1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * linux/kernel/seccomp.c 4 * 5 * Copyright 2004-2005 Andrea Arcangeli <andrea@cpushare.com> 6 * 7 * Copyright (C) 2012 Google, Inc. 8 * Will Drewry <wad@chromium.org> 9 * 10 * This defines a simple but solid secure-computing facility. 11 * 12 * Mode 1 uses a fixed list of allowed system calls. 13 * Mode 2 allows user-defined system call filters in the form 14 * of Berkeley Packet Filters/Linux Socket Filters. 15 */ 16 17 #include <linux/refcount.h> 18 #include <linux/audit.h> 19 #include <linux/compat.h> 20 #include <linux/coredump.h> 21 #include <linux/kmemleak.h> 22 #include <linux/nospec.h> 23 #include <linux/prctl.h> 24 #include <linux/sched.h> 25 #include <linux/sched/task_stack.h> 26 #include <linux/seccomp.h> 27 #include <linux/slab.h> 28 #include <linux/syscalls.h> 29 #include <linux/sysctl.h> 30 31 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER 32 #include <asm/syscall.h> 33 #endif 34 35 #ifdef CONFIG_SECCOMP_FILTER 36 #include <linux/file.h> 37 #include <linux/filter.h> 38 #include <linux/pid.h> 39 #include <linux/ptrace.h> 40 #include <linux/security.h> 41 #include <linux/tracehook.h> 42 #include <linux/uaccess.h> 43 #include <linux/anon_inodes.h> 44 45 enum notify_state { 46 SECCOMP_NOTIFY_INIT, 47 SECCOMP_NOTIFY_SENT, 48 SECCOMP_NOTIFY_REPLIED, 49 }; 50 51 struct seccomp_knotif { 52 /* The struct pid of the task whose filter triggered the notification */ 53 struct task_struct *task; 54 55 /* The "cookie" for this request; this is unique for this filter. */ 56 u64 id; 57 58 /* 59 * The seccomp data. This pointer is valid the entire time this 60 * notification is active, since it comes from __seccomp_filter which 61 * eclipses the entire lifecycle here. 62 */ 63 const struct seccomp_data *data; 64 65 /* 66 * Notification states. When SECCOMP_RET_USER_NOTIF is returned, a 67 * struct seccomp_knotif is created and starts out in INIT. Once the 68 * handler reads the notification off of an FD, it transitions to SENT. 69 * If a signal is received the state transitions back to INIT and 70 * another message is sent. When the userspace handler replies, state 71 * transitions to REPLIED. 72 */ 73 enum notify_state state; 74 75 /* The return values, only valid when in SECCOMP_NOTIFY_REPLIED */ 76 int error; 77 long val; 78 u32 flags; 79 80 /* Signals when this has entered SECCOMP_NOTIFY_REPLIED */ 81 struct completion ready; 82 83 struct list_head list; 84 }; 85 86 /** 87 * struct notification - container for seccomp userspace notifications. Since 88 * most seccomp filters will not have notification listeners attached and this 89 * structure is fairly large, we store the notification-specific stuff in a 90 * separate structure. 91 * 92 * @request: A semaphore that users of this notification can wait on for 93 * changes. Actual reads and writes are still controlled with 94 * filter->notify_lock. 95 * @next_id: The id of the next request. 96 * @notifications: A list of struct seccomp_knotif elements. 97 * @wqh: A wait queue for poll. 98 */ 99 struct notification { 100 struct semaphore request; 101 u64 next_id; 102 struct list_head notifications; 103 wait_queue_head_t wqh; 104 }; 105 106 /** 107 * struct seccomp_filter - container for seccomp BPF programs 108 * 109 * @usage: reference count to manage the object lifetime. 110 * get/put helpers should be used when accessing an instance 111 * outside of a lifetime-guarded section. In general, this 112 * is only needed for handling filters shared across tasks. 113 * @log: true if all actions except for SECCOMP_RET_ALLOW should be logged 114 * @prev: points to a previously installed, or inherited, filter 115 * @prog: the BPF program to evaluate 116 * @notif: the struct that holds all notification related information 117 * @notify_lock: A lock for all notification-related accesses. 118 * 119 * seccomp_filter objects are organized in a tree linked via the @prev 120 * pointer. For any task, it appears to be a singly-linked list starting 121 * with current->seccomp.filter, the most recently attached or inherited filter. 122 * However, multiple filters may share a @prev node, by way of fork(), which 123 * results in a unidirectional tree existing in memory. This is similar to 124 * how namespaces work. 125 * 126 * seccomp_filter objects should never be modified after being attached 127 * to a task_struct (other than @usage). 128 */ 129 struct seccomp_filter { 130 refcount_t usage; 131 bool log; 132 struct seccomp_filter *prev; 133 struct bpf_prog *prog; 134 struct notification *notif; 135 struct mutex notify_lock; 136 }; 137 138 /* Limit any path through the tree to 256KB worth of instructions. */ 139 #define MAX_INSNS_PER_PATH ((1 << 18) / sizeof(struct sock_filter)) 140 141 /* 142 * Endianness is explicitly ignored and left for BPF program authors to manage 143 * as per the specific architecture. 144 */ 145 static void populate_seccomp_data(struct seccomp_data *sd) 146 { 147 struct task_struct *task = current; 148 struct pt_regs *regs = task_pt_regs(task); 149 unsigned long args[6]; 150 151 sd->nr = syscall_get_nr(task, regs); 152 sd->arch = syscall_get_arch(task); 153 syscall_get_arguments(task, regs, args); 154 sd->args[0] = args[0]; 155 sd->args[1] = args[1]; 156 sd->args[2] = args[2]; 157 sd->args[3] = args[3]; 158 sd->args[4] = args[4]; 159 sd->args[5] = args[5]; 160 sd->instruction_pointer = KSTK_EIP(task); 161 } 162 163 /** 164 * seccomp_check_filter - verify seccomp filter code 165 * @filter: filter to verify 166 * @flen: length of filter 167 * 168 * Takes a previously checked filter (by bpf_check_classic) and 169 * redirects all filter code that loads struct sk_buff data 170 * and related data through seccomp_bpf_load. It also 171 * enforces length and alignment checking of those loads. 