree(sfilter); 670 return ERR_PTR(ret); 671 } 672 673 refcount_set(&sfilter->refs, 1); 674 refcount_set(&sfilter->users, 1); 675 init_waitqueue_head(&sfilter->wqh); 676 677 return sfilter; 678 } 679 680 /** 681 * seccomp_prepare_user_filter - prepares a user-supplied sock_fprog 682 * @user_filter: pointer to the user data containing a sock_fprog. 683 * 684 * Returns 0 on success and non-zero otherwise. 685 */ 686 static struct seccomp_filter * 687 seccomp_prepare_user_filter(const char __user *user_filter) 688 { 689 struct sock_fprog fprog; 690 struct seccomp_filter *filter = ERR_PTR(-EFAULT); 691 692 #ifdef CONFIG_COMPAT 693 if (in_compat_syscall()) { 694 struct compat_sock_fprog fprog32; 695 if (copy_from_user(&fprog32, user_filter, sizeof(fprog32))) 696 goto out; 697 fprog.len = fprog32.len; 698 fprog.filter = compat_ptr(fprog32.filter); 699 } else /* falls through to the if below. */ 700 #endif 701 if (copy_from_user(&fprog, user_filter, sizeof(fprog))) 702 goto out; 703 filter = seccomp_prepare_filter(&fprog); 704 out: 705 return filter; 706 } 707 708 #ifdef SECCOMP_ARCH_NATIVE 709 /** 710 * seccomp_is_const_allow - check if filter is constant allow with given data 711 * @fprog: The BPF programs 712 * @sd: The seccomp data to check against, only syscall number and arch 713 * number are considered constant. 714 */ 715 static bool seccomp_is_const_allow(struct sock_fprog_kern *fprog, 716 struct seccomp_data *sd) 717 { 718 unsigned int reg_value = 0; 719 unsigned int pc; 720 bool op_res; 721 722 if (WARN_ON_ONCE(!fprog)) 723 return false; 724 725 for (pc = 0; pc < fprog->len; pc++) { 726 struct sock_filter *insn = &fprog->filter[pc]; 727 u16 code = insn->code; 728 u32 k = insn->k; 729 730 switch (code) { 731 case BPF_LD | BPF_W | BPF_ABS: 732 switch (k) { 733 case offsetof(struct seccomp_data, nr): 734 reg_value = sd->nr; 735 break; 736 case offsetof(struct seccomp_data, arch): 737 reg_value = sd->arch; 738 break; 739 default: 740 /* can't optimize (non-constant value load) */ 741 return false; 742 } 743 break; 744 case BPF_RET | BPF_K: 745 /* reached return with constant values only, check allow */ 746 return k == SECCOMP_RET_ALLOW; 747 case BPF_JMP | BPF_JA: 748 pc += insn->k; 749 break; 750 case BPF_JMP | BPF_JEQ | BPF_K: 751 case BPF_JMP | BPF_JGE | BPF_K: 752 case BPF_JMP | BPF_JGT | BPF_K: 753 case BPF_JMP | BPF_JSET | BPF_K: 754 switch (BPF_OP(code)) { 755 case BPF_JEQ: 756 op_res = reg_value == k; 757 break; 758 case BPF_JGE: 759 op_res = reg_value >= k; 760 break; 761 case BPF_JGT: 762 op_res = reg_value > k; 763 break; 764 case BPF_JSET: 765 op_res = !!(reg_value & k); 766 break; 767 default: 768 /* can't optimize (unknown jump) */ 769 return false; 770 } 771 772 pc += op_res ? insn->jt : insn->jf; 773 break; 774 case BPF_ALU | BPF_AND | BPF_K: 775 reg_value &= k; 776 break; 777 default: 778 /* can't optimize (unknown insn) */ 779 return false; 780 } 781 } 782 783 /* ran off the end of the filter?! */ 784 WARN_ON(1); 785 return false; 786 } 787 788 static void seccomp_cache_prepare_bitmap(struct seccomp_filter *sfilter, 789 void *bitmap, const void *bitmap_prev, 790 size_t bitmap_size, int arch) 791 { 792 struct sock_fprog_kern *fprog = sfilter->prog->orig_prog; 793 struct seccomp_data sd; 794 int nr; 795 796 if (bitmap_prev) { 797 /* The new filter must be as restrictive as the last. */ 798 bitmap_copy(bitmap, bitmap_prev, bitmap_size); 799 } else { 800 /* Before any filters, all syscalls are always allowed. */ 801 bitmap_fill(bitmap, bitmap_size); 802 } 803 804 for (nr = 0; nr < bitmap_size; nr++) { 805 /* No bitmap change: not a cacheable action. */ 806 if (!test_bit(nr, bitmap)) 807 continue; 808 809 sd.nr = nr; 810 sd.arch = arch; 811 812 /* No bitmap change: continue to always allow. */ 813 if (seccomp_is_const_allow(fprog, &sd)) 814 continue; 815 816 /* 817 * Not a cacheable action: always run filters. 818 * atomic clear_bit() not needed, filter not visible yet. 819 */ 820 __clear_bit(nr, bitmap); 821 } 822 } 823 824 /** 825 * seccomp_cache_prepare - emulate the filter to find cacheable syscalls 826 * @sfilter: The seccomp filter 827 * 828 * Returns 0 if successful or -errno if error occurred. 829 */ 830 static void seccomp_cache_prepare(struct seccomp_filter *sfilter) 831 { 832 struct action_cache *cache = &sfilter->cache; 833 const struct action_cache *cache_prev = 834 sfilter->prev ? &sfilter->prev->cache : NULL; 835 836 seccomp_cache_prepare_bitmap(sfilter, cache->allow_native, 837 cache_prev ? cache_prev->allow_native : NULL, 838 SECCOMP_ARCH_NATIVE_NR, 839 SECCOMP_ARCH_NATIVE); 840 841 #ifdef SECCOMP_ARCH_COMPAT 842 seccomp_cache_prepare_bitmap(sfilter, cache->allow_compat, 843 cache_prev ? cache_prev->allow_compat : NULL, 844 SECCOMP_ARCH_COMPAT_NR, 845 SECCOMP_ARCH_COMPAT); 846 #endif /* SECCOMP_ARCH_COMPAT */ 847 } 848 #endif /* SECCOMP_ARCH_NATIVE */ 849 850 /** 851 * seccomp_attach_filter: validate and attach filter 852 * @flags: flags to change filter behavior 853 * @filter: seccomp filter to add to the current process 854 * 855 * Caller must be holding current->sighand->siglock lock. 856 * 857 * Returns 0 on success, -ve on error, or 858 * - in TSYNC mode: the pid of a thread which was either not in the correct 859 * seccomp mode or did not have an ancestral seccomp filter 860 * - in NEW_LISTENER mode: the fd of the new listener 861 */ 862 static long seccomp_attach_filter(unsigned int flags, 863 struct seccomp_filter *filter) 864 { 865 unsigned long total_insns; 866 struct seccomp_filter *walker; 867 868 assert_spin_locked(¤t->sighand->siglock); 869 870 /* Validate resulting filter length. */ 871 total_insns = filter->prog->len; 872 for (walker = current->seccomp.filter; walker; walker = walker->prev) 873 total_insns += walker->prog->len + 4; /* 4 instr penalty */ 874 if (total_insns > MAX_INSNS_PER_PATH) 875 return -ENOMEM; 876 877 /* If thread sync has been requested, check that it is possible. */ 878 if (flags & SECCOMP_FILTER_FLAG_TSYNC) { 879 int ret; 880 881 ret = seccomp_can_sync_threads(); 882 if (ret) { 883 if (flags & SECCOMP_FILTER_FLAG_TSYNC_ESRCH) 884 return -ESRCH; 885 else 886 return ret; 887 } 888 } 889 890 /* Set log flag, if present. */ 891 if (flags & SECCOMP_FILTER_FLAG_LOG) 892 filter->log = true; 893 894 /* 895 * If there is an existing filter, make it the prev and don't drop its 896 * task reference. 