1// SPDX-License-Identifier: GPL-2.0
2/*
3 * linux/kernel/seccomp.c
4 *
5 * Copyright 2004-2005 Andrea Arcangeli <andrea@cpushare.com>
6 *
7 * Copyright (C) 2012 Google, Inc.
8 * Will Drewry <wad@chromium.org>
9 *
10 * This defines a simple but solid secure-computing facility.
11 *
12 * Mode 1 uses a fixed list of allowed system calls.
13 * Mode 2 allows user-defined system call filters in the form
14 * of Berkeley Packet Filters/Linux Socket Filters.
15 */
16#define pr_fmt(fmt) "seccomp: " fmt
17
18#include <linux/refcount.h>
19#include <linux/audit.h>
20#include <linux/compat.h>
21#include <linux/coredump.h>
22#include <linux/kmemleak.h>
23#include <linux/nospec.h>
24#include <linux/prctl.h>
25#include <linux/sched.h>
26#include <linux/sched/task_stack.h>
27#include <linux/seccomp.h>
28#include <linux/slab.h>
29#include <linux/syscalls.h>
30#include <linux/sysctl.h>
31
32#include <asm/syscall.h>
33
34/* Not exposed in headers: strictly internal use only. */
35#define SECCOMP_MODE_DEAD (SECCOMP_MODE_FILTER + 1)
36
37#ifdef CONFIG_SECCOMP_FILTER
38#include <linux/file.h>
39#include <linux/filter.h>
40#include <linux/pid.h>
41#include <linux/ptrace.h>
42#include <linux/capability.h>
43#include <linux/uaccess.h>
44#include <linux/anon_inodes.h>
45#include <linux/lockdep.h>
46
47/*
48 * When SECCOMP_IOCTL_NOTIF_ID_VALID was first introduced, it had the
49 * wrong direction flag in the ioctl number. This is the broken one,
50 * which the kernel needs to keep supporting until all userspaces stop
51 * using the wrong command number.
52 */
53#define SECCOMP_IOCTL_NOTIF_ID_VALID_WRONG_DIR SECCOMP_IOR(2, __u64)
54
55enum notify_state {
56 SECCOMP_NOTIFY_INIT,
57 SECCOMP_NOTIFY_SENT,
58 SECCOMP_NOTIFY_REPLIED,
59};
60
61struct seccomp_knotif {
62 /* The struct pid of the task whose filter triggered the notification */
63 struct task_struct *task;
64
65 /* The "cookie" for this request; this is unique for this filter. */
66 u64 id;
67
68 /*
69 * The seccomp data. This pointer is valid the entire time this
70 * notification is active, since it comes from __seccomp_filter which
71 * eclipses the entire lifecycle here.
72 */
73 const struct seccomp_data *data;
74
75 /*
76 * Notification states. When SECCOMP_RET_USER_NOTIF is returned, a
77 * struct seccomp_knotif is created and starts out in INIT. Once the
78 * handler reads the notification off of an FD, it transitions to SENT.
79 * If a signal is received the state transitions back to INIT and
80 * another message is sent. When the userspace handler replies, state
81 * transitions to REPLIED.
82 */
83 enum notify_state state;
84
85 /* The return values, only valid when in SECCOMP_NOTIFY_REPLIED */
86 int error;
87 long val;
88 u32 flags;
89
90 /*
91 * Signals when this has changed states, such as the listener
92 * dying, a new seccomp addfd message, or changing to REPLIED
93 */
94 struct completion ready;
95
96 struct list_head list;
97
98 /* outstanding addfd requests */
99 struct list_head addfd;
100};
101
102/**
103 * struct seccomp_kaddfd - container for seccomp_addfd ioctl messages
104 *
105 * @file: A reference to the file to install in the other task
106 * @fd: The fd number to install it at. If the fd number is -1, it means the
107 * installing process should allocate the fd as normal.
108 * @flags: The flags for the new file descriptor. At the moment, only O_CLOEXEC
109 * is allowed.
110 * @ioctl_flags: The flags used for the seccomp_addfd ioctl.
111 * @setfd: whether or not SECCOMP_ADDFD_FLAG_SETFD was set during notify_addfd
112 * @ret: The return value of the installing process. It is set to the fd num
113 * upon success (>= 0).
114 * @completion: Indicates that the installing process has completed fd
115 * installation, or gone away (either due to successful
116 * reply, or signal)
117 * @list: list_head for chaining seccomp_kaddfd together.
118 *
119 */
120struct seccomp_kaddfd {
121 struct file *file;
122 int fd;
123 unsigned int flags;
124 __u32 ioctl_flags;
125
126 union {
127 bool setfd;
128 /* To only be set on reply */
129 int ret;
130 };
131 struct completion completion;
132 struct list_head list;
133};
134
135/**
136 * struct notification - container for seccomp userspace notifications. Since
137 * most seccomp filters will not have notification listeners attached and this
138 * structure is fairly large, we store the notification-specific stuff in a
139 * separate structure.
140 *
141 * @requests: A semaphore that users of this notification can wait on for
142 * changes. Actual reads and writes are still controlled with
143 * filter->notify_lock.
144 * @flags: A set of SECCOMP_USER_NOTIF_FD_* flags.
145 * @next_id: The id of the next request.
146 * @notifications: A list of struct seccomp_knotif elements.
147 */
148
149struct notification {
150 atomic_t requests;
151 u32 flags;
152 u64 next_id;
153 struct list_head notifications;
154};
155
156#ifdef SECCOMP_ARCH_NATIVE
157/**
158 * struct action_cache - per-filter cache of seccomp actions per
159 * arch/syscall pair
160 *
161 * @allow_native: A bitmap where each bit represents whether the
162 * filter will always allow the syscall, for the
163 * native architecture.
164 * @allow_compat: A bitmap where each bit represents whether the
165 * filter will always allow the syscall, for the
166 * compat architecture.
167 */
168struct action_cache {
169 DECLARE_BITMAP(allow_native, SECCOMP_ARCH_NATIVE_NR);
170#ifdef SECCOMP_ARCH_COMPAT
171 DECLARE_BITMAP(allow_compat, SECCOMP_ARCH_COMPAT_NR);
172#endif
173};
174#else
175struct action_cache { };
176
177static inline bool seccomp_cache_check_allow(const struct seccomp_filter *sfilter,
178 const struct seccomp_data *sd)
179{
180 return false;
181}
182
183static inline void seccomp_cache_prepare(struct seccomp_filter *sfilter)
184{
185}
186#endif /* SECCOMP_ARCH_NATIVE */
187
188/**
189 * struct seccomp_filter - container for seccomp BPF programs
190 *
191 * @refs: Reference count to manage the object lifetime.
192 * A filter's reference count is incremented for each directly
193 * attached task, once for the dependent filter, and if
194 * requested for the user notifier. When @refs reaches zero,
195 * the filter can be freed.
196 * @users: A filter's @users count is incremented for each directly
197 * attached task (filter installation, fork(), thread_sync),
198 * and once for the dependent filter (tracked in filter->prev).
199 * When it reaches zero it indicates that no direct or indirect
200 * users of that filter exist. No new tasks can get associated with
201 * this filter after reaching 0. The @users count is always smaller
202 * or equal to @refs. Hence, reaching 0 for @users does not mean
203 * the filter can be freed.
204 * @cache: cache of arch/syscall mappings to actions
205 * @log: true if all actions except for SECCOMP_RET_ALLOW should be logged
206 * @wait_killable_recv: Put notifying process in killable state once the
207 * notification is received by the userspace listener.
208 * @prev: points to a previously installed, or inherited, filter
209 * @prog: the BPF program to evaluate
210 * @notif: the struct that holds all notification related information
211 * @notify_lock: A lock for all notification-related accesses.
212 * @wqh: A wait queue for poll if a notifier is in use.
213 *
214 * seccomp_filter objects are organized in a tree linked via the @prev
215 * pointer. For any task, it appears to be a singly-linked list starting
216 * with current->seccomp.filter, the most recently attached or inherited filter.
217 * However, multiple filters may share a @prev node, by way of fork(), which
218 * results in a unidirectional tree existing in memory. This is similar to
219 * how namespaces work.
220 *
221 * seccomp_filter objects should never be modified after being attached
222 * to a task_struct (other than @refs).
223 */
224struct seccomp_filter {
225 refcount_t refs;
226 refcount_t users;
227 bool log;
228 bool wait_killable_recv;
229 struct action_cache cache;
230 struct seccomp_filter *prev;
231 struct bpf_prog *prog;
232 struct notification *notif;
233 struct mutex notify_lock;
234 wait_queue_head_t wqh;
235};
236
237/* Limit any path through the tree to 256KB worth of instructions. */
238#define MAX_INSNS_PER_PATH ((1 << 18) / sizeof(struct sock_filter))
239
240/*
241 * Endianness is explicitly ignored and left for BPF program authors to manage
242 * as per the specific architecture.
243 */
244static void populate_seccomp_data(struct seccomp_data *sd)
245{
246 /*
247 * Instead of using current_pt_reg(), we're already doing the work
248 * to safely fetch "current", so just use "task" everywhere below.
249 */
250 struct task_struct *task = current;
251 struct pt_regs *regs = task_pt_regs(task);
252 unsigned long args[6];
253
254 sd->nr = syscall_get_nr(task, regs);
255 sd->arch = syscall_get_arch(task);
256 syscall_get_arguments(task, regs, args);
257 sd->args[0] = args[0];
258 sd->args[1] = args[1];
259 sd->args[2] = args[2];
260 sd->args[3] = args[3];
261 sd->args[4] = args[4];
262 sd->args[5] = args[5];
263 sd->instruction_pointer = KSTK_EIP(task);
264}
265
266/**
267 * seccomp_check_filter - verify seccomp filter code
268 * @filter: filter to verify
269 * @flen: length of filter
270 *
271 * Takes a previously checked filter (by bpf_check_classic) and
272 * redirects all filter code that loads struct sk_buff data
273 * and related data through seccomp_bpf_load. It also
274 * enforces length and alignment checking of those loads.
275 *
276 * Returns 0 if the rule set is legal or -EINVAL if not.