172 * 173 * Returns 0 if the rule set is legal or -EINVAL if not. 174 */ 175 static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen) 176 { 177 int pc; 178 for (pc = 0; pc < flen; pc++) { 179 struct sock_filter *ftest = &filter[pc]; 180 u16 code = ftest->code; 181 u32 k = ftest->k; 182 183 switch (code) { 184 case BPF_LD | BPF_W | BPF_ABS: 185 ftest->code = BPF_LDX | BPF_W | BPF_ABS; 186 /* 32-bit aligned and not out of bounds. */ 187 if (k >= sizeof(struct seccomp_data) || k & 3) 188 return -EINVAL; 189 continue; 190 case BPF_LD | BPF_W | BPF_LEN: 191 ftest->code = BPF_LD | BPF_IMM; 192 ftest->k = sizeof(struct seccomp_data); 193 continue; 194 case BPF_LDX | BPF_W | BPF_LEN: 195 ftest->code = BPF_LDX | BPF_IMM; 196 ftest->k = sizeof(struct seccomp_data); 197 continue; 198 /* Explicitly include allowed calls. */ 199 case BPF_RET | BPF_K: 200 case BPF_RET | BPF_A: 201 case BPF_ALU | BPF_ADD | BPF_K: 202 case BPF_ALU | BPF_ADD | BPF_X: 203 case BPF_ALU | BPF_SUB | BPF_K: 204 case BPF_ALU | BPF_SUB | BPF_X: 205 case BPF_ALU | BPF_MUL | BPF_K: 206 case BPF_ALU | BPF_MUL | BPF_X: 207 case BPF_ALU | BPF_DIV | BPF_K: 208 case BPF_ALU | BPF_DIV | BPF_X: 209 case BPF_ALU | BPF_AND | BPF_K: 210 case BPF_ALU | BPF_AND | BPF_X: 211 case BPF_ALU | BPF_OR | BPF_K: 212 case BPF_ALU | BPF_OR | BPF_X: 213 case BPF_ALU | BPF_XOR | BPF_K: 214 case BPF_ALU | BPF_XOR | BPF_X: 215 case BPF_ALU | BPF_LSH | BPF_K: 216 case BPF_ALU | BPF_LSH | BPF_X: 217 case BPF_ALU | BPF_RSH | BPF_K: 218 case BPF_ALU | BPF_RSH | BPF_X: 219 case BPF_ALU | BPF_NEG: 220 case BPF_LD | BPF_IMM: 221 case BPF_LDX | BPF_IMM: 222 case BPF_MISC | BPF_TAX: 223 case BPF_MISC | BPF_TXA: 224 case BPF_LD | BPF_MEM: 225 case BPF_LDX | BPF_MEM: 226 case BPF_ST: 227 case BPF_STX: 228 case BPF_JMP | BPF_JA: 229 case BPF_JMP | BPF_JEQ | BPF_K: 230 case BPF_JMP | BPF_JEQ | BPF_X: 231 case BPF_JMP | BPF_JGE | BPF_K: 232 case BPF_JMP | BPF_JGE | BPF_X: 233 case BPF_JMP | BPF_JGT | BPF_K: 234 case BPF_JMP | BPF_JGT | BPF_X: 235 case BPF_JMP | BPF_JSET | BPF_K: 236 case BPF_JMP | BPF_JSET | BPF_X: 237 continue; 238 default: 239 return -EINVAL; 240 } 241 } 242 return 0; 243 } 244 245 /** 246 * seccomp_run_filters - evaluates all seccomp filters against @sd 247 * @sd: optional seccomp data to be passed to filters 248 * @match: stores struct seccomp_filter that resulted in the return value, 249 * unless filter returned SECCOMP_RET_ALLOW, in which case it will 250 * be unchanged. 251 * 252 * Returns valid seccomp BPF response codes. 253 */ 254 #define ACTION_ONLY(ret) ((s32)((ret) & (SECCOMP_RET_ACTION_FULL))) 255 static u32 seccomp_run_filters(const struct seccomp_data *sd, 256 struct seccomp_filter **match) 257 { 258 u32 ret = SECCOMP_RET_ALLOW; 259 /* Make sure cross-thread synced filter points somewhere sane. */ 260 struct seccomp_filter *f = 261 READ_ONCE(current->seccomp.filter); 262 263 /* Ensure unexpected behavior doesn't result in failing open. */ 264 if (WARN_ON(f == NULL)) 265 return SECCOMP_RET_KILL_PROCESS; 266 267 /* 268 * All filters in the list are evaluated and the lowest BPF return 269 * value always takes priority (ignoring the DATA). 270 */ 271 for (; f; f = f->prev) { 272 u32 cur_ret = bpf_prog_run_pin_on_cpu(f->prog, sd); 273 274 if (ACTION_ONLY(cur_ret) < ACTION_ONLY(ret)) { 275 ret = cur_ret; 276 *match = f; 277 } 278 } 279 return ret; 280 } 281 #endif /* CONFIG_SECCOMP_FILTER */ 282 283 static inline bool seccomp_may_assign_mode(unsigned long seccomp_mode) 284 { 285 assert_spin_locked(¤t->sighand->siglock); 286 287 if (current->seccomp.mode && current->seccomp.mode != seccomp_mode) 288 return false; 289 290 return true; 291 } 292 293 void __weak arch_seccomp_spec_mitigate(struct task_struct *task) { } 294 295 static inline void seccomp_assign_mode(struct task_struct *task, 296 unsigned long seccomp_mode, 297 unsigned long flags) 298 { 299 assert_spin_locked(&task->sighand->siglock); 300 301 task->seccomp.mode = seccomp_mode; 302 /* 303 * Make sure TIF_SECCOMP cannot be set before the mode (and 304 * filter) is set. 305 */ 306 smp_mb__before_atomic(); 307 /* Assume default seccomp processes want spec flaw mitigation. */ 308 if ((flags & SECCOMP_FILTER_FLAG_SPEC_ALLOW) == 0) 309 arch_seccomp_spec_mitigate(task); 310 set_tsk_thread_flag(task, TIF_SECCOMP); 311 } 312 313 #ifdef CONFIG_SECCOMP_FILTER 314 /* Returns 1 if the parent is an ancestor of the child. */ 315 static int is_ancestor(struct seccomp_filter *parent, 316 struct seccomp_filter *child) 317 { 318 /* NULL is the root ancestor. */ 319 if (parent == NULL) 320 return 1; 321 for (; child; child = child->prev) 322 if (child == parent) 323 return 1; 324 return 0; 325 } 326 327 /** 328 * seccomp_can_sync_threads: checks if all threads can be synchronized 329 * 330 * Expects sighand and cred_guard_mutex locks to be held. 331 * 332 * Returns 0 on success, -ve on error, or the pid of a thread which was 333 * either not in the correct seccomp mode or did not have an ancestral 334 * seccomp filter. 335 */ 336 static inline pid_t seccomp_can_sync_threads(void) 337 { 338 struct task_struct *thread, *caller; 339 340 BUG_ON(!mutex_is_locked(¤t->signal->cred_guard_mutex)); 341 assert_spin_locked(¤t->sighand->siglock); 342 343 /* Validate all threads being eligible for synchronization. */ 344 caller = current; 345 for_each_thread(caller, thread) { 346 pid_t failed; 347 348 /* Skip current, since it is initiating the sync. */ 349 if (thread == caller) 350 continue; 351 352 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED || 353 (thread->seccomp.mode == SECCOMP_MODE_FILTER && 354 is_ancestor(thread->seccomp.filter, 355 caller->seccomp.filter))) 356 continue; 357 358 /* Return the first thread that cannot be synchronized. */ 359 failed = task_pid_vnr(thread); 360 /* If the pid cannot be resolved, then return -ESRCH */ 361 if (WARN_ON(failed == 0)) 362 failed = -ESRCH; 363 return failed; 364 } 365 366 return 0; 367 } 368 369 /** 370 * seccomp_sync_threads: sets all threads to use current's filter 371 * 372 * Expects sighand and cred_guard_mutex locks to be held, and for 373 * seccomp_can_sync_threads() to have returned success already 374 * without dropping the locks. 375 * 376 */ 377 static inline void seccomp_sync_threads(unsigned long flags) 378 { 379 struct task_struct *thread, *caller; 380 381 BUG_ON(!mutex_is_locked(¤t->signal->cred_guard_mutex)); 382 assert_spin_locked(¤t->sighand->siglock); 383 384 /* Synchronize all threads. */ 385 caller = current; 386 for_each_thread(caller, thread) { 387 /* Skip current, since it needs no changes. */ 388 if (thread == caller) 389 continue; 390 391 /* Get a task reference for the new leaf node. */ 392 get_seccomp_filter(caller); 393 /* 394 * Drop the task reference to the shared ancestor since 395 * current's path will hold a reference. (This also 396 * allows a put before the assignment.) 397 */ 398 put_seccomp_filter(thread); 399 smp_store_release(&thread->seccomp.filter, 400 caller->seccomp.filter); 401 atomic_set(&thread->seccomp.filter_count, 402 atomic_read(&thread->seccomp.filter_count)); 403 404 /* 405 * Don't let an unprivileged task work around 406 * the no_new_privs restriction by creating 407 * a thread that sets it up, enters seccomp, 408 * then dies. 409 */ 410 if (task_no_new_privs(caller)) 411 task_set_no_new_privs(thread); 412 413 /* 414 * Opt the other thread into seccomp if needed. 