897 */ 898 filter->prev = current->seccomp.filter; 899 seccomp_cache_prepare(filter); 900 current->seccomp.filter = filter; 901 atomic_inc(¤t->seccomp.filter_count); 902 903 /* Now that the new filter is in place, synchronize to all threads. */ 904 if (flags & SECCOMP_FILTER_FLAG_TSYNC) 905 seccomp_sync_threads(flags); 906 907 return 0; 908 } 909 910 static void __get_seccomp_filter(struct seccomp_filter *filter) 911 { 912 refcount_inc(&filter->refs); 913 } 914 915 /* get_seccomp_filter - increments the reference count of the filter on @tsk */ 916 void get_seccomp_filter(struct task_struct *tsk) 917 { 918 struct seccomp_filter *orig = tsk->seccomp.filter; 919 if (!orig) 920 return; 921 __get_seccomp_filter(orig); 922 refcount_inc(&orig->users); 923 } 924 925 static void seccomp_init_siginfo(kernel_siginfo_t *info, int syscall, int reason) 926 { 927 clear_siginfo(info); 928 info->si_signo = SIGSYS; 929 info->si_code = SYS_SECCOMP; 930 info->si_call_addr = (void __user *)KSTK_EIP(current); 931 info->si_errno = reason; 932 info->si_arch = syscall_get_arch(current); 933 info->si_syscall = syscall; 934 } 935 936 /** 937 * seccomp_send_sigsys - signals the task to allow in-process syscall emulation 938 * @syscall: syscall number to send to userland 939 * @reason: filter-supplied reason code to send to userland (via si_errno) 940 * 941 * Forces a SIGSYS with a code of SYS_SECCOMP and related sigsys info. 942 */ 943 static void seccomp_send_sigsys(int syscall, int reason) 944 { 945 struct kernel_siginfo info; 946 seccomp_init_siginfo(&info, syscall, reason); 947 force_sig_info(&info); 948 } 949 #endif /* CONFIG_SECCOMP_FILTER */ 950 951 /* For use with seccomp_actions_logged */ 952 #define SECCOMP_LOG_KILL_PROCESS (1 << 0) 953 #define SECCOMP_LOG_KILL_THREAD (1 << 1) 954 #define SECCOMP_LOG_TRAP (1 << 2) 955 #define SECCOMP_LOG_ERRNO (1 << 3) 956 #define SECCOMP_LOG_TRACE (1 << 4) 957 #define SECCOMP_LOG_LOG (1 << 5) 958 #define SECCOMP_LOG_ALLOW (1 << 6) 959 #define SECCOMP_LOG_USER_NOTIF (1 << 7) 960 961 static u32 seccomp_actions_logged = SECCOMP_LOG_KILL_PROCESS | 962 SECCOMP_LOG_KILL_THREAD | 963 SECCOMP_LOG_TRAP | 964 SECCOMP_LOG_ERRNO | 965 SECCOMP_LOG_USER_NOTIF | 966 SECCOMP_LOG_TRACE | 967 SECCOMP_LOG_LOG; 968 969 static inline void seccomp_log(unsigned long syscall, long signr, u32 action, 970 bool requested) 971 { 972 bool log = false; 973 974 switch (action) { 975 case SECCOMP_RET_ALLOW: 976 break; 977 case SECCOMP_RET_TRAP: 978 log = requested && seccomp_actions_logged & SECCOMP_LOG_TRAP; 979 break; 980 case SECCOMP_RET_ERRNO: 981 log = requested && seccomp_actions_logged & SECCOMP_LOG_ERRNO; 982 break; 983 case SECCOMP_RET_TRACE: 984 log = requested && seccomp_actions_logged & SECCOMP_LOG_TRACE; 985 break; 986 case SECCOMP_RET_USER_NOTIF: 987 log = requested && seccomp_actions_logged & SECCOMP_LOG_USER_NOTIF; 988 break; 989 case SECCOMP_RET_LOG: 990 log = seccomp_actions_logged & SECCOMP_LOG_LOG; 991 break; 992 case SECCOMP_RET_KILL_THREAD: 993 log = seccomp_actions_logged & SECCOMP_LOG_KILL_THREAD; 994 break; 995 case SECCOMP_RET_KILL_PROCESS: 996 default: 997 log = seccomp_actions_logged & SECCOMP_LOG_KILL_PROCESS; 998 } 999 1000 /* 1001 * Emit an audit message when the action is RET_KILL_*, RET_LOG, or the 1002 * FILTER_FLAG_LOG bit was set. The admin has the ability to silence 1003 * any action from being logged by removing the action name from the 1004 * seccomp_actions_logged sysctl. 1005 */ 1006 if (!log) 1007 return; 1008 1009 audit_seccomp(syscall, signr, action); 1010 } 1011 1012 /* 1013 * Secure computing mode 1 allows only read/write/exit/sigreturn. 1014 * To be fully secure this must be combined with rlimit 1015 * to limit the stack allocations too. 1016 */ 1017 static const int mode1_syscalls[] = { 1018 __NR_seccomp_read, __NR_seccomp_write, __NR_seccomp_exit, __NR_seccomp_sigreturn, 1019 -1, /* negative terminated */ 1020 }; 1021 1022 static void __secure_computing_strict(int this_syscall) 1023 { 1024 const int *allowed_syscalls = mode1_syscalls; 1025 #ifdef CONFIG_COMPAT 1026 if (in_compat_syscall()) 1027 allowed_syscalls = get_compat_mode1_syscalls(); 1028 #endif 1029 do { 1030 if (*allowed_syscalls == this_syscall) 1031 return; 1032 } while (*++allowed_syscalls != -1); 1033 1034 #ifdef SECCOMP_DEBUG 1035 dump_stack(); 1036 #endif 1037 seccomp_log(this_syscall, SIGKILL, SECCOMP_RET_KILL_THREAD, true); 1038 do_exit(SIGKILL); 1039 } 1040 1041 #ifndef CONFIG_HAVE_ARCH_SECCOMP_FILTER 1042 void secure_computing_strict(int this_syscall) 1043 { 1044 int mode = current->seccomp.mode; 1045 1046 if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) && 1047 unlikely(current->ptrace & PT_SUSPEND_SECCOMP)) 1048 return; 1049 1050 if (mode == SECCOMP_MODE_DISABLED) 1051 return; 1052 else if (mode == SECCOMP_MODE_STRICT) 1053 __secure_computing_strict(this_syscall); 1054 else 1055 BUG(); 1056 } 1057 #else 1058 1059 #ifdef CONFIG_SECCOMP_FILTER 1060 static u64 seccomp_next_notify_id(struct seccomp_filter *filter) 1061 { 1062 /* 1063 * Note: overflow is ok here, the id just needs to be unique per 1064 * filter. 1065 */ 1066 lockdep_assert_held(&filter->notify_lock); 1067 return filter->notif->next_id++; 1068 } 1069 1070 static void seccomp_handle_addfd(struct seccomp_kaddfd *addfd, struct seccomp_knotif *n) 1071 { 1072 int fd; 1073 1074 /* 1075 * Remove the notification, and reset the list pointers, indicating 1076 * that it has been handled. 1077 */ 1078 list_del_init(&addfd->list); 1079 if (!addfd->setfd) 1080 fd = receive_fd(addfd->file, addfd->flags); 1081 else 1082 fd = receive_fd_replace(addfd->fd, addfd->file, addfd->flags); 1083 addfd->ret = fd; 1084 1085 if (addfd->ioctl_flags & SECCOMP_ADDFD_FLAG_SEND) { 1086 /* If we fail reset and return an error to the notifier */ 1087 if (fd < 0) { 1088 n->state = SECCOMP_NOTIFY_SENT; 1089 } else { 1090 /* Return the FD we just added */ 1091 n->flags = 0; 1092 n->error = 0; 1093 n->val = fd; 1094 } 1095 } 1096 1097 /* 1098 * Mark the notification as completed. From this point, addfd mem 1099 * might be invalidated and we can't safely read it anymore. 