1// SPDX-License-Identifier: GPL-2.0
   2/*
   3 * linux/kernel/seccomp.c
   4 *
   5 * Copyright 2004-2005  Andrea Arcangeli <andrea@cpushare.com>
   6 *
   7 * Copyright (C) 2012 Google, Inc.
   8 * Will Drewry <wad@chromium.org>
   9 *
  10 * This defines a simple but solid secure-computing facility.
  11 *
  12 * Mode 1 uses a fixed list of allowed system calls.
  13 * Mode 2 allows user-defined system call filters in the form
  14 *        of Berkeley Packet Filters/Linux Socket Filters.
  15 */
 
  16
  17#include <linux/refcount.h>
  18#include <linux/audit.h>
  19#include <linux/compat.h>
  20#include <linux/coredump.h>
  21#include <linux/kmemleak.h>
  22#include <linux/nospec.h>
  23#include <linux/prctl.h>
  24#include <linux/sched.h>
  25#include <linux/sched/task_stack.h>
  26#include <linux/seccomp.h>
  27#include <linux/slab.h>
  28#include <linux/syscalls.h>
  29#include <linux/sysctl.h>
  30
  31#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
  32#include <asm/syscall.h>
  33#endif
  34
  35#ifdef CONFIG_SECCOMP_FILTER
  36#include <linux/file.h>
  37#include <linux/filter.h>
  38#include <linux/pid.h>
  39#include <linux/ptrace.h>
  40#include <linux/security.h>
  41#include <linux/tracehook.h>
  42#include <linux/uaccess.h>
  43#include <linux/anon_inodes.h>
 
 
 
 
 
 
 
 
 
  44
  45enum notify_state {
  46	SECCOMP_NOTIFY_INIT,
  47	SECCOMP_NOTIFY_SENT,
  48	SECCOMP_NOTIFY_REPLIED,
  49};
  50
  51struct seccomp_knotif {
  52	/* The struct pid of the task whose filter triggered the notification */
  53	struct task_struct *task;
  54
  55	/* The "cookie" for this request; this is unique for this filter. */
  56	u64 id;
  57
  58	/*
  59	 * The seccomp data. This pointer is valid the entire time this
  60	 * notification is active, since it comes from __seccomp_filter which
  61	 * eclipses the entire lifecycle here.
  62	 */
  63	const struct seccomp_data *data;
  64
  65	/*
  66	 * Notification states. When SECCOMP_RET_USER_NOTIF is returned, a
  67	 * struct seccomp_knotif is created and starts out in INIT. Once the
  68	 * handler reads the notification off of an FD, it transitions to SENT.
  69	 * If a signal is received the state transitions back to INIT and
  70	 * another message is sent. When the userspace handler replies, state
  71	 * transitions to REPLIED.
  72	 */
  73	enum notify_state state;
  74
  75	/* The return values, only valid when in SECCOMP_NOTIFY_REPLIED */
  76	int error;
  77	long val;
 
  78
  79	/* Signals when this has entered SECCOMP_NOTIFY_REPLIED */
 
 
 
  80	struct completion ready;
  81
  82	struct list_head list;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
  83};
  84
  85/**
  86 * struct notification - container for seccomp userspace notifications. Since
  87 * most seccomp filters will not have notification listeners attached and this
  88 * structure is fairly large, we store the notification-specific stuff in a
  89 * separate structure.
  90 *
  91 * @request: A semaphore that users of this notification can wait on for
  92 *           changes. Actual reads and writes are still controlled with
  93 *           filter->notify_lock.
  94 * @next_id: The id of the next request.
  95 * @notifications: A list of struct seccomp_knotif elements.
  96 * @wqh: A wait queue for poll.
  97 */
  98struct notification {
  99	struct semaphore request;
 100	u64 next_id;
 101	struct list_head notifications;
 102	wait_queue_head_t wqh;
 103};
 104
 105/**
 106 * struct seccomp_filter - container for seccomp BPF programs
 107 *
 108 * @usage: reference count to manage the object lifetime.
 109 *         get/put helpers should be used when accessing an instance
 110 *         outside of a lifetime-guarded section.  In general, this
 111 *         is only needed for handling filters shared across tasks.
 
 
 
 
 
 
 
 
 
 112 * @log: true if all actions except for SECCOMP_RET_ALLOW should be logged
 113 * @prev: points to a previously installed, or inherited, filter
 114 * @prog: the BPF program to evaluate
 115 * @notif: the struct that holds all notification related information
 116 * @notify_lock: A lock for all notification-related accesses.
 
 117 *
 118 * seccomp_filter objects are organized in a tree linked via the @prev
 119 * pointer.  For any task, it appears to be a singly-linked list starting
 120 * with current->seccomp.filter, the most recently attached or inherited filter.
 121 * However, multiple filters may share a @prev node, by way of fork(), which
 122 * results in a unidirectional tree existing in memory.  This is similar to
 123 * how namespaces work.
 124 *
 125 * seccomp_filter objects should never be modified after being attached
 126 * to a task_struct (other than @usage).
 127 */
 128struct seccomp_filter {
 129	refcount_t usage;
 
 130	bool log;
 131	struct seccomp_filter *prev;
 132	struct bpf_prog *prog;
 133	struct notification *notif;
 134	struct mutex notify_lock;
 
