1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * linux/kernel/seccomp.c 4 * 5 * Copyright 2004-2005 Andrea Arcangeli <andrea@cpushare.com> 6 * 7 * Copyright (C) 2012 Google, Inc. 8 * Will Drewry <wad@chromium.org> 9 * 10 * This defines a simple but solid secure-computing facility. 11 * 12 * Mode 1 uses a fixed list of allowed system calls. 13 * Mode 2 allows user-defined system call filters in the form 14 * of Berkeley Packet Filters/Linux Socket Filters. 15 */ 16 #define pr_fmt(fmt) "seccomp: " fmt 17 18 #include <linux/refcount.h> 19 #include <linux/audit.h> 20 #include <linux/compat.h> 21 #include <linux/coredump.h> 22 #include <linux/kmemleak.h> 23 #include <linux/nospec.h> 24 #include <linux/prctl.h> 25 #include <linux/sched.h> 26 #include <linux/sched/task_stack.h> 27 #include <linux/seccomp.h> 28 #include <linux/slab.h> 29 #include <linux/syscalls.h> 30 #include <linux/sysctl.h> 31 32 /* Not exposed in headers: strictly internal use only. */ 33 #define SECCOMP_MODE_DEAD (SECCOMP_MODE_FILTER + 1) 34 35 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER 36 #include <asm/syscall.h> 37 #endif 38 39 #ifdef CONFIG_SECCOMP_FILTER 40 #include <linux/file.h> 41 #include <linux/filter.h> 42 #include <linux/pid.h> 43 #include <linux/ptrace.h> 44 #include <linux/capability.h> 45 #include <linux/uaccess.h> 46 #include <linux/anon_inodes.h> 47 #include <linux/lockdep.h> 48 49 /* 50 * When SECCOMP_IOCTL_NOTIF_ID_VALID was first introduced, it had the 51 * wrong direction flag in the ioctl number. This is the broken one, 52 * which the kernel needs to keep supporting until all userspaces stop 53 * using the wrong command number. 54 */ 55 #define SECCOMP_IOCTL_NOTIF_ID_VALID_WRONG_DIR SECCOMP_IOR(2, __u64) 56 57 enum notify_state { 58 SECCOMP_NOTIFY_INIT, 59 SECCOMP_NOTIFY_SENT, 60 SECCOMP_NOTIFY_REPLIED, 61 }; 62 63 struct seccomp_knotif { 64 /* The struct pid of the task whose filter triggered the notification */ 65 struct task_struct *task; 66 67 /* The "cookie" for this request; this is unique for this filter. */ 68 u64 id; 69 70 /* 71 * The seccomp data. This pointer is valid the entire time this 72 * notification is active, since it comes from __seccomp_filter which 73 * eclipses the entire lifecycle here. 74 */ 75 const struct seccomp_data *data; 76 77 /* 78 * Notification states. When SECCOMP_RET_USER_NOTIF is returned, a 79 * struct seccomp_knotif is created and starts out in INIT. Once the 80 * handler reads the notification off of an FD, it transitions to SENT. 81 * If a signal is received the state transitions back to INIT and 82 * another message is sent. When the userspace handler replies, state 83 * transitions to REPLIED. 84 */ 85 enum notify_state state; 86 87 /* The return values, only valid when in SECCOMP_NOTIFY_REPLIED */ 88 int error; 89 long val; 90 u32 flags; 91 92 /* 93 * Signals when this has changed states, such as the listener 94 * dying, a new seccomp addfd message, or changing to REPLIED 95 */ 96 struct completion ready; 97 98 struct list_head list; 99 100 /* outstanding addfd requests */ 101 struct list_head addfd; 102 }; 103 104 /** 105 * struct seccomp_kaddfd - container for seccomp_addfd ioctl messages 106 * 107 * @file: A reference to the file to install in the other task 108 * @fd: The fd number to install it at. If the fd number is -1, it means the 109 * installing process should allocate the fd as normal. 110 * @flags: The flags for the new file descriptor. At the moment, only O_CLOEXEC 111 * is allowed. 112 * @ioctl_flags: The flags used for the seccomp_addfd ioctl. 113 * @setfd: whether or not SECCOMP_ADDFD_FLAG_SETFD was set during notify_addfd 114 * @ret: The return value of the installing process. It is set to the fd num 115 * upon success (>= 0). 116 * @completion: Indicates that the installing process has completed fd 117 * installation, or gone away (either due to successful 118 * reply, or signal) 119 * @list: list_head for chaining seccomp_kaddfd together. 120 * 121 */ 122 struct seccomp_kaddfd { 123 struct file *file; 124 int fd; 125 unsigned int flags; 126 __u32 ioctl_flags; 127 128 union { 129 bool setfd; 130 /* To only be set on reply */ 131 int ret; 132 }; 133 struct completion completion; 134 struct list_head list; 135 }; 136 137 /** 138 * struct notification - container for seccomp userspace notifications. Since 139 * most seccomp filters will not have notification listeners attached and this 140 * structure is fairly large, we store the notification-specific stuff in a 141 * separate structure. 142 * 143 * @requests: A semaphore that users of this notification can wait on for 144 * changes. Actual reads and writes are still controlled with 145 * filter->notify_lock. 146 * @flags: A set of SECCOMP_USER_NOTIF_FD_* flags. 147 * @next_id: The id of the next request. 148 * @notifications: A list of struct seccomp_knotif elements. 149 */ 150 151 struct notification { 152 atomic_t requests; 153 u32 flags; 154 u64 next_id; 155 struct list_head notifications; 156 }; 157 158 #ifdef SECCOMP_ARCH_NATIVE 159 /** 160 * struct action_cache - per-filter cache of seccomp actions per 161 * arch/syscall pair 162 * 163 * @allow_native: A bitmap where each bit represents whether the 164 * filter will always allow the syscall, for the 165 * native architecture. 166 * @allow_compat: A bitmap where each bit represents whether the 167 * filter will always allow the syscall, for the 168 * compat architecture. 169 */ 170 struct action_cache { 171 DECLARE_BITMAP(allow_native, SECCOMP_ARCH_NATIVE_NR); 172 #ifdef SECCOMP_ARCH_COMPAT 173 DECLARE_BITMAP(allow_compat, SECCOMP_ARCH_COMPAT_NR); 174 #endif 175 }; 176 #else 177 struct action_cache { }; 178 179 static inline bool seccomp_cache_check_allow(const struct seccomp_filter *sfilter, 180 const struct seccomp_data *sd) 181 { 182 return false; 183 } 184 185 static inline void seccomp_cache_prepare(struct seccomp_filter *sfilter) 186 { 187 } 188 #endif /* SECCOMP_ARCH_NATIVE */ 189 190 /** 191 * struct seccomp_filter - container for seccomp BPF programs 192 * 193 * @refs: Reference count to manage the object lifetime. 194 * A filter's reference count is incremented for each directly 195 * attached task, once for the dependent filter, and if 196 * requested for the user notifier. When @refs reaches zero, 197 * the filter can be freed. 198 * @users: A filter's @users count is incremented for each directly 199 * attached task (filter installation, fork(), thread_sync), 200 * and once for the dependent filter (tracked in filter->prev). 201 * When it reaches zero it indicates that no direct or indirect 202 * users of that filter exist. No new tasks can get associated with 203 * this filter after reaching 0. The @users count is always smaller 204 * or equal to @refs. Hence, reaching 0 for @users does not mean 205 * the filter can be freed. 206 * @cache: cache of arch/syscall mappings to actions 207 * @log: true if all actions except for SECCOMP_RET_ALLOW should be logged 208 * @wait_killable_recv: Put notifying process in killable state once the 209 * notification is received by the userspace listener. 210 * @prev: points to a previously installed, or inherited, filter 211 * @prog: the BPF program to evaluate 212 * @notif: the struct that holds all notification related information 213 * @notify_lock: A lock for all notification-related accesses. 214 * @wqh: A wait queue for poll if a notifier is in use. 215 * 216 * seccomp_filter objects are organized in a tree linked via the @prev 217 * pointer. For any task, it appears to be a singly-linked list starting 218 * with current->seccomp.filter, the most recently attached or inherited filter. 219 * However, multiple filters may share a @prev node, by way of fork(), which 220 * results in a unidirectional tree existing in memory. This is similar to 221 * how namespaces work. 222 * 223 * seccomp_filter objects should never be modified after being attached 224 * to a task_struct (other than @refs). 225 */ 226 struct seccomp_filter { 227 refcount_t refs; 228 refcount_t users; 229 bool log; 230 bool wait_killable_recv; 231 struct action_cache cache; 232 struct seccomp_filter *prev; 233 struct bpf_prog *prog; 234 struct notification *notif; 235 struct mutex notify_lock; 236 wait_queue_head_t wqh; 237 }; 238 239 /* Limit any path through the tree to 256KB worth of instructions. */ 240 #define MAX_INSNS_PER_PATH ((1 << 18) / sizeof(struct sock_filter)) 241 242 /* 243 * Endianness is explicitly ignored and left for BPF program authors to manage 244 * as per the specific architecture. 245 */ 246 static void populate_seccomp_data(struct seccomp_data *sd) 247 { 248 /* 249 * Instead of using current_pt_reg(), we're already doing the work 250 * to safely fetch "current", so just use "task" everywhere below. 251 */ 252 struct task_struct *task = current; 253 struct pt_regs *regs = task_pt_regs(task); 254 unsigned long args[6]; 255 256 sd->nr = syscall_get_nr(task, regs); 257 sd->arch = syscall_get_arch(task); 258 syscall_get_arguments(task, regs, args); 259 sd->args[0] = args[0]; 260 sd->args[1] = args[1]; 261 sd->args[2] = args[2]; 262 sd->args[3] = args[3]; 263 sd->args[4] = args[4]; 264 sd->args[5] = args[5]; 265 sd->instruction_pointer = KSTK_EIP(task); 266 } 267 268 /** 269 * seccomp_check_filter - verify seccomp filter code 270 * @filter: filter to verify 271 * @flen: length of filter 272 * 273 * Takes a previously checked filter (by bpf_check_classic) and 274 * redirects all filter code that loads struct sk_buff data 275 * and related data through seccomp_bpf_load. It also 276 * enforces length and alignment checking of those loads. 