1// SPDX-License-Identifier: GPL-2.0
   2/*
   3 * linux/kernel/seccomp.c
   4 *
   5 * Copyright 2004-2005  Andrea Arcangeli <andrea@cpushare.com>
   6 *
   7 * Copyright (C) 2012 Google, Inc.
   8 * Will Drewry <wad@chromium.org>
   9 *
  10 * This defines a simple but solid secure-computing facility.
  11 *
  12 * Mode 1 uses a fixed list of allowed system calls.
  13 * Mode 2 allows user-defined system call filters in the form
  14 *        of Berkeley Packet Filters/Linux Socket Filters.
  15 */
  16#define pr_fmt(fmt) "seccomp: " fmt
  17
  18#include <linux/refcount.h>
  19#include <linux/audit.h>
  20#include <linux/compat.h>
  21#include <linux/coredump.h>
  22#include <linux/kmemleak.h>
  23#include <linux/nospec.h>
  24#include <linux/prctl.h>
  25#include <linux/sched.h>
  26#include <linux/sched/task_stack.h>
  27#include <linux/seccomp.h>
  28#include <linux/slab.h>
  29#include <linux/syscalls.h>
  30#include <linux/sysctl.h>
  31
 
 
 
  32#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
  33#include <asm/syscall.h>
  34#endif
  35
  36#ifdef CONFIG_SECCOMP_FILTER
  37#include <linux/file.h>
  38#include <linux/filter.h>
  39#include <linux/pid.h>
  40#include <linux/ptrace.h>
  41#include <linux/capability.h>
  42#include <linux/tracehook.h>
  43#include <linux/uaccess.h>
  44#include <linux/anon_inodes.h>
  45#include <linux/lockdep.h>
  46
  47/*
  48 * When SECCOMP_IOCTL_NOTIF_ID_VALID was first introduced, it had the
  49 * wrong direction flag in the ioctl number. This is the broken one,
  50 * which the kernel needs to keep supporting until all userspaces stop
  51 * using the wrong command number.
  52 */
  53#define SECCOMP_IOCTL_NOTIF_ID_VALID_WRONG_DIR	SECCOMP_IOR(2, __u64)
  54
  55enum notify_state {
  56	SECCOMP_NOTIFY_INIT,
  57	SECCOMP_NOTIFY_SENT,
  58	SECCOMP_NOTIFY_REPLIED,
  59};
  60
  61struct seccomp_knotif {
  62	/* The struct pid of the task whose filter triggered the notification */
  63	struct task_struct *task;
  64
  65	/* The "cookie" for this request; this is unique for this filter. */
  66	u64 id;
  67
  68	/*
  69	 * The seccomp data. This pointer is valid the entire time this
  70	 * notification is active, since it comes from __seccomp_filter which
  71	 * eclipses the entire lifecycle here.
  72	 */
  73	const struct seccomp_data *data;
  74
  75	/*
  76	 * Notification states. When SECCOMP_RET_USER_NOTIF is returned, a
  77	 * struct seccomp_knotif is created and starts out in INIT. Once the
  78	 * handler reads the notification off of an FD, it transitions to SENT.
  79	 * If a signal is received the state transitions back to INIT and
  80	 * another message is sent. When the userspace handler replies, state
  81	 * transitions to REPLIED.
  82	 */
  83	enum notify_state state;
  84
  85	/* The return values, only valid when in SECCOMP_NOTIFY_REPLIED */
  86	int error;
  87	long val;
  88	u32 flags;
  89
  90	/*
  91	 * Signals when this has changed states, such as the listener
  92	 * dying, a new seccomp addfd message, or changing to REPLIED
  93	 */
  94	struct completion ready;
  95
  96	struct list_head list;
  97
  98	/* outstanding addfd requests */
  99	struct list_head addfd;
 100};
 101
 102/**
 103 * struct seccomp_kaddfd - container for seccomp_addfd ioctl messages
 104 *
 105 * @file: A reference to the file to install in the other task
 106 * @fd: The fd number to install it at. If the fd number is -1, it means the
 107 *      installing process should allocate the fd as normal.
 108 * @flags: The flags for the new file descriptor. At the moment, only O_CLOEXEC
 109 *         is allowed.
 110 * @ioctl_flags: The flags used for the seccomp_addfd ioctl.
 111 * @ret: The return value of the installing process. It is set to the fd num
 112 *       upon success (>= 0).
 113 * @completion: Indicates that the installing process has completed fd
 114 *              installation, or gone away (either due to successful
 115 *              reply, or signal)
 116 *
 117 */
 118struct seccomp_kaddfd {
 119	struct file *file;
 120	int fd;
 121	unsigned int flags;
 122	__u32 ioctl_flags;
 123
 124	union {
 125		bool setfd;
 126		/* To only be set on reply */
 127		int ret;
 128	};
 129	struct completion completion;
 130	struct list_head list;
 131};
 132
 133/**
 134 * struct notification - container for seccomp userspace notifications. Since
 135 * most seccomp filters will not have notification listeners attached and this
 136 * structure is fairly large, we store the notification-specific stuff in a
 137 * separate structure.
 138 *
 139 * @request: A semaphore that users of this notification can wait on for
 140 *           changes. Actual reads and writes are still controlled with
 141 *           filter->notify_lock.
 142 * @next_id: The id of the next request.
 143 * @notifications: A list of struct seccomp_knotif elements.
 144 */
 145struct notification {
 146	struct semaphore request;
 147	u64 next_id;
 148	struct list_head notifications;
 149};
 150
 151#ifdef SECCOMP_ARCH_NATIVE
 152/**
 153 * struct action_cache - per-filter cache of seccomp actions per
 154 * arch/syscall pair
 155 *
 156 * @allow_native: A bitmap where each bit represents whether the
 157 *		  filter will always allow the syscall, for the
 158 *		  native architecture.
 159 * @allow_compat: A bitmap where each bit represents whether the
 160 *		  filter will always allow the syscall, for the
 161 *		  compat architecture.
 162 */
 163struct action_cache {
 164	DECLARE_BITMAP(allow_native, SECCOMP_ARCH_NATIVE_NR);
 165#ifdef SECCOMP_ARCH_COMPAT
 166	DECLARE_BITMAP(allow_compat, SECCOMP_ARCH_COMPAT_NR);
 167#endif
 168};
 169#else
 170struct action_cache { };
 171
 172static inline bool seccomp_cache_check_allow(const struct seccomp_filter *sfilter,
 173					     const struct seccomp_data *sd)
 174{
 175	return false;
 176}
 177
 178static inline void seccomp_cache_prepare(struct seccomp_filter *sfilter)
 179{
 180}
 181#endif /* SECCOMP_ARCH_NATIVE */
 182
 183/**
 184 * struct seccomp_filter - container for seccomp BPF programs
 185 *
 186 * @refs: Reference count to manage the object lifetime.
 187 *	  A filter's reference count is incremented for each directly
 188 *	  attached task, once for the dependent filter, and if
 189 *	  requested for the user notifier. When @refs reaches zero,
 190 *	  the filter can be freed.
 191 * @users: A filter's @users count is incremented for each directly
 192 *         attached task (filter installation, fork(), thread_sync),
 193 *	   and once for the dependent filter (tracked in filter->prev).
 194 *	   When it reaches zero it indicates that no direct or indirect
 195 *	   users of that filter exist. No new tasks can get associated with
 196 *	   this filter after reaching 0. The @users count is always smaller
 197 *	   or equal to @refs. Hence, reaching 0 for @users does not mean
 198 *	   the filter can be freed.
 199 * @cache: cache of arch/syscall mappings to actions
 200 * @log: true if all actions except for SECCOMP_RET_ALLOW should be logged
 
 
 201 * @prev: points to a previously installed, or inherited, filter
 202 * @prog: the BPF program to evaluate
 203 * @notif: the struct that holds all notification related information
 204 * @notify_lock: A lock for all notification-related accesses.
 205 * @wqh: A wait queue for poll if a notifier is in use.
 206 *
 207 * seccomp_filter objects are organized in a tree linked via the @prev
 208 * pointer.  For any task, it appears to be a singly-linked list starting
 209 * with current->seccomp.filter, the most recently attached or inherited filter.
 210 * However, multiple filters may share a @prev node, by way of fork(), which
 211 * results in a unidirectional tree existing in memory.  This is similar to
 212 * how namespaces work.
 213 *
 214 * seccomp_filter objects should never be modified after being attached
 215 * to a task_struct (other than @refs).
 216 */
 217struct seccomp_filter {
 218	refcount_t refs;
 219	refcount_t users;
 220	bool log;
 