 135};
 136
 137/* Limit any path through the tree to 256KB worth of instructions. */
 138#define MAX_INSNS_PER_PATH ((1 << 18) / sizeof(struct sock_filter))
 139
 140/*
 141 * Endianness is explicitly ignored and left for BPF program authors to manage
 142 * as per the specific architecture.
 143 */
 144static void populate_seccomp_data(struct seccomp_data *sd)
 145{
 146	struct task_struct *task = current;
 147	struct pt_regs *regs = task_pt_regs(task);
 148	unsigned long args[6];
 149
 150	sd->nr = syscall_get_nr(task, regs);
 151	sd->arch = syscall_get_arch(task);
 152	syscall_get_arguments(task, regs, args);
 153	sd->args[0] = args[0];
 154	sd->args[1] = args[1];
 155	sd->args[2] = args[2];
 156	sd->args[3] = args[3];
 157	sd->args[4] = args[4];
 158	sd->args[5] = args[5];
 159	sd->instruction_pointer = KSTK_EIP(task);
 160}
 161
 162/**
 163 *	seccomp_check_filter - verify seccomp filter code
 164 *	@filter: filter to verify
 165 *	@flen: length of filter
 166 *
 167 * Takes a previously checked filter (by bpf_check_classic) and
 168 * redirects all filter code that loads struct sk_buff data
 169 * and related data through seccomp_bpf_load.  It also
 170 * enforces length and alignment checking of those loads.
 171 *
 172 * Returns 0 if the rule set is legal or -EINVAL if not.
 173 */
 174static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen)
 175{
 176	int pc;
 177	for (pc = 0; pc < flen; pc++) {
 178		struct sock_filter *ftest = &filter[pc];
 179		u16 code = ftest->code;
 180		u32 k = ftest->k;
 181
 182		switch (code) {
 183		case BPF_LD | BPF_W | BPF_ABS:
 184			ftest->code = BPF_LDX | BPF_W | BPF_ABS;
 185			/* 32-bit aligned and not out of bounds. */
 186			if (k >= sizeof(struct seccomp_data) || k & 3)
 187				return -EINVAL;
 188			continue;
 189		case BPF_LD | BPF_W | BPF_LEN:
 190			ftest->code = BPF_LD | BPF_IMM;
 191			ftest->k = sizeof(struct seccomp_data);
 192			continue;
 193		case BPF_LDX | BPF_W | BPF_LEN:
 194			ftest->code = BPF_LDX | BPF_IMM;
 195			ftest->k = sizeof(struct seccomp_data);
 196			continue;
 197		/* Explicitly include allowed calls. */
 198		case BPF_RET | BPF_K:
 199		case BPF_RET | BPF_A:
 200		case BPF_ALU | BPF_ADD | BPF_K:
 201		case BPF_ALU | BPF_ADD | BPF_X:
 202		case BPF_ALU | BPF_SUB | BPF_K:
 203		case BPF_ALU | BPF_SUB | BPF_X:
 204		case BPF_ALU | BPF_MUL | BPF_K:
 205		case BPF_ALU | BPF_MUL | BPF_X:
 206		case BPF_ALU | BPF_DIV | BPF_K:
 207		case BPF_ALU | BPF_DIV | BPF_X:
 208		case BPF_ALU | BPF_AND | BPF_K:
 209		case BPF_ALU | BPF_AND | BPF_X:
 210		case BPF_ALU | BPF_OR | BPF_K:
 211		case BPF_ALU | BPF_OR | BPF_X:
 212		case BPF_ALU | BPF_XOR | BPF_K:
 213		case BPF_ALU | BPF_XOR | BPF_X:
 214		case BPF_ALU | BPF_LSH | BPF_K:
 215		case BPF_ALU | BPF_LSH | BPF_X:
 216		case BPF_ALU | BPF_RSH | BPF_K:
 217		case BPF_ALU | BPF_RSH | BPF_X:
 218		case BPF_ALU | BPF_NEG:
 219		case BPF_LD | BPF_IMM:
 220		case BPF_LDX | BPF_IMM:
 221		case BPF_MISC | BPF_TAX:
 222		case BPF_MISC | BPF_TXA:
 223		case BPF_LD | BPF_MEM:
 224		case BPF_LDX | BPF_MEM:
 225		case BPF_ST:
 226		case BPF_STX:
 227		case BPF_JMP | BPF_JA:
 228		case BPF_JMP | BPF_JEQ | BPF_K:
 229		case BPF_JMP | BPF_JEQ | BPF_X:
 230		case BPF_JMP | BPF_JGE | BPF_K:
 231		case BPF_JMP | BPF_JGE | BPF_X:
 232		case BPF_JMP | BPF_JGT | BPF_K:
 233		case BPF_JMP | BPF_JGT | BPF_X:
 234		case BPF_JMP | BPF_JSET | BPF_K:
 235		case BPF_JMP | BPF_JSET | BPF_X:
 236			continue;
 237		default:
 238			return -EINVAL;
 239		}
 240	}
 241	return 0;
 242}
 243
 244/**
 245 * seccomp_run_filters - evaluates all seccomp filters against @sd
 246 * @sd: optional seccomp data to be passed to filters
 247 * @match: stores struct seccomp_filter that resulted in the return value,
 248 *         unless filter returned SECCOMP_RET_ALLOW, in which case it will
 249 *         be unchanged.
 250 *
 251 * Returns valid seccomp BPF response codes.
 252 */
 253#define ACTION_ONLY(ret) ((s32)((ret) & (SECCOMP_RET_ACTION_FULL)))
 254static u32 seccomp_run_filters(const struct seccomp_data *sd,
 255			       struct seccomp_filter **match)
 256{
 257	u32 ret = SECCOMP_RET_ALLOW;
 258	/* Make sure cross-thread synced filter points somewhere sane. */
 259	struct seccomp_filter *f =
 260			READ_ONCE(current->seccomp.filter);
 261
 262	/* Ensure unexpected behavior doesn't result in failing open. */
 263	if (WARN_ON(f == NULL))
 264		return SECCOMP_RET_KILL_PROCESS;
 265
 266	/*
 267	 * All filters in the list are evaluated and the lowest BPF return
 268	 * value always takes priority (ignoring the DATA).
 269	 */
 270	preempt_disable();
 271	for (; f; f = f->prev) {
 272		u32 cur_ret = BPF_PROG_RUN(f->prog, sd);
 273
 274		if (ACTION_ONLY(cur_ret) < ACTION_ONLY(ret)) {
 275			ret = cur_ret;
 276			*match = f;
 277		}
 278	}
 279	preempt_enable();
 280	return ret;
 281}
 282#endif /* CONFIG_SECCOMP_FILTER */
 283
 284static inline bool seccomp_may_assign_mode(unsigned long seccomp_mode)
 285{
 286	assert_spin_locked(&current->sighand->siglock);
 287
 288	if (current->seccomp.mode && current->seccomp.mode != seccomp_mode)
 289		return false;
 290
 291	return true;
 292}
 293
 294void __weak arch_seccomp_spec_mitigate(struct task_struct *task) { }
 295
 296static inline void seccomp_assign_mode(struct task_struct *task,
 297				       unsigned long seccomp_mode,
 298				       unsigned long flags)
 299{
 300	assert_spin_locked(&task->sighand->siglock);
 301
 302	task->seccomp.mode = seccomp_mode;
 303	/*
 304	 * Make sure TIF_SECCOMP cannot be set before the mode (and
 305	 * filter) is set.
 306	 */
 307	smp_mb__before_atomic();
 308	/* Assume default seccomp processes want spec flaw mitigation. */
 309	if ((flags & SECCOMP_FILTER_FLAG_SPEC_ALLOW) == 0)
 310		arch_seccomp_spec_mitigate(task);
 311	set_tsk_thread_flag(task, TIF_SECCOMP);
 312}
 313
 314#ifdef CONFIG_SECCOMP_FILTER
 315/* Returns 1 if the parent is an ancestor of the child. */
 316static int is_ancestor(struct seccomp_filter *parent,
 317		       struct seccomp_filter *child)
 318{
 319	/* NULL is the root ancestor. */
 320	if (parent == NULL)
 321		return 1;
 322	for (; child; child = child->prev)
 323		if (child == parent)
 324			return 1;
 325	return 0;
 326}
 327
 328/**
 329 * seccomp_can_sync_threads: checks if all threads can be synchronized
 330 *
 331 * Expects sighand and cred_guard_mutex locks to be held.
 332 *
 333 * Returns 0 on success, -ve on error, or the pid of a thread which was
 334 * either not in the correct seccomp mode or did not have an ancestral
 335 * seccomp filter.
 336 */
 337static inline pid_t seccomp_can_sync_threads(void)
 338{
 339	struct task_struct *thread, *caller;
 340
 341	BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
 342	assert_spin_locked(&current->sighand->siglock);
 343
 344	/* Validate all threads being eligible for synchronization. */
 345	caller = current;
 346	for_each_thread(caller, thread) {
 347		pid_t failed;
 348
 349		/* Skip current, since it is initiating the sync. */
 350		if (thread == caller)
 351			continue;
 352
 353		if (thread->seccomp.mode == SECCOMP_MODE_DISABLED ||
 354		    (thread->seccomp.mode == SECCOMP_MODE_FILTER &&
 355		     is_ancestor(thread->seccomp.filter,
 356				 caller->seccomp.filter)))
 357			continue;
 358
 359		/* Return the first thread that cannot be synchronized. */
 360		failed = task_pid_vnr(thread);
 361		/* If the pid cannot be resolved, then return -ESRCH */
 362		if (WARN_ON(failed == 0))
 363			failed = -ESRCH;
 364		return failed;
 365	}
 366
 367	return 0;
 368}
 369
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 370/**
 371 * seccomp_sync_threads: sets all threads to use current's filter
 372 *
 373 * Expects sighand and cred_guard_mutex locks to be held, and for
 374 * seccomp_can_sync_threads() to have returned success already
 375 * without dropping the locks.
 376 *
 377 */
 378static inline void seccomp_sync_threads(unsigned long flags)
 379{
 380	struct task_struct *thread, *caller;
 381
 382	BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
 383	assert_spin_locked(&current->sighand->siglock);
 384
 385	/* Synchronize all threads. */
 386	caller = current;
 387	for_each_thread(caller, thread) {
 388		/* Skip current, since it needs no changes. */
 389		if (thread == caller)
 390			continue;
 391
 392		/* Get a task reference for the new leaf node. */
 393		get_seccomp_filter(caller);
 
 394		/*
 395		 * Drop the task reference to the shared ancestor since
 396		 * current's path will hold a reference.  (This also
 397		 * allows a put before the assignment.)
 398		 */
 399		put_seccomp_filter(thread);
 
 
 400		smp_store_release(&thread->seccomp.filter,
 401				  caller->seccomp.filter);
 