277 * 278 * Returns 0 if the rule set is legal or -EINVAL if not. 279 */ 280 static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen) 281 { 282 int pc; 283 for (pc = 0; pc < flen; pc++) { 284 struct sock_filter *ftest = &filter[pc]; 285 u16 code = ftest->code; 286 u32 k = ftest->k; 287 288 switch (code) { 289 case BPF_LD | BPF_W | BPF_ABS: 290 ftest->code = BPF_LDX | BPF_W | BPF_ABS; 291 /* 32-bit aligned and not out of bounds. */ 292 if (k >= sizeof(struct seccomp_data) || k & 3) 293 return -EINVAL; 294 continue; 295 case BPF_LD | BPF_W | BPF_LEN: 296 ftest->code = BPF_LD | BPF_IMM; 297 ftest->k = sizeof(struct seccomp_data); 298 continue; 299 case BPF_LDX | BPF_W | BPF_LEN: 300 ftest->code = BPF_LDX | BPF_IMM; 301 ftest->k = sizeof(struct seccomp_data); 302 continue; 303 /* Explicitly include allowed calls. */ 304 case BPF_RET | BPF_K: 305 case BPF_RET | BPF_A: 306 case BPF_ALU | BPF_ADD | BPF_K: 307 case BPF_ALU | BPF_ADD | BPF_X: 308 case BPF_ALU | BPF_SUB | BPF_K: 309 case BPF_ALU | BPF_SUB | BPF_X: 310 case BPF_ALU | BPF_MUL | BPF_K: 311 case BPF_ALU | BPF_MUL | BPF_X: 312 case BPF_ALU | BPF_DIV | BPF_K: 313 case BPF_ALU | BPF_DIV | BPF_X: 314 case BPF_ALU | BPF_AND | BPF_K: 315 case BPF_ALU | BPF_AND | BPF_X: 316 case BPF_ALU | BPF_OR | BPF_K: 317 case BPF_ALU | BPF_OR | BPF_X: 318 case BPF_ALU | BPF_XOR | BPF_K: 319 case BPF_ALU | BPF_XOR | BPF_X: 320 case BPF_ALU | BPF_LSH | BPF_K: 321 case BPF_ALU | BPF_LSH | BPF_X: 322 case BPF_ALU | BPF_RSH | BPF_K: 323 case BPF_ALU | BPF_RSH | BPF_X: 324 case BPF_ALU | BPF_NEG: 325 case BPF_LD | BPF_IMM: 326 case BPF_LDX | BPF_IMM: 327 case BPF_MISC | BPF_TAX: 328 case BPF_MISC | BPF_TXA: 329 case BPF_LD | BPF_MEM: 330 case BPF_LDX | BPF_MEM: 331 case BPF_ST: 332 case BPF_STX: 333 case BPF_JMP | BPF_JA: 334 case BPF_JMP | BPF_JEQ | BPF_K: 335 case BPF_JMP | BPF_JEQ | BPF_X: 336 case BPF_JMP | BPF_JGE | BPF_K: 337 case BPF_JMP | BPF_JGE | BPF_X: 338 case BPF_JMP | BPF_JGT | BPF_K: 339 case BPF_JMP | BPF_JGT | BPF_X: 340 case BPF_JMP | BPF_JSET | BPF_K: 341 case BPF_JMP | BPF_JSET | BPF_X: 342 continue; 343 default: 344 return -EINVAL; 345 } 346 } 347 return 0; 348 } 349 350 #ifdef SECCOMP_ARCH_NATIVE 351 static inline bool seccomp_cache_check_allow_bitmap(const void *bitmap, 352 size_t bitmap_size, 353 int syscall_nr) 354 { 355 if (unlikely(syscall_nr < 0 || syscall_nr >= bitmap_size)) 356 return false; 357 syscall_nr = array_index_nospec(syscall_nr, bitmap_size); 358 359 return test_bit(syscall_nr, bitmap); 360 } 361 362 /** 363 * seccomp_cache_check_allow - lookup seccomp cache 364 * @sfilter: The seccomp filter 365 * @sd: The seccomp data to lookup the cache with 366 * 367 * Returns true if the seccomp_data is cached and allowed. 368 */ 369 static inline bool seccomp_cache_check_allow(const struct seccomp_filter *sfilter, 370 const struct seccomp_data *sd) 371 { 372 int syscall_nr = sd->nr; 373 const struct action_cache *cache = &sfilter->cache; 374 375 #ifndef SECCOMP_ARCH_COMPAT 376 /* A native-only architecture doesn't need to check sd->arch. */ 377 return seccomp_cache_check_allow_bitmap(cache->allow_native, 378 SECCOMP_ARCH_NATIVE_NR, 379 syscall_nr); 380 #else 381 if (likely(sd->arch == SECCOMP_ARCH_NATIVE)) 382 return seccomp_cache_check_allow_bitmap(cache->allow_native, 383 SECCOMP_ARCH_NATIVE_NR, 384 syscall_nr); 385 if (likely(sd->arch == SECCOMP_ARCH_COMPAT)) 386 return seccomp_cache_check_allow_bitmap(cache->allow_compat, 387 SECCOMP_ARCH_COMPAT_NR, 388 syscall_nr); 389 #endif /* SECCOMP_ARCH_COMPAT */ 390 391 WARN_ON_ONCE(true); 392 return false; 393 } 394 #endif /* SECCOMP_ARCH_NATIVE */ 395 396 #define ACTION_ONLY(ret) ((s32)((ret) & (SECCOMP_RET_ACTION_FULL))) 397 /** 398 * seccomp_run_filters - evaluates all seccomp filters against @sd 399 * @sd: optional seccomp data to be passed to filters 400 * @match: stores struct seccomp_filter that resulted in the return value, 401 * unless filter returned SECCOMP_RET_ALLOW, in which case it will 402 * be unchanged. 403 * 404 * Returns valid seccomp BPF response codes. 405 */ 406 static u32 seccomp_run_filters(const struct seccomp_data *sd, 407 struct seccomp_filter **match) 408 { 409 u32 ret = SECCOMP_RET_ALLOW; 410 /* Make sure cross-thread synced filter points somewhere sane. */ 411 struct seccomp_filter *f = 412 READ_ONCE(current->seccomp.filter); 413 414 /* Ensure unexpected behavior doesn't result in failing open. */ 415 if (WARN_ON(f == NULL)) 416 return SECCOMP_RET_KILL_PROCESS; 417 418 if (seccomp_cache_check_allow(f, sd)) 419 return SECCOMP_RET_ALLOW; 420 421 /* 422 * All filters in the list are evaluated and the lowest BPF return 423 * value always takes priority (ignoring the DATA). 424 */ 425 for (; f; f = f->prev) { 426 u32 cur_ret = bpf_prog_run_pin_on_cpu(f->prog, sd); 427 428 if (ACTION_ONLY(cur_ret) < ACTION_ONLY(ret)) { 429 ret = cur_ret; 430 *match = f; 431 } 432 } 433 return ret; 434 } 435 #endif /* CONFIG_SECCOMP_FILTER */ 436 437 static inline bool seccomp_may_assign_mode(unsigned long seccomp_mode) 438 { 439 assert_spin_locked(¤t->sighand->siglock); 440 441 if (current->seccomp.mode && current->seccomp.mode != seccomp_mode) 442 return false; 443 444 return true; 445 } 446 447 void __weak arch_seccomp_spec_mitigate(struct task_struct *task) { } 448 449 static inline void seccomp_assign_mode(struct task_struct *task, 450 unsigned long seccomp_mode, 451 unsigned long flags) 452 { 453 assert_spin_locked(&task->sighand->siglock); 454 455 task->seccomp.mode = seccomp_mode; 456 /* 457 * Make sure SYSCALL_WORK_SECCOMP cannot be set before the mode (and 458 * filter) is set. 459 */ 460 smp_mb__before_atomic(); 461 /* Assume default seccomp processes want spec flaw mitigation. */ 462 if ((flags & SECCOMP_FILTER_FLAG_SPEC_ALLOW) == 0) 463 arch_seccomp_spec_mitigate(task); 464 set_task_syscall_work(task, SECCOMP); 465 } 466 467 #ifdef CONFIG_SECCOMP_FILTER 468 /* Returns 1 if the parent is an ancestor of the child. */ 469 static int is_ancestor(struct seccomp_filter *parent, 470 struct seccomp_filter *child) 471 { 472 /* NULL is the root ancestor. */ 473 if (parent == NULL) 474 return 1; 475 for (; child; child = child->prev) 476 if (child == parent) 477 return 1; 478 return 0; 479 } 480 481 /** 482 * seccomp_can_sync_threads: checks if all threads can be synchronized 483 * 484 * Expects sighand and cred_guard_mutex locks to be held. 485 * 486 * Returns 0 on success, -ve on error, or the pid of a thread which was 487 * either not in the correct seccomp mode or did not have an ancestral 488 * seccomp filter. 489 */ 490 static inline pid_t seccomp_can_sync_threads(void) 491 { 492 struct task_struct *thread, *caller; 493 494 BUG_ON(!mutex_is_locked(¤t->signal->cred_guard_mutex)); 495 assert_spin_locked(¤t->sighand->siglock); 496 497 /* Validate all threads being eligible for synchronization. */ 498 caller = current; 499 for_each_thread(caller, thread) { 500 pid_t failed; 501 502 /* Skip current, since it is initiating the sync. */ 503 if (thread == caller) 504 continue; 505 /* Skip exited threads. */ 506 if (thread->flags & PF_EXITING) 507 continue; 508 509 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED || 510 (thread->seccomp.mode == SECCOMP_MODE_FILTER && 511 is_ancestor(thread->seccomp.filter, 512 caller->seccomp.filter))) 513 continue; 514 515 /* Return the first thread that cannot be synchronized. */ 516 failed = task_pid_vnr(thread); 517 /* If the pid cannot be resolved, then return -ESRCH */ 518 if (WARN_ON(failed == 0)) 519 failed = -ESRCH; 520 return failed; 521 } 522 523 return 0; 524 } 525 526 static inline void seccomp_filter_free(struct seccomp_filter *filter) 527 { 528 if (filter) { 529 bpf_prog_destroy(filter->prog); 530 kfree(filter); 531 } 532 } 533 534 static void __seccomp_filter_orphan(struct seccomp_filter *orig) 535 { 536 while (orig && refcount_dec_and_test(&orig->users)) { 537 if (waitqueue_active(&orig->wqh)) 538 wake_up_poll(&orig->wqh, EPOLLHUP); 539 orig = orig->prev; 540 } 541 } 542 543 static void __put_seccomp_filter(struct seccomp_filter *orig) 544 { 545 /* Clean up single-reference branches iteratively. */ 546 while (orig && refcount_dec_and_test(&orig->refs)) { 547 struct seccomp_filter *freeme = orig; 548 orig = orig->prev; 549 seccomp_filter_free(freeme); 550 } 551 } 552 553 static void __seccomp_filter_release(struct seccomp_filter *orig) 554 { 555 /* Notify about any unused filters in the task's former filter tree. */ 556 __seccomp_filter_orphan(orig); 557 /* Finally drop all references to the task's former tree. */ 558 __put_seccomp_filter(orig); 559 } 560 561 /** 562 * seccomp_filter_release - Detach the task from its filter tree, 563 * drop its reference count, and notify 564 * about unused filters 565 * 566 * @tsk: task the filter should be released from. 567 * 568 * This function should only be called when the task is exiting as 569 * it detaches it from its filter tree. PF_EXITING has to be set 570 * for the task. 571 */ 572 void seccomp_filter_release(struct task_struct *tsk) 573 { 574 struct seccomp_filter *orig; 575 576 if (WARN_ON((tsk->flags & PF_EXITING) == 0)) 577 return; 578 579 spin_lock_irq(&tsk->sighand->siglock); 580 orig = tsk->seccomp.filter; 581 /* Detach task from its filter tree. */ 582 tsk->seccomp.filter = NULL; 583 spin_unlock_irq(&tsk->sighand->siglock); 584 __seccomp_filter_release(orig); 585 } 586 587 /** 588 * seccomp_sync_threads: sets all threads to use current's filter 589 * 590 * @flags: SECCOMP_FILTER_FLAG_* flags to set during sync. 591 * 592 * Expects sighand and cred_guard_mutex locks to be held, and for 593 * seccomp_can_sync_threads() to have returned success already 594 * without dropping the locks. 