 221	struct action_cache cache;
 222	struct seccomp_filter *prev;
 223	struct bpf_prog *prog;
 224	struct notification *notif;
 225	struct mutex notify_lock;
 226	wait_queue_head_t wqh;
 227};
 228
 229/* Limit any path through the tree to 256KB worth of instructions. */
 230#define MAX_INSNS_PER_PATH ((1 << 18) / sizeof(struct sock_filter))
 231
 232/*
 233 * Endianness is explicitly ignored and left for BPF program authors to manage
 234 * as per the specific architecture.
 235 */
 236static void populate_seccomp_data(struct seccomp_data *sd)
 237{
 238	/*
 239	 * Instead of using current_pt_reg(), we're already doing the work
 240	 * to safely fetch "current", so just use "task" everywhere below.
 241	 */
 242	struct task_struct *task = current;
 243	struct pt_regs *regs = task_pt_regs(task);
 244	unsigned long args[6];
 245
 246	sd->nr = syscall_get_nr(task, regs);
 247	sd->arch = syscall_get_arch(task);
 248	syscall_get_arguments(task, regs, args);
 249	sd->args[0] = args[0];
 250	sd->args[1] = args[1];
 251	sd->args[2] = args[2];
 252	sd->args[3] = args[3];
 253	sd->args[4] = args[4];
 254	sd->args[5] = args[5];
 255	sd->instruction_pointer = KSTK_EIP(task);
 256}
 257
 258/**
 259 *	seccomp_check_filter - verify seccomp filter code
 260 *	@filter: filter to verify
 261 *	@flen: length of filter
 262 *
 263 * Takes a previously checked filter (by bpf_check_classic) and
 264 * redirects all filter code that loads struct sk_buff data
 265 * and related data through seccomp_bpf_load.  It also
 266 * enforces length and alignment checking of those loads.
 267 *
 268 * Returns 0 if the rule set is legal or -EINVAL if not.
 269 */
 270static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen)
 271{
 272	int pc;
 273	for (pc = 0; pc < flen; pc++) {
 274		struct sock_filter *ftest = &filter[pc];
 275		u16 code = ftest->code;
 276		u32 k = ftest->k;
 277
 278		switch (code) {
 279		case BPF_LD | BPF_W | BPF_ABS:
 280			ftest->code = BPF_LDX | BPF_W | BPF_ABS;
 281			/* 32-bit aligned and not out of bounds. */
 282			if (k >= sizeof(struct seccomp_data) || k & 3)
 283				return -EINVAL;
 284			continue;
 285		case BPF_LD | BPF_W | BPF_LEN:
 286			ftest->code = BPF_LD | BPF_IMM;
 287			ftest->k = sizeof(struct seccomp_data);
 288			continue;
 289		case BPF_LDX | BPF_W | BPF_LEN:
 290			ftest->code = BPF_LDX | BPF_IMM;
 291			ftest->k = sizeof(struct seccomp_data);
 292			continue;
 293		/* Explicitly include allowed calls. */
 294		case BPF_RET | BPF_K:
 295		case BPF_RET | BPF_A:
 296		case BPF_ALU | BPF_ADD | BPF_K:
 297		case BPF_ALU | BPF_ADD | BPF_X:
 298		case BPF_ALU | BPF_SUB | BPF_K:
 299		case BPF_ALU | BPF_SUB | BPF_X:
 300		case BPF_ALU | BPF_MUL | BPF_K:
 301		case BPF_ALU | BPF_MUL | BPF_X:
 302		case BPF_ALU | BPF_DIV | BPF_K:
 303		case BPF_ALU | BPF_DIV | BPF_X:
 304		case BPF_ALU | BPF_AND | BPF_K:
 305		case BPF_ALU | BPF_AND | BPF_X:
 306		case BPF_ALU | BPF_OR | BPF_K:
 307		case BPF_ALU | BPF_OR | BPF_X:
 308		case BPF_ALU | BPF_XOR | BPF_K:
 309		case BPF_ALU | BPF_XOR | BPF_X:
 310		case BPF_ALU | BPF_LSH | BPF_K:
 311		case BPF_ALU | BPF_LSH | BPF_X:
 312		case BPF_ALU | BPF_RSH | BPF_K:
 313		case BPF_ALU | BPF_RSH | BPF_X:
 314		case BPF_ALU | BPF_NEG:
 315		case BPF_LD | BPF_IMM:
 316		case BPF_LDX | BPF_IMM:
 317		case BPF_MISC | BPF_TAX:
 318		case BPF_MISC | BPF_TXA:
 319		case BPF_LD | BPF_MEM:
 320		case BPF_LDX | BPF_MEM:
 321		case BPF_ST:
 322		case BPF_STX:
 323		case BPF_JMP | BPF_JA:
 324		case BPF_JMP | BPF_JEQ | BPF_K:
 325		case BPF_JMP | BPF_JEQ | BPF_X:
 326		case BPF_JMP | BPF_JGE | BPF_K:
 327		case BPF_JMP | BPF_JGE | BPF_X:
 328		case BPF_JMP | BPF_JGT | BPF_K:
 329		case BPF_JMP | BPF_JGT | BPF_X:
 330		case BPF_JMP | BPF_JSET | BPF_K:
 331		case BPF_JMP | BPF_JSET | BPF_X:
 332			continue;
 333		default:
 334			return -EINVAL;
 335		}
 336	}
 337	return 0;
 338}
 339
 340#ifdef SECCOMP_ARCH_NATIVE
 341static inline bool seccomp_cache_check_allow_bitmap(const void *bitmap,
 342						    size_t bitmap_size,
 343						    int syscall_nr)
 344{
 345	if (unlikely(syscall_nr < 0 || syscall_nr >= bitmap_size))
 346		return false;
 347	syscall_nr = array_index_nospec(syscall_nr, bitmap_size);
 348
 349	return test_bit(syscall_nr, bitmap);
 350}
 351
 352/**
 353 * seccomp_cache_check_allow - lookup seccomp cache
 354 * @sfilter: The seccomp filter
 355 * @sd: The seccomp data to lookup the cache with
 356 *
 357 * Returns true if the seccomp_data is cached and allowed.
 358 */
 359static inline bool seccomp_cache_check_allow(const struct seccomp_filter *sfilter,
 360					     const struct seccomp_data *sd)
 361{
 362	int syscall_nr = sd->nr;
 363	const struct action_cache *cache = &sfilter->cache;
 364
 365#ifndef SECCOMP_ARCH_COMPAT
 366	/* A native-only architecture doesn't need to check sd->arch. */
 367	return seccomp_cache_check_allow_bitmap(cache->allow_native,
 368						SECCOMP_ARCH_NATIVE_NR,
 369						syscall_nr);
 370#else
 371	if (likely(sd->arch == SECCOMP_ARCH_NATIVE))
 372		return seccomp_cache_check_allow_bitmap(cache->allow_native,
 373							SECCOMP_ARCH_NATIVE_NR,
 374							syscall_nr);
 375	if (likely(sd->arch == SECCOMP_ARCH_COMPAT))
 376		return seccomp_cache_check_allow_bitmap(cache->allow_compat,
 377							SECCOMP_ARCH_COMPAT_NR,
 378							syscall_nr);
 379#endif /* SECCOMP_ARCH_COMPAT */
 380
 381	WARN_ON_ONCE(true);
 382	return false;
 383}
 384#endif /* SECCOMP_ARCH_NATIVE */
 385
 386/**
 387 * seccomp_run_filters - evaluates all seccomp filters against @sd
 388 * @sd: optional seccomp data to be passed to filters
 389 * @match: stores struct seccomp_filter that resulted in the return value,
 390 *         unless filter returned SECCOMP_RET_ALLOW, in which case it will
 391 *         be unchanged.
 392 *
 393 * Returns valid seccomp BPF response codes.
 394 */
 395#define ACTION_ONLY(ret) ((s32)((ret) & (SECCOMP_RET_ACTION_FULL)))
 396static u32 seccomp_run_filters(const struct seccomp_data *sd,
 397			       struct seccomp_filter **match)
 398{
 399	u32 ret = SECCOMP_RET_ALLOW;
 400	/* Make sure cross-thread synced filter points somewhere sane. */
 401	struct seccomp_filter *f =
 402			READ_ONCE(current->seccomp.filter);
 403
 404	/* Ensure unexpected behavior doesn't result in failing open. */
 405	if (WARN_ON(f == NULL))
 406		return SECCOMP_RET_KILL_PROCESS;
 407
 408	if (seccomp_cache_check_allow(f, sd))
 409		return SECCOMP_RET_ALLOW;
 410
 411	/*
 412	 * All filters in the list are evaluated and the lowest BPF return
 413	 * value always takes priority (ignoring the DATA).
 414	 */
 415	for (; f; f = f->prev) {
 416		u32 cur_ret = bpf_prog_run_pin_on_cpu(f->prog, sd);
 417
 418		if (ACTION_ONLY(cur_ret) < ACTION_ONLY(ret)) {
 419			ret = cur_ret;
 420			*match = f;
 421		}
 422	}
 423	return ret;
 424}
 425#endif /* CONFIG_SECCOMP_FILTER */
 426
 427static inline bool seccomp_may_assign_mode(unsigned long seccomp_mode)
 428{
 429	assert_spin_locked(&current->sighand->siglock);
 430
 431	if (current->seccomp.mode && current->seccomp.mode != seccomp_mode)
 432		return false;
 433
 434	return true;
 435}
 436
 437void __weak arch_seccomp_spec_mitigate(struct task_struct *task) { }
 438
 439static inline void seccomp_assign_mode(struct task_struct *task,
 440				       unsigned long seccomp_mode,
 441				       unsigned long flags)
 442{
 443	assert_spin_locked(&task->sighand->siglock);
 444
 445	task->seccomp.mode = seccomp_mode;
 446	/*
 447	 * Make sure SYSCALL_WORK_SECCOMP cannot be set before the mode (and
 448	 * filter) is set.
 449	 */
 450	smp_mb__before_atomic();
 451	/* Assume default seccomp processes want spec flaw mitigation. */
 452	if ((flags & SECCOMP_FILTER_FLAG_SPEC_ALLOW) == 0)
 453		arch_seccomp_spec_mitigate(task);
 454	set_task_syscall_work(task, SECCOMP);
 455}
 456
 457#ifdef CONFIG_SECCOMP_FILTER
 458/* Returns 1 if the parent is an ancestor of the child. */
 459static int is_ancestor(struct seccomp_filter *parent,
 460		       struct seccomp_filter *child)
 461{
 462	/* NULL is the root ancestor. */
 463	if (parent == NULL)
 464		return 1;
 465	for (; child; child = child->prev)
 466		if (child == parent)
 467			return 1;
 468	return 0;
 469}
 470
 471/**
 472 * seccomp_can_sync_threads: checks if all threads can be synchronized
 473 *
 474 * Expects sighand and cred_guard_mutex locks to be held.
 475 *
 476 * Returns 0 on success, -ve on error, or the pid of a thread which was
 477 * either not in the correct seccomp mode or did not have an ancestral
 478 * seccomp filter.
 479 */
 480static inline pid_t seccomp_can_sync_threads(void)
 481{
 482	struct task_struct *thread, *caller;
 483
 484	BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
 485	assert_spin_locked(&current->sighand->siglock);
 486
 487	/* Validate all threads being eligible for synchronization. */
 488	caller = current;
 489	for_each_thread(caller, thread) {
 490		pid_t failed;
 491
 492		/* Skip current, since it is initiating the sync. */
 493		if (thread == caller)
 494			continue;
 495
 496		if (thread->seccomp.mode == SECCOMP_MODE_DISABLED ||
 497		    (thread->seccomp.mode == SECCOMP_MODE_FILTER &&
 498		     is_ancestor(thread->seccomp.filter,
 499				 caller->seccomp.filter)))
 500			continue;
 501
 502		/* Return the first thread that cannot be synchronized. */
 503		failed = task_pid_vnr(thread);
 504		/* If the pid cannot be resolved, then return -ESRCH */
 505		if (WARN_ON(failed == 0))
 506			failed = -ESRCH;
 507		return failed;
 508	}
 509
 510	return 0;
 511}
 512
 513static inline void seccomp_filter_free(struct seccomp_filter *filter)
 514{
 515	if (filter) {
 516		bpf_prog_destroy(filter->prog);
 517		kfree(filter);
 518	}
 519}
 520
 521static void __seccomp_filter_orphan(struct seccomp_filter *orig)
 522{
 523	while (orig && refcount_dec_and_test(&orig->users)) {
 524		if (waitqueue_active(&orig->wqh))
 525			wake_up_poll(&orig->wqh, EPOLLHUP);
 526		orig = orig->prev;
 527	}
 528}
 529
 530static void __put_seccomp_filter(struct seccomp_filter *orig)
 531{
 532	/* Clean up single-reference branches iteratively. */
 533	while (orig && refcount_dec_and_test(&orig->refs)) {
 534		struct seccomp_filter *freeme = orig;
 535		orig = orig->prev;
 536		seccomp_filter_free(freeme);
 537	}
 538}
 539
 540static void __seccomp_filter_release(struct seccomp_filter *orig)
 541{
 542	/* Notify about any unused filters in the task's former filter tree. */
 543	__seccomp_filter_orphan(orig);
 544	/* Finally drop all references to the task's former tree. */
 545	__put_seccomp_filter(orig);
 546}
 547
 548/**
 549 * seccomp_filter_release - Detach the task from its filter tree,