 
 402
 403		/*
 404		 * Don't let an unprivileged task work around
 405		 * the no_new_privs restriction by creating
 406		 * a thread that sets it up, enters seccomp,
 407		 * then dies.
 408		 */
 409		if (task_no_new_privs(caller))
 410			task_set_no_new_privs(thread);
 411
 412		/*
 413		 * Opt the other thread into seccomp if needed.
 414		 * As threads are considered to be trust-realm
 415		 * equivalent (see ptrace_may_access), it is safe to
 416		 * allow one thread to transition the other.
 417		 */
 418		if (thread->seccomp.mode == SECCOMP_MODE_DISABLED)
 419			seccomp_assign_mode(thread, SECCOMP_MODE_FILTER,
 420					    flags);
 421	}
 422}
 423
 424/**
 425 * seccomp_prepare_filter: Prepares a seccomp filter for use.
 426 * @fprog: BPF program to install
 427 *
 428 * Returns filter on success or an ERR_PTR on failure.
 429 */
 430static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog)
 431{
 432	struct seccomp_filter *sfilter;
 433	int ret;
 434	const bool save_orig = IS_ENABLED(CONFIG_CHECKPOINT_RESTORE);
 435
 436	if (fprog->len == 0 || fprog->len > BPF_MAXINSNS)
 437		return ERR_PTR(-EINVAL);
 438
 439	BUG_ON(INT_MAX / fprog->len < sizeof(struct sock_filter));
 440
 441	/*
 442	 * Installing a seccomp filter requires that the task has
 443	 * CAP_SYS_ADMIN in its namespace or be running with no_new_privs.
 444	 * This avoids scenarios where unprivileged tasks can affect the
 445	 * behavior of privileged children.
 446	 */
 447	if (!task_no_new_privs(current) &&
 448	    security_capable(current_cred(), current_user_ns(),
 449				     CAP_SYS_ADMIN, CAP_OPT_NOAUDIT) != 0)
 450		return ERR_PTR(-EACCES);
 451
 452	/* Allocate a new seccomp_filter */
 453	sfilter = kzalloc(sizeof(*sfilter), GFP_KERNEL | __GFP_NOWARN);
 454	if (!sfilter)
 455		return ERR_PTR(-ENOMEM);
 456
 457	mutex_init(&sfilter->notify_lock);
 458	ret = bpf_prog_create_from_user(&sfilter->prog, fprog,
 459					seccomp_check_filter, save_orig);
 460	if (ret < 0) {
 461		kfree(sfilter);
 462		return ERR_PTR(ret);
 463	}
 464
 465	refcount_set(&sfilter->usage, 1);
 
 
 466
 467	return sfilter;
 468}
 469
 470/**
 471 * seccomp_prepare_user_filter - prepares a user-supplied sock_fprog
 472 * @user_filter: pointer to the user data containing a sock_fprog.
 473 *
 474 * Returns 0 on success and non-zero otherwise.
 475 */
 476static struct seccomp_filter *
 477seccomp_prepare_user_filter(const char __user *user_filter)
 478{
 479	struct sock_fprog fprog;
 480	struct seccomp_filter *filter = ERR_PTR(-EFAULT);
 481
 482#ifdef CONFIG_COMPAT
 483	if (in_compat_syscall()) {
 484		struct compat_sock_fprog fprog32;
 485		if (copy_from_user(&fprog32, user_filter, sizeof(fprog32)))
 486			goto out;
 487		fprog.len = fprog32.len;
 488		fprog.filter = compat_ptr(fprog32.filter);
 489	} else /* falls through to the if below. */
 490#endif
 491	if (copy_from_user(&fprog, user_filter, sizeof(fprog)))
 492		goto out;
 493	filter = seccomp_prepare_filter(&fprog);
 494out:
 495	return filter;
 496}
 497
 498/**
 499 * seccomp_attach_filter: validate and attach filter
 500 * @flags:  flags to change filter behavior
 501 * @filter: seccomp filter to add to the current process
 502 *
 503 * Caller must be holding current->sighand->siglock lock.
 504 *
 505 * Returns 0 on success, -ve on error, or
 506 *   - in TSYNC mode: the pid of a thread which was either not in the correct
 507 *     seccomp mode or did not have an ancestral seccomp filter
 508 *   - in NEW_LISTENER mode: the fd of the new listener
 509 */
 510static long seccomp_attach_filter(unsigned int flags,
 511				  struct seccomp_filter *filter)
 512{
 513	unsigned long total_insns;
 514	struct seccomp_filter *walker;
 515
 516	assert_spin_locked(&current->sighand->siglock);
 517
 518	/* Validate resulting filter length. */
 519	total_insns = filter->prog->len;
 520	for (walker = current->seccomp.filter; walker; walker = walker->prev)
 521		total_insns += walker->prog->len + 4;  /* 4 instr penalty */
 522	if (total_insns > MAX_INSNS_PER_PATH)
 523		return -ENOMEM;
 524
 525	/* If thread sync has been requested, check that it is possible. */
 526	if (flags & SECCOMP_FILTER_FLAG_TSYNC) {
 527		int ret;
 528
 529		ret = seccomp_can_sync_threads();
 530		if (ret)
 531			return ret;
 
 
 
 
 532	}
 533
 534	/* Set log flag, if present. */
 535	if (flags & SECCOMP_FILTER_FLAG_LOG)
 536		filter->log = true;
 537
 538	/*
 539	 * If there is an existing filter, make it the prev and don't drop its
 540	 * task reference.
 541	 */
 542	filter->prev = current->seccomp.filter;
 543	current->seccomp.filter = filter;
 