415 * As threads are considered to be trust-realm 416 * equivalent (see ptrace_may_access), it is safe to 417 * allow one thread to transition the other. 418 */ 419 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED) 420 seccomp_assign_mode(thread, SECCOMP_MODE_FILTER, 421 flags); 422 } 423 } 424 425 /** 426 * seccomp_prepare_filter: Prepares a seccomp filter for use. 427 * @fprog: BPF program to install 428 * 429 * Returns filter on success or an ERR_PTR on failure. 430 */ 431 static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog) 432 { 433 struct seccomp_filter *sfilter; 434 int ret; 435 const bool save_orig = IS_ENABLED(CONFIG_CHECKPOINT_RESTORE); 436 437 if (fprog->len == 0 || fprog->len > BPF_MAXINSNS) 438 return ERR_PTR(-EINVAL); 439 440 BUG_ON(INT_MAX / fprog->len < sizeof(struct sock_filter)); 441 442 /* 443 * Installing a seccomp filter requires that the task has 444 * CAP_SYS_ADMIN in its namespace or be running with no_new_privs. 445 * This avoids scenarios where unprivileged tasks can affect the 446 * behavior of privileged children. 447 */ 448 if (!task_no_new_privs(current) && 449 security_capable(current_cred(), current_user_ns(), 450 CAP_SYS_ADMIN, CAP_OPT_NOAUDIT) != 0) 451 return ERR_PTR(-EACCES); 452 453 /* Allocate a new seccomp_filter */ 454 sfilter = kzalloc(sizeof(*sfilter), GFP_KERNEL | __GFP_NOWARN); 455 if (!sfilter) 456 return ERR_PTR(-ENOMEM); 457 458 mutex_init(&sfilter->notify_lock); 459 ret = bpf_prog_create_from_user(&sfilter->prog, fprog, 460 seccomp_check_filter, save_orig); 461 if (ret < 0) { 462 kfree(sfilter); 463 return ERR_PTR(ret); 464 } 465 466 refcount_set(&sfilter->usage, 1); 467 468 return sfilter; 469 } 470 471 /** 472 * seccomp_prepare_user_filter - prepares a user-supplied sock_fprog 473 * @user_filter: pointer to the user data containing a sock_fprog. 474 * 475 * Returns 0 on success and non-zero otherwise. 476 */ 477 static struct seccomp_filter * 478 seccomp_prepare_user_filter(const char __user *user_filter) 479 { 480 struct sock_fprog fprog; 481 struct seccomp_filter *filter = ERR_PTR(-EFAULT); 482 483 #ifdef CONFIG_COMPAT 484 if (in_compat_syscall()) { 485 struct compat_sock_fprog fprog32; 486 if (copy_from_user(&fprog32, user_filter, sizeof(fprog32))) 487 goto out; 488 fprog.len = fprog32.len; 489 fprog.filter = compat_ptr(fprog32.filter); 490 } else /* falls through to the if below. */ 491 #endif 492 if (copy_from_user(&fprog, user_filter, sizeof(fprog))) 493 goto out; 494 filter = seccomp_prepare_filter(&fprog); 495 out: 496 return filter; 497 } 498 499 /** 500 * seccomp_attach_filter: validate and attach filter 501 * @flags: flags to change filter behavior 502 * @filter: seccomp filter to add to the current process 503 * 504 * Caller must be holding current->sighand->siglock lock. 505 * 506 * Returns 0 on success, -ve on error, or 507 * - in TSYNC mode: the pid of a thread which was either not in the correct 508 * seccomp mode or did not have an ancestral seccomp filter 509 * - in NEW_LISTENER mode: the fd of the new listener 510 */ 511 static long seccomp_attach_filter(unsigned int flags, 512 struct seccomp_filter *filter) 513 { 514 unsigned long total_insns; 515 struct seccomp_filter *walker; 516 517 assert_spin_locked(¤t->sighand->siglock); 518 519 /* Validate resulting filter length. */ 520 total_insns = filter->prog->len; 521 for (walker = current->seccomp.filter; walker; walker = walker->prev) 522 total_insns += walker->prog->len + 4; /* 4 instr penalty */ 523 if (total_insns > MAX_INSNS_PER_PATH) 524 return -ENOMEM; 525 526 /* If thread sync has been requested, check that it is possible. */ 527 if (flags & SECCOMP_FILTER_FLAG_TSYNC) { 528 int ret; 529 530 ret = seccomp_can_sync_threads(); 531 if (ret) { 532 if (flags & SECCOMP_FILTER_FLAG_TSYNC_ESRCH) 533 return -ESRCH; 534 else 535 return ret; 536 } 537 } 538 539 /* Set log flag, if present. */ 540 if (flags & SECCOMP_FILTER_FLAG_LOG) 541 filter->log = true; 542 543 /* 544 * If there is an existing filter, make it the prev and don't drop its 545 * task reference. 546 */ 547 filter->prev = current->seccomp.filter; 548 current->seccomp.filter = filter; 549 atomic_inc(¤t->seccomp.filter_count); 550 551 /* Now that the new filter is in place, synchronize to all threads. */ 552 if (flags & SECCOMP_FILTER_FLAG_TSYNC) 553 seccomp_sync_threads(flags); 554 555 return 0; 556 } 557 558 static void __get_seccomp_filter(struct seccomp_filter *filter) 559 { 560 refcount_inc(&filter->usage); 561 } 562 563 /* get_seccomp_filter - increments the reference count of the filter on @tsk */ 564 void get_seccomp_filter(struct task_struct *tsk) 565 { 566 struct seccomp_filter *orig = tsk->seccomp.filter; 567 if (!orig) 568 return; 569 __get_seccomp_filter(orig); 570 } 571 572 static inline void seccomp_filter_free(struct seccomp_filter *filter) 573 { 574 if (filter) { 575 bpf_prog_destroy(filter->prog); 576 kfree(filter); 577 } 578 } 579 580 static void __put_seccomp_filter(struct seccomp_filter *orig) 581 { 582 /* Clean up single-reference branches iteratively. */ 583 while (orig && refcount_dec_and_test(&orig->usage)) { 584 struct seccomp_filter *freeme = orig; 585 orig = orig->prev; 586 seccomp_filter_free(freeme); 587 } 588 } 589 590 /* put_seccomp_filter - decrements the ref count of tsk->seccomp.filter */ 591 void put_seccomp_filter(struct task_struct *tsk) 592 { 593 __put_seccomp_filter(tsk->seccomp.filter); 594 } 595 596 static void seccomp_init_siginfo(kernel_siginfo_t *info, int syscall, int reason) 597 { 598 clear_siginfo(info); 599 info->si_signo = SIGSYS; 600 info->si_code = SYS_SECCOMP; 601 info->si_call_addr = (void __user *)KSTK_EIP(current); 602 info->si_errno = reason; 603 info->si_arch = syscall_get_arch(current); 604 info->si_syscall = syscall; 605 } 606 607 /** 608 * seccomp_send_sigsys - signals the task to allow in-process syscall emulation 609 * @syscall: syscall number to send to userland 610 * @reason: filter-supplied reason code to send to userland (via si_errno) 611 * 612 * Forces a SIGSYS with a code of SYS_SECCOMP and related sigsys info. 613 */ 614 static void seccomp_send_sigsys(int syscall, int reason) 615 { 616 struct kernel_siginfo info; 617 seccomp_init_siginfo(&info, syscall, reason); 618 force_sig_info(&info); 619 } 620 #endif /* CONFIG_SECCOMP_FILTER */ 621 622 /* For use with seccomp_actions_logged */ 623 #define SECCOMP_LOG_KILL_PROCESS (1 << 0) 624 #define SECCOMP_LOG_KILL_THREAD (1 << 1) 625 #define SECCOMP_LOG_TRAP (1 << 2) 626 #define SECCOMP_LOG_ERRNO (1 << 3) 627 #define SECCOMP_LOG_TRACE (1 << 4) 628 #define SECCOMP_LOG_LOG (1 << 5) 629 #define SECCOMP_LOG_ALLOW (1 << 6) 630 #define SECCOMP_LOG_USER_NOTIF (1 << 7) 631 632 static u32 seccomp_actions_logged = SECCOMP_LOG_KILL_PROCESS | 633 SECCOMP_LOG_KILL_THREAD | 634 SECCOMP_LOG_TRAP | 635 SECCOMP_LOG_ERRNO | 636 SECCOMP_LOG_USER_NOTIF | 637 SECCOMP_LOG_TRACE | 638 SECCOMP_LOG_LOG; 639 640 static inline void seccomp_log(unsigned long syscall, long signr, u32 action, 641 bool requested) 642 { 643 bool log = false; 644 645 switch (action) { 646 case SECCOMP_RET_ALLOW: 647 break; 648 case SECCOMP_RET_TRAP: 649 log = requested && seccomp_actions_logged & SECCOMP_LOG_TRAP; 650 break; 651 case SECCOMP_RET_ERRNO: 652 log = requested && seccomp_actions_logged & SECCOMP_LOG_ERRNO; 653 break; 654 case SECCOMP_RET_TRACE: 655 log = requested && seccomp_actions_logged & SECCOMP_LOG_TRACE; 656 break; 657 case SECCOMP_RET_USER_NOTIF: 658 log = requested && seccomp_actions_logged & SECCOMP_LOG_USER_NOTIF; 659 break; 660 case SECCOMP_RET_LOG: 661 log = seccomp_actions_logged & SECCOMP_LOG_LOG; 662 break; 663 case SECCOMP_RET_KILL_THREAD: 664 log = seccomp_actions_logged & SECCOMP_LOG_KILL_THREAD; 665 break; 666 case SECCOMP_RET_KILL_PROCESS: 667 default: 668 log = seccomp_actions_logged & SECCOMP_LOG_KILL_PROCESS; 669 } 670 671 /* 672 * Emit an audit message when the action is RET_KILL_*, RET_LOG, or the 673 * FILTER_FLAG_LOG bit was set. The admin has the ability to silence 674 * any action from being logged by removing the action name from the 675 * seccomp_actions_logged sysctl. 676 */ 677 if (!log) 678 return; 679 680 audit_seccomp(syscall, signr, action); 681 } 682 683 /* 684 * Secure computing mode 1 allows only read/write/exit/sigreturn. 685 * To be fully secure this must be combined with rlimit 686 * to limit the stack allocations too. 687 */ 688 static const int mode1_syscalls[] = { 689 __NR_seccomp_read, __NR_seccomp_write, __NR_seccomp_exit, __NR_seccomp_sigreturn, 690 0, /* null terminated */ 691 }; 692 693 static void __secure_computing_strict(int this_syscall) 694 { 695 const int *syscall_whitelist = mode1_syscalls; 696 #ifdef CONFIG_COMPAT 697 if (in_compat_syscall()) 698 syscall_whitelist = get_compat_mode1_syscalls(); 699 #endif 700 do { 701 if (*syscall_whitelist == this_syscall) 702 return; 703 } while (*++syscall_whitelist); 704 705 #ifdef SECCOMP_DEBUG 706 dump_stack(); 707 #endif 708 seccomp_log(this_syscall, SIGKILL, SECCOMP_RET_KILL_THREAD, true); 709 do_exit(SIGKILL); 710 } 711 712 #ifndef CONFIG_HAVE_ARCH_SECCOMP_FILTER 713 void secure_computing_strict(int this_syscall) 714 { 715 int mode = current->seccomp.mode; 716 717 if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) && 718 unlikely(current->ptrace & PT_SUSPEND_SECCOMP)) 719 return; 720 721 if (mode == SECCOMP_MODE_DISABLED) 722 return; 723 else if (mode == SECCOMP_MODE_STRICT) 724 __secure_computing_strict(this_syscall); 725 else 726 BUG(); 727 } 728 #else 729 730 #ifdef CONFIG_SECCOMP_FILTER 731 static u64 seccomp_next_notify_id(struct seccomp_filter *filter) 732 { 733 /* 734 * Note: overflow is ok here, the id just needs to be unique per 735 * filter. 736 */ 737 lockdep_assert_held(&filter->notify_lock); 738 return filter->notif->next_id++; 739 } 740 741 static int seccomp_do_user_notification(int this_syscall, 742 struct seccomp_filter *match, 743 const struct seccomp_data *sd) 744 { 745 int err; 746 u32 flags = 0; 747 long ret = 0; 748 struct seccomp_knotif n = {}; 749 750 mutex_lock(&match->notify_lock); 751 err = -ENOSYS; 752 if (!match->notif) 753 goto out; 754 755 n.task = current; 756 n.state = SECCOMP_NOTIFY_INIT; 757 n.data = sd; 758 n.id = seccomp_next_notify_id(match); 759 init_completion(&n.ready); 760 list_add(&n.list, &match->notif->notifications); 761 762 up(&match->notif->request); 763 wake_up_poll(&match->notif->wqh, EPOLLIN | EPOLLRDNORM); 764 mutex_unlock(&match->notify_lock); 765 766 /* 767 * This is where we wait for a reply from userspace. 768 */ 769 err = wait_for_completion_interruptible(&n.ready); 770 mutex_lock(&match->notify_lock); 771 if (err == 0) { 772 ret = n.val; 773 err = n.error; 774 flags = n.flags; 775 } 776 777 /* 778 * Note that it's possible the listener died in between the time when 779 * we were notified of a respons (or a signal) and when we were able to 780 * re-acquire the lock, so only delete from the list if the 781 * notification actually exists. 782 * 783 * Also note that this test is only valid because there's no way to 784 * *reattach* to a notifier right now. If one is added, we'll need to 785 * keep track of the notif itself and make sure they match here. 786 */ 787 if (match->notif) 788 list_del(&n.list); 789 out: 790 mutex_unlock(&match->notify_lock); 791 792 /* Userspace requests to continue the syscall. */ 793 if (flags & SECCOMP_USER_NOTIF_FLAG_CONTINUE) 794 return 0; 795 796 syscall_set_return_value(current, task_pt_regs(current), 797 err, ret); 798 return -1; 799 } 800 801 static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd, 802 const bool recheck_after_trace) 803 { 804 u32 filter_ret, action; 805 struct seccomp_filter *match = NULL; 806 int data; 807 struct seccomp_data sd_local; 808 809 /* 810 * Make sure that any changes to mode from another thread have 811 * been seen after TIF_SECCOMP was seen. 812 */ 813 rmb(); 814 815 if (!sd) { 816 populate_seccomp_data(&sd_local); 817 sd = &sd_local; 818 } 819 820 filter_ret = seccomp_run_filters(sd, &match); 821 data = filter_ret & SECCOMP_RET_DATA; 822 action = filter_ret & SECCOMP_RET_ACTION_FULL; 823 824 switch (action) { 825 case SECCOMP_RET_ERRNO: 826 /* Set low-order bits as an errno, capped at MAX_ERRNO. */ 827 if (data > MAX_ERRNO) 828 data = MAX_ERRNO; 829 syscall_set_return_value(current, task_pt_regs(current), 830 -data, 0); 831 goto skip; 832 833 case SECCOMP_RET_TRAP: 834 /* Show the handler the original registers. */ 835 syscall_rollback(current, task_pt_regs(current)); 836 /* Let the filter pass back 16 bits of data. */ 837 seccomp_send_sigsys(this_syscall, data); 838 goto skip; 839 840 case SECCOMP_RET_TRACE: 841 /* We've been put in this state by the ptracer already. */ 842 if (recheck_after_trace) 843 return 0; 844 845 /* ENOSYS these calls if there is no tracer attached. */ 846 if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP)) { 847 syscall_set_return_value(current, 848 task_pt_regs(current), 849 -ENOSYS, 0); 850 goto skip; 851 } 852 853 /* Allow the BPF to provide the event message */ 854 ptrace_event(PTRACE_EVENT_SECCOMP, data); 855 /* 856 * The delivery of a fatal signal during event 857 * notification may silently skip tracer notification, 858 * which could leave us with a potentially unmodified 859 * syscall that the tracer would have liked to have 860 * changed. Since the process is about to die, we just 861 * force the syscall to be skipped and let the signal 862 * kill the process and correctly handle any tracer exit 863 * notifications. 