 550 *			    drop its reference count, and notify
 551 *			    about unused filters
 552 *
 553 * This function should only be called when the task is exiting as
 554 * it detaches it from its filter tree. As such, READ_ONCE() and
 555 * barriers are not needed here, as would normally be needed.
 556 */
 557void seccomp_filter_release(struct task_struct *tsk)
 558{
 559	struct seccomp_filter *orig = tsk->seccomp.filter;
 560
 561	/* We are effectively holding the siglock by not having any sighand. */
 562	WARN_ON(tsk->sighand != NULL);
 563
 564	/* Detach task from its filter tree. */
 565	tsk->seccomp.filter = NULL;
 566	__seccomp_filter_release(orig);
 567}
 568
 569/**
 570 * seccomp_sync_threads: sets all threads to use current's filter
 571 *
 572 * Expects sighand and cred_guard_mutex locks to be held, and for
 573 * seccomp_can_sync_threads() to have returned success already
 574 * without dropping the locks.
 575 *
 576 */
 577static inline void seccomp_sync_threads(unsigned long flags)
 578{
 579	struct task_struct *thread, *caller;
 580
 581	BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
 582	assert_spin_locked(&current->sighand->siglock);
 583
 584	/* Synchronize all threads. */
 585	caller = current;
 586	for_each_thread(caller, thread) {
 587		/* Skip current, since it needs no changes. */
 588		if (thread == caller)
 589			continue;
 590
 591		/* Get a task reference for the new leaf node. */
 592		get_seccomp_filter(caller);
 593
 594		/*
 595		 * Drop the task reference to the shared ancestor since
 596		 * current's path will hold a reference.  (This also
 597		 * allows a put before the assignment.)
 598		 */
 599		__seccomp_filter_release(thread->seccomp.filter);
 600
 601		/* Make our new filter tree visible. */
 602		smp_store_release(&thread->seccomp.filter,
 603				  caller->seccomp.filter);
 604		atomic_set(&thread->seccomp.filter_count,
 605			   atomic_read(&caller->seccomp.filter_count));
 606
 607		/*
 608		 * Don't let an unprivileged task work around
 609		 * the no_new_privs restriction by creating
 610		 * a thread that sets it up, enters seccomp,
 611		 * then dies.
 612		 */
 613		if (task_no_new_privs(caller))
 614			task_set_no_new_privs(thread);
 615
 616		/*
 617		 * Opt the other thread into seccomp if needed.
 618		 * As threads are considered to be trust-realm
 619		 * equivalent (see ptrace_may_access), it is safe to
 620		 * allow one thread to transition the other.
 621		 */
 622		if (thread->seccomp.mode == SECCOMP_MODE_DISABLED)
 623			seccomp_assign_mode(thread, SECCOMP_MODE_FILTER,
 624					    flags);
 625	}
 626}
 627
 628/**
 629 * seccomp_prepare_filter: Prepares a seccomp filter for use.
 630 * @fprog: BPF program to install
 631 *
 632 * Returns filter on success or an ERR_PTR on failure.
 633 */
 634static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog)
 635{
 636	struct seccomp_filter *sfilter;
 637	int ret;
 638	const bool save_orig =
 639#if defined(CONFIG_CHECKPOINT_RESTORE) || defined(SECCOMP_ARCH_NATIVE)
 640		true;
 641#else
 642		false;
 643#endif
 644
 645	if (fprog->len == 0 || fprog->len > BPF_MAXINSNS)
 646		return ERR_PTR(-EINVAL);
 647
 648	BUG_ON(INT_MAX / fprog->len < sizeof(struct sock_filter));
 649
 650	/*
 651	 * Installing a seccomp filter requires that the task has
 652	 * CAP_SYS_ADMIN in its namespace or be running with no_new_privs.
 653	 * This avoids scenarios where unprivileged tasks can affect the
 654	 * behavior of privileged children.
 655	 */
 656	if (!task_no_new_privs(current) &&
 657			!ns_capable_noaudit(current_user_ns(), CAP_SYS_ADMIN))
 658		return ERR_PTR(-EACCES);
 659
 660	/* Allocate a new seccomp_filter */
 661	sfilter = kzalloc(sizeof(*sfilter), GFP_KERNEL | __GFP_NOWARN);
 662	if (!sfilter)
 663		return ERR_PTR(-ENOMEM);
 664
 665	mutex_init(&sfilter->notify_lock);
 666	ret = bpf_prog_create_from_user(&sfilter->prog, fprog,
 667					seccomp_check_filter, save_orig);
 668	if (ret < 0) {
 669		kfree(sfilter);
 670		return ERR_PTR(ret);
 671	}
 672
 673	refcount_set(&sfilter->refs, 1);
 674	refcount_set(&sfilter->users, 1);
 675	init_waitqueue_head(&sfilter->wqh);
 676
 677	return sfilter;
 678}
 679
 680/**
 681 * seccomp_prepare_user_filter - prepares a user-supplied sock_fprog
 682 * @user_filter: pointer to the user data containing a sock_fprog.
 683 *
 684 * Returns 0 on success and non-zero otherwise.
 685 */
 686static struct seccomp_filter *
 687seccomp_prepare_user_filter(const char __user *user_filter)
 688{
 689	struct sock_fprog fprog;
 690	struct seccomp_filter *filter = ERR_PTR(-EFAULT);
 691
 692#ifdef CONFIG_COMPAT
 693	if (in_compat_syscall()) {
 694		struct compat_sock_fprog fprog32;
 695		if (copy_from_user(&fprog32, user_filter, sizeof(fprog32)))
 696			goto out;
 697		fprog.len = fprog32.len;
 698		fprog.filter = compat_ptr(fprog32.filter);
 699	} else /* falls through to the if below. */
 700#endif
 701	if (copy_from_user(&fprog, user_filter, sizeof(fprog)))
 702		goto out;
 703	filter = seccomp_prepare_filter(&fprog);
 704out:
 705	return filter;
 706}
 707
 708#ifdef SECCOMP_ARCH_NATIVE
 709/**
 710 * seccomp_is_const_allow - check if filter is constant allow with given data
 711 * @fprog: The BPF programs
 712 * @sd: The seccomp data to check against, only syscall number and arch
 713 *      number are considered constant.
 714 */
 715static bool seccomp_is_const_allow(struct sock_fprog_kern *fprog,
 716				   struct seccomp_data *sd)
 717{
 718	unsigned int reg_value = 0;
 719	unsigned int pc;
 720	bool op_res;
 721
 722	if (WARN_ON_ONCE(!fprog))
 723		return false;
 724
 725	for (pc = 0; pc < fprog->len; pc++) {
 726		struct sock_filter *insn = &fprog->filter[pc];
 727		u16 code = insn->code;
 728		u32 k = insn->k;
 729
 730		switch (code) {
 731		case BPF_LD | BPF_W | BPF_ABS:
 732			switch (k) {
 733			case offsetof(struct seccomp_data, nr):
 734				reg_value = sd->nr;
 735				break;
 736			case offsetof(struct seccomp_data, arch):
 737				reg_value = sd->arch;
 738				break;
 739			default:
 740				/* can't optimize (non-constant value load) */
 741				return false;
 742			}
 743			break;
 744		case BPF_RET | BPF_K:
 745			/* reached return with constant values only, check allow */
 746			return k == SECCOMP_RET_ALLOW;
 747		case BPF_JMP | BPF_JA:
 748			pc += insn->k;
 749			break;
 750		case BPF_JMP | BPF_JEQ | BPF_K:
 751		case BPF_JMP | BPF_JGE | BPF_K:
 752		case BPF_JMP | BPF_JGT | BPF_K:
 753		case BPF_JMP | BPF_JSET | BPF_K:
 754			switch (BPF_OP(code)) {
 755			case BPF_JEQ:
 756				op_res = reg_value == k;
 757				break;
 758			case BPF_JGE:
 759				op_res = reg_value >= k;
 760				break;
 761			case BPF_JGT:
 762				op_res = reg_value > k;
 763				break;
 764			case BPF_JSET:
 765				op_res = !!(reg_value & k);
 766				break;
 767			default:
 768				/* can't optimize (unknown jump) */
 769				return false;
 770			}
 771
 772			pc += op_res ? insn->jt : insn->jf;
 773			break;
 774		case BPF_ALU | BPF_AND | BPF_K:
 775			reg_value &= k;
 776			break;
 777		default:
 778			/* can't optimize (unknown insn) */
 779			return false;
 780		}
 781	}
 782
 783	/* ran off the end of the filter?! */
 784	WARN_ON(1);
 785	return false;
 786}
 787
 788static void seccomp_cache_prepare_bitmap(struct seccomp_filter *sfilter,
 789					 void *bitmap, const void *bitmap_prev,
 790					 size_t bitmap_size, int arch)
 791{
 792	struct sock_fprog_kern *fprog = sfilter->prog->orig_prog;
 793	struct seccomp_data sd;
 794	int nr;
 795
 796	if (bitmap_prev) {
 797		/* The new filter must be as restrictive as the last. */
 798		bitmap_copy(bitmap, bitmap_prev, bitmap_size);
 799	} else {
 800		/* Before any filters, all syscalls are always allowed. */
 801		bitmap_fill(bitmap, bitmap_size);
 802	}
 803
 804	for (nr = 0; nr < bitmap_size; nr++) {
 805		/* No bitmap change: not a cacheable action. */
 806		if (!test_bit(nr, bitmap))
 807			continue;
 808
 809		sd.nr = nr;
 810		sd.arch = arch;
 811
 812		/* No bitmap change: continue to always allow. */
 813		if (seccomp_is_const_allow(fprog, &sd))
 814			continue;
 815
 816		/*
 817		 * Not a cacheable action: always run filters.
 818		 * atomic clear_bit() not needed, filter not visible yet.
 819		 */
 820		__clear_bit(nr, bitmap);
 821	}
 822}
 823
 824/**
 825 * seccomp_cache_prepare - emulate the filter to find cacheable syscalls
 826 * @sfilter: The seccomp filter
 827 *
 828 * Returns 0 if successful or -errno if error occurred.
 829 */
 830static void seccomp_cache_prepare(struct seccomp_filter *sfilter)
 831{
 832	struct action_cache *cache = &sfilter->cache;
 833	const struct action_cache *cache_prev =
 834		sfilter->prev ? &sfilter->prev->cache : NULL;
 835
 836	seccomp_cache_prepare_bitmap(sfilter, cache->allow_native,
 837				     cache_prev ? cache_prev->allow_native : NULL,
 838				     SECCOMP_ARCH_NATIVE_NR,
 839				     SECCOMP_ARCH_NATIVE);
 840
 841#ifdef SECCOMP_ARCH_COMPAT
 842	seccomp_cache_prepare_bitmap(sfilter, cache->allow_compat,
 843				     cache_prev ? cache_prev->allow_compat : NULL,
 844				     SECCOMP_ARCH_COMPAT_NR,
 845				     SECCOMP_ARCH_COMPAT);
 846#endif /* SECCOMP_ARCH_COMPAT */
 847}
 848#endif /* SECCOMP_ARCH_NATIVE */
 849
 850/**
 851 * seccomp_attach_filter: validate and attach filter
 852 * @flags:  flags to change filter behavior
 853 * @filter: seccomp filter to add to the current process
 854 *
 855 * Caller must be holding current->sighand->siglock lock.
 856 *
 857 * Returns 0 on success, -ve on error, or
 858 *   - in TSYNC mode: the pid of a thread which was either not in the correct
 859 *     seccomp mode or did not have an ancestral seccomp filter
 860 *   - in NEW_LISTENER mode: the fd of the new listener
 861 */
 862static long seccomp_attach_filter(unsigned int flags,
 863				  struct seccomp_filter *filter)
 864{
 865	unsigned long total_insns;
 866	struct seccomp_filter *walker;
 867
 868	assert_spin_locked(&current->sighand->siglock);
 869
 870	/* Validate resulting filter length. */
 871	total_insns = filter->prog->len;
 872	for (walker = current->seccomp.filter; walker; walker = walker->prev)
 873		total_insns += walker->prog->len + 4;  /* 4 instr penalty */
 874	if (total_insns > MAX_INSNS_PER_PATH)
 875		return -ENOMEM;
 876
 877	/* If thread sync has been requested, check that it is possible. */
 878	if (flags & SECCOMP_FILTER_FLAG_TSYNC) {
 879		int ret;
 880
 881		ret = seccomp_can_sync_threads();
 882		if (ret) {
 883			if (flags & SECCOMP_FILTER_FLAG_TSYNC_ESRCH)
 884				return -ESRCH;
 885			else
 886				return ret;
 887		}
 888	}
 889
 890	/* Set log flag, if present. */
 891	if (flags & SECCOMP_FILTER_FLAG_LOG)
 892		filter->log = true;
 893
 