277 */
278static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen)
279{
280 int pc;
281 for (pc = 0; pc < flen; pc++) {
282 struct sock_filter *ftest = &filter[pc];
283 u16 code = ftest->code;
284 u32 k = ftest->k;
285
286 switch (code) {
287 case BPF_LD | BPF_W | BPF_ABS:
288 ftest->code = BPF_LDX | BPF_W | BPF_ABS;
289 /* 32-bit aligned and not out of bounds. */
290 if (k >= sizeof(struct seccomp_data) || k & 3)
291 return -EINVAL;
292 continue;
293 case BPF_LD | BPF_W | BPF_LEN:
294 ftest->code = BPF_LD | BPF_IMM;
295 ftest->k = sizeof(struct seccomp_data);
296 continue;
297 case BPF_LDX | BPF_W | BPF_LEN:
298 ftest->code = BPF_LDX | BPF_IMM;
299 ftest->k = sizeof(struct seccomp_data);
300 continue;
301 /* Explicitly include allowed calls. */
302 case BPF_RET | BPF_K:
303 case BPF_RET | BPF_A:
304 case BPF_ALU | BPF_ADD | BPF_K:
305 case BPF_ALU | BPF_ADD | BPF_X:
306 case BPF_ALU | BPF_SUB | BPF_K:
307 case BPF_ALU | BPF_SUB | BPF_X:
308 case BPF_ALU | BPF_MUL | BPF_K:
309 case BPF_ALU | BPF_MUL | BPF_X:
310 case BPF_ALU | BPF_DIV | BPF_K:
311 case BPF_ALU | BPF_DIV | BPF_X:
312 case BPF_ALU | BPF_AND | BPF_K:
313 case BPF_ALU | BPF_AND | BPF_X:
314 case BPF_ALU | BPF_OR | BPF_K:
315 case BPF_ALU | BPF_OR | BPF_X:
316 case BPF_ALU | BPF_XOR | BPF_K:
317 case BPF_ALU | BPF_XOR | BPF_X:
318 case BPF_ALU | BPF_LSH | BPF_K:
319 case BPF_ALU | BPF_LSH | BPF_X:
320 case BPF_ALU | BPF_RSH | BPF_K:
321 case BPF_ALU | BPF_RSH | BPF_X:
322 case BPF_ALU | BPF_NEG:
323 case BPF_LD | BPF_IMM:
324 case BPF_LDX | BPF_IMM:
325 case BPF_MISC | BPF_TAX:
326 case BPF_MISC | BPF_TXA:
327 case BPF_LD | BPF_MEM:
328 case BPF_LDX | BPF_MEM:
329 case BPF_ST:
330 case BPF_STX:
331 case BPF_JMP | BPF_JA:
332 case BPF_JMP | BPF_JEQ | BPF_K:
333 case BPF_JMP | BPF_JEQ | BPF_X:
334 case BPF_JMP | BPF_JGE | BPF_K:
335 case BPF_JMP | BPF_JGE | BPF_X:
336 case BPF_JMP | BPF_JGT | BPF_K:
337 case BPF_JMP | BPF_JGT | BPF_X:
338 case BPF_JMP | BPF_JSET | BPF_K:
339 case BPF_JMP | BPF_JSET | BPF_X:
340 continue;
341 default:
342 return -EINVAL;
343 }
344 }
345 return 0;
346}
347
348#ifdef SECCOMP_ARCH_NATIVE
349static inline bool seccomp_cache_check_allow_bitmap(const void *bitmap,
350 size_t bitmap_size,
351 int syscall_nr)
352{
353 if (unlikely(syscall_nr < 0 || syscall_nr >= bitmap_size))
354 return false;
355 syscall_nr = array_index_nospec(syscall_nr, bitmap_size);
356
357 return test_bit(syscall_nr, bitmap);
358}
359
360/**
361 * seccomp_cache_check_allow - lookup seccomp cache
362 * @sfilter: The seccomp filter
363 * @sd: The seccomp data to lookup the cache with
364 *
365 * Returns true if the seccomp_data is cached and allowed.
366 */
367static inline bool seccomp_cache_check_allow(const struct seccomp_filter *sfilter,
368 const struct seccomp_data *sd)
369{
370 int syscall_nr = sd->nr;
371 const struct action_cache *cache = &sfilter->cache;
372
373#ifndef SECCOMP_ARCH_COMPAT
374 /* A native-only architecture doesn't need to check sd->arch. */
375 return seccomp_cache_check_allow_bitmap(cache->allow_native,
376 SECCOMP_ARCH_NATIVE_NR,
377 syscall_nr);
378#else
379 if (likely(sd->arch == SECCOMP_ARCH_NATIVE))
380 return seccomp_cache_check_allow_bitmap(bitmap: cache->allow_native,
381 SECCOMP_ARCH_NATIVE_NR,
382 syscall_nr);
383 if (likely(sd->arch == SECCOMP_ARCH_COMPAT))
384 return seccomp_cache_check_allow_bitmap(bitmap: cache->allow_compat,
385 SECCOMP_ARCH_COMPAT_NR,
386 syscall_nr);
387#endif /* SECCOMP_ARCH_COMPAT */
388
389 WARN_ON_ONCE(true);
390 return false;
391}
392#endif /* SECCOMP_ARCH_NATIVE */
393
394#define ACTION_ONLY(ret) ((s32)((ret) & (SECCOMP_RET_ACTION_FULL)))
395/**
396 * seccomp_run_filters - evaluates all seccomp filters against @sd
397 * @sd: optional seccomp data to be passed to filters
398 * @match: stores struct seccomp_filter that resulted in the return value,
399 * unless filter returned SECCOMP_RET_ALLOW, in which case it will
400 * be unchanged.
401 *
402 * Returns valid seccomp BPF response codes.
403 */
404static u32 seccomp_run_filters(const struct seccomp_data *sd,
405 struct seccomp_filter **match)
406{
407 u32 ret = SECCOMP_RET_ALLOW;
408 /* Make sure cross-thread synced filter points somewhere sane. */
409 struct seccomp_filter *f =
410 READ_ONCE(current->seccomp.filter);
411
412 /* Ensure unexpected behavior doesn't result in failing open. */
413 if (WARN_ON(f == NULL))
414 return SECCOMP_RET_KILL_PROCESS;
415
416 if (seccomp_cache_check_allow(sfilter: f, sd))
417 return SECCOMP_RET_ALLOW;
418
419 /*
420 * All filters in the list are evaluated and the lowest BPF return
421 * value always takes priority (ignoring the DATA).
422 */
423 for (; f; f = f->prev) {
424 u32 cur_ret = bpf_prog_run_pin_on_cpu(prog: f->prog, ctx: sd);
425
426 if (ACTION_ONLY(cur_ret) < ACTION_ONLY(ret)) {
427 ret = cur_ret;
428 *match = f;
429 }
430 }
431 return ret;
432}
433#endif /* CONFIG_SECCOMP_FILTER */
434
435static inline bool seccomp_may_assign_mode(unsigned long seccomp_mode)
436{
437 assert_spin_locked(&current->sighand->siglock);
438
439 if (current->seccomp.mode && current->seccomp.mode != seccomp_mode)
440 return false;
441
442 return true;
443}
444
445void __weak arch_seccomp_spec_mitigate(struct task_struct *task) { }
446
447static inline void seccomp_assign_mode(struct task_struct *task,
448 unsigned long seccomp_mode,
449 unsigned long flags)
450{
451 assert_spin_locked(&task->sighand->siglock);
452
453 task->seccomp.mode = seccomp_mode;
454 /*
455 * Make sure SYSCALL_WORK_SECCOMP cannot be set before the mode (and
456 * filter) is set.
457 */
458 smp_mb__before_atomic();
459 /* Assume default seccomp processes want spec flaw mitigation. */
460 if ((flags & SECCOMP_FILTER_FLAG_SPEC_ALLOW) == 0)
461 arch_seccomp_spec_mitigate(task);
462 set_task_syscall_work(task, SECCOMP);
463}
464
465#ifdef CONFIG_SECCOMP_FILTER
466/* Returns 1 if the parent is an ancestor of the child. */
467static int is_ancestor(struct seccomp_filter *parent,
468 struct seccomp_filter *child)
469{
470 /* NULL is the root ancestor. */
471 if (parent == NULL)
472 return 1;
473 for (; child; child = child->prev)
474 if (child == parent)
475 return 1;
476 return 0;
477}
478
479/**
480 * seccomp_can_sync_threads: checks if all threads can be synchronized
481 *
482 * Expects sighand and cred_guard_mutex locks to be held.
483 *
484 * Returns 0 on success, -ve on error, or the pid of a thread which was
485 * either not in the correct seccomp mode or did not have an ancestral
486 * seccomp filter.
487 */
488static inline pid_t seccomp_can_sync_threads(void)
489{
490 struct task_struct *thread, *caller;
491
492 BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
493 assert_spin_locked(&current->sighand->siglock);
494
495 /* Validate all threads being eligible for synchronization. */
496 caller = current;
497 for_each_thread(caller, thread) {
498 pid_t failed;
499
500 /* Skip current, since it is initiating the sync. */
501 if (thread == caller)
502 continue;
503 /* Skip exited threads. */
504 if (thread->flags & PF_EXITING)
505 continue;
506
507 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED ||
508 (thread->seccomp.mode == SECCOMP_MODE_FILTER &&
509 is_ancestor(parent: thread->seccomp.filter,
510 child: caller->seccomp.filter)))
511 continue;
512
513 /* Return the first thread that cannot be synchronized. */
514 failed = task_pid_vnr(tsk: thread);
515 /* If the pid cannot be resolved, then return -ESRCH */
516 if (WARN_ON(failed == 0))
517 failed = -ESRCH;
518 return failed;
519 }
520
521 return 0;
522}
523
524static inline void seccomp_filter_free(struct seccomp_filter *filter)
525{
526 if (filter) {
527 bpf_prog_destroy(fp: filter->prog);
528 kfree(objp: filter);
529 }
530}
531
532static void __seccomp_filter_orphan(struct seccomp_filter *orig)
533{
534 while (orig && refcount_dec_and_test(r: &orig->users)) {
535 if (waitqueue_active(wq_head: &orig->wqh))
536 wake_up_poll(&orig->wqh, EPOLLHUP);
537 orig = orig->prev;
538 }
539}
540
541static void __put_seccomp_filter(struct seccomp_filter *orig)
542{
543 /* Clean up single-reference branches iteratively. */
544 while (orig && refcount_dec_and_test(r: &orig->refs)) {
545 struct seccomp_filter *freeme = orig;
546 orig = orig->prev;
547 seccomp_filter_free(filter: freeme);
548 }
549}
550
551static void __seccomp_filter_release(struct seccomp_filter *orig)
552{
553 /* Notify about any unused filters in the task's former filter tree. */
554 __seccomp_filter_orphan(orig);
555 /* Finally drop all references to the task's former tree. */
556 __put_seccomp_filter(orig);
557}
558
559/**
560 * seccomp_filter_release - Detach the task from its filter tree,
561 * drop its reference count, and notify
562 * about unused filters
563 *
564 * @tsk: task the filter should be released from.
565 *
566 * This function should only be called when the task is exiting as
567 * it detaches it from its filter tree. PF_EXITING has to be set
568 * for the task.
569 */
570void seccomp_filter_release(struct task_struct *tsk)
571{
572 struct seccomp_filter *orig;
573
574 if (WARN_ON((tsk->flags & PF_EXITING) == 0))
575 return;
576
577 if (READ_ONCE(tsk->seccomp.filter) == NULL)
578 return;
579
580 spin_lock_irq(lock: &tsk->sighand->siglock);
581 orig = tsk->seccomp.filter;
582 /* Detach task from its filter tree. */
583 tsk->seccomp.filter = NULL;
584 spin_unlock_irq(lock: &tsk->sighand->siglock);
585 __seccomp_filter_release(orig);
586}
587
588/**
589 * seccomp_sync_threads: sets all threads to use current's filter
590 *
591 * @flags: SECCOMP_FILTER_FLAG_* flags to set during sync.
592 *
593 * Expects sighand and cred_guard_mutex locks to be held, and for
594 * seccomp_can_sync_threads() to have returned success already
595 * without dropping the locks.
596 *
597 */
598static inline void seccomp_sync_threads(unsigned long flags)
599{
600 struct task_struct *thread, *caller;
601
602 BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
603 assert_spin_locked(&current->sighand->siglock);
604
605 /*
606 * Don't touch any of the threads if the process is being killed.
607 * This allows for a lockless check in seccomp_filter_release.
608 */
609 if (current->signal->flags & SIGNAL_GROUP_EXIT)
610 return;
611
612 /* Synchronize all threads. */
613 caller = current;
614 for_each_thread(caller, thread) {
615 /* Skip current, since it needs no changes. */
616 if (thread == caller)
617 continue;
618
619 /*
620 * Skip exited threads. seccomp_filter_release could have
621 * been already called for this task.
622 */
623 if (thread->flags & PF_EXITING)
624 continue;
625
626 /* Get a task reference for the new leaf node. */
627 get_seccomp_filter(tsk: caller);
628
629 /*
630 * Drop the task reference to the shared ancestor since
631 * current's path will hold a reference. (This also
632 * allows a put before the assignment.)