595 * 596 */ 597 static inline void seccomp_sync_threads(unsigned long flags) 598 { 599 struct task_struct *thread, *caller; 600 601 BUG_ON(!mutex_is_locked(¤t->signal->cred_guard_mutex)); 602 assert_spin_locked(¤t->sighand->siglock); 603 604 /* Synchronize all threads. */ 605 caller = current; 606 for_each_thread(caller, thread) { 607 /* Skip current, since it needs no changes. */ 608 if (thread == caller) 609 continue; 610 611 /* 612 * Skip exited threads. seccomp_filter_release could have 613 * been already called for this task. 614 */ 615 if (thread->flags & PF_EXITING) 616 continue; 617 618 /* Get a task reference for the new leaf node. */ 619 get_seccomp_filter(caller); 620 621 /* 622 * Drop the task reference to the shared ancestor since 623 * current's path will hold a reference. (This also 624 * allows a put before the assignment.) 625 */ 626 __seccomp_filter_release(thread->seccomp.filter); 627 628 /* Make our new filter tree visible. */ 629 smp_store_release(&thread->seccomp.filter, 630 caller->seccomp.filter); 631 atomic_set(&thread->seccomp.filter_count, 632 atomic_read(&caller->seccomp.filter_count)); 633 634 /* 635 * Don't let an unprivileged task work around 636 * the no_new_privs restriction by creating 637 * a thread that sets it up, enters seccomp, 638 * then dies. 639 */ 640 if (task_no_new_privs(caller)) 641 task_set_no_new_privs(thread); 642 643 /* 644 * Opt the other thread into seccomp if needed. 645 * As threads are considered to be trust-realm 646 * equivalent (see ptrace_may_access), it is safe to 647 * allow one thread to transition the other. 648 */ 649 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED) 650 seccomp_assign_mode(thread, SECCOMP_MODE_FILTER, 651 flags); 652 } 653 } 654 655 /** 656 * seccomp_prepare_filter: Prepares a seccomp filter for use. 657 * @fprog: BPF program to install 658 * 659 * Returns filter on success or an ERR_PTR on failure. 660 */ 661 static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog) 662 { 663 struct seccomp_filter *sfilter; 664 int ret; 665 const bool save_orig = 666 #if defined(CONFIG_CHECKPOINT_RESTORE) || defined(SECCOMP_ARCH_NATIVE) 667 true; 668 #else 669 false; 670 #endif 671 672 if (fprog->len == 0 || fprog->len > BPF_MAXINSNS) 673 return ERR_PTR(-EINVAL); 674 675 BUG_ON(INT_MAX / fprog->len < sizeof(struct sock_filter)); 676 677 /* 678 * Installing a seccomp filter requires that the task has 679 * CAP_SYS_ADMIN in its namespace or be running with no_new_privs. 680 * This avoids scenarios where unprivileged tasks can affect the 681 * behavior of privileged children. 682 */ 683 if (!task_no_new_privs(current) && 684 !ns_capable_noaudit(current_user_ns(), CAP_SYS_ADMIN)) 685 return ERR_PTR(-EACCES); 686 687 /* Allocate a new seccomp_filter */ 688 sfilter = kzalloc(sizeof(*sfilter), GFP_KERNEL | __GFP_NOWARN); 689 if (!sfilter) 690 return ERR_PTR(-ENOMEM); 691 692 mutex_init(&sfilter->notify_lock); 693 ret = bpf_prog_create_from_user(&sfilter->prog, fprog, 694 seccomp_check_filter, save_orig); 695 if (ret < 0) { 696 kfree(sfilter); 697 return ERR_PTR(ret); 698 } 699 700 refcount_set(&sfilter->refs, 1); 701 refcount_set(&sfilter->users, 1); 702 init_waitqueue_head(&sfilter->wqh); 703 704 return sfilter; 705 } 706 707 /** 708 * seccomp_prepare_user_filter - prepares a user-supplied sock_fprog 709 * @user_filter: pointer to the user data containing a sock_fprog. 710 * 711 * Returns 0 on success and non-zero otherwise. 712 */ 713 static struct seccomp_filter * 714 seccomp_prepare_user_filter(const char __user *user_filter) 715 { 716 struct sock_fprog fprog; 717 struct seccomp_filter *filter = ERR_PTR(-EFAULT); 718 719 #ifdef CONFIG_COMPAT 720 if (in_compat_syscall()) { 721 struct compat_sock_fprog fprog32; 722 if (copy_from_user(&fprog32, user_filter, sizeof(fprog32))) 723 goto out; 724 fprog.len = fprog32.len; 725 fprog.filter = compat_ptr(fprog32.filter); 726 } else /* falls through to the if below. */ 727 #endif 728 if (copy_from_user(&fprog, user_filter, sizeof(fprog))) 729 goto out; 730 filter = seccomp_prepare_filter(&fprog); 731 out: 732 return filter; 733 } 734 735 #ifdef SECCOMP_ARCH_NATIVE 736 /** 737 * seccomp_is_const_allow - check if filter is constant allow with given data 738 * @fprog: The BPF programs 739 * @sd: The seccomp data to check against, only syscall number and arch 740 * number are considered constant. 741 */ 742 static bool seccomp_is_const_allow(struct sock_fprog_kern *fprog, 743 struct seccomp_data *sd) 744 { 745 unsigned int reg_value = 0; 746 unsigned int pc; 747 bool op_res; 748 749 if (WARN_ON_ONCE(!fprog)) 750 return false; 751 752 for (pc = 0; pc < fprog->len; pc++) { 753 struct sock_filter *insn = &fprog->filter[pc]; 754 u16 code = insn->code; 755 u32 k = insn->k; 756 757 switch (code) { 758 case BPF_LD | BPF_W | BPF_ABS: 759 switch (k) { 760 case offsetof(struct seccomp_data, nr): 761 reg_value = sd->nr; 762 break; 763 case offsetof(struct seccomp_data, arch): 764 reg_value = sd->arch; 765 break; 766 default: 767 /* can't optimize (non-constant value load) */ 768 return false; 769 } 770 break; 771 case BPF_RET | BPF_K: 772 /* reached return with constant values only, check allow */ 773 return k == SECCOMP_RET_ALLOW; 774 case BPF_JMP | BPF_JA: 775 pc += insn->k; 776 break; 777 case BPF_JMP | BPF_JEQ | BPF_K: 778 case BPF_JMP | BPF_JGE | BPF_K: 779 case BPF_JMP | BPF_JGT | BPF_K: 780 case BPF_JMP | BPF_JSET | BPF_K: 781 switch (BPF_OP(code)) { 782 case BPF_JEQ: 783 op_res = reg_value == k; 784 break; 785 case BPF_JGE: 786 op_res = reg_value >= k; 787 break; 788 case BPF_JGT: 789 op_res = reg_value > k; 790 break; 791 case BPF_JSET: 792 op_res = !!(reg_value & k); 793 break; 794 default: 795 /* can't optimize (unknown jump) */ 796 return false; 797 } 798 799 pc += op_res ? insn->jt : insn->jf; 800 break; 801 case BPF_ALU | BPF_AND | BPF_K: 802 reg_value &= k; 803 break; 804 default: 805 /* can't optimize (unknown insn) */ 806 return false; 807 } 808 } 809 810 /* ran off the end of the filter?! */ 811 WARN_ON(1); 812 return false; 813 } 814 815 static void seccomp_cache_prepare_bitmap(struct seccomp_filter *sfilter, 816 void *bitmap, const void *bitmap_prev, 817 size_t bitmap_size, int arch) 818 { 819 struct sock_fprog_kern *fprog = sfilter->prog->orig_prog; 820 struct seccomp_data sd; 821 int nr; 822 823 if (bitmap_prev) { 824 /* The new filter must be as restrictive as the last. */ 825 bitmap_copy(bitmap, bitmap_prev, bitmap_size); 826 } else { 827 /* Before any filters, all syscalls are always allowed. */ 828 bitmap_fill(bitmap, bitmap_size); 829 } 830 831 for (nr = 0; nr < bitmap_size; nr++) { 832 /* No bitmap change: not a cacheable action. */ 833 if (!test_bit(nr, bitmap)) 834 continue; 835 836 sd.nr = nr; 837 sd.arch = arch; 838 839 /* No bitmap change: continue to always allow. */ 840 if (seccomp_is_const_allow(fprog, &sd)) 841 continue; 842 843 /* 844 * Not a cacheable action: always run filters. 845 * atomic clear_bit() not needed, filter not visible yet. 846 */ 847 __clear_bit(nr, bitmap); 848 } 849 } 850 851 /** 852 * seccomp_cache_prepare - emulate the filter to find cacheable syscalls 853 * @sfilter: The seccomp filter 854 * 855 * Returns 0 if successful or -errno if error occurred. 856 */ 857 static void seccomp_cache_prepare(struct seccomp_filter *sfilter) 858 { 859 struct action_cache *cache = &sfilter->cache; 860 const struct action_cache *cache_prev = 861 sfilter->prev ? &sfilter->prev->cache : NULL; 862 863 seccomp_cache_prepare_bitmap(sfilter, cache->allow_native, 864 cache_prev ? cache_prev->allow_native : NULL, 865 SECCOMP_ARCH_NATIVE_NR, 866 SECCOMP_ARCH_NATIVE); 867 868 #ifdef SECCOMP_ARCH_COMPAT 869 seccomp_cache_prepare_bitmap(sfilter, cache->allow_compat, 870 cache_prev ? cache_prev->allow_compat : NULL, 871 SECCOMP_ARCH_COMPAT_NR, 872 SECCOMP_ARCH_COMPAT); 873 #endif /* SECCOMP_ARCH_COMPAT */ 874 } 875 #endif /* SECCOMP_ARCH_NATIVE */ 876 877 /** 878 * seccomp_attach_filter: validate and attach filter 879 * @flags: flags to change filter behavior 880 * @filter: seccomp filter to add to the current process 881 * 882 * Caller must be holding current->sighand->siglock lock. 883 * 884 * Returns 0 on success, -ve on error, or 885 * - in TSYNC mode: the pid of a thread which was either not in the correct 886 * seccomp mode or did not have an ancestral seccomp filter 887 * - in NEW_LISTENER mode: the fd of the new listener 888 */ 889 static long seccomp_attach_filter(unsigned int flags, 890 struct seccomp_filter *filter) 891 { 892 unsigned long total_insns; 893 struct seccomp_filter *walker; 894 895 assert_spin_locked(¤t->sighand->siglock); 896 897 /* Validate resulting filter length. */ 898 total_insns = filter->prog->len; 899 for (walker = current->seccomp.filter; walker; walker = walker->prev) 900 total_insns += walker->prog->len + 4; /* 4 instr penalty */ 901 if (total_insns > MAX_INSNS_PER_PATH) 902 return -ENOMEM; 903 904 /* If thread sync has been requested, check that it is possible. */ 905 if (flags & SECCOMP_FILTER_FLAG_TSYNC) { 906 int ret; 907 908 ret = seccomp_can_sync_threads(); 909 if (ret) { 910 if (flags & SECCOMP_FILTER_FLAG_TSYNC_ESRCH) 911 return -ESRCH; 912 else 913 return ret; 914 } 915 } 916 917 /* Set log flag, if present. */ 918 if (flags & SECCOMP_FILTER_FLAG_LOG) 919 filter->log = true; 920 921 /* Set wait killable flag, if present. */ 922 if (flags & SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV) 923 filter->wait_killable_recv = true; 924 925 /* 926 * If there is an existing filter, make it the prev and don't drop its 927 * task reference. 