 
 
 
 894	/*
 895	 * If there is an existing filter, make it the prev and don't drop its
 896	 * task reference.
 897	 */
 898	filter->prev = current->seccomp.filter;
 899	seccomp_cache_prepare(filter);
 900	current->seccomp.filter = filter;
 901	atomic_inc(&current->seccomp.filter_count);
 902
 903	/* Now that the new filter is in place, synchronize to all threads. */
 904	if (flags & SECCOMP_FILTER_FLAG_TSYNC)
 905		seccomp_sync_threads(flags);
 906
 907	return 0;
 908}
 909
 910static void __get_seccomp_filter(struct seccomp_filter *filter)
 911{
 912	refcount_inc(&filter->refs);
 913}
 914
 915/* get_seccomp_filter - increments the reference count of the filter on @tsk */
 916void get_seccomp_filter(struct task_struct *tsk)
 917{
 918	struct seccomp_filter *orig = tsk->seccomp.filter;
 919	if (!orig)
 920		return;
 921	__get_seccomp_filter(orig);
 922	refcount_inc(&orig->users);
 923}
 924
 925static void seccomp_init_siginfo(kernel_siginfo_t *info, int syscall, int reason)
 926{
 927	clear_siginfo(info);
 928	info->si_signo = SIGSYS;
 929	info->si_code = SYS_SECCOMP;
 930	info->si_call_addr = (void __user *)KSTK_EIP(current);
 931	info->si_errno = reason;
 932	info->si_arch = syscall_get_arch(current);
 933	info->si_syscall = syscall;
 934}
 935
 936/**
 937 * seccomp_send_sigsys - signals the task to allow in-process syscall emulation
 938 * @syscall: syscall number to send to userland
 939 * @reason: filter-supplied reason code to send to userland (via si_errno)
 940 *
 941 * Forces a SIGSYS with a code of SYS_SECCOMP and related sigsys info.
 942 */
 943static void seccomp_send_sigsys(int syscall, int reason)
 944{
 945	struct kernel_siginfo info;
 946	seccomp_init_siginfo(&info, syscall, reason);
 947	force_sig_info(&info);
 948}
 949#endif	/* CONFIG_SECCOMP_FILTER */
 950
 951/* For use with seccomp_actions_logged */
 952#define SECCOMP_LOG_KILL_PROCESS	(1 << 0)
 953#define SECCOMP_LOG_KILL_THREAD		(1 << 1)
 954#define SECCOMP_LOG_TRAP		(1 << 2)
 955#define SECCOMP_LOG_ERRNO		(1 << 3)
 956#define SECCOMP_LOG_TRACE		(1 << 4)
 957#define SECCOMP_LOG_LOG			(1 << 5)
 958#define SECCOMP_LOG_ALLOW		(1 << 6)
 959#define SECCOMP_LOG_USER_NOTIF		(1 << 7)
 960
 961static u32 seccomp_actions_logged = SECCOMP_LOG_KILL_PROCESS |
 962				    SECCOMP_LOG_KILL_THREAD  |
 963				    SECCOMP_LOG_TRAP  |
 964				    SECCOMP_LOG_ERRNO |
 965				    SECCOMP_LOG_USER_NOTIF |
 966				    SECCOMP_LOG_TRACE |
 967				    SECCOMP_LOG_LOG;
 968
 969static inline void seccomp_log(unsigned long syscall, long signr, u32 action,
 970			       bool requested)
 971{
 972	bool log = false;
 973
 974	switch (action) {
 975	case SECCOMP_RET_ALLOW:
 976		break;
 977	case SECCOMP_RET_TRAP:
 978		log = requested && seccomp_actions_logged & SECCOMP_LOG_TRAP;
 979		break;
 980	case SECCOMP_RET_ERRNO:
 981		log = requested && seccomp_actions_logged & SECCOMP_LOG_ERRNO;
 982		break;
 983	case SECCOMP_RET_TRACE:
 984		log = requested && seccomp_actions_logged & SECCOMP_LOG_TRACE;
 985		break;
 986	case SECCOMP_RET_USER_NOTIF:
 987		log = requested && seccomp_actions_logged & SECCOMP_LOG_USER_NOTIF;
 988		break;
 989	case SECCOMP_RET_LOG:
 990		log = seccomp_actions_logged & SECCOMP_LOG_LOG;
 991		break;
 992	case SECCOMP_RET_KILL_THREAD:
 993		log = seccomp_actions_logged & SECCOMP_LOG_KILL_THREAD;
 994		break;
 995	case SECCOMP_RET_KILL_PROCESS:
 996	default:
 997		log = seccomp_actions_logged & SECCOMP_LOG_KILL_PROCESS;
 998	}
 999
1000	/*
1001	 * Emit an audit message when the action is RET_KILL_*, RET_LOG, or the
1002	 * FILTER_FLAG_LOG bit was set. The admin has the ability to silence
1003	 * any action from being logged by removing the action name from the
1004	 * seccomp_actions_logged sysctl.
1005	 */
1006	if (!log)
1007		return;
1008
1009	audit_seccomp(syscall, signr, action);
1010}
1011
1012/*
1013 * Secure computing mode 1 allows only read/write/exit/sigreturn.
1014 * To be fully secure this must be combined with rlimit
1015 * to limit the stack allocations too.
1016 */
1017static const int mode1_syscalls[] = {
1018	__NR_seccomp_read, __NR_seccomp_write, __NR_seccomp_exit, __NR_seccomp_sigreturn,
1019	-1, /* negative terminated */
1020};
1021
1022static void __secure_computing_strict(int this_syscall)
1023{
1024	const int *allowed_syscalls = mode1_syscalls;
1025#ifdef CONFIG_COMPAT
1026	if (in_compat_syscall())
1027		allowed_syscalls = get_compat_mode1_syscalls();
1028#endif
1029	do {
1030		if (*allowed_syscalls == this_syscall)
1031			return;
1032	} while (*++allowed_syscalls != -1);
1033
1034#ifdef SECCOMP_DEBUG
1035	dump_stack();
1036#endif
 
1037	seccomp_log(this_syscall, SIGKILL, SECCOMP_RET_KILL_THREAD, true);
1038	do_exit(SIGKILL);
1039}
1040
1041#ifndef CONFIG_HAVE_ARCH_SECCOMP_FILTER
1042void secure_computing_strict(int this_syscall)
1043{
1044	int mode = current->seccomp.mode;
1045
1046	if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) &&
1047	    unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
1048		return;
1049
1050	if (mode == SECCOMP_MODE_DISABLED)
1051		return;
1052	else if (mode == SECCOMP_MODE_STRICT)
1053		__secure_computing_strict(this_syscall);
1054	else
1055		BUG();
1056}
1057#else
1058
1059#ifdef CONFIG_SECCOMP_FILTER
1060static u64 seccomp_next_notify_id(struct seccomp_filter *filter)
1061{
1062	/*
1063	 * Note: overflow is ok here, the id just needs to be unique per
1064	 * filter.
1065	 */
1066	lockdep_assert_held(&filter->notify_lock);
1067	return filter->notif->next_id++;
1068}
1069
1070static void seccomp_handle_addfd(struct seccomp_kaddfd *addfd, struct seccomp_knotif *n)
1071{
1072	int fd;
1073
1074	/*
1075	 * Remove the notification, and reset the list pointers, indicating
1076	 * that it has been handled.
1077	 */
1078	list_del_init(&addfd->list);
1079	if (!addfd->setfd)
1080		fd = receive_fd(addfd->file, addfd->flags);
1081	else
1082		fd = receive_fd_replace(addfd->fd, addfd->file, addfd->flags);
1083	addfd->ret = fd;
1084
1085	if (addfd->ioctl_flags & SECCOMP_ADDFD_FLAG_SEND) {
1086		/* If we fail reset and return an error to the notifier */
1087		if (fd < 0) {
1088			n->state = SECCOMP_NOTIFY_SENT;
1089		} else {
1090			/* Return the FD we just added */
1091			n->flags = 0;
1092			n->error = 0;
1093			n->val = fd;
1094		}
1095	}
1096
1097	/*
1098	 * Mark the notification as completed. From this point, addfd mem
1099	 * might be invalidated and we can't safely read it anymore.
1100	 */
1101	complete(&addfd->completion);
1102}
1103
 
 
 
 
 
 
1104static int seccomp_do_user_notification(int this_syscall,
1105					struct seccomp_filter *match,
1106					const struct seccomp_data *sd)
1107{
1108	int err;
1109	u32 flags = 0;
1110	long ret = 0;
1111	struct seccomp_knotif n = {};
1112	struct seccomp_kaddfd *addfd, *tmp;
1113
1114	mutex_lock(&match->notify_lock);
1115	err = -ENOSYS;
1116	if (!match->notif)
1117		goto out;
1118
1119	n.task = current;
1120	n.state = SECCOMP_NOTIFY_INIT;
1121	n.data = sd;
1122	n.id = seccomp_next_notify_id(match);
1123	init_completion(&n.ready);
1124	list_add(&n.list, &match->notif->notifications);
1125	INIT_LIST_HEAD(&n.addfd);
1126
1127	up(&match->notif->request);
1128	wake_up_poll(&match->wqh, EPOLLIN | EPOLLRDNORM);
1129
1130	/*
1131	 * This is where we wait for a reply from userspace.
1132	 */
1133	do {
 
 
1134		mutex_unlock(&match->notify_lock);
1135		err = wait_for_completion_interruptible(&n.ready);
 
 
 
1136		mutex_lock(&match->notify_lock);
1137		if (err != 0)
 
 
 
 
 
 
 
 
1138			goto interrupted;
 