633 */
634 __seccomp_filter_release(orig: thread->seccomp.filter);
635
636 /* Make our new filter tree visible. */
637 smp_store_release(&thread->seccomp.filter,
638 caller->seccomp.filter);
639 atomic_set(v: &thread->seccomp.filter_count,
640 i: atomic_read(v: &caller->seccomp.filter_count));
641
642 /*
643 * Don't let an unprivileged task work around
644 * the no_new_privs restriction by creating
645 * a thread that sets it up, enters seccomp,
646 * then dies.
647 */
648 if (task_no_new_privs(p: caller))
649 task_set_no_new_privs(p: thread);
650
651 /*
652 * Opt the other thread into seccomp if needed.
653 * As threads are considered to be trust-realm
654 * equivalent (see ptrace_may_access), it is safe to
655 * allow one thread to transition the other.
656 */
657 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED)
658 seccomp_assign_mode(task: thread, SECCOMP_MODE_FILTER,
659 flags);
660 }
661}
662
663/**
664 * seccomp_prepare_filter: Prepares a seccomp filter for use.
665 * @fprog: BPF program to install
666 *
667 * Returns filter on success or an ERR_PTR on failure.
668 */
669static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog)
670{
671 struct seccomp_filter *sfilter;
672 int ret;
673 const bool save_orig =
674#if defined(CONFIG_CHECKPOINT_RESTORE) || defined(SECCOMP_ARCH_NATIVE)
675 true;
676#else
677 false;
678#endif
679
680 if (fprog->len == 0 || fprog->len > BPF_MAXINSNS)
681 return ERR_PTR(error: -EINVAL);
682
683 BUG_ON(INT_MAX / fprog->len < sizeof(struct sock_filter));
684
685 /*
686 * Installing a seccomp filter requires that the task has
687 * CAP_SYS_ADMIN in its namespace or be running with no_new_privs.
688 * This avoids scenarios where unprivileged tasks can affect the
689 * behavior of privileged children.
690 */
691 if (!task_no_new_privs(current) &&
692 !ns_capable_noaudit(ns: current_user_ns(), CAP_SYS_ADMIN))
693 return ERR_PTR(error: -EACCES);
694
695 /* Allocate a new seccomp_filter */
696 sfilter = kzalloc(sizeof(*sfilter), GFP_KERNEL | __GFP_NOWARN);
697 if (!sfilter)
698 return ERR_PTR(error: -ENOMEM);
699
700 mutex_init(&sfilter->notify_lock);
701 ret = bpf_prog_create_from_user(pfp: &sfilter->prog, fprog,
702 trans: seccomp_check_filter, save_orig);
703 if (ret < 0) {
704 kfree(objp: sfilter);
705 return ERR_PTR(error: ret);
706 }
707
708 refcount_set(r: &sfilter->refs, n: 1);
709 refcount_set(r: &sfilter->users, n: 1);
710 init_waitqueue_head(&sfilter->wqh);
711
712 return sfilter;
713}
714
715/**
716 * seccomp_prepare_user_filter - prepares a user-supplied sock_fprog
717 * @user_filter: pointer to the user data containing a sock_fprog.
718 *
719 * Returns 0 on success and non-zero otherwise.
720 */
721static struct seccomp_filter *
722seccomp_prepare_user_filter(const char __user *user_filter)
723{
724 struct sock_fprog fprog;
725 struct seccomp_filter *filter = ERR_PTR(error: -EFAULT);
726
727#ifdef CONFIG_COMPAT
728 if (in_compat_syscall()) {
729 struct compat_sock_fprog fprog32;
730 if (copy_from_user(to: &fprog32, from: user_filter, n: sizeof(fprog32)))
731 goto out;
732 fprog.len = fprog32.len;
733 fprog.filter = compat_ptr(uptr: fprog32.filter);
734 } else /* falls through to the if below. */
735#endif
736 if (copy_from_user(to: &fprog, from: user_filter, n: sizeof(fprog)))
737 goto out;
738 filter = seccomp_prepare_filter(fprog: &fprog);
739out:
740 return filter;
741}
742
743#ifdef SECCOMP_ARCH_NATIVE
744static bool seccomp_uprobe_exception(struct seccomp_data *sd)
745{
746#if defined __NR_uretprobe || defined __NR_uprobe
747#ifdef SECCOMP_ARCH_COMPAT
748 if (sd->arch == SECCOMP_ARCH_NATIVE)
749#endif
750 {
751#ifdef __NR_uretprobe
752 if (sd->nr == __NR_uretprobe)
753 return true;
754#endif
755#ifdef __NR_uprobe
756 if (sd->nr == __NR_uprobe)
757 return true;
758#endif
759 }
760#endif
761 return false;
762}
763
764/**
765 * seccomp_is_const_allow - check if filter is constant allow with given data
766 * @fprog: The BPF programs
767 * @sd: The seccomp data to check against, only syscall number and arch
768 * number are considered constant.
769 */
770static bool seccomp_is_const_allow(struct sock_fprog_kern *fprog,
771 struct seccomp_data *sd)
772{
773 unsigned int reg_value = 0;
774 unsigned int pc;
775 bool op_res;
776
777 if (WARN_ON_ONCE(!fprog))
778 return false;
779
780 /* Our single exception to filtering. */
781 if (seccomp_uprobe_exception(sd))
782 return true;
783
784 for (pc = 0; pc < fprog->len; pc++) {
785 struct sock_filter *insn = &fprog->filter[pc];
786 u16 code = insn->code;
787 u32 k = insn->k;
788
789 switch (code) {
790 case BPF_LD | BPF_W | BPF_ABS:
791 switch (k) {
792 case offsetof(struct seccomp_data, nr):
793 reg_value = sd->nr;
794 break;
795 case offsetof(struct seccomp_data, arch):
796 reg_value = sd->arch;
797 break;
798 default:
799 /* can't optimize (non-constant value load) */
800 return false;
801 }
802 break;
803 case BPF_RET | BPF_K:
804 /* reached return with constant values only, check allow */
805 return k == SECCOMP_RET_ALLOW;
806 case BPF_JMP | BPF_JA:
807 pc += insn->k;
808 break;
809 case BPF_JMP | BPF_JEQ | BPF_K:
810 case BPF_JMP | BPF_JGE | BPF_K:
811 case BPF_JMP | BPF_JGT | BPF_K:
812 case BPF_JMP | BPF_JSET | BPF_K:
813 switch (BPF_OP(code)) {
814 case BPF_JEQ:
815 op_res = reg_value == k;
816 break;
817 case BPF_JGE:
818 op_res = reg_value >= k;
819 break;
820 case BPF_JGT:
821 op_res = reg_value > k;
822 break;
823 case BPF_JSET:
824 op_res = !!(reg_value & k);
825 break;
826 default:
827 /* can't optimize (unknown jump) */
828 return false;
829 }
830
831 pc += op_res ? insn->jt : insn->jf;
832 break;
833 case BPF_ALU | BPF_AND | BPF_K:
834 reg_value &= k;
835 break;
836 default:
837 /* can't optimize (unknown insn) */
838 return false;
839 }
840 }
841
842 /* ran off the end of the filter?! */
843 WARN_ON(1);
844 return false;
845}
846
847static void seccomp_cache_prepare_bitmap(struct seccomp_filter *sfilter,
848 void *bitmap, const void *bitmap_prev,
849 size_t bitmap_size, int arch)
850{
851 struct sock_fprog_kern *fprog = sfilter->prog->orig_prog;
852 struct seccomp_data sd;
853 int nr;
854
855 if (bitmap_prev) {
856 /* The new filter must be as restrictive as the last. */
857 bitmap_copy(dst: bitmap, src: bitmap_prev, nbits: bitmap_size);
858 } else {
859 /* Before any filters, all syscalls are always allowed. */
860 bitmap_fill(dst: bitmap, nbits: bitmap_size);
861 }
862
863 for (nr = 0; nr < bitmap_size; nr++) {
864 /* No bitmap change: not a cacheable action. */
865 if (!test_bit(nr, bitmap))
866 continue;
867
868 sd.nr = nr;
869 sd.arch = arch;
870
871 /* No bitmap change: continue to always allow. */
872 if (seccomp_is_const_allow(fprog, sd: &sd))
873 continue;
874
875 /*
876 * Not a cacheable action: always run filters.
877 * atomic clear_bit() not needed, filter not visible yet.
878 */
879 __clear_bit(nr, bitmap);
880 }
881}
882
883/**
884 * seccomp_cache_prepare - emulate the filter to find cacheable syscalls
885 * @sfilter: The seccomp filter
886 *
887 * Returns 0 if successful or -errno if error occurred.
888 */
889static void seccomp_cache_prepare(struct seccomp_filter *sfilter)
890{
891 struct action_cache *cache = &sfilter->cache;
892 const struct action_cache *cache_prev =
893 sfilter->prev ? &sfilter->prev->cache : NULL;
894
895 seccomp_cache_prepare_bitmap(sfilter, bitmap: cache->allow_native,
896 bitmap_prev: cache_prev ? cache_prev->allow_native : NULL,
897 SECCOMP_ARCH_NATIVE_NR,
898 SECCOMP_ARCH_NATIVE);
899
900#ifdef SECCOMP_ARCH_COMPAT
901 seccomp_cache_prepare_bitmap(sfilter, bitmap: cache->allow_compat,
902 bitmap_prev: cache_prev ? cache_prev->allow_compat : NULL,
903 SECCOMP_ARCH_COMPAT_NR,
904 SECCOMP_ARCH_COMPAT);
905#endif /* SECCOMP_ARCH_COMPAT */
906}
907#endif /* SECCOMP_ARCH_NATIVE */
908
909/**
910 * seccomp_attach_filter: validate and attach filter
911 * @flags: flags to change filter behavior
912 * @filter: seccomp filter to add to the current process
913 *
914 * Caller must be holding current->sighand->siglock lock.
915 *
916 * Returns 0 on success, -ve on error, or
917 * - in TSYNC mode: the pid of a thread which was either not in the correct
918 * seccomp mode or did not have an ancestral seccomp filter
919 * - in NEW_LISTENER mode: the fd of the new listener
920 */
921static long seccomp_attach_filter(unsigned int flags,
922 struct seccomp_filter *filter)
923{
924 unsigned long total_insns;
925 struct seccomp_filter *walker;
926
927 assert_spin_locked(&current->sighand->siglock);
928
929 /* Validate resulting filter length. */
930 total_insns = filter->prog->len;
931 for (walker = current->seccomp.filter; walker; walker = walker->prev)
932 total_insns += walker->prog->len + 4; /* 4 instr penalty */
933 if (total_insns > MAX_INSNS_PER_PATH)
934 return -ENOMEM;
935
936 /* If thread sync has been requested, check that it is possible. */
937 if (flags & SECCOMP_FILTER_FLAG_TSYNC) {
938 int ret;
939
940 ret = seccomp_can_sync_threads();
941 if (ret) {
942 if (flags & SECCOMP_FILTER_FLAG_TSYNC_ESRCH)
943 return -ESRCH;
944 else
945 return ret;
946 }
947 }
948
949 /* Set log flag, if present. */
950 if (flags & SECCOMP_FILTER_FLAG_LOG)
951 filter->log = true;
952
953 /* Set wait killable flag, if present. */
954 if (flags & SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV)
955 filter->wait_killable_recv = true;
956
957 /*
958 * If there is an existing filter, make it the prev and don't drop its
959 * task reference.