1100 */ 1101 complete(&addfd->completion); 1102 } 1103 1104 static int seccomp_do_user_notification(int this_syscall, 1105 struct seccomp_filter *match, 1106 const struct seccomp_data *sd) 1107 { 1108 int err; 1109 u32 flags = 0; 1110 long ret = 0; 1111 struct seccomp_knotif n = {}; 1112 struct seccomp_kaddfd *addfd, *tmp; 1113 1114 mutex_lock(&match->notify_lock); 1115 err = -ENOSYS; 1116 if (!match->notif) 1117 goto out; 1118 1119 n.task = current; 1120 n.state = SECCOMP_NOTIFY_INIT; 1121 n.data = sd; 1122 n.id = seccomp_next_notify_id(match); 1123 init_completion(&n.ready); 1124 list_add(&n.list, &match->notif->notifications); 1125 INIT_LIST_HEAD(&n.addfd); 1126 1127 up(&match->notif->request); 1128 wake_up_poll(&match->wqh, EPOLLIN | EPOLLRDNORM); 1129 1130 /* 1131 * This is where we wait for a reply from userspace. 1132 */ 1133 do { 1134 mutex_unlock(&match->notify_lock); 1135 err = wait_for_completion_interruptible(&n.ready); 1136 mutex_lock(&match->notify_lock); 1137 if (err != 0) 1138 goto interrupted; 1139 1140 addfd = list_first_entry_or_null(&n.addfd, 1141 struct seccomp_kaddfd, list); 1142 /* Check if we were woken up by a addfd message */ 1143 if (addfd) 1144 seccomp_handle_addfd(addfd, &n); 1145 1146 } while (n.state != SECCOMP_NOTIFY_REPLIED); 1147 1148 ret = n.val; 1149 err = n.error; 1150 flags = n.flags; 1151 1152 interrupted: 1153 /* If there were any pending addfd calls, clear them out */ 1154 list_for_each_entry_safe(addfd, tmp, &n.addfd, list) { 1155 /* The process went away before we got a chance to handle it */ 1156 addfd->ret = -ESRCH; 1157 list_del_init(&addfd->list); 1158 complete(&addfd->completion); 1159 } 1160 1161 /* 1162 * Note that it's possible the listener died in between the time when 1163 * we were notified of a response (or a signal) and when we were able to 1164 * re-acquire the lock, so only delete from the list if the 1165 * notification actually exists. 1166 * 1167 * Also note that this test is only valid because there's no way to 1168 * *reattach* to a notifier right now. If one is added, we'll need to 1169 * keep track of the notif itself and make sure they match here. 1170 */ 1171 if (match->notif) 1172 list_del(&n.list); 1173 out: 1174 mutex_unlock(&match->notify_lock); 1175 1176 /* Userspace requests to continue the syscall. */ 1177 if (flags & SECCOMP_USER_NOTIF_FLAG_CONTINUE) 1178 return 0; 1179 1180 syscall_set_return_value(current, current_pt_regs(), 1181 err, ret); 1182 return -1; 1183 } 1184 1185 static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd, 1186 const bool recheck_after_trace) 1187 { 1188 u32 filter_ret, action; 1189 struct seccomp_filter *match = NULL; 1190 int data; 1191 struct seccomp_data sd_local; 1192 1193 /* 1194 * Make sure that any changes to mode from another thread have 1195 * been seen after SYSCALL_WORK_SECCOMP was seen. 1196 */ 1197 smp_rmb(); 1198 1199 if (!sd) { 1200 populate_seccomp_data(&sd_local); 1201 sd = &sd_local; 1202 } 1203 1204 filter_ret = seccomp_run_filters(sd, &match); 1205 data = filter_ret & SECCOMP_RET_DATA; 1206 action = filter_ret & SECCOMP_RET_ACTION_FULL; 1207 1208 switch (action) { 1209 case SECCOMP_RET_ERRNO: 1210 /* Set low-order bits as an errno, capped at MAX_ERRNO. */ 1211 if (data > MAX_ERRNO) 1212 data = MAX_ERRNO; 1213 syscall_set_return_value(current, current_pt_regs(), 1214 -data, 0); 1215 goto skip; 1216 1217 case SECCOMP_RET_TRAP: 1218 /* Show the handler the original registers. */ 1219 syscall_rollback(current, current_pt_regs()); 1220 /* Let the filter pass back 16 bits of data. */ 1221 seccomp_send_sigsys(this_syscall, data); 1222 goto skip; 1223 1224 case SECCOMP_RET_TRACE: 1225 /* We've been put in this state by the ptracer already. */ 1226 if (recheck_after_trace) 1227 return 0; 1228 1229 /* ENOSYS these calls if there is no tracer attached. */ 1230 if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP)) { 1231 syscall_set_return_value(current, 1232 current_pt_regs(), 1233 -ENOSYS, 0); 1234 goto skip; 1235 } 1236 1237 /* Allow the BPF to provide the event message */ 1238 ptrace_event(PTRACE_EVENT_SECCOMP, data); 1239 /* 1240 * The delivery of a fatal signal during event 1241 * notification may silently skip tracer notification, 1242 * which could leave us with a potentially unmodified 1243 * syscall that the tracer would have liked to have 1244 * changed. Since the process is about to die, we just 1245 * force the syscall to be skipped and let the signal 1246 * kill the process and correctly handle any tracer exit 1247 * notifications. 1248 */ 1249 if (fatal_signal_pending(current)) 1250 goto skip; 1251 /* Check if the tracer forced the syscall to be skipped. */ 1252 this_syscall = syscall_get_nr(current, current_pt_regs()); 1253 if (this_syscall < 0) 1254 goto skip; 1255 1256 /* 1257 * Recheck the syscall, since it may have changed. This 1258 * intentionally uses a NULL struct seccomp_data to force 1259 * a reload of all registers. This does not goto skip since 1260 * a skip would have already been reported. 1261 */ 1262 if (__seccomp_filter(this_syscall, NULL, true)) 1263 return -1; 1264 1265 return 0; 1266 1267 case SECCOMP_RET_USER_NOTIF: 1268 if (seccomp_do_user_notification(this_syscall, match, sd)) 1269 goto skip; 1270 1271 return 0; 1272 1273 case SECCOMP_RET_LOG: 1274 seccomp_log(this_syscall, 0, action, true); 1275 return 0; 1276 1277 case SECCOMP_RET_ALLOW: 1278 /* 1279 * Note that the "match" filter will always be NULL for 1280 * this action since SECCOMP_RET_ALLOW is the starting 1281 * state in seccomp_run_filters(). 