1139
1140		addfd = list_first_entry_or_null(&n.addfd,
1141						 struct seccomp_kaddfd, list);
1142		/* Check if we were woken up by a addfd message */
1143		if (addfd)
1144			seccomp_handle_addfd(addfd, &n);
1145
1146	}  while (n.state != SECCOMP_NOTIFY_REPLIED);
1147
1148	ret = n.val;
1149	err = n.error;
1150	flags = n.flags;
1151
1152interrupted:
1153	/* If there were any pending addfd calls, clear them out */
1154	list_for_each_entry_safe(addfd, tmp, &n.addfd, list) {
1155		/* The process went away before we got a chance to handle it */
1156		addfd->ret = -ESRCH;
1157		list_del_init(&addfd->list);
1158		complete(&addfd->completion);
1159	}
1160
1161	/*
1162	 * Note that it's possible the listener died in between the time when
1163	 * we were notified of a response (or a signal) and when we were able to
1164	 * re-acquire the lock, so only delete from the list if the
1165	 * notification actually exists.
1166	 *
1167	 * Also note that this test is only valid because there's no way to
1168	 * *reattach* to a notifier right now. If one is added, we'll need to
1169	 * keep track of the notif itself and make sure they match here.
1170	 */
1171	if (match->notif)
1172		list_del(&n.list);
1173out:
1174	mutex_unlock(&match->notify_lock);
1175
1176	/* Userspace requests to continue the syscall. */
1177	if (flags & SECCOMP_USER_NOTIF_FLAG_CONTINUE)
1178		return 0;
1179
1180	syscall_set_return_value(current, current_pt_regs(),
1181				 err, ret);
1182	return -1;
1183}
1184
1185static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
1186			    const bool recheck_after_trace)
1187{
1188	u32 filter_ret, action;
1189	struct seccomp_filter *match = NULL;
1190	int data;
1191	struct seccomp_data sd_local;
1192
1193	/*
1194	 * Make sure that any changes to mode from another thread have
1195	 * been seen after SYSCALL_WORK_SECCOMP was seen.
1196	 */
1197	smp_rmb();
1198
1199	if (!sd) {
1200		populate_seccomp_data(&sd_local);
1201		sd = &sd_local;
1202	}
1203
1204	filter_ret = seccomp_run_filters(sd, &match);
1205	data = filter_ret & SECCOMP_RET_DATA;
1206	action = filter_ret & SECCOMP_RET_ACTION_FULL;
1207
1208	switch (action) {
1209	case SECCOMP_RET_ERRNO:
1210		/* Set low-order bits as an errno, capped at MAX_ERRNO. */
1211		if (data > MAX_ERRNO)
1212			data = MAX_ERRNO;
1213		syscall_set_return_value(current, current_pt_regs(),
1214					 -data, 0);
1215		goto skip;
1216
1217	case SECCOMP_RET_TRAP:
1218		/* Show the handler the original registers. */
1219		syscall_rollback(current, current_pt_regs());
1220		/* Let the filter pass back 16 bits of data. */
1221		seccomp_send_sigsys(this_syscall, data);
1222		goto skip;
1223
1224	case SECCOMP_RET_TRACE:
1225		/* We've been put in this state by the ptracer already. */
1226		if (recheck_after_trace)
1227			return 0;
1228
1229		/* ENOSYS these calls if there is no tracer attached. */
1230		if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP)) {
1231			syscall_set_return_value(current,
1232						 current_pt_regs(),
1233						 -ENOSYS, 0);
1234			goto skip;
1235		}
1236
1237		/* Allow the BPF to provide the event message */
1238		ptrace_event(PTRACE_EVENT_SECCOMP, data);
1239		/*
1240		 * The delivery of a fatal signal during event
1241		 * notification may silently skip tracer notification,
1242		 * which could leave us with a potentially unmodified
1243		 * syscall that the tracer would have liked to have
1244		 * changed. Since the process is about to die, we just
1245		 * force the syscall to be skipped and let the signal
1246		 * kill the process and correctly handle any tracer exit
1247		 * notifications.
1248		 */
1249		if (fatal_signal_pending(current))
1250			goto skip;
1251		/* Check if the tracer forced the syscall to be skipped. */
1252		this_syscall = syscall_get_nr(current, current_pt_regs());
1253		if (this_syscall < 0)
1254			goto skip;
1255
1256		/*
1257		 * Recheck the syscall, since it may have changed. This
1258		 * intentionally uses a NULL struct seccomp_data to force
1259		 * a reload of all registers. This does not goto skip since
1260		 * a skip would have already been reported.
1261		 */
1262		if (__seccomp_filter(this_syscall, NULL, true))
1263			return -1;
1264
1265		return 0;
1266
1267	case SECCOMP_RET_USER_NOTIF:
1268		if (seccomp_do_user_notification(this_syscall, match, sd))
1269			goto skip;
1270
1271		return 0;
1272
1273	case SECCOMP_RET_LOG:
1274		seccomp_log(this_syscall, 0, action, true);
1275		return 0;
1276
1277	case SECCOMP_RET_ALLOW:
1278		/*
1279		 * Note that the "match" filter will always be NULL for
1280		 * this action since SECCOMP_RET_ALLOW is the starting
1281		 * state in seccomp_run_filters().
1282		 */
1283		return 0;
1284
1285	case SECCOMP_RET_KILL_THREAD:
1286	case SECCOMP_RET_KILL_PROCESS:
1287	default:
 
1288		seccomp_log(this_syscall, SIGSYS, action, true);
1289		/* Dump core only if this is the last remaining thread. */
1290		if (action != SECCOMP_RET_KILL_THREAD ||
1291		    get_nr_threads(current) == 1) {
1292			kernel_siginfo_t info;
1293
1294			/* Show the original registers in the dump. */
1295			syscall_rollback(current, current_pt_regs());
1296			/* Trigger a manual coredump since do_exit skips it. */
1297			seccomp_init_siginfo(&info, this_syscall, data);
1298			do_coredump(&info);
1299		}
1300		if (action == SECCOMP_RET_KILL_THREAD)
1301			do_exit(SIGSYS);
1302		else
1303			do_group_exit(SIGSYS);
1304	}
1305
1306	unreachable();
1307
1308skip:
1309	seccomp_log(this_syscall, 0, action, match ? match->log : false);
1310	return -1;
1311}
1312#else
1313static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
1314			    const bool recheck_after_trace)
1315{
1316	BUG();
1317
1318	return -1;
1319}
1320#endif
1321
1322int __secure_computing(const struct seccomp_data *sd)
1323{
1324	int mode = current->seccomp.mode;
1325	int this_syscall;
1326
1327	if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) &&
1328	    unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
1329		return 0;
1330
1331	this_syscall = sd ? sd->nr :
1332		syscall_get_nr(current, current_pt_regs());
1333
1334	switch (mode) {
1335	case SECCOMP_MODE_STRICT:
1336		__secure_computing_strict(this_syscall);  /* may call do_exit */
1337		return 0;
1338	case SECCOMP_MODE_FILTER:
1339		return __seccomp_filter(this_syscall, sd, false);
 
 
 
 
 
1340	default:
1341		BUG();
1342	}
1343}
1344#endif /* CONFIG_HAVE_ARCH_SECCOMP_FILTER */
1345
1346long prctl_get_seccomp(void)
1347{
1348	return current->seccomp.mode;
1349}
1350
1351/**
1352 * seccomp_set_mode_strict: internal function for setting strict seccomp
1353 *
1354 * Once current->seccomp.mode is non-zero, it may not be changed.
1355 *
1356 * Returns 0 on success or -EINVAL on failure.
1357 */
1358static long seccomp_set_mode_strict(void)
1359{
1360	const unsigned long seccomp_mode = SECCOMP_MODE_STRICT;
1361	long ret = -EINVAL;
1362
1363	spin_lock_irq(&current->sighand->siglock);
1364
1365	if (!seccomp_may_assign_mode(seccomp_mode))
1366		goto out;
1367
1368#ifdef TIF_NOTSC
1369	disable_TSC();
1370#endif
1371	seccomp_assign_mode(current, seccomp_mode, 0);
1372	ret = 0;
1373
1374out:
1375	spin_unlock_irq(&current->sighand->siglock);
1376
1377	return ret;
1378}
1379
1380#ifdef CONFIG_SECCOMP_FILTER
1381static void seccomp_notify_free(struct seccomp_filter *filter)
1382{
1383	kfree(filter->notif);
1384	filter->notif = NULL;
1385}
1386
1387static void seccomp_notify_detach(struct seccomp_filter *filter)
1388{
1389	struct seccomp_knotif *knotif;
1390
1391	if (!filter)
1392		return;
1393
1394	mutex_lock(&filter->notify_lock);
1395
1396	/*
1397	 * If this file is being closed because e.g. the task who owned it
1398	 * died, let's wake everyone up who was waiting on us.
1399	 */
1400	list_for_each_entry(knotif, &filter->notif->notifications, list) {
1401		if (knotif->state == SECCOMP_NOTIFY_REPLIED)
1402			continue;
1403
1404		knotif->state = SECCOMP_NOTIFY_REPLIED;
1405		knotif->error = -ENOSYS;
1406		knotif->val = 0;
1407
1408		/*
1409		 * We do not need to wake up any pending addfd messages, as
1410		 * the notifier will do that for us, as this just looks
1411		 * like a standard reply.
1412		 */
1413		complete(&knotif->ready);
1414	}
1415
1416	seccomp_notify_free(filter);
1417	mutex_unlock(&filter->notify_lock);
1418}
1419
1420static int seccomp_notify_release(struct inode *inode, struct file *file)
1421{
1422	struct seccomp_filter *filter = file->private_data;
1423
1424	seccomp_notify_detach(filter);
1425	__put_seccomp_filter(filter);
1426	return 0;
1427}
1428
1429/* must be called with notif_lock held */
1430static inline struct seccomp_knotif *
1431find_notification(struct seccomp_filter *filter, u64 id)
1432{
1433	struct seccomp_knotif *cur;
1434
1435	lockdep_assert_held(&filter->notify_lock);
1436
1437	list_for_each_entry(cur, &filter->notif->notifications, list) {
1438		if (cur->id == id)
1439			return cur;
1440	}
1441
1442	return NULL;
1443}
1444
1445
1446static long seccomp_notify_recv(struct seccomp_filter *filter,
1447				void __user *buf)
1448{
1449	struct seccomp_knotif *knotif = NULL, *cur;
1450	struct seccomp_notif unotif;
1451	ssize_t ret;
1452
1453	/* Verify that we're not given garbage to keep struct extensible. */
1454	ret = check_zeroed_user(buf, sizeof(unotif));
1455	if (ret < 0)
1456		return ret;
1457	if (!ret)
1458		return -EINVAL;
1459
1460	memset(&unotif, 0, sizeof(unotif));
1461
1462	ret = down_interruptible(&filter->notif->request);
1463	if (ret < 0)
1464		return ret;
1465
1466	mutex_lock(&filter->notify_lock);
1467	list_for_each_entry(cur, &filter->notif->notifications, list) {
1468		if (cur->state == SECCOMP_NOTIFY_INIT) {
1469			knotif = cur;
1470			break;
1471		}
1472	}
1473
1474	/*
1475	 * If we didn't find a notification, it could be that the task was
1476	 * interrupted by a fatal signal between the time we were woken and
1477	 * when we were able to acquire the rw lock.
1478	 */
1479	if (!knotif) {
1480		ret = -ENOENT;
1481		goto out;
1482	}
1483
1484	unotif.id = knotif->id;
1485	unotif.pid = task_pid_vnr(knotif->task);
1486	unotif.data = *(knotif->data);
1487
1488	knotif->state = SECCOMP_NOTIFY_SENT;
1489	wake_up_poll(&filter->wqh, EPOLLOUT | EPOLLWRNORM);
1490	ret = 0;
1491out:
1492	mutex_unlock(&filter->notify_lock);
1493
1494	if (ret == 0 && copy_to_user(buf, &unotif, sizeof(unotif))) {
1495		ret = -EFAULT;
1496
1497		/*
1498		 * Userspace screwed up. To make sure that we keep this
1499		 * notification alive, let's reset it back to INIT. It
1500		 * may have died when we released the lock, so we need to make
1501		 * sure it's still around.
1502		 */
1503		mutex_lock(&filter->notify_lock);
1504		knotif = find_notification(filter, unotif.id);
1505		if (knotif) {
 