864 */ 865 if (fatal_signal_pending(current)) 866 goto skip; 867 /* Check if the tracer forced the syscall to be skipped. */ 868 this_syscall = syscall_get_nr(current, task_pt_regs(current)); 869 if (this_syscall < 0) 870 goto skip; 871 872 /* 873 * Recheck the syscall, since it may have changed. This 874 * intentionally uses a NULL struct seccomp_data to force 875 * a reload of all registers. This does not goto skip since 876 * a skip would have already been reported. 877 */ 878 if (__seccomp_filter(this_syscall, NULL, true)) 879 return -1; 880 881 return 0; 882 883 case SECCOMP_RET_USER_NOTIF: 884 if (seccomp_do_user_notification(this_syscall, match, sd)) 885 goto skip; 886 887 return 0; 888 889 case SECCOMP_RET_LOG: 890 seccomp_log(this_syscall, 0, action, true); 891 return 0; 892 893 case SECCOMP_RET_ALLOW: 894 /* 895 * Note that the "match" filter will always be NULL for 896 * this action since SECCOMP_RET_ALLOW is the starting 897 * state in seccomp_run_filters(). 898 */ 899 return 0; 900 901 case SECCOMP_RET_KILL_THREAD: 902 case SECCOMP_RET_KILL_PROCESS: 903 default: 904 seccomp_log(this_syscall, SIGSYS, action, true); 905 /* Dump core only if this is the last remaining thread. */ 906 if (action == SECCOMP_RET_KILL_PROCESS || 907 get_nr_threads(current) == 1) { 908 kernel_siginfo_t info; 909 910 /* Show the original registers in the dump. */ 911 syscall_rollback(current, task_pt_regs(current)); 912 /* Trigger a manual coredump since do_exit skips it. */ 913 seccomp_init_siginfo(&info, this_syscall, data); 914 do_coredump(&info); 915 } 916 if (action == SECCOMP_RET_KILL_PROCESS) 917 do_group_exit(SIGSYS); 918 else 919 do_exit(SIGSYS); 920 } 921 922 unreachable(); 923 924 skip: 925 seccomp_log(this_syscall, 0, action, match ? match->log : false); 926 return -1; 927 } 928 #else 929 static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd, 930 const bool recheck_after_trace) 931 { 932 BUG(); 933 } 934 #endif 935 936 int __secure_computing(const struct seccomp_data *sd) 937 { 938 int mode = current->seccomp.mode; 939 int this_syscall; 940 941 if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) && 942 unlikely(current->ptrace & PT_SUSPEND_SECCOMP)) 943 return 0; 944 945 this_syscall = sd ? sd->nr : 946 syscall_get_nr(current, task_pt_regs(current)); 947 948 switch (mode) { 949 case SECCOMP_MODE_STRICT: 950 __secure_computing_strict(this_syscall); /* may call do_exit */ 951 return 0; 952 case SECCOMP_MODE_FILTER: 953 return __seccomp_filter(this_syscall, sd, false); 954 default: 955 BUG(); 956 } 957 } 958 #endif /* CONFIG_HAVE_ARCH_SECCOMP_FILTER */ 959 960 long prctl_get_seccomp(void) 961 { 962 return current->seccomp.mode; 963 } 964 965 /** 966 * seccomp_set_mode_strict: internal function for setting strict seccomp 967 * 968 * Once current->seccomp.mode is non-zero, it may not be changed. 969 * 970 * Returns 0 on success or -EINVAL on failure. 971 */ 972 static long seccomp_set_mode_strict(void) 973 { 974 const unsigned long seccomp_mode = SECCOMP_MODE_STRICT; 975 long ret = -EINVAL; 976 977 spin_lock_irq(¤t->sighand->siglock); 978 979 if (!seccomp_may_assign_mode(seccomp_mode)) 980 goto out; 981 982 #ifdef TIF_NOTSC 983 disable_TSC(); 984 #endif 985 seccomp_assign_mode(current, seccomp_mode, 0); 986 ret = 0; 987 988 out: 989 spin_unlock_irq(¤t->sighand->siglock); 990 991 return ret; 992 } 993 994 #ifdef CONFIG_SECCOMP_FILTER 995 static int seccomp_notify_release(struct inode *inode, struct file *file) 996 { 997 struct seccomp_filter *filter = file->private_data; 998 struct seccomp_knotif *knotif; 999 1000 if (!filter) 1001 return 0; 1002 1003 mutex_lock(&filter->notify_lock); 1004 1005 /* 1006 * If this file is being closed because e.g. the task who owned it 1007 * died, let's wake everyone up who was waiting on us. 1008 */ 1009 list_for_each_entry(knotif, &filter->notif->notifications, list) { 1010 if (knotif->state == SECCOMP_NOTIFY_REPLIED) 1011 continue; 1012 1013 knotif->state = SECCOMP_NOTIFY_REPLIED; 1014 knotif->error = -ENOSYS; 1015 knotif->val = 0; 1016 1017 complete(&knotif->ready); 1018 } 1019 1020 kfree(filter->notif); 1021 filter->notif = NULL; 1022 mutex_unlock(&filter->notify_lock); 1023 __put_seccomp_filter(filter); 1024 return 0; 1025 } 1026 1027 static long seccomp_notify_recv(struct seccomp_filter *filter, 1028 void __user *buf) 1029 { 1030 struct seccomp_knotif *knotif = NULL, *cur; 1031 struct seccomp_notif unotif; 1032 ssize_t ret; 1033 1034 /* Verify that we're not given garbage to keep struct extensible. */ 1035 ret = check_zeroed_user(buf, sizeof(unotif)); 1036 if (ret < 0) 1037 return ret; 1038 if (!ret) 1039 return -EINVAL; 1040 1041 memset(&unotif, 0, sizeof(unotif)); 1042 1043 ret = down_interruptible(&filter->notif->request); 1044 if (ret < 0) 1045 return ret; 1046 1047 mutex_lock(&filter->notify_lock); 1048 list_for_each_entry(cur, &filter->notif->notifications, list) { 1049 if (cur->state == SECCOMP_NOTIFY_INIT) { 1050 knotif = cur; 1051 break; 1052 } 1053 } 1054 1055 /* 1056 * If we didn't find a notification, it could be that the task was 1057 * interrupted by a fatal signal between the time we were woken and 1058 * when we were able to acquire the rw lock. 1059 */ 1060 if (!knotif) { 1061 ret = -ENOENT; 1062 goto out; 1063 } 1064 1065 unotif.id = knotif->id; 1066 unotif.pid = task_pid_vnr(knotif->task); 1067 unotif.data = *(knotif->data); 1068 1069 knotif->state = SECCOMP_NOTIFY_SENT; 1070 wake_up_poll(&filter->notif->wqh, EPOLLOUT | EPOLLWRNORM); 1071 ret = 0; 1072 out: 1073 mutex_unlock(&filter->notify_lock); 1074 1075 if (ret == 0 && copy_to_user(buf, &unotif, sizeof(unotif))) { 1076 ret = -EFAULT; 1077 1078 /* 1079 * Userspace screwed up. To make sure that we keep this 1080 * notification alive, let's reset it back to INIT. It 1081 * may have died when we released the lock, so we need to make 1082 * sure it's still around. 