1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * linux/kernel/seccomp.c 4 * 5 * Copyright 2004-2005 Andrea Arcangeli <andrea@cpushare.com> 6 * 7 * Copyright (C) 2012 Google, Inc. 8 * Will Drewry <wad@chromium.org> 9 * 10 * This defines a simple but solid secure-computing facility. 11 * 12 * Mode 1 uses a fixed list of allowed system calls. 13 * Mode 2 allows user-defined system call filters in the form 14 * of Berkeley Packet Filters/Linux Socket Filters. 15 */ 16 #define pr_fmt(fmt) "seccomp: " fmt 17 18 #include <linux/refcount.h> 19 #include <linux/audit.h> 20 #include <linux/compat.h> 21 #include <linux/coredump.h> 22 #include <linux/kmemleak.h> 23 #include <linux/nospec.h> 24 #include <linux/prctl.h> 25 #include <linux/sched.h> 26 #include <linux/sched/task_stack.h> 27 #include <linux/seccomp.h> 28 #include <linux/slab.h> 29 #include <linux/syscalls.h> 30 #include <linux/sysctl.h> 31 32 #include <asm/syscall.h> 33 34 /* Not exposed in headers: strictly internal use only. */ 35 #define SECCOMP_MODE_DEAD (SECCOMP_MODE_FILTER + 1) 36 37 #ifdef CONFIG_SECCOMP_FILTER 38 #include <linux/file.h> 39 #include <linux/filter.h> 40 #include <linux/pid.h> 41 #include <linux/ptrace.h> 42 #include <linux/capability.h> 43 #include <linux/uaccess.h> 44 #include <linux/anon_inodes.h> 45 #include <linux/lockdep.h> 46 47 /* 48 * When SECCOMP_IOCTL_NOTIF_ID_VALID was first introduced, it had the 49 * wrong direction flag in the ioctl number. This is the broken one, 50 * which the kernel needs to keep supporting until all userspaces stop 51 * using the wrong command number. 52 */ 53 #define SECCOMP_IOCTL_NOTIF_ID_VALID_WRONG_DIR SECCOMP_IOR(2, __u64) 54 55 enum notify_state { 56 SECCOMP_NOTIFY_INIT, 57 SECCOMP_NOTIFY_SENT, 58 SECCOMP_NOTIFY_REPLIED, 59 }; 60 61 struct seccomp_knotif { 62 /* The struct pid of the task whose filter triggered the notification */ 63 struct task_struct *task; 64 65 /* The "cookie" for this request; this is unique for this filter. */ 66 u64 id; 67 68 /* 69 * The seccomp data. This pointer is valid the entire time this 70 * notification is active, since it comes from __seccomp_filter which 71 * eclipses the entire lifecycle here. 72 */ 73 const struct seccomp_data *data; 74 75 /* 76 * Notification states. When SECCOMP_RET_USER_NOTIF is returned, a 77 * struct seccomp_knotif is created and starts out in INIT. Once the 78 * handler reads the notification off of an FD, it transitions to SENT. 79 * If a signal is received the state transitions back to INIT and 80 * another message is sent. When the userspace handler replies, state 81 * transitions to REPLIED. 82 */ 83 enum notify_state state; 84 85 /* The return values, only valid when in SECCOMP_NOTIFY_REPLIED */ 86 int error; 87 long val; 88 u32 flags; 89 90 /* 91 * Signals when this has changed states, such as the listener 92 * dying, a new seccomp addfd message, or changing to REPLIED 93 */ 94 struct completion ready; 95 96 struct list_head list; 97 98 /* outstanding addfd requests */ 99 struct list_head addfd; 100 }; 101 102 /** 103 * struct seccomp_kaddfd - container for seccomp_addfd ioctl messages 104 * 105 * @file: A reference to the file to install in the other task 106 * @fd: The fd number to install it at. If the fd number is -1, it means the 107 * installing process should allocate the fd as normal. 108 * @flags: The flags for the new file descriptor. At the moment, only O_CLOEXEC 109 * is allowed. 110 * @ioctl_flags: The flags used for the seccomp_addfd ioctl. 111 * @setfd: whether or not SECCOMP_ADDFD_FLAG_SETFD was set during notify_addfd 112 * @ret: The return value of the installing process. It is set to the fd num 113 * upon success (>= 0). 114 * @completion: Indicates that the installing process has completed fd 115 * installation, or gone away (either due to successful 116 * reply, or signal) 117 * @list: list_head for chaining seccomp_kaddfd together. 118 * 119 */ 120 struct seccomp_kaddfd { 121 struct file *file; 122 int fd; 123 unsigned int flags; 124 __u32 ioctl_flags; 125 126 union { 127 bool setfd; 128 /* To only be set on reply */ 129 int ret; 130 }; 131 struct completion completion; 132 struct list_head list; 133 }; 134 135 /** 136 * struct notification - container for seccomp userspace notifications. Since 137 * most seccomp filters will not have notification listeners attached and this 138 * structure is fairly large, we store the notification-specific stuff in a 139 * separate structure. 140 * 141 * @requests: A semaphore that users of this notification can wait on for 142 * changes. Actual reads and writes are still controlled with 143 * filter->notify_lock. 144 * @flags: A set of SECCOMP_USER_NOTIF_FD_* flags. 145 * @next_id: The id of the next request. 146 * @notifications: A list of struct seccomp_knotif elements. 147 */ 148 149 struct notification { 150 atomic_t requests; 151 u32 flags; 152 u64 next_id; 153 struct list_head notifications; 154 }; 155 156 #ifdef SECCOMP_ARCH_NATIVE 157 /** 158 * struct action_cache - per-filter cache of seccomp actions per 159 * arch/syscall pair 160 * 161 * @allow_native: A bitmap where each bit represents whether the 162 * filter will always allow the syscall, for the 163 * native architecture. 164 * @allow_compat: A bitmap where each bit represents whether the 165 * filter will always allow the syscall, for the 166 * compat architecture. 167 */ 168 struct action_cache { 169 DECLARE_BITMAP(allow_native, SECCOMP_ARCH_NATIVE_NR); 170 #ifdef SECCOMP_ARCH_COMPAT 171 DECLARE_BITMAP(allow_compat, SECCOMP_ARCH_COMPAT_NR); 172 #endif 173 }; 174 #else 175 struct action_cache { }; 176 177 static inline bool seccomp_cache_check_allow(const struct seccomp_filter *sfilter, 178 const struct seccomp_data *sd) 179 { 180 return false; 181 } 182 183 static inline void seccomp_cache_prepare(struct seccomp_filter *sfilter) 184 { 185 } 186 #endif /* SECCOMP_ARCH_NATIVE */ 187 188 /** 189 * struct seccomp_filter - container for seccomp BPF programs 190 * 191 * @refs: Reference count to manage the object lifetime. 192 * A filter's reference count is incremented for each directly 193 * attached task, once for the dependent filter, and if 194 * requested for the user notifier. When @refs reaches zero, 195 * the filter can be freed. 196 * @users: A filter's @users count is incremented for each directly 197 * attached task (filter installation, fork(), thread_sync), 198 * and once for the dependent filter (tracked in filter->prev). 199 * When it reaches zero it indicates that no direct or indirect 200 * users of that filter exist. No new tasks can get associated with 201 * this filter after reaching 0. The @users count is always smaller 202 * or equal to @refs. Hence, reaching 0 for @users does not mean 203 * the filter can be freed. 204 * @cache: cache of arch/syscall mappings to actions 205 * @log: true if all actions except for SECCOMP_RET_ALLOW should be logged 206 * @wait_killable_recv: Put notifying process in killable state once the 207 * notification is received by the userspace listener. 208 * @prev: points to a previously installed, or inherited, filter 209 * @prog: the BPF program to evaluate 210 * @notif: the struct that holds all notification related information 211 * @notify_lock: A lock for all notification-related accesses. 212 * @wqh: A wait queue for poll if a notifier is in use. 213 * 214 * seccomp_filter objects are organized in a tree linked via the @prev 215 * pointer. For any task, it appears to be a singly-linked list starting 216 * with current->seccomp.filter, the most recently attached or inherited filter. 217 * However, multiple filters may share a @prev node, by way of fork(), which 218 * results in a unidirectional tree existing in memory. This is similar to 219 * how namespaces work. 220 * 221 * seccomp_filter objects should never be modified after being attached 222 * to a task_struct (other than @refs). 223 */ 224 struct seccomp_filter { 225 refcount_t refs; 226 refcount_t users; 227 bool log; 228 bool wait_killable_recv; 229 struct action_cache cache; 230 struct seccomp_filter *prev; 231 struct bpf_prog *prog; 232 struct notification *notif; 233 struct mutex notify_lock; 234 wait_queue_head_t wqh; 235 }; 236 237 /* Limit any path through the tree to 256KB worth of instructions. */ 238 #define MAX_INSNS_PER_PATH ((1 << 18) / sizeof(struct sock_filter)) 239 240 /* 241 * Endianness is explicitly ignored and left for BPF program authors to manage 242 * as per the specific architecture. 243 */ 244 static void populate_seccomp_data(struct seccomp_data *sd) 245 { 246 /* 247 * Instead of using current_pt_reg(), we're already doing the work 248 * to safely fetch "current", so just use "task" everywhere below. 249 */ 250 struct task_struct *task = current; 251 struct pt_regs *regs = task_pt_regs(task); 252 unsigned long args[6]; 253 254 sd->nr = syscall_get_nr(task, regs); 255 sd->arch = syscall_get_arch(task); 256 syscall_get_arguments(task, regs, args); 257 sd->args[0] = args[0]; 258 sd->args[1] = args[1]; 259 sd->args[2] = args[2]; 260 sd->args[3] = args[3]; 261 sd->args[4] = args[4]; 262 sd->args[5] = args[5]; 263 sd->instruction_pointer = KSTK_EIP(task); 264 } 265 266 /** 267 * seccomp_check_filter - verify seccomp filter code 268 * @filter: filter to verify 269 * @flen: length of filter 270 * 271 * Takes a previously checked filter (by bpf_check_classic) and 272 * redirects all filter code that loads struct sk_buff data 273 * and related data through seccomp_bpf_load. It also 274 * enforces length and alignment checking of those loads. 