 
 
1506			knotif->state = SECCOMP_NOTIFY_INIT;
1507			up(&filter->notif->request);
1508		}
1509		mutex_unlock(&filter->notify_lock);
1510	}
1511
1512	return ret;
1513}
1514
1515static long seccomp_notify_send(struct seccomp_filter *filter,
1516				void __user *buf)
1517{
1518	struct seccomp_notif_resp resp = {};
1519	struct seccomp_knotif *knotif;
1520	long ret;
1521
1522	if (copy_from_user(&resp, buf, sizeof(resp)))
1523		return -EFAULT;
1524
1525	if (resp.flags & ~SECCOMP_USER_NOTIF_FLAG_CONTINUE)
1526		return -EINVAL;
1527
1528	if ((resp.flags & SECCOMP_USER_NOTIF_FLAG_CONTINUE) &&
1529	    (resp.error || resp.val))
1530		return -EINVAL;
1531
1532	ret = mutex_lock_interruptible(&filter->notify_lock);
1533	if (ret < 0)
1534		return ret;
1535
1536	knotif = find_notification(filter, resp.id);
1537	if (!knotif) {
1538		ret = -ENOENT;
1539		goto out;
1540	}
1541
1542	/* Allow exactly one reply. */
1543	if (knotif->state != SECCOMP_NOTIFY_SENT) {
1544		ret = -EINPROGRESS;
1545		goto out;
1546	}
1547
1548	ret = 0;
1549	knotif->state = SECCOMP_NOTIFY_REPLIED;
1550	knotif->error = resp.error;
1551	knotif->val = resp.val;
1552	knotif->flags = resp.flags;
1553	complete(&knotif->ready);
1554out:
1555	mutex_unlock(&filter->notify_lock);
1556	return ret;
1557}
1558
1559static long seccomp_notify_id_valid(struct seccomp_filter *filter,
1560				    void __user *buf)
1561{
1562	struct seccomp_knotif *knotif;
1563	u64 id;
1564	long ret;
1565
1566	if (copy_from_user(&id, buf, sizeof(id)))
1567		return -EFAULT;
1568
1569	ret = mutex_lock_interruptible(&filter->notify_lock);
1570	if (ret < 0)
1571		return ret;
1572
1573	knotif = find_notification(filter, id);
1574	if (knotif && knotif->state == SECCOMP_NOTIFY_SENT)
1575		ret = 0;
1576	else
1577		ret = -ENOENT;
1578
1579	mutex_unlock(&filter->notify_lock);
1580	return ret;
1581}
1582
1583static long seccomp_notify_addfd(struct seccomp_filter *filter,
1584				 struct seccomp_notif_addfd __user *uaddfd,
1585				 unsigned int size)
1586{
1587	struct seccomp_notif_addfd addfd;
1588	struct seccomp_knotif *knotif;
1589	struct seccomp_kaddfd kaddfd;
1590	int ret;
1591
1592	BUILD_BUG_ON(sizeof(addfd) < SECCOMP_NOTIFY_ADDFD_SIZE_VER0);
1593	BUILD_BUG_ON(sizeof(addfd) != SECCOMP_NOTIFY_ADDFD_SIZE_LATEST);
1594
1595	if (size < SECCOMP_NOTIFY_ADDFD_SIZE_VER0 || size >= PAGE_SIZE)
1596		return -EINVAL;
1597
1598	ret = copy_struct_from_user(&addfd, sizeof(addfd), uaddfd, size);
1599	if (ret)
1600		return ret;
1601
1602	if (addfd.newfd_flags & ~O_CLOEXEC)
1603		return -EINVAL;
1604
1605	if (addfd.flags & ~(SECCOMP_ADDFD_FLAG_SETFD | SECCOMP_ADDFD_FLAG_SEND))
1606		return -EINVAL;
1607
1608	if (addfd.newfd && !(addfd.flags & SECCOMP_ADDFD_FLAG_SETFD))
1609		return -EINVAL;
1610
1611	kaddfd.file = fget(addfd.srcfd);
1612	if (!kaddfd.file)
1613		return -EBADF;
1614
1615	kaddfd.ioctl_flags = addfd.flags;
1616	kaddfd.flags = addfd.newfd_flags;
1617	kaddfd.setfd = addfd.flags & SECCOMP_ADDFD_FLAG_SETFD;
1618	kaddfd.fd = addfd.newfd;
1619	init_completion(&kaddfd.completion);
1620
1621	ret = mutex_lock_interruptible(&filter->notify_lock);
1622	if (ret < 0)
1623		goto out;
1624
1625	knotif = find_notification(filter, addfd.id);
1626	if (!knotif) {
1627		ret = -ENOENT;
1628		goto out_unlock;
1629	}
1630
1631	/*
1632	 * We do not want to allow for FD injection to occur before the
1633	 * notification has been picked up by a userspace handler, or after
1634	 * the notification has been replied to.
1635	 */
1636	if (knotif->state != SECCOMP_NOTIFY_SENT) {
1637		ret = -EINPROGRESS;
1638		goto out_unlock;
1639	}
1640
1641	if (addfd.flags & SECCOMP_ADDFD_FLAG_SEND) {
1642		/*
1643		 * Disallow queuing an atomic addfd + send reply while there are
1644		 * some addfd requests still to process.
1645		 *
1646		 * There is no clear reason to support it and allows us to keep
1647		 * the loop on the other side straight-forward.
1648		 */
1649		if (!list_empty(&knotif->addfd)) {
1650			ret = -EBUSY;
1651			goto out_unlock;
1652		}
1653
1654		/* Allow exactly only one reply */
1655		knotif->state = SECCOMP_NOTIFY_REPLIED;
1656	}
1657
1658	list_add(&kaddfd.list, &knotif->addfd);
1659	complete(&knotif->ready);
1660	mutex_unlock(&filter->notify_lock);
1661
1662	/* Now we wait for it to be processed or be interrupted */
1663	ret = wait_for_completion_interruptible(&kaddfd.completion);
1664	if (ret == 0) {
1665		/*
1666		 * We had a successful completion. The other side has already
1667		 * removed us from the addfd queue, and
1668		 * wait_for_completion_interruptible has a memory barrier upon
1669		 * success that lets us read this value directly without
1670		 * locking.
1671		 */
1672		ret = kaddfd.ret;
1673		goto out;
1674	}
1675
1676	mutex_lock(&filter->notify_lock);
1677	/*
1678	 * Even though we were woken up by a signal and not a successful
1679	 * completion, a completion may have happened in the mean time.
1680	 *
1681	 * We need to check again if the addfd request has been handled,
1682	 * and if not, we will remove it from the queue.
1683	 */
1684	if (list_empty(&kaddfd.list))
1685		ret = kaddfd.ret;
1686	else
1687		list_del(&kaddfd.list);
1688
1689out_unlock:
1690	mutex_unlock(&filter->notify_lock);
1691out:
1692	fput(kaddfd.file);
1693
1694	return ret;
1695}
1696
1697static long seccomp_notify_ioctl(struct file *file, unsigned int cmd,
1698				 unsigned long arg)
1699{
1700	struct seccomp_filter *filter = file->private_data;
1701	void __user *buf = (void __user *)arg;
1702
1703	/* Fixed-size ioctls */
1704	switch (cmd) {
1705	case SECCOMP_IOCTL_NOTIF_RECV:
1706		return seccomp_notify_recv(filter, buf);
1707	case SECCOMP_IOCTL_NOTIF_SEND:
1708		return seccomp_notify_send(filter, buf);
1709	case SECCOMP_IOCTL_NOTIF_ID_VALID_WRONG_DIR:
1710	case SECCOMP_IOCTL_NOTIF_ID_VALID:
1711		return seccomp_notify_id_valid(filter, buf);
1712	}
1713
1714	/* Extensible Argument ioctls */
1715#define EA_IOCTL(cmd)	((cmd) & ~(IOC_INOUT | IOCSIZE_MASK))
1716	switch (EA_IOCTL(cmd)) {
1717	case EA_IOCTL(SECCOMP_IOCTL_NOTIF_ADDFD):
1718		return seccomp_notify_addfd(filter, buf, _IOC_SIZE(cmd));
1719	default:
1720		return -EINVAL;
1721	}
1722}
1723
1724static __poll_t seccomp_notify_poll(struct file *file,
1725				    struct poll_table_struct *poll_tab)
1726{
1727	struct seccomp_filter *filter = file->private_data;
1728	__poll_t ret = 0;
1729	struct seccomp_knotif *cur;
1730
1731	poll_wait(file, &filter->wqh, poll_tab);
1732
1733	if (mutex_lock_interruptible(&filter->notify_lock) < 0)
1734		return EPOLLERR;
1735
1736	list_for_each_entry(cur, &filter->notif->notifications, list) {
1737		if (cur->state == SECCOMP_NOTIFY_INIT)
1738			ret |= EPOLLIN | EPOLLRDNORM;
1739		if (cur->state == SECCOMP_NOTIFY_SENT)
1740			ret |= EPOLLOUT | EPOLLWRNORM;
1741		if ((ret & EPOLLIN) && (ret & EPOLLOUT))
1742			break;
1743	}
1744
1745	mutex_unlock(&filter->notify_lock);
1746
1747	if (refcount_read(&filter->users) == 0)
1748		ret |= EPOLLHUP;
1749
1750	return ret;
1751}
1752
1753static const struct file_operations seccomp_notify_ops = {
1754	.poll = seccomp_notify_poll,
1755	.release = seccomp_notify_release,
1756	.unlocked_ioctl = seccomp_notify_ioctl,
1757	.compat_ioctl = seccomp_notify_ioctl,
1758};
1759
1760static struct file *init_listener(struct seccomp_filter *filter)
1761{
1762	struct file *ret;
1763
1764	ret = ERR_PTR(-ENOMEM);
1765	filter->notif = kzalloc(sizeof(*(filter->notif)), GFP_KERNEL);
1766	if (!filter->notif)
1767		goto out;
1768
1769	sema_init(&filter->notif->request, 0);
1770	filter->notif->next_id = get_random_u64();
1771	INIT_LIST_HEAD(&filter->notif->notifications);
1772
1773	ret = anon_inode_getfile("seccomp notify", &seccomp_notify_ops,
1774				 filter, O_RDWR);
1775	if (IS_ERR(ret))
1776		goto out_notif;
1777
1778	/* The file has a reference to it now */
1779	__get_seccomp_filter(filter);
1780
1781out_notif:
1782	if (IS_ERR(ret))
1783		seccomp_notify_free(filter);
1784out:
1785	return ret;
1786}
1787
1788/*
1789 * Does @new_child have a listener while an ancestor also has a listener?
1790 * If so, we'll want to reject this filter.
1791 * This only has to be tested for the current process, even in the TSYNC case,
1792 * because TSYNC installs @child with the same parent on all threads.
1793 * Note that @new_child is not hooked up to its parent at this point yet, so
1794 * we use current->seccomp.filter.
1795 */
1796static bool has_duplicate_listener(struct seccomp_filter *new_child)
1797{
1798	struct seccomp_filter *cur;
1799
1800	/* must be protected against concurrent TSYNC */
1801	lockdep_assert_held(&current->sighand->siglock);
1802
1803	if (!new_child->notif)
1804		return false;
1805	for (cur = current->seccomp.filter; cur; cur = cur->prev) {
1806		if (cur->notif)
1807			return true;
1808	}
1809
1810	return false;
1811}
1812
1813/**
1814 * seccomp_set_mode_filter: internal function for setting seccomp filter
1815 * @flags:  flags to change filter behavior
1816 * @filter: struct sock_fprog containing filter
1817 *
1818 * This function may be called repeatedly to install additional filters.
1819 * Every filter successfully installed will be evaluated (in reverse order)
1820 * for each system call the task makes.
1821 *
1822 * Once current->seccomp.mode is non-zero, it may not be changed.
1823 *
1824 * Returns 0 on success or -EINVAL on failure.
1825 */
1826static long seccomp_set_mode_filter(unsigned int flags,
1827				    const char __user *filter)
1828{
1829	const unsigned long seccomp_mode = SECCOMP_MODE_FILTER;
1830	struct seccomp_filter *prepared = NULL;
1831	long ret = -EINVAL;
1832	int listener = -1;
1833	struct file *listener_f = NULL;
1834
1835	/* Validate flags. */
1836	if (flags & ~SECCOMP_FILTER_FLAG_MASK)
1837		return -EINVAL;
1838
1839	/*
1840	 * In the successful case, NEW_LISTENER returns the new listener fd.
1841	 * But in the failure case, TSYNC returns the thread that died. If you
1842	 * combine these two flags, there's no way to tell whether something
1843	 * succeeded or failed. So, let's disallow this combination if the user
1844	 * has not explicitly requested no errors from TSYNC.
1845	 */
1846	if ((flags & SECCOMP_FILTER_FLAG_TSYNC) &&
1847	    (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) &&
1848	    ((flags & SECCOMP_FILTER_FLAG_TSYNC_ESRCH) == 0))
 