 544
 545	/* Now that the new filter is in place, synchronize to all threads. */
 546	if (flags & SECCOMP_FILTER_FLAG_TSYNC)
 547		seccomp_sync_threads(flags);
 548
 549	return 0;
 550}
 551
 552static void __get_seccomp_filter(struct seccomp_filter *filter)
 553{
 554	refcount_inc(&filter->usage);
 555}
 556
 557/* get_seccomp_filter - increments the reference count of the filter on @tsk */
 558void get_seccomp_filter(struct task_struct *tsk)
 559{
 560	struct seccomp_filter *orig = tsk->seccomp.filter;
 561	if (!orig)
 562		return;
 563	__get_seccomp_filter(orig);
 564}
 565
 566static inline void seccomp_filter_free(struct seccomp_filter *filter)
 567{
 568	if (filter) {
 569		bpf_prog_destroy(filter->prog);
 570		kfree(filter);
 571	}
 572}
 573
 574static void __put_seccomp_filter(struct seccomp_filter *orig)
 575{
 576	/* Clean up single-reference branches iteratively. */
 577	while (orig && refcount_dec_and_test(&orig->usage)) {
 578		struct seccomp_filter *freeme = orig;
 579		orig = orig->prev;
 580		seccomp_filter_free(freeme);
 581	}
 582}
 583
 584/* put_seccomp_filter - decrements the ref count of tsk->seccomp.filter */
 585void put_seccomp_filter(struct task_struct *tsk)
 586{
 587	__put_seccomp_filter(tsk->seccomp.filter);
 588}
 589
 590static void seccomp_init_siginfo(kernel_siginfo_t *info, int syscall, int reason)
 591{
 592	clear_siginfo(info);
 593	info->si_signo = SIGSYS;
 594	info->si_code = SYS_SECCOMP;
 595	info->si_call_addr = (void __user *)KSTK_EIP(current);
 596	info->si_errno = reason;
 597	info->si_arch = syscall_get_arch(current);
 598	info->si_syscall = syscall;
 599}
 600
 601/**
 602 * seccomp_send_sigsys - signals the task to allow in-process syscall emulation
 603 * @syscall: syscall number to send to userland
 604 * @reason: filter-supplied reason code to send to userland (via si_errno)
 605 *
 606 * Forces a SIGSYS with a code of SYS_SECCOMP and related sigsys info.
 607 */
 608static void seccomp_send_sigsys(int syscall, int reason)
 609{
 610	struct kernel_siginfo info;
 611	seccomp_init_siginfo(&info, syscall, reason);
 612	force_sig_info(&info);
 613}
 614#endif	/* CONFIG_SECCOMP_FILTER */
 615
 616/* For use with seccomp_actions_logged */
 617#define SECCOMP_LOG_KILL_PROCESS	(1 << 0)
 618#define SECCOMP_LOG_KILL_THREAD		(1 << 1)
 619#define SECCOMP_LOG_TRAP		(1 << 2)
 620#define SECCOMP_LOG_ERRNO		(1 << 3)
 621#define SECCOMP_LOG_TRACE		(1 << 4)
 622#define SECCOMP_LOG_LOG			(1 << 5)
 623#define SECCOMP_LOG_ALLOW		(1 << 6)
 624#define SECCOMP_LOG_USER_NOTIF		(1 << 7)
 625
 626static u32 seccomp_actions_logged = SECCOMP_LOG_KILL_PROCESS |
 627				    SECCOMP_LOG_KILL_THREAD  |
 628				    SECCOMP_LOG_TRAP  |
 629				    SECCOMP_LOG_ERRNO |
 630				    SECCOMP_LOG_USER_NOTIF |
 631				    SECCOMP_LOG_TRACE |
 632				    SECCOMP_LOG_LOG;
 633
 634static inline void seccomp_log(unsigned long syscall, long signr, u32 action,
 635			       bool requested)
 636{
 637	bool log = false;
 638
 639	switch (action) {
 640	case SECCOMP_RET_ALLOW:
 641		break;
 642	case SECCOMP_RET_TRAP:
 643		log = requested && seccomp_actions_logged & SECCOMP_LOG_TRAP;
 644		break;
 645	case SECCOMP_RET_ERRNO:
 646		log = requested && seccomp_actions_logged & SECCOMP_LOG_ERRNO;
 647		break;
 648	case SECCOMP_RET_TRACE:
 649		log = requested && seccomp_actions_logged & SECCOMP_LOG_TRACE;
 650		break;
 651	case SECCOMP_RET_USER_NOTIF:
 652		log = requested && seccomp_actions_logged & SECCOMP_LOG_USER_NOTIF;
 653		break;
 654	case SECCOMP_RET_LOG:
 655		log = seccomp_actions_logged & SECCOMP_LOG_LOG;
 656		break;
 657	case SECCOMP_RET_KILL_THREAD:
 658		log = seccomp_actions_logged & SECCOMP_LOG_KILL_THREAD;
 659		break;
 660	case SECCOMP_RET_KILL_PROCESS:
 661	default:
 662		log = seccomp_actions_logged & SECCOMP_LOG_KILL_PROCESS;
 663	}
 664
 665	/*
 666	 * Emit an audit message when the action is RET_KILL_*, RET_LOG, or the
 667	 * FILTER_FLAG_LOG bit was set. The admin has the ability to silence
 668	 * any action from being logged by removing the action name from the
 669	 * seccomp_actions_logged sysctl.
 670	 */
 671	if (!log)
 672		return;
 673
 674	audit_seccomp(syscall, signr, action);
 675}
 676
 677/*
 678 * Secure computing mode 1 allows only read/write/exit/sigreturn.
 679 * To be fully secure this must be combined with rlimit
 680 * to limit the stack allocations too.
 681 */
 682static const int mode1_syscalls[] = {
 683	__NR_seccomp_read, __NR_seccomp_write, __NR_seccomp_exit, __NR_seccomp_sigreturn,
 684	0, /* null terminated */
 685};
 686
 687static void __secure_computing_strict(int this_syscall)
 688{
 689	const int *syscall_whitelist = mode1_syscalls;
 690#ifdef CONFIG_COMPAT
 691	if (in_compat_syscall())
 692		syscall_whitelist = get_compat_mode1_syscalls();
 693#endif
 694	do {
 695		if (*syscall_whitelist == this_syscall)
 696			return;
 697	} while (*++syscall_whitelist);
 698
 699#ifdef SECCOMP_DEBUG
 700	dump_stack();
 701#endif
 702	seccomp_log(this_syscall, SIGKILL, SECCOMP_RET_KILL_THREAD, true);
 703	do_exit(SIGKILL);
 704}
 705
 706#ifndef CONFIG_HAVE_ARCH_SECCOMP_FILTER
 707void secure_computing_strict(int this_syscall)
 708{
 709	int mode = current->seccomp.mode;
 710
 711	if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) &&
 712	    unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
 713		return;
 714
 715	if (mode == SECCOMP_MODE_DISABLED)
 716		return;
 717	else if (mode == SECCOMP_MODE_STRICT)
 718		__secure_computing_strict(this_syscall);
 719	else
 720		BUG();
 721}
 722#else
 723
 724#ifdef CONFIG_SECCOMP_FILTER
 725static u64 seccomp_next_notify_id(struct seccomp_filter *filter)
 726{
 727	/*
 728	 * Note: overflow is ok here, the id just needs to be unique per
 729	 * filter.
 730	 */
 731	lockdep_assert_held(&filter->notify_lock);
 732	return filter->notif->next_id++;
 733}
 734
 735static void seccomp_do_user_notification(int this_syscall,
 736					 struct seccomp_filter *match,
 737					 const struct seccomp_data *sd)
 
 
 
 
 
 
 
 
 
 
 
 738{
 739	int err;
 
 740	long ret = 0;
 741	struct seccomp_knotif n = {};
 
 742
 743	mutex_lock(&match->notify_lock);
 744	err = -ENOSYS;
 745	if (!match->notif)
 746		goto out;
 747
 748	n.task = current;
 749	n.state = SECCOMP_NOTIFY_INIT;
 750	n.data = sd;
 751	n.id = seccomp_next_notify_id(match);
 752	init_completion(&n.ready);
 753	list_add(&n.list, &match->notif->notifications);
 
 754
 755	up(&match->notif->request);
 756	wake_up_poll(&match->notif->wqh, EPOLLIN | EPOLLRDNORM);
 757	mutex_unlock(&match->notify_lock);
 758
 759	/*
 760	 * This is where we wait for a reply from userspace.
 761	 */
 
 762	err = wait_for_completion_interruptible(&n.ready);
 763	mutex_lock(&match->notify_lock);
 764	if (err == 0) {
 
 
 
 
 
 
 
 
 765		ret = n.val;
 766		err = n.error;
 
 
 
 
 
 
 
 
 
 767	}
 768
 769	/*
 770	 * Note that it's possible the listener died in between the time when
 771	 * we were notified of a respons (or a signal) and when we were able to
 772	 * re-acquire the lock, so only delete from the list if the
 773	 * notification actually exists.
 774	 *
 775	 * Also note that this test is only valid because there's no way to
 776	 * *reattach* to a notifier right now. If one is added, we'll need to
 777	 * keep track of the notif itself and make sure they match here.
 778	 */
 779	if (match->notif)
 780		list_del(&n.list);
 781out:
 782	mutex_unlock(&match->notify_lock);
 
 
 
 
 
 783	syscall_set_return_value(current, task_pt_regs(current),
 784				 err, ret);
 
 785}
 786
 787static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
 788			    const bool recheck_after_trace)
 789{
 790	u32 filter_ret, action;
 791	struct seccomp_filter *match = NULL;
 792	int data;
 793	struct seccomp_data sd_local;
 794
 795	/*
 796	 * Make sure that any changes to mode from another thread have
 797	 * been seen after TIF_SECCOMP was seen.
 798	 */
 799	rmb();
 800
 801	if (!sd) {
 802		populate_seccomp_data(&sd_local);
 803		sd = &sd_local;
 804	}
 805
 806	filter_ret = seccomp_run_filters(sd, &match);
 807	data = filter_ret & SECCOMP_RET_DATA;
 808	action = filter_ret & SECCOMP_RET_ACTION_FULL;
 809
 810	switch (action) {
 811	case SECCOMP_RET_ERRNO:
 812		/* Set low-order bits as an errno, capped at MAX_ERRNO. */
 813		if (data > MAX_ERRNO)
 814			data = MAX_ERRNO;
 815		syscall_set_return_value(current, task_pt_regs(current),
 816					 -data, 0);
 817		goto skip;
 818
 819	case SECCOMP_RET_TRAP:
 820		/* Show the handler the original registers. */
 821		syscall_rollback(current, task_pt_regs(current));
 822		/* Let the filter pass back 16 bits of data. */
 823		seccomp_send_sigsys(this_syscall, data);
 824		goto skip;
 825
 826	case SECCOMP_RET_TRACE:
 827		/* We've been put in this state by the ptracer already. */
 828		if (recheck_after_trace)
 829			return 0;
 830
 831		/* ENOSYS these calls if there is no tracer attached. */
 832		if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP)) {
 833			syscall_set_return_value(current,
 834						 task_pt_regs(current),
 835						 -ENOSYS, 0);
 836			goto skip;
 837		}
 838
 839		/* Allow the BPF to provide the event message */
 840		ptrace_event(PTRACE_EVENT_SECCOMP, data);
 841		/*
 842		 * The delivery of a fatal signal during event
 843		 * notification may silently skip tracer notification,
 844		 * which could leave us with a potentially unmodified
 845		 * syscall that the tracer would have liked to have
 846		 * changed. Since the process is about to die, we just
 847		 * force the syscall to be skipped and let the signal
 848		 * kill the process and correctly handle any tracer exit
 849		 * notifications.
 850		 */
 851		if (fatal_signal_pending(current))
 852			goto skip;
 853		/* Check if the tracer forced the syscall to be skipped. */
 854		this_syscall = syscall_get_nr(current, task_pt_regs(current));
 855		if (this_syscall < 0)
 856			goto skip;
 857
 858		/*
 859		 * Recheck the syscall, since it may have changed. This
 860		 * intentionally uses a NULL struct seccomp_data to force
 861		 * a reload of all registers. This does not goto skip since
 862		 * a skip would have already been reported.
 863		 */
 864		if (__seccomp_filter(this_syscall, NULL, true))
 865			return -1;
 866
 867		return 0;
 868
 869	case SECCOMP_RET_USER_NOTIF:
 870		seccomp_do_user_notification(this_syscall, match, sd);
 871		goto skip;
 