275 * 276 * Returns 0 if the rule set is legal or -EINVAL if not. 277 */ 278 static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen) 279 { 280 int pc; 281 for (pc = 0; pc < flen; pc++) { 282 struct sock_filter *ftest = &filter[pc]; 283 u16 code = ftest->code; 284 u32 k = ftest->k; 285 286 switch (code) { 287 case BPF_LD | BPF_W | BPF_ABS: 288 ftest->code = BPF_LDX | BPF_W | BPF_ABS; 289 /* 32-bit aligned and not out of bounds. */ 290 if (k >= sizeof(struct seccomp_data) || k & 3) 291 return -EINVAL; 292 continue; 293 case BPF_LD | BPF_W | BPF_LEN: 294 ftest->code = BPF_LD | BPF_IMM; 295 ftest->k = sizeof(struct seccomp_data); 296 continue; 297 case BPF_LDX | BPF_W | BPF_LEN: 298 ftest->code = BPF_LDX | BPF_IMM; 299 ftest->k = sizeof(struct seccomp_data); 300 continue; 301 /* Explicitly include allowed calls. */ 302 case BPF_RET | BPF_K: 303 case BPF_RET | BPF_A: 304 case BPF_ALU | BPF_ADD | BPF_K: 305 case BPF_ALU | BPF_ADD | BPF_X: 306 case BPF_ALU | BPF_SUB | BPF_K: 307 case BPF_ALU | BPF_SUB | BPF_X: 308 case BPF_ALU | BPF_MUL | BPF_K: 309 case BPF_ALU | BPF_MUL | BPF_X: 310 case BPF_ALU | BPF_DIV | BPF_K: 311 case BPF_ALU | BPF_DIV | BPF_X: 312 case BPF_ALU | BPF_AND | BPF_K: 313 case BPF_ALU | BPF_AND | BPF_X: 314 case BPF_ALU | BPF_OR | BPF_K: 315 case BPF_ALU | BPF_OR | BPF_X: 316 case BPF_ALU | BPF_XOR | BPF_K: 317 case BPF_ALU | BPF_XOR | BPF_X: 318 case BPF_ALU | BPF_LSH | BPF_K: 319 case BPF_ALU | BPF_LSH | BPF_X: 320 case BPF_ALU | BPF_RSH | BPF_K: 321 case BPF_ALU | BPF_RSH | BPF_X: 322 case BPF_ALU | BPF_NEG: 323 case BPF_LD | BPF_IMM: 324 case BPF_LDX | BPF_IMM: 325 case BPF_MISC | BPF_TAX: 326 case BPF_MISC | BPF_TXA: 327 case BPF_LD | BPF_MEM: 328 case BPF_LDX | BPF_MEM: 329 case BPF_ST: 330 case BPF_STX: 331 case BPF_JMP | BPF_JA: 332 case BPF_JMP | BPF_JEQ | BPF_K: 333 case BPF_JMP | BPF_JEQ | BPF_X: 334 case BPF_JMP | BPF_JGE | BPF_K: 335 case BPF_JMP | BPF_JGE | BPF_X: 336 case BPF_JMP | BPF_JGT | BPF_K: 337 case BPF_JMP | BPF_JGT | BPF_X: 338 case BPF_JMP | BPF_JSET | BPF_K: 339 case BPF_JMP | BPF_JSET | BPF_X: 340 continue; 341 default: 342 return -EINVAL; 343 } 344 } 345 return 0; 346 } 347 348 #ifdef SECCOMP_ARCH_NATIVE 349 static inline bool seccomp_cache_check_allow_bitmap(const void *bitmap, 350 size_t bitmap_size, 351 int syscall_nr) 352 { 353 if (unlikely(syscall_nr < 0 || syscall_nr >= bitmap_size)) 354 return false; 355 syscall_nr = array_index_nospec(syscall_nr, bitmap_size); 356 357 return test_bit(syscall_nr, bitmap); 358 } 359 360 /** 361 * seccomp_cache_check_allow - lookup seccomp cache 362 * @sfilter: The seccomp filter 363 * @sd: The seccomp data to lookup the cache with 364 * 365 * Returns true if the seccomp_data is cached and allowed. 366 */ 367 static inline bool seccomp_cache_check_allow(const struct seccomp_filter *sfilter, 368 const struct seccomp_data *sd) 369 { 370 int syscall_nr = sd->nr; 371 const struct action_cache *cache = &sfilter->cache; 372 373 #ifndef SECCOMP_ARCH_COMPAT 374 /* A native-only architecture doesn't need to check sd->arch. */ 375 return seccomp_cache_check_allow_bitmap(cache->allow_native, 376 SECCOMP_ARCH_NATIVE_NR, 377 syscall_nr); 378 #else 379 if (likely(sd->arch == SECCOMP_ARCH_NATIVE)) 380 return seccomp_cache_check_allow_bitmap(cache->allow_native, 381 SECCOMP_ARCH_NATIVE_NR, 382 syscall_nr); 383 if (likely(sd->arch == SECCOMP_ARCH_COMPAT)) 384 return seccomp_cache_check_allow_bitmap(cache->allow_compat, 385 SECCOMP_ARCH_COMPAT_NR, 386 syscall_nr); 387 #endif /* SECCOMP_ARCH_COMPAT */ 388 389 WARN_ON_ONCE(true); 390 return false; 391 } 392 #endif /* SECCOMP_ARCH_NATIVE */ 393 394 #define ACTION_ONLY(ret) ((s32)((ret) & (SECCOMP_RET_ACTION_FULL))) 395 /** 396 * seccomp_run_filters - evaluates all seccomp filters against @sd 397 * @sd: optional seccomp data to be passed to filters 398 * @match: stores struct seccomp_filter that resulted in the return value, 399 * unless filter returned SECCOMP_RET_ALLOW, in which case it will 400 * be unchanged. 401 * 402 * Returns valid seccomp BPF response codes. 403 */ 404 static u32 seccomp_run_filters(const struct seccomp_data *sd, 405 struct seccomp_filter **match) 406 { 407 u32 ret = SECCOMP_RET_ALLOW; 408 /* Make sure cross-thread synced filter points somewhere sane. */ 409 struct seccomp_filter *f = 410 READ_ONCE(current->seccomp.filter); 411 412 /* Ensure unexpected behavior doesn't result in failing open. */ 413 if (WARN_ON(f == NULL)) 414 return SECCOMP_RET_KILL_PROCESS; 415 416 if (seccomp_cache_check_allow(f, sd)) 417 return SECCOMP_RET_ALLOW; 418 419 /* 420 * All filters in the list are evaluated and the lowest BPF return 421 * value always takes priority (ignoring the DATA). 422 */ 423 for (; f; f = f->prev) { 424 u32 cur_ret = bpf_prog_run_pin_on_cpu(f->prog, sd); 425 426 if (ACTION_ONLY(cur_ret) < ACTION_ONLY(ret)) { 427 ret = cur_ret; 428 *match = f; 429 } 430 } 431 return ret; 432 } 433 #endif /* CONFIG_SECCOMP_FILTER */ 434 435 static inline bool seccomp_may_assign_mode(unsigned long seccomp_mode) 436 { 437 assert_spin_locked(¤t->sighand->siglock); 438 439 if (current->seccomp.mode && current->seccomp.mode != seccomp_mode) 440 return false; 441 442 return true; 443 } 444 445 void __weak arch_seccomp_spec_mitigate(struct task_struct *task) { } 446 447 static inline void seccomp_assign_mode(struct task_struct *task, 448 unsigned long seccomp_mode, 449 unsigned long flags) 450 { 451 assert_spin_locked(&task->sighand->siglock); 452 453 task->seccomp.mode = seccomp_mode; 454 /* 455 * Make sure SYSCALL_WORK_SECCOMP cannot be set before the mode (and 456 * filter) is set. 457 */ 458 smp_mb__before_atomic(); 459 /* Assume default seccomp processes want spec flaw mitigation. */ 460 if ((flags & SECCOMP_FILTER_FLAG_SPEC_ALLOW) == 0) 461 arch_seccomp_spec_mitigate(task); 462 set_task_syscall_work(task, SECCOMP); 463 } 464 465 #ifdef CONFIG_SECCOMP_FILTER 466 /* Returns 1 if the parent is an ancestor of the child. */ 467 static int is_ancestor(struct seccomp_filter *parent, 468 struct seccomp_filter *child) 469 { 470 /* NULL is the root ancestor. */ 471 if (parent == NULL) 472 return 1; 473 for (; child; child = child->prev) 474 if (child == parent) 475 return 1; 476 return 0; 477 } 478 479 /** 480 * seccomp_can_sync_threads: checks if all threads can be synchronized 481 * 482 * Expects sighand and cred_guard_mutex locks to be held. 483 * 484 * Returns 0 on success, -ve on error, or the pid of a thread which was 485 * either not in the correct seccomp mode or did not have an ancestral 486 * seccomp filter. 487 */ 488 static inline pid_t seccomp_can_sync_threads(void) 489 { 490 struct task_struct *thread, *caller; 491 492 BUG_ON(!mutex_is_locked(¤t->signal->cred_guard_mutex)); 493 assert_spin_locked(¤t->sighand->siglock); 494 495 /* Validate all threads being eligible for synchronization. */ 496 caller = current; 497 for_each_thread(caller, thread) { 498 pid_t failed; 499 500 /* Skip current, since it is initiating the sync. */ 501 if (thread == caller) 502 continue; 503 /* Skip exited threads. */ 504 if (thread->flags & PF_EXITING) 505 continue; 506 507 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED || 508 (thread->seccomp.mode == SECCOMP_MODE_FILTER && 509 is_ancestor(thread->seccomp.filter, 510 caller->seccomp.filter))) 511 continue; 512 513 /* Return the first thread that cannot be synchronized. */ 514 failed = task_pid_vnr(thread); 515 /* If the pid cannot be resolved, then return -ESRCH */ 516 if (WARN_ON(failed == 0)) 517 failed = -ESRCH; 518 return failed; 519 } 520 521 return 0; 522 } 523 524 static inline void seccomp_filter_free(struct seccomp_filter *filter) 525 { 526 if (filter) { 527 bpf_prog_destroy(filter->prog); 528 kfree(filter); 529 } 530 } 531 532 static void __seccomp_filter_orphan(struct seccomp_filter *orig) 533 { 534 while (orig && refcount_dec_and_test(&orig->users)) { 535 if (waitqueue_active(&orig->wqh)) 536 wake_up_poll(&orig->wqh, EPOLLHUP); 537 orig = orig->prev; 538 } 539 } 540 541 static void __put_seccomp_filter(struct seccomp_filter *orig) 542 { 543 /* Clean up single-reference branches iteratively. */ 544 while (orig && refcount_dec_and_test(&orig->refs)) { 545 struct seccomp_filter *freeme = orig; 546 orig = orig->prev; 547 seccomp_filter_free(freeme); 548 } 549 } 550 551 static void __seccomp_filter_release(struct seccomp_filter *orig) 552 { 553 /* Notify about any unused filters in the task's former filter tree. */ 554 __seccomp_filter_orphan(orig); 555 /* Finally drop all references to the task's former tree. */ 556 __put_seccomp_filter(orig); 557 } 558 559 /** 560 * seccomp_filter_release - Detach the task from its filter tree, 561 * drop its reference count, and notify 562 * about unused filters 563 * 564 * @tsk: task the filter should be released from. 565 * 566 * This function should only be called when the task is exiting as 567 * it detaches it from its filter tree. PF_EXITING has to be set 568 * for the task. 569 */ 570 void seccomp_filter_release(struct task_struct *tsk) 571 { 572 struct seccomp_filter *orig; 573 574 if (WARN_ON((tsk->flags & PF_EXITING) == 0)) 575 return; 576 577 if (READ_ONCE(tsk->seccomp.filter) == NULL) 578 return; 579 580 spin_lock_irq(&tsk->sighand->siglock); 581 orig = tsk->seccomp.filter; 582 /* Detach task from its filter tree. */ 583 tsk->seccomp.filter = NULL; 584 spin_unlock_irq(&tsk->sighand->siglock); 585 __seccomp_filter_release(orig); 586 } 587 588 /** 589 * seccomp_sync_threads: sets all threads to use current's filter 590 * 591 * @flags: SECCOMP_FILTER_FLAG_* flags to set during sync. 592 * 593 * Expects sighand and cred_guard_mutex locks to be held, and for 594 * seccomp_can_sync_threads() to have returned success already 595 * without dropping the locks. 