 
 
 
 
 
 
 
1849		return -EINVAL;
1850
1851	/* Prepare the new filter before holding any locks. */
1852	prepared = seccomp_prepare_user_filter(filter);
1853	if (IS_ERR(prepared))
1854		return PTR_ERR(prepared);
1855
1856	if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) {
1857		listener = get_unused_fd_flags(O_CLOEXEC);
1858		if (listener < 0) {
1859			ret = listener;
1860			goto out_free;
1861		}
1862
1863		listener_f = init_listener(prepared);
1864		if (IS_ERR(listener_f)) {
1865			put_unused_fd(listener);
1866			ret = PTR_ERR(listener_f);
1867			goto out_free;
1868		}
1869	}
1870
1871	/*
1872	 * Make sure we cannot change seccomp or nnp state via TSYNC
1873	 * while another thread is in the middle of calling exec.
1874	 */
1875	if (flags & SECCOMP_FILTER_FLAG_TSYNC &&
1876	    mutex_lock_killable(&current->signal->cred_guard_mutex))
1877		goto out_put_fd;
1878
1879	spin_lock_irq(&current->sighand->siglock);
1880
1881	if (!seccomp_may_assign_mode(seccomp_mode))
1882		goto out;
1883
1884	if (has_duplicate_listener(prepared)) {
1885		ret = -EBUSY;
1886		goto out;
1887	}
1888
1889	ret = seccomp_attach_filter(flags, prepared);
1890	if (ret)
1891		goto out;
1892	/* Do not free the successfully attached filter. */
1893	prepared = NULL;
1894
1895	seccomp_assign_mode(current, seccomp_mode, flags);
1896out:
1897	spin_unlock_irq(&current->sighand->siglock);
1898	if (flags & SECCOMP_FILTER_FLAG_TSYNC)
1899		mutex_unlock(&current->signal->cred_guard_mutex);
1900out_put_fd:
1901	if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) {
1902		if (ret) {
1903			listener_f->private_data = NULL;
1904			fput(listener_f);
1905			put_unused_fd(listener);
1906			seccomp_notify_detach(prepared);
1907		} else {
1908			fd_install(listener, listener_f);
1909			ret = listener;
1910		}
1911	}
1912out_free:
1913	seccomp_filter_free(prepared);
1914	return ret;
1915}
1916#else
1917static inline long seccomp_set_mode_filter(unsigned int flags,
1918					   const char __user *filter)
1919{
1920	return -EINVAL;
1921}
1922#endif
1923
1924static long seccomp_get_action_avail(const char __user *uaction)
1925{
1926	u32 action;
1927
1928	if (copy_from_user(&action, uaction, sizeof(action)))
1929		return -EFAULT;
1930
1931	switch (action) {
1932	case SECCOMP_RET_KILL_PROCESS:
1933	case SECCOMP_RET_KILL_THREAD:
1934	case SECCOMP_RET_TRAP:
1935	case SECCOMP_RET_ERRNO:
1936	case SECCOMP_RET_USER_NOTIF:
1937	case SECCOMP_RET_TRACE:
1938	case SECCOMP_RET_LOG:
1939	case SECCOMP_RET_ALLOW:
1940		break;
1941	default:
1942		return -EOPNOTSUPP;
1943	}
1944
1945	return 0;
1946}
1947
1948static long seccomp_get_notif_sizes(void __user *usizes)
1949{
1950	struct seccomp_notif_sizes sizes = {
1951		.seccomp_notif = sizeof(struct seccomp_notif),
1952		.seccomp_notif_resp = sizeof(struct seccomp_notif_resp),
1953		.seccomp_data = sizeof(struct seccomp_data),
1954	};
1955
1956	if (copy_to_user(usizes, &sizes, sizeof(sizes)))
1957		return -EFAULT;
1958
1959	return 0;
1960}
1961
1962/* Common entry point for both prctl and syscall. */
1963static long do_seccomp(unsigned int op, unsigned int flags,
1964		       void __user *uargs)
1965{
1966	switch (op) {
1967	case SECCOMP_SET_MODE_STRICT:
1968		if (flags != 0 || uargs != NULL)
1969			return -EINVAL;
1970		return seccomp_set_mode_strict();
1971	case SECCOMP_SET_MODE_FILTER:
1972		return seccomp_set_mode_filter(flags, uargs);
1973	case SECCOMP_GET_ACTION_AVAIL:
1974		if (flags != 0)
1975			return -EINVAL;
1976
1977		return seccomp_get_action_avail(uargs);
1978	case SECCOMP_GET_NOTIF_SIZES:
1979		if (flags != 0)
1980			return -EINVAL;
1981
1982		return seccomp_get_notif_sizes(uargs);
1983	default:
1984		return -EINVAL;
1985	}
1986}
1987
1988SYSCALL_DEFINE3(seccomp, unsigned int, op, unsigned int, flags,
1989			 void __user *, uargs)
1990{
1991	return do_seccomp(op, flags, uargs);
1992}
1993
1994/**
1995 * prctl_set_seccomp: configures current->seccomp.mode
1996 * @seccomp_mode: requested mode to use
1997 * @filter: optional struct sock_fprog for use with SECCOMP_MODE_FILTER
1998 *
1999 * Returns 0 on success or -EINVAL on failure.
2000 */
2001long prctl_set_seccomp(unsigned long seccomp_mode, void __user *filter)
2002{
2003	unsigned int op;
2004	void __user *uargs;
2005
2006	switch (seccomp_mode) {
2007	case SECCOMP_MODE_STRICT:
2008		op = SECCOMP_SET_MODE_STRICT;
2009		/*
2010		 * Setting strict mode through prctl always ignored filter,
2011		 * so make sure it is always NULL here to pass the internal
2012		 * check in do_seccomp().
2013		 */
2014		uargs = NULL;
2015		break;
2016	case SECCOMP_MODE_FILTER:
2017		op = SECCOMP_SET_MODE_FILTER;
2018		uargs = filter;
2019		break;
2020	default:
2021		return -EINVAL;
2022	}
2023
2024	/* prctl interface doesn't have flags, so they are always zero. */
2025	return do_seccomp(op, 0, uargs);
2026}
2027
2028#if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
2029static struct seccomp_filter *get_nth_filter(struct task_struct *task,
2030					     unsigned long filter_off)
2031{
2032	struct seccomp_filter *orig, *filter;
2033	unsigned long count;
2034
2035	/*
2036	 * Note: this is only correct because the caller should be the (ptrace)
2037	 * tracer of the task, otherwise lock_task_sighand is needed.
2038	 */
2039	spin_lock_irq(&task->sighand->siglock);
2040
2041	if (task->seccomp.mode != SECCOMP_MODE_FILTER) {
2042		spin_unlock_irq(&task->sighand->siglock);
2043		return ERR_PTR(-EINVAL);
2044	}
2045
2046	orig = task->seccomp.filter;
2047	__get_seccomp_filter(orig);
2048	spin_unlock_irq(&task->sighand->siglock);
2049
2050	count = 0;
2051	for (filter = orig; filter; filter = filter->prev)
2052		count++;
2053
2054	if (filter_off >= count) {
2055		filter = ERR_PTR(-ENOENT);
2056		goto out;
2057	}
2058
2059	count -= filter_off;
2060	for (filter = orig; filter && count > 1; filter = filter->prev)
2061		count--;
2062
2063	if (WARN_ON(count != 1 || !filter)) {
2064		filter = ERR_PTR(-ENOENT);
2065		goto out;
2066	}
2067
2068	__get_seccomp_filter(filter);
2069
2070out:
2071	__put_seccomp_filter(orig);
2072	return filter;
2073}
2074
2075long seccomp_get_filter(struct task_struct *task, unsigned long filter_off,
2076			void __user *data)
2077{
2078	struct seccomp_filter *filter;
2079	struct sock_fprog_kern *fprog;
2080	long ret;
2081
2082	if (!capable(CAP_SYS_ADMIN) ||
2083	    current->seccomp.mode != SECCOMP_MODE_DISABLED) {
2084		return -EACCES;
2085	}
2086
2087	filter = get_nth_filter(task, filter_off);
2088	if (IS_ERR(filter))
2089		return PTR_ERR(filter);
2090
2091	fprog = filter->prog->orig_prog;
2092	if (!fprog) {
2093		/* This must be a new non-cBPF filter, since we save
2094		 * every cBPF filter's orig_prog above when
2095		 * CONFIG_CHECKPOINT_RESTORE is enabled.
2096		 */
2097		ret = -EMEDIUMTYPE;
2098		goto out;
2099	}
2100
2101	ret = fprog->len;
2102	if (!data)
2103		goto out;
2104
2105	if (copy_to_user(data, fprog->filter, bpf_classic_proglen(fprog)))
2106		ret = -EFAULT;
2107
2108out:
2109	__put_seccomp_filter(filter);
2110	return ret;
2111}
2112
2113long seccomp_get_metadata(struct task_struct *task,
2114			  unsigned long size, void __user *data)
2115{
2116	long ret;
2117	struct seccomp_filter *filter;
2118	struct seccomp_metadata kmd = {};
2119
2120	if (!capable(CAP_SYS_ADMIN) ||
2121	    current->seccomp.mode != SECCOMP_MODE_DISABLED) {
2122		return -EACCES;
2123	}
2124
2125	size = min_t(unsigned long, size, sizeof(kmd));
2126
2127	if (size < sizeof(kmd.filter_off))
2128		return -EINVAL;
2129
2130	if (copy_from_user(&kmd.filter_off, data, sizeof(kmd.filter_off)))
2131		return -EFAULT;
2132
2133	filter = get_nth_filter(task, kmd.filter_off);
2134	if (IS_ERR(filter))
2135		return PTR_ERR(filter);
2136
2137	if (filter->log)
2138		kmd.flags |= SECCOMP_FILTER_FLAG_LOG;
2139
2140	ret = size;
2141	if (copy_to_user(data, &kmd, size))
2142		ret = -EFAULT;
2143
2144	__put_seccomp_filter(filter);
2145	return ret;
2146}
2147#endif
2148
2149#ifdef CONFIG_SYSCTL
2150
2151/* Human readable action names for friendly sysctl interaction */
2152#define SECCOMP_RET_KILL_PROCESS_NAME	"kill_process"