960 */
961 filter->prev = current->seccomp.filter;
962 seccomp_cache_prepare(sfilter: filter);
963 current->seccomp.filter = filter;
964 atomic_inc(v: &current->seccomp.filter_count);
965
966 /* Now that the new filter is in place, synchronize to all threads. */
967 if (flags & SECCOMP_FILTER_FLAG_TSYNC)
968 seccomp_sync_threads(flags);
969
970 return 0;
971}
972
973static void __get_seccomp_filter(struct seccomp_filter *filter)
974{
975 refcount_inc(r: &filter->refs);
976}
977
978/* get_seccomp_filter - increments the reference count of the filter on @tsk */
979void get_seccomp_filter(struct task_struct *tsk)
980{
981 struct seccomp_filter *orig = tsk->seccomp.filter;
982 if (!orig)
983 return;
984 __get_seccomp_filter(filter: orig);
985 refcount_inc(r: &orig->users);
986}
987
988#endif /* CONFIG_SECCOMP_FILTER */
989
990/* For use with seccomp_actions_logged */
991#define SECCOMP_LOG_KILL_PROCESS (1 << 0)
992#define SECCOMP_LOG_KILL_THREAD (1 << 1)
993#define SECCOMP_LOG_TRAP (1 << 2)
994#define SECCOMP_LOG_ERRNO (1 << 3)
995#define SECCOMP_LOG_TRACE (1 << 4)
996#define SECCOMP_LOG_LOG (1 << 5)
997#define SECCOMP_LOG_ALLOW (1 << 6)
998#define SECCOMP_LOG_USER_NOTIF (1 << 7)
999
1000static u32 seccomp_actions_logged = SECCOMP_LOG_KILL_PROCESS |
1001 SECCOMP_LOG_KILL_THREAD |
1002 SECCOMP_LOG_TRAP |
1003 SECCOMP_LOG_ERRNO |
1004 SECCOMP_LOG_USER_NOTIF |
1005 SECCOMP_LOG_TRACE |
1006 SECCOMP_LOG_LOG;
1007
1008static inline void seccomp_log(unsigned long syscall, long signr, u32 action,
1009 bool requested)
1010{
1011 bool log = false;
1012
1013 switch (action) {
1014 case SECCOMP_RET_ALLOW:
1015 break;
1016 case SECCOMP_RET_TRAP:
1017 log = requested && seccomp_actions_logged & SECCOMP_LOG_TRAP;
1018 break;
1019 case SECCOMP_RET_ERRNO:
1020 log = requested && seccomp_actions_logged & SECCOMP_LOG_ERRNO;
1021 break;
1022 case SECCOMP_RET_TRACE:
1023 log = requested && seccomp_actions_logged & SECCOMP_LOG_TRACE;
1024 break;
1025 case SECCOMP_RET_USER_NOTIF:
1026 log = requested && seccomp_actions_logged & SECCOMP_LOG_USER_NOTIF;
1027 break;
1028 case SECCOMP_RET_LOG:
1029 log = seccomp_actions_logged & SECCOMP_LOG_LOG;
1030 break;
1031 case SECCOMP_RET_KILL_THREAD:
1032 log = seccomp_actions_logged & SECCOMP_LOG_KILL_THREAD;
1033 break;
1034 case SECCOMP_RET_KILL_PROCESS:
1035 default:
1036 log = seccomp_actions_logged & SECCOMP_LOG_KILL_PROCESS;
1037 }
1038
1039 /*
1040 * Emit an audit message when the action is RET_KILL_*, RET_LOG, or the
1041 * FILTER_FLAG_LOG bit was set. The admin has the ability to silence
1042 * any action from being logged by removing the action name from the
1043 * seccomp_actions_logged sysctl.
1044 */
1045 if (!log)
1046 return;
1047
1048 audit_seccomp(syscall, signr, code: action);
1049}
1050
1051/*
1052 * Secure computing mode 1 allows only read/write/exit/sigreturn.
1053 * To be fully secure this must be combined with rlimit
1054 * to limit the stack allocations too.
1055 */
1056static const int mode1_syscalls[] = {
1057 __NR_seccomp_read, __NR_seccomp_write, __NR_seccomp_exit, __NR_seccomp_sigreturn,
1058#ifdef __NR_uretprobe
1059 __NR_uretprobe,
1060#endif
1061#ifdef __NR_uprobe
1062 __NR_uprobe,
1063#endif
1064 -1, /* negative terminated */
1065};
1066
1067static void __secure_computing_strict(int this_syscall)
1068{
1069 const int *allowed_syscalls = mode1_syscalls;
1070#ifdef CONFIG_COMPAT
1071 if (in_compat_syscall())
1072 allowed_syscalls = get_compat_mode1_syscalls();
1073#endif
1074 do {
1075 if (*allowed_syscalls == this_syscall)
1076 return;
1077 } while (*++allowed_syscalls != -1);
1078
1079#ifdef SECCOMP_DEBUG
1080 dump_stack();
1081#endif
1082 current->seccomp.mode = SECCOMP_MODE_DEAD;
1083 seccomp_log(syscall: this_syscall, SIGKILL, SECCOMP_RET_KILL_THREAD, requested: true);
1084 do_exit(SIGKILL);
1085}
1086
1087#ifndef CONFIG_HAVE_ARCH_SECCOMP_FILTER
1088void secure_computing_strict(int this_syscall)
1089{
1090 int mode = current->seccomp.mode;
1091
1092 if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) &&
1093 unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
1094 return;
1095
1096 if (mode == SECCOMP_MODE_DISABLED)
1097 return;
1098 else if (mode == SECCOMP_MODE_STRICT)
1099 __secure_computing_strict(this_syscall);
1100 else
1101 BUG();
1102}
1103int __secure_computing(void)
1104{
1105 int this_syscall = syscall_get_nr(current, current_pt_regs());
1106
1107 secure_computing_strict(this_syscall);
1108 return 0;
1109}
1110#else
1111
1112#ifdef CONFIG_SECCOMP_FILTER
1113static u64 seccomp_next_notify_id(struct seccomp_filter *filter)
1114{
1115 /*
1116 * Note: overflow is ok here, the id just needs to be unique per
1117 * filter.
1118 */
1119 lockdep_assert_held(&filter->notify_lock);
1120 return filter->notif->next_id++;
1121}
1122
1123static void seccomp_handle_addfd(struct seccomp_kaddfd *addfd, struct seccomp_knotif *n)
1124{
1125 int fd;
1126
1127 /*
1128 * Remove the notification, and reset the list pointers, indicating
1129 * that it has been handled.
1130 */
1131 list_del_init(entry: &addfd->list);
1132 if (!addfd->setfd)
1133 fd = receive_fd(file: addfd->file, NULL, o_flags: addfd->flags);
1134 else
1135 fd = receive_fd_replace(new_fd: addfd->fd, file: addfd->file, o_flags: addfd->flags);
1136 addfd->ret = fd;
1137
1138 if (addfd->ioctl_flags & SECCOMP_ADDFD_FLAG_SEND) {
1139 /* If we fail reset and return an error to the notifier */
1140 if (fd < 0) {
1141 n->state = SECCOMP_NOTIFY_SENT;
1142 } else {
1143 /* Return the FD we just added */
1144 n->flags = 0;
1145 n->error = 0;
1146 n->val = fd;
1147 }
1148 }
1149
1150 /*
1151 * Mark the notification as completed. From this point, addfd mem
1152 * might be invalidated and we can't safely read it anymore.
1153 */
1154 complete(&addfd->completion);
1155}
1156
1157static bool should_sleep_killable(struct seccomp_filter *match,
1158 struct seccomp_knotif *n)
1159{
1160 return match->wait_killable_recv && n->state >= SECCOMP_NOTIFY_SENT;
1161}
1162
1163static int seccomp_do_user_notification(int this_syscall,
1164 struct seccomp_filter *match,
1165 const struct seccomp_data *sd)
1166{
1167 int err;
1168 u32 flags = 0;
1169 long ret = 0;
1170 struct seccomp_knotif n = {};
1171 struct seccomp_kaddfd *addfd, *tmp;
1172
1173 mutex_lock(lock: &match->notify_lock);
1174 err = -ENOSYS;
1175 if (!match->notif)
1176 goto out;
1177
1178 n.task = current;
1179 n.state = SECCOMP_NOTIFY_INIT;
1180 n.data = sd;
1181 n.id = seccomp_next_notify_id(filter: match);
1182 init_completion(x: &n.ready);
1183 list_add_tail(new: &n.list, head: &match->notif->notifications);
1184 INIT_LIST_HEAD(list: &n.addfd);
1185
1186 atomic_inc(v: &match->notif->requests);
1187 if (match->notif->flags & SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP)
1188 wake_up_poll_on_current_cpu(&match->wqh, EPOLLIN | EPOLLRDNORM);
1189 else
1190 wake_up_poll(&match->wqh, EPOLLIN | EPOLLRDNORM);
1191
1192 /*
1193 * This is where we wait for a reply from userspace.
1194 */
1195 do {
1196 bool wait_killable = should_sleep_killable(match, n: &n);
1197
1198 mutex_unlock(lock: &match->notify_lock);
1199 if (wait_killable)
1200 err = wait_for_completion_killable(x: &n.ready);
1201 else
1202 err = wait_for_completion_interruptible(x: &n.ready);
1203 mutex_lock(lock: &match->notify_lock);
1204
1205 if (err != 0) {
1206 /*
1207 * Check to see whether we should switch to wait
1208 * killable. Only return the interrupted error if not.
1209 */
1210 if (!(!wait_killable && should_sleep_killable(match, n: &n)))
1211 goto interrupted;
1212 }
1213
1214 addfd = list_first_entry_or_null(&n.addfd,
1215 struct seccomp_kaddfd, list);
1216 /* Check if we were woken up by a addfd message */
1217 if (addfd)
1218 seccomp_handle_addfd(addfd, n: &n);
1219
1220 } while (n.state != SECCOMP_NOTIFY_REPLIED);
1221
1222 ret = n.val;
1223 err = n.error;
1224 flags = n.flags;
1225
1226interrupted:
1227 /* If there were any pending addfd calls, clear them out */
1228 list_for_each_entry_safe(addfd, tmp, &n.addfd, list) {
1229 /* The process went away before we got a chance to handle it */
1230 addfd->ret = -ESRCH;
1231 list_del_init(entry: &addfd->list);
1232 complete(&addfd->completion);
1233 }
1234
1235 /*
1236 * Note that it's possible the listener died in between the time when
1237 * we were notified of a response (or a signal) and when we were able to
1238 * re-acquire the lock, so only delete from the list if the
1239 * notification actually exists.
1240 *
1241 * Also note that this test is only valid because there's no way to
1242 * *reattach* to a notifier right now. If one is added, we'll need to
1243 * keep track of the notif itself and make sure they match here.
1244 */
1245 if (match->notif)
1246 list_del(entry: &n.list);
1247out:
1248 mutex_unlock(lock: &match->notify_lock);
1249
1250 /* Userspace requests to continue the syscall. */
1251 if (flags & SECCOMP_USER_NOTIF_FLAG_CONTINUE)
1252 return 0;
1253
1254 syscall_set_return_value(current, current_pt_regs(),
1255 error: err, val: ret);
1256 return -1;
1257}
1258
1259static int __seccomp_filter(int this_syscall, const bool recheck_after_trace)
1260{
1261 u32 filter_ret, action;
1262 struct seccomp_data sd;
1263 struct seccomp_filter *match = NULL;
1264 int data;
1265
1266 /*
1267 * Make sure that any changes to mode from another thread have
1268 * been seen after SYSCALL_WORK_SECCOMP was seen.