1282 */ 1283 return 0; 1284 1285 case SECCOMP_RET_KILL_THREAD: 1286 case SECCOMP_RET_KILL_PROCESS: 1287 default: 1288 seccomp_log(this_syscall, SIGSYS, action, true); 1289 /* Dump core only if this is the last remaining thread. */ 1290 if (action != SECCOMP_RET_KILL_THREAD || 1291 get_nr_threads(current) == 1) { 1292 kernel_siginfo_t info; 1293 1294 /* Show the original registers in the dump. */ 1295 syscall_rollback(current, current_pt_regs()); 1296 /* Trigger a manual coredump since do_exit skips it. */ 1297 seccomp_init_siginfo(&info, this_syscall, data); 1298 do_coredump(&info); 1299 } 1300 if (action == SECCOMP_RET_KILL_THREAD) 1301 do_exit(SIGSYS); 1302 else 1303 do_group_exit(SIGSYS); 1304 } 1305 1306 unreachable(); 1307 1308 skip: 1309 seccomp_log(this_syscall, 0, action, match ? match->log : false); 1310 return -1; 1311 } 1312 #else 1313 static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd, 1314 const bool recheck_after_trace) 1315 { 1316 BUG(); 1317 1318 return -1; 1319 } 1320 #endif 1321 1322 int __secure_computing(const struct seccomp_data *sd) 1323 { 1324 int mode = current->seccomp.mode; 1325 int this_syscall; 1326 1327 if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) && 1328 unlikely(current->ptrace & PT_SUSPEND_SECCOMP)) 1329 return 0; 1330 1331 this_syscall = sd ? sd->nr : 1332 syscall_get_nr(current, current_pt_regs()); 1333 1334 switch (mode) { 1335 case SECCOMP_MODE_STRICT: 1336 __secure_computing_strict(this_syscall); /* may call do_exit */ 1337 return 0; 1338 case SECCOMP_MODE_FILTER: 1339 return __seccomp_filter(this_syscall, sd, false); 1340 default: 1341 BUG(); 1342 } 1343 } 1344 #endif /* CONFIG_HAVE_ARCH_SECCOMP_FILTER */ 1345 1346 long prctl_get_seccomp(void) 1347 { 1348 return current->seccomp.mode; 1349 } 1350 1351 /** 1352 * seccomp_set_mode_strict: internal function for setting strict seccomp 1353 * 1354 * Once current->seccomp.mode is non-zero, it may not be changed. 1355 * 1356 * Returns 0 on success or -EINVAL on failure. 1357 */ 1358 static long seccomp_set_mode_strict(void) 1359 { 1360 const unsigned long seccomp_mode = SECCOMP_MODE_STRICT; 1361 long ret = -EINVAL; 1362 1363 spin_lock_irq(¤t->sighand->siglock); 1364 1365 if (!seccomp_may_assign_mode(seccomp_mode)) 1366 goto out; 1367 1368 #ifdef TIF_NOTSC 1369 disable_TSC(); 1370 #endif 1371 seccomp_assign_mode(current, seccomp_mode, 0); 1372 ret = 0; 1373 1374 out: 1375 spin_unlock_irq(¤t->sighand->siglock); 1376 1377 return ret; 1378 } 1379 1380 #ifdef CONFIG_SECCOMP_FILTER 1381 static void seccomp_notify_free(struct seccomp_filter *filter) 1382 { 1383 kfree(filter->notif); 1384 filter->notif = NULL; 1385 } 1386 1387 static void seccomp_notify_detach(struct seccomp_filter *filter) 1388 { 1389 struct seccomp_knotif *knotif; 1390 1391 if (!filter) 1392 return; 1393 1394 mutex_lock(&filter->notify_lock); 1395 1396 /* 1397 * If this file is being closed because e.g. the task who owned it 1398 * died, let's wake everyone up who was waiting on us. 1399 */ 1400 list_for_each_entry(knotif, &filter->notif->notifications, list) { 1401 if (knotif->state == SECCOMP_NOTIFY_REPLIED) 1402 continue; 1403 1404 knotif->state = SECCOMP_NOTIFY_REPLIED; 1405 knotif->error = -ENOSYS; 1406 knotif->val = 0; 1407 1408 /* 1409 * We do not need to wake up any pending addfd messages, as 1410 * the notifier will do that for us, as this just looks 1411 * like a standard reply. 1412 */ 1413 complete(&knotif->ready); 1414 } 1415 1416 seccomp_notify_free(filter); 1417 mutex_unlock(&filter->notify_lock); 1418 } 1419 1420 static int seccomp_notify_release(struct inode *inode, struct file *file) 1421 { 1422 struct seccomp_filter *filter = file->private_data; 1423 1424 seccomp_notify_detach(filter); 1425 __put_seccomp_filter(filter); 1426 return 0; 1427 } 1428 1429 /* must be called with notif_lock held */ 1430 static inline struct seccomp_knotif * 1431 find_notification(struct seccomp_filter *filter, u64 id) 1432 { 1433 struct seccomp_knotif *cur; 1434 1435 lockdep_assert_held(&filter->notify_lock); 1436 1437 list_for_each_entry(cur, &filter->notif->notifications, list) { 1438 if (cur->id == id) 1439 return cur; 1440 } 1441 1442 return NULL; 1443 } 1444 1445 1446 static long seccomp_notify_recv(struct seccomp_filter *filter, 1447 void __user *buf) 1448 { 1449 struct seccomp_knotif *knotif = NULL, *cur; 1450 struct seccomp_notif unotif; 1451 ssize_t ret; 1452 1453 /* Verify that we're not given garbage to keep struct extensible. */ 1454 ret = check_zeroed_user(buf, sizeof(unotif)); 1455 if (ret < 0) 1456 return ret; 1457 if (!ret) 1458 return -EINVAL; 1459 1460 memset(&unotif, 0, sizeof(unotif)); 1461 1462 ret = down_interruptible(&filter->notif->request); 1463 if (ret < 0) 1464 return ret; 1465 1466 mutex_lock(&filter->notify_lock); 1467 list_for_each_entry(cur, &filter->notif->notifications, list) { 1468 if (cur->state == SECCOMP_NOTIFY_INIT) { 1469 knotif = cur; 1470 break; 1471 } 1472 } 1473 1474 /* 1475 * If we didn't find a notification, it could be that the task was 1476 * interrupted by a fatal signal between the time we were woken and 1477 * when we were able to acquire the rw lock. 1478 */ 1479 if (!knotif) { 1480 ret = -ENOENT; 1481 goto out; 1482 } 1483 1484 unotif.id = knotif->id; 1485 unotif.pid = task_pid_vnr(knotif->task); 1486 unotif.data = *(knotif->data); 1487 1488 knotif->state = SECCOMP_NOTIFY_SENT; 1489 wake_up_poll(&filter->wqh, EPOLLOUT | EPOLLWRNORM); 1490 ret = 0; 1491 out: 1492 mutex_unlock(&filter->notify_lock); 1493 1494 if (ret == 0 && copy_to_user(buf, &unotif, sizeof(unotif))) { 1495 ret = -EFAULT; 1496 1497 /* 1498 * Userspace screwed up. To make sure that we keep this 1499 * notification alive, let's reset it back to INIT. It 1500 * may have died when we released the lock, so we need to make 1501 * sure it's still around. 1502 */ 1503 mutex_lock(&filter->notify_lock); 1504 knotif = find_notification(filter, unotif.id); 1505 if (knotif) { 1506 knotif->state = SECCOMP_NOTIFY_INIT; 1507 up(&filter->notif->request); 1508 } 1509 mutex_unlock(&filter->notify_lock); 1510 } 1511 1512 return ret; 1513 } 1514 1515 static long seccomp_notify_send(struct seccomp_filter *filter, 1516 void __user *buf) 1517 { 1518 struct seccomp_notif_resp resp = {}; 1519 struct seccomp_knotif *knotif; 1520 long ret; 1521 1522 if (copy_from_user(&resp, buf, sizeof(resp))) 1523 return -EFAULT; 1524 1525 if (resp.flags & ~SECCOMP_USER_NOTIF_FLAG_CONTINUE) 1526 return -EINVAL; 1527 1528 if ((resp.flags & SECCOMP_USER_NOTIF_FLAG_CONTINUE) && 1529 (resp.error || resp.val)) 1530 return -EINVAL; 1531 1532 ret = mutex_lock_interruptible(&filter->notify_lock); 1533 if (ret < 0) 1534 return ret; 1535 1536 knotif = find_notification(filter, resp.id); 1537 if (!knotif) { 1538 ret = -ENOENT; 1539 goto out; 1540 } 1541 1542 /* Allow exactly one reply. */ 1543 if (knotif->state != SECCOMP_NOTIFY_SENT) { 1544 ret = -EINPROGRESS; 1545 goto out; 1546 } 1547 1548 ret = 0; 1549 knotif->state = SECCOMP_NOTIFY_REPLIED; 1550 knotif->error = resp.error; 1551 knotif->val = resp.val; 1552 knotif->flags = resp.flags; 1553 complete(&knotif->ready); 1554 out: 1555 mutex_unlock(&filter->notify_lock); 1556 return ret; 1557 } 1558 1559 static long seccomp_notify_id_valid(struct seccomp_filter *filter, 1560 void __user *buf) 1561 { 1562 struct seccomp_knotif *knotif; 1563 u64 id; 1564 long ret; 1565 1566 if (copy_from_user(&id, buf, sizeof(id))) 1567 return -EFAULT; 1568 1569 ret = mutex_lock_interruptible(&filter->notify_lock); 1570 if (ret < 0) 1571 return ret; 1572 1573 knotif = find_notification(filter, id); 1574 if (knotif && knotif->state == SECCOMP_NOTIFY_SENT) 1575 ret = 0; 1576 else 1577 ret = -ENOENT; 1578 1579 mutex_unlock(&filter->notify_lock); 1580 return ret; 1581 } 1582 1583 static long seccomp_notify_addfd(struct seccomp_filter *filter, 1584 struct seccomp_notif_addfd __user *uaddfd, 1585 unsigned int size) 1586 { 1587 struct seccomp_notif_addfd addfd; 1588 struct seccomp_knotif *knotif; 1589 struct seccomp_kaddfd kaddfd; 1590 int ret; 1591 1592 BUILD_BUG_ON(sizeof(addfd) < SECCOMP_NOTIFY_ADDFD_SIZE_VER0); 1593 BUILD_BUG_ON(sizeof(addfd) != SECCOMP_NOTIFY_ADDFD_SIZE_LATEST); 1594 1595 if (size < SECCOMP_NOTIFY_ADDFD_SIZE_VER0 || size >= PAGE_SIZE) 1596 return -EINVAL; 1597 1598 ret = copy_struct_from_user(&addfd, sizeof(addfd), uaddfd, size); 1599 if (ret) 1600 return ret; 1601 1602 if (addfd.newfd_flags & ~O_CLOEXEC) 1603 return -EINVAL; 1604 1605 if (addfd.flags & ~(SECCOMP_ADDFD_FLAG_SETFD | SECCOMP_ADDFD_FLAG_SEND)) 1606 return -EINVAL; 1607 1608 if (addfd.newfd && !(addfd.flags & SECCOMP_ADDFD_FLAG_SETFD)) 1609 return -EINVAL; 1610 1611 kaddfd.file = fget(addfd.srcfd); 1612 if (!kaddfd.file) 1613 return -EBADF; 1614 1615 kaddfd.ioctl_flags = addfd.flags; 1616 kaddfd.flags = addfd.newfd_flags; 1617 kaddfd.setfd = addfd.flags & SECCOMP_ADDFD_FLAG_SETFD; 1618 kaddfd.fd = addfd.newfd; 1619 init_completion(&kaddfd.completion); 1620 1621 ret = mutex_lock_interruptible(&filter->notify_lock); 1622 if (ret < 0) 1623 goto out; 1624 1625 knotif = find_notification(filter, addfd.id); 1626 if (!knotif) { 1627 ret = -ENOENT; 1628 goto out_unlock; 1629 } 1630 1631 /* 1632 * We do not want to allow for FD injection to occur before the 1633 * notification has been picked up by a userspace handler, or after 1634 * the notification has been replied to. 1635 */ 1636 if (knotif->state != SECCOMP_NOTIFY_SENT) { 1637 ret = -EINPROGRESS; 1638 goto out_unlock; 1639 } 1640 1641 if (addfd.flags & SECCOMP_ADDFD_FLAG_SEND) { 1642 /* 1643 * Disallow queuing an atomic addfd + send reply while there are 1644 * some addfd requests still to process. 1645 * 1646 * There is no clear reason to support it and allows us to keep 1647 * the loop on the other side straight-forward. 1648 */ 1649 if (!list_empty(&knotif->addfd)) { 1650 ret = -EBUSY; 1651 goto out_unlock; 1652 } 1653 1654 /* Allow exactly only one reply */ 1655 knotif->state = SECCOMP_NOTIFY_REPLIED; 1656 } 1657 1658 list_add(&kaddfd.list, &knotif->addfd); 1659 complete(&knotif->ready); 1660 mutex_unlock(&filter->notify_lock); 1661 1662 /* Now we wait for it to be processed or be interrupted */ 1663 ret = wait_for_completion_interruptible(&kaddfd.completion); 1664 if (ret == 0) { 1665 /* 1666 * We had a successful completion. The other side has already 1667 * removed us from the addfd queue, and 1668 * wait_for_completion_interruptible has a memory barrier upon 1669 * success that lets us read this value directly without 1670 * locking. 1671 */ 1672 ret = kaddfd.ret; 1673 goto out; 1674 } 1675 1676 mutex_lock(&filter->notify_lock); 1677 /* 1678 * Even though we were woken up by a signal and not a successful 1679 * completion, a completion may have happened in the mean time. 1680 * 1681 * We need to check again if the addfd request has been handled, 1682 * and if not, we will remove it from the queue. 1683 */ 1684 if (list_empty(&kaddfd.list)) 1685 ret = kaddfd.ret; 1686 else 1687 list_del(&kaddfd.list); 1688 1689 out_unlock: 1690 mutex_unlock(&filter->notify_lock); 1691 out: 1692 fput(kaddfd.file); 1693 1694 return ret; 1695 } 1696 1697 static long seccomp_notify_ioctl(struct file *file, unsigned int cmd, 1698 unsigned long arg) 1699 { 1700 struct seccomp_filter *filter = file->private_data; 1701 void __user *buf = (void __user *)arg; 1702 1703 /* Fixed-size ioctls */ 1704 switch (cmd) { 1705 case SECCOMP_IOCTL_NOTIF_RECV: 1706 return seccomp_notify_recv(filter, buf); 1707 case SECCOMP_IOCTL_NOTIF_SEND: 1708 return seccomp_notify_send(filter, buf); 1709 case SECCOMP_IOCTL_NOTIF_ID_VALID_WRONG_DIR: 1710 case SECCOMP_IOCTL_NOTIF_ID_VALID: 1711 return seccomp_notify_id_valid(filter, buf); 1712 } 1713 1714 /* Extensible Argument ioctls */ 1715 #define EA_IOCTL(cmd) ((cmd) & ~(IOC_INOUT | IOCSIZE_MASK)) 1716 switch (EA_IOCTL(cmd)) { 1717 case EA_IOCTL(SECCOMP_IOCTL_NOTIF_ADDFD): 1718 return seccomp_notify_addfd(filter, buf, _IOC_SIZE(cmd)); 1719 default: 1720 return -EINVAL; 1721 } 1722 } 1723 1724 static __poll_t seccomp_notify_poll(struct file *file, 1725 struct poll_table_struct *poll_tab) 1726 { 1727 struct seccomp_filter *filter = file->private_data; 1728 __poll_t ret = 0; 1729 struct seccomp_knotif *cur; 1730 1731 poll_wait(file, &filter->wqh, poll_tab); 1732 1733 if (mutex_lock_interruptible(&filter->notify_lock) < 0) 1734 return EPOLLERR; 1735 1736 list_for_each_entry(cur, &filter->notif->notifications, list) { 1737 if (cur->state == SECCOMP_NOTIFY_INIT) 1738 ret |= EPOLLIN | EPOLLRDNORM; 1739 if (cur->state == SECCOMP_NOTIFY_SENT) 1740 ret |= EPOLLOUT | EPOLLWRNORM; 1741 if ((ret & EPOLLIN) && (ret & EPOLLOUT)) 1742 break; 1743 } 1744 1745 mutex_unlock(&filter->notify_lock); 1746 1747 if (refcount_read(&filter->users) == 0) 1748 ret |= EPOLLHUP; 1749 1750 return ret; 1751 } 1752 1753 static const struct file_operations seccomp_notify_ops = { 1754 .poll = seccomp_notify_poll, 1755 .release = seccomp_notify_release, 1756 .unlocked_ioctl = seccomp_notify_ioctl, 1757 .compat_ioctl = seccomp_notify_ioctl, 1758 }; 1759 1760 static struct file *init_listener(struct seccomp_filter *filter) 1761 { 1762 struct file *ret; 1763 1764 ret = ERR_PTR(-ENOMEM); 1765 filter->notif = kzalloc(sizeof(*(filter->notif)), GFP_KERNEL); 1766 if (!filter->notif) 1767 goto out; 1768 1769 sema_init(&filter->notif->request, 0); 1770 filter->notif->next_id = get_random_u64(); 1771 INIT_LIST_HEAD(&filter->notif->notifications); 1772 1773 ret = anon_inode_getfile("seccomp notify", &seccomp_notify_ops, 1774 filter, O_RDWR); 1775 if (IS_ERR(ret)) 1776 goto out_notif; 1777 1778 /* The file has a reference to it now */ 1779 __get_seccomp_filter(filter); 1780 1781 out_notif: 1782 if (IS_ERR(ret)) 1783 seccomp_notify_free(filter); 1784 out: 1785 return ret; 1786 } 1787 1788 /* 1789 * Does @new_child have a listener while an ancestor also has a listener? 