1// SPDX-License-Identifier: GPL-2.0
   2/*
   3 * linux/kernel/seccomp.c
   4 *
   5 * Copyright 2004-2005  Andrea Arcangeli <andrea@cpushare.com>
   6 *
   7 * Copyright (C) 2012 Google, Inc.
   8 * Will Drewry <wad@chromium.org>
   9 *
  10 * This defines a simple but solid secure-computing facility.
  11 *
  12 * Mode 1 uses a fixed list of allowed system calls.
  13 * Mode 2 allows user-defined system call filters in the form
  14 *        of Berkeley Packet Filters/Linux Socket Filters.
  15 */
  16#define pr_fmt(fmt) "seccomp: " fmt
  17
  18#include <linux/refcount.h>
  19#include <linux/audit.h>
  20#include <linux/compat.h>
  21#include <linux/coredump.h>
  22#include <linux/kmemleak.h>
  23#include <linux/nospec.h>
  24#include <linux/prctl.h>
  25#include <linux/sched.h>
  26#include <linux/sched/task_stack.h>
  27#include <linux/seccomp.h>
  28#include <linux/slab.h>
  29#include <linux/syscalls.h>
  30#include <linux/sysctl.h>
  31
  32/* Not exposed in headers: strictly internal use only. */
  33#define SECCOMP_MODE_DEAD	(SECCOMP_MODE_FILTER + 1)
  34
  35#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
  36#include <asm/syscall.h>
  37#endif
  38
  39#ifdef CONFIG_SECCOMP_FILTER
  40#include <linux/file.h>
  41#include <linux/filter.h>
  42#include <linux/pid.h>
  43#include <linux/ptrace.h>
  44#include <linux/capability.h>
 
  45#include <linux/uaccess.h>
  46#include <linux/anon_inodes.h>
  47#include <linux/lockdep.h>
  48
  49/*
  50 * When SECCOMP_IOCTL_NOTIF_ID_VALID was first introduced, it had the
  51 * wrong direction flag in the ioctl number. This is the broken one,
  52 * which the kernel needs to keep supporting until all userspaces stop
  53 * using the wrong command number.
  54 */
  55#define SECCOMP_IOCTL_NOTIF_ID_VALID_WRONG_DIR	SECCOMP_IOR(2, __u64)
  56
  57enum notify_state {
  58	SECCOMP_NOTIFY_INIT,
  59	SECCOMP_NOTIFY_SENT,
  60	SECCOMP_NOTIFY_REPLIED,
  61};
  62
  63struct seccomp_knotif {
  64	/* The struct pid of the task whose filter triggered the notification */
  65	struct task_struct *task;
  66
  67	/* The "cookie" for this request; this is unique for this filter. */
  68	u64 id;
  69
  70	/*
  71	 * The seccomp data. This pointer is valid the entire time this
  72	 * notification is active, since it comes from __seccomp_filter which
  73	 * eclipses the entire lifecycle here.
  74	 */
  75	const struct seccomp_data *data;
  76
  77	/*
  78	 * Notification states. When SECCOMP_RET_USER_NOTIF is returned, a
  79	 * struct seccomp_knotif is created and starts out in INIT. Once the
  80	 * handler reads the notification off of an FD, it transitions to SENT.
  81	 * If a signal is received the state transitions back to INIT and
  82	 * another message is sent. When the userspace handler replies, state
  83	 * transitions to REPLIED.
  84	 */
  85	enum notify_state state;
  86
  87	/* The return values, only valid when in SECCOMP_NOTIFY_REPLIED */
  88	int error;
  89	long val;
  90	u32 flags;
  91
  92	/*
  93	 * Signals when this has changed states, such as the listener
  94	 * dying, a new seccomp addfd message, or changing to REPLIED
  95	 */
  96	struct completion ready;
  97
  98	struct list_head list;
  99
 100	/* outstanding addfd requests */
 101	struct list_head addfd;
 102};
 103
 104/**
 105 * struct seccomp_kaddfd - container for seccomp_addfd ioctl messages
 106 *
 107 * @file: A reference to the file to install in the other task
 108 * @fd: The fd number to install it at. If the fd number is -1, it means the
 109 *      installing process should allocate the fd as normal.
 110 * @flags: The flags for the new file descriptor. At the moment, only O_CLOEXEC
 111 *         is allowed.
 112 * @ioctl_flags: The flags used for the seccomp_addfd ioctl.
 113 * @setfd: whether or not SECCOMP_ADDFD_FLAG_SETFD was set during notify_addfd
 114 * @ret: The return value of the installing process. It is set to the fd num
 115 *       upon success (>= 0).
 116 * @completion: Indicates that the installing process has completed fd
 117 *              installation, or gone away (either due to successful
 118 *              reply, or signal)
 119 * @list: list_head for chaining seccomp_kaddfd together.
 120 *
 121 */
 122struct seccomp_kaddfd {
 123	struct file *file;
 124	int fd;
 125	unsigned int flags;
 126	__u32 ioctl_flags;
 127
 128	union {
 129		bool setfd;
 130		/* To only be set on reply */
 131		int ret;
 132	};
 133	struct completion completion;
 134	struct list_head list;
 135};
 136
 137/**
 138 * struct notification - container for seccomp userspace notifications. Since
 139 * most seccomp filters will not have notification listeners attached and this
 140 * structure is fairly large, we store the notification-specific stuff in a
 141 * separate structure.
 142 *
 143 * @requests: A semaphore that users of this notification can wait on for
 144 *            changes. Actual reads and writes are still controlled with
 145 *            filter->notify_lock.
 146 * @flags: A set of SECCOMP_USER_NOTIF_FD_* flags.
 147 * @next_id: The id of the next request.
 148 * @notifications: A list of struct seccomp_knotif elements.
 149 */
 150
 151struct notification {
 152	atomic_t requests;
 153	u32 flags;
 154	u64 next_id;
 155	struct list_head notifications;
 156};
 157
 158#ifdef SECCOMP_ARCH_NATIVE
 159/**
 160 * struct action_cache - per-filter cache of seccomp actions per
 161 * arch/syscall pair
 162 *
 163 * @allow_native: A bitmap where each bit represents whether the
 164 *		  filter will always allow the syscall, for the
 165 *		  native architecture.
 166 * @allow_compat: A bitmap where each bit represents whether the
 167 *		  filter will always allow the syscall, for the
 168 *		  compat architecture.
 169 */
 170struct action_cache {
 171	DECLARE_BITMAP(allow_native, SECCOMP_ARCH_NATIVE_NR);
 172#ifdef SECCOMP_ARCH_COMPAT
 173	DECLARE_BITMAP(allow_compat, SECCOMP_ARCH_COMPAT_NR);
 174#endif
 175};
 176#else
 177struct action_cache { };
 178
 179static inline bool seccomp_cache_check_allow(const struct seccomp_filter *sfilter,
 180					     const struct seccomp_data *sd)
 181{
 182	return false;
 183}
 184
 185static inline void seccomp_cache_prepare(struct seccomp_filter *sfilter)
 186{
 187}
 188#endif /* SECCOMP_ARCH_NATIVE */
 189
 190/**
 191 * struct seccomp_filter - container for seccomp BPF programs
 192 *
 193 * @refs: Reference count to manage the object lifetime.
 194 *	  A filter's reference count is incremented for each directly
 195 *	  attached task, once for the dependent filter, and if
 196 *	  requested for the user notifier. When @refs reaches zero,
 197 *	  the filter can be freed.
 198 * @users: A filter's @users count is incremented for each directly
 199 *         attached task (filter installation, fork(), thread_sync),
 200 *	   and once for the dependent filter (tracked in filter->prev).
 201 *	   When it reaches zero it indicates that no direct or indirect
 202 *	   users of that filter exist. No new tasks can get associated with
 203 *	   this filter after reaching 0. The @users count is always smaller
 204 *	   or equal to @refs. Hence, reaching 0 for @users does not mean
 205 *	   the filter can be freed.
 206 * @cache: cache of arch/syscall mappings to actions
 207 * @log: true if all actions except for SECCOMP_RET_ALLOW should be logged
 208 * @wait_killable_recv: Put notifying process in killable state once the
 209 *			notification is received by the userspace listener.
 210 * @prev: points to a previously installed, or inherited, filter
 211 * @prog: the BPF program to evaluate
 212 * @notif: the struct that holds all notification related information
 213 * @notify_lock: A lock for all notification-related accesses.
 214 * @wqh: A wait queue for poll if a notifier is in use.
 215 *
 216 * seccomp_filter objects are organized in a tree linked via the @prev
 217 * pointer.  For any task, it appears to be a singly-linked list starting
 218 * with current->seccomp.filter, the most recently attached or inherited filter.
 219 * However, multiple filters may share a @prev node, by way of fork(), which
 220 * results in a unidirectional tree existing in memory.  This is similar to
 221 * how namespaces work.
 222 *
 223 * seccomp_filter objects should never be modified after being attached
 224 * to a task_struct (other than @refs).
 225 */
 226struct seccomp_filter {
 227	refcount_t refs;
 228	refcount_t users;
 229	bool log;
 230	bool wait_killable_recv;
 231	struct action_cache cache;
 232	struct seccomp_filter *prev;
 233	struct bpf_prog *prog;
 234	struct notification *notif;
 235	struct mutex notify_lock;
 236	wait_queue_head_t wqh;
 237};
 238
 239/* Limit any path through the tree to 256KB worth of instructions. */
 240#define MAX_INSNS_PER_PATH ((1 << 18) / sizeof(struct sock_filter))
 241
 242/*
 243 * Endianness is explicitly ignored and left for BPF program authors to manage
 244 * as per the specific architecture.
 245 */
 246static void populate_seccomp_data(struct seccomp_data *sd)
 247{
 248	/*
 249	 * Instead of using current_pt_reg(), we're already doing the work
 250	 * to safely fetch "current", so just use "task" everywhere below.