 
 872
 873	case SECCOMP_RET_LOG:
 874		seccomp_log(this_syscall, 0, action, true);
 875		return 0;
 876
 877	case SECCOMP_RET_ALLOW:
 878		/*
 879		 * Note that the "match" filter will always be NULL for
 880		 * this action since SECCOMP_RET_ALLOW is the starting
 881		 * state in seccomp_run_filters().
 882		 */
 883		return 0;
 884
 885	case SECCOMP_RET_KILL_THREAD:
 886	case SECCOMP_RET_KILL_PROCESS:
 887	default:
 888		seccomp_log(this_syscall, SIGSYS, action, true);
 889		/* Dump core only if this is the last remaining thread. */
 890		if (action == SECCOMP_RET_KILL_PROCESS ||
 891		    get_nr_threads(current) == 1) {
 892			kernel_siginfo_t info;
 893
 894			/* Show the original registers in the dump. */
 895			syscall_rollback(current, task_pt_regs(current));
 896			/* Trigger a manual coredump since do_exit skips it. */
 897			seccomp_init_siginfo(&info, this_syscall, data);
 898			do_coredump(&info);
 899		}
 900		if (action == SECCOMP_RET_KILL_PROCESS)
 901			do_group_exit(SIGSYS);
 902		else
 903			do_exit(SIGSYS);
 904	}
 905
 906	unreachable();
 907
 908skip:
 909	seccomp_log(this_syscall, 0, action, match ? match->log : false);
 910	return -1;
 911}
 912#else
 913static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
 914			    const bool recheck_after_trace)
 915{
 916	BUG();
 917}
 918#endif
 919
 920int __secure_computing(const struct seccomp_data *sd)
 921{
 922	int mode = current->seccomp.mode;
 923	int this_syscall;
 924
 925	if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) &&
 926	    unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
 927		return 0;
 928
 929	this_syscall = sd ? sd->nr :
 930		syscall_get_nr(current, task_pt_regs(current));
 931
 932	switch (mode) {
 933	case SECCOMP_MODE_STRICT:
 934		__secure_computing_strict(this_syscall);  /* may call do_exit */
 935		return 0;
 936	case SECCOMP_MODE_FILTER:
 937		return __seccomp_filter(this_syscall, sd, false);
 938	default:
 939		BUG();
 940	}
 941}
 942#endif /* CONFIG_HAVE_ARCH_SECCOMP_FILTER */
 943
 944long prctl_get_seccomp(void)
 945{
 946	return current->seccomp.mode;
 947}
 948
 949/**
 950 * seccomp_set_mode_strict: internal function for setting strict seccomp
 951 *
 952 * Once current->seccomp.mode is non-zero, it may not be changed.
 953 *
 954 * Returns 0 on success or -EINVAL on failure.
 955 */
 956static long seccomp_set_mode_strict(void)
 957{
 958	const unsigned long seccomp_mode = SECCOMP_MODE_STRICT;
 959	long ret = -EINVAL;
 960
 961	spin_lock_irq(&current->sighand->siglock);
 962
 963	if (!seccomp_may_assign_mode(seccomp_mode))
 964		goto out;
 965
 966#ifdef TIF_NOTSC
 967	disable_TSC();
 968#endif
 969	seccomp_assign_mode(current, seccomp_mode, 0);
 970	ret = 0;
 971
 972out:
 973	spin_unlock_irq(&current->sighand->siglock);
 974
 975	return ret;
 976}
 977
 978#ifdef CONFIG_SECCOMP_FILTER
 979static int seccomp_notify_release(struct inode *inode, struct file *file)
 
 
 
 
 
 
 980{
 981	struct seccomp_filter *filter = file->private_data;
 982	struct seccomp_knotif *knotif;
 983
 984	if (!filter)
 985		return 0;
 986
 987	mutex_lock(&filter->notify_lock);
 988
 989	/*
 990	 * If this file is being closed because e.g. the task who owned it
 991	 * died, let's wake everyone up who was waiting on us.
 992	 */
 993	list_for_each_entry(knotif, &filter->notif->notifications, list) {
 994		if (knotif->state == SECCOMP_NOTIFY_REPLIED)
 995			continue;
 996
 997		knotif->state = SECCOMP_NOTIFY_REPLIED;
 998		knotif->error = -ENOSYS;
 999		knotif->val = 0;
1000
 
 
 
 
 
1001		complete(&knotif->ready);
1002	}
1003
1004	kfree(filter->notif);
1005	filter->notif = NULL;
1006	mutex_unlock(&filter->notify_lock);
 
 
 
 
 
 
 
1007	__put_seccomp_filter(filter);
1008	return 0;
1009}
1010
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1011static long seccomp_notify_recv(struct seccomp_filter *filter,
1012				void __user *buf)
1013{
1014	struct seccomp_knotif *knotif = NULL, *cur;
1015	struct seccomp_notif unotif;
1016	ssize_t ret;
1017
 
 
 
 
 
 
 
1018	memset(&unotif, 0, sizeof(unotif));
1019
1020	ret = down_interruptible(&filter->notif->request);
1021	if (ret < 0)
1022		return ret;
1023
1024	mutex_lock(&filter->notify_lock);
1025	list_for_each_entry(cur, &filter->notif->notifications, list) {
1026		if (cur->state == SECCOMP_NOTIFY_INIT) {
1027			knotif = cur;
1028			break;
1029		}
1030	}
1031
1032	/*
1033	 * If we didn't find a notification, it could be that the task was
1034	 * interrupted by a fatal signal between the time we were woken and
1035	 * when we were able to acquire the rw lock.
1036	 */
1037	if (!knotif) {
1038		ret = -ENOENT;
1039		goto out;
1040	}
1041
1042	unotif.id = knotif->id;
1043	unotif.pid = task_pid_vnr(knotif->task);
1044	unotif.data = *(knotif->data);
1045
1046	knotif->state = SECCOMP_NOTIFY_SENT;
1047	wake_up_poll(&filter->notif->wqh, EPOLLOUT | EPOLLWRNORM);
1048	ret = 0;
1049out:
1050	mutex_unlock(&filter->notify_lock);
1051
1052	if (ret == 0 && copy_to_user(buf, &unotif, sizeof(unotif))) {
1053		ret = -EFAULT;
1054
1055		/*
1056		 * Userspace screwed up. To make sure that we keep this
1057		 * notification alive, let's reset it back to INIT. It
1058		 * may have died when we released the lock, so we need to make
1059		 * sure it's still around.
1060		 */
1061		knotif = NULL;
1062		mutex_lock(&filter->notify_lock);
1063		list_for_each_entry(cur, &filter->notif->notifications, list) {
1064			if (cur->id == unotif.id) {
1065				knotif = cur;
1066				break;
1067			}
1068		}
1069
1070		if (knotif) {
1071			knotif->state = SECCOMP_NOTIFY_INIT;
1072			up(&filter->notif->request);
1073		}
1074		mutex_unlock(&filter->notify_lock);
1075	}
1076
1077	return ret;
1078}
1079
1080static long seccomp_notify_send(struct seccomp_filter *filter,
1081				void __user *buf)
1082{
1083	struct seccomp_notif_resp resp = {};
1084	struct seccomp_knotif *knotif = NULL, *cur;
1085	long ret;
1086
1087	if (copy_from_user(&resp, buf, sizeof(resp)))
1088		return -EFAULT;
1089
1090	if (resp.flags)
 
 
 