1790 * If so, we'll want to reject this filter. 1791 * This only has to be tested for the current process, even in the TSYNC case, 1792 * because TSYNC installs @child with the same parent on all threads. 1793 * Note that @new_child is not hooked up to its parent at this point yet, so 1794 * we use current->seccomp.filter. 1795 */ 1796 static bool has_duplicate_listener(struct seccomp_filter *new_child) 1797 { 1798 struct seccomp_filter *cur; 1799 1800 /* must be protected against concurrent TSYNC */ 1801 lockdep_assert_held(¤t->sighand->siglock); 1802 1803 if (!new_child->notif) 1804 return false; 1805 for (cur = current->seccomp.filter; cur; cur = cur->prev) { 1806 if (cur->notif) 1807 return true; 1808 } 1809 1810 return false; 1811 } 1812 1813 /** 1814 * seccomp_set_mode_filter: internal function for setting seccomp filter 1815 * @flags: flags to change filter behavior 1816 * @filter: struct sock_fprog containing filter 1817 * 1818 * This function may be called repeatedly to install additional filters. 1819 * Every filter successfully installed will be evaluated (in reverse order) 1820 * for each system call the task makes. 1821 * 1822 * Once current->seccomp.mode is non-zero, it may not be changed. 1823 * 1824 * Returns 0 on success or -EINVAL on failure. 1825 */ 1826 static long seccomp_set_mode_filter(unsigned int flags, 1827 const char __user *filter) 1828 { 1829 const unsigned long seccomp_mode = SECCOMP_MODE_FILTER; 1830 struct seccomp_filter *prepared = NULL; 1831 long ret = -EINVAL; 1832 int listener = -1; 1833 struct file *listener_f = NULL; 1834 1835 /* Validate flags. */ 1836 if (flags & ~SECCOMP_FILTER_FLAG_MASK) 1837 return -EINVAL; 1838 1839 /* 1840 * In the successful case, NEW_LISTENER returns the new listener fd. 1841 * But in the failure case, TSYNC returns the thread that died. If you 1842 * combine these two flags, there's no way to tell whether something 1843 * succeeded or failed. So, let's disallow this combination if the user 1844 * has not explicitly requested no errors from TSYNC. 1845 */ 1846 if ((flags & SECCOMP_FILTER_FLAG_TSYNC) && 1847 (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) && 1848 ((flags & SECCOMP_FILTER_FLAG_TSYNC_ESRCH) == 0)) 1849 return -EINVAL; 1850 1851 /* Prepare the new filter before holding any locks. */ 1852 prepared = seccomp_prepare_user_filter(filter); 1853 if (IS_ERR(prepared)) 1854 return PTR_ERR(prepared); 1855 1856 if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) { 1857 listener = get_unused_fd_flags(O_CLOEXEC); 1858 if (listener < 0) { 1859 ret = listener; 1860 goto out_free; 1861 } 1862 1863 listener_f = init_listener(prepared); 1864 if (IS_ERR(listener_f)) { 1865 put_unused_fd(listener); 1866 ret = PTR_ERR(listener_f); 1867 goto out_free; 1868 } 1869 } 1870 1871 /* 1872 * Make sure we cannot change seccomp or nnp state via TSYNC 1873 * while another thread is in the middle of calling exec. 1874 */ 1875 if (flags & SECCOMP_FILTER_FLAG_TSYNC && 1876 mutex_lock_killable(¤t->signal->cred_guard_mutex)) 1877 goto out_put_fd; 1878 1879 spin_lock_irq(¤t->sighand->siglock); 1880 1881 if (!seccomp_may_assign_mode(seccomp_mode)) 1882 goto out; 1883 1884 if (has_duplicate_listener(prepared)) { 1885 ret = -EBUSY; 1886 goto out; 1887 } 1888 1889 ret = seccomp_attach_filter(flags, prepared); 1890 if (ret) 1891 goto out; 1892 /* Do not free the successfully attached filter. */ 1893 prepared = NULL; 1894 1895 seccomp_assign_mode(current, seccomp_mode, flags); 1896 out: 1897 spin_unlock_irq(¤t->sighand->siglock); 1898 if (flags & SECCOMP_FILTER_FLAG_TSYNC) 1899 mutex_unlock(¤t->signal->cred_guard_mutex); 1900 out_put_fd: 1901 if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) { 1902 if (ret) { 1903 listener_f->private_data = NULL; 1904 fput(listener_f); 1905 put_unused_fd(listener); 1906 seccomp_notify_detach(prepared); 1907 } else { 1908 fd_install(listener, listener_f); 1909 ret = listener; 1910 } 1911 } 1912 out_free: 1913 seccomp_filter_free(prepared); 1914 return ret; 1915 } 1916 #else 1917 static inline long seccomp_set_mode_filter(unsigned int flags, 1918 const char __user *filter) 1919 { 1920 return -EINVAL; 1921 } 1922 #endif 1923 1924 static long seccomp_get_action_avail(const char __user *uaction) 1925 { 1926 u32 action; 1927 1928 if (copy_from_user(&action, uaction, sizeof(action))) 1929 return -EFAULT; 1930 1931 switch (action) { 1932 case SECCOMP_RET_KILL_PROCESS: 1933 case SECCOMP_RET_KILL_THREAD: 1934 case SECCOMP_RET_TRAP: 1935 case SECCOMP_RET_ERRNO: 1936 case SECCOMP_RET_USER_NOTIF: 1937 case SECCOMP_RET_TRACE: 1938 case SECCOMP_RET_LOG: 1939 case SECCOMP_RET_ALLOW: 1940 break; 1941 default: 1942 return -EOPNOTSUPP; 1943 } 1944 1945 return 0; 1946 } 1947 1948 static long seccomp_get_notif_sizes(void __user *usizes) 1949 { 1950 struct seccomp_notif_sizes sizes = { 1951 .seccomp_notif = sizeof(struct seccomp_notif), 1952 .seccomp_notif_resp = sizeof(struct seccomp_notif_resp), 1953 .seccomp_data = sizeof(struct seccomp_data), 1954 }; 1955 1956 if (copy_to_user(usizes, &sizes, sizeof(sizes))) 1957 return -EFAULT; 1958 1959 return 0; 1960 } 1961 1962 /* Common entry point for both prctl and syscall. */ 1963 static long do_seccomp(unsigned int op, unsigned int flags, 1964 void __user *uargs) 1965 { 1966 switch (op) { 1967 case SECCOMP_SET_MODE_STRICT: 1968 if (flags != 0 || uargs != NULL) 1969 return -EINVAL; 1970 return seccomp_set_mode_strict(); 1971 case SECCOMP_SET_MODE_FILTER: 1972 return seccomp_set_mode_filter(flags, uargs); 1973 case SECCOMP_GET_ACTION_AVAIL: 1974 if (flags != 0) 1975 return -EINVAL; 1976 1977 return seccomp_get_action_avail(uargs); 1978 case SECCOMP_GET_NOTIF_SIZES: 1979 if (flags != 0) 1980 return -EINVAL; 1981 1982 return seccomp_get_notif_sizes(uargs); 1983 default: 1984 return -EINVAL; 1985 } 1986 } 1987 1988 SYSCALL_DEFINE3(seccomp, unsigned int, op, unsigned int, flags, 1989 void __user *, uargs) 1990 { 1991 return do_seccomp(op, flags, uargs); 1992 } 1993 1994 /** 1995 * prctl_set_seccomp: configures current->seccomp.mode 1996 * @seccomp_mode: requested mode to use 1997 * @filter: optional struct sock_fprog for use with SECCOMP_MODE_FILTER 1998 * 1999 * Returns 0 on success or -EINVAL on failure. 