 251	 */
 252	struct task_struct *task = current;
 253	struct pt_regs *regs = task_pt_regs(task);
 254	unsigned long args[6];
 255
 256	sd->nr = syscall_get_nr(task, regs);
 257	sd->arch = syscall_get_arch(task);
 258	syscall_get_arguments(task, regs, args);
 259	sd->args[0] = args[0];
 260	sd->args[1] = args[1];
 261	sd->args[2] = args[2];
 262	sd->args[3] = args[3];
 263	sd->args[4] = args[4];
 264	sd->args[5] = args[5];
 265	sd->instruction_pointer = KSTK_EIP(task);
 266}
 267
 268/**
 269 *	seccomp_check_filter - verify seccomp filter code
 270 *	@filter: filter to verify
 271 *	@flen: length of filter
 272 *
 273 * Takes a previously checked filter (by bpf_check_classic) and
 274 * redirects all filter code that loads struct sk_buff data
 275 * and related data through seccomp_bpf_load.  It also
 276 * enforces length and alignment checking of those loads.
 277 *
 278 * Returns 0 if the rule set is legal or -EINVAL if not.
 279 */
 280static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen)
 281{
 282	int pc;
 283	for (pc = 0; pc < flen; pc++) {
 284		struct sock_filter *ftest = &filter[pc];
 285		u16 code = ftest->code;
 286		u32 k = ftest->k;
 287
 288		switch (code) {
 289		case BPF_LD | BPF_W | BPF_ABS:
 290			ftest->code = BPF_LDX | BPF_W | BPF_ABS;
 291			/* 32-bit aligned and not out of bounds. */
 292			if (k >= sizeof(struct seccomp_data) || k & 3)
 293				return -EINVAL;
 294			continue;
 295		case BPF_LD | BPF_W | BPF_LEN:
 296			ftest->code = BPF_LD | BPF_IMM;
 297			ftest->k = sizeof(struct seccomp_data);
 298			continue;
 299		case BPF_LDX | BPF_W | BPF_LEN:
 300			ftest->code = BPF_LDX | BPF_IMM;
 301			ftest->k = sizeof(struct seccomp_data);
 302			continue;
 303		/* Explicitly include allowed calls. */
 304		case BPF_RET | BPF_K:
 305		case BPF_RET | BPF_A:
 306		case BPF_ALU | BPF_ADD | BPF_K:
 307		case BPF_ALU | BPF_ADD | BPF_X:
 308		case BPF_ALU | BPF_SUB | BPF_K:
 309		case BPF_ALU | BPF_SUB | BPF_X:
 310		case BPF_ALU | BPF_MUL | BPF_K:
 311		case BPF_ALU | BPF_MUL | BPF_X:
 312		case BPF_ALU | BPF_DIV | BPF_K:
 313		case BPF_ALU | BPF_DIV | BPF_X:
 314		case BPF_ALU | BPF_AND | BPF_K:
 315		case BPF_ALU | BPF_AND | BPF_X:
 316		case BPF_ALU | BPF_OR | BPF_K:
 317		case BPF_ALU | BPF_OR | BPF_X:
 318		case BPF_ALU | BPF_XOR | BPF_K:
 319		case BPF_ALU | BPF_XOR | BPF_X:
 320		case BPF_ALU | BPF_LSH | BPF_K:
 321		case BPF_ALU | BPF_LSH | BPF_X:
 322		case BPF_ALU | BPF_RSH | BPF_K:
 323		case BPF_ALU | BPF_RSH | BPF_X:
 324		case BPF_ALU | BPF_NEG:
 325		case BPF_LD | BPF_IMM:
 326		case BPF_LDX | BPF_IMM:
 327		case BPF_MISC | BPF_TAX:
 328		case BPF_MISC | BPF_TXA:
 329		case BPF_LD | BPF_MEM:
 330		case BPF_LDX | BPF_MEM:
 331		case BPF_ST:
 332		case BPF_STX:
 333		case BPF_JMP | BPF_JA:
 334		case BPF_JMP | BPF_JEQ | BPF_K:
 335		case BPF_JMP | BPF_JEQ | BPF_X:
 336		case BPF_JMP | BPF_JGE | BPF_K:
 337		case BPF_JMP | BPF_JGE | BPF_X:
 338		case BPF_JMP | BPF_JGT | BPF_K:
 339		case BPF_JMP | BPF_JGT | BPF_X:
 340		case BPF_JMP | BPF_JSET | BPF_K:
 341		case BPF_JMP | BPF_JSET | BPF_X:
 342			continue;
 343		default:
 344			return -EINVAL;
 345		}
 346	}
 347	return 0;
 348}
 349
 350#ifdef SECCOMP_ARCH_NATIVE
 351static inline bool seccomp_cache_check_allow_bitmap(const void *bitmap,
 352						    size_t bitmap_size,
 353						    int syscall_nr)
 354{
 355	if (unlikely(syscall_nr < 0 || syscall_nr >= bitmap_size))
 356		return false;
 357	syscall_nr = array_index_nospec(syscall_nr, bitmap_size);
 358
 359	return test_bit(syscall_nr, bitmap);
 360}
 361
 362/**
 363 * seccomp_cache_check_allow - lookup seccomp cache
 364 * @sfilter: The seccomp filter
 365 * @sd: The seccomp data to lookup the cache with
 366 *
 367 * Returns true if the seccomp_data is cached and allowed.
 368 */
 369static inline bool seccomp_cache_check_allow(const struct seccomp_filter *sfilter,
 370					     const struct seccomp_data *sd)
 371{
 372	int syscall_nr = sd->nr;
 373	const struct action_cache *cache = &sfilter->cache;
 374
 375#ifndef SECCOMP_ARCH_COMPAT
 376	/* A native-only architecture doesn't need to check sd->arch. */
 377	return seccomp_cache_check_allow_bitmap(cache->allow_native,
 378						SECCOMP_ARCH_NATIVE_NR,
 379						syscall_nr);
 380#else
 381	if (likely(sd->arch == SECCOMP_ARCH_NATIVE))
 382		return seccomp_cache_check_allow_bitmap(cache->allow_native,
 383							SECCOMP_ARCH_NATIVE_NR,
 384							syscall_nr);
 385	if (likely(sd->arch == SECCOMP_ARCH_COMPAT))
 386		return seccomp_cache_check_allow_bitmap(cache->allow_compat,
 387							SECCOMP_ARCH_COMPAT_NR,
 388							syscall_nr);
 389#endif /* SECCOMP_ARCH_COMPAT */
 390
 391	WARN_ON_ONCE(true);
 392	return false;
 393}
 394#endif /* SECCOMP_ARCH_NATIVE */
 395
 396#define ACTION_ONLY(ret) ((s32)((ret) & (SECCOMP_RET_ACTION_FULL)))
 397/**
 398 * seccomp_run_filters - evaluates all seccomp filters against @sd
 399 * @sd: optional seccomp data to be passed to filters
 400 * @match: stores struct seccomp_filter that resulted in the return value,
 401 *         unless filter returned SECCOMP_RET_ALLOW, in which case it will
 402 *         be unchanged.
 403 *
 404 * Returns valid seccomp BPF response codes.
 405 */
 
 406static u32 seccomp_run_filters(const struct seccomp_data *sd,
 407			       struct seccomp_filter **match)
 408{
 409	u32 ret = SECCOMP_RET_ALLOW;
 410	/* Make sure cross-thread synced filter points somewhere sane. */
 411	struct seccomp_filter *f =
 412			READ_ONCE(current->seccomp.filter);
 413
 414	/* Ensure unexpected behavior doesn't result in failing open. */
 415	if (WARN_ON(f == NULL))
 416		return SECCOMP_RET_KILL_PROCESS;
 417
 418	if (seccomp_cache_check_allow(f, sd))
 419		return SECCOMP_RET_ALLOW;
 420
 421	/*
 422	 * All filters in the list are evaluated and the lowest BPF return
 423	 * value always takes priority (ignoring the DATA).
 424	 */
 425	for (; f; f = f->prev) {
 426		u32 cur_ret = bpf_prog_run_pin_on_cpu(f->prog, sd);
 427
 428		if (ACTION_ONLY(cur_ret) < ACTION_ONLY(ret)) {
 429			ret = cur_ret;
 430			*match = f;
 431		}
 432	}
 433	return ret;
 434}
 435#endif /* CONFIG_SECCOMP_FILTER */
 436
 437static inline bool seccomp_may_assign_mode(unsigned long seccomp_mode)
 438{
 439	assert_spin_locked(&current->sighand->siglock);
 440
 441	if (current->seccomp.mode && current->seccomp.mode != seccomp_mode)
 442		return false;
 443
 444	return true;
 445}
 446
 447void __weak arch_seccomp_spec_mitigate(struct task_struct *task) { }
 448
 449static inline void seccomp_assign_mode(struct task_struct *task,
 450				       unsigned long seccomp_mode,
 451				       unsigned long flags)
 452{
 453	assert_spin_locked(&task->sighand->siglock);
 454
 455	task->seccomp.mode = seccomp_mode;
 456	/*
 457	 * Make sure SYSCALL_WORK_SECCOMP cannot be set before the mode (and
 458	 * filter) is set.
 459	 */
 460	smp_mb__before_atomic();
 461	/* Assume default seccomp processes want spec flaw mitigation. */
 462	if ((flags & SECCOMP_FILTER_FLAG_SPEC_ALLOW) == 0)
 463		arch_seccomp_spec_mitigate(task);
 464	set_task_syscall_work(task, SECCOMP);
 465}
 466
 467#ifdef CONFIG_SECCOMP_FILTER
 468/* Returns 1 if the parent is an ancestor of the child. */
 469static int is_ancestor(struct seccomp_filter *parent,
 470		       struct seccomp_filter *child)
 471{
 472	/* NULL is the root ancestor. */
 473	if (parent == NULL)
 474		return 1;
 475	for (; child; child = child->prev)
 476		if (child == parent)
 477			return 1;
 478	return 0;
 479}
 480
 481/**
 482 * seccomp_can_sync_threads: checks if all threads can be synchronized
 483 *
 484 * Expects sighand and cred_guard_mutex locks to be held.