928 */ 929 filter->prev = current->seccomp.filter; 930 seccomp_cache_prepare(filter); 931 current->seccomp.filter = filter; 932 atomic_inc(¤t->seccomp.filter_count); 933 934 /* Now that the new filter is in place, synchronize to all threads. */ 935 if (flags & SECCOMP_FILTER_FLAG_TSYNC) 936 seccomp_sync_threads(flags); 937 938 return 0; 939 } 940 941 static void __get_seccomp_filter(struct seccomp_filter *filter) 942 { 943 refcount_inc(&filter->refs); 944 } 945 946 /* get_seccomp_filter - increments the reference count of the filter on @tsk */ 947 void get_seccomp_filter(struct task_struct *tsk) 948 { 949 struct seccomp_filter *orig = tsk->seccomp.filter; 950 if (!orig) 951 return; 952 __get_seccomp_filter(orig); 953 refcount_inc(&orig->users); 954 } 955 956 #endif /* CONFIG_SECCOMP_FILTER */ 957 958 /* For use with seccomp_actions_logged */ 959 #define SECCOMP_LOG_KILL_PROCESS (1 << 0) 960 #define SECCOMP_LOG_KILL_THREAD (1 << 1) 961 #define SECCOMP_LOG_TRAP (1 << 2) 962 #define SECCOMP_LOG_ERRNO (1 << 3) 963 #define SECCOMP_LOG_TRACE (1 << 4) 964 #define SECCOMP_LOG_LOG (1 << 5) 965 #define SECCOMP_LOG_ALLOW (1 << 6) 966 #define SECCOMP_LOG_USER_NOTIF (1 << 7) 967 968 static u32 seccomp_actions_logged = SECCOMP_LOG_KILL_PROCESS | 969 SECCOMP_LOG_KILL_THREAD | 970 SECCOMP_LOG_TRAP | 971 SECCOMP_LOG_ERRNO | 972 SECCOMP_LOG_USER_NOTIF | 973 SECCOMP_LOG_TRACE | 974 SECCOMP_LOG_LOG; 975 976 static inline void seccomp_log(unsigned long syscall, long signr, u32 action, 977 bool requested) 978 { 979 bool log = false; 980 981 switch (action) { 982 case SECCOMP_RET_ALLOW: 983 break; 984 case SECCOMP_RET_TRAP: 985 log = requested && seccomp_actions_logged & SECCOMP_LOG_TRAP; 986 break; 987 case SECCOMP_RET_ERRNO: 988 log = requested && seccomp_actions_logged & SECCOMP_LOG_ERRNO; 989 break; 990 case SECCOMP_RET_TRACE: 991 log = requested && seccomp_actions_logged & SECCOMP_LOG_TRACE; 992 break; 993 case SECCOMP_RET_USER_NOTIF: 994 log = requested && seccomp_actions_logged & SECCOMP_LOG_USER_NOTIF; 995 break; 996 case SECCOMP_RET_LOG: 997 log = seccomp_actions_logged & SECCOMP_LOG_LOG; 998 break; 999 case SECCOMP_RET_KILL_THREAD: 1000 log = seccomp_actions_logged & SECCOMP_LOG_KILL_THREAD; 1001 break; 1002 case SECCOMP_RET_KILL_PROCESS: 1003 default: 1004 log = seccomp_actions_logged & SECCOMP_LOG_KILL_PROCESS; 1005 } 1006 1007 /* 1008 * Emit an audit message when the action is RET_KILL_*, RET_LOG, or the 1009 * FILTER_FLAG_LOG bit was set. The admin has the ability to silence 1010 * any action from being logged by removing the action name from the 1011 * seccomp_actions_logged sysctl. 1012 */ 1013 if (!log) 1014 return; 1015 1016 audit_seccomp(syscall, signr, action); 1017 } 1018 1019 /* 1020 * Secure computing mode 1 allows only read/write/exit/sigreturn. 1021 * To be fully secure this must be combined with rlimit 1022 * to limit the stack allocations too. 1023 */ 1024 static const int mode1_syscalls[] = { 1025 __NR_seccomp_read, __NR_seccomp_write, __NR_seccomp_exit, __NR_seccomp_sigreturn, 1026 -1, /* negative terminated */ 1027 }; 1028 1029 static void __secure_computing_strict(int this_syscall) 1030 { 1031 const int *allowed_syscalls = mode1_syscalls; 1032 #ifdef CONFIG_COMPAT 1033 if (in_compat_syscall()) 1034 allowed_syscalls = get_compat_mode1_syscalls(); 1035 #endif 1036 do { 1037 if (*allowed_syscalls == this_syscall) 1038 return; 1039 } while (*++allowed_syscalls != -1); 1040 1041 #ifdef SECCOMP_DEBUG 1042 dump_stack(); 1043 #endif 1044 current->seccomp.mode = SECCOMP_MODE_DEAD; 1045 seccomp_log(this_syscall, SIGKILL, SECCOMP_RET_KILL_THREAD, true); 1046 do_exit(SIGKILL); 1047 } 1048 1049 #ifndef CONFIG_HAVE_ARCH_SECCOMP_FILTER 1050 void secure_computing_strict(int this_syscall) 1051 { 1052 int mode = current->seccomp.mode; 1053 1054 if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) && 1055 unlikely(current->ptrace & PT_SUSPEND_SECCOMP)) 1056 return; 1057 1058 if (mode == SECCOMP_MODE_DISABLED) 1059 return; 1060 else if (mode == SECCOMP_MODE_STRICT) 1061 __secure_computing_strict(this_syscall); 1062 else 1063 BUG(); 1064 } 1065 #else 1066 1067 #ifdef CONFIG_SECCOMP_FILTER 1068 static u64 seccomp_next_notify_id(struct seccomp_filter *filter) 1069 { 1070 /* 1071 * Note: overflow is ok here, the id just needs to be unique per 1072 * filter. 1073 */ 1074 lockdep_assert_held(&filter->notify_lock); 1075 return filter->notif->next_id++; 1076 } 1077 1078 static void seccomp_handle_addfd(struct seccomp_kaddfd *addfd, struct seccomp_knotif *n) 1079 { 1080 int fd; 1081 1082 /* 1083 * Remove the notification, and reset the list pointers, indicating 1084 * that it has been handled. 1085 */ 1086 list_del_init(&addfd->list); 1087 if (!addfd->setfd) 1088 fd = receive_fd(addfd->file, NULL, addfd->flags); 1089 else 1090 fd = receive_fd_replace(addfd->fd, addfd->file, addfd->flags); 1091 addfd->ret = fd; 1092 1093 if (addfd->ioctl_flags & SECCOMP_ADDFD_FLAG_SEND) { 1094 /* If we fail reset and return an error to the notifier */ 1095 if (fd < 0) { 1096 n->state = SECCOMP_NOTIFY_SENT; 1097 } else { 1098 /* Return the FD we just added */ 1099 n->flags = 0; 1100 n->error = 0; 1101 n->val = fd; 1102 } 1103 } 1104 1105 /* 1106 * Mark the notification as completed. From this point, addfd mem 1107 * might be invalidated and we can't safely read it anymore. 1108 */ 1109 complete(&addfd->completion); 1110 } 1111 1112 static bool should_sleep_killable(struct seccomp_filter *match, 1113 struct seccomp_knotif *n) 1114 { 1115 return match->wait_killable_recv && n->state == SECCOMP_NOTIFY_SENT; 1116 } 1117 1118 static int seccomp_do_user_notification(int this_syscall, 1119 struct seccomp_filter *match, 1120 const struct seccomp_data *sd) 1121 { 1122 int err; 1123 u32 flags = 0; 1124 long ret = 0; 1125 struct seccomp_knotif n = {}; 1126 struct seccomp_kaddfd *addfd, *tmp; 1127 1128 mutex_lock(&match->notify_lock); 1129 err = -ENOSYS; 1130 if (!match->notif) 1131 goto out; 1132 1133 n.task = current; 1134 n.state = SECCOMP_NOTIFY_INIT; 1135 n.data = sd; 1136 n.id = seccomp_next_notify_id(match); 1137 init_completion(&n.ready); 1138 list_add_tail(&n.list, &match->notif->notifications); 1139 INIT_LIST_HEAD(&n.addfd); 1140 1141 atomic_inc(&match->notif->requests); 1142 if (match->notif->flags & SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP) 1143 wake_up_poll_on_current_cpu(&match->wqh, EPOLLIN | EPOLLRDNORM); 1144 else 1145 wake_up_poll(&match->wqh, EPOLLIN | EPOLLRDNORM); 1146 1147 /* 1148 * This is where we wait for a reply from userspace. 1149 */ 1150 do { 1151 bool wait_killable = should_sleep_killable(match, &n); 1152 1153 mutex_unlock(&match->notify_lock); 1154 if (wait_killable) 1155 err = wait_for_completion_killable(&n.ready); 1156 else 1157 err = wait_for_completion_interruptible(&n.ready); 1158 mutex_lock(&match->notify_lock); 1159 1160 if (err != 0) { 1161 /* 1162 * Check to see if the notifcation got picked up and 1163 * whether we should switch to wait killable. 1164 */ 1165 if (!wait_killable && should_sleep_killable(match, &n)) 1166 continue; 1167 1168 goto interrupted; 1169 } 1170 1171 addfd = list_first_entry_or_null(&n.addfd, 1172 struct seccomp_kaddfd, list); 1173 /* Check if we were woken up by a addfd message */ 1174 if (addfd) 1175 seccomp_handle_addfd(addfd, &n); 1176 1177 } while (n.state != SECCOMP_NOTIFY_REPLIED); 1178 1179 ret = n.val; 1180 err = n.error; 1181 flags = n.flags; 1182 1183 interrupted: 1184 /* If there were any pending addfd calls, clear them out */ 1185 list_for_each_entry_safe(addfd, tmp, &n.addfd, list) { 1186 /* The process went away before we got a chance to handle it */ 1187 addfd->ret = -ESRCH; 1188 list_del_init(&addfd->list); 1189 complete(&addfd->completion); 1190 } 1191 1192 /* 1193 * Note that it's possible the listener died in between the time when 1194 * we were notified of a response (or a signal) and when we were able to 1195 * re-acquire the lock, so only delete from the list if the 1196 * notification actually exists. 