2000 */ 2001 long prctl_set_seccomp(unsigned long seccomp_mode, void __user *filter) 2002 { 2003 unsigned int op; 2004 void __user *uargs; 2005 2006 switch (seccomp_mode) { 2007 case SECCOMP_MODE_STRICT: 2008 op = SECCOMP_SET_MODE_STRICT; 2009 /* 2010 * Setting strict mode through prctl always ignored filter, 2011 * so make sure it is always NULL here to pass the internal 2012 * check in do_seccomp(). 2013 */ 2014 uargs = NULL; 2015 break; 2016 case SECCOMP_MODE_FILTER: 2017 op = SECCOMP_SET_MODE_FILTER; 2018 uargs = filter; 2019 break; 2020 default: 2021 return -EINVAL; 2022 } 2023 2024 /* prctl interface doesn't have flags, so they are always zero. */ 2025 return do_seccomp(op, 0, uargs); 2026 } 2027 2028 #if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE) 2029 static struct seccomp_filter *get_nth_filter(struct task_struct *task, 2030 unsigned long filter_off) 2031 { 2032 struct seccomp_filter *orig, *filter; 2033 unsigned long count; 2034 2035 /* 2036 * Note: this is only correct because the caller should be the (ptrace) 2037 * tracer of the task, otherwise lock_task_sighand is needed. 2038 */ 2039 spin_lock_irq(&task->sighand->siglock); 2040 2041 if (task->seccomp.mode != SECCOMP_MODE_FILTER) { 2042 spin_unlock_irq(&task->sighand->siglock); 2043 return ERR_PTR(-EINVAL); 2044 } 2045 2046 orig = task->seccomp.filter; 2047 __get_seccomp_filter(orig); 2048 spin_unlock_irq(&task->sighand->siglock); 2049 2050 count = 0; 2051 for (filter = orig; filter; filter = filter->prev) 2052 count++; 2053 2054 if (filter_off >= count) { 2055 filter = ERR_PTR(-ENOENT); 2056 goto out; 2057 } 2058 2059 count -= filter_off; 2060 for (filter = orig; filter && count > 1; filter = filter->prev) 2061 count--; 2062 2063 if (WARN_ON(count != 1 || !filter)) { 2064 filter = ERR_PTR(-ENOENT); 2065 goto out; 2066 } 2067 2068 __get_seccomp_filter(filter); 2069 2070 out: 2071 __put_seccomp_filter(orig); 2072 return filter; 2073 } 2074 2075 long seccomp_get_filter(struct task_struct *task, unsigned long filter_off, 2076 void __user *data) 2077 { 2078 struct seccomp_filter *filter; 2079 struct sock_fprog_kern *fprog; 2080 long ret; 2081 2082 if (!capable(CAP_SYS_ADMIN) || 2083 current->seccomp.mode != SECCOMP_MODE_DISABLED) { 2084 return -EACCES; 2085 } 2086 2087 filter = get_nth_filter(task, filter_off); 2088 if (IS_ERR(filter)) 2089 return PTR_ERR(filter); 2090 2091 fprog = filter->prog->orig_prog; 2092 if (!fprog) { 2093 /* This must be a new non-cBPF filter, since we save 2094 * every cBPF filter's orig_prog above when 2095 * CONFIG_CHECKPOINT_RESTORE is enabled. 2096 */ 2097 ret = -EMEDIUMTYPE; 2098 goto out; 2099 } 2100 2101 ret = fprog->len; 2102 if (!data) 2103 goto out; 2104 2105 if (copy_to_user(data, fprog->filter, bpf_classic_proglen(fprog))) 2106 ret = -EFAULT; 2107 2108 out: 2109 __put_seccomp_filter(filter); 2110 return ret; 2111 } 2112 2113 long seccomp_get_metadata(struct task_struct *task, 2114 unsigned long size, void __user *data) 2115 { 2116 long ret; 2117 struct seccomp_filter *filter; 2118 struct seccomp_metadata kmd = {}; 2119 2120 if (!capable(CAP_SYS_ADMIN) || 2121 current->seccomp.mode != SECCOMP_MODE_DISABLED) { 2122 return -EACCES; 2123 } 2124 2125 size = min_t(unsigned long, size, sizeof(kmd)); 2126 2127 if (size < sizeof(kmd.filter_off)) 2128 return -EINVAL; 2129 2130 if (copy_from_user(&kmd.filter_off, data, sizeof(kmd.filter_off))) 2131 return -EFAULT; 2132 2133 filter = get_nth_filter(task, kmd.filter_off); 2134 if (IS_ERR(filter)) 2135 return PTR_ERR(filter); 2136 2137 if (filter->log) 2138 kmd.flags |= SECCOMP_FILTER_FLAG_LOG; 2139 2140 ret = size; 2141 if (copy_to_user(data, &kmd, size)) 2142 ret = -EFAULT; 2143 2144 __put_seccomp_filter(filter); 2145 return ret; 2146 } 2147 #endif 2148 2149 #ifdef CONFIG_SYSCTL 2150 2151 /* Human readable action names for friendly sysctl interaction */ 2152 #define SECCOMP_RET_KILL_PROCESS_NAME "kill_process" 2153 #define SECCOMP_RET_KILL_THREAD_NAME "kill_thread" 2154 #define SECCOMP_RET_TRAP_NAME "trap" 2155 #define SECCOMP_RET_ERRNO_NAME "errno" 2156 #define SECCOMP_RET_USER_NOTIF_NAME "user_notif" 2157 #define SECCOMP_RET_TRACE_NAME "trace" 2158 #define SECCOMP_RET_LOG_NAME "log" 2159 #define SECCOMP_RET_ALLOW_NAME "allow" 2160 2161 static const char seccomp_actions_avail[] = 2162 SECCOMP_RET_KILL_PROCESS_NAME " " 2163 SECCOMP_RET_KILL_THREAD_NAME " " 2164 SECCOMP_RET_TRAP_NAME " " 2165 SECCOMP_RET_ERRNO_NAME " " 2166 SECCOMP_RET_USER_NOTIF_NAME " " 2167 SECCOMP_RET_TRACE_NAME " " 2168 SECCOMP_RET_LOG_NAME " " 2169 SECCOMP_RET_ALLOW_NAME; 2170 2171 struct seccomp_log_name { 2172 u32 log; 2173 const char *name; 2174 }; 2175 2176 static const struct seccomp_log_name seccomp_log_names[] = { 2177 { SECCOMP_LOG_KILL_PROCESS, SECCOMP_RET_KILL_PROCESS_NAME }, 2178 { SECCOMP_LOG_KILL_THREAD, SECCOMP_RET_KILL_THREAD_NAME }, 2179 { SECCOMP_LOG_TRAP, SECCOMP_RET_TRAP_NAME }, 2180 { SECCOMP_LOG_ERRNO, SECCOMP_RET_ERRNO_NAME }, 2181 { SECCOMP_LOG_USER_NOTIF, SECCOMP_RET_USER_NOTIF_NAME }, 2182 { SECCOMP_LOG_TRACE, SECCOMP_RET_TRACE_NAME }, 2183 { SECCOMP_LOG_LOG, SECCOMP_RET_LOG_NAME }, 2184 { SECCOMP_LOG_ALLOW, SECCOMP_RET_ALLOW_NAME }, 2185 { } 2186 }; 2187 2188 static bool seccomp_names_from_actions_logged(char *names, size_t size, 2189 u32 actions_logged, 2190 const char *sep) 2191 { 2192 const struct seccomp_log_name *cur; 2193 bool append_sep = false; 2194 2195 for (cur = seccomp_log_names; cur->name && size; cur++) { 2196 ssize_t ret; 2197 2198 if (!