1083 */ 1084 knotif = NULL; 1085 mutex_lock(&filter->notify_lock); 1086 list_for_each_entry(cur, &filter->notif->notifications, list) { 1087 if (cur->id == unotif.id) { 1088 knotif = cur; 1089 break; 1090 } 1091 } 1092 1093 if (knotif) { 1094 knotif->state = SECCOMP_NOTIFY_INIT; 1095 up(&filter->notif->request); 1096 } 1097 mutex_unlock(&filter->notify_lock); 1098 } 1099 1100 return ret; 1101 } 1102 1103 static long seccomp_notify_send(struct seccomp_filter *filter, 1104 void __user *buf) 1105 { 1106 struct seccomp_notif_resp resp = {}; 1107 struct seccomp_knotif *knotif = NULL, *cur; 1108 long ret; 1109 1110 if (copy_from_user(&resp, buf, sizeof(resp))) 1111 return -EFAULT; 1112 1113 if (resp.flags & ~SECCOMP_USER_NOTIF_FLAG_CONTINUE) 1114 return -EINVAL; 1115 1116 if ((resp.flags & SECCOMP_USER_NOTIF_FLAG_CONTINUE) && 1117 (resp.error || resp.val)) 1118 return -EINVAL; 1119 1120 ret = mutex_lock_interruptible(&filter->notify_lock); 1121 if (ret < 0) 1122 return ret; 1123 1124 list_for_each_entry(cur, &filter->notif->notifications, list) { 1125 if (cur->id == resp.id) { 1126 knotif = cur; 1127 break; 1128 } 1129 } 1130 1131 if (!knotif) { 1132 ret = -ENOENT; 1133 goto out; 1134 } 1135 1136 /* Allow exactly one reply. */ 1137 if (knotif->state != SECCOMP_NOTIFY_SENT) { 1138 ret = -EINPROGRESS; 1139 goto out; 1140 } 1141 1142 ret = 0; 1143 knotif->state = SECCOMP_NOTIFY_REPLIED; 1144 knotif->error = resp.error; 1145 knotif->val = resp.val; 1146 knotif->flags = resp.flags; 1147 complete(&knotif->ready); 1148 out: 1149 mutex_unlock(&filter->notify_lock); 1150 return ret; 1151 } 1152 1153 static long seccomp_notify_id_valid(struct seccomp_filter *filter, 1154 void __user *buf) 1155 { 1156 struct seccomp_knotif *knotif = NULL; 1157 u64 id; 1158 long ret; 1159 1160 if (copy_from_user(&id, buf, sizeof(id))) 1161 return -EFAULT; 1162 1163 ret = mutex_lock_interruptible(&filter->notify_lock); 1164 if (ret < 0) 1165 return ret; 1166 1167 ret = -ENOENT; 1168 list_for_each_entry(knotif, &filter->notif->notifications, list) { 1169 if (knotif->id == id) { 1170 if (knotif->state == SECCOMP_NOTIFY_SENT) 1171 ret = 0; 1172 goto out; 1173 } 1174 } 1175 1176 out: 1177 mutex_unlock(&filter->notify_lock); 1178 return ret; 1179 } 1180 1181 static long seccomp_notify_ioctl(struct file *file, unsigned int cmd, 1182 unsigned long arg) 1183 { 1184 struct seccomp_filter *filter = file->private_data; 1185 void __user *buf = (void __user *)arg; 1186 1187 switch (cmd) { 1188 case SECCOMP_IOCTL_NOTIF_RECV: 1189 return seccomp_notify_recv(filter, buf); 1190 case SECCOMP_IOCTL_NOTIF_SEND: 1191 return seccomp_notify_send(filter, buf); 1192 case SECCOMP_IOCTL_NOTIF_ID_VALID: 1193 return seccomp_notify_id_valid(filter, buf); 1194 default: 1195 return -EINVAL; 1196 } 1197 } 1198 1199 static __poll_t seccomp_notify_poll(struct file *file, 1200 struct poll_table_struct *poll_tab) 1201 { 1202 struct seccomp_filter *filter = file->private_data; 1203 __poll_t ret = 0; 1204 struct seccomp_knotif *cur; 1205 1206 poll_wait(file, &filter->notif->wqh, poll_tab); 1207 1208 if (mutex_lock_interruptible(&filter->notify_lock) < 0) 1209 return EPOLLERR; 1210 1211 list_for_each_entry(cur, &filter->notif->notifications, list) { 1212 if (cur->state == SECCOMP_NOTIFY_INIT) 1213 ret |= EPOLLIN | EPOLLRDNORM; 1214 if (cur->state == SECCOMP_NOTIFY_SENT) 1215 ret |= EPOLLOUT | EPOLLWRNORM; 1216 if ((ret & EPOLLIN) && (ret & EPOLLOUT)) 1217 break; 1218 } 1219 1220 mutex_unlock(&filter->notify_lock); 1221 1222 return ret; 1223 } 1224 1225 static const struct file_operations seccomp_notify_ops = { 1226 .poll = seccomp_notify_poll, 1227 .release = seccomp_notify_release, 1228 .unlocked_ioctl = seccomp_notify_ioctl, 1229 .compat_ioctl = seccomp_notify_ioctl, 1230 }; 1231 1232 static struct file *init_listener(struct seccomp_filter *filter) 1233 { 1234 struct file *ret = ERR_PTR(-EBUSY); 1235 struct seccomp_filter *cur; 1236 1237 for (cur = current->seccomp.filter; cur; cur = cur->prev) { 1238 if (cur->notif) 1239 goto out; 1240 } 1241 1242 ret = ERR_PTR(-ENOMEM); 1243 filter->notif = kzalloc(sizeof(*(filter->notif)), GFP_KERNEL); 1244 if (!filter->notif) 1245 goto out; 1246 1247 sema_init(&filter->notif->request, 0); 1248 filter->notif->next_id = get_random_u64(); 1249 INIT_LIST_HEAD(&filter->notif->notifications); 1250 init_waitqueue_head(&filter->notif->wqh); 1251 1252 ret = anon_inode_getfile("seccomp notify", &seccomp_notify_ops, 1253 filter, O_RDWR); 1254 if (IS_ERR(ret)) 1255 goto out_notif; 1256 1257 /* The file has a reference to it now */ 1258 __get_seccomp_filter(filter); 1259 1260 out_notif: 1261 if (IS_ERR(ret)) 1262 kfree(filter->notif); 1263 out: 1264 return ret; 1265 } 1266 1267 /** 1268 * seccomp_set_mode_filter: internal function for setting seccomp filter 1269 * @flags: flags to change filter behavior 1270 * @filter: struct sock_fprog containing filter 1271 * 1272 * This function may be called repeatedly to install additional filters. 1273 * Every filter successfully installed will be evaluated (in reverse order) 1274 * for each system call the task makes. 1275 * 1276 * Once current->seccomp.mode is non-zero, it may not be changed. 1277 * 1278 * Returns 0 on success or -EINVAL on failure. 1279 */ 1280 static long seccomp_set_mode_filter(unsigned int flags, 1281 const char __user *filter) 1282 { 1283 const unsigned long seccomp_mode = SECCOMP_MODE_FILTER; 1284 struct seccomp_filter *prepared = NULL; 1285 long ret = -EINVAL; 1286 int listener = -1; 1287 struct file *listener_f = NULL; 1288 1289 /* Validate flags. */ 1290 if (flags & ~SECCOMP_FILTER_FLAG_MASK) 1291 return -EINVAL; 1292 1293 /* 1294 * In the successful case, NEW_LISTENER returns the new listener fd. 1295 * But in the failure case, TSYNC returns the thread that died. If you 1296 * combine these two flags, there's no way to tell whether something 1297 * succeeded or failed. So, let's disallow this combination if the user 1298 * has not explicitly requested no errors from TSYNC. 1299 */ 1300 if ((flags & SECCOMP_FILTER_FLAG_TSYNC) && 1301 (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) && 1302 ((flags & SECCOMP_FILTER_FLAG_TSYNC_ESRCH) == 0)) 1303 return -EINVAL; 1304 1305 /* Prepare the new filter before holding any locks. */ 1306 prepared = seccomp_prepare_user_filter(filter); 1307 if (IS_ERR(prepared)) 1308 return PTR_ERR(prepared); 1309 1310 if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) { 1311 listener = get_unused_fd_flags(O_CLOEXEC); 1312 if (listener < 0) { 1313 ret = listener; 1314 goto out_free; 1315 } 1316 1317 listener_f = init_listener(prepared); 1318 if (IS_ERR(listener_f)) { 1319 put_unused_fd(listener); 1320 ret = PTR_ERR(listener_f); 1321 goto out_free; 1322 } 1323 } 1324 1325 /* 1326 * Make sure we cannot change seccomp or nnp state via TSYNC 1327 * while another thread is in the middle of calling exec. 1328 */ 1329 if (flags & SECCOMP_FILTER_FLAG_TSYNC && 1330 mutex_lock_killable(¤t->signal->cred_guard_mutex)) 1331 goto out_put_fd; 1332 1333 spin_lock_irq(¤t->sighand->siglock); 1334 1335 if (!seccomp_may_assign_mode(seccomp_mode)) 1336 goto out; 1337 1338 ret = seccomp_attach_filter(flags, prepared); 1339 if (ret) 1340 goto out; 1341 /* Do not free the successfully attached filter. */ 1342 prepared = NULL; 1343 1344 seccomp_assign_mode(current, seccomp_mode, flags); 1345 out: 1346 spin_unlock_irq(¤t->sighand->siglock); 1347 if (flags & SECCOMP_FILTER_FLAG_TSYNC) 1348 mutex_unlock(¤t->signal->cred_guard_mutex); 1349 out_put_fd: 1350 if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) { 1351 if (ret) { 1352 listener_f->private_data = NULL; 1353 fput(listener_f); 1354 put_unused_fd(listener); 1355 } else { 1356 fd_install(listener, listener_f); 1357 ret = listener; 1358 } 1359 } 1360 out_free: 1361 seccomp_filter_free(prepared); 1362 return ret; 1363 } 1364 #else 1365 static inline long seccomp_set_mode_filter(unsigned int flags, 1366 const char __user *filter) 1367 { 1368 return -EINVAL; 1369 } 1370 #endif 1371 1372 static long seccomp_get_action_avail(const char __user *uaction) 1373 { 1374 u32 action; 1375 1376 if (copy_from_user(&action, uaction, sizeof(action))) 1377 return -EFAULT; 1378 1379 switch (action) { 1380 case SECCOMP_RET_KILL_PROCESS: 1381 case SECCOMP_RET_KILL_THREAD: 1382 case SECCOMP_RET_TRAP: 1383 case SECCOMP_RET_ERRNO: 1384 case SECCOMP_RET_USER_NOTIF: 1385 case SECCOMP_RET_TRACE: 1386 case SECCOMP_RET_LOG: 1387 case SECCOMP_RET_ALLOW: 1388 break; 1389 default: 1390 return -EOPNOTSUPP; 1391 } 1392 1393 return 0; 1394 } 1395 1396 static long seccomp_get_notif_sizes(void __user *usizes) 1397 { 1398 struct seccomp_notif_sizes sizes = { 1399 .seccomp_notif = sizeof(struct seccomp_notif), 1400 .seccomp_notif_resp = sizeof(struct seccomp_notif_resp), 1401 .seccomp_data = sizeof(struct seccomp_data), 1402 }; 1403 1404 if (copy_to_user(usizes, &sizes, sizeof(sizes))) 1405 return -EFAULT; 1406 1407 return 0; 1408 } 1409 1410 /* Common entry point for both prctl and syscall. */ 1411 static long do_seccomp(unsigned int op, unsigned int flags, 1412 void __user *uargs) 1413 { 1414 switch (op) { 1415 case SECCOMP_SET_MODE_STRICT: 1416 if (flags != 0 || uargs != NULL) 1417 return -EINVAL; 1418 return seccomp_set_mode_strict(); 1419 case SECCOMP_SET_MODE_FILTER: 1420 return seccomp_set_mode_filter(flags, uargs); 1421 case SECCOMP_GET_ACTION_AVAIL: 1422 if (flags != 0) 1423 return -EINVAL; 1424 1425 return seccomp_get_action_avail(uargs); 1426 case SECCOMP_GET_NOTIF_SIZES: 1427 if (flags != 0) 1428 return -EINVAL; 1429 1430 return seccomp_get_notif_sizes(uargs); 1431 default: 1432 return -EINVAL; 1433 } 1434 } 1435 1436 SYSCALL_DEFINE3(seccomp, unsigned int, op, unsigned int, flags, 1437 void __user *, uargs) 1438 { 1439 return do_seccomp(op, flags, uargs); 1440 } 1441 1442 /** 1443 * prctl_set_seccomp: configures current->seccomp.mode 1444 * @seccomp_mode: requested mode to use 1445 * @filter: optional struct sock_fprog for use with SECCOMP_MODE_FILTER 1446 * 1447 * Returns 0 on success or -EINVAL on failure. 1448 */ 1449 long prctl_set_seccomp(unsigned long seccomp_mode, void __user *filter) 1450 { 1451 unsigned int op; 1452 void __user *uargs; 1453 1454 switch (seccomp_mode) { 1455 case SECCOMP_MODE_STRICT: 1456 op = SECCOMP_SET_MODE_STRICT; 1457 /* 1458 * Setting strict mode through prctl always ignored filter, 1459 * so make sure it is always NULL here to pass the internal 1460 * check in do_seccomp(). 1461 */ 1462 uargs = NULL; 1463 break; 1464 case SECCOMP_MODE_FILTER: 1465 op = SECCOMP_SET_MODE_FILTER; 1466 uargs = filter; 1467 break; 1468 default: 1469 return -EINVAL; 1470 } 1471 1472 /* prctl interface doesn't have flags, so they are always zero. */ 1473 return do_seccomp(op, 0, uargs); 1474 } 1475 1476 #if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE) 1477 static struct seccomp_filter *get_nth_filter(struct task_struct *task, 1478 unsigned long filter_off) 1479 { 1480 struct seccomp_filter *orig, *filter; 1481 unsigned long count; 1482 1483 /* 1484 * Note: this is only correct because the caller should be the (ptrace) 1485 * tracer of the task, otherwise lock_task_sighand is needed. 1486 */ 1487 spin_lock_irq(&task->sighand->siglock); 1488 1489 if (task->seccomp.mode != SECCOMP_MODE_FILTER) { 1490 spin_unlock_irq(&task->sighand->siglock); 1491 return ERR_PTR(-EINVAL); 1492 } 1493 1494 orig = task->seccomp.filter; 1495 __get_seccomp_filter(orig); 1496 spin_unlock_irq(&task->sighand->siglock); 1497 1498 count = 0; 1499 for (filter = orig; filter; filter = filter->prev) 1500 count++; 1501 1502 if (filter_off >= count) { 1503 filter = ERR_PTR(-ENOENT); 1504 goto out; 1505 } 1506 1507 count -= filter_off; 1508 for (filter = orig; filter && count > 1; filter = filter->prev) 1509 count--; 1510 1511 if (WARN_ON(count != 1 || !filter)) { 1512 filter = ERR_PTR(-ENOENT); 1513 goto out; 1514 } 1515 1516 __get_seccomp_filter(filter); 1517 1518 out: 1519 __put_seccomp_filter(orig); 1520 return filter; 1521 } 1522 1523 long seccomp_get_filter(struct task_struct *task, unsigned long filter_off, 1524 void __user *data) 1525 { 1526 struct seccomp_filter *filter; 1527 struct sock_fprog_kern *fprog; 1528 long ret; 1529 1530 if (!capable(CAP_SYS_ADMIN) || 1531 current->seccomp.mode != SECCOMP_MODE_DISABLED) { 1532 return -EACCES; 1533 } 1534 1535 filter = get_nth_filter(task, filter_off); 1536 if (IS_ERR(filter)) 1537 return PTR_ERR(filter); 1538 1539 fprog = filter->prog->orig_prog; 1540 if (!fprog) { 1541 /* This must be a new non-cBPF filter, since we save 1542 * every cBPF filter's orig_prog above when 1543 * CONFIG_CHECKPOINT_RESTORE is enabled. 1544 */ 1545 ret = -EMEDIUMTYPE; 1546 goto out; 1547 } 1548 1549 ret = fprog->len; 1550 if (!data) 1551 goto out; 1552 1553 if (copy_to_user(data, fprog->filter, bpf_classic_proglen(fprog))) 1554 ret = -EFAULT; 1555 1556 out: 1557 __put_seccomp_filter(filter); 1558 return ret; 1559 } 1560 1561 long seccomp_get_metadata(struct task_struct *task, 1562 unsigned long size, void __user *data) 1563 { 1564 long ret; 1565 struct seccomp_filter *filter; 1566 struct seccomp_metadata kmd = {}; 1567 1568 if (!capable(CAP_SYS_ADMIN) || 1569 current->seccomp.mode != SECCOMP_MODE_DISABLED) { 1570 return -EACCES; 1571 } 1572 1573 size = min_t(unsigned long, size, sizeof(kmd)); 1574 1575 if (size < sizeof(kmd.filter_off)) 1576 return -EINVAL; 1577 1578 if (copy_from_user(&kmd.filter_off, data, sizeof(kmd.filter_off))) 1579 return -EFAULT; 1580 1581 filter = get_nth_filter(task, kmd.filter_off); 1582 if (IS_ERR(filter)) 1583 return PTR_ERR(filter); 1584 1585 if (filter->log) 1586 kmd.flags |= SECCOMP_FILTER_FLAG_LOG; 1587 1588 ret = size; 1589 if (copy_to_user(data, &kmd, size)) 1590 ret = -EFAULT; 1591 1592 __put_seccomp_filter(filter); 1593 return ret; 1594 } 1595 #endif 1596 1597 #ifdef CONFIG_SYSCTL 1598 1599 /* Human readable action names for friendly sysctl interaction */ 1600 #define SECCOMP_RET_KILL_PROCESS_NAME "kill_process" 1601 #define SECCOMP_RET_KILL_THREAD_NAME "kill_thread" 1602 #define SECCOMP_RET_TRAP_NAME "trap" 1603 #define SECCOMP_RET_ERRNO_NAME "errno" 1604 #define SECCOMP_RET_USER_NOTIF_NAME "user_notif" 1605 #define SECCOMP_RET_TRACE_NAME "trace" 1606 #define SECCOMP_RET_LOG_NAME "log" 1607 #define SECCOMP_RET_ALLOW_NAME "allow" 1608 1609 static const char seccomp_actions_avail[] = 1610 SECCOMP_RET_KILL_PROCESS_NAME " " 1611 SECCOMP_RET_KILL_THREAD_NAME " " 1612 SECCOMP_RET_TRAP_NAME " " 1613 SECCOMP_RET_ERRNO_NAME " " 1614 SECCOMP_RET_USER_NOTIF_NAME " " 1615 SECCOMP_RET_TRACE_NAME " " 1616 SECCOMP_RET_LOG_NAME " " 1617 SECCOMP_RET_ALLOW_NAME; 1618 1619 struct seccomp_log_name { 1620 u32 log; 1621 const char *name; 1622 }; 1623 1624 static const struct seccomp_log_name seccomp_log_names[] = { 1625 { SECCOMP_LOG_KILL_PROCESS, SECCOMP_RET_KILL_PROCESS_NAME }, 1626 { SECCOMP_LOG_KILL_THREAD, SECCOMP_RET_KILL_THREAD_NAME }, 1627 { SECCOMP_LOG_TRAP, SECCOMP_RET_TRAP_NAME }, 1628 { SECCOMP_LOG_ERRNO, SECCOMP_RET_ERRNO_NAME }, 1629 { SECCOMP_LOG_USER_NOTIF, SECCOMP_RET_USER_NOTIF_NAME }, 1630 { SECCOMP_LOG_TRACE, SECCOMP_RET_TRACE_NAME }, 1631 { SECCOMP_LOG_LOG, SECCOMP_RET_LOG_NAME }, 1632 { SECCOMP_LOG_ALLOW, SECCOMP_RET_ALLOW_NAME }, 1633 { } 1634 }; 1635 1636 static bool seccomp_names_from_actions_logged(char *names, size_t size, 1637 u32 actions_logged, 1638 const char *sep) 1639 { 1640 const struct seccomp_log_name *cur; 1641 bool append_sep = false; 1642 1643 for (cur = seccomp_log_names; cur->name && size; cur++) { 1644 ssize_t ret; 1645 1646 if (!(actions_logged & cur->log)) 1647 continue; 1648 1649 if (append_sep) { 1650 ret = strscpy(names, sep, size); 1651 if (ret < 0) 1652 return false; 1653 1654 names += ret; 1655 size -= ret; 1656 } else 1657 append_sep = true; 1658 1659 ret = strscpy(names, cur->name, size); 1660 if (ret < 0) 1661 return false; 1662 1663 names += ret; 1664 size -= ret; 1665 } 1666 1667 return true; 1668 } 1669 1670 static bool seccomp_action_logged_from_name(u32 *action_logged, 1671 const char *name) 1672 { 1673 const struct seccomp_log_name *cur; 1674 1675 for (cur = seccomp_log_names; cur->name; cur++) { 1676 if (!strcmp(cur->name, name)) { 1677 *action_logged = cur->log; 1678 return true; 1679 } 1680 } 1681 1682 return false; 1683 } 1684 1685 static bool seccomp_actions_logged_from_names(u32 *actions_logged, char *names) 1686 { 1687 char *name; 1688 1689 *actions_logged = 0; 1690 while ((name = strsep(&names, " ")) && *name) { 1691 u32 action_logged = 0; 1692 1693 if (!seccomp_action_logged_from_name(&action_logged, name)) 1694 return false; 1695 1696 *actions_logged |= action_logged; 1697 } 1698 1699 return true; 1700 } 1701 1702 static int read_actions_logged(struct ctl_table *ro_table, void __user *buffer, 1703 size_t *lenp, loff_t *ppos) 1704 { 1705 char names[sizeof(seccomp_actions_avail)]; 1706 struct ctl_table table; 1707 1708 memset(names, 0, sizeof(names)); 1709 1710 if (!seccomp_names_from_actions_logged(names, sizeof(names), 1711 seccomp_actions_logged, " ")) 1712 return -EINVAL; 1713 1714 table = *ro_table; 1715 table.data = names; 1716 table.maxlen = sizeof(names); 1717 return proc_dostring(&table, 0, buffer, lenp, ppos); 1718 } 1719 1720 static int write_actions_logged(struct ctl_table *ro_table, void __user *buffer, 1721 size_t *lenp, loff_t *ppos, u32 *actions_logged) 1722 { 1723 char names[sizeof(seccomp_actions_avail)]; 1724 struct ctl_table table; 1725 int ret; 1726 1727 if (!capable(CAP_SYS_ADMIN)) 1728 return -EPERM; 1729 1730 memset(names, 0, sizeof(names)); 1731 1732 table = *ro_table; 1733 table.data = names; 1734 table.maxlen = sizeof(names); 1735 ret = proc_dostring(&table, 1, buffer, lenp, ppos); 1736 if (ret) 1737 return ret; 1738 1739 if (!seccomp_actions_logged_from_names(actions_logged, table.data)) 1740 return -EINVAL; 1741 1742 if (*actions_logged & SECCOMP_LOG_ALLOW) 1743 return -EINVAL; 1744 1745 seccomp_actions_logged = *actions_logged; 1746 return 0; 1747 } 1748 1749 static void audit_actions_logged(u32 actions_logged, u32 old_actions_logged, 1750 int ret) 1751 { 1752 char names[sizeof(seccomp_actions_avail)]; 1753 char old_names[sizeof(seccomp_actions_avail)]; 1754 const char *new = names; 1755 const char *old = old_names; 1756 1757 if (!audit_enabled) 1758 return; 1759 1760 memset(names, 0, sizeof(names)); 1761 memset(old_names, 0, sizeof(old_names)); 1762 1763 if (ret) 1764 new = "?"; 1765 else if (!actions_logged) 1766 new = "(none)"; 1767 else if (!seccomp_names_from_actions_logged(names, sizeof(names), 1768 actions_logged, ",")) 1769 new = "?"; 1770 1771 if (!old_actions_logged) 1772 old = "(none)"; 1773 else if (!seccomp_names_from_actions_logged(old_names, 1774 sizeof(old_names), 1775 old_actions_logged, ",")) 1776 old = "?"; 1777 1778 return audit_seccomp_actions_logged(new, old, !ret); 1779 } 1780 1781 static int seccomp_actions_logged_handler(struct ctl_table *ro_table, int write, 1782 void *buffer, size_t *lenp, 1783 loff_t *ppos) 1784 { 1785 int ret; 1786 1787 if (write) { 1788 u32 actions_logged = 0; 1789 u32 old_actions_logged = seccomp_actions_logged; 1790 1791 ret = write_actions_logged(ro_table, buffer, lenp, ppos, 1792 &actions_logged); 1793 audit_actions_logged(actions_logged, old_actions_logged, ret); 1794 } else 1795 ret = read_actions_logged(ro_table, buffer, lenp, ppos); 1796 1797 return ret; 1798 } 1799 1800 static struct ctl_path seccomp_sysctl_path[] = { 1801 { .procname = "kernel", }, 1802 { .procname = "seccomp", }, 1803 { } 1804 }; 1805 1806 static struct ctl_table seccomp_sysctl_table[] = { 1807 { 1808 .procname = "actions_avail", 1809 .data = (void *) &seccomp_actions_avail, 1810 .maxlen = sizeof(seccomp_actions_avail), 1811 .mode = 0444, 1812 .proc_handler = proc_dostring, 1813 }, 1814 { 1815 .procname = "actions_logged", 1816 .mode = 0644, 1817 .proc_handler = seccomp_actions_logged_handler, 1818 }, 1819 { } 1820 }; 1821 1822 static int __init seccomp_sysctl_init(void) 1823 { 1824 struct ctl_table_header *hdr; 1825 1826 hdr = register_sysctl_paths(seccomp_sysctl_path, seccomp_sysctl_table); 1827 if (!hdr) 1828 pr_warn("seccomp: sysctl registration failed\n"); 1829 else 1830 kmemleak_not_leak(hdr); 1831 1832 return 0; 1833 } 1834 1835 device_initcall(seccomp_sysctl_init) 1836 1837 #endif /* CONFIG_SYSCTL */ 1838