1269 */
1270 smp_rmb();
1271
1272 populate_seccomp_data(sd: &sd);
1273
1274 filter_ret = seccomp_run_filters(sd: &sd, match: &match);
1275 data = filter_ret & SECCOMP_RET_DATA;
1276 action = filter_ret & SECCOMP_RET_ACTION_FULL;
1277
1278 switch (action) {
1279 case SECCOMP_RET_ERRNO:
1280 /* Set low-order bits as an errno, capped at MAX_ERRNO. */
1281 if (data > MAX_ERRNO)
1282 data = MAX_ERRNO;
1283 syscall_set_return_value(current, current_pt_regs(),
1284 error: -data, val: 0);
1285 goto skip;
1286
1287 case SECCOMP_RET_TRAP:
1288 /* Show the handler the original registers. */
1289 syscall_rollback(current, current_pt_regs());
1290 /* Let the filter pass back 16 bits of data. */
1291 force_sig_seccomp(syscall: this_syscall, reason: data, force_coredump: false);
1292 goto skip;
1293
1294 case SECCOMP_RET_TRACE:
1295 /* We've been put in this state by the ptracer already. */
1296 if (recheck_after_trace)
1297 return 0;
1298
1299 /* ENOSYS these calls if there is no tracer attached. */
1300 if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP)) {
1301 syscall_set_return_value(current,
1302 current_pt_regs(),
1303 error: -ENOSYS, val: 0);
1304 goto skip;
1305 }
1306
1307 /* Allow the BPF to provide the event message */
1308 ptrace_event(PTRACE_EVENT_SECCOMP, message: data);
1309 /*
1310 * The delivery of a fatal signal during event
1311 * notification may silently skip tracer notification,
1312 * which could leave us with a potentially unmodified
1313 * syscall that the tracer would have liked to have
1314 * changed. Since the process is about to die, we just
1315 * force the syscall to be skipped and let the signal
1316 * kill the process and correctly handle any tracer exit
1317 * notifications.
1318 */
1319 if (fatal_signal_pending(current))
1320 goto skip;
1321 /* Check if the tracer forced the syscall to be skipped. */
1322 this_syscall = syscall_get_nr(current, current_pt_regs());
1323 if (this_syscall < 0)
1324 goto skip;
1325
1326 /*
1327 * Recheck the syscall, since it may have changed. This
1328 * intentionally uses a NULL struct seccomp_data to force
1329 * a reload of all registers. This does not goto skip since
1330 * a skip would have already been reported.
1331 */
1332 if (__seccomp_filter(this_syscall, recheck_after_trace: true))
1333 return -1;
1334
1335 return 0;
1336
1337 case SECCOMP_RET_USER_NOTIF:
1338 if (seccomp_do_user_notification(this_syscall, match, sd: &sd))
1339 goto skip;
1340
1341 return 0;
1342
1343 case SECCOMP_RET_LOG:
1344 seccomp_log(syscall: this_syscall, signr: 0, action, requested: true);
1345 return 0;
1346
1347 case SECCOMP_RET_ALLOW:
1348 /*
1349 * Note that the "match" filter will always be NULL for
1350 * this action since SECCOMP_RET_ALLOW is the starting
1351 * state in seccomp_run_filters().
1352 */
1353 return 0;
1354
1355 case SECCOMP_RET_KILL_THREAD:
1356 case SECCOMP_RET_KILL_PROCESS:
1357 default:
1358 current->seccomp.mode = SECCOMP_MODE_DEAD;
1359 seccomp_log(syscall: this_syscall, SIGSYS, action, requested: true);
1360 /* Dump core only if this is the last remaining thread. */
1361 if (action != SECCOMP_RET_KILL_THREAD ||
1362 (atomic_read(v: &current->signal->live) == 1)) {
1363 /* Show the original registers in the dump. */
1364 syscall_rollback(current, current_pt_regs());
1365 /* Trigger a coredump with SIGSYS */
1366 force_sig_seccomp(syscall: this_syscall, reason: data, force_coredump: true);
1367 } else {
1368 do_exit(SIGSYS);
1369 }
1370 return -1; /* skip the syscall go directly to signal handling */
1371 }
1372
1373 unreachable();
1374
1375skip:
1376 seccomp_log(syscall: this_syscall, signr: 0, action, requested: match ? match->log : false);
1377 return -1;
1378}
1379#else
1380static int __seccomp_filter(int this_syscall, const bool recheck_after_trace)
1381{
1382 BUG();
1383
1384 return -1;
1385}
1386#endif
1387
1388int __secure_computing(void)
1389{
1390 int mode = current->seccomp.mode;
1391 int this_syscall;
1392
1393 if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) &&
1394 unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
1395 return 0;
1396
1397 this_syscall = syscall_get_nr(current, current_pt_regs());
1398
1399 switch (mode) {
1400 case SECCOMP_MODE_STRICT:
1401 __secure_computing_strict(this_syscall); /* may call do_exit */
1402 return 0;
1403 case SECCOMP_MODE_FILTER:
1404 return __seccomp_filter(this_syscall, recheck_after_trace: false);
1405 /* Surviving SECCOMP_RET_KILL_* must be proactively impossible. */
1406 case SECCOMP_MODE_DEAD:
1407 WARN_ON_ONCE(1);
1408 do_exit(SIGKILL);
1409 return -1;
1410 default:
1411 BUG();
1412 }
1413}
1414#endif /* CONFIG_HAVE_ARCH_SECCOMP_FILTER */
1415
1416long prctl_get_seccomp(void)
1417{
1418 return current->seccomp.mode;
1419}
1420
1421/**
1422 * seccomp_set_mode_strict: internal function for setting strict seccomp
1423 *
1424 * Once current->seccomp.mode is non-zero, it may not be changed.
1425 *
1426 * Returns 0 on success or -EINVAL on failure.
1427 */
1428static long seccomp_set_mode_strict(void)
1429{
1430 const unsigned long seccomp_mode = SECCOMP_MODE_STRICT;
1431 long ret = -EINVAL;
1432
1433 spin_lock_irq(lock: &current->sighand->siglock);
1434
1435 if (!seccomp_may_assign_mode(seccomp_mode))
1436 goto out;
1437
1438#ifdef TIF_NOTSC
1439 disable_TSC();
1440#endif
1441 seccomp_assign_mode(current, seccomp_mode, flags: 0);
1442 ret = 0;
1443
1444out:
1445 spin_unlock_irq(lock: &current->sighand->siglock);
1446
1447 return ret;
1448}
1449
1450#ifdef CONFIG_SECCOMP_FILTER
1451static void seccomp_notify_free(struct seccomp_filter *filter)
1452{
1453 kfree(objp: filter->notif);
1454 filter->notif = NULL;
1455}
1456
1457static void seccomp_notify_detach(struct seccomp_filter *filter)
1458{
1459 struct seccomp_knotif *knotif;
1460
1461 if (!filter)
1462 return;
1463
1464 mutex_lock(lock: &filter->notify_lock);
1465
1466 /*
1467 * If this file is being closed because e.g. the task who owned it
1468 * died, let's wake everyone up who was waiting on us.
1469 */
1470 list_for_each_entry(knotif, &filter->notif->notifications, list) {
1471 if (knotif->state == SECCOMP_NOTIFY_REPLIED)
1472 continue;
1473
1474 knotif->state = SECCOMP_NOTIFY_REPLIED;
1475 knotif->error = -ENOSYS;
1476 knotif->val = 0;
1477
1478 /*
1479 * We do not need to wake up any pending addfd messages, as
1480 * the notifier will do that for us, as this just looks
1481 * like a standard reply.
1482 */
1483 complete(&knotif->ready);
1484 }
1485
1486 seccomp_notify_free(filter);
1487 mutex_unlock(lock: &filter->notify_lock);
1488}
1489
1490static int seccomp_notify_release(struct inode *inode, struct file *file)
1491{
1492 struct seccomp_filter *filter = file->private_data;
1493
1494 seccomp_notify_detach(filter);
1495 __put_seccomp_filter(orig: filter);
1496 return 0;
1497}
1498
1499/* must be called with notif_lock held */
1500static inline struct seccomp_knotif *
1501find_notification(struct seccomp_filter *filter, u64 id)
1502{
1503 struct seccomp_knotif *cur;
1504
1505 lockdep_assert_held(&filter->notify_lock);
1506
1507 list_for_each_entry(cur, &filter->notif->notifications, list) {
1508 if (cur->id == id)
1509 return cur;
1510 }
1511
1512 return NULL;
1513}
1514
1515static int recv_wake_function(wait_queue_entry_t *wait, unsigned int mode, int sync,
1516 void *key)
1517{
1518 /* Avoid a wakeup if event not interesting for us. */
1519 if (key && !(key_to_poll(key) & (EPOLLIN | EPOLLERR | EPOLLHUP)))
1520 return 0;
1521 return autoremove_wake_function(wq_entry: wait, mode, sync, key);
1522}
1523
1524static int recv_wait_event(struct seccomp_filter *filter)
1525{
1526 DEFINE_WAIT_FUNC(wait, recv_wake_function);
1527 int ret;
1528
1529 if (refcount_read(r: &filter->users) == 0)
1530 return 0;
1531
1532 if (atomic_dec_if_positive(v: &filter->notif->requests) >= 0)
1533 return 0;
1534
1535 for (;;) {
1536 ret = prepare_to_wait_event(wq_head: &filter->wqh, wq_entry: &wait, TASK_INTERRUPTIBLE);
1537
1538 if (atomic_dec_if_positive(v: &filter->notif->requests) >= 0)
1539 break;
1540 if (refcount_read(r: &filter->users) == 0)
1541 break;
1542
1543 if (ret)
1544 return ret;
1545
1546 schedule();
1547 }
1548 finish_wait(wq_head: &filter->wqh, wq_entry: &wait);
1549 return 0;
1550}
1551
1552static long seccomp_notify_recv(struct seccomp_filter *filter,
1553 void __user *buf)
1554{
1555 struct seccomp_knotif *knotif = NULL, *cur;
1556 struct seccomp_notif unotif;
1557 ssize_t ret;
1558
1559 /* Verify that we're not given garbage to keep struct extensible. */
1560 ret = check_zeroed_user(from: buf, size: sizeof(unotif));
1561 if (ret < 0)
1562 return ret;
1563 if (!ret)
1564 return -EINVAL;
1565
1566 memset(s: &unotif, c: 0, n: sizeof(unotif));
1567
1568 ret = recv_wait_event(filter);
1569 if (ret < 0)
1570 return ret;
1571
1572 mutex_lock(lock: &filter->notify_lock);
1573 list_for_each_entry(cur, &filter->notif->notifications, list) {
1574 if (cur->state == SECCOMP_NOTIFY_INIT) {
1575 knotif = cur;
1576 break;
1577 }
1578 }
1579
1580 /*
1581 * If we didn't find a notification, it could be that the task was
1582 * interrupted by a fatal signal between the time we were woken and
1583 * when we were able to acquire the rw lock.
1584 */
1585 if (!knotif) {
1586 ret = -ENOENT;
1587 goto out;
1588 }
1589
1590 unotif.id = knotif->id;
1591 unotif.pid = task_pid_vnr(tsk: knotif->task);
1592 unotif.data = *(knotif->data);
1593
1594 knotif->state = SECCOMP_NOTIFY_SENT;
1595 wake_up_poll(&filter->wqh, EPOLLOUT | EPOLLWRNORM);
1596 ret = 0;
1597out:
1598 mutex_unlock(lock: &filter->notify_lock);
1599
1600 if (ret == 0 && copy_to_user(to: buf, from: &unotif, n: sizeof(unotif))) {
1601 ret = -EFAULT;
1602
1603 /*
1604 * Userspace screwed up. To make sure that we keep this
1605 * notification alive, let's reset it back to INIT. It
1606 * may have died when we released the lock, so we need to make
1607 * sure it's still around.