(actions_logged & cur->log)) 2199 continue; 2200 2201 if (append_sep) { 2202 ret = strscpy(names, sep, size); 2203 if (ret < 0) 2204 return false; 2205 2206 names += ret; 2207 size -= ret; 2208 } else 2209 append_sep = true; 2210 2211 ret = strscpy(names, cur->name, size); 2212 if (ret < 0) 2213 return false; 2214 2215 names += ret; 2216 size -= ret; 2217 } 2218 2219 return true; 2220 } 2221 2222 static bool seccomp_action_logged_from_name(u32 *action_logged, 2223 const char *name) 2224 { 2225 const struct seccomp_log_name *cur; 2226 2227 for (cur = seccomp_log_names; cur->name; cur++) { 2228 if (!strcmp(cur->name, name)) { 2229 *action_logged = cur->log; 2230 return true; 2231 } 2232 } 2233 2234 return false; 2235 } 2236 2237 static bool seccomp_actions_logged_from_names(u32 *actions_logged, char *names) 2238 { 2239 char *name; 2240 2241 *actions_logged = 0; 2242 while ((name = strsep(&names, " ")) && *name) { 2243 u32 action_logged = 0; 2244 2245 if (!seccomp_action_logged_from_name(&action_logged, name)) 2246 return false; 2247 2248 *actions_logged |= action_logged; 2249 } 2250 2251 return true; 2252 } 2253 2254 static int read_actions_logged(struct ctl_table *ro_table, void *buffer, 2255 size_t *lenp, loff_t *ppos) 2256 { 2257 char names[sizeof(seccomp_actions_avail)]; 2258 struct ctl_table table; 2259 2260 memset(names, 0, sizeof(names)); 2261 2262 if (!seccomp_names_from_actions_logged(names, sizeof(names), 2263 seccomp_actions_logged, " ")) 2264 return -EINVAL; 2265 2266 table = *ro_table; 2267 table.data = names; 2268 table.maxlen = sizeof(names); 2269 return proc_dostring(&table, 0, buffer, lenp, ppos); 2270 } 2271 2272 static int write_actions_logged(struct ctl_table *ro_table, void *buffer, 2273 size_t *lenp, loff_t *ppos, u32 *actions_logged) 2274 { 2275 char names[sizeof(seccomp_actions_avail)]; 2276 struct ctl_table table; 2277 int ret; 2278 2279 if (!capable(CAP_SYS_ADMIN)) 2280 return -EPERM; 2281 2282 memset(names, 0, sizeof(names)); 2283 2284 table = *ro_table; 2285 table.data = names; 2286 table.maxlen = sizeof(names); 2287 ret = proc_dostring(&table, 1, buffer, lenp, ppos); 2288 if (ret) 2289 return ret; 2290 2291 if (!seccomp_actions_logged_from_names(actions_logged, table.data)) 2292 return -EINVAL; 2293 2294 if (*actions_logged & SECCOMP_LOG_ALLOW) 2295 return -EINVAL; 2296 2297 seccomp_actions_logged = *actions_logged; 2298 return 0; 2299 } 2300 2301 static void audit_actions_logged(u32 actions_logged, u32 old_actions_logged, 2302 int ret) 2303 { 2304 char names[sizeof(seccomp_actions_avail)]; 2305 char old_names[sizeof(seccomp_actions_avail)]; 2306 const char *new = names; 2307 const char *old = old_names; 2308 2309 if (!audit_enabled) 2310 return; 2311 2312 memset(names, 0, sizeof(names)); 2313 memset(old_names, 0, sizeof(old_names)); 2314 2315 if (ret) 2316 new = "?"; 2317 else if (!actions_logged) 2318 new = "(none)"; 2319 else if (!seccomp_names_from_actions_logged(names, sizeof(names), 2320 actions_logged, ",")) 2321 new = "?"; 2322 2323 if (!old_actions_logged) 2324 old = "(none)"; 2325 else if (!seccomp_names_from_actions_logged(old_names, 2326 sizeof(old_names), 2327 old_actions_logged, ",")) 2328 old = "?"; 2329 2330 return audit_seccomp_actions_logged(new, old, !ret); 2331 } 2332 2333 static int seccomp_actions_logged_handler(struct ctl_table *ro_table, int write, 2334 void *buffer, size_t *lenp, 2335 loff_t *ppos) 2336 { 2337 int ret; 2338 2339 if (write) { 2340 u32 actions_logged = 0; 2341 u32 old_actions_logged = seccomp_actions_logged; 2342 2343 ret = write_actions_logged(ro_table, buffer, lenp, ppos, 2344 &actions_logged); 2345 audit_actions_logged(actions_logged, old_actions_logged, ret); 2346 } else 2347 ret = read_actions_logged(ro_table, buffer, lenp, ppos); 2348 2349 return ret; 2350 } 2351 2352 static struct ctl_path seccomp_sysctl_path[] = { 2353 { .procname = "kernel", }, 2354 { .procname = "seccomp", }, 2355 { } 2356 }; 2357 2358 static struct ctl_table seccomp_sysctl_table[] = { 2359 { 2360 .procname = "actions_avail", 2361 .data = (void *) &seccomp_actions_avail, 2362 .maxlen = sizeof(seccomp_actions_avail), 2363 .mode = 0444, 2364 .proc_handler = proc_dostring, 2365 }, 2366 { 2367 .procname = "actions_logged", 2368 .mode = 0644, 2369 .proc_handler = seccomp_actions_logged_handler, 2370 }, 2371 { } 2372 }; 2373 2374 static int __init seccomp_sysctl_init(void) 2375 { 2376 struct ctl_table_header *hdr; 2377 2378 hdr = register_sysctl_paths(seccomp_sysctl_path, seccomp_sysctl_table); 2379 if (!hdr) 2380 pr_warn("sysctl registration failed\n"); 2381 else 2382 kmemleak_not_leak(hdr); 2383 2384 return 0; 2385 } 2386 2387 device_initcall(seccomp_sysctl_init) 2388 2389 #endif /* CONFIG_SYSCTL */ 2390 2391 #ifdef CONFIG_SECCOMP_CACHE_DEBUG 2392 /* Currently CONFIG_SECCOMP_CACHE_DEBUG implies SECCOMP_ARCH_NATIVE */ 2393 static void proc_pid_seccomp_cache_arch(struct seq_file *m, const char *name, 2394 const void *bitmap, size_t bitmap_size) 2395 { 2396 int nr; 2397 2398 for (nr = 0; nr < bitmap_size; nr++) { 2399 bool cached = test_bit(nr, bitmap); 2400 char *status = cached ? "ALLOW" : "FILTER"; 2401 2402 seq_printf(m, "%s %d %s\n", name, nr, status); 2403 } 2404 } 2405 2406 int proc_pid_seccomp_cache(struct seq_file *m, struct pid_namespace *ns, 2407 struct pid *pid, struct task_struct *task) 2408 { 2409 struct seccomp_filter *f; 2410 unsigned long flags; 2411 2412 /* 2413 * We don't want some sandboxed process to know what their seccomp 2414 * filters consist of. 2415 */ 2416 if (!file_ns_capable(m->file, &init_user_ns, CAP_SYS_ADMIN)) 2417 return -EACCES; 2418 2419 if (!lock_task_sighand(task, &flags)) 2420 return -ESRCH; 2421 2422 f = READ_ONCE(task->seccomp.filter); 2423 if (!f) { 2424 unlock_task_sighand(task, &flags); 2425 return 0; 2426 } 2427 2428 /* prevent filter from being freed while we are printing it */ 2429 __get_seccomp_filter(f); 2430 unlock_task_sighand(task, &flags); 2431 2432 proc_pid_seccomp_cache_arch(m, SECCOMP_ARCH_NATIVE_NAME, 2433 f->cache.allow_native, 2434 SECCOMP_ARCH_NATIVE_NR); 2435 2436 #ifdef SECCOMP_ARCH_COMPAT 2437 proc_pid_seccomp_cache_arch(m, SECCOMP_ARCH_COMPAT_NAME, 2438 f->cache.allow_compat, 2439 SECCOMP_ARCH_COMPAT_NR); 2440 #endif /* SECCOMP_ARCH_COMPAT */ 2441 2442 __put_seccomp_filter(f); 2443 return 0; 2444 } 2445 #endif /* CONFIG_SECCOMP_CACHE_DEBUG */ 2446