2153#define SECCOMP_RET_KILL_THREAD_NAME	"kill_thread"
2154#define SECCOMP_RET_TRAP_NAME		"trap"
2155#define SECCOMP_RET_ERRNO_NAME		"errno"
2156#define SECCOMP_RET_USER_NOTIF_NAME	"user_notif"
2157#define SECCOMP_RET_TRACE_NAME		"trace"
2158#define SECCOMP_RET_LOG_NAME		"log"
2159#define SECCOMP_RET_ALLOW_NAME		"allow"
2160
2161static const char seccomp_actions_avail[] =
2162				SECCOMP_RET_KILL_PROCESS_NAME	" "
2163				SECCOMP_RET_KILL_THREAD_NAME	" "
2164				SECCOMP_RET_TRAP_NAME		" "
2165				SECCOMP_RET_ERRNO_NAME		" "
2166				SECCOMP_RET_USER_NOTIF_NAME     " "
2167				SECCOMP_RET_TRACE_NAME		" "
2168				SECCOMP_RET_LOG_NAME		" "
2169				SECCOMP_RET_ALLOW_NAME;
2170
2171struct seccomp_log_name {
2172	u32		log;
2173	const char	*name;
2174};
2175
2176static const struct seccomp_log_name seccomp_log_names[] = {
2177	{ SECCOMP_LOG_KILL_PROCESS, SECCOMP_RET_KILL_PROCESS_NAME },
2178	{ SECCOMP_LOG_KILL_THREAD, SECCOMP_RET_KILL_THREAD_NAME },
2179	{ SECCOMP_LOG_TRAP, SECCOMP_RET_TRAP_NAME },
2180	{ SECCOMP_LOG_ERRNO, SECCOMP_RET_ERRNO_NAME },
2181	{ SECCOMP_LOG_USER_NOTIF, SECCOMP_RET_USER_NOTIF_NAME },
2182	{ SECCOMP_LOG_TRACE, SECCOMP_RET_TRACE_NAME },
2183	{ SECCOMP_LOG_LOG, SECCOMP_RET_LOG_NAME },
2184	{ SECCOMP_LOG_ALLOW, SECCOMP_RET_ALLOW_NAME },
2185	{ }
2186};
2187
2188static bool seccomp_names_from_actions_logged(char *names, size_t size,
2189					      u32 actions_logged,
2190					      const char *sep)
2191{
2192	const struct seccomp_log_name *cur;
2193	bool append_sep = false;
2194
2195	for (cur = seccomp_log_names; cur->name && size; cur++) {
2196		ssize_t ret;
2197
2198		if (!(actions_logged & cur->log))
2199			continue;
2200
2201		if (append_sep) {
2202			ret = strscpy(names, sep, size);
2203			if (ret < 0)
2204				return false;
2205
2206			names += ret;
2207			size -= ret;
2208		} else
2209			append_sep = true;
2210
2211		ret = strscpy(names, cur->name, size);
2212		if (ret < 0)
2213			return false;
2214
2215		names += ret;
2216		size -= ret;
2217	}
2218
2219	return true;
2220}
2221
2222static bool seccomp_action_logged_from_name(u32 *action_logged,
2223					    const char *name)
2224{
2225	const struct seccomp_log_name *cur;
2226
2227	for (cur = seccomp_log_names; cur->name; cur++) {
2228		if (!strcmp(cur->name, name)) {
2229			*action_logged = cur->log;
2230			return true;
2231		}
2232	}
2233
2234	return false;
2235}
2236
2237static bool seccomp_actions_logged_from_names(u32 *actions_logged, char *names)
2238{
2239	char *name;
2240
2241	*actions_logged = 0;
2242	while ((name = strsep(&names, " ")) && *name) {
2243		u32 action_logged = 0;
2244
2245		if (!seccomp_action_logged_from_name(&action_logged, name))
2246			return false;
2247
2248		*actions_logged |= action_logged;
2249	}
2250
2251	return true;
2252}
2253
2254static int read_actions_logged(struct ctl_table *ro_table, void *buffer,
2255			       size_t *lenp, loff_t *ppos)
2256{
2257	char names[sizeof(seccomp_actions_avail)];
2258	struct ctl_table table;
2259
2260	memset(names, 0, sizeof(names));
2261
2262	if (!seccomp_names_from_actions_logged(names, sizeof(names),
2263					       seccomp_actions_logged, " "))
2264		return -EINVAL;
2265
2266	table = *ro_table;
2267	table.data = names;
2268	table.maxlen = sizeof(names);
2269	return proc_dostring(&table, 0, buffer, lenp, ppos);
2270}
2271
2272static int write_actions_logged(struct ctl_table *ro_table, void *buffer,
2273				size_t *lenp, loff_t *ppos, u32 *actions_logged)
2274{
2275	char names[sizeof(seccomp_actions_avail)];
2276	struct ctl_table table;
2277	int ret;
2278
2279	if (!capable(CAP_SYS_ADMIN))
2280		return -EPERM;
2281
2282	memset(names, 0, sizeof(names));
2283
2284	table = *ro_table;
2285	table.data = names;
2286	table.maxlen = sizeof(names);
2287	ret = proc_dostring(&table, 1, buffer, lenp, ppos);
2288	if (ret)
2289		return ret;
2290
2291	if (!seccomp_actions_logged_from_names(actions_logged, table.data))
2292		return -EINVAL;
2293
2294	if (*actions_logged & SECCOMP_LOG_ALLOW)
2295		return -EINVAL;
2296
2297	seccomp_actions_logged = *actions_logged;
2298	return 0;
2299}
2300
2301static void audit_actions_logged(u32 actions_logged, u32 old_actions_logged,
2302				 int ret)
2303{
2304	char names[sizeof(seccomp_actions_avail)];
2305	char old_names[sizeof(seccomp_actions_avail)];
2306	const char *new = names;
2307	const char *old = old_names;
2308
2309	if (!audit_enabled)
2310		return;
2311
2312	memset(names, 0, sizeof(names));
2313	memset(old_names, 0, sizeof(old_names));
2314
2315	if (ret)
2316		new = "?";
2317	else if (!actions_logged)
2318		new = "(none)";
2319	else if (!seccomp_names_from_actions_logged(names, sizeof(names),
2320						    actions_logged, ","))
2321		new = "?";
2322
2323	if (!old_actions_logged)
2324		old = "(none)";
2325	else if (!seccomp_names_from_actions_logged(old_names,
2326						    sizeof(old_names),
2327						    old_actions_logged, ","))
2328		old = "?";
2329
2330	return audit_seccomp_actions_logged(new, old, !ret);
2331}
2332
2333static int seccomp_actions_logged_handler(struct ctl_table *ro_table, int write,
2334					  void *buffer, size_t *lenp,
2335					  loff_t *ppos)
2336{
2337	int ret;
2338
2339	if (write) {
2340		u32 actions_logged = 0;
2341		u32 old_actions_logged = seccomp_actions_logged;
2342
2343		ret = write_actions_logged(ro_table, buffer, lenp, ppos,
2344					   &actions_logged);
2345		audit_actions_logged(actions_logged, old_actions_logged, ret);
2346	} else
2347		ret = read_actions_logged(ro_table, buffer, lenp, ppos);
2348
2349	return ret;
2350}
2351
2352static struct ctl_path seccomp_sysctl_path[] = {
2353	{ .procname = "kernel", },
2354	{ .procname = "seccomp", },
2355	{ }
2356};
2357
2358static struct ctl_table seccomp_sysctl_table[] = {
2359	{
2360		.procname	= "actions_avail",
2361		.data		= (void *) &seccomp_actions_avail,
2362		.maxlen		= sizeof(seccomp_actions_avail),
2363		.mode		= 0444,
2364		.proc_handler	= proc_dostring,
2365	},
2366	{
2367		.procname	= "actions_logged",
2368		.mode		= 0644,
2369		.proc_handler	= seccomp_actions_logged_handler,
2370	},
2371	{ }
2372};
2373
2374static int __init seccomp_sysctl_init(void)
2375{
2376	struct ctl_table_header *hdr;
2377
2378	hdr = register_sysctl_paths(seccomp_sysctl_path, seccomp_sysctl_table);
2379	if (!hdr)
2380		pr_warn("sysctl registration failed\n");
2381	else
2382		kmemleak_not_leak(hdr);
2383
2384	return 0;
2385}
2386
2387device_initcall(seccomp_sysctl_init)
2388
2389#endif /* CONFIG_SYSCTL */
2390
2391#ifdef CONFIG_SECCOMP_CACHE_DEBUG
2392/* Currently CONFIG_SECCOMP_CACHE_DEBUG implies SECCOMP_ARCH_NATIVE */
2393static void proc_pid_seccomp_cache_arch(struct seq_file *m, const char *name,
2394					const void *bitmap, size_t bitmap_size)
2395{
2396	int nr;
2397
2398	for (nr = 0; nr < bitmap_size; nr++) {
2399		bool cached = test_bit(nr, bitmap);
2400		char *status = cached ? "ALLOW" : "FILTER";
2401
2402		seq_printf(m, "%s %d %s\n", name, nr, status);
2403	}
2404}
2405
2406int proc_pid_seccomp_cache(struct seq_file *m, struct pid_namespace *ns,
2407			   struct pid *pid, struct task_struct *task)
2408{
2409	struct seccomp_filter *f;
2410	unsigned long flags;
2411
2412	/*
2413	 * We don't want some sandboxed process to know what their seccomp
2414	 * filters consist of.
2415	 */
2416	if (!file_ns_capable(m->file, &init_user_ns, CAP_SYS_ADMIN))
2417		return -EACCES;
2418
2419	if (!lock_task_sighand(task, &flags))
2420		return -ESRCH;
2421
2422	f = READ_ONCE(task->seccomp.filter);
2423	if (!f) {
2424		unlock_task_sighand(task, &flags);
2425		return 0;
2426	}
2427
2428	/* prevent filter from being freed while we are printing it */
2429	__get_seccomp_filter(f);
2430	unlock_task_sighand(task, &flags);
2431
2432	proc_pid_seccomp_cache_arch(m, SECCOMP_ARCH_NATIVE_NAME,
2433				    f->cache.allow_native,
2434				    SECCOMP_ARCH_NATIVE_NR);
2435
2436#ifdef SECCOMP_ARCH_COMPAT
2437	proc_pid_seccomp_cache_arch(m, SECCOMP_ARCH_COMPAT_NAME,
2438				    f->cache.allow_compat,
2439				    SECCOMP_ARCH_COMPAT_NR);
2440#endif /* SECCOMP_ARCH_COMPAT */
2441
2442	__put_seccomp_filter(f);
2443	return 0;
2444}
2445#endif /* CONFIG_SECCOMP_CACHE_DEBUG */