596 * 597 */ 598 static inline void seccomp_sync_threads(unsigned long flags) 599 { 600 struct task_struct *thread, *caller; 601 602 BUG_ON(!mutex_is_locked(¤t->signal->cred_guard_mutex)); 603 assert_spin_locked(¤t->sighand->siglock); 604 605 /* 606 * Don't touch any of the threads if the process is being killed. 607 * This allows for a lockless check in seccomp_filter_release. 608 */ 609 if (current->signal->flags & SIGNAL_GROUP_EXIT) 610 return; 611 612 /* Synchronize all threads. */ 613 caller = current; 614 for_each_thread(caller, thread) { 615 /* Skip current, since it needs no changes. */ 616 if (thread == caller) 617 continue; 618 619 /* 620 * Skip exited threads. seccomp_filter_release could have 621 * been already called for this task. 622 */ 623 if (thread->flags & PF_EXITING) 624 continue; 625 626 /* Get a task reference for the new leaf node. */ 627 get_seccomp_filter(caller); 628 629 /* 630 * Drop the task reference to the shared ancestor since 631 * current's path will hold a reference. (This also 632 * allows a put before the assignment.) 633 */ 634 __seccomp_filter_release(thread->seccomp.filter); 635 636 /* Make our new filter tree visible. */ 637 smp_store_release(&thread->seccomp.filter, 638 caller->seccomp.filter); 639 atomic_set(&thread->seccomp.filter_count, 640 atomic_read(&caller->seccomp.filter_count)); 641 642 /* 643 * Don't let an unprivileged task work around 644 * the no_new_privs restriction by creating 645 * a thread that sets it up, enters seccomp, 646 * then dies. 647 */ 648 if (task_no_new_privs(caller)) 649 task_set_no_new_privs(thread); 650 651 /* 652 * Opt the other thread into seccomp if needed. 653 * As threads are considered to be trust-realm 654 * equivalent (see ptrace_may_access), it is safe to 655 * allow one thread to transition the other. 656 */ 657 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED) 658 seccomp_assign_mode(thread, SECCOMP_MODE_FILTER, 659 flags); 660 } 661 } 662 663 /** 664 * seccomp_prepare_filter: Prepares a seccomp filter for use. 665 * @fprog: BPF program to install 666 * 667 * Returns filter on success or an ERR_PTR on failure. 668 */ 669 static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog) 670 { 671 struct seccomp_filter *sfilter; 672 int ret; 673 const bool save_orig = 674 #if defined(CONFIG_CHECKPOINT_RESTORE) || defined(SECCOMP_ARCH_NATIVE) 675 true; 676 #else 677 false; 678 #endif 679 680 if (fprog->len == 0 || fprog->len > BPF_MAXINSNS) 681 return ERR_PTR(-EINVAL); 682 683 BUG_ON(INT_MAX / fprog->len < sizeof(struct sock_filter)); 684 685 /* 686 * Installing a seccomp filter requires that the task has 687 * CAP_SYS_ADMIN in its namespace or be running with no_new_privs. 688 * This avoids scenarios where unprivileged tasks can affect the 689 * behavior of privileged children. 690 */ 691 if (!task_no_new_privs(current) && 692 !ns_capable_noaudit(current_user_ns(), CAP_SYS_ADMIN)) 693 return ERR_PTR(-EACCES); 694 695 /* Allocate a new seccomp_filter */ 696 sfilter = kzalloc(sizeof(*sfilter), GFP_KERNEL | __GFP_NOWARN); 697 if (!sfilter) 698 return ERR_PTR(-ENOMEM); 699 700 mutex_init(&sfilter->notify_lock); 701 ret = bpf_prog_create_from_user(&sfilter->prog, fprog, 702 seccomp_check_filter, save_orig); 703 if (ret < 0) { 704 kfree(sfilter); 705 return ERR_PTR(ret); 706 } 707 708 refcount_set(&sfilter->refs, 1); 709 refcount_set(&sfilter->users, 1); 710 init_waitqueue_head(&sfilter->wqh); 711 712 return sfilter; 713 } 714 715 /** 716 * seccomp_prepare_user_filter - prepares a user-supplied sock_fprog 717 * @user_filter: pointer to the user data containing a sock_fprog. 718 * 719 * Returns 0 on success and non-zero otherwise. 720 */ 721 static struct seccomp_filter * 722 seccomp_prepare_user_filter(const char __user *user_filter) 723 { 724 struct sock_fprog fprog; 725 struct seccomp_filter *filter = ERR_PTR(-EFAULT); 726 727 #ifdef CONFIG_COMPAT 728 if (in_compat_syscall()) { 729 struct compat_sock_fprog fprog32; 730 if (copy_from_user(&fprog32, user_filter, sizeof(fprog32))) 731 goto out; 732 fprog.len = fprog32.len; 733 fprog.filter = compat_ptr(fprog32.filter); 734 } else /* falls through to the if below. */ 735 #endif 736 if (copy_from_user(&fprog, user_filter, sizeof(fprog))) 737 goto out; 738 filter = seccomp_prepare_filter(&fprog); 739 out: 740 return filter; 741 } 742 743 #ifdef SECCOMP_ARCH_NATIVE 744 static bool seccomp_uprobe_exception(struct seccomp_data *sd) 745 { 746 #if defined __NR_uretprobe || defined __NR_uprobe 747 #ifdef SECCOMP_ARCH_COMPAT 748 if (sd->arch == SECCOMP_ARCH_NATIVE) 749 #endif 750 { 751 #ifdef __NR_uretprobe 752 if (sd->nr == __NR_uretprobe) 753 return true; 754 #endif 755 #ifdef __NR_uprobe 756 if (sd->nr == __NR_uprobe) 757 return true; 758 #endif 759 } 760 #endif 761 return false; 762 } 763 764 /** 765 * seccomp_is_const_allow - check if filter is constant allow with given data 766 * @fprog: The BPF programs 767 * @sd: The seccomp data to check against, only syscall number and arch 768 * number are considered constant. 769 */ 770 static bool seccomp_is_const_allow(struct sock_fprog_kern *fprog, 771 struct seccomp_data *sd) 772 { 773 unsigned int reg_value = 0; 774 unsigned int pc; 775 bool op_res; 776 777 if (WARN_ON_ONCE(!fprog)) 778 return false; 779 780 /* Our single exception to filtering. */ 781 if (seccomp_uprobe_exception(sd)) 782 return true; 783 784 for (pc = 0; pc < fprog->len; pc++) { 785 struct sock_filter *insn = &fprog->filter[pc]; 786 u16 code = insn->code; 787 u32 k = insn->k; 788 789 switch (code) { 790 case BPF_LD | BPF_W | BPF_ABS: 791 switch (k) { 792 case offsetof(struct seccomp_data, nr): 793 reg_value = sd->nr; 794 break; 795 case offsetof(struct seccomp_data, arch): 796 reg_value = sd->arch; 797 break; 798 default: 799 /* can't optimize (non-constant value load) */ 800 return false; 801 } 802 break; 803 case BPF_RET | BPF_K: 804 /* reached return with constant values only, check allow */ 805 return k == SECCOMP_RET_ALLOW; 806 case BPF_JMP | BPF_JA: 807 pc += insn->k; 808 break; 809 case BPF_JMP | BPF_JEQ | BPF_K: 810 case BPF_JMP | BPF_JGE | BPF_K: 811 case BPF_JMP | BPF_JGT | BPF_K: 812 case BPF_JMP | BPF_JSET | BPF_K: 813 switch (BPF_OP(code)) { 814 case BPF_JEQ: 815 op_res = reg_value == k; 816 break; 817 case BPF_JGE: 818 op_res = reg_value >= k; 819 break; 820 case BPF_JGT: 821 op_res = reg_value > k; 822 break; 823 case BPF_JSET: 824 op_res = !!(reg_value & k); 825 break; 826 default: 827 /* can't optimize (unknown jump) */ 828 return false; 829 } 830 831 pc += op_res ? insn->jt : insn->jf; 832 break; 833 case BPF_ALU | BPF_AND | BPF_K: 834 reg_value &= k; 835 break; 836 default: 837 /* can't optimize (unknown insn) */ 838 return false; 839 } 840 } 841 842 /* ran off the end of the filter?! */ 843 WARN_ON(1); 844 return false; 845 } 846 847 static void seccomp_cache_prepare_bitmap(struct seccomp_filter *sfilter, 848 void *bitmap, const void *bitmap_prev, 849 size_t bitmap_size, int arch) 850 { 851 struct sock_fprog_kern *fprog = sfilter->prog->orig_prog; 852 struct seccomp_data sd; 853 int nr; 854 855 if (bitmap_prev) { 856 /* The new filter must be as restrictive as the last. */ 857 bitmap_copy(bitmap, bitmap_prev, bitmap_size); 858 } else { 859 /* Before any filters, all syscalls are always allowed. */ 860 bitmap_fill(bitmap, bitmap_size); 861 } 862 863 for (nr = 0; nr < bitmap_size; nr++) { 864 /* No bitmap change: not a cacheable action. */ 865 if (!test_bit(nr, bitmap)) 866 continue; 867 868 sd.nr = nr; 869 sd.arch = arch; 870 871 /* No bitmap change: continue to always allow. */ 872 if (seccomp_is_const_allow(fprog, &sd)) 873 continue; 874 875 /* 876 * Not a cacheable action: always run filters. 877 * atomic clear_bit() not needed, filter not visible yet. 878 */ 879 __clear_bit(nr, bitmap); 880 } 881 } 882 883 /** 884 * seccomp_cache_prepare - emulate the filter to find cacheable syscalls 885 * @sfilter: The seccomp filter 886 * 887 * Returns 0 if successful or -errno if error occurred. 