 485 *
 486 * Returns 0 on success, -ve on error, or the pid of a thread which was
 487 * either not in the correct seccomp mode or did not have an ancestral
 488 * seccomp filter.
 489 */
 490static inline pid_t seccomp_can_sync_threads(void)
 491{
 492	struct task_struct *thread, *caller;
 493
 494	BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
 495	assert_spin_locked(&current->sighand->siglock);
 496
 497	/* Validate all threads being eligible for synchronization. */
 498	caller = current;
 499	for_each_thread(caller, thread) {
 500		pid_t failed;
 501
 502		/* Skip current, since it is initiating the sync. */
 503		if (thread == caller)
 504			continue;
 505		/* Skip exited threads. */
 506		if (thread->flags & PF_EXITING)
 507			continue;
 508
 509		if (thread->seccomp.mode == SECCOMP_MODE_DISABLED ||
 510		    (thread->seccomp.mode == SECCOMP_MODE_FILTER &&
 511		     is_ancestor(thread->seccomp.filter,
 512				 caller->seccomp.filter)))
 513			continue;
 514
 515		/* Return the first thread that cannot be synchronized. */
 516		failed = task_pid_vnr(thread);
 517		/* If the pid cannot be resolved, then return -ESRCH */
 518		if (WARN_ON(failed == 0))
 519			failed = -ESRCH;
 520		return failed;
 521	}
 522
 523	return 0;
 524}
 525
 526static inline void seccomp_filter_free(struct seccomp_filter *filter)
 527{
 528	if (filter) {
 529		bpf_prog_destroy(filter->prog);
 530		kfree(filter);
 531	}
 532}
 533
 534static void __seccomp_filter_orphan(struct seccomp_filter *orig)
 535{
 536	while (orig && refcount_dec_and_test(&orig->users)) {
 537		if (waitqueue_active(&orig->wqh))
 538			wake_up_poll(&orig->wqh, EPOLLHUP);
 539		orig = orig->prev;
 540	}
 541}
 542
 543static void __put_seccomp_filter(struct seccomp_filter *orig)
 544{
 545	/* Clean up single-reference branches iteratively. */
 546	while (orig && refcount_dec_and_test(&orig->refs)) {
 547		struct seccomp_filter *freeme = orig;
 548		orig = orig->prev;
 549		seccomp_filter_free(freeme);
 550	}
 551}
 552
 553static void __seccomp_filter_release(struct seccomp_filter *orig)
 554{
 555	/* Notify about any unused filters in the task's former filter tree. */
 556	__seccomp_filter_orphan(orig);
 557	/* Finally drop all references to the task's former tree. */
 558	__put_seccomp_filter(orig);
 559}
 560
 561/**
 562 * seccomp_filter_release - Detach the task from its filter tree,
 563 *			    drop its reference count, and notify
 564 *			    about unused filters
 565 *
 566 * @tsk: task the filter should be released from.
 567 *
 568 * This function should only be called when the task is exiting as
 569 * it detaches it from its filter tree. PF_EXITING has to be set
 570 * for the task.
 571 */
 572void seccomp_filter_release(struct task_struct *tsk)
 573{
 574	struct seccomp_filter *orig;
 575
 576	if (WARN_ON((tsk->flags & PF_EXITING) == 0))
 577		return;
 578
 579	spin_lock_irq(&tsk->sighand->siglock);
 580	orig = tsk->seccomp.filter;
 581	/* Detach task from its filter tree. */
 582	tsk->seccomp.filter = NULL;
 583	spin_unlock_irq(&tsk->sighand->siglock);
 584	__seccomp_filter_release(orig);
 585}
 586
 587/**
 588 * seccomp_sync_threads: sets all threads to use current's filter
 589 *
 590 * @flags: SECCOMP_FILTER_FLAG_* flags to set during sync.
 591 *
 592 * Expects sighand and cred_guard_mutex locks to be held, and for
 593 * seccomp_can_sync_threads() to have returned success already
 594 * without dropping the locks.
 595 *
 596 */
 597static inline void seccomp_sync_threads(unsigned long flags)
 598{
 599	struct task_struct *thread, *caller;
 600
 601	BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
 602	assert_spin_locked(&current->sighand->siglock);
 603
 604	/* Synchronize all threads. */
 605	caller = current;
 606	for_each_thread(caller, thread) {
 607		/* Skip current, since it needs no changes. */
 608		if (thread == caller)
 609			continue;
 610
 611		/*
 612		 * Skip exited threads. seccomp_filter_release could have
 613		 * been already called for this task.
 614		 */
 615		if (thread->flags & PF_EXITING)
 616			continue;
 617
 618		/* Get a task reference for the new leaf node. */
 619		get_seccomp_filter(caller);
 620
 621		/*
 622		 * Drop the task reference to the shared ancestor since
 623		 * current's path will hold a reference.  (This also
 624		 * allows a put before the assignment.)
 625		 */
 626		__seccomp_filter_release(thread->seccomp.filter);
 627
 628		/* Make our new filter tree visible. */
 629		smp_store_release(&thread->seccomp.filter,
 630				  caller->seccomp.filter);
 631		atomic_set(&thread->seccomp.filter_count,
 632			   atomic_read(&caller->seccomp.filter_count));
 633
 634		/*
 635		 * Don't let an unprivileged task work around
 636		 * the no_new_privs restriction by creating
 637		 * a thread that sets it up, enters seccomp,
 638		 * then dies.
 639		 */
 640		if (task_no_new_privs(caller))
 641			task_set_no_new_privs(thread);
 642
 643		/*
 644		 * Opt the other thread into seccomp if needed.
 645		 * As threads are considered to be trust-realm
 646		 * equivalent (see ptrace_may_access), it is safe to
 647		 * allow one thread to transition the other.
 648		 */
 649		if (thread->seccomp.mode == SECCOMP_MODE_DISABLED)
 650			seccomp_assign_mode(thread, SECCOMP_MODE_FILTER,
 651					    flags);
 652	}
 653}
 654
 655/**
 656 * seccomp_prepare_filter: Prepares a seccomp filter for use.
 657 * @fprog: BPF program to install
 658 *
 659 * Returns filter on success or an ERR_PTR on failure.
 660 */
 661static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog)
 662{
 663	struct seccomp_filter *sfilter;
 664	int ret;
 665	const bool save_orig =
 666#if defined(CONFIG_CHECKPOINT_RESTORE) || defined(SECCOMP_ARCH_NATIVE)
 667		true;
 668#else
 669		false;
 670#endif
 671
 672	if (fprog->len == 0 || fprog->len > BPF_MAXINSNS)
 673		return ERR_PTR(-EINVAL);
 674
 675	BUG_ON(INT_MAX / fprog->len < sizeof(struct sock_filter));
 676
 677	/*
 678	 * Installing a seccomp filter requires that the task has
 679	 * CAP_SYS_ADMIN in its namespace or be running with no_new_privs.
 680	 * This avoids scenarios where unprivileged tasks can affect the
 681	 * behavior of privileged children.
 682	 */
 683	if (!task_no_new_privs(current) &&
 684			!ns_capable_noaudit(current_user_ns(), CAP_SYS_ADMIN))
 685		return ERR_PTR(-EACCES);
 686
 687	/* Allocate a new seccomp_filter */
 688	sfilter = kzalloc(sizeof(*sfilter), GFP_KERNEL | __GFP_NOWARN);
 689	if (!sfilter)
 690		return ERR_PTR(-ENOMEM);
 691
 692	mutex_init(&sfilter->notify_lock);
 693	ret = bpf_prog_create_from_user(&sfilter->prog, fprog,
 694					seccomp_check_filter, save_orig);
 695	if (ret < 0) {
 696		kfree(sfilter);
 697		return ERR_PTR(ret);
 698	}
 699
 700	refcount_set(&sfilter->refs, 1);
 701	refcount_set(&sfilter->users, 1);
 702	init_waitqueue_head(&sfilter->wqh);
 703
 704	return sfilter;
 705}
 706
 707/**
 708 * seccomp_prepare_user_filter - prepares a user-supplied sock_fprog
 709 * @user_filter: pointer to the user data containing a sock_fprog.
 710 *
 711 * Returns 0 on success and non-zero otherwise.
 712 */
 713static struct seccomp_filter *
 714seccomp_prepare_user_filter(const char __user *user_filter)
 715{
 716	struct sock_fprog fprog;
 717	struct seccomp_filter *filter = ERR_PTR(-EFAULT);
 718
 719#ifdef CONFIG_COMPAT
 720	if (in_compat_syscall()) {
 721		struct compat_sock_fprog fprog32;
 722		if (copy_from_user(&fprog32, user_filter, sizeof(fprog32)))
 723			goto out;
 724		fprog.len = fprog32.len;
 725		fprog.filter = compat_ptr(fprog32.filter);
 726	} else /* falls through to the if below. */
 727#endif
 728	if (copy_from_user(&fprog, user_filter, sizeof(fprog)))
 729		goto out;
 730	filter = seccomp_prepare_filter(&fprog);
 731out:
 732	return filter;
 733}
 734
 735#ifdef SECCOMP_ARCH_NATIVE
 736/**
 737 * seccomp_is_const_allow - check if filter is constant allow with given data
 738 * @fprog: The BPF programs
 739 * @sd: The seccomp data to check against, only syscall number and arch
 740 *      number are considered constant.