 
1091		return -EINVAL;
1092
1093	ret = mutex_lock_interruptible(&filter->notify_lock);
1094	if (ret < 0)
1095		return ret;
1096
1097	list_for_each_entry(cur, &filter->notif->notifications, list) {
1098		if (cur->id == resp.id) {
1099			knotif = cur;
1100			break;
1101		}
1102	}
1103
1104	if (!knotif) {
1105		ret = -ENOENT;
1106		goto out;
1107	}
1108
1109	/* Allow exactly one reply. */
1110	if (knotif->state != SECCOMP_NOTIFY_SENT) {
1111		ret = -EINPROGRESS;
1112		goto out;
1113	}
1114
1115	ret = 0;
1116	knotif->state = SECCOMP_NOTIFY_REPLIED;
1117	knotif->error = resp.error;
1118	knotif->val = resp.val;
 
1119	complete(&knotif->ready);
1120out:
1121	mutex_unlock(&filter->notify_lock);
1122	return ret;
1123}
1124
1125static long seccomp_notify_id_valid(struct seccomp_filter *filter,
1126				    void __user *buf)
1127{
1128	struct seccomp_knotif *knotif = NULL;
1129	u64 id;
1130	long ret;
1131
1132	if (copy_from_user(&id, buf, sizeof(id)))
1133		return -EFAULT;
1134
1135	ret = mutex_lock_interruptible(&filter->notify_lock);
1136	if (ret < 0)
1137		return ret;
1138
1139	ret = -ENOENT;
1140	list_for_each_entry(knotif, &filter->notif->notifications, list) {
1141		if (knotif->id == id) {
1142			if (knotif->state == SECCOMP_NOTIFY_SENT)
1143				ret = 0;
1144			goto out;
1145		}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1146	}
1147
1148out:
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1149	mutex_unlock(&filter->notify_lock);
 
 
 
1150	return ret;
1151}
1152
1153static long seccomp_notify_ioctl(struct file *file, unsigned int cmd,
1154				 unsigned long arg)
1155{
1156	struct seccomp_filter *filter = file->private_data;
1157	void __user *buf = (void __user *)arg;
1158
 
1159	switch (cmd) {
1160	case SECCOMP_IOCTL_NOTIF_RECV:
1161		return seccomp_notify_recv(filter, buf);
1162	case SECCOMP_IOCTL_NOTIF_SEND:
1163		return seccomp_notify_send(filter, buf);
 
1164	case SECCOMP_IOCTL_NOTIF_ID_VALID:
1165		return seccomp_notify_id_valid(filter, buf);
 
 
 
 
 
 
 
1166	default:
1167		return -EINVAL;
1168	}
1169}
1170
1171static __poll_t seccomp_notify_poll(struct file *file,
1172				    struct poll_table_struct *poll_tab)
1173{
1174	struct seccomp_filter *filter = file->private_data;
1175	__poll_t ret = 0;
1176	struct seccomp_knotif *cur;
1177
1178	poll_wait(file, &filter->notif->wqh, poll_tab);
1179
1180	if (mutex_lock_interruptible(&filter->notify_lock) < 0)
1181		return EPOLLERR;
1182
1183	list_for_each_entry(cur, &filter->notif->notifications, list) {
1184		if (cur->state == SECCOMP_NOTIFY_INIT)
1185			ret |= EPOLLIN | EPOLLRDNORM;
1186		if (cur->state == SECCOMP_NOTIFY_SENT)
1187			ret |= EPOLLOUT | EPOLLWRNORM;
1188		if ((ret & EPOLLIN) && (ret & EPOLLOUT))
1189			break;
1190	}
1191
1192	mutex_unlock(&filter->notify_lock);
1193
 
 
 
1194	return ret;
1195}
1196
1197static const struct file_operations seccomp_notify_ops = {
1198	.poll = seccomp_notify_poll,
1199	.release = seccomp_notify_release,
1200	.unlocked_ioctl = seccomp_notify_ioctl,
 
1201};
1202
1203static struct file *init_listener(struct seccomp_filter *filter)
1204{
1205	struct file *ret = ERR_PTR(-EBUSY);
1206	struct seccomp_filter *cur;
1207
1208	for (cur = current->seccomp.filter; cur; cur = cur->prev) {
1209		if (cur->notif)
1210			goto out;
1211	}
1212
1213	ret = ERR_PTR(-ENOMEM);
1214	filter->notif = kzalloc(sizeof(*(filter->notif)), GFP_KERNEL);
1215	if (!filter->notif)
1216		goto out;
1217
1218	sema_init(&filter->notif->request, 0);
1219	filter->notif->next_id = get_random_u64();
1220	INIT_LIST_HEAD(&filter->notif->notifications);
1221	init_waitqueue_head(&filter->notif->wqh);
1222
1223	ret = anon_inode_getfile("seccomp notify", &seccomp_notify_ops,
1224				 filter, O_RDWR);
1225	if (IS_ERR(ret))
1226		goto out_notif;
1227
1228	/* The file has a reference to it now */
1229	__get_seccomp_filter(filter);
1230
1231out_notif:
1232	if (IS_ERR(ret))
1233		kfree(filter->notif);
1234out:
1235	return ret;
1236}
1237
1238/**
1239 * seccomp_set_mode_filter: internal function for setting seccomp filter
1240 * @flags:  flags to change filter behavior
1241 * @filter: struct sock_fprog containing filter
1242 *
1243 * This function may be called repeatedly to install additional filters.
1244 * Every filter successfully installed will be evaluated (in reverse order)
1245 * for each system call the task makes.
1246 *
1247 * Once current->seccomp.mode is non-zero, it may not be changed.
1248 *
1249 * Returns 0 on success or -EINVAL on failure.
1250 */
1251static long seccomp_set_mode_filter(unsigned int flags,
1252				    const char __user *filter)
1253{
1254	const unsigned long seccomp_mode = SECCOMP_MODE_FILTER;
1255	struct seccomp_filter *prepared = NULL;
1256	long ret = -EINVAL;
1257	int listener = -1;
1258	struct file *listener_f = NULL;
1259
1260	/* Validate flags. */
1261	if (flags & ~SECCOMP_FILTER_FLAG_MASK)
1262		return -EINVAL;
1263
1264	/*
1265	 * In the successful case, NEW_LISTENER returns the new listener fd.
1266	 * But in the failure case, TSYNC returns the thread that died. If you
1267	 * combine these two flags, there's no way to tell whether something
1268	 * succeeded or failed. So, let's disallow this combination.
 
1269	 */
1270	if ((flags & SECCOMP_FILTER_FLAG_TSYNC) &&
1271	    (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER))
 
1272		return -EINVAL;
1273
1274	/* Prepare the new filter before holding any locks. */
1275	prepared = seccomp_prepare_user_filter(filter);
1276	if (IS_ERR(prepared))
1277		return PTR_ERR(prepared);
1278
1279	if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) {
1280		listener = get_unused_fd_flags(O_CLOEXEC);
1281		if (listener < 0) {
1282			ret = listener;
1283			goto out_free;
1284		}
1285
1286		listener_f = init_listener(prepared);
1287		if (IS_ERR(listener_f)) {
1288			put_unused_fd(listener);
1289			ret = PTR_ERR(listener_f);
1290			goto out_free;
1291		}
1292	}
1293
1294	/*
1295	 * Make sure we cannot change seccomp or nnp state via TSYNC
1296	 * while another thread is in the middle of calling exec.
1297	 */
1298	if (flags & SECCOMP_FILTER_FLAG_TSYNC &&
1299	    mutex_lock_killable(&current->signal->cred_guard_mutex))
1300		goto out_put_fd;
1301
1302	spin_lock_irq(&current->sighand->siglock);
1303
1304	if (!seccomp_may_assign_mode(seccomp_mode))
1305		goto out;
1306
1307	ret = seccomp_attach_filter(flags, prepared);
1308	if (ret)
1309		goto out;
1310	/* Do not free the successfully attached filter. */
1311	prepared = NULL;
1312
1313	seccomp_assign_mode(current, seccomp_mode, flags);
1314out:
1315	spin_unlock_irq(&current->sighand->siglock);
1316	if (flags & SECCOMP_FILTER_FLAG_TSYNC)
1317		mutex_unlock(&current->signal->cred_guard_mutex);
1318out_put_fd:
1319	if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) {
1320		if (ret) {
1321			listener_f->private_data = NULL;
1322			fput(listener_f);
1323			put_unused_fd(listener);
 