1608 */
1609 mutex_lock(lock: &filter->notify_lock);
1610 knotif = find_notification(filter, id: unotif.id);
1611 if (knotif) {
1612 /* Reset the process to make sure it's not stuck */
1613 if (should_sleep_killable(match: filter, n: knotif))
1614 complete(&knotif->ready);
1615 knotif->state = SECCOMP_NOTIFY_INIT;
1616 atomic_inc(v: &filter->notif->requests);
1617 wake_up_poll(&filter->wqh, EPOLLIN | EPOLLRDNORM);
1618 }
1619 mutex_unlock(lock: &filter->notify_lock);
1620 }
1621
1622 return ret;
1623}
1624
1625static long seccomp_notify_send(struct seccomp_filter *filter,
1626 void __user *buf)
1627{
1628 struct seccomp_notif_resp resp = {};
1629 struct seccomp_knotif *knotif;
1630 long ret;
1631
1632 if (copy_from_user(to: &resp, from: buf, n: sizeof(resp)))
1633 return -EFAULT;
1634
1635 if (resp.flags & ~SECCOMP_USER_NOTIF_FLAG_CONTINUE)
1636 return -EINVAL;
1637
1638 if ((resp.flags & SECCOMP_USER_NOTIF_FLAG_CONTINUE) &&
1639 (resp.error || resp.val))
1640 return -EINVAL;
1641
1642 ret = mutex_lock_interruptible(lock: &filter->notify_lock);
1643 if (ret < 0)
1644 return ret;
1645
1646 knotif = find_notification(filter, id: resp.id);
1647 if (!knotif) {
1648 ret = -ENOENT;
1649 goto out;
1650 }
1651
1652 /* Allow exactly one reply. */
1653 if (knotif->state != SECCOMP_NOTIFY_SENT) {
1654 ret = -EINPROGRESS;
1655 goto out;
1656 }
1657
1658 ret = 0;
1659 knotif->state = SECCOMP_NOTIFY_REPLIED;
1660 knotif->error = resp.error;
1661 knotif->val = resp.val;
1662 knotif->flags = resp.flags;
1663 if (filter->notif->flags & SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP)
1664 complete_on_current_cpu(x: &knotif->ready);
1665 else
1666 complete(&knotif->ready);
1667out:
1668 mutex_unlock(lock: &filter->notify_lock);
1669 return ret;
1670}
1671
1672static long seccomp_notify_id_valid(struct seccomp_filter *filter,
1673 void __user *buf)
1674{
1675 struct seccomp_knotif *knotif;
1676 u64 id;
1677 long ret;
1678
1679 if (copy_from_user(to: &id, from: buf, n: sizeof(id)))
1680 return -EFAULT;
1681
1682 ret = mutex_lock_interruptible(lock: &filter->notify_lock);
1683 if (ret < 0)
1684 return ret;
1685
1686 knotif = find_notification(filter, id);
1687 if (knotif && knotif->state == SECCOMP_NOTIFY_SENT)
1688 ret = 0;
1689 else
1690 ret = -ENOENT;
1691
1692 mutex_unlock(lock: &filter->notify_lock);
1693 return ret;
1694}
1695
1696static long seccomp_notify_set_flags(struct seccomp_filter *filter,
1697 unsigned long flags)
1698{
1699 long ret;
1700
1701 if (flags & ~SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP)
1702 return -EINVAL;
1703
1704 ret = mutex_lock_interruptible(lock: &filter->notify_lock);
1705 if (ret < 0)
1706 return ret;
1707 filter->notif->flags = flags;
1708 mutex_unlock(lock: &filter->notify_lock);
1709 return 0;
1710}
1711
1712static long seccomp_notify_addfd(struct seccomp_filter *filter,
1713 struct seccomp_notif_addfd __user *uaddfd,
1714 unsigned int size)
1715{
1716 struct seccomp_notif_addfd addfd;
1717 struct seccomp_knotif *knotif;
1718 struct seccomp_kaddfd kaddfd;
1719 int ret;
1720
1721 BUILD_BUG_ON(sizeof(addfd) < SECCOMP_NOTIFY_ADDFD_SIZE_VER0);
1722 BUILD_BUG_ON(sizeof(addfd) != SECCOMP_NOTIFY_ADDFD_SIZE_LATEST);
1723
1724 if (size < SECCOMP_NOTIFY_ADDFD_SIZE_VER0 || size >= PAGE_SIZE)
1725 return -EINVAL;
1726
1727 ret = copy_struct_from_user(dst: &addfd, ksize: sizeof(addfd), src: uaddfd, usize: size);
1728 if (ret)
1729 return ret;
1730
1731 if (addfd.newfd_flags & ~O_CLOEXEC)
1732 return -EINVAL;
1733
1734 if (addfd.flags & ~(SECCOMP_ADDFD_FLAG_SETFD | SECCOMP_ADDFD_FLAG_SEND))
1735 return -EINVAL;
1736
1737 if (addfd.newfd && !(addfd.flags & SECCOMP_ADDFD_FLAG_SETFD))
1738 return -EINVAL;
1739
1740 kaddfd.file = fget(fd: addfd.srcfd);
1741 if (!kaddfd.file)
1742 return -EBADF;
1743
1744 kaddfd.ioctl_flags = addfd.flags;
1745 kaddfd.flags = addfd.newfd_flags;
1746 kaddfd.setfd = addfd.flags & SECCOMP_ADDFD_FLAG_SETFD;
1747 kaddfd.fd = addfd.newfd;
1748 init_completion(x: &kaddfd.completion);
1749
1750 ret = mutex_lock_interruptible(lock: &filter->notify_lock);
1751 if (ret < 0)
1752 goto out;
1753
1754 knotif = find_notification(filter, id: addfd.id);
1755 if (!knotif) {
1756 ret = -ENOENT;
1757 goto out_unlock;
1758 }
1759
1760 /*
1761 * We do not want to allow for FD injection to occur before the
1762 * notification has been picked up by a userspace handler, or after
1763 * the notification has been replied to.
1764 */
1765 if (knotif->state != SECCOMP_NOTIFY_SENT) {
1766 ret = -EINPROGRESS;
1767 goto out_unlock;
1768 }
1769
1770 if (addfd.flags & SECCOMP_ADDFD_FLAG_SEND) {
1771 /*
1772 * Disallow queuing an atomic addfd + send reply while there are
1773 * some addfd requests still to process.
1774 *
1775 * There is no clear reason to support it and allows us to keep
1776 * the loop on the other side straight-forward.
1777 */
1778 if (!list_empty(head: &knotif->addfd)) {
1779 ret = -EBUSY;
1780 goto out_unlock;
1781 }
1782
1783 /* Allow exactly only one reply */
1784 knotif->state = SECCOMP_NOTIFY_REPLIED;
1785 }
1786
1787 list_add(new: &kaddfd.list, head: &knotif->addfd);
1788 complete(&knotif->ready);
1789 mutex_unlock(lock: &filter->notify_lock);
1790
1791 /* Now we wait for it to be processed or be interrupted */
1792 ret = wait_for_completion_interruptible(x: &kaddfd.completion);
1793 if (ret == 0) {
1794 /*
1795 * We had a successful completion. The other side has already
1796 * removed us from the addfd queue, and
1797 * wait_for_completion_interruptible has a memory barrier upon
1798 * success that lets us read this value directly without
1799 * locking.
1800 */
1801 ret = kaddfd.ret;
1802 goto out;
1803 }
1804
1805 mutex_lock(lock: &filter->notify_lock);
1806 /*
1807 * Even though we were woken up by a signal and not a successful
1808 * completion, a completion may have happened in the mean time.
1809 *
1810 * We need to check again if the addfd request has been handled,
1811 * and if not, we will remove it from the queue.
1812 */
1813 if (list_empty(head: &kaddfd.list))
1814 ret = kaddfd.ret;
1815 else
1816 list_del(entry: &kaddfd.list);
1817
1818out_unlock:
1819 mutex_unlock(lock: &filter->notify_lock);
1820out:
1821 fput(kaddfd.file);
1822
1823 return ret;
1824}
1825
1826static long seccomp_notify_ioctl(struct file *file, unsigned int cmd,
1827 unsigned long arg)
1828{
1829 struct seccomp_filter *filter = file->private_data;
1830 void __user *buf = (void __user *)arg;
1831
1832 /* Fixed-size ioctls */
1833 switch (cmd) {
1834 case SECCOMP_IOCTL_NOTIF_RECV:
1835 return seccomp_notify_recv(filter, buf);
1836 case SECCOMP_IOCTL_NOTIF_SEND:
1837 return seccomp_notify_send(filter, buf);
1838 case SECCOMP_IOCTL_NOTIF_ID_VALID_WRONG_DIR:
1839 case SECCOMP_IOCTL_NOTIF_ID_VALID:
1840 return seccomp_notify_id_valid(filter, buf);
1841 case SECCOMP_IOCTL_NOTIF_SET_FLAGS:
1842 return seccomp_notify_set_flags(filter, flags: arg);
1843 }
1844
1845 /* Extensible Argument ioctls */
1846#define EA_IOCTL(cmd) ((cmd) & ~(IOC_INOUT | IOCSIZE_MASK))
1847 switch (EA_IOCTL(cmd)) {
1848 case EA_IOCTL(SECCOMP_IOCTL_NOTIF_ADDFD):
1849 return seccomp_notify_addfd(filter, uaddfd: buf, _IOC_SIZE(cmd));
1850 default:
1851 return -EINVAL;
1852 }
1853}
1854
1855static __poll_t seccomp_notify_poll(struct file *file,
1856 struct poll_table_struct *poll_tab)
1857{
1858 struct seccomp_filter *filter = file->private_data;
1859 __poll_t ret = 0;
1860 struct seccomp_knotif *cur;
1861
1862 poll_wait(filp: file, wait_address: &filter->wqh, p: poll_tab);
1863
1864 if (mutex_lock_interruptible(lock: &filter->notify_lock) < 0)
1865 return EPOLLERR;
1866
1867 list_for_each_entry(cur, &filter->notif->notifications, list) {
1868 if (cur->state == SECCOMP_NOTIFY_INIT)
1869 ret |= EPOLLIN | EPOLLRDNORM;
1870 if (cur->state == SECCOMP_NOTIFY_SENT)
1871 ret |= EPOLLOUT | EPOLLWRNORM;
1872 if ((ret & EPOLLIN) && (ret & EPOLLOUT))
1873 break;
1874 }
1875
1876 mutex_unlock(lock: &filter->notify_lock);
1877
1878 if (refcount_read(r: &filter->users) == 0)
1879 ret |= EPOLLHUP;
1880
1881 return ret;
1882}
1883
1884static const struct file_operations seccomp_notify_ops = {
1885 .poll = seccomp_notify_poll,
1886 .release = seccomp_notify_release,
1887 .unlocked_ioctl = seccomp_notify_ioctl,
1888 .compat_ioctl = seccomp_notify_ioctl,
1889};
1890
1891static struct file *init_listener(struct seccomp_filter *filter)
1892{
1893 struct file *ret;
1894
1895 ret = ERR_PTR(error: -ENOMEM);
1896 filter->notif = kzalloc(sizeof(*(filter->notif)), GFP_KERNEL);
1897 if (!filter->notif)
1898 goto out;
1899
1900 filter->notif->next_id = get_random_u64();
1901 INIT_LIST_HEAD(list: &filter->notif->notifications);
1902
1903 ret = anon_inode_getfile(name: "seccomp notify", fops: &seccomp_notify_ops,
1904 priv: filter, O_RDWR);
1905 if (IS_ERR(ptr: ret))
1906 goto out_notif;
1907
1908 /* The file has a reference to it now */
1909 __get_seccomp_filter(filter);
1910
1911out_notif:
1912 if (IS_ERR(ptr: ret))
1913 seccomp_notify_free(filter);
1914out:
1915 return ret;
1916}
1917
1918/*
1919 * Does @new_child have a listener while an ancestor also has a listener?