888 */ 889 static void seccomp_cache_prepare(struct seccomp_filter *sfilter) 890 { 891 struct action_cache *cache = &sfilter->cache; 892 const struct action_cache *cache_prev = 893 sfilter->prev ? &sfilter->prev->cache : NULL; 894 895 seccomp_cache_prepare_bitmap(sfilter, cache->allow_native, 896 cache_prev ? cache_prev->allow_native : NULL, 897 SECCOMP_ARCH_NATIVE_NR, 898 SECCOMP_ARCH_NATIVE); 899 900 #ifdef SECCOMP_ARCH_COMPAT 901 seccomp_cache_prepare_bitmap(sfilter, cache->allow_compat, 902 cache_prev ? cache_prev->allow_compat : NULL, 903 SECCOMP_ARCH_COMPAT_NR, 904 SECCOMP_ARCH_COMPAT); 905 #endif /* SECCOMP_ARCH_COMPAT */ 906 } 907 #endif /* SECCOMP_ARCH_NATIVE */ 908 909 /** 910 * seccomp_attach_filter: validate and attach filter 911 * @flags: flags to change filter behavior 912 * @filter: seccomp filter to add to the current process 913 * 914 * Caller must be holding current->sighand->siglock lock. 915 * 916 * Returns 0 on success, -ve on error, or 917 * - in TSYNC mode: the pid of a thread which was either not in the correct 918 * seccomp mode or did not have an ancestral seccomp filter 919 * - in NEW_LISTENER mode: the fd of the new listener 920 */ 921 static long seccomp_attach_filter(unsigned int flags, 922 struct seccomp_filter *filter) 923 { 924 unsigned long total_insns; 925 struct seccomp_filter *walker; 926 927 assert_spin_locked(¤t->sighand->siglock); 928 929 /* Validate resulting filter length. */ 930 total_insns = filter->prog->len; 931 for (walker = current->seccomp.filter; walker; walker = walker->prev) 932 total_insns += walker->prog->len + 4; /* 4 instr penalty */ 933 if (total_insns > MAX_INSNS_PER_PATH) 934 return -ENOMEM; 935 936 /* If thread sync has been requested, check that it is possible. */ 937 if (flags & SECCOMP_FILTER_FLAG_TSYNC) { 938 int ret; 939 940 ret = seccomp_can_sync_threads(); 941 if (ret) { 942 if (flags & SECCOMP_FILTER_FLAG_TSYNC_ESRCH) 943 return -ESRCH; 944 else 945 return ret; 946 } 947 } 948 949 /* Set log flag, if present. */ 950 if (flags & SECCOMP_FILTER_FLAG_LOG) 951 filter->log = true; 952 953 /* Set wait killable flag, if present. */ 954 if (flags & SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV) 955 filter->wait_killable_recv = true; 956 957 /* 958 * If there is an existing filter, make it the prev and don't drop its 959 * task reference. 960 */ 961 filter->prev = current->seccomp.filter; 962 seccomp_cache_prepare(filter); 963 current->seccomp.filter = filter; 964 atomic_inc(¤t->seccomp.filter_count); 965 966 /* Now that the new filter is in place, synchronize to all threads. */ 967 if (flags & SECCOMP_FILTER_FLAG_TSYNC) 968 seccomp_sync_threads(flags); 969 970 return 0; 971 } 972 973 static void __get_seccomp_filter(struct seccomp_filter *filter) 974 { 975 refcount_inc(&filter->refs); 976 } 977 978 /* get_seccomp_filter - increments the reference count of the filter on @tsk */ 979 void get_seccomp_filter(struct task_struct *tsk) 980 { 981 struct seccomp_filter *orig = tsk->seccomp.filter; 982 if (!orig) 983 return; 984 __get_seccomp_filter(orig); 985 refcount_inc(&orig->users); 986 } 987 988 #endif /* CONFIG_SECCOMP_FILTER */ 989 990 /* For use with seccomp_actions_logged */ 991 #define SECCOMP_LOG_KILL_PROCESS (1 << 0) 992 #define SECCOMP_LOG_KILL_THREAD (1 << 1) 993 #define SECCOMP_LOG_TRAP (1 << 2) 994 #define SECCOMP_LOG_ERRNO (1 << 3) 995 #define SECCOMP_LOG_TRACE (1 << 4) 996 #define SECCOMP_LOG_LOG (1 << 5) 997 #define SECCOMP_LOG_ALLOW (1 << 6) 998 #define SECCOMP_LOG_USER_NOTIF (1 << 7) 999 1000 static u32 seccomp_actions_logged = SECCOMP_LOG_KILL_PROCESS | 1001 SECCOMP_LOG_KILL_THREAD | 1002 SECCOMP_LOG_TRAP | 1003 SECCOMP_LOG_ERRNO | 1004 SECCOMP_LOG_USER_NOTIF | 1005 SECCOMP_LOG_TRACE | 1006 SECCOMP_LOG_LOG; 1007 1008 static inline void seccomp_log(unsigned long syscall, long signr, u32 action, 1009 bool requested) 1010 { 1011 bool log = false; 1012 1013 switch (action) { 1014 case SECCOMP_RET_ALLOW: 1015 break; 1016 case SECCOMP_RET_TRAP: 1017 log = requested && seccomp_actions_logged & SECCOMP_LOG_TRAP; 1018 break; 1019 case SECCOMP_RET_ERRNO: 1020 log = requested && seccomp_actions_logged & SECCOMP_LOG_ERRNO; 1021 break; 1022 case SECCOMP_RET_TRACE: 1023 log = requested && seccomp_actions_logged & SECCOMP_LOG_TRACE; 1024 break; 1025 case SECCOMP_RET_USER_NOTIF: 1026 log = requested && seccomp_actions_logged & SECCOMP_LOG_USER_NOTIF; 1027 break; 1028 case SECCOMP_RET_LOG: 1029 log = seccomp_actions_logged & SECCOMP_LOG_LOG; 1030 break; 1031 case SECCOMP_RET_KILL_THREAD: 1032 log = seccomp_actions_logged & SECCOMP_LOG_KILL_THREAD; 1033 break; 1034 case SECCOMP_RET_KILL_PROCESS: 1035 default: 1036 log = seccomp_actions_logged & SECCOMP_LOG_KILL_PROCESS; 1037 } 1038 1039 /* 1040 * Emit an audit message when the action is RET_KILL_*, RET_LOG, or the 1041 * FILTER_FLAG_LOG bit was set. The admin has the ability to silence 1042 * any action from being logged by removing the action name from the 1043 * seccomp_actions_logged sysctl. 1044 */ 1045 if (!log) 1046 return; 1047 1048 audit_seccomp(syscall, signr, action); 1049 } 1050 1051 /* 1052 * Secure computing mode 1 allows only read/write/exit/sigreturn. 1053 * To be fully secure this must be combined with rlimit 1054 * to limit the stack allocations too. 1055 */ 1056 static const int mode1_syscalls[] = { 1057 __NR_seccomp_read, __NR_seccomp_write, __NR_seccomp_exit, __NR_seccomp_sigreturn, 1058 #ifdef __NR_uretprobe 1059 __NR_uretprobe, 1060 #endif 1061 #ifdef __NR_uprobe 1062 __NR_uprobe, 1063 #endif 1064 -1, /* negative terminated */ 1065 }; 1066 1067 static void __secure_computing_strict(int this_syscall) 1068 { 1069 const int *allowed_syscalls = mode1_syscalls; 1070 #ifdef CONFIG_COMPAT 1071 if (in_compat_syscall()) 1072 allowed_syscalls = get_compat_mode1_syscalls(); 1073 #endif 1074 do { 1075 if (*allowed_syscalls == this_syscall) 1076 return; 1077 } while (*++allowed_syscalls != -1); 1078 1079 #ifdef SECCOMP_DEBUG 1080 dump_stack(); 1081 #endif 1082 current->seccomp.mode = SECCOMP_MODE_DEAD; 1083 seccomp_log(this_syscall, SIGKILL, SECCOMP_RET_KILL_THREAD, true); 1084 do_exit(SIGKILL); 1085 } 1086 1087 #ifndef CONFIG_HAVE_ARCH_SECCOMP_FILTER 1088 void secure_computing_strict(int this_syscall) 1089 { 1090 int mode = current->seccomp.mode; 1091 1092 if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) && 1093 unlikely(current->ptrace & PT_SUSPEND_SECCOMP)) 1094 return; 1095 1096 if (mode == SECCOMP_MODE_DISABLED) 1097 return; 1098 else if (mode == SECCOMP_MODE_STRICT) 1099 __secure_computing_strict(this_syscall); 1100 else 1101 BUG(); 1102 } 1103 int __secure_computing(void) 1104 { 1105 int this_syscall = syscall_get_nr(current, current_pt_regs()); 1106 1107 secure_computing_strict(this_syscall); 1108 return 0; 1109 } 1110 #else 1111 1112 #ifdef CONFIG_SECCOMP_FILTER 1113 static u64 seccomp_next_notify_id(struct seccomp_filter *filter) 1114 { 1115 /* 1116 * Note: overflow is ok here, the id just needs to be unique per 1117 * filter. 1118 */ 1119 lockdep_assert_held(&filter->notify_lock); 1120 return filter->notif->next_id++; 1121 } 1122 1123 static void seccomp_handle_addfd(struct seccomp_kaddfd *addfd, struct seccomp_knotif *n) 1124 { 1125 int fd; 1126 1127 /* 1128 * Remove the notification, and reset the list pointers, indicating 1129 * that it has been handled. 1130 */ 1131 list_del_init(&addfd->list); 1132 if (!addfd->setfd) 1133 fd = receive_fd(addfd->file, NULL, addfd->flags); 1134 else 1135 fd = receive_fd_replace(addfd->fd, addfd->file, addfd->flags); 1136 addfd->ret = fd; 1137 1138 if (addfd->ioctl_flags & SECCOMP_ADDFD_FLAG_SEND) { 1139 /* If we fail reset and return an error to the notifier */ 1140 if (fd < 0) { 1141 n->state = SECCOMP_NOTIFY_SENT; 1142 } else { 1143 /* Return the FD we just added */ 1144 n->flags = 0; 1145 n->error = 0; 1146 n->val = fd; 1147 } 1148 } 1149 1150 /* 1151 * Mark the notification as completed. From this point, addfd mem 1152 * might be invalidated and we can't safely read it anymore. 1153 */ 1154 complete(&addfd->completion); 1155 } 1156 1157 static bool should_sleep_killable(struct seccomp_filter *match, 1158 struct seccomp_knotif *n) 1159 { 1160 return match->wait_killable_recv && n->state >= SECCOMP_NOTIFY_SENT; 1161 } 1162 1163 static int seccomp_do_user_notification(int this_syscall, 1164 struct seccomp_filter *match, 1165 const struct seccomp_data *sd) 1166 { 1167 int err; 1168 u32 flags = 0; 1169 long ret = 0; 1170 struct seccomp_knotif n = {}; 1171 struct seccomp_kaddfd *addfd, *tmp; 1172 1173 mutex_lock(&match->notify_lock); 1174 err = -ENOSYS; 1175 if (!match->notif) 1176 goto out; 1177 1178 n.task = current; 1179 n.state = SECCOMP_NOTIFY_INIT; 1180 n.data = sd; 1181 n.id = seccomp_next_notify_id(match); 1182 init_completion(&n.ready); 1183 list_add_tail(&n.list, &match->notif->notifications); 1184 INIT_LIST_HEAD(&n.addfd); 1185 1186 atomic_inc(&match->notif->requests); 1187 if (match->notif->flags & SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP) 1188 wake_up_poll_on_current_cpu(&match->wqh, EPOLLIN | EPOLLRDNORM); 1189 else 1190 wake_up_poll(&match->wqh, EPOLLIN | EPOLLRDNORM); 1191 1192 /* 1193 * This is where we wait for a reply from userspace. 1194 */ 1195 do { 1196 bool wait_killable = should_sleep_killable(match, &n); 1197 1198 mutex_unlock(&match->notify_lock); 1199 if (wait_killable) 1200 err = wait_for_completion_killable(&n.ready); 1201 else 1202 err = wait_for_completion_interruptible(&n.ready); 1203 mutex_lock(&match->notify_lock); 1204 1205 if (err != 0) { 1206 /* 1207 * Check to see whether we should switch to wait 1208 * killable. Only return the interrupted error if not. 1209 */ 1210 if (!(!wait_killable && should_sleep_killable(match, &n))) 1211 goto interrupted; 1212 } 1213 1214 addfd = list_first_entry_or_null(&n.addfd, 1215 struct seccomp_kaddfd, list); 1216 /* Check if we were woken up by a addfd message */ 1217 if (addfd) 1218 seccomp_handle_addfd(addfd, &n); 1219 1220 } while (n.state != SECCOMP_NOTIFY_REPLIED); 1221 1222 ret = n.val; 1223 err = n.error; 1224 flags = n.flags; 1225 1226 interrupted: 1227 /* If there were any pending addfd calls, clear them out */ 1228 list_for_each_entry_safe(addfd, tmp, &n.addfd, list) { 1229 /* The process went away before we got a chance to handle it */ 1230 addfd->ret = -ESRCH; 1231 list_del_init(&addfd->list); 1232 complete(&addfd->completion); 1233 } 1234 1235 /* 1236 * Note that it's possible the listener died in between the time when 1237 * we were notified of a response (or a signal) and when we were able to 1238 * re-acquire the lock, so only delete from the list if the 1239 * notification actually exists. 