1324		} else {
1325			fd_install(listener, listener_f);
1326			ret = listener;
1327		}
1328	}
1329out_free:
1330	seccomp_filter_free(prepared);
1331	return ret;
1332}
1333#else
1334static inline long seccomp_set_mode_filter(unsigned int flags,
1335					   const char __user *filter)
1336{
1337	return -EINVAL;
1338}
1339#endif
1340
1341static long seccomp_get_action_avail(const char __user *uaction)
1342{
1343	u32 action;
1344
1345	if (copy_from_user(&action, uaction, sizeof(action)))
1346		return -EFAULT;
1347
1348	switch (action) {
1349	case SECCOMP_RET_KILL_PROCESS:
1350	case SECCOMP_RET_KILL_THREAD:
1351	case SECCOMP_RET_TRAP:
1352	case SECCOMP_RET_ERRNO:
1353	case SECCOMP_RET_USER_NOTIF:
1354	case SECCOMP_RET_TRACE:
1355	case SECCOMP_RET_LOG:
1356	case SECCOMP_RET_ALLOW:
1357		break;
1358	default:
1359		return -EOPNOTSUPP;
1360	}
1361
1362	return 0;
1363}
1364
1365static long seccomp_get_notif_sizes(void __user *usizes)
1366{
1367	struct seccomp_notif_sizes sizes = {
1368		.seccomp_notif = sizeof(struct seccomp_notif),
1369		.seccomp_notif_resp = sizeof(struct seccomp_notif_resp),
1370		.seccomp_data = sizeof(struct seccomp_data),
1371	};
1372
1373	if (copy_to_user(usizes, &sizes, sizeof(sizes)))
1374		return -EFAULT;
1375
1376	return 0;
1377}
1378
1379/* Common entry point for both prctl and syscall. */
1380static long do_seccomp(unsigned int op, unsigned int flags,
1381		       void __user *uargs)
1382{
1383	switch (op) {
1384	case SECCOMP_SET_MODE_STRICT:
1385		if (flags != 0 || uargs != NULL)
1386			return -EINVAL;
1387		return seccomp_set_mode_strict();
1388	case SECCOMP_SET_MODE_FILTER:
1389		return seccomp_set_mode_filter(flags, uargs);
1390	case SECCOMP_GET_ACTION_AVAIL:
1391		if (flags != 0)
1392			return -EINVAL;
1393
1394		return seccomp_get_action_avail(uargs);
1395	case SECCOMP_GET_NOTIF_SIZES:
1396		if (flags != 0)
1397			return -EINVAL;
1398
1399		return seccomp_get_notif_sizes(uargs);
1400	default:
1401		return -EINVAL;
1402	}
1403}
1404
1405SYSCALL_DEFINE3(seccomp, unsigned int, op, unsigned int, flags,
1406			 void __user *, uargs)
1407{
1408	return do_seccomp(op, flags, uargs);
1409}
1410
1411/**
1412 * prctl_set_seccomp: configures current->seccomp.mode
1413 * @seccomp_mode: requested mode to use
1414 * @filter: optional struct sock_fprog for use with SECCOMP_MODE_FILTER
1415 *
1416 * Returns 0 on success or -EINVAL on failure.
1417 */
1418long prctl_set_seccomp(unsigned long seccomp_mode, void __user *filter)
1419{
1420	unsigned int op;
1421	void __user *uargs;
1422
1423	switch (seccomp_mode) {
1424	case SECCOMP_MODE_STRICT:
1425		op = SECCOMP_SET_MODE_STRICT;
1426		/*
1427		 * Setting strict mode through prctl always ignored filter,
1428		 * so make sure it is always NULL here to pass the internal
1429		 * check in do_seccomp().
1430		 */
1431		uargs = NULL;
1432		break;
1433	case SECCOMP_MODE_FILTER:
1434		op = SECCOMP_SET_MODE_FILTER;
1435		uargs = filter;
1436		break;
1437	default:
1438		return -EINVAL;
1439	}
1440
1441	/* prctl interface doesn't have flags, so they are always zero. */
1442	return do_seccomp(op, 0, uargs);
1443}
1444
1445#if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
1446static struct seccomp_filter *get_nth_filter(struct task_struct *task,
1447					     unsigned long filter_off)
1448{
1449	struct seccomp_filter *orig, *filter;
1450	unsigned long count;
1451
1452	/*
1453	 * Note: this is only correct because the caller should be the (ptrace)
1454	 * tracer of the task, otherwise lock_task_sighand is needed.
1455	 */
1456	spin_lock_irq(&task->sighand->siglock);
1457
1458	if (task->seccomp.mode != SECCOMP_MODE_FILTER) {
1459		spin_unlock_irq(&task->sighand->siglock);
1460		return ERR_PTR(-EINVAL);
1461	}
1462
1463	orig = task->seccomp.filter;
1464	__get_seccomp_filter(orig);
1465	spin_unlock_irq(&task->sighand->siglock);
1466
1467	count = 0;
1468	for (filter = orig; filter; filter = filter->prev)
1469		count++;
1470
1471	if (filter_off >= count) {
1472		filter = ERR_PTR(-ENOENT);
1473		goto out;
1474	}
1475
1476	count -= filter_off;
1477	for (filter = orig; filter && count > 1; filter = filter->prev)
1478		count--;
1479
1480	if (WARN_ON(count != 1 || !filter)) {
1481		filter = ERR_PTR(-ENOENT);
1482		goto out;
1483	}
1484
1485	__get_seccomp_filter(filter);
1486
1487out:
1488	__put_seccomp_filter(orig);
1489	return filter;
1490}
1491
1492long seccomp_get_filter(struct task_struct *task, unsigned long filter_off,
1493			void __user *data)
1494{
1495	struct seccomp_filter *filter;
1496	struct sock_fprog_kern *fprog;
1497	long ret;
1498
1499	if (!capable(CAP_SYS_ADMIN) ||
1500	    current->seccomp.mode != SECCOMP_MODE_DISABLED) {
1501		return -EACCES;
1502	}
1503
1504	filter = get_nth_filter(task, filter_off);
1505	if (IS_ERR(filter))
1506		return PTR_ERR(filter);
1507
1508	fprog = filter->prog->orig_prog;
1509	if (!fprog) {
1510		/* This must be a new non-cBPF filter, since we save
1511		 * every cBPF filter's orig_prog above when
1512		 * CONFIG_CHECKPOINT_RESTORE is enabled.
1513		 */
1514		ret = -EMEDIUMTYPE;
1515		goto out;
1516	}
1517
1518	ret = fprog->len;
1519	if (!data)
1520		goto out;
1521
1522	if (copy_to_user(data, fprog->filter, bpf_classic_proglen(fprog)))
1523		ret = -EFAULT;
1524
1525out:
1526	__put_seccomp_filter(filter);
1527	return ret;
1528}
1529
1530long seccomp_get_metadata(struct task_struct *task,
1531			  unsigned long size, void __user *data)
1532{
1533	long ret;
1534	struct seccomp_filter *filter;
1535	struct seccomp_metadata kmd = {};
1536
1537	if (!capable(CAP_SYS_ADMIN) ||
1538	    current->seccomp.mode != SECCOMP_MODE_DISABLED) {
1539		return -EACCES;
1540	}
1541
1542	size = min_t(unsigned long, size, sizeof(kmd));
1543
1544	if (size < sizeof(kmd.filter_off))
1545		return -EINVAL;
1546
1547	if (copy_from_user(&kmd.filter_off, data, sizeof(kmd.filter_off)))
1548		return -EFAULT;
1549
1550	filter = get_nth_filter(task, kmd.filter_off);
1551	if (IS_ERR(filter))
1552		return PTR_ERR(filter);
1553
1554	if (filter->log)
1555		kmd.flags |= SECCOMP_FILTER_FLAG_LOG;
1556
1557	ret = size;
1558	if (copy_to_user(data, &kmd, size))
1559		ret = -EFAULT;
1560
1561	__put_seccomp_filter(filter);
1562	return ret;
1563}
1564#endif
1565
1566#ifdef CONFIG_SYSCTL
1567
1568/* Human readable action names for friendly sysctl interaction */
1569#define SECCOMP_RET_KILL_PROCESS_NAME	"kill_process"
1570#define SECCOMP_RET_KILL_THREAD_NAME	"kill_thread"