1197 * 1198 * Also note that this test is only valid because there's no way to 1199 * *reattach* to a notifier right now. If one is added, we'll need to 1200 * keep track of the notif itself and make sure they match here. 1201 */ 1202 if (match->notif) 1203 list_del(&n.list); 1204 out: 1205 mutex_unlock(&match->notify_lock); 1206 1207 /* Userspace requests to continue the syscall. */ 1208 if (flags & SECCOMP_USER_NOTIF_FLAG_CONTINUE) 1209 return 0; 1210 1211 syscall_set_return_value(current, current_pt_regs(), 1212 err, ret); 1213 return -1; 1214 } 1215 1216 static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd, 1217 const bool recheck_after_trace) 1218 { 1219 u32 filter_ret, action; 1220 struct seccomp_filter *match = NULL; 1221 int data; 1222 struct seccomp_data sd_local; 1223 1224 /* 1225 * Make sure that any changes to mode from another thread have 1226 * been seen after SYSCALL_WORK_SECCOMP was seen. 1227 */ 1228 smp_rmb(); 1229 1230 if (!sd) { 1231 populate_seccomp_data(&sd_local); 1232 sd = &sd_local; 1233 } 1234 1235 filter_ret = seccomp_run_filters(sd, &match); 1236 data = filter_ret & SECCOMP_RET_DATA; 1237 action = filter_ret & SECCOMP_RET_ACTION_FULL; 1238 1239 switch (action) { 1240 case SECCOMP_RET_ERRNO: 1241 /* Set low-order bits as an errno, capped at MAX_ERRNO. */ 1242 if (data > MAX_ERRNO) 1243 data = MAX_ERRNO; 1244 syscall_set_return_value(current, current_pt_regs(), 1245 -data, 0); 1246 goto skip; 1247 1248 case SECCOMP_RET_TRAP: 1249 /* Show the handler the original registers. */ 1250 syscall_rollback(current, current_pt_regs()); 1251 /* Let the filter pass back 16 bits of data. */ 1252 force_sig_seccomp(this_syscall, data, false); 1253 goto skip; 1254 1255 case SECCOMP_RET_TRACE: 1256 /* We've been put in this state by the ptracer already. */ 1257 if (recheck_after_trace) 1258 return 0; 1259 1260 /* ENOSYS these calls if there is no tracer attached. */ 1261 if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP)) { 1262 syscall_set_return_value(current, 1263 current_pt_regs(), 1264 -ENOSYS, 0); 1265 goto skip; 1266 } 1267 1268 /* Allow the BPF to provide the event message */ 1269 ptrace_event(PTRACE_EVENT_SECCOMP, data); 1270 /* 1271 * The delivery of a fatal signal during event 1272 * notification may silently skip tracer notification, 1273 * which could leave us with a potentially unmodified 1274 * syscall that the tracer would have liked to have 1275 * changed. Since the process is about to die, we just 1276 * force the syscall to be skipped and let the signal 1277 * kill the process and correctly handle any tracer exit 1278 * notifications. 1279 */ 1280 if (fatal_signal_pending(current)) 1281 goto skip; 1282 /* Check if the tracer forced the syscall to be skipped. */ 1283 this_syscall = syscall_get_nr(current, current_pt_regs()); 1284 if (this_syscall < 0) 1285 goto skip; 1286 1287 /* 1288 * Recheck the syscall, since it may have changed. This 1289 * intentionally uses a NULL struct seccomp_data to force 1290 * a reload of all registers. This does not goto skip since 1291 * a skip would have already been reported. 1292 */ 1293 if (__seccomp_filter(this_syscall, NULL, true)) 1294 return -1; 1295 1296 return 0; 1297 1298 case SECCOMP_RET_USER_NOTIF: 1299 if (seccomp_do_user_notification(this_syscall, match, sd)) 1300 goto skip; 1301 1302 return 0; 1303 1304 case SECCOMP_RET_LOG: 1305 seccomp_log(this_syscall, 0, action, true); 1306 return 0; 1307 1308 case SECCOMP_RET_ALLOW: 1309 /* 1310 * Note that the "match" filter will always be NULL for 1311 * this action since SECCOMP_RET_ALLOW is the starting 1312 * state in seccomp_run_filters(). 1313 */ 1314 return 0; 1315 1316 case SECCOMP_RET_KILL_THREAD: 1317 case SECCOMP_RET_KILL_PROCESS: 1318 default: 1319 current->seccomp.mode = SECCOMP_MODE_DEAD; 1320 seccomp_log(this_syscall, SIGSYS, action, true); 1321 /* Dump core only if this is the last remaining thread. */ 1322 if (action != SECCOMP_RET_KILL_THREAD || 1323 (atomic_read(¤t->signal->live) == 1)) { 1324 /* Show the original registers in the dump. */ 1325 syscall_rollback(current, current_pt_regs()); 1326 /* Trigger a coredump with SIGSYS */ 1327 force_sig_seccomp(this_syscall, data, true); 1328 } else { 1329 do_exit(SIGSYS); 1330 } 1331 return -1; /* skip the syscall go directly to signal handling */ 1332 } 1333 1334 unreachable(); 1335 1336 skip: 1337 seccomp_log(this_syscall, 0, action, match ? match->log : false); 1338 return -1; 1339 } 1340 #else 1341 static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd, 1342 const bool recheck_after_trace) 1343 { 1344 BUG(); 1345 1346 return -1; 1347 } 1348 #endif 1349 1350 int __secure_computing(const struct seccomp_data *sd) 1351 { 1352 int mode = current->seccomp.mode; 1353 int this_syscall; 1354 1355 if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) && 1356 unlikely(current->ptrace & PT_SUSPEND_SECCOMP)) 1357 return 0; 1358 1359 this_syscall = sd ? sd->nr : 1360 syscall_get_nr(current, current_pt_regs()); 1361 1362 switch (mode) { 1363 case SECCOMP_MODE_STRICT: 1364 __secure_computing_strict(this_syscall); /* may call do_exit */ 1365 return 0; 1366 case SECCOMP_MODE_FILTER: 1367 return __seccomp_filter(this_syscall, sd, false); 1368 /* Surviving SECCOMP_RET_KILL_* must be proactively impossible. */ 1369 case SECCOMP_MODE_DEAD: 1370 WARN_ON_ONCE(1); 1371 do_exit(SIGKILL); 1372 return -1; 1373 default: 1374 BUG(); 1375 } 1376 } 1377 #endif /* CONFIG_HAVE_ARCH_SECCOMP_FILTER */ 1378 1379 long prctl_get_seccomp(void) 1380 { 1381 return current->seccomp.mode; 1382 } 1383 1384 /** 1385 * seccomp_set_mode_strict: internal function for setting strict seccomp 1386 * 1387 * Once current->seccomp.mode is non-zero, it may not be changed. 1388 * 1389 * Returns 0 on success or -EINVAL on failure. 1390 */ 1391 static long seccomp_set_mode_strict(void) 1392 { 1393 const unsigned long seccomp_mode = SECCOMP_MODE_STRICT; 1394 long ret = -EINVAL; 1395 1396 spin_lock_irq(¤t->sighand->siglock); 1397 1398 if (!seccomp_may_assign_mode(seccomp_mode)) 1399 goto out; 1400 1401 #ifdef TIF_NOTSC 1402 disable_TSC(); 1403 #endif 1404 seccomp_assign_mode(current, seccomp_mode, 0); 1405 ret = 0; 1406 1407 out: 1408 spin_unlock_irq(¤t->sighand->siglock); 1409 1410 return ret; 1411 } 1412 1413 #ifdef CONFIG_SECCOMP_FILTER 1414 static void seccomp_notify_free(struct seccomp_filter *filter) 1415 { 1416 kfree(filter->notif); 1417 filter->notif = NULL; 1418 } 1419 1420 static void seccomp_notify_detach(struct seccomp_filter *filter) 1421 { 1422 struct seccomp_knotif *knotif; 1423 1424 if (!filter) 1425 return; 1426 1427 mutex_lock(&filter->notify_lock); 1428 1429 /* 1430 * If this file is being closed because e.g. the task who owned it 1431 * died, let's wake everyone up who was waiting on us. 1432 */ 1433 list_for_each_entry(knotif, &filter->notif->notifications, list) { 1434 if (knotif->state == SECCOMP_NOTIFY_REPLIED) 1435 continue; 1436 1437 knotif->state = SECCOMP_NOTIFY_REPLIED; 1438 knotif->error = -ENOSYS; 1439 knotif->val = 0; 1440 1441 /* 1442 * We do not need to wake up any pending addfd messages, as 1443 * the notifier will do that for us, as this just looks 1444 * like a standard reply. 1445 */ 1446 complete(&knotif->ready); 1447 } 1448 1449 seccomp_notify_free(filter); 1450 mutex_unlock(&filter->notify_lock); 1451 } 1452 1453 static int seccomp_notify_release(struct inode *inode, struct file *file) 1454 { 1455 struct seccomp_filter *filter = file->private_data; 1456 1457 seccomp_notify_detach(filter); 1458 __put_seccomp_filter(filter); 1459 return 0; 1460 } 1461 1462 /* must be called with notif_lock held */ 1463 static inline struct seccomp_knotif * 1464 find_notification(struct seccomp_filter *filter, u64 id) 1465 { 1466 struct seccomp_knotif *cur; 1467 1468 lockdep_assert_held(&filter->notify_lock); 1469 1470 list_for_each_entry(cur, &filter->notif->notifications, list) { 1471 if (cur->id == id) 1472 return cur; 1473 } 1474 1475 return NULL; 1476 } 1477 1478 static int recv_wake_function(wait_queue_entry_t *wait, unsigned int mode, int sync, 1479 void *key) 1480 { 1481 /* Avoid a wakeup if event not interesting for us. */ 1482 if (key && !(key_to_poll(key) & (EPOLLIN | EPOLLERR | EPOLLHUP))) 1483 return 0; 1484 return autoremove_wake_function(wait, mode, sync, key); 1485 } 1486 1487 static int recv_wait_event(struct seccomp_filter *filter) 1488 { 1489 DEFINE_WAIT_FUNC(wait, recv_wake_function); 1490 int ret; 1491 1492 if (refcount_read(&filter->users) == 0) 1493 return 0; 1494 1495 if (atomic_dec_if_positive(&filter->notif->requests) >= 0) 1496 return 0; 1497 1498 for (;;) { 1499 ret = prepare_to_wait_event(&filter->wqh, &wait, TASK_INTERRUPTIBLE); 1500 1501 if (atomic_dec_if_positive(&filter->notif->requests) >= 0) 1502 break; 1503 if (refcount_read(&filter->users) == 0) 1504 break; 1505 1506 if (ret) 1507 return ret; 1508 1509 schedule(); 1510 } 1511 finish_wait(&filter->wqh, &wait); 1512 return 0; 1513 } 1514 1515 static long seccomp_notify_recv(struct seccomp_filter *filter, 1516 void __user *buf) 1517 { 1518 struct seccomp_knotif *knotif = NULL, *cur; 1519 struct seccomp_notif unotif; 1520 ssize_t ret; 1521 1522 /* Verify that we're not given garbage to keep struct extensible. */ 1523 ret = check_zeroed_user(buf, sizeof(unotif)); 1524 if (ret < 0) 1525 return ret; 1526 if (!ret) 1527 return -EINVAL; 1528 1529 memset(&unotif, 0, sizeof(unotif)); 1530 1531 ret = recv_wait_event(filter); 1532 if (ret < 0) 1533 return ret; 1534 1535 mutex_lock(&filter->notify_lock); 1536 list_for_each_entry(cur, &filter->notif->notifications, list) { 1537 if (cur->state == SECCOMP_NOTIFY_INIT) { 1538 knotif = cur; 1539 break; 1540 } 1541 } 1542 1543 /* 1544 * If we didn't find a notification, it could be that the task was 1545 * interrupted by a fatal signal between the time we were woken and 1546 * when we were able to acquire the rw lock. 1547 */ 1548 if (!knotif) { 1549 ret = -ENOENT; 1550 goto out; 1551 } 1552 1553 unotif.id = knotif->id; 1554 unotif.pid = task_pid_vnr(knotif->task); 1555 unotif.data = *(knotif->data); 1556 1557 knotif->state = SECCOMP_NOTIFY_SENT; 1558 wake_up_poll(&filter->wqh, EPOLLOUT | EPOLLWRNORM); 1559 ret = 0; 1560 out: 1561 mutex_unlock(&filter->notify_lock); 1562 1563 if (ret == 0 && copy_to_user(buf, &unotif, sizeof(unotif))) { 1564 ret = -EFAULT; 1565 1566 /* 1567 * Userspace screwed up. To make sure that we keep this 1568 * notification alive, let's reset it back to INIT. It 1569 * may have died when we released the lock, so we need to make 1570 * sure it's still around. 