 741 */
 742static bool seccomp_is_const_allow(struct sock_fprog_kern *fprog,
 743				   struct seccomp_data *sd)
 744{
 745	unsigned int reg_value = 0;
 746	unsigned int pc;
 747	bool op_res;
 748
 749	if (WARN_ON_ONCE(!fprog))
 750		return false;
 751
 752	/* Our single exception to filtering. */
 753#ifdef __NR_uretprobe
 754#ifdef SECCOMP_ARCH_COMPAT
 755	if (sd->arch == SECCOMP_ARCH_NATIVE)
 756#endif
 757		if (sd->nr == __NR_uretprobe)
 758			return true;
 759#endif
 760
 761	for (pc = 0; pc < fprog->len; pc++) {
 762		struct sock_filter *insn = &fprog->filter[pc];
 763		u16 code = insn->code;
 764		u32 k = insn->k;
 765
 766		switch (code) {
 767		case BPF_LD | BPF_W | BPF_ABS:
 768			switch (k) {
 769			case offsetof(struct seccomp_data, nr):
 770				reg_value = sd->nr;
 771				break;
 772			case offsetof(struct seccomp_data, arch):
 773				reg_value = sd->arch;
 774				break;
 775			default:
 776				/* can't optimize (non-constant value load) */
 777				return false;
 778			}
 779			break;
 780		case BPF_RET | BPF_K:
 781			/* reached return with constant values only, check allow */
 782			return k == SECCOMP_RET_ALLOW;
 783		case BPF_JMP | BPF_JA:
 784			pc += insn->k;
 785			break;
 786		case BPF_JMP | BPF_JEQ | BPF_K:
 787		case BPF_JMP | BPF_JGE | BPF_K:
 788		case BPF_JMP | BPF_JGT | BPF_K:
 789		case BPF_JMP | BPF_JSET | BPF_K:
 790			switch (BPF_OP(code)) {
 791			case BPF_JEQ:
 792				op_res = reg_value == k;
 793				break;
 794			case BPF_JGE:
 795				op_res = reg_value >= k;
 796				break;
 797			case BPF_JGT:
 798				op_res = reg_value > k;
 799				break;
 800			case BPF_JSET:
 801				op_res = !!(reg_value & k);
 802				break;
 803			default:
 804				/* can't optimize (unknown jump) */
 805				return false;
 806			}
 807
 808			pc += op_res ? insn->jt : insn->jf;
 809			break;
 810		case BPF_ALU | BPF_AND | BPF_K:
 811			reg_value &= k;
 812			break;
 813		default:
 814			/* can't optimize (unknown insn) */
 815			return false;
 816		}
 817	}
 818
 819	/* ran off the end of the filter?! */
 820	WARN_ON(1);
 821	return false;
 822}
 823
 824static void seccomp_cache_prepare_bitmap(struct seccomp_filter *sfilter,
 825					 void *bitmap, const void *bitmap_prev,
 826					 size_t bitmap_size, int arch)
 827{
 828	struct sock_fprog_kern *fprog = sfilter->prog->orig_prog;
 829	struct seccomp_data sd;
 830	int nr;
 831
 832	if (bitmap_prev) {
 833		/* The new filter must be as restrictive as the last. */
 834		bitmap_copy(bitmap, bitmap_prev, bitmap_size);
 835	} else {
 836		/* Before any filters, all syscalls are always allowed. */
 837		bitmap_fill(bitmap, bitmap_size);
 838	}
 839
 840	for (nr = 0; nr < bitmap_size; nr++) {
 841		/* No bitmap change: not a cacheable action. */
 842		if (!test_bit(nr, bitmap))
 843			continue;
 844
 845		sd.nr = nr;
 846		sd.arch = arch;
 847
 848		/* No bitmap change: continue to always allow. */
 849		if (seccomp_is_const_allow(fprog, &sd))
 850			continue;
 851
 852		/*
 853		 * Not a cacheable action: always run filters.
 854		 * atomic clear_bit() not needed, filter not visible yet.
 855		 */
 856		__clear_bit(nr, bitmap);
 857	}
 858}
 859
 860/**
 861 * seccomp_cache_prepare - emulate the filter to find cacheable syscalls
 862 * @sfilter: The seccomp filter
 863 *
 864 * Returns 0 if successful or -errno if error occurred.
 865 */
 866static void seccomp_cache_prepare(struct seccomp_filter *sfilter)
 867{
 868	struct action_cache *cache = &sfilter->cache;
 869	const struct action_cache *cache_prev =
 870		sfilter->prev ? &sfilter->prev->cache : NULL;
 871
 872	seccomp_cache_prepare_bitmap(sfilter, cache->allow_native,
 873				     cache_prev ? cache_prev->allow_native : NULL,
 874				     SECCOMP_ARCH_NATIVE_NR,
 875				     SECCOMP_ARCH_NATIVE);
 876
 877#ifdef SECCOMP_ARCH_COMPAT
 878	seccomp_cache_prepare_bitmap(sfilter, cache->allow_compat,
 879				     cache_prev ? cache_prev->allow_compat : NULL,
 880				     SECCOMP_ARCH_COMPAT_NR,
 881				     SECCOMP_ARCH_COMPAT);
 882#endif /* SECCOMP_ARCH_COMPAT */
 883}
 884#endif /* SECCOMP_ARCH_NATIVE */
 885
 886/**
 887 * seccomp_attach_filter: validate and attach filter
 888 * @flags:  flags to change filter behavior
 889 * @filter: seccomp filter to add to the current process
 890 *
 891 * Caller must be holding current->sighand->siglock lock.
 892 *
 893 * Returns 0 on success, -ve on error, or
 894 *   - in TSYNC mode: the pid of a thread which was either not in the correct
 895 *     seccomp mode or did not have an ancestral seccomp filter
 896 *   - in NEW_LISTENER mode: the fd of the new listener
 897 */
 898static long seccomp_attach_filter(unsigned int flags,
 899				  struct seccomp_filter *filter)
 900{
 901	unsigned long total_insns;
 902	struct seccomp_filter *walker;
 903
 904	assert_spin_locked(&current->sighand->siglock);
 905
 906	/* Validate resulting filter length. */
 907	total_insns = filter->prog->len;
 908	for (walker = current->seccomp.filter; walker; walker = walker->prev)
 909		total_insns += walker->prog->len + 4;  /* 4 instr penalty */
 910	if (total_insns > MAX_INSNS_PER_PATH)
 911		return -ENOMEM;
 912
 913	/* If thread sync has been requested, check that it is possible. */
 914	if (flags & SECCOMP_FILTER_FLAG_TSYNC) {
 915		int ret;
 916
 917		ret = seccomp_can_sync_threads();
 918		if (ret) {
 919			if (flags & SECCOMP_FILTER_FLAG_TSYNC_ESRCH)
 920				return -ESRCH;
 921			else
 922				return ret;
 923		}
 924	}
 925
 926	/* Set log flag, if present. */
 927	if (flags & SECCOMP_FILTER_FLAG_LOG)
 928		filter->log = true;
 929
 930	/* Set wait killable flag, if present. */
 931	if (flags & SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV)
 932		filter->wait_killable_recv = true;
 933
 934	/*
 935	 * If there is an existing filter, make it the prev and don't drop its
 936	 * task reference.
 937	 */
 938	filter->prev = current->seccomp.filter;
 939	seccomp_cache_prepare(filter);
 940	current->seccomp.filter = filter;
 941	atomic_inc(&current->seccomp.filter_count);
 942
 943	/* Now that the new filter is in place, synchronize to all threads. */
 944	if (flags & SECCOMP_FILTER_FLAG_TSYNC)
 945		seccomp_sync_threads(flags);
 946
 947	return 0;
 948}
 949
 950static void __get_seccomp_filter(struct seccomp_filter *filter)
 951{
 952	refcount_inc(&filter->refs);
 953}
 954
 955/* get_seccomp_filter - increments the reference count of the filter on @tsk */
 956void get_seccomp_filter(struct task_struct *tsk)
 957{
 958	struct seccomp_filter *orig = tsk->seccomp.filter;
 959	if (!orig)
 960		return;
 961	__get_seccomp_filter(orig);
 962	refcount_inc(&orig->users);
 963}
 964
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 965#endif	/* CONFIG_SECCOMP_FILTER */
 966
 967/* For use with seccomp_actions_logged */
 968#define SECCOMP_LOG_KILL_PROCESS	(1 << 0)
 969#define SECCOMP_LOG_KILL_THREAD		(1 << 1)
 970#define SECCOMP_LOG_TRAP		(1 << 2)
 971#define SECCOMP_LOG_ERRNO		(1 << 3)
 972#define SECCOMP_LOG_TRACE		(1 << 4)
 973#define SECCOMP_LOG_LOG			(1 << 5)
 974#define SECCOMP_LOG_ALLOW		(1 << 6)
 975#define SECCOMP_LOG_USER_NOTIF		(1 << 7)
 976
 977static u32 seccomp_actions_logged = SECCOMP_LOG_KILL_PROCESS |
 978				    SECCOMP_LOG_KILL_THREAD  |
 979				    SECCOMP_LOG_TRAP  |
 980				    SECCOMP_LOG_ERRNO |
 981				    SECCOMP_LOG_USER_NOTIF |
 982				    SECCOMP_LOG_TRACE |
 983				    SECCOMP_LOG_LOG;
 984
 985static inline void seccomp_log(unsigned long syscall, long signr, u32 action,
 986			       bool requested)
 987{
 988	bool log = false;
 989
 990	switch (action) {
 991	case SECCOMP_RET_ALLOW:
 992		break;
 993	case SECCOMP_RET_TRAP:
 994		log = requested && seccomp_actions_logged & SECCOMP_LOG_TRAP;
 995		break;
 996	case SECCOMP_RET_ERRNO:
 997		log = requested && seccomp_actions_logged & SECCOMP_LOG_ERRNO;
 998		break;
 999	case SECCOMP_RET_TRACE:
1000		log = requested && seccomp_actions_logged & SECCOMP_LOG_TRACE;
1001		break;
1002	case SECCOMP_RET_USER_NOTIF:
1003		log = requested && seccomp_actions_logged & SECCOMP_LOG_USER_NOTIF;
1004		break;
1005	case SECCOMP_RET_LOG:
1006		log = seccomp_actions_logged & SECCOMP_LOG_LOG;
1007		break;
1008	case SECCOMP_RET_KILL_THREAD:
1009		log = seccomp_actions_logged & SECCOMP_LOG_KILL_THREAD;
1010		break;
1011	case SECCOMP_RET_KILL_PROCESS:
1012	default:
1013		log = seccomp_actions_logged & SECCOMP_LOG_KILL_PROCESS;
1014	}
1015
1016	/*
1017	 * Emit an audit message when the action is RET_KILL_*, RET_LOG, or the
1018	 * FILTER_FLAG_LOG bit was set. The admin has the ability to silence
1019	 * any action from being logged by removing the action name from the
1020	 * seccomp_actions_logged sysctl.