1240 * 1241 * Also note that this test is only valid because there's no way to 1242 * *reattach* to a notifier right now. If one is added, we'll need to 1243 * keep track of the notif itself and make sure they match here. 1244 */ 1245 if (match->notif) 1246 list_del(&n.list); 1247 out: 1248 mutex_unlock(&match->notify_lock); 1249 1250 /* Userspace requests to continue the syscall. */ 1251 if (flags & SECCOMP_USER_NOTIF_FLAG_CONTINUE) 1252 return 0; 1253 1254 syscall_set_return_value(current, current_pt_regs(), 1255 err, ret); 1256 return -1; 1257 } 1258 1259 static int __seccomp_filter(int this_syscall, const bool recheck_after_trace) 1260 { 1261 u32 filter_ret, action; 1262 struct seccomp_data sd; 1263 struct seccomp_filter *match = NULL; 1264 int data; 1265 1266 /* 1267 * Make sure that any changes to mode from another thread have 1268 * been seen after SYSCALL_WORK_SECCOMP was seen. 1269 */ 1270 smp_rmb(); 1271 1272 populate_seccomp_data(&sd); 1273 1274 filter_ret = seccomp_run_filters(&sd, &match); 1275 data = filter_ret & SECCOMP_RET_DATA; 1276 action = filter_ret & SECCOMP_RET_ACTION_FULL; 1277 1278 switch (action) { 1279 case SECCOMP_RET_ERRNO: 1280 /* Set low-order bits as an errno, capped at MAX_ERRNO. */ 1281 if (data > MAX_ERRNO) 1282 data = MAX_ERRNO; 1283 syscall_set_return_value(current, current_pt_regs(), 1284 -data, 0); 1285 goto skip; 1286 1287 case SECCOMP_RET_TRAP: 1288 /* Show the handler the original registers. */ 1289 syscall_rollback(current, current_pt_regs()); 1290 /* Let the filter pass back 16 bits of data. */ 1291 force_sig_seccomp(this_syscall, data, false); 1292 goto skip; 1293 1294 case SECCOMP_RET_TRACE: 1295 /* We've been put in this state by the ptracer already. */ 1296 if (recheck_after_trace) 1297 return 0; 1298 1299 /* ENOSYS these calls if there is no tracer attached. */ 1300 if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP)) { 1301 syscall_set_return_value(current, 1302 current_pt_regs(), 1303 -ENOSYS, 0); 1304 goto skip; 1305 } 1306 1307 /* Allow the BPF to provide the event message */ 1308 ptrace_event(PTRACE_EVENT_SECCOMP, data); 1309 /* 1310 * The delivery of a fatal signal during event 1311 * notification may silently skip tracer notification, 1312 * which could leave us with a potentially unmodified 1313 * syscall that the tracer would have liked to have 1314 * changed. Since the process is about to die, we just 1315 * force the syscall to be skipped and let the signal 1316 * kill the process and correctly handle any tracer exit 1317 * notifications. 1318 */ 1319 if (fatal_signal_pending(current)) 1320 goto skip; 1321 /* Check if the tracer forced the syscall to be skipped. */ 1322 this_syscall = syscall_get_nr(current, current_pt_regs()); 1323 if (this_syscall < 0) 1324 goto skip; 1325 1326 /* 1327 * Recheck the syscall, since it may have changed. This 1328 * intentionally uses a NULL struct seccomp_data to force 1329 * a reload of all registers. This does not goto skip since 1330 * a skip would have already been reported. 1331 */ 1332 if (__seccomp_filter(this_syscall, true)) 1333 return -1; 1334 1335 return 0; 1336 1337 case SECCOMP_RET_USER_NOTIF: 1338 if (seccomp_do_user_notification(this_syscall, match, &sd)) 1339 goto skip; 1340 1341 return 0; 1342 1343 case SECCOMP_RET_LOG: 1344 seccomp_log(this_syscall, 0, action, true); 1345 return 0; 1346 1347 case SECCOMP_RET_ALLOW: 1348 /* 1349 * Note that the "match" filter will always be NULL for 1350 * this action since SECCOMP_RET_ALLOW is the starting 1351 * state in seccomp_run_filters(). 1352 */ 1353 return 0; 1354 1355 case SECCOMP_RET_KILL_THREAD: 1356 case SECCOMP_RET_KILL_PROCESS: 1357 default: 1358 current->seccomp.mode = SECCOMP_MODE_DEAD; 1359 seccomp_log(this_syscall, SIGSYS, action, true); 1360 /* Dump core only if this is the last remaining thread. */ 1361 if (action != SECCOMP_RET_KILL_THREAD || 1362 (atomic_read(¤t->signal->live) == 1)) { 1363 /* Show the original registers in the dump. */ 1364 syscall_rollback(current, current_pt_regs()); 1365 /* Trigger a coredump with SIGSYS */ 1366 force_sig_seccomp(this_syscall, data, true); 1367 } else { 1368 do_exit(SIGSYS); 1369 } 1370 return -1; /* skip the syscall go directly to signal handling */ 1371 } 1372 1373 unreachable(); 1374 1375 skip: 1376 seccomp_log(this_syscall, 0, action, match ? match->log : false); 1377 return -1; 1378 } 1379 #else 1380 static int __seccomp_filter(int this_syscall, const bool recheck_after_trace) 1381 { 1382 BUG(); 1383 1384 return -1; 1385 } 1386 #endif 1387 1388 int __secure_computing(void) 1389 { 1390 int mode = current->seccomp.mode; 1391 int this_syscall; 1392 1393 if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) && 1394 unlikely(current->ptrace & PT_SUSPEND_SECCOMP)) 1395 return 0; 1396 1397 this_syscall = syscall_get_nr(current, current_pt_regs()); 1398 1399 switch (mode) { 1400 case SECCOMP_MODE_STRICT: 1401 __secure_computing_strict(this_syscall); /* may call do_exit */ 1402 return 0; 1403 case SECCOMP_MODE_FILTER: 1404 return __seccomp_filter(this_syscall, false); 1405 /* Surviving SECCOMP_RET_KILL_* must be proactively impossible. */ 1406 case SECCOMP_MODE_DEAD: 1407 WARN_ON_ONCE(1); 1408 do_exit(SIGKILL); 1409 return -1; 1410 default: 1411 BUG(); 1412 } 1413 } 1414 #endif /* CONFIG_HAVE_ARCH_SECCOMP_FILTER */ 1415 1416 long prctl_get_seccomp(void) 1417 { 1418 return current->seccomp.mode; 1419 } 1420 1421 /** 1422 * seccomp_set_mode_strict: internal function for setting strict seccomp 1423 * 1424 * Once current->seccomp.mode is non-zero, it may not be changed. 1425 * 1426 * Returns 0 on success or -EINVAL on failure. 1427 */ 1428 static long seccomp_set_mode_strict(void) 1429 { 1430 const unsigned long seccomp_mode = SECCOMP_MODE_STRICT; 1431 long ret = -EINVAL; 1432 1433 spin_lock_irq(¤t->sighand->siglock); 1434 1435 if (!seccomp_may_assign_mode(seccomp_mode)) 1436 goto out; 1437 1438 #ifdef TIF_NOTSC 1439 disable_TSC(); 1440 #endif 1441 seccomp_assign_mode(current, seccomp_mode, 0); 1442 ret = 0; 1443 1444 out: 1445 spin_unlock_irq(¤t->sighand->siglock); 1446 1447 return ret; 1448 } 1449 1450 #ifdef CONFIG_SECCOMP_FILTER 1451 static void seccomp_notify_free(struct seccomp_filter *filter) 1452 { 1453 kfree(filter->notif); 1454 filter->notif = NULL; 1455 } 1456 1457 static void seccomp_notify_detach(struct seccomp_filter *filter) 1458 { 1459 struct seccomp_knotif *knotif; 1460 1461 if (!filter) 1462 return; 1463 1464 mutex_lock(&filter->notify_lock); 1465 1466 /* 1467 * If this file is being closed because e.g. the task who owned it 1468 * died, let's wake everyone up who was waiting on us. 1469 */ 1470 list_for_each_entry(knotif, &filter->notif->notifications, list) { 1471 if (knotif->state == SECCOMP_NOTIFY_REPLIED) 1472 continue; 1473 1474 knotif->state = SECCOMP_NOTIFY_REPLIED; 1475 knotif->error = -ENOSYS; 1476 knotif->val = 0; 1477 1478 /* 1479 * We do not need to wake up any pending addfd messages, as 1480 * the notifier will do that for us, as this just looks 1481 * like a standard reply. 1482 */ 1483 complete(&knotif->ready); 1484 } 1485 1486 seccomp_notify_free(filter); 1487 mutex_unlock(&filter->notify_lock); 1488 } 1489 1490 static int seccomp_notify_release(struct inode *inode, struct file *file) 1491 { 1492 struct seccomp_filter *filter = file->private_data; 1493 1494 seccomp_notify_detach(filter); 1495 __put_seccomp_filter(filter); 1496 return 0; 1497 } 1498 1499 /* must be called with notif_lock held */ 1500 static inline struct seccomp_knotif * 1501 find_notification(struct seccomp_filter *filter, u64 id) 1502 { 1503 struct seccomp_knotif *cur; 1504 1505 lockdep_assert_held(&filter->notify_lock); 1506 1507 list_for_each_entry(cur, &filter->notif->notifications, list) { 1508 if (cur->id == id) 1509 return cur; 1510 } 1511 1512 return NULL; 1513 } 1514 1515 static int recv_wake_function(wait_queue_entry_t *wait, unsigned int mode, int sync, 1516 void *key) 1517 { 1518 /* Avoid a wakeup if event not interesting for us. */ 1519 if (key && !