1571 */ 1572 mutex_lock(&filter->notify_lock); 1573 knotif = find_notification(filter, unotif.id); 1574 if (knotif) { 1575 /* Reset the process to make sure it's not stuck */ 1576 if (should_sleep_killable(filter, knotif)) 1577 complete(&knotif->ready); 1578 knotif->state = SECCOMP_NOTIFY_INIT; 1579 atomic_inc(&filter->notif->requests); 1580 wake_up_poll(&filter->wqh, EPOLLIN | EPOLLRDNORM); 1581 } 1582 mutex_unlock(&filter->notify_lock); 1583 } 1584 1585 return ret; 1586 } 1587 1588 static long seccomp_notify_send(struct seccomp_filter *filter, 1589 void __user *buf) 1590 { 1591 struct seccomp_notif_resp resp = {}; 1592 struct seccomp_knotif *knotif; 1593 long ret; 1594 1595 if (copy_from_user(&resp, buf, sizeof(resp))) 1596 return -EFAULT; 1597 1598 if (resp.flags & ~SECCOMP_USER_NOTIF_FLAG_CONTINUE) 1599 return -EINVAL; 1600 1601 if ((resp.flags & SECCOMP_USER_NOTIF_FLAG_CONTINUE) && 1602 (resp.error || resp.val)) 1603 return -EINVAL; 1604 1605 ret = mutex_lock_interruptible(&filter->notify_lock); 1606 if (ret < 0) 1607 return ret; 1608 1609 knotif = find_notification(filter, resp.id); 1610 if (!knotif) { 1611 ret = -ENOENT; 1612 goto out; 1613 } 1614 1615 /* Allow exactly one reply. */ 1616 if (knotif->state != SECCOMP_NOTIFY_SENT) { 1617 ret = -EINPROGRESS; 1618 goto out; 1619 } 1620 1621 ret = 0; 1622 knotif->state = SECCOMP_NOTIFY_REPLIED; 1623 knotif->error = resp.error; 1624 knotif->val = resp.val; 1625 knotif->flags = resp.flags; 1626 if (filter->notif->flags & SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP) 1627 complete_on_current_cpu(&knotif->ready); 1628 else 1629 complete(&knotif->ready); 1630 out: 1631 mutex_unlock(&filter->notify_lock); 1632 return ret; 1633 } 1634 1635 static long seccomp_notify_id_valid(struct seccomp_filter *filter, 1636 void __user *buf) 1637 { 1638 struct seccomp_knotif *knotif; 1639 u64 id; 1640 long ret; 1641 1642 if (copy_from_user(&id, buf, sizeof(id))) 1643 return -EFAULT; 1644 1645 ret = mutex_lock_interruptible(&filter->notify_lock); 1646 if (ret < 0) 1647 return ret; 1648 1649 knotif = find_notification(filter, id); 1650 if (knotif && knotif->state == SECCOMP_NOTIFY_SENT) 1651 ret = 0; 1652 else 1653 ret = -ENOENT; 1654 1655 mutex_unlock(&filter->notify_lock); 1656 return ret; 1657 } 1658 1659 static long seccomp_notify_set_flags(struct seccomp_filter *filter, 1660 unsigned long flags) 1661 { 1662 long ret; 1663 1664 if (flags & ~SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP) 1665 return -EINVAL; 1666 1667 ret = mutex_lock_interruptible(&filter->notify_lock); 1668 if (ret < 0) 1669 return ret; 1670 filter->notif->flags = flags; 1671 mutex_unlock(&filter->notify_lock); 1672 return 0; 1673 } 1674 1675 static long seccomp_notify_addfd(struct seccomp_filter *filter, 1676 struct seccomp_notif_addfd __user *uaddfd, 1677 unsigned int size) 1678 { 1679 struct seccomp_notif_addfd addfd; 1680 struct seccomp_knotif *knotif; 1681 struct seccomp_kaddfd kaddfd; 1682 int ret; 1683 1684 BUILD_BUG_ON(sizeof(addfd) < SECCOMP_NOTIFY_ADDFD_SIZE_VER0); 1685 BUILD_BUG_ON(sizeof(addfd) != SECCOMP_NOTIFY_ADDFD_SIZE_LATEST); 1686 1687 if (size < SECCOMP_NOTIFY_ADDFD_SIZE_VER0 || size >= PAGE_SIZE) 1688 return -EINVAL; 1689 1690 ret = copy_struct_from_user(&addfd, sizeof(addfd), uaddfd, size); 1691 if (ret) 1692 return ret; 1693 1694 if (addfd.newfd_flags & ~O_CLOEXEC) 1695 return -EINVAL; 1696 1697 if (addfd.flags & ~(SECCOMP_ADDFD_FLAG_SETFD | SECCOMP_ADDFD_FLAG_SEND)) 1698 return -EINVAL; 1699 1700 if (addfd.newfd && !(addfd.flags & SECCOMP_ADDFD_FLAG_SETFD)) 1701 return -EINVAL; 1702 1703 kaddfd.file = fget(addfd.srcfd); 1704 if (!kaddfd.file) 1705 return -EBADF; 1706 1707 kaddfd.ioctl_flags = addfd.flags; 1708 kaddfd.flags = addfd.newfd_flags; 1709 kaddfd.setfd = addfd.flags & SECCOMP_ADDFD_FLAG_SETFD; 1710 kaddfd.fd = addfd.newfd; 1711 init_completion(&kaddfd.completion); 1712 1713 ret = mutex_lock_interruptible(&filter->notify_lock); 1714 if (ret < 0) 1715 goto out; 1716 1717 knotif = find_notification(filter, addfd.id); 1718 if (!knotif) { 1719 ret = -ENOENT; 1720 goto out_unlock; 1721 } 1722 1723 /* 1724 * We do not want to allow for FD injection to occur before the 1725 * notification has been picked up by a userspace handler, or after 1726 * the notification has been replied to. 1727 */ 1728 if (knotif->state != SECCOMP_NOTIFY_SENT) { 1729 ret = -EINPROGRESS; 1730 goto out_unlock; 1731 } 1732 1733 if (addfd.flags & SECCOMP_ADDFD_FLAG_SEND) { 1734 /* 1735 * Disallow queuing an atomic addfd + send reply while there are 1736 * some addfd requests still to process. 1737 * 1738 * There is no clear reason to support it and allows us to keep 1739 * the loop on the other side straight-forward. 1740 */ 1741 if (!list_empty(&knotif->addfd)) { 1742 ret = -EBUSY; 1743 goto out_unlock; 1744 } 1745 1746 /* Allow exactly only one reply */ 1747 knotif->state = SECCOMP_NOTIFY_REPLIED; 1748 } 1749 1750 list_add(&kaddfd.list, &knotif->addfd); 1751 complete(&knotif->ready); 1752 mutex_unlock(&filter->notify_lock); 1753 1754 /* Now we wait for it to be processed or be interrupted */ 1755 ret = wait_for_completion_interruptible(&kaddfd.completion); 1756 if (ret == 0) { 1757 /* 1758 * We had a successful completion. The other side has already 1759 * removed us from the addfd queue, and 1760 * wait_for_completion_interruptible has a memory barrier upon 1761 * success that lets us read this value directly without 1762 * locking. 1763 */ 1764 ret = kaddfd.ret; 1765 goto out; 1766 } 1767 1768 mutex_lock(&filter->notify_lock); 1769 /* 1770 * Even though we were woken up by a signal and not a successful 1771 * completion, a completion may have happened in the mean time. 1772 * 1773 * We need to check again if the addfd request has been handled, 1774 * and if not, we will remove it from the queue. 1775 */ 1776 if (list_empty(&kaddfd.list)) 1777 ret = kaddfd.ret; 1778 else 1779 list_del(&kaddfd.list); 1780 1781 out_unlock: 1782 mutex_unlock(&filter->notify_lock); 1783 out: 1784 fput(kaddfd.file); 1785 1786 return ret; 1787 } 1788 1789 static long seccomp_notify_ioctl(struct file *file, unsigned int cmd, 1790 unsigned long arg) 1791 { 1792 struct seccomp_filter *filter = file->private_data; 1793 void __user *buf = (void __user *)arg; 1794 1795 /* Fixed-size ioctls */ 1796 switch (cmd) { 1797 case SECCOMP_IOCTL_NOTIF_RECV: 1798 return seccomp_notify_recv(filter, buf); 1799 case SECCOMP_IOCTL_NOTIF_SEND: 1800 return seccomp_notify_send(filter, buf); 1801 case SECCOMP_IOCTL_NOTIF_ID_VALID_WRONG_DIR: 1802 case SECCOMP_IOCTL_NOTIF_ID_VALID: 1803 return seccomp_notify_id_valid(filter, buf); 1804 case SECCOMP_IOCTL_NOTIF_SET_FLAGS: 1805 return seccomp_notify_set_flags(filter, arg); 1806 } 1807 1808 /* Extensible Argument ioctls */ 1809 #define EA_IOCTL(cmd) ((cmd) & ~(IOC_INOUT | IOCSIZE_MASK)) 1810 switch (EA_IOCTL(cmd)) { 1811 case EA_IOCTL(SECCOMP_IOCTL_NOTIF_ADDFD): 1812 return seccomp_notify_addfd(filter, buf, _IOC_SIZE(cmd)); 1813 default: 1814 return -EINVAL; 1815 } 1816 } 1817 1818 static __poll_t seccomp_notify_poll(struct file *file, 1819 struct poll_table_struct *poll_tab) 1820 { 1821 struct seccomp_filter *filter = file->private_data; 1822 __poll_t ret = 0; 1823 struct seccomp_knotif *cur; 1824 1825 poll_wait(file, &filter->wqh, poll_tab); 1826 1827 if (mutex_lock_interruptible(&filter->notify_lock) < 0) 1828 return EPOLLERR; 1829 1830 list_for_each_entry(cur, &filter->notif->notifications, list) { 1831 if (cur->state == SECCOMP_NOTIFY_INIT) 1832 ret |= EPOLLIN | EPOLLRDNORM; 1833 if (cur->state == SECCOMP_NOTIFY_SENT) 1834 ret |= EPOLLOUT | EPOLLWRNORM; 1835 if ((ret & EPOLLIN) && (ret & EPOLLOUT)) 1836 break; 1837 } 1838 1839 mutex_unlock(&filter->notify_lock); 1840 1841 if (refcount_read(&filter->users) == 0) 1842 ret |= EPOLLHUP; 1843 1844 return ret; 1845 } 1846 1847 static const struct file_operations seccomp_notify_ops = { 1848 .poll = seccomp_notify_poll, 1849 .release = seccomp_notify_release, 1850 .unlocked_ioctl = seccomp_notify_ioctl, 1851 .compat_ioctl = seccomp_notify_ioctl, 1852 }; 1853 1854 static struct file *init_listener(struct seccomp_filter *filter) 1855 { 1856 struct file *ret; 1857 1858 ret = ERR_PTR(-ENOMEM); 1859 filter->notif = kzalloc(sizeof(*(filter->notif)), GFP_KERNEL); 1860 if (!filter->notif) 1861 goto out; 1862 1863 filter->notif->next_id = get_random_u64(); 1864 INIT_LIST_HEAD(&filter->notif->notifications); 1865 1866 ret = anon_inode_getfile("seccomp notify", &seccomp_notify_ops, 1867 filter, O_RDWR); 1868 if (IS_ERR(ret)) 1869 goto out_notif; 1870 1871 /* The file has a reference to it now */ 1872 __get_seccomp_filter(filter); 1873 1874 out_notif: 1875 if (IS_ERR(ret)) 1876 seccomp_notify_free(filter); 1877 out: 1878 return ret; 1879 } 1880 1881 /* 1882 * Does @new_child have a listener while an ancestor also has a listener? 