1920 * If so, we'll want to reject this filter.
1921 * This only has to be tested for the current process, even in the TSYNC case,
1922 * because TSYNC installs @child with the same parent on all threads.
1923 * Note that @new_child is not hooked up to its parent at this point yet, so
1924 * we use current->seccomp.filter.
1925 */
1926static bool has_duplicate_listener(struct seccomp_filter *new_child)
1927{
1928 struct seccomp_filter *cur;
1929
1930 /* must be protected against concurrent TSYNC */
1931 lockdep_assert_held(&current->sighand->siglock);
1932
1933 if (!new_child->notif)
1934 return false;
1935 for (cur = current->seccomp.filter; cur; cur = cur->prev) {
1936 if (cur->notif)
1937 return true;
1938 }
1939
1940 return false;
1941}
1942
1943/**
1944 * seccomp_set_mode_filter: internal function for setting seccomp filter
1945 * @flags: flags to change filter behavior
1946 * @filter: struct sock_fprog containing filter
1947 *
1948 * This function may be called repeatedly to install additional filters.
1949 * Every filter successfully installed will be evaluated (in reverse order)
1950 * for each system call the task makes.
1951 *
1952 * Once current->seccomp.mode is non-zero, it may not be changed.
1953 *
1954 * Returns 0 on success or -EINVAL on failure.
1955 */
1956static long seccomp_set_mode_filter(unsigned int flags,
1957 const char __user *filter)
1958{
1959 const unsigned long seccomp_mode = SECCOMP_MODE_FILTER;
1960 struct seccomp_filter *prepared = NULL;
1961 long ret = -EINVAL;
1962 int listener = -1;
1963 struct file *listener_f = NULL;
1964
1965 /* Validate flags. */
1966 if (flags & ~SECCOMP_FILTER_FLAG_MASK)
1967 return -EINVAL;
1968
1969 /*
1970 * In the successful case, NEW_LISTENER returns the new listener fd.
1971 * But in the failure case, TSYNC returns the thread that died. If you
1972 * combine these two flags, there's no way to tell whether something
1973 * succeeded or failed. So, let's disallow this combination if the user
1974 * has not explicitly requested no errors from TSYNC.
1975 */
1976 if ((flags & SECCOMP_FILTER_FLAG_TSYNC) &&
1977 (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) &&
1978 ((flags & SECCOMP_FILTER_FLAG_TSYNC_ESRCH) == 0))
1979 return -EINVAL;
1980
1981 /*
1982 * The SECCOMP_FILTER_FLAG_WAIT_KILLABLE_SENT flag doesn't make sense
1983 * without the SECCOMP_FILTER_FLAG_NEW_LISTENER flag.
1984 */
1985 if ((flags & SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV) &&
1986 ((flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) == 0))
1987 return -EINVAL;
1988
1989 /* Prepare the new filter before holding any locks. */
1990 prepared = seccomp_prepare_user_filter(user_filter: filter);
1991 if (IS_ERR(ptr: prepared))
1992 return PTR_ERR(ptr: prepared);
1993
1994 if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) {
1995 listener = get_unused_fd_flags(O_CLOEXEC);
1996 if (listener < 0) {
1997 ret = listener;
1998 goto out_free;
1999 }
2000
2001 listener_f = init_listener(filter: prepared);
2002 if (IS_ERR(ptr: listener_f)) {
2003 put_unused_fd(fd: listener);
2004 ret = PTR_ERR(ptr: listener_f);
2005 goto out_free;
2006 }
2007 }
2008
2009 /*
2010 * Make sure we cannot change seccomp or nnp state via TSYNC
2011 * while another thread is in the middle of calling exec.
2012 */
2013 if (flags & SECCOMP_FILTER_FLAG_TSYNC &&
2014 mutex_lock_killable(lock: &current->signal->cred_guard_mutex))
2015 goto out_put_fd;
2016
2017 spin_lock_irq(lock: &current->sighand->siglock);
2018
2019 if (!seccomp_may_assign_mode(seccomp_mode))
2020 goto out;
2021
2022 if (has_duplicate_listener(new_child: prepared)) {
2023 ret = -EBUSY;
2024 goto out;
2025 }
2026
2027 ret = seccomp_attach_filter(flags, filter: prepared);
2028 if (ret)
2029 goto out;
2030 /* Do not free the successfully attached filter. */
2031 prepared = NULL;
2032
2033 seccomp_assign_mode(current, seccomp_mode, flags);
2034out:
2035 spin_unlock_irq(lock: &current->sighand->siglock);
2036 if (flags & SECCOMP_FILTER_FLAG_TSYNC)
2037 mutex_unlock(lock: &current->signal->cred_guard_mutex);
2038out_put_fd:
2039 if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) {
2040 if (ret) {
2041 listener_f->private_data = NULL;
2042 fput(listener_f);
2043 put_unused_fd(fd: listener);
2044 seccomp_notify_detach(filter: prepared);
2045 } else {
2046 fd_install(fd: listener, file: listener_f);
2047 ret = listener;
2048 }
2049 }
2050out_free:
2051 seccomp_filter_free(filter: prepared);
2052 return ret;
2053}
2054#else
2055static inline long seccomp_set_mode_filter(unsigned int flags,
2056 const char __user *filter)
2057{
2058 return -EINVAL;
2059}
2060#endif
2061
2062static long seccomp_get_action_avail(const char __user *uaction)
2063{
2064 u32 action;
2065
2066 if (copy_from_user(to: &action, from: uaction, n: sizeof(action)))
2067 return -EFAULT;
2068
2069 switch (action) {
2070 case SECCOMP_RET_KILL_PROCESS:
2071 case SECCOMP_RET_KILL_THREAD:
2072 case SECCOMP_RET_TRAP:
2073 case SECCOMP_RET_ERRNO:
2074 case SECCOMP_RET_USER_NOTIF:
2075 case SECCOMP_RET_TRACE:
2076 case SECCOMP_RET_LOG:
2077 case SECCOMP_RET_ALLOW:
2078 break;
2079 default:
2080 return -EOPNOTSUPP;
2081 }
2082
2083 return 0;
2084}
2085
2086static long seccomp_get_notif_sizes(void __user *usizes)
2087{
2088 struct seccomp_notif_sizes sizes = {
2089 .seccomp_notif = sizeof(struct seccomp_notif),
2090 .seccomp_notif_resp = sizeof(struct seccomp_notif_resp),
2091 .seccomp_data = sizeof(struct seccomp_data),
2092 };
2093
2094 if (copy_to_user(to: usizes, from: &sizes, n: sizeof(sizes)))
2095 return -EFAULT;
2096
2097 return 0;
2098}
2099
2100/* Common entry point for both prctl and syscall. */
2101static long do_seccomp(unsigned int op, unsigned int flags,
2102 void __user *uargs)
2103{
2104 switch (op) {
2105 case SECCOMP_SET_MODE_STRICT:
2106 if (flags != 0 || uargs != NULL)
2107 return -EINVAL;
2108 return seccomp_set_mode_strict();
2109 case SECCOMP_SET_MODE_FILTER:
2110 return seccomp_set_mode_filter(flags, filter: uargs);
2111 case SECCOMP_GET_ACTION_AVAIL:
2112 if (flags != 0)
2113 return -EINVAL;
2114
2115 return seccomp_get_action_avail(uaction: uargs);
2116 case SECCOMP_GET_NOTIF_SIZES:
2117 if (flags != 0)
2118 return -EINVAL;
2119
2120 return seccomp_get_notif_sizes(usizes: uargs);
2121 default:
2122 return -EINVAL;
2123 }
2124}
2125
2126SYSCALL_DEFINE3(seccomp, unsigned int, op, unsigned int, flags,
2127 void __user *, uargs)
2128{
2129 return do_seccomp(op, flags, uargs);
2130}
2131
2132/**
2133 * prctl_set_seccomp: configures current->seccomp.mode
2134 * @seccomp_mode: requested mode to use
2135 * @filter: optional struct sock_fprog for use with SECCOMP_MODE_FILTER
2136 *
2137 * Returns 0 on success or -EINVAL on failure.
2138 */
2139long prctl_set_seccomp(unsigned long seccomp_mode, void __user *filter)
2140{
2141 unsigned int op;
2142 void __user *uargs;
2143
2144 switch (seccomp_mode) {
2145 case SECCOMP_MODE_STRICT:
2146 op = SECCOMP_SET_MODE_STRICT;
2147 /*
2148 * Setting strict mode through prctl always ignored filter,
2149 * so make sure it is always NULL here to pass the internal
2150 * check in do_seccomp().
2151 */
2152 uargs = NULL;
2153 break;
2154 case SECCOMP_MODE_FILTER:
2155 op = SECCOMP_SET_MODE_FILTER;
2156 uargs = filter;
2157 break;
2158 default:
2159 return -EINVAL;
2160 }
2161
2162 /* prctl interface doesn't have flags, so they are always zero. */
2163 return do_seccomp(op, flags: 0, uargs);
2164}
2165
2166#if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
2167static struct seccomp_filter *get_nth_filter(struct task_struct *task,
2168 unsigned long filter_off)
2169{
2170 struct seccomp_filter *orig, *filter;
2171 unsigned long count;
2172
2173 /*
2174 * Note: this is only correct because the caller should be the (ptrace)
2175 * tracer of the task, otherwise lock_task_sighand is needed.
2176 */
2177 spin_lock_irq(&task->sighand->siglock);
2178
2179 if (task->seccomp.mode != SECCOMP_MODE_FILTER) {
2180 spin_unlock_irq(&task->sighand->siglock);
2181 return ERR_PTR(-EINVAL);
2182 }
2183
2184 orig = task->seccomp.filter;
2185 __get_seccomp_filter(orig);
2186 spin_unlock_irq(&task->sighand->siglock);
2187
2188 count = 0;
2189 for (filter = orig; filter; filter = filter->prev)
2190 count++;
2191
2192 if (filter_off >= count) {
2193 filter = ERR_PTR(-ENOENT);
2194 goto out;
2195 }
2196
2197 count -= filter_off;
2198 for (filter = orig; filter && count > 1; filter = filter->prev)
2199 count--;
2200
2201 if (WARN_ON(count != 1 || !filter)) {
2202 filter = ERR_PTR(-ENOENT);
2203 goto out;
2204 }
2205
2206 __get_seccomp_filter(filter);
2207
2208out:
2209 __put_seccomp_filter(orig);
2210 return filter;
2211}
2212
2213long seccomp_get_filter(struct task_struct *task, unsigned long filter_off,
2214 void __user *data)
2215{
2216 struct seccomp_filter *filter;
2217 struct sock_fprog_kern *fprog;
2218 long ret;
2219
2220 if (!capable(CAP_SYS_ADMIN) ||
2221 current->seccomp.mode != SECCOMP_MODE_DISABLED) {
2222 return -EACCES;
2223 }
2224
2225 filter = get_nth_filter(task, filter_off);
2226 if (IS_ERR(filter))
2227 return PTR_ERR(filter);
2228
2229 fprog = filter->prog->orig_prog;
2230 if (!fprog) {
2231 /* This must be a new non-cBPF filter, since we save
2232 * every cBPF filter's orig_prog above when
2233 * CONFIG_CHECKPOINT_RESTORE is enabled.