1021	 */
1022	if (!log)
1023		return;
1024
1025	audit_seccomp(syscall, signr, action);
1026}
1027
1028/*
1029 * Secure computing mode 1 allows only read/write/exit/sigreturn.
1030 * To be fully secure this must be combined with rlimit
1031 * to limit the stack allocations too.
1032 */
1033static const int mode1_syscalls[] = {
1034	__NR_seccomp_read, __NR_seccomp_write, __NR_seccomp_exit, __NR_seccomp_sigreturn,
1035#ifdef __NR_uretprobe
1036	__NR_uretprobe,
1037#endif
1038	-1, /* negative terminated */
1039};
1040
1041static void __secure_computing_strict(int this_syscall)
1042{
1043	const int *allowed_syscalls = mode1_syscalls;
1044#ifdef CONFIG_COMPAT
1045	if (in_compat_syscall())
1046		allowed_syscalls = get_compat_mode1_syscalls();
1047#endif
1048	do {
1049		if (*allowed_syscalls == this_syscall)
1050			return;
1051	} while (*++allowed_syscalls != -1);
1052
1053#ifdef SECCOMP_DEBUG
1054	dump_stack();
1055#endif
1056	current->seccomp.mode = SECCOMP_MODE_DEAD;
1057	seccomp_log(this_syscall, SIGKILL, SECCOMP_RET_KILL_THREAD, true);
1058	do_exit(SIGKILL);
1059}
1060
1061#ifndef CONFIG_HAVE_ARCH_SECCOMP_FILTER
1062void secure_computing_strict(int this_syscall)
1063{
1064	int mode = current->seccomp.mode;
1065
1066	if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) &&
1067	    unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
1068		return;
1069
1070	if (mode == SECCOMP_MODE_DISABLED)
1071		return;
1072	else if (mode == SECCOMP_MODE_STRICT)
1073		__secure_computing_strict(this_syscall);
1074	else
1075		BUG();
1076}
1077#else
1078
1079#ifdef CONFIG_SECCOMP_FILTER
1080static u64 seccomp_next_notify_id(struct seccomp_filter *filter)
1081{
1082	/*
1083	 * Note: overflow is ok here, the id just needs to be unique per
1084	 * filter.
1085	 */
1086	lockdep_assert_held(&filter->notify_lock);
1087	return filter->notif->next_id++;
1088}
1089
1090static void seccomp_handle_addfd(struct seccomp_kaddfd *addfd, struct seccomp_knotif *n)
1091{
1092	int fd;
1093
1094	/*
1095	 * Remove the notification, and reset the list pointers, indicating
1096	 * that it has been handled.
1097	 */
1098	list_del_init(&addfd->list);
1099	if (!addfd->setfd)
1100		fd = receive_fd(addfd->file, NULL, addfd->flags);
1101	else
1102		fd = receive_fd_replace(addfd->fd, addfd->file, addfd->flags);
1103	addfd->ret = fd;
1104
1105	if (addfd->ioctl_flags & SECCOMP_ADDFD_FLAG_SEND) {
1106		/* If we fail reset and return an error to the notifier */
1107		if (fd < 0) {
1108			n->state = SECCOMP_NOTIFY_SENT;
1109		} else {
1110			/* Return the FD we just added */
1111			n->flags = 0;
1112			n->error = 0;
1113			n->val = fd;
1114		}
1115	}
1116
1117	/*
1118	 * Mark the notification as completed. From this point, addfd mem
1119	 * might be invalidated and we can't safely read it anymore.
1120	 */
1121	complete(&addfd->completion);
1122}
1123
1124static bool should_sleep_killable(struct seccomp_filter *match,
1125				  struct seccomp_knotif *n)
1126{
1127	return match->wait_killable_recv && n->state == SECCOMP_NOTIFY_SENT;
1128}
1129
1130static int seccomp_do_user_notification(int this_syscall,
1131					struct seccomp_filter *match,
1132					const struct seccomp_data *sd)
1133{
1134	int err;
1135	u32 flags = 0;
1136	long ret = 0;
1137	struct seccomp_knotif n = {};
1138	struct seccomp_kaddfd *addfd, *tmp;
1139
1140	mutex_lock(&match->notify_lock);
1141	err = -ENOSYS;
1142	if (!match->notif)
1143		goto out;
1144
1145	n.task = current;
1146	n.state = SECCOMP_NOTIFY_INIT;
1147	n.data = sd;
1148	n.id = seccomp_next_notify_id(match);
1149	init_completion(&n.ready);
1150	list_add_tail(&n.list, &match->notif->notifications);
1151	INIT_LIST_HEAD(&n.addfd);
1152
1153	atomic_inc(&match->notif->requests);
1154	if (match->notif->flags & SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP)
1155		wake_up_poll_on_current_cpu(&match->wqh, EPOLLIN | EPOLLRDNORM);
1156	else
1157		wake_up_poll(&match->wqh, EPOLLIN | EPOLLRDNORM);
1158
1159	/*
1160	 * This is where we wait for a reply from userspace.
1161	 */
1162	do {
1163		bool wait_killable = should_sleep_killable(match, &n);
1164
1165		mutex_unlock(&match->notify_lock);
1166		if (wait_killable)
1167			err = wait_for_completion_killable(&n.ready);
1168		else
1169			err = wait_for_completion_interruptible(&n.ready);
1170		mutex_lock(&match->notify_lock);
1171
1172		if (err != 0) {
1173			/*
1174			 * Check to see if the notifcation got picked up and
1175			 * whether we should switch to wait killable.
1176			 */
1177			if (!wait_killable && should_sleep_killable(match, &n))
1178				continue;
1179
1180			goto interrupted;
1181		}
1182
1183		addfd = list_first_entry_or_null(&n.addfd,
1184						 struct seccomp_kaddfd, list);
1185		/* Check if we were woken up by a addfd message */
1186		if (addfd)
1187			seccomp_handle_addfd(addfd, &n);
1188
1189	}  while (n.state != SECCOMP_NOTIFY_REPLIED);
1190
1191	ret = n.val;
1192	err = n.error;
1193	flags = n.flags;
1194
1195interrupted:
1196	/* If there were any pending addfd calls, clear them out */
1197	list_for_each_entry_safe(addfd, tmp, &n.addfd, list) {
1198		/* The process went away before we got a chance to handle it */
1199		addfd->ret = -ESRCH;
1200		list_del_init(&addfd->list);
1201		complete(&addfd->completion);
1202	}
1203
1204	/*
1205	 * Note that it's possible the listener died in between the time when
1206	 * we were notified of a response (or a signal) and when we were able to
1207	 * re-acquire the lock, so only delete from the list if the
1208	 * notification actually exists.
1209	 *
1210	 * Also note that this test is only valid because there's no way to
1211	 * *reattach* to a notifier right now. If one is added, we'll need to
1212	 * keep track of the notif itself and make sure they match here.
1213	 */
1214	if (match->notif)
1215		list_del(&n.list);
1216out:
1217	mutex_unlock(&match->notify_lock);
1218
1219	/* Userspace requests to continue the syscall. */
1220	if (flags & SECCOMP_USER_NOTIF_FLAG_CONTINUE)
1221		return 0;
1222
1223	syscall_set_return_value(current, current_pt_regs(),
1224				 err, ret);
1225	return -1;
1226}
1227
1228static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
1229			    const bool recheck_after_trace)
1230{
1231	u32 filter_ret, action;
1232	struct seccomp_filter *match = NULL;
1233	int data;
1234	struct seccomp_data sd_local;
1235
1236	/*
1237	 * Make sure that any changes to mode from another thread have
1238	 * been seen after SYSCALL_WORK_SECCOMP was seen.
1239	 */
1240	smp_rmb();
1241
1242	if (!sd) {
1243		populate_seccomp_data(&sd_local);
1244		sd = &sd_local;
1245	}
1246
1247	filter_ret = seccomp_run_filters(sd, &match);
1248	data = filter_ret & SECCOMP_RET_DATA;
1249	action = filter_ret & SECCOMP_RET_ACTION_FULL;
1250
1251	switch (action) {
1252	case SECCOMP_RET_ERRNO:
1253		/* Set low-order bits as an errno, capped at MAX_ERRNO. */
1254		if (data > MAX_ERRNO)
1255			data = MAX_ERRNO;
1256		syscall_set_return_value(current, current_pt_regs(),
1257					 -data, 0);
1258		goto skip;
1259
1260	case SECCOMP_RET_TRAP:
1261		/* Show the handler the original registers. */
1262		syscall_rollback(current, current_pt_regs());
1263		/* Let the filter pass back 16 bits of data. */
1264		force_sig_seccomp(this_syscall, data, false);
1265		goto skip;
1266
1267	case SECCOMP_RET_TRACE:
1268		/* We've been put in this state by the ptracer already. */
1269		if (recheck_after_trace)
1270			return 0;
1271
1272		/* ENOSYS these calls if there is no tracer attached. */
1273		if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP)) {
1274			syscall_set_return_value(current,
1275						 current_pt_regs(),
1276						 -ENOSYS, 0);
1277			goto skip;
1278		}
1279
1280		/* Allow the BPF to provide the event message */
1281		ptrace_event(PTRACE_EVENT_SECCOMP, data);
1282		/*
1283		 * The delivery of a fatal signal during event
1284		 * notification may silently skip tracer notification,
1285		 * which could leave us with a potentially unmodified
1286		 * syscall that the tracer would have liked to have
1287		 * changed. Since the process is about to die, we just
1288		 * force the syscall to be skipped and let the signal
1289		 * kill the process and correctly handle any tracer exit
1290		 * notifications.