(key_to_poll(key) & (EPOLLIN | EPOLLERR | EPOLLHUP))) 1520 return 0; 1521 return autoremove_wake_function(wait, mode, sync, key); 1522 } 1523 1524 static int recv_wait_event(struct seccomp_filter *filter) 1525 { 1526 DEFINE_WAIT_FUNC(wait, recv_wake_function); 1527 int ret; 1528 1529 if (refcount_read(&filter->users) == 0) 1530 return 0; 1531 1532 if (atomic_dec_if_positive(&filter->notif->requests) >= 0) 1533 return 0; 1534 1535 for (;;) { 1536 ret = prepare_to_wait_event(&filter->wqh, &wait, TASK_INTERRUPTIBLE); 1537 1538 if (atomic_dec_if_positive(&filter->notif->requests) >= 0) 1539 break; 1540 if (refcount_read(&filter->users) == 0) 1541 break; 1542 1543 if (ret) 1544 return ret; 1545 1546 schedule(); 1547 } 1548 finish_wait(&filter->wqh, &wait); 1549 return 0; 1550 } 1551 1552 static long seccomp_notify_recv(struct seccomp_filter *filter, 1553 void __user *buf) 1554 { 1555 struct seccomp_knotif *knotif = NULL, *cur; 1556 struct seccomp_notif unotif; 1557 ssize_t ret; 1558 1559 /* Verify that we're not given garbage to keep struct extensible. */ 1560 ret = check_zeroed_user(buf, sizeof(unotif)); 1561 if (ret < 0) 1562 return ret; 1563 if (!ret) 1564 return -EINVAL; 1565 1566 memset(&unotif, 0, sizeof(unotif)); 1567 1568 ret = recv_wait_event(filter); 1569 if (ret < 0) 1570 return ret; 1571 1572 mutex_lock(&filter->notify_lock); 1573 list_for_each_entry(cur, &filter->notif->notifications, list) { 1574 if (cur->state == SECCOMP_NOTIFY_INIT) { 1575 knotif = cur; 1576 break; 1577 } 1578 } 1579 1580 /* 1581 * If we didn't find a notification, it could be that the task was 1582 * interrupted by a fatal signal between the time we were woken and 1583 * when we were able to acquire the rw lock. 1584 */ 1585 if (!knotif) { 1586 ret = -ENOENT; 1587 goto out; 1588 } 1589 1590 unotif.id = knotif->id; 1591 unotif.pid = task_pid_vnr(knotif->task); 1592 unotif.data = *(knotif->data); 1593 1594 knotif->state = SECCOMP_NOTIFY_SENT; 1595 wake_up_poll(&filter->wqh, EPOLLOUT | EPOLLWRNORM); 1596 ret = 0; 1597 out: 1598 mutex_unlock(&filter->notify_lock); 1599 1600 if (ret == 0 && copy_to_user(buf, &unotif, sizeof(unotif))) { 1601 ret = -EFAULT; 1602 1603 /* 1604 * Userspace screwed up. To make sure that we keep this 1605 * notification alive, let's reset it back to INIT. It 1606 * may have died when we released the lock, so we need to make 1607 * sure it's still around. 1608 */ 1609 mutex_lock(&filter->notify_lock); 1610 knotif = find_notification(filter, unotif.id); 1611 if (knotif) { 1612 /* Reset the process to make sure it's not stuck */ 1613 if (should_sleep_killable(filter, knotif)) 1614 complete(&knotif->ready); 1615 knotif->state = SECCOMP_NOTIFY_INIT; 1616 atomic_inc(&filter->notif->requests); 1617 wake_up_poll(&filter->wqh, EPOLLIN | EPOLLRDNORM); 1618 } 1619 mutex_unlock(&filter->notify_lock); 1620 } 1621 1622 return ret; 1623 } 1624 1625 static long seccomp_notify_send(struct seccomp_filter *filter, 1626 void __user *buf) 1627 { 1628 struct seccomp_notif_resp resp = {}; 1629 struct seccomp_knotif *knotif; 1630 long ret; 1631 1632 if (copy_from_user(&resp, buf, sizeof(resp))) 1633 return -EFAULT; 1634 1635 if (resp.flags & ~SECCOMP_USER_NOTIF_FLAG_CONTINUE) 1636 return -EINVAL; 1637 1638 if ((resp.flags & SECCOMP_USER_NOTIF_FLAG_CONTINUE) && 1639 (resp.error || resp.val)) 1640 return -EINVAL; 1641 1642 ret = mutex_lock_interruptible(&filter->notify_lock); 1643 if (ret < 0) 1644 return ret; 1645 1646 knotif = find_notification(filter, resp.id); 1647 if (!knotif) { 1648 ret = -ENOENT; 1649 goto out; 1650 } 1651 1652 /* Allow exactly one reply. */ 1653 if (knotif->state != SECCOMP_NOTIFY_SENT) { 1654 ret = -EINPROGRESS; 1655 goto out; 1656 } 1657 1658 ret = 0; 1659 knotif->state = SECCOMP_NOTIFY_REPLIED; 1660 knotif->error = resp.error; 1661 knotif->val = resp.val; 1662 knotif->flags = resp.flags; 1663 if (filter->notif->flags & SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP) 1664 complete_on_current_cpu(&knotif->ready); 1665 else 1666 complete(&knotif->ready); 1667 out: 1668 mutex_unlock(&filter->notify_lock); 1669 return ret; 1670 } 1671 1672 static long seccomp_notify_id_valid(struct seccomp_filter *filter, 1673 void __user *buf) 1674 { 1675 struct seccomp_knotif *knotif; 1676 u64 id; 1677 long ret; 1678 1679 if (copy_from_user(&id, buf, sizeof(id))) 1680 return -EFAULT; 1681 1682 ret = mutex_lock_interruptible(&filter->notify_lock); 1683 if (ret < 0) 1684 return ret; 1685 1686 knotif = find_notification(filter, id); 1687 if (knotif && knotif->state == SECCOMP_NOTIFY_SENT) 1688 ret = 0; 1689 else 1690 ret = -ENOENT; 1691 1692 mutex_unlock(&filter->notify_lock); 1693 return ret; 1694 } 1695 1696 static long seccomp_notify_set_flags(struct seccomp_filter *filter, 1697 unsigned long flags) 1698 { 1699 long ret; 1700 1701 if (flags & ~SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP) 1702 return -EINVAL; 1703 1704 ret = mutex_lock_interruptible(&filter->notify_lock); 1705 if (ret < 0) 1706 return ret; 1707 filter->notif->flags = flags; 1708 mutex_unlock(&filter->notify_lock); 1709 return 0; 1710 } 1711 1712 static long seccomp_notify_addfd(struct seccomp_filter *filter, 1713 struct seccomp_notif_addfd __user *uaddfd, 1714 unsigned int size) 1715 { 1716 struct seccomp_notif_addfd addfd; 1717 struct seccomp_knotif *knotif; 1718 struct seccomp_kaddfd kaddfd; 1719 int ret; 1720 1721 BUILD_BUG_ON(sizeof(addfd) < SECCOMP_NOTIFY_ADDFD_SIZE_VER0); 1722 BUILD_BUG_ON(sizeof(addfd) != SECCOMP_NOTIFY_ADDFD_SIZE_LATEST); 1723 1724 if (size < SECCOMP_NOTIFY_ADDFD_SIZE_VER0 || size >= PAGE_SIZE) 1725 return -EINVAL; 1726 1727 ret = copy_struct_from_user(&addfd, sizeof(addfd), uaddfd, size); 1728 if (ret) 1729 return ret; 1730 1731 if (addfd.newfd_flags & ~O_CLOEXEC) 1732 return -EINVAL; 1733 1734 if (addfd.flags & ~(SECCOMP_ADDFD_FLAG_SETFD | SECCOMP_ADDFD_FLAG_SEND)) 1735 return -EINVAL; 1736 1737 if (addfd.newfd && !(addfd.flags & SECCOMP_ADDFD_FLAG_SETFD)) 1738 return -EINVAL; 1739 1740 kaddfd.file = fget(addfd.srcfd); 1741 if (!kaddfd.file) 1742 return -EBADF; 1743 1744 kaddfd.ioctl_flags = addfd.flags; 1745 kaddfd.flags = addfd.newfd_flags; 1746 kaddfd.setfd = addfd.flags & SECCOMP_ADDFD_FLAG_SETFD; 1747 kaddfd.fd = addfd.newfd; 1748 init_completion(&kaddfd.completion); 1749 1750 ret = mutex_lock_interruptible(&filter->notify_lock); 1751 if (ret < 0) 1752 goto out; 1753 1754 knotif = find_notification(filter, addfd.id); 1755 if (!knotif) { 1756 ret = -ENOENT; 1757 goto out_unlock; 1758 } 1759 1760 /* 1761 * We do not want to allow for FD injection to occur before the 1762 * notification has been picked up by a userspace handler, or after 1763 * the notification has been replied to. 1764 */ 1765 if (knotif->state != SECCOMP_NOTIFY_SENT) { 1766 ret = -EINPROGRESS; 1767 goto out_unlock; 1768 } 1769 1770 if (addfd.flags & SECCOMP_ADDFD_FLAG_SEND) { 1771 /* 1772 * Disallow queuing an atomic addfd + send reply while there are 1773 * some addfd requests still to process. 1774 * 1775 * There is no clear reason to support it and allows us to keep 1776 * the loop on the other side straight-forward. 1777 */ 1778 if (!list_empty(&knotif->addfd)) { 1779 ret = -EBUSY; 1780 goto out_unlock; 1781 } 1782 1783 /* Allow exactly only one reply */ 1784 knotif->state = SECCOMP_NOTIFY_REPLIED; 1785 } 1786 1787 list_add(&kaddfd.list, &knotif->addfd); 1788 complete(&knotif->ready); 1789 mutex_unlock(&filter->notify_lock); 1790 1791 /* Now we wait for it to be processed or be interrupted */ 1792 ret = wait_for_completion_interruptible(&kaddfd.completion); 1793 if (ret == 0) { 1794 /* 1795 * We had a successful completion. The other side has already 1796 * removed us from the addfd queue, and 1797 * wait_for_completion_interruptible has a memory barrier upon 1798 * success that lets us read this value directly without 1799 * locking. 1800 */ 1801 ret = kaddfd.ret; 1802 goto out; 1803 } 1804 1805 mutex_lock(&filter->notify_lock); 1806 /* 1807 * Even though we were woken up by a signal and not a successful 1808 * completion, a completion may have happened in the mean time. 1809 * 1810 * We need to check again if the addfd request has been handled, 1811 * and if not, we will remove it from the queue. 1812 */ 1813 if (list_empty(&kaddfd.list)) 1814 ret = kaddfd.ret; 1815 else 1816 list_del(&kaddfd.list); 1817 1818 out_unlock: 1819 mutex_unlock(&filter->notify_lock); 1820 out: 1821 fput(kaddfd.file); 1822 1823 return ret; 1824 } 1825 1826 static long seccomp_notify_ioctl(struct file *file, unsigned int cmd, 1827 unsigned long arg) 1828 { 1829 struct seccomp_filter *filter = file->private_data; 1830 void __user *buf = (void __user *)arg; 1831 1832 /* Fixed-size ioctls */ 1833 switch (cmd) { 1834 case SECCOMP_IOCTL_NOTIF_RECV: 1835 return seccomp_notify_recv(filter, buf); 1836 case SECCOMP_IOCTL_NOTIF_SEND: 1837 return seccomp_notify_send(filter, buf); 1838 case SECCOMP_IOCTL_NOTIF_ID_VALID_WRONG_DIR: 1839 case SECCOMP_IOCTL_NOTIF_ID_VALID: 1840 return seccomp_notify_id_valid(filter, buf); 1841 case SECCOMP_IOCTL_NOTIF_SET_FLAGS: 1842 return seccomp_notify_set_flags(filter, arg); 1843 } 1844 1845 /* Extensible Argument ioctls */ 1846 #define EA_IOCTL(cmd) ((cmd) & ~(IOC_INOUT | IOCSIZE_MASK)) 1847 switch (EA_IOCTL(cmd)) { 1848 case EA_IOCTL(SECCOMP_IOCTL_NOTIF_ADDFD): 1849 return seccomp_notify_addfd(filter, buf, _IOC_SIZE(cmd)); 1850 default: 1851 return -EINVAL; 1852 } 1853 } 1854 1855 static __poll_t seccomp_notify_poll(struct file *file, 1856 struct poll_table_struct *poll_tab) 1857 { 1858 struct seccomp_filter *filter = file->private_data; 1859 __poll_t ret = 0; 1860 struct seccomp_knotif *cur; 1861 1862 poll_wait(file, &filter->wqh, poll_tab); 1863 1864 if (mutex_lock_interruptible(&filter->notify_lock) < 0) 1865 return EPOLLERR; 1866 1867 list_for_each_entry(cur, &filter->notif->notifications, list) { 1868 if (cur->state == SECCOMP_NOTIFY_INIT) 1869 ret |= EPOLLIN | EPOLLRDNORM; 1870 if (cur->state == SECCOMP_NOTIFY_SENT) 1871 ret |= EPOLLOUT | EPOLLWRNORM; 1872 if ((ret & EPOLLIN) && (ret & EPOLLOUT)) 1873 break; 1874 } 1875 1876 mutex_unlock(&filter->notify_lock); 1877 1878 if (refcount_read(&filter->users) == 0) 1879 ret |= EPOLLHUP; 1880 1881 return ret; 1882 } 1883 1884 static const struct file_operations seccomp_notify_ops = { 1885 .poll = seccomp_notify_poll, 1886 .release = seccomp_notify_release, 1887 .unlocked_ioctl = seccomp_notify_ioctl, 1888 .compat_ioctl = seccomp_notify_ioctl, 1889 }; 1890 1891 static struct file *init_listener(struct seccomp_filter *filter) 1892 { 1893 struct file *ret; 1894 1895 ret = ERR_PTR(-ENOMEM); 1896 filter->notif = kzalloc(sizeof(*(filter->notif)), GFP_KERNEL); 1897 if (!filter->notif) 1898 goto out; 1899 1900 filter->notif->next_id = get_random_u64(); 1901 INIT_LIST_HEAD(&filter->notif->notifications); 1902 1903 ret = anon_inode_getfile("seccomp notify", &seccomp_notify_ops, 1904 filter, O_RDWR); 1905 if (IS_ERR(ret)) 1906 goto out_notif; 1907 1908 /* The file has a reference to it now */ 1909 __get_seccomp_filter(filter); 1910 1911 out_notif: 1912 if (IS_ERR(ret)) 1913 seccomp_notify_free(filter); 1914 out: 1915 return ret; 1916 } 1917 1918 /* 1919 * Does @new_child have a listener while an ancestor also has a listener? 