2234 */
2235 ret = -EMEDIUMTYPE;
2236 goto out;
2237 }
2238
2239 ret = fprog->len;
2240 if (!data)
2241 goto out;
2242
2243 if (copy_to_user(data, fprog->filter, bpf_classic_proglen(fprog)))
2244 ret = -EFAULT;
2245
2246out:
2247 __put_seccomp_filter(filter);
2248 return ret;
2249}
2250
2251long seccomp_get_metadata(struct task_struct *task,
2252 unsigned long size, void __user *data)
2253{
2254 long ret;
2255 struct seccomp_filter *filter;
2256 struct seccomp_metadata kmd = {};
2257
2258 if (!capable(CAP_SYS_ADMIN) ||
2259 current->seccomp.mode != SECCOMP_MODE_DISABLED) {
2260 return -EACCES;
2261 }
2262
2263 size = min_t(unsigned long, size, sizeof(kmd));
2264
2265 if (size < sizeof(kmd.filter_off))
2266 return -EINVAL;
2267
2268 if (copy_from_user(&kmd.filter_off, data, sizeof(kmd.filter_off)))
2269 return -EFAULT;
2270
2271 filter = get_nth_filter(task, kmd.filter_off);
2272 if (IS_ERR(filter))
2273 return PTR_ERR(filter);
2274
2275 if (filter->log)
2276 kmd.flags |= SECCOMP_FILTER_FLAG_LOG;
2277
2278 ret = size;
2279 if (copy_to_user(data, &kmd, size))
2280 ret = -EFAULT;
2281
2282 __put_seccomp_filter(filter);
2283 return ret;
2284}
2285#endif
2286
2287#ifdef CONFIG_SYSCTL
2288
2289/* Human readable action names for friendly sysctl interaction */
2290#define SECCOMP_RET_KILL_PROCESS_NAME "kill_process"
2291#define SECCOMP_RET_KILL_THREAD_NAME "kill_thread"
2292#define SECCOMP_RET_TRAP_NAME "trap"
2293#define SECCOMP_RET_ERRNO_NAME "errno"
2294#define SECCOMP_RET_USER_NOTIF_NAME "user_notif"
2295#define SECCOMP_RET_TRACE_NAME "trace"
2296#define SECCOMP_RET_LOG_NAME "log"
2297#define SECCOMP_RET_ALLOW_NAME "allow"
2298
2299static const char seccomp_actions_avail[] =
2300 SECCOMP_RET_KILL_PROCESS_NAME " "
2301 SECCOMP_RET_KILL_THREAD_NAME " "
2302 SECCOMP_RET_TRAP_NAME " "
2303 SECCOMP_RET_ERRNO_NAME " "
2304 SECCOMP_RET_USER_NOTIF_NAME " "
2305 SECCOMP_RET_TRACE_NAME " "
2306 SECCOMP_RET_LOG_NAME " "
2307 SECCOMP_RET_ALLOW_NAME;
2308
2309struct seccomp_log_name {
2310 u32 log;
2311 const char *name;
2312};
2313
2314static const struct seccomp_log_name seccomp_log_names[] = {
2315 { SECCOMP_LOG_KILL_PROCESS, SECCOMP_RET_KILL_PROCESS_NAME },
2316 { SECCOMP_LOG_KILL_THREAD, SECCOMP_RET_KILL_THREAD_NAME },
2317 { SECCOMP_LOG_TRAP, SECCOMP_RET_TRAP_NAME },
2318 { SECCOMP_LOG_ERRNO, SECCOMP_RET_ERRNO_NAME },
2319 { SECCOMP_LOG_USER_NOTIF, SECCOMP_RET_USER_NOTIF_NAME },
2320 { SECCOMP_LOG_TRACE, SECCOMP_RET_TRACE_NAME },
2321 { SECCOMP_LOG_LOG, SECCOMP_RET_LOG_NAME },
2322 { SECCOMP_LOG_ALLOW, SECCOMP_RET_ALLOW_NAME },
2323 { }
2324};
2325
2326static bool seccomp_names_from_actions_logged(char *names, size_t size,
2327 u32 actions_logged,
2328 const char *sep)
2329{
2330 const struct seccomp_log_name *cur;
2331 bool append_sep = false;
2332
2333 for (cur = seccomp_log_names; cur->name && size; cur++) {
2334 ssize_t ret;
2335
2336 if (!(actions_logged & cur->log))
2337 continue;
2338
2339 if (append_sep) {
2340 ret = strscpy(names, sep, size);
2341 if (ret < 0)
2342 return false;
2343
2344 names += ret;
2345 size -= ret;
2346 } else
2347 append_sep = true;
2348
2349 ret = strscpy(names, cur->name, size);
2350 if (ret < 0)
2351 return false;
2352
2353 names += ret;
2354 size -= ret;
2355 }
2356
2357 return true;
2358}
2359
2360static bool seccomp_action_logged_from_name(u32 *action_logged,
2361 const char *name)
2362{
2363 const struct seccomp_log_name *cur;
2364
2365 for (cur = seccomp_log_names; cur->name; cur++) {
2366 if (!strcmp(cur->name, name)) {
2367 *action_logged = cur->log;
2368 return true;
2369 }
2370 }
2371
2372 return false;
2373}
2374
2375static bool seccomp_actions_logged_from_names(u32 *actions_logged, char *names)
2376{
2377 char *name;
2378
2379 *actions_logged = 0;
2380 while ((name = strsep(&names, " ")) && *name) {
2381 u32 action_logged = 0;
2382
2383 if (!seccomp_action_logged_from_name(action_logged: &action_logged, name))
2384 return false;
2385
2386 *actions_logged |= action_logged;
2387 }
2388
2389 return true;
2390}
2391
2392static int read_actions_logged(const struct ctl_table *ro_table, void *buffer,
2393 size_t *lenp, loff_t *ppos)
2394{
2395 char names[sizeof(seccomp_actions_avail)];
2396 struct ctl_table table;
2397
2398 memset(s: names, c: 0, n: sizeof(names));
2399
2400 if (!seccomp_names_from_actions_logged(names, size: sizeof(names),
2401 actions_logged: seccomp_actions_logged, sep: " "))
2402 return -EINVAL;
2403
2404 table = *ro_table;
2405 table.data = names;
2406 table.maxlen = sizeof(names);
2407 return proc_dostring(&table, 0, buffer, lenp, ppos);
2408}
2409
2410static int write_actions_logged(const struct ctl_table *ro_table, void *buffer,
2411 size_t *lenp, loff_t *ppos, u32 *actions_logged)
2412{
2413 char names[sizeof(seccomp_actions_avail)];
2414 struct ctl_table table;
2415 int ret;
2416
2417 if (!capable(CAP_SYS_ADMIN))
2418 return -EPERM;
2419
2420 memset(s: names, c: 0, n: sizeof(names));
2421
2422 table = *ro_table;
2423 table.data = names;
2424 table.maxlen = sizeof(names);
2425 ret = proc_dostring(&table, 1, buffer, lenp, ppos);
2426 if (ret)
2427 return ret;
2428
2429 if (!seccomp_actions_logged_from_names(actions_logged, names: table.data))
2430 return -EINVAL;
2431
2432 if (*actions_logged & SECCOMP_LOG_ALLOW)
2433 return -EINVAL;
2434
2435 seccomp_actions_logged = *actions_logged;
2436 return 0;
2437}
2438
2439static void audit_actions_logged(u32 actions_logged, u32 old_actions_logged,
2440 int ret)
2441{
2442 char names[sizeof(seccomp_actions_avail)];
2443 char old_names[sizeof(seccomp_actions_avail)];
2444 const char *new = names;
2445 const char *old = old_names;
2446
2447 if (!audit_enabled)
2448 return;
2449
2450 memset(s: names, c: 0, n: sizeof(names));
2451 memset(s: old_names, c: 0, n: sizeof(old_names));
2452
2453 if (ret)
2454 new = "?";
2455 else if (!actions_logged)
2456 new = "(none)";
2457 else if (!seccomp_names_from_actions_logged(names, size: sizeof(names),
2458 actions_logged, sep: ","))
2459 new = "?";
2460
2461 if (!old_actions_logged)
2462 old = "(none)";
2463 else if (!seccomp_names_from_actions_logged(names: old_names,
2464 size: sizeof(old_names),
2465 actions_logged: old_actions_logged, sep: ","))
2466 old = "?";
2467
2468 return audit_seccomp_actions_logged(names: new, old_names: old, res: !ret);
2469}
2470
2471static int seccomp_actions_logged_handler(const struct ctl_table *ro_table, int write,
2472 void *buffer, size_t *lenp,
2473 loff_t *ppos)
2474{
2475 int ret;
2476
2477 if (write) {
2478 u32 actions_logged = 0;
2479 u32 old_actions_logged = seccomp_actions_logged;
2480
2481 ret = write_actions_logged(ro_table, buffer, lenp, ppos,
2482 actions_logged: &actions_logged);
2483 audit_actions_logged(actions_logged, old_actions_logged, ret);
2484 } else
2485 ret = read_actions_logged(ro_table, buffer, lenp, ppos);
2486
2487 return ret;
2488}
2489
2490static const struct ctl_table seccomp_sysctl_table[] = {
2491 {
2492 .procname = "actions_avail",
2493 .data = (void *) &seccomp_actions_avail,
2494 .maxlen = sizeof(seccomp_actions_avail),
2495 .mode = 0444,
2496 .proc_handler = proc_dostring,
2497 },
2498 {
2499 .procname = "actions_logged",
2500 .mode = 0644,
2501 .proc_handler = seccomp_actions_logged_handler,
2502 },
2503};
2504
2505static int __init seccomp_sysctl_init(void)
2506{
2507 register_sysctl_init("kernel/seccomp", seccomp_sysctl_table);
2508 return 0;
2509}
2510
2511device_initcall(seccomp_sysctl_init)
2512
2513#endif /* CONFIG_SYSCTL */
2514
2515#ifdef CONFIG_SECCOMP_CACHE_DEBUG
2516/* Currently CONFIG_SECCOMP_CACHE_DEBUG implies SECCOMP_ARCH_NATIVE */
2517static void proc_pid_seccomp_cache_arch(struct seq_file *m, const char *name,
2518 const void *bitmap, size_t bitmap_size)
2519{
2520 int nr;
2521
2522 for (nr = 0; nr < bitmap_size; nr++) {
2523 bool cached = test_bit(nr, bitmap);
2524 char *status = cached ? "ALLOW" : "FILTER";
2525
2526 seq_printf(m, "%s %d %s\n", name, nr, status);
2527 }
2528}
2529
2530int proc_pid_seccomp_cache(struct seq_file *m, struct pid_namespace *ns,
2531 struct pid *pid, struct task_struct *task)
2532{
2533 struct seccomp_filter *f;
2534 unsigned long flags;
2535
2536 /*
2537 * We don't want some sandboxed process to know what their seccomp
2538 * filters consist of.
2539 */
2540 if (!file_ns_capable(m->file, &init_user_ns, CAP_SYS_ADMIN))
2541 return -EACCES;
2542
2543 if (!lock_task_sighand(task, &flags))
2544 return -ESRCH;
2545
2546 f = READ_ONCE(task->seccomp.filter);
2547 if (!f) {
2548 unlock_task_sighand(task, &flags);
2549 return 0;
2550 }
2551
2552 /* prevent filter from being freed while we are printing it */
2553 __get_seccomp_filter(f);
2554 unlock_task_sighand(task, &flags);
2555
2556 proc_pid_seccomp_cache_arch(m, SECCOMP_ARCH_NATIVE_NAME,
2557 f->cache.allow_native,
2558 SECCOMP_ARCH_NATIVE_NR);
2559
2560#ifdef SECCOMP_ARCH_COMPAT
2561 proc_pid_seccomp_cache_arch(m, SECCOMP_ARCH_COMPAT_NAME,
2562 f->cache.allow_compat,
2563 SECCOMP_ARCH_COMPAT_NR);
2564#endif /* SECCOMP_ARCH_COMPAT */
2565
2566 __put_seccomp_filter(f);
2567 return 0;
2568}
2569#endif /* CONFIG_SECCOMP_CACHE_DEBUG */
2570