1883 * If so, we'll want to reject this filter. 1884 * This only has to be tested for the current process, even in the TSYNC case, 1885 * because TSYNC installs @child with the same parent on all threads. 1886 * Note that @new_child is not hooked up to its parent at this point yet, so 1887 * we use current->seccomp.filter. 1888 */ 1889 static bool has_duplicate_listener(struct seccomp_filter *new_child) 1890 { 1891 struct seccomp_filter *cur; 1892 1893 /* must be protected against concurrent TSYNC */ 1894 lockdep_assert_held(¤t->sighand->siglock); 1895 1896 if (!new_child->notif) 1897 return false; 1898 for (cur = current->seccomp.filter; cur; cur = cur->prev) { 1899 if (cur->notif) 1900 return true; 1901 } 1902 1903 return false; 1904 } 1905 1906 /** 1907 * seccomp_set_mode_filter: internal function for setting seccomp filter 1908 * @flags: flags to change filter behavior 1909 * @filter: struct sock_fprog containing filter 1910 * 1911 * This function may be called repeatedly to install additional filters. 1912 * Every filter successfully installed will be evaluated (in reverse order) 1913 * for each system call the task makes. 1914 * 1915 * Once current->seccomp.mode is non-zero, it may not be changed. 1916 * 1917 * Returns 0 on success or -EINVAL on failure. 1918 */ 1919 static long seccomp_set_mode_filter(unsigned int flags, 1920 const char __user *filter) 1921 { 1922 const unsigned long seccomp_mode = SECCOMP_MODE_FILTER; 1923 struct seccomp_filter *prepared = NULL; 1924 long ret = -EINVAL; 1925 int listener = -1; 1926 struct file *listener_f = NULL; 1927 1928 /* Validate flags. */ 1929 if (flags & ~SECCOMP_FILTER_FLAG_MASK) 1930 return -EINVAL; 1931 1932 /* 1933 * In the successful case, NEW_LISTENER returns the new listener fd. 1934 * But in the failure case, TSYNC returns the thread that died. If you 1935 * combine these two flags, there's no way to tell whether something 1936 * succeeded or failed. So, let's disallow this combination if the user 1937 * has not explicitly requested no errors from TSYNC. 1938 */ 1939 if ((flags & SECCOMP_FILTER_FLAG_TSYNC) && 1940 (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) && 1941 ((flags & SECCOMP_FILTER_FLAG_TSYNC_ESRCH) == 0)) 1942 return -EINVAL; 1943 1944 /* 1945 * The SECCOMP_FILTER_FLAG_WAIT_KILLABLE_SENT flag doesn't make sense 1946 * without the SECCOMP_FILTER_FLAG_NEW_LISTENER flag. 1947 */ 1948 if ((flags & SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV) && 1949 ((flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) == 0)) 1950 return -EINVAL; 1951 1952 /* Prepare the new filter before holding any locks. */ 1953 prepared = seccomp_prepare_user_filter(filter); 1954 if (IS_ERR(prepared)) 1955 return PTR_ERR(prepared); 1956 1957 if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) { 1958 listener = get_unused_fd_flags(O_CLOEXEC); 1959 if (listener < 0) { 1960 ret = listener; 1961 goto out_free; 1962 } 1963 1964 listener_f = init_listener(prepared); 1965 if (IS_ERR(listener_f)) { 1966 put_unused_fd(listener); 1967 ret = PTR_ERR(listener_f); 1968 goto out_free; 1969 } 1970 } 1971 1972 /* 1973 * Make sure we cannot change seccomp or nnp state via TSYNC 1974 * while another thread is in the middle of calling exec. 1975 */ 1976 if (flags & SECCOMP_FILTER_FLAG_TSYNC && 1977 mutex_lock_killable(¤t->signal->cred_guard_mutex)) 1978 goto out_put_fd; 1979 1980 spin_lock_irq(¤t->sighand->siglock); 1981 1982 if (!seccomp_may_assign_mode(seccomp_mode)) 1983 goto out; 1984 1985 if (has_duplicate_listener(prepared)) { 1986 ret = -EBUSY; 1987 goto out; 1988 } 1989 1990 ret = seccomp_attach_filter(flags, prepared); 1991 if (ret) 1992 goto out; 1993 /* Do not free the successfully attached filter. */ 1994 prepared = NULL; 1995 1996 seccomp_assign_mode(current, seccomp_mode, flags); 1997 out: 1998 spin_unlock_irq(¤t->sighand->siglock); 1999 if (flags & SECCOMP_FILTER_FLAG_TSYNC) 2000 mutex_unlock(¤t->signal->cred_guard_mutex); 2001 out_put_fd: 2002 if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) { 2003 if (ret) { 2004 listener_f->private_data = NULL; 2005 fput(listener_f); 2006 put_unused_fd(listener); 2007 seccomp_notify_detach(prepared); 2008 } else { 2009 fd_install(listener, listener_f); 2010 ret = listener; 2011 } 2012 } 2013 out_free: 2014 seccomp_filter_free(prepared); 2015 return ret; 2016 } 2017 #else 2018 static inline long seccomp_set_mode_filter(unsigned int flags, 2019 const char __user *filter) 2020 { 2021 return -EINVAL; 2022 } 2023 #endif 2024 2025 static long seccomp_get_action_avail(const char __user *uaction) 2026 { 2027 u32 action; 2028 2029 if (copy_from_user(&action, uaction, sizeof(action))) 2030 return -EFAULT; 2031 2032 switch (action) { 2033 case SECCOMP_RET_KILL_PROCESS: 2034 case SECCOMP_RET_KILL_THREAD: 2035 case SECCOMP_RET_TRAP: 2036 case SECCOMP_RET_ERRNO: 2037 case SECCOMP_RET_USER_NOTIF: 2038 case SECCOMP_RET_TRACE: 2039 case SECCOMP_RET_LOG: 2040 case SECCOMP_RET_ALLOW: 2041 break; 2042 default: 2043 return -EOPNOTSUPP; 2044 } 2045 2046 return 0; 2047 } 2048 2049 static long seccomp_get_notif_sizes(void __user *usizes) 2050 { 2051 struct seccomp_notif_sizes sizes = { 2052 .seccomp_notif = sizeof(struct seccomp_notif), 2053 .seccomp_notif_resp = sizeof(struct seccomp_notif_resp), 2054 .seccomp_data = sizeof(struct seccomp_data), 2055 }; 2056 2057 if (copy_to_user(usizes, &sizes, sizeof(sizes))) 2058 return -EFAULT; 2059 2060 return 0; 2061 } 2062 2063 /* Common entry point for both prctl and syscall. */ 2064 static long do_seccomp(unsigned int op, unsigned int flags, 2065 void __user *uargs) 2066 { 2067 switch (op) { 2068 case SECCOMP_SET_MODE_STRICT: 2069 if (flags != 0 || uargs != NULL) 2070 return -EINVAL; 2071 return seccomp_set_mode_strict(); 2072 case SECCOMP_SET_MODE_FILTER: 2073 return seccomp_set_mode_filter(flags, uargs); 2074 case SECCOMP_GET_ACTION_AVAIL: 2075 if (flags != 0) 2076 return -EINVAL; 2077 2078 return seccomp_get_action_avail(uargs); 2079 case SECCOMP_GET_NOTIF_SIZES: 2080 if (flags != 0) 2081 return -EINVAL; 2082 2083 return seccomp_get_notif_sizes(uargs); 2084 default: 2085 return -EINVAL; 2086 } 2087 } 2088 2089 SYSCALL_DEFINE3(seccomp, unsigned int, op, unsigned int, flags, 2090 void __user *, uargs) 2091 { 2092 return do_seccomp(op, flags, uargs); 2093 } 2094 2095 /** 2096 * prctl_set_seccomp: configures current->seccomp.mode 2097 * @seccomp_mode: requested mode to use 2098 * @filter: optional struct sock_fprog for use with SECCOMP_MODE_FILTER 2099 * 2100 * Returns 0 on success or -EINVAL on failure. 2101 */ 2102 long prctl_set_seccomp(unsigned long seccomp_mode, void __user *filter) 2103 { 2104 unsigned int op; 2105 void __user *uargs; 2106 2107 switch (seccomp_mode) { 2108 case SECCOMP_MODE_STRICT: 2109 op = SECCOMP_SET_MODE_STRICT; 2110 /* 2111 * Setting strict mode through prctl always ignored filter, 2112 * so make sure it is always NULL here to pass the internal 2113 * check in do_seccomp(). 2114 */ 2115 uargs = NULL; 2116 break; 2117 case SECCOMP_MODE_FILTER: 2118 op = SECCOMP_SET_MODE_FILTER; 2119 uargs = filter; 2120 break; 2121 default: 2122 return -EINVAL; 2123 } 2124 2125 /* prctl interface doesn't have flags, so they are always zero. */ 2126 return do_seccomp(op, 0, uargs); 2127 } 2128 2129 #if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE) 2130 static struct seccomp_filter *get_nth_filter(struct task_struct *task, 2131 unsigned long filter_off) 2132 { 2133 struct seccomp_filter *orig, *filter; 2134 unsigned long count; 2135 2136 /* 2137 * Note: this is only correct because the caller should be the (ptrace) 2138 * tracer of the task, otherwise lock_task_sighand is needed. 2139 */ 2140 spin_lock_irq(&task->sighand->siglock); 2141 2142 if (task->seccomp.mode != SECCOMP_MODE_FILTER) { 2143 spin_unlock_irq(&task->sighand->siglock); 2144 return ERR_PTR(-EINVAL); 2145 } 2146 2147 orig = task->seccomp.filter; 2148 __get_seccomp_filter(orig); 2149 spin_unlock_irq(&task->sighand->siglock); 2150 2151 count = 0; 2152 for (filter = orig; filter; filter = filter->prev) 2153 count++; 2154 2155 if (filter_off >= count) { 2156 filter = ERR_PTR(-ENOENT); 2157 goto out; 2158 } 2159 2160 count -= filter_off; 2161 for (filter = orig; filter && count > 1; filter = filter->prev) 2162 count--; 2163 2164 if (WARN_ON(count != 1 || !filter)) { 2165 filter = ERR_PTR(-ENOENT); 2166 goto out; 2167 } 2168 2169 __get_seccomp_filter(filter); 2170 2171 out: 2172 __put_seccomp_filter(orig); 2173 return filter; 2174 } 2175 2176 long seccomp_get_filter(struct task_struct *task, unsigned long filter_off, 2177 void __user *data) 2178 { 2179 struct seccomp_filter *filter; 2180 struct sock_fprog_kern *fprog; 2181 long ret; 2182 2183 if (!capable(CAP_SYS_ADMIN) || 2184 current->seccomp.mode != SECCOMP_MODE_DISABLED) { 2185 return -EACCES; 2186 } 2187 2188 filter = get_nth_filter(task, filter_off); 2189 if (IS_ERR(filter)) 2190 return PTR_ERR(filter); 2191 2192 fprog = filter->prog->orig_prog; 2193 if (!fprog) { 2194 /* This must be a new non-cBPF filter, since we save 2195 * every cBPF filter's orig_prog above when 2196 * CONFIG_CHECKPOINT_RESTORE is enabled. 