1291		 */
1292		if (fatal_signal_pending(current))
1293			goto skip;
1294		/* Check if the tracer forced the syscall to be skipped. */
1295		this_syscall = syscall_get_nr(current, current_pt_regs());
1296		if (this_syscall < 0)
1297			goto skip;
1298
1299		/*
1300		 * Recheck the syscall, since it may have changed. This
1301		 * intentionally uses a NULL struct seccomp_data to force
1302		 * a reload of all registers. This does not goto skip since
1303		 * a skip would have already been reported.
1304		 */
1305		if (__seccomp_filter(this_syscall, NULL, true))
1306			return -1;
1307
1308		return 0;
1309
1310	case SECCOMP_RET_USER_NOTIF:
1311		if (seccomp_do_user_notification(this_syscall, match, sd))
1312			goto skip;
1313
1314		return 0;
1315
1316	case SECCOMP_RET_LOG:
1317		seccomp_log(this_syscall, 0, action, true);
1318		return 0;
1319
1320	case SECCOMP_RET_ALLOW:
1321		/*
1322		 * Note that the "match" filter will always be NULL for
1323		 * this action since SECCOMP_RET_ALLOW is the starting
1324		 * state in seccomp_run_filters().
1325		 */
1326		return 0;
1327
1328	case SECCOMP_RET_KILL_THREAD:
1329	case SECCOMP_RET_KILL_PROCESS:
1330	default:
1331		current->seccomp.mode = SECCOMP_MODE_DEAD;
1332		seccomp_log(this_syscall, SIGSYS, action, true);
1333		/* Dump core only if this is the last remaining thread. */
1334		if (action != SECCOMP_RET_KILL_THREAD ||
1335		    (atomic_read(&current->signal->live) == 1)) {
 
 
1336			/* Show the original registers in the dump. */
1337			syscall_rollback(current, current_pt_regs());
1338			/* Trigger a coredump with SIGSYS */
1339			force_sig_seccomp(this_syscall, data, true);
1340		} else {
1341			do_exit(SIGSYS);
1342		}
1343		return -1; /* skip the syscall go directly to signal handling */
 
 
 
1344	}
1345
1346	unreachable();
1347
1348skip:
1349	seccomp_log(this_syscall, 0, action, match ? match->log : false);
1350	return -1;
1351}
1352#else
1353static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
1354			    const bool recheck_after_trace)
1355{
1356	BUG();
1357
1358	return -1;
1359}
1360#endif
1361
1362int __secure_computing(const struct seccomp_data *sd)
1363{
1364	int mode = current->seccomp.mode;
1365	int this_syscall;
1366
1367	if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) &&
1368	    unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
1369		return 0;
1370
1371	this_syscall = sd ? sd->nr :
1372		syscall_get_nr(current, current_pt_regs());
1373
1374	switch (mode) {
1375	case SECCOMP_MODE_STRICT:
1376		__secure_computing_strict(this_syscall);  /* may call do_exit */
1377		return 0;
1378	case SECCOMP_MODE_FILTER:
1379		return __seccomp_filter(this_syscall, sd, false);
1380	/* Surviving SECCOMP_RET_KILL_* must be proactively impossible. */
1381	case SECCOMP_MODE_DEAD:
1382		WARN_ON_ONCE(1);
1383		do_exit(SIGKILL);
1384		return -1;
1385	default:
1386		BUG();
1387	}
1388}
1389#endif /* CONFIG_HAVE_ARCH_SECCOMP_FILTER */
1390
1391long prctl_get_seccomp(void)
1392{
1393	return current->seccomp.mode;
1394}
1395
1396/**
1397 * seccomp_set_mode_strict: internal function for setting strict seccomp
1398 *
1399 * Once current->seccomp.mode is non-zero, it may not be changed.
1400 *
1401 * Returns 0 on success or -EINVAL on failure.
1402 */
1403static long seccomp_set_mode_strict(void)
1404{
1405	const unsigned long seccomp_mode = SECCOMP_MODE_STRICT;
1406	long ret = -EINVAL;
1407
1408	spin_lock_irq(&current->sighand->siglock);
1409
1410	if (!seccomp_may_assign_mode(seccomp_mode))
1411		goto out;
1412
1413#ifdef TIF_NOTSC
1414	disable_TSC();
1415#endif
1416	seccomp_assign_mode(current, seccomp_mode, 0);
1417	ret = 0;
1418
1419out:
1420	spin_unlock_irq(&current->sighand->siglock);
1421
1422	return ret;
1423}
1424
1425#ifdef CONFIG_SECCOMP_FILTER
1426static void seccomp_notify_free(struct seccomp_filter *filter)
1427{
1428	kfree(filter->notif);
1429	filter->notif = NULL;
1430}
1431
1432static void seccomp_notify_detach(struct seccomp_filter *filter)
1433{
1434	struct seccomp_knotif *knotif;
1435
1436	if (!filter)
1437		return;
1438
1439	mutex_lock(&filter->notify_lock);
1440
1441	/*
1442	 * If this file is being closed because e.g. the task who owned it
1443	 * died, let's wake everyone up who was waiting on us.
1444	 */
1445	list_for_each_entry(knotif, &filter->notif->notifications, list) {
1446		if (knotif->state == SECCOMP_NOTIFY_REPLIED)
1447			continue;
1448
1449		knotif->state = SECCOMP_NOTIFY_REPLIED;
1450		knotif->error = -ENOSYS;
1451		knotif->val = 0;
1452
1453		/*
1454		 * We do not need to wake up any pending addfd messages, as
1455		 * the notifier will do that for us, as this just looks
1456		 * like a standard reply.
1457		 */
1458		complete(&knotif->ready);
1459	}
1460
1461	seccomp_notify_free(filter);
1462	mutex_unlock(&filter->notify_lock);
1463}
1464
1465static int seccomp_notify_release(struct inode *inode, struct file *file)
1466{
1467	struct seccomp_filter *filter = file->private_data;
1468
1469	seccomp_notify_detach(filter);
1470	__put_seccomp_filter(filter);
1471	return 0;
1472}
1473
1474/* must be called with notif_lock held */
1475static inline struct seccomp_knotif *
1476find_notification(struct seccomp_filter *filter, u64 id)
1477{
1478	struct seccomp_knotif *cur;
1479
1480	lockdep_assert_held(&filter->notify_lock);
1481
1482	list_for_each_entry(cur, &filter->notif->notifications, list) {
1483		if (cur->id == id)
1484			return cur;
1485	}
1486
1487	return NULL;
1488}
1489
1490static int recv_wake_function(wait_queue_entry_t *wait, unsigned int mode, int sync,
1491				  void *key)
1492{
1493	/* Avoid a wakeup if event not interesting for us. */
1494	if (key && !(key_to_poll(key) & (EPOLLIN | EPOLLERR | EPOLLHUP)))
1495		return 0;
1496	return autoremove_wake_function(wait, mode, sync, key);
1497}
1498
1499static int recv_wait_event(struct seccomp_filter *filter)
1500{
1501	DEFINE_WAIT_FUNC(wait, recv_wake_function);
1502	int ret;
1503
1504	if (refcount_read(&filter->users) == 0)
1505		return 0;
1506
1507	if (atomic_dec_if_positive(&filter->notif->requests) >= 0)
1508		return 0;
1509
1510	for (;;) {
1511		ret = prepare_to_wait_event(&filter->wqh, &wait, TASK_INTERRUPTIBLE);
1512
1513		if (atomic_dec_if_positive(&filter->notif->requests) >= 0)
1514			break;
1515		if (refcount_read(&filter->users) == 0)
1516			break;
1517
1518		if (ret)
1519			return ret;
1520
1521		schedule();
1522	}
1523	finish_wait(&filter->wqh, &wait);
1524	return 0;
1525}
1526
1527static long seccomp_notify_recv(struct seccomp_filter *filter,
1528				void __user *buf)
1529{
1530	struct seccomp_knotif *knotif = NULL, *cur;
1531	struct seccomp_notif unotif;
1532	ssize_t ret;
1533
1534	/* Verify that we're not given garbage to keep struct extensible. */
1535	ret = check_zeroed_user(buf, sizeof(unotif));
1536	if (ret < 0)
1537		return ret;
1538	if (!ret)
1539		return -EINVAL;
1540
1541	memset(&unotif, 0, sizeof(unotif));
1542
1543	ret = recv_wait_event(filter);
1544	if (ret < 0)
1545		return ret;
1546
1547	mutex_lock(&filter->notify_lock);
1548	list_for_each_entry(cur, &filter->notif->notifications, list) {
1549		if (cur->state == SECCOMP_NOTIFY_INIT) {
1550			knotif = cur;
1551			break;
1552		}
1553	}
1554
1555	/*
1556	 * If we didn't find a notification, it could be that the task was
1557	 * interrupted by a fatal signal between the time we were woken and
1558	 * when we were able to acquire the rw lock.
1559	 */
1560	if (!knotif) {
1561		ret = -ENOENT;
1562		goto out;
1563	}
1564
1565	unotif.id = knotif->id;
1566	unotif.pid = task_pid_vnr(knotif->task);
1567	unotif.data = *(knotif->data);
1568
1569	knotif->state = SECCOMP_NOTIFY_SENT;
1570	wake_up_poll(&filter->wqh, EPOLLOUT | EPOLLWRNORM);
1571	ret = 0;
1572out:
1573	mutex_unlock(&filter->notify_lock);
1574
1575	if (ret == 0 && copy_to_user(buf, &unotif, sizeof(unotif))) {
1576		ret = -EFAULT;
1577
1578		/*
1579		 * Userspace screwed up. To make sure that we keep this
1580		 * notification alive, let's reset it back to INIT. It
1581		 * may have died when we released the lock, so we need to make
1582		 * sure it's still around.