1571#define SECCOMP_RET_TRAP_NAME		"trap"
1572#define SECCOMP_RET_ERRNO_NAME		"errno"
1573#define SECCOMP_RET_USER_NOTIF_NAME	"user_notif"
1574#define SECCOMP_RET_TRACE_NAME		"trace"
1575#define SECCOMP_RET_LOG_NAME		"log"
1576#define SECCOMP_RET_ALLOW_NAME		"allow"
1577
1578static const char seccomp_actions_avail[] =
1579				SECCOMP_RET_KILL_PROCESS_NAME	" "
1580				SECCOMP_RET_KILL_THREAD_NAME	" "
1581				SECCOMP_RET_TRAP_NAME		" "
1582				SECCOMP_RET_ERRNO_NAME		" "
1583				SECCOMP_RET_USER_NOTIF_NAME     " "
1584				SECCOMP_RET_TRACE_NAME		" "
1585				SECCOMP_RET_LOG_NAME		" "
1586				SECCOMP_RET_ALLOW_NAME;
1587
1588struct seccomp_log_name {
1589	u32		log;
1590	const char	*name;
1591};
1592
1593static const struct seccomp_log_name seccomp_log_names[] = {
1594	{ SECCOMP_LOG_KILL_PROCESS, SECCOMP_RET_KILL_PROCESS_NAME },
1595	{ SECCOMP_LOG_KILL_THREAD, SECCOMP_RET_KILL_THREAD_NAME },
1596	{ SECCOMP_LOG_TRAP, SECCOMP_RET_TRAP_NAME },
1597	{ SECCOMP_LOG_ERRNO, SECCOMP_RET_ERRNO_NAME },
1598	{ SECCOMP_LOG_USER_NOTIF, SECCOMP_RET_USER_NOTIF_NAME },
1599	{ SECCOMP_LOG_TRACE, SECCOMP_RET_TRACE_NAME },
1600	{ SECCOMP_LOG_LOG, SECCOMP_RET_LOG_NAME },
1601	{ SECCOMP_LOG_ALLOW, SECCOMP_RET_ALLOW_NAME },
1602	{ }
1603};
1604
1605static bool seccomp_names_from_actions_logged(char *names, size_t size,
1606					      u32 actions_logged,
1607					      const char *sep)
1608{
1609	const struct seccomp_log_name *cur;
1610	bool append_sep = false;
1611
1612	for (cur = seccomp_log_names; cur->name && size; cur++) {
1613		ssize_t ret;
1614
1615		if (!(actions_logged & cur->log))
1616			continue;
1617
1618		if (append_sep) {
1619			ret = strscpy(names, sep, size);
1620			if (ret < 0)
1621				return false;
1622
1623			names += ret;
1624			size -= ret;
1625		} else
1626			append_sep = true;
1627
1628		ret = strscpy(names, cur->name, size);
1629		if (ret < 0)
1630			return false;
1631
1632		names += ret;
1633		size -= ret;
1634	}
1635
1636	return true;
1637}
1638
1639static bool seccomp_action_logged_from_name(u32 *action_logged,
1640					    const char *name)
1641{
1642	const struct seccomp_log_name *cur;
1643
1644	for (cur = seccomp_log_names; cur->name; cur++) {
1645		if (!strcmp(cur->name, name)) {
1646			*action_logged = cur->log;
1647			return true;
1648		}
1649	}
1650
1651	return false;
1652}
1653
1654static bool seccomp_actions_logged_from_names(u32 *actions_logged, char *names)
1655{
1656	char *name;
1657
1658	*actions_logged = 0;
1659	while ((name = strsep(&names, " ")) && *name) {
1660		u32 action_logged = 0;
1661
1662		if (!seccomp_action_logged_from_name(&action_logged, name))
1663			return false;
1664
1665		*actions_logged |= action_logged;
1666	}
1667
1668	return true;
1669}
1670
1671static int read_actions_logged(struct ctl_table *ro_table, void __user *buffer,
1672			       size_t *lenp, loff_t *ppos)
1673{
1674	char names[sizeof(seccomp_actions_avail)];
1675	struct ctl_table table;
1676
1677	memset(names, 0, sizeof(names));
1678
1679	if (!seccomp_names_from_actions_logged(names, sizeof(names),
1680					       seccomp_actions_logged, " "))
1681		return -EINVAL;
1682
1683	table = *ro_table;
1684	table.data = names;
1685	table.maxlen = sizeof(names);
1686	return proc_dostring(&table, 0, buffer, lenp, ppos);
1687}
1688
1689static int write_actions_logged(struct ctl_table *ro_table, void __user *buffer,
1690				size_t *lenp, loff_t *ppos, u32 *actions_logged)
1691{
1692	char names[sizeof(seccomp_actions_avail)];
1693	struct ctl_table table;
1694	int ret;
1695
1696	if (!capable(CAP_SYS_ADMIN))
1697		return -EPERM;
1698
1699	memset(names, 0, sizeof(names));
1700
1701	table = *ro_table;
1702	table.data = names;
1703	table.maxlen = sizeof(names);
1704	ret = proc_dostring(&table, 1, buffer, lenp, ppos);
1705	if (ret)
1706		return ret;
1707
1708	if (!seccomp_actions_logged_from_names(actions_logged, table.data))
1709		return -EINVAL;
1710
1711	if (*actions_logged & SECCOMP_LOG_ALLOW)
1712		return -EINVAL;
1713
1714	seccomp_actions_logged = *actions_logged;
1715	return 0;
1716}
1717
1718static void audit_actions_logged(u32 actions_logged, u32 old_actions_logged,
1719				 int ret)
1720{
1721	char names[sizeof(seccomp_actions_avail)];
1722	char old_names[sizeof(seccomp_actions_avail)];
1723	const char *new = names;
1724	const char *old = old_names;
1725
1726	if (!audit_enabled)
1727		return;
1728
1729	memset(names, 0, sizeof(names));
1730	memset(old_names, 0, sizeof(old_names));
1731
1732	if (ret)
1733		new = "?";
1734	else if (!actions_logged)
1735		new = "(none)";
1736	else if (!seccomp_names_from_actions_logged(names, sizeof(names),
1737						    actions_logged, ","))
1738		new = "?";
1739
1740	if (!old_actions_logged)
1741		old = "(none)";
1742	else if (!seccomp_names_from_actions_logged(old_names,
1743						    sizeof(old_names),
1744						    old_actions_logged, ","))
1745		old = "?";
1746
1747	return audit_seccomp_actions_logged(new, old, !ret);
1748}
1749
1750static int seccomp_actions_logged_handler(struct ctl_table *ro_table, int write,
1751					  void __user *buffer, size_t *lenp,
1752					  loff_t *ppos)
1753{
1754	int ret;
1755
1756	if (write) {
1757		u32 actions_logged = 0;
1758		u32 old_actions_logged = seccomp_actions_logged;
1759
1760		ret = write_actions_logged(ro_table, buffer, lenp, ppos,
1761					   &actions_logged);
1762		audit_actions_logged(actions_logged, old_actions_logged, ret);
1763	} else
1764		ret = read_actions_logged(ro_table, buffer, lenp, ppos);
1765
1766	return ret;
1767}
1768
1769static struct ctl_path seccomp_sysctl_path[] = {
1770	{ .procname = "kernel", },
1771	{ .procname = "seccomp", },
1772	{ }
1773};
1774
1775static struct ctl_table seccomp_sysctl_table[] = {
1776	{
1777		.procname	= "actions_avail",
1778		.data		= (void *) &seccomp_actions_avail,
1779		.maxlen		= sizeof(seccomp_actions_avail),
1780		.mode		= 0444,
1781		.proc_handler	= proc_dostring,
1782	},
1783	{
1784		.procname	= "actions_logged",
1785		.mode		= 0644,
1786		.proc_handler	= seccomp_actions_logged_handler,
1787	},
1788	{ }
1789};
1790
1791static int __init seccomp_sysctl_init(void)
1792{
1793	struct ctl_table_header *hdr;
1794
1795	hdr = register_sysctl_paths(seccomp_sysctl_path, seccomp_sysctl_table);
1796	if (!hdr)
1797		pr_warn("seccomp: sysctl registration failed\n");
1798	else
1799		kmemleak_not_leak(hdr);
1800
1801	return 0;
1802}
1803
1804device_initcall(seccomp_sysctl_init)
1805
1806#endif /* CONFIG_SYSCTL */