2197 */ 2198 ret = -EMEDIUMTYPE; 2199 goto out; 2200 } 2201 2202 ret = fprog->len; 2203 if (!data) 2204 goto out; 2205 2206 if (copy_to_user(data, fprog->filter, bpf_classic_proglen(fprog))) 2207 ret = -EFAULT; 2208 2209 out: 2210 __put_seccomp_filter(filter); 2211 return ret; 2212 } 2213 2214 long seccomp_get_metadata(struct task_struct *task, 2215 unsigned long size, void __user *data) 2216 { 2217 long ret; 2218 struct seccomp_filter *filter; 2219 struct seccomp_metadata kmd = {}; 2220 2221 if (!capable(CAP_SYS_ADMIN) || 2222 current->seccomp.mode != SECCOMP_MODE_DISABLED) { 2223 return -EACCES; 2224 } 2225 2226 size = min_t(unsigned long, size, sizeof(kmd)); 2227 2228 if (size < sizeof(kmd.filter_off)) 2229 return -EINVAL; 2230 2231 if (copy_from_user(&kmd.filter_off, data, sizeof(kmd.filter_off))) 2232 return -EFAULT; 2233 2234 filter = get_nth_filter(task, kmd.filter_off); 2235 if (IS_ERR(filter)) 2236 return PTR_ERR(filter); 2237 2238 if (filter->log) 2239 kmd.flags |= SECCOMP_FILTER_FLAG_LOG; 2240 2241 ret = size; 2242 if (copy_to_user(data, &kmd, size)) 2243 ret = -EFAULT; 2244 2245 __put_seccomp_filter(filter); 2246 return ret; 2247 } 2248 #endif 2249 2250 #ifdef CONFIG_SYSCTL 2251 2252 /* Human readable action names for friendly sysctl interaction */ 2253 #define SECCOMP_RET_KILL_PROCESS_NAME "kill_process" 2254 #define SECCOMP_RET_KILL_THREAD_NAME "kill_thread" 2255 #define SECCOMP_RET_TRAP_NAME "trap" 2256 #define SECCOMP_RET_ERRNO_NAME "errno" 2257 #define SECCOMP_RET_USER_NOTIF_NAME "user_notif" 2258 #define SECCOMP_RET_TRACE_NAME "trace" 2259 #define SECCOMP_RET_LOG_NAME "log" 2260 #define SECCOMP_RET_ALLOW_NAME "allow" 2261 2262 static const char seccomp_actions_avail[] = 2263 SECCOMP_RET_KILL_PROCESS_NAME " " 2264 SECCOMP_RET_KILL_THREAD_NAME " " 2265 SECCOMP_RET_TRAP_NAME " " 2266 SECCOMP_RET_ERRNO_NAME " " 2267 SECCOMP_RET_USER_NOTIF_NAME " " 2268 SECCOMP_RET_TRACE_NAME " " 2269 SECCOMP_RET_LOG_NAME " " 2270 SECCOMP_RET_ALLOW_NAME; 2271 2272 struct seccomp_log_name { 2273 u32 log; 2274 const char *name; 2275 }; 2276 2277 static const struct seccomp_log_name seccomp_log_names[] = { 2278 { SECCOMP_LOG_KILL_PROCESS, SECCOMP_RET_KILL_PROCESS_NAME }, 2279 { SECCOMP_LOG_KILL_THREAD, SECCOMP_RET_KILL_THREAD_NAME }, 2280 { SECCOMP_LOG_TRAP, SECCOMP_RET_TRAP_NAME }, 2281 { SECCOMP_LOG_ERRNO, SECCOMP_RET_ERRNO_NAME }, 2282 { SECCOMP_LOG_USER_NOTIF, SECCOMP_RET_USER_NOTIF_NAME }, 2283 { SECCOMP_LOG_TRACE, SECCOMP_RET_TRACE_NAME }, 2284 { SECCOMP_LOG_LOG, SECCOMP_RET_LOG_NAME }, 2285 { SECCOMP_LOG_ALLOW, SECCOMP_RET_ALLOW_NAME }, 2286 { } 2287 }; 2288 2289 static bool seccomp_names_from_actions_logged(char *names, size_t size, 2290 u32 actions_logged, 2291 const char *sep) 2292 { 2293 const struct seccomp_log_name *cur; 2294 bool append_sep = false; 2295 2296 for (cur = seccomp_log_names; cur->name && size; cur++) { 2297 ssize_t ret; 2298 2299 if (!(actions_logged & cur->log)) 2300 continue; 2301 2302 if (append_sep) { 2303 ret = strscpy(names, sep, size); 2304 if (ret < 0) 2305 return false; 2306 2307 names += ret; 2308 size -= ret; 2309 } else 2310 append_sep = true; 2311 2312 ret = strscpy(names, cur->name, size); 2313 if (ret < 0) 2314 return false; 2315 2316 names += ret; 2317 size -= ret; 2318 } 2319 2320 return true; 2321 } 2322 2323 static bool seccomp_action_logged_from_name(u32 *action_logged, 2324 const char *name) 2325 { 2326 const struct seccomp_log_name *cur; 2327 2328 for (cur = seccomp_log_names; cur->name; cur++) { 2329 if (!strcmp(cur->name, name)) { 2330 *action_logged = cur->log; 2331 return true; 2332 } 2333 } 2334 2335 return false; 2336 } 2337 2338 static bool seccomp_actions_logged_from_names(u32 *actions_logged, char *names) 2339 { 2340 char *name; 2341 2342 *actions_logged = 0; 2343 while ((name = strsep(&names, " ")) && *name) { 2344 u32 action_logged = 0; 2345 2346 if (!seccomp_action_logged_from_name(&action_logged, name)) 2347 return false; 2348 2349 *actions_logged |= action_logged; 2350 } 2351 2352 return true; 2353 } 2354 2355 static int read_actions_logged(const struct ctl_table *ro_table, void *buffer, 2356 size_t *lenp, loff_t *ppos) 2357 { 2358 char names[sizeof(seccomp_actions_avail)]; 2359 struct ctl_table table; 2360 2361 memset(names, 0, sizeof(names)); 2362 2363 if (!seccomp_names_from_actions_logged(names, sizeof(names), 2364 seccomp_actions_logged, " ")) 2365 return -EINVAL; 2366 2367 table = *ro_table; 2368 table.data = names; 2369 table.maxlen = sizeof(names); 2370 return proc_dostring(&table, 0, buffer, lenp, ppos); 2371 } 2372 2373 static int write_actions_logged(const struct ctl_table *ro_table, void *buffer, 2374 size_t *lenp, loff_t *ppos, u32 *actions_logged) 2375 { 2376 char names[sizeof(seccomp_actions_avail)]; 2377 struct ctl_table table; 2378 int ret; 2379 2380 if (!capable(CAP_SYS_ADMIN)) 2381 return -EPERM; 2382 2383 memset(names, 0, sizeof(names)); 2384 2385 table = *ro_table; 2386 table.data = names; 2387 table.maxlen = sizeof(names); 2388 ret = proc_dostring(&table, 1, buffer, lenp, ppos); 2389 if (ret) 2390 return ret; 2391 2392 if (!seccomp_actions_logged_from_names(actions_logged, table.data)) 2393 return -EINVAL; 2394 2395 if (*actions_logged & SECCOMP_LOG_ALLOW) 2396 return -EINVAL; 2397 2398 seccomp_actions_logged = *actions_logged; 2399 return 0; 2400 } 2401 2402 static void audit_actions_logged(u32 actions_logged, u32 old_actions_logged, 2403 int ret) 2404 { 2405 char names[sizeof(seccomp_actions_avail)]; 2406 char old_names[sizeof(seccomp_actions_avail)]; 2407 const char *new = names; 2408 const char *old = old_names; 2409 2410 if (!audit_enabled) 2411 return; 2412 2413 memset(names, 0, sizeof(names)); 2414 memset(old_names, 0, sizeof(old_names)); 2415 2416 if (ret) 2417 new = "?"; 2418 else if (!actions_logged) 2419 new = "(none)"; 2420 else if (!seccomp_names_from_actions_logged(names, sizeof(names), 2421 actions_logged, ",")) 2422 new = "?"; 2423 2424 if (!old_actions_logged) 2425 old = "(none)"; 2426 else if (!seccomp_names_from_actions_logged(old_names, 2427 sizeof(old_names), 2428 old_actions_logged, ",")) 2429 old = "?"; 2430 2431 return audit_seccomp_actions_logged(new, old, !ret); 2432 } 2433 2434 static int seccomp_actions_logged_handler(const struct ctl_table *ro_table, int write, 2435 void *buffer, size_t *lenp, 2436 loff_t *ppos) 2437 { 2438 int ret; 2439 2440 if (write) { 2441 u32 actions_logged = 0; 2442 u32 old_actions_logged = seccomp_actions_logged; 2443 2444 ret = write_actions_logged(ro_table, buffer, lenp, ppos, 2445 &actions_logged); 2446 audit_actions_logged(actions_logged, old_actions_logged, ret); 2447 } else 2448 ret = read_actions_logged(ro_table, buffer, lenp, ppos); 2449 2450 return ret; 2451 } 2452 2453 static struct ctl_table seccomp_sysctl_table[] = { 2454 { 2455 .procname = "actions_avail", 2456 .data = (void *) &seccomp_actions_avail, 2457 .maxlen = sizeof(seccomp_actions_avail), 2458 .mode = 0444, 2459 .proc_handler = proc_dostring, 2460 }, 2461 { 2462 .procname = "actions_logged", 2463 .mode = 0644, 2464 .proc_handler = seccomp_actions_logged_handler, 2465 }, 2466 }; 2467 2468 static int __init seccomp_sysctl_init(void) 2469 { 2470 register_sysctl_init("kernel/seccomp", seccomp_sysctl_table); 2471 return 0; 2472 } 2473 2474 device_initcall(seccomp_sysctl_init) 2475 2476 #endif /* CONFIG_SYSCTL */ 2477 2478 #ifdef CONFIG_SECCOMP_CACHE_DEBUG 2479 /* Currently CONFIG_SECCOMP_CACHE_DEBUG implies SECCOMP_ARCH_NATIVE */ 2480 static void proc_pid_seccomp_cache_arch(struct seq_file *m, const char *name, 2481 const void *bitmap, size_t bitmap_size) 2482 { 2483 int nr; 2484 2485 for (nr = 0; nr < bitmap_size; nr++) { 2486 bool cached = test_bit(nr, bitmap); 2487 char *status = cached ? "ALLOW" : "FILTER"; 2488 2489 seq_printf(m, "%s %d %s\n", name, nr, status); 2490 } 2491 } 2492 2493 int proc_pid_seccomp_cache(struct seq_file *m, struct pid_namespace *ns, 2494 struct pid *pid, struct task_struct *task) 2495 { 2496 struct seccomp_filter *f; 2497 unsigned long flags; 2498 2499 /* 2500 * We don't want some sandboxed process to know what their seccomp 2501 * filters consist of. 2502 */ 2503 if (!file_ns_capable(m->file, &init_user_ns, CAP_SYS_ADMIN)) 2504 return -EACCES; 2505 2506 if (!lock_task_sighand(task, &flags)) 2507 return -ESRCH; 2508 2509 f = READ_ONCE(task->seccomp.filter); 2510 if (!f) { 2511 unlock_task_sighand(task, &flags); 2512 return 0; 2513 } 2514 2515 /* prevent filter from being freed while we are printing it */ 2516 __get_seccomp_filter(f); 2517 unlock_task_sighand(task, &flags); 2518 2519 proc_pid_seccomp_cache_arch(m, SECCOMP_ARCH_NATIVE_NAME, 2520 f->cache.allow_native, 2521 SECCOMP_ARCH_NATIVE_NR); 2522 2523 #ifdef SECCOMP_ARCH_COMPAT 2524 proc_pid_seccomp_cache_arch(m, SECCOMP_ARCH_COMPAT_NAME, 2525 f->cache.allow_compat, 2526 SECCOMP_ARCH_COMPAT_NR); 2527 #endif /* SECCOMP_ARCH_COMPAT */ 2528 2529 __put_seccomp_filter(f); 2530 return 0; 2531 } 2532 #endif /* CONFIG_SECCOMP_CACHE_DEBUG */ 2533