1920 * If so, we'll want to reject this filter. 1921 * This only has to be tested for the current process, even in the TSYNC case, 1922 * because TSYNC installs @child with the same parent on all threads. 1923 * Note that @new_child is not hooked up to its parent at this point yet, so 1924 * we use current->seccomp.filter. 1925 */ 1926 static bool has_duplicate_listener(struct seccomp_filter *new_child) 1927 { 1928 struct seccomp_filter *cur; 1929 1930 /* must be protected against concurrent TSYNC */ 1931 lockdep_assert_held(¤t->sighand->siglock); 1932 1933 if (!new_child->notif) 1934 return false; 1935 for (cur = current->seccomp.filter; cur; cur = cur->prev) { 1936 if (cur->notif) 1937 return true; 1938 } 1939 1940 return false; 1941 } 1942 1943 /** 1944 * seccomp_set_mode_filter: internal function for setting seccomp filter 1945 * @flags: flags to change filter behavior 1946 * @filter: struct sock_fprog containing filter 1947 * 1948 * This function may be called repeatedly to install additional filters. 1949 * Every filter successfully installed will be evaluated (in reverse order) 1950 * for each system call the task makes. 1951 * 1952 * Once current->seccomp.mode is non-zero, it may not be changed. 1953 * 1954 * Returns 0 on success or -EINVAL on failure. 1955 */ 1956 static long seccomp_set_mode_filter(unsigned int flags, 1957 const char __user *filter) 1958 { 1959 const unsigned long seccomp_mode = SECCOMP_MODE_FILTER; 1960 struct seccomp_filter *prepared = NULL; 1961 long ret = -EINVAL; 1962 int listener = -1; 1963 struct file *listener_f = NULL; 1964 1965 /* Validate flags. */ 1966 if (flags & ~SECCOMP_FILTER_FLAG_MASK) 1967 return -EINVAL; 1968 1969 /* 1970 * In the successful case, NEW_LISTENER returns the new listener fd. 1971 * But in the failure case, TSYNC returns the thread that died. If you 1972 * combine these two flags, there's no way to tell whether something 1973 * succeeded or failed. So, let's disallow this combination if the user 1974 * has not explicitly requested no errors from TSYNC. 1975 */ 1976 if ((flags & SECCOMP_FILTER_FLAG_TSYNC) && 1977 (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) && 1978 ((flags & SECCOMP_FILTER_FLAG_TSYNC_ESRCH) == 0)) 1979 return -EINVAL; 1980 1981 /* 1982 * The SECCOMP_FILTER_FLAG_WAIT_KILLABLE_SENT flag doesn't make sense 1983 * without the SECCOMP_FILTER_FLAG_NEW_LISTENER flag. 1984 */ 1985 if ((flags & SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV) && 1986 ((flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) == 0)) 1987 return -EINVAL; 1988 1989 /* Prepare the new filter before holding any locks. */ 1990 prepared = seccomp_prepare_user_filter(filter); 1991 if (IS_ERR(prepared)) 1992 return PTR_ERR(prepared); 1993 1994 if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) { 1995 listener = get_unused_fd_flags(O_CLOEXEC); 1996 if (listener < 0) { 1997 ret = listener; 1998 goto out_free; 1999 } 2000 2001 listener_f = init_listener(prepared); 2002 if (IS_ERR(listener_f)) { 2003 put_unused_fd(listener); 2004 ret = PTR_ERR(listener_f); 2005 goto out_free; 2006 } 2007 } 2008 2009 /* 2010 * Make sure we cannot change seccomp or nnp state via TSYNC 2011 * while another thread is in the middle of calling exec. 2012 */ 2013 if (flags & SECCOMP_FILTER_FLAG_TSYNC && 2014 mutex_lock_killable(¤t->signal->cred_guard_mutex)) 2015 goto out_put_fd; 2016 2017 spin_lock_irq(¤t->sighand->siglock); 2018 2019 if (!seccomp_may_assign_mode(seccomp_mode)) 2020 goto out; 2021 2022 if (has_duplicate_listener(prepared)) { 2023 ret = -EBUSY; 2024 goto out; 2025 } 2026 2027 ret = seccomp_attach_filter(flags, prepared); 2028 if (ret) 2029 goto out; 2030 /* Do not free the successfully attached filter. */ 2031 prepared = NULL; 2032 2033 seccomp_assign_mode(current, seccomp_mode, flags); 2034 out: 2035 spin_unlock_irq(¤t->sighand->siglock); 2036 if (flags & SECCOMP_FILTER_FLAG_TSYNC) 2037 mutex_unlock(¤t->signal->cred_guard_mutex); 2038 out_put_fd: 2039 if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) { 2040 if (ret) { 2041 listener_f->private_data = NULL; 2042 fput(listener_f); 2043 put_unused_fd(listener); 2044 seccomp_notify_detach(prepared); 2045 } else { 2046 fd_install(listener, listener_f); 2047 ret = listener; 2048 } 2049 } 2050 out_free: 2051 seccomp_filter_free(prepared); 2052 return ret; 2053 } 2054 #else 2055 static inline long seccomp_set_mode_filter(unsigned int flags, 2056 const char __user *filter) 2057 { 2058 return -EINVAL; 2059 } 2060 #endif 2061 2062 static long seccomp_get_action_avail(const char __user *uaction) 2063 { 2064 u32 action; 2065 2066 if (copy_from_user(&action, uaction, sizeof(action))) 2067 return -EFAULT; 2068 2069 switch (action) { 2070 case SECCOMP_RET_KILL_PROCESS: 2071 case SECCOMP_RET_KILL_THREAD: 2072 case SECCOMP_RET_TRAP: 2073 case SECCOMP_RET_ERRNO: 2074 case SECCOMP_RET_USER_NOTIF: 2075 case SECCOMP_RET_TRACE: 2076 case SECCOMP_RET_LOG: 2077 case SECCOMP_RET_ALLOW: 2078 break; 2079 default: 2080 return -EOPNOTSUPP; 2081 } 2082 2083 return 0; 2084 } 2085 2086 static long seccomp_get_notif_sizes(void __user *usizes) 2087 { 2088 struct seccomp_notif_sizes sizes = { 2089 .seccomp_notif = sizeof(struct seccomp_notif), 2090 .seccomp_notif_resp = sizeof(struct seccomp_notif_resp), 2091 .seccomp_data = sizeof(struct seccomp_data), 2092 }; 2093 2094 if (copy_to_user(usizes, &sizes, sizeof(sizes))) 2095 return -EFAULT; 2096 2097 return 0; 2098 } 2099 2100 /* Common entry point for both prctl and syscall. */ 2101 static long do_seccomp(unsigned int op, unsigned int flags, 2102 void __user *uargs) 2103 { 2104 switch (op) { 2105 case SECCOMP_SET_MODE_STRICT: 2106 if (flags != 0 || uargs != NULL) 2107 return -EINVAL; 2108 return seccomp_set_mode_strict(); 2109 case SECCOMP_SET_MODE_FILTER: 2110 return seccomp_set_mode_filter(flags, uargs); 2111 case SECCOMP_GET_ACTION_AVAIL: 2112 if (flags != 0) 2113 return -EINVAL; 2114 2115 return seccomp_get_action_avail(uargs); 2116 case SECCOMP_GET_NOTIF_SIZES: 2117 if (flags != 0) 2118 return -EINVAL; 2119 2120 return seccomp_get_notif_sizes(uargs); 2121 default: 2122 return -EINVAL; 2123 } 2124 } 2125 2126 SYSCALL_DEFINE3(seccomp, unsigned int, op, unsigned int, flags, 2127 void __user *, uargs) 2128 { 2129 return do_seccomp(op, flags, uargs); 2130 } 2131 2132 /** 2133 * prctl_set_seccomp: configures current->seccomp.mode 2134 * @seccomp_mode: requested mode to use 2135 * @filter: optional struct sock_fprog for use with SECCOMP_MODE_FILTER 2136 * 2137 * Returns 0 on success or -EINVAL on failure. 2138 */ 2139 long prctl_set_seccomp(unsigned long seccomp_mode, void __user *filter) 2140 { 2141 unsigned int op; 2142 void __user *uargs; 2143 2144 switch (seccomp_mode) { 2145 case SECCOMP_MODE_STRICT: 2146 op = SECCOMP_SET_MODE_STRICT; 2147 /* 2148 * Setting strict mode through prctl always ignored filter, 2149 * so make sure it is always NULL here to pass the internal 2150 * check in do_seccomp(). 2151 */ 2152 uargs = NULL; 2153 break; 2154 case SECCOMP_MODE_FILTER: 2155 op = SECCOMP_SET_MODE_FILTER; 2156 uargs = filter; 2157 break; 2158 default: 2159 return -EINVAL; 2160 } 2161 2162 /* prctl interface doesn't have flags, so they are always zero. */ 2163 return do_seccomp(op, 0, uargs); 2164 } 2165 2166 #if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE) 2167 static struct seccomp_filter *get_nth_filter(struct task_struct *task, 2168 unsigned long filter_off) 2169 { 2170 struct seccomp_filter *orig, *filter; 2171 unsigned long count; 2172 2173 /* 2174 * Note: this is only correct because the caller should be the (ptrace) 2175 * tracer of the task, otherwise lock_task_sighand is needed. 2176 */ 2177 spin_lock_irq(&task->sighand->siglock); 2178 2179 if (task->seccomp.mode != SECCOMP_MODE_FILTER) { 2180 spin_unlock_irq(&task->sighand->siglock); 2181 return ERR_PTR(-EINVAL); 2182 } 2183 2184 orig = task->seccomp.filter; 2185 __get_seccomp_filter(orig); 2186 spin_unlock_irq(&task->sighand->siglock); 2187 2188 count = 0; 2189 for (filter = orig; filter; filter = filter->prev) 2190 count++; 2191 2192 if (filter_off >= count) { 2193 filter = ERR_PTR(-ENOENT); 2194 goto out; 2195 } 2196 2197 count -= filter_off; 2198 for (filter = orig; filter && count > 1; filter = filter->prev) 2199 count--; 2200 2201 if (WARN_ON(count != 1 || !filter)) { 2202 filter = ERR_PTR(-ENOENT); 2203 goto out; 2204 } 2205 2206 __get_seccomp_filter(filter); 2207 2208 out: 2209 __put_seccomp_filter(orig); 2210 return filter; 2211 } 2212 2213 long seccomp_get_filter(struct task_struct *task, unsigned long filter_off, 2214 void __user *data) 2215 { 2216 struct seccomp_filter *filter; 2217 struct sock_fprog_kern *fprog; 2218 long ret; 2219 2220 if (!capable(CAP_SYS_ADMIN) || 2221 current->seccomp.mode != SECCOMP_MODE_DISABLED) { 2222 return -EACCES; 2223 } 2224 2225 filter = get_nth_filter(task, filter_off); 2226 if (IS_ERR(filter)) 2227 return PTR_ERR(filter); 2228 2229 fprog = filter->prog->orig_prog; 2230 if (!fprog) { 2231 /* This must be a new non-cBPF filter, since we save 2232 * every cBPF filter's orig_prog above when 2233 * CONFIG_CHECKPOINT_RESTORE is enabled. 