1583		 */
1584		mutex_lock(&filter->notify_lock);
1585		knotif = find_notification(filter, unotif.id);
1586		if (knotif) {
1587			/* Reset the process to make sure it's not stuck */
1588			if (should_sleep_killable(filter, knotif))
1589				complete(&knotif->ready);
1590			knotif->state = SECCOMP_NOTIFY_INIT;
1591			atomic_inc(&filter->notif->requests);
1592			wake_up_poll(&filter->wqh, EPOLLIN | EPOLLRDNORM);
1593		}
1594		mutex_unlock(&filter->notify_lock);
1595	}
1596
1597	return ret;
1598}
1599
1600static long seccomp_notify_send(struct seccomp_filter *filter,
1601				void __user *buf)
1602{
1603	struct seccomp_notif_resp resp = {};
1604	struct seccomp_knotif *knotif;
1605	long ret;
1606
1607	if (copy_from_user(&resp, buf, sizeof(resp)))
1608		return -EFAULT;
1609
1610	if (resp.flags & ~SECCOMP_USER_NOTIF_FLAG_CONTINUE)
1611		return -EINVAL;
1612
1613	if ((resp.flags & SECCOMP_USER_NOTIF_FLAG_CONTINUE) &&
1614	    (resp.error || resp.val))
1615		return -EINVAL;
1616
1617	ret = mutex_lock_interruptible(&filter->notify_lock);
1618	if (ret < 0)
1619		return ret;
1620
1621	knotif = find_notification(filter, resp.id);
1622	if (!knotif) {
1623		ret = -ENOENT;
1624		goto out;
1625	}
1626
1627	/* Allow exactly one reply. */
1628	if (knotif->state != SECCOMP_NOTIFY_SENT) {
1629		ret = -EINPROGRESS;
1630		goto out;
1631	}
1632
1633	ret = 0;
1634	knotif->state = SECCOMP_NOTIFY_REPLIED;
1635	knotif->error = resp.error;
1636	knotif->val = resp.val;
1637	knotif->flags = resp.flags;
1638	if (filter->notif->flags & SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP)
1639		complete_on_current_cpu(&knotif->ready);
1640	else
1641		complete(&knotif->ready);
1642out:
1643	mutex_unlock(&filter->notify_lock);
1644	return ret;
1645}
1646
1647static long seccomp_notify_id_valid(struct seccomp_filter *filter,
1648				    void __user *buf)
1649{
1650	struct seccomp_knotif *knotif;
1651	u64 id;
1652	long ret;
1653
1654	if (copy_from_user(&id, buf, sizeof(id)))
1655		return -EFAULT;
1656
1657	ret = mutex_lock_interruptible(&filter->notify_lock);
1658	if (ret < 0)
1659		return ret;
1660
1661	knotif = find_notification(filter, id);
1662	if (knotif && knotif->state == SECCOMP_NOTIFY_SENT)
1663		ret = 0;
1664	else
1665		ret = -ENOENT;
1666
1667	mutex_unlock(&filter->notify_lock);
1668	return ret;
1669}
1670
1671static long seccomp_notify_set_flags(struct seccomp_filter *filter,
1672				    unsigned long flags)
1673{
1674	long ret;
1675
1676	if (flags & ~SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP)
1677		return -EINVAL;
1678
1679	ret = mutex_lock_interruptible(&filter->notify_lock);
1680	if (ret < 0)
1681		return ret;
1682	filter->notif->flags = flags;
1683	mutex_unlock(&filter->notify_lock);
1684	return 0;
1685}
1686
1687static long seccomp_notify_addfd(struct seccomp_filter *filter,
1688				 struct seccomp_notif_addfd __user *uaddfd,
1689				 unsigned int size)
1690{
1691	struct seccomp_notif_addfd addfd;
1692	struct seccomp_knotif *knotif;
1693	struct seccomp_kaddfd kaddfd;
1694	int ret;
1695
1696	BUILD_BUG_ON(sizeof(addfd) < SECCOMP_NOTIFY_ADDFD_SIZE_VER0);
1697	BUILD_BUG_ON(sizeof(addfd) != SECCOMP_NOTIFY_ADDFD_SIZE_LATEST);
1698
1699	if (size < SECCOMP_NOTIFY_ADDFD_SIZE_VER0 || size >= PAGE_SIZE)
1700		return -EINVAL;
1701
1702	ret = copy_struct_from_user(&addfd, sizeof(addfd), uaddfd, size);
1703	if (ret)
1704		return ret;
1705
1706	if (addfd.newfd_flags & ~O_CLOEXEC)
1707		return -EINVAL;
1708
1709	if (addfd.flags & ~(SECCOMP_ADDFD_FLAG_SETFD | SECCOMP_ADDFD_FLAG_SEND))
1710		return -EINVAL;
1711
1712	if (addfd.newfd && !(addfd.flags & SECCOMP_ADDFD_FLAG_SETFD))
1713		return -EINVAL;
1714
1715	kaddfd.file = fget(addfd.srcfd);
1716	if (!kaddfd.file)
1717		return -EBADF;
1718
1719	kaddfd.ioctl_flags = addfd.flags;
1720	kaddfd.flags = addfd.newfd_flags;
1721	kaddfd.setfd = addfd.flags & SECCOMP_ADDFD_FLAG_SETFD;
1722	kaddfd.fd = addfd.newfd;
1723	init_completion(&kaddfd.completion);
1724
1725	ret = mutex_lock_interruptible(&filter->notify_lock);
1726	if (ret < 0)
1727		goto out;
1728
1729	knotif = find_notification(filter, addfd.id);
1730	if (!knotif) {
1731		ret = -ENOENT;
1732		goto out_unlock;
1733	}
1734
1735	/*
1736	 * We do not want to allow for FD injection to occur before the
1737	 * notification has been picked up by a userspace handler, or after
1738	 * the notification has been replied to.
1739	 */
1740	if (knotif->state != SECCOMP_NOTIFY_SENT) {
1741		ret = -EINPROGRESS;
1742		goto out_unlock;
1743	}
1744
1745	if (addfd.flags & SECCOMP_ADDFD_FLAG_SEND) {
1746		/*
1747		 * Disallow queuing an atomic addfd + send reply while there are
1748		 * some addfd requests still to process.
1749		 *
1750		 * There is no clear reason to support it and allows us to keep
1751		 * the loop on the other side straight-forward.
1752		 */
1753		if (!list_empty(&knotif->addfd)) {
1754			ret = -EBUSY;
1755			goto out_unlock;
1756		}
1757
1758		/* Allow exactly only one reply */
1759		knotif->state = SECCOMP_NOTIFY_REPLIED;
1760	}
1761
1762	list_add(&kaddfd.list, &knotif->addfd);
1763	complete(&knotif->ready);
1764	mutex_unlock(&filter->notify_lock);
1765
1766	/* Now we wait for it to be processed or be interrupted */
1767	ret = wait_for_completion_interruptible(&kaddfd.completion);
1768	if (ret == 0) {
1769		/*
1770		 * We had a successful completion. The other side has already
1771		 * removed us from the addfd queue, and
1772		 * wait_for_completion_interruptible has a memory barrier upon
1773		 * success that lets us read this value directly without
1774		 * locking.
1775		 */
1776		ret = kaddfd.ret;
1777		goto out;
1778	}
1779
1780	mutex_lock(&filter->notify_lock);
1781	/*
1782	 * Even though we were woken up by a signal and not a successful
1783	 * completion, a completion may have happened in the mean time.
1784	 *
1785	 * We need to check again if the addfd request has been handled,
1786	 * and if not, we will remove it from the queue.
1787	 */
1788	if (list_empty(&kaddfd.list))
1789		ret = kaddfd.ret;
1790	else
1791		list_del(&kaddfd.list);
1792
1793out_unlock:
1794	mutex_unlock(&filter->notify_lock);
1795out:
1796	fput(kaddfd.file);
1797
1798	return ret;
1799}
1800
1801static long seccomp_notify_ioctl(struct file *file, unsigned int cmd,
1802				 unsigned long arg)
1803{
1804	struct seccomp_filter *filter = file->private_data;
1805	void __user *buf = (void __user *)arg;
1806
1807	/* Fixed-size ioctls */
1808	switch (cmd) {
1809	case SECCOMP_IOCTL_NOTIF_RECV:
1810		return seccomp_notify_recv(filter, buf);
1811	case SECCOMP_IOCTL_NOTIF_SEND:
1812		return seccomp_notify_send(filter, buf);
1813	case SECCOMP_IOCTL_NOTIF_ID_VALID_WRONG_DIR:
1814	case SECCOMP_IOCTL_NOTIF_ID_VALID:
1815		return seccomp_notify_id_valid(filter, buf);
1816	case SECCOMP_IOCTL_NOTIF_SET_FLAGS:
1817		return seccomp_notify_set_flags(filter, arg);
1818	}
1819
1820	/* Extensible Argument ioctls */
1821#define EA_IOCTL(cmd)	((cmd) & ~(IOC_INOUT | IOCSIZE_MASK))
1822	switch (EA_IOCTL(cmd)) {
1823	case EA_IOCTL(SECCOMP_IOCTL_NOTIF_ADDFD):
1824		return seccomp_notify_addfd(filter, buf, _IOC_SIZE(cmd));
1825	default:
1826		return -EINVAL;
1827	}
1828}
1829
1830static __poll_t seccomp_notify_poll(struct file *file,
1831				    struct poll_table_struct *poll_tab)
1832{
1833	struct seccomp_filter *filter = file->private_data;
1834	__poll_t ret = 0;
1835	struct seccomp_knotif *cur;
1836
1837	poll_wait(file, &filter->wqh, poll_tab);
1838
1839	if (mutex_lock_interruptible(&filter->notify_lock) < 0)
1840		return EPOLLERR;
1841
1842	list_for_each_entry(cur, &filter->notif->notifications, list) {
1843		if (cur->state == SECCOMP_NOTIFY_INIT)
1844			ret |= EPOLLIN | EPOLLRDNORM;
1845		if (cur->state == SECCOMP_NOTIFY_SENT)
1846			ret |= EPOLLOUT | EPOLLWRNORM;
1847		if ((ret & EPOLLIN) && (ret & EPOLLOUT))
1848			break;
1849	}
1850
1851	mutex_unlock(&filter->notify_lock);
1852
1853	if (refcount_read(&filter->users) == 0)
1854		ret |= EPOLLHUP;
1855
1856	return ret;
1857}
1858
1859static const struct file_operations seccomp_notify_ops = {
1860	.poll = seccomp_notify_poll,
1861	.release = seccomp_notify_release,
1862	.unlocked_ioctl = seccomp_notify_ioctl,
1863	.compat_ioctl = seccomp_notify_ioctl,
1864};
1865
1866static struct file *init_listener(struct seccomp_filter *filter)
1867{
1868	struct file *ret;
1869
1870	ret = ERR_PTR(-ENOMEM);
1871	filter->notif = kzalloc(sizeof(*(filter->notif)), GFP_KERNEL);
1872	if (!filter->notif)
1873		goto out;
1874
 
1875	filter->notif->next_id = get_random_u64();
1876	INIT_LIST_HEAD(&filter->notif->notifications);
1877
1878	ret = anon_inode_getfile("seccomp notify", &seccomp_notify_ops,
1879				 filter, O_RDWR);
1880	if (IS_ERR(ret))
1881		goto out_notif;
1882
1883	/* The file has a reference to it now */
1884	__get_seccomp_filter(filter);
1885
1886out_notif:
1887	if (IS_ERR(ret))
1888		seccomp_notify_free(filter);
1889out:
1890	return ret;
1891}
1892
1893/*
1894 * Does @new_child have a listener while an ancestor also has a listener?