2234 */ 2235 ret = -EMEDIUMTYPE; 2236 goto out; 2237 } 2238 2239 ret = fprog->len; 2240 if (!data) 2241 goto out; 2242 2243 if (copy_to_user(data, fprog->filter, bpf_classic_proglen(fprog))) 2244 ret = -EFAULT; 2245 2246 out: 2247 __put_seccomp_filter(filter); 2248 return ret; 2249 } 2250 2251 long seccomp_get_metadata(struct task_struct *task, 2252 unsigned long size, void __user *data) 2253 { 2254 long ret; 2255 struct seccomp_filter *filter; 2256 struct seccomp_metadata kmd = {}; 2257 2258 if (!capable(CAP_SYS_ADMIN) || 2259 current->seccomp.mode != SECCOMP_MODE_DISABLED) { 2260 return -EACCES; 2261 } 2262 2263 size = min_t(unsigned long, size, sizeof(kmd)); 2264 2265 if (size < sizeof(kmd.filter_off)) 2266 return -EINVAL; 2267 2268 if (copy_from_user(&kmd.filter_off, data, sizeof(kmd.filter_off))) 2269 return -EFAULT; 2270 2271 filter = get_nth_filter(task, kmd.filter_off); 2272 if (IS_ERR(filter)) 2273 return PTR_ERR(filter); 2274 2275 if (filter->log) 2276 kmd.flags |= SECCOMP_FILTER_FLAG_LOG; 2277 2278 ret = size; 2279 if (copy_to_user(data, &kmd, size)) 2280 ret = -EFAULT; 2281 2282 __put_seccomp_filter(filter); 2283 return ret; 2284 } 2285 #endif 2286 2287 #ifdef CONFIG_SYSCTL 2288 2289 /* Human readable action names for friendly sysctl interaction */ 2290 #define SECCOMP_RET_KILL_PROCESS_NAME "kill_process" 2291 #define SECCOMP_RET_KILL_THREAD_NAME "kill_thread" 2292 #define SECCOMP_RET_TRAP_NAME "trap" 2293 #define SECCOMP_RET_ERRNO_NAME "errno" 2294 #define SECCOMP_RET_USER_NOTIF_NAME "user_notif" 2295 #define SECCOMP_RET_TRACE_NAME "trace" 2296 #define SECCOMP_RET_LOG_NAME "log" 2297 #define SECCOMP_RET_ALLOW_NAME "allow" 2298 2299 static const char seccomp_actions_avail[] = 2300 SECCOMP_RET_KILL_PROCESS_NAME " " 2301 SECCOMP_RET_KILL_THREAD_NAME " " 2302 SECCOMP_RET_TRAP_NAME " " 2303 SECCOMP_RET_ERRNO_NAME " " 2304 SECCOMP_RET_USER_NOTIF_NAME " " 2305 SECCOMP_RET_TRACE_NAME " " 2306 SECCOMP_RET_LOG_NAME " " 2307 SECCOMP_RET_ALLOW_NAME; 2308 2309 struct seccomp_log_name { 2310 u32 log; 2311 const char *name; 2312 }; 2313 2314 static const struct seccomp_log_name seccomp_log_names[] = { 2315 { SECCOMP_LOG_KILL_PROCESS, SECCOMP_RET_KILL_PROCESS_NAME }, 2316 { SECCOMP_LOG_KILL_THREAD, SECCOMP_RET_KILL_THREAD_NAME }, 2317 { SECCOMP_LOG_TRAP, SECCOMP_RET_TRAP_NAME }, 2318 { SECCOMP_LOG_ERRNO, SECCOMP_RET_ERRNO_NAME }, 2319 { SECCOMP_LOG_USER_NOTIF, SECCOMP_RET_USER_NOTIF_NAME }, 2320 { SECCOMP_LOG_TRACE, SECCOMP_RET_TRACE_NAME }, 2321 { SECCOMP_LOG_LOG, SECCOMP_RET_LOG_NAME }, 2322 { SECCOMP_LOG_ALLOW, SECCOMP_RET_ALLOW_NAME }, 2323 { } 2324 }; 2325 2326 static bool seccomp_names_from_actions_logged(char *names, size_t size, 2327 u32 actions_logged, 2328 const char *sep) 2329 { 2330 const struct seccomp_log_name *cur; 2331 bool append_sep = false; 2332 2333 for (cur = seccomp_log_names; cur->name && size; cur++) { 2334 ssize_t ret; 2335 2336 if (!(actions_logged & cur->log)) 2337 continue; 2338 2339 if (append_sep) { 2340 ret = strscpy(names, sep, size); 2341 if (ret < 0) 2342 return false; 2343 2344 names += ret; 2345 size -= ret; 2346 } else 2347 append_sep = true; 2348 2349 ret = strscpy(names, cur->name, size); 2350 if (ret < 0) 2351 return false; 2352 2353 names += ret; 2354 size -= ret; 2355 } 2356 2357 return true; 2358 } 2359 2360 static bool seccomp_action_logged_from_name(u32 *action_logged, 2361 const char *name) 2362 { 2363 const struct seccomp_log_name *cur; 2364 2365 for (cur = seccomp_log_names; cur->name; cur++) { 2366 if (!strcmp(cur->name, name)) { 2367 *action_logged = cur->log; 2368 return true; 2369 } 2370 } 2371 2372 return false; 2373 } 2374 2375 static bool seccomp_actions_logged_from_names(u32 *actions_logged, char *names) 2376 { 2377 char *name; 2378 2379 *actions_logged = 0; 2380 while ((name = strsep(&names, " ")) && *name) { 2381 u32 action_logged = 0; 2382 2383 if (!seccomp_action_logged_from_name(&action_logged, name)) 2384 return false; 2385 2386 *actions_logged |= action_logged; 2387 } 2388 2389 return true; 2390 } 2391 2392 static int read_actions_logged(const struct ctl_table *ro_table, void *buffer, 2393 size_t *lenp, loff_t *ppos) 2394 { 2395 char names[sizeof(seccomp_actions_avail)]; 2396 struct ctl_table table; 2397 2398 memset(names, 0, sizeof(names)); 2399 2400 if (!seccomp_names_from_actions_logged(names, sizeof(names), 2401 seccomp_actions_logged, " ")) 2402 return -EINVAL; 2403 2404 table = *ro_table; 2405 table.data = names; 2406 table.maxlen = sizeof(names); 2407 return proc_dostring(&table, 0, buffer, lenp, ppos); 2408 } 2409 2410 static int write_actions_logged(const struct ctl_table *ro_table, void *buffer, 2411 size_t *lenp, loff_t *ppos, u32 *actions_logged) 2412 { 2413 char names[sizeof(seccomp_actions_avail)]; 2414 struct ctl_table table; 2415 int ret; 2416 2417 if (!capable(CAP_SYS_ADMIN)) 2418 return -EPERM; 2419 2420 memset(names, 0, sizeof(names)); 2421 2422 table = *ro_table; 2423 table.data = names; 2424 table.maxlen = sizeof(names); 2425 ret = proc_dostring(&table, 1, buffer, lenp, ppos); 2426 if (ret) 2427 return ret; 2428 2429 if (!seccomp_actions_logged_from_names(actions_logged, table.data)) 2430 return -EINVAL; 2431 2432 if (*actions_logged & SECCOMP_LOG_ALLOW) 2433 return -EINVAL; 2434 2435 seccomp_actions_logged = *actions_logged; 2436 return 0; 2437 } 2438 2439 static void audit_actions_logged(u32 actions_logged, u32 old_actions_logged, 2440 int ret) 2441 { 2442 char names[sizeof(seccomp_actions_avail)]; 2443 char old_names[sizeof(seccomp_actions_avail)]; 2444 const char *new = names; 2445 const char *old = old_names; 2446 2447 if (!audit_enabled) 2448 return; 2449 2450 memset(names, 0, sizeof(names)); 2451 memset(old_names, 0, sizeof(old_names)); 2452 2453 if (ret) 2454 new = "?"; 2455 else if (!actions_logged) 2456 new = "(none)"; 2457 else if (!seccomp_names_from_actions_logged(names, sizeof(names), 2458 actions_logged, ",")) 2459 new = "?"; 2460 2461 if (!old_actions_logged) 2462 old = "(none)"; 2463 else if (!seccomp_names_from_actions_logged(old_names, 2464 sizeof(old_names), 2465 old_actions_logged, ",")) 2466 old = "?"; 2467 2468 return audit_seccomp_actions_logged(new, old, !ret); 2469 } 2470 2471 static int seccomp_actions_logged_handler(const struct ctl_table *ro_table, int write, 2472 void *buffer, size_t *lenp, 2473 loff_t *ppos) 2474 { 2475 int ret; 2476 2477 if (write) { 2478 u32 actions_logged = 0; 2479 u32 old_actions_logged = seccomp_actions_logged; 2480 2481 ret = write_actions_logged(ro_table, buffer, lenp, ppos, 2482 &actions_logged); 2483 audit_actions_logged(actions_logged, old_actions_logged, ret); 2484 } else 2485 ret = read_actions_logged(ro_table, buffer, lenp, ppos); 2486 2487 return ret; 2488 } 2489 2490 static const struct ctl_table seccomp_sysctl_table[] = { 2491 { 2492 .procname = "actions_avail", 2493 .data = (void *) &seccomp_actions_avail, 2494 .maxlen = sizeof(seccomp_actions_avail), 2495 .mode = 0444, 2496 .proc_handler = proc_dostring, 2497 }, 2498 { 2499 .procname = "actions_logged", 2500 .mode = 0644, 2501 .proc_handler = seccomp_actions_logged_handler, 2502 }, 2503 }; 2504 2505 static int __init seccomp_sysctl_init(void) 2506 { 2507 register_sysctl_init("kernel/seccomp", seccomp_sysctl_table); 2508 return 0; 2509 } 2510 2511 device_initcall(seccomp_sysctl_init) 2512 2513 #endif /* CONFIG_SYSCTL */ 2514 2515 #ifdef CONFIG_SECCOMP_CACHE_DEBUG 2516 /* Currently CONFIG_SECCOMP_CACHE_DEBUG implies SECCOMP_ARCH_NATIVE */ 2517 static void proc_pid_seccomp_cache_arch(struct seq_file *m, const char *name, 2518 const void *bitmap, size_t bitmap_size) 2519 { 2520 int nr; 2521 2522 for (nr = 0; nr < bitmap_size; nr++) { 2523 bool cached = test_bit(nr, bitmap); 2524 char *status = cached ? "ALLOW" : "FILTER"; 2525 2526 seq_printf(m, "%s %d %s\n", name, nr, status); 2527 } 2528 } 2529 2530 int proc_pid_seccomp_cache(struct seq_file *m, struct pid_namespace *ns, 2531 struct pid *pid, struct task_struct *task) 2532 { 2533 struct seccomp_filter *f; 2534 unsigned long flags; 2535 2536 /* 2537 * We don't want some sandboxed process to know what their seccomp 2538 * filters consist of. 2539 */ 2540 if (!file_ns_capable(m->file, &init_user_ns, CAP_SYS_ADMIN)) 2541 return -EACCES; 2542 2543 if (!lock_task_sighand(task, &flags)) 2544 return -ESRCH; 2545 2546 f = READ_ONCE(task->seccomp.filter); 2547 if (!f) { 2548 unlock_task_sighand(task, &flags); 2549 return 0; 2550 } 2551 2552 /* prevent filter from being freed while we are printing it */ 2553 __get_seccomp_filter(f); 2554 unlock_task_sighand(task, &flags); 2555 2556 proc_pid_seccomp_cache_arch(m, SECCOMP_ARCH_NATIVE_NAME, 2557 f->cache.allow_native, 2558 SECCOMP_ARCH_NATIVE_NR); 2559 2560 #ifdef SECCOMP_ARCH_COMPAT 2561 proc_pid_seccomp_cache_arch(m, SECCOMP_ARCH_COMPAT_NAME, 2562 f->cache.allow_compat, 2563 SECCOMP_ARCH_COMPAT_NR); 2564 #endif /* SECCOMP_ARCH_COMPAT */ 2565 2566 __put_seccomp_filter(f); 2567 return 0; 2568 } 2569 #endif /* CONFIG_SECCOMP_CACHE_DEBUG */ 2570