1895 * If so, we'll want to reject this filter.
1896 * This only has to be tested for the current process, even in the TSYNC case,
1897 * because TSYNC installs @child with the same parent on all threads.
1898 * Note that @new_child is not hooked up to its parent at this point yet, so
1899 * we use current->seccomp.filter.
1900 */
1901static bool has_duplicate_listener(struct seccomp_filter *new_child)
1902{
1903	struct seccomp_filter *cur;
1904
1905	/* must be protected against concurrent TSYNC */
1906	lockdep_assert_held(&current->sighand->siglock);
1907
1908	if (!new_child->notif)
1909		return false;
1910	for (cur = current->seccomp.filter; cur; cur = cur->prev) {
1911		if (cur->notif)
1912			return true;
1913	}
1914
1915	return false;
1916}
1917
1918/**
1919 * seccomp_set_mode_filter: internal function for setting seccomp filter
1920 * @flags:  flags to change filter behavior
1921 * @filter: struct sock_fprog containing filter
1922 *
1923 * This function may be called repeatedly to install additional filters.
1924 * Every filter successfully installed will be evaluated (in reverse order)
1925 * for each system call the task makes.
1926 *
1927 * Once current->seccomp.mode is non-zero, it may not be changed.
1928 *
1929 * Returns 0 on success or -EINVAL on failure.
1930 */
1931static long seccomp_set_mode_filter(unsigned int flags,
1932				    const char __user *filter)
1933{
1934	const unsigned long seccomp_mode = SECCOMP_MODE_FILTER;
1935	struct seccomp_filter *prepared = NULL;
1936	long ret = -EINVAL;
1937	int listener = -1;
1938	struct file *listener_f = NULL;
1939
1940	/* Validate flags. */
1941	if (flags & ~SECCOMP_FILTER_FLAG_MASK)
1942		return -EINVAL;
1943
1944	/*
1945	 * In the successful case, NEW_LISTENER returns the new listener fd.
1946	 * But in the failure case, TSYNC returns the thread that died. If you
1947	 * combine these two flags, there's no way to tell whether something
1948	 * succeeded or failed. So, let's disallow this combination if the user
1949	 * has not explicitly requested no errors from TSYNC.
1950	 */
1951	if ((flags & SECCOMP_FILTER_FLAG_TSYNC) &&
1952	    (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) &&
1953	    ((flags & SECCOMP_FILTER_FLAG_TSYNC_ESRCH) == 0))
1954		return -EINVAL;
1955
1956	/*
1957	 * The SECCOMP_FILTER_FLAG_WAIT_KILLABLE_SENT flag doesn't make sense
1958	 * without the SECCOMP_FILTER_FLAG_NEW_LISTENER flag.
1959	 */
1960	if ((flags & SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV) &&
1961	    ((flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) == 0))
1962		return -EINVAL;
1963
1964	/* Prepare the new filter before holding any locks. */
1965	prepared = seccomp_prepare_user_filter(filter);
1966	if (IS_ERR(prepared))
1967		return PTR_ERR(prepared);
1968
1969	if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) {
1970		listener = get_unused_fd_flags(O_CLOEXEC);
1971		if (listener < 0) {
1972			ret = listener;
1973			goto out_free;
1974		}
1975
1976		listener_f = init_listener(prepared);
1977		if (IS_ERR(listener_f)) {
1978			put_unused_fd(listener);
1979			ret = PTR_ERR(listener_f);
1980			goto out_free;
1981		}
1982	}
1983
1984	/*
1985	 * Make sure we cannot change seccomp or nnp state via TSYNC
1986	 * while another thread is in the middle of calling exec.
1987	 */
1988	if (flags & SECCOMP_FILTER_FLAG_TSYNC &&
1989	    mutex_lock_killable(&current->signal->cred_guard_mutex))
1990		goto out_put_fd;
1991
1992	spin_lock_irq(&current->sighand->siglock);
1993
1994	if (!seccomp_may_assign_mode(seccomp_mode))
1995		goto out;
1996
1997	if (has_duplicate_listener(prepared)) {
1998		ret = -EBUSY;
1999		goto out;
2000	}
2001
2002	ret = seccomp_attach_filter(flags, prepared);
2003	if (ret)
2004		goto out;
2005	/* Do not free the successfully attached filter. */
2006	prepared = NULL;
2007
2008	seccomp_assign_mode(current, seccomp_mode, flags);
2009out:
2010	spin_unlock_irq(&current->sighand->siglock);
2011	if (flags & SECCOMP_FILTER_FLAG_TSYNC)
2012		mutex_unlock(&current->signal->cred_guard_mutex);
2013out_put_fd:
2014	if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) {
2015		if (ret) {
2016			listener_f->private_data = NULL;
2017			fput(listener_f);
2018			put_unused_fd(listener);
2019			seccomp_notify_detach(prepared);
2020		} else {
2021			fd_install(listener, listener_f);
2022			ret = listener;
2023		}
2024	}
2025out_free:
2026	seccomp_filter_free(prepared);
2027	return ret;
2028}
2029#else
2030static inline long seccomp_set_mode_filter(unsigned int flags,
2031					   const char __user *filter)
2032{
2033	return -EINVAL;
2034}
2035#endif
2036
2037static long seccomp_get_action_avail(const char __user *uaction)
2038{
2039	u32 action;
2040
2041	if (copy_from_user(&action, uaction, sizeof(action)))
2042		return -EFAULT;
2043
2044	switch (action) {
2045	case SECCOMP_RET_KILL_PROCESS:
2046	case SECCOMP_RET_KILL_THREAD:
2047	case SECCOMP_RET_TRAP:
2048	case SECCOMP_RET_ERRNO:
2049	case SECCOMP_RET_USER_NOTIF:
2050	case SECCOMP_RET_TRACE:
2051	case SECCOMP_RET_LOG:
2052	case SECCOMP_RET_ALLOW:
2053		break;
2054	default:
2055		return -EOPNOTSUPP;
2056	}
2057
2058	return 0;
2059}
2060
2061static long seccomp_get_notif_sizes(void __user *usizes)
2062{
2063	struct seccomp_notif_sizes sizes = {
2064		.seccomp_notif = sizeof(struct seccomp_notif),
2065		.seccomp_notif_resp = sizeof(struct seccomp_notif_resp),
2066		.seccomp_data = sizeof(struct seccomp_data),
2067	};
2068
2069	if (copy_to_user(usizes, &sizes, sizeof(sizes)))
2070		return -EFAULT;
2071
2072	return 0;
2073}
2074
2075/* Common entry point for both prctl and syscall. */
2076static long do_seccomp(unsigned int op, unsigned int flags,
2077		       void __user *uargs)
2078{
2079	switch (op) {
2080	case SECCOMP_SET_MODE_STRICT:
2081		if (flags != 0 || uargs != NULL)
2082			return -EINVAL;
2083		return seccomp_set_mode_strict();
2084	case SECCOMP_SET_MODE_FILTER:
2085		return seccomp_set_mode_filter(flags, uargs);
2086	case SECCOMP_GET_ACTION_AVAIL:
2087		if (flags != 0)
2088			return -EINVAL;
2089
2090		return seccomp_get_action_avail(uargs);
2091	case SECCOMP_GET_NOTIF_SIZES:
2092		if (flags != 0)
2093			return -EINVAL;
2094
2095		return seccomp_get_notif_sizes(uargs);
2096	default:
2097		return -EINVAL;
2098	}
2099}
2100
2101SYSCALL_DEFINE3(seccomp, unsigned int, op, unsigned int, flags,
2102			 void __user *, uargs)
2103{
2104	return do_seccomp(op, flags, uargs);
2105}
2106
2107/**
2108 * prctl_set_seccomp: configures current->seccomp.mode
2109 * @seccomp_mode: requested mode to use
2110 * @filter: optional struct sock_fprog for use with SECCOMP_MODE_FILTER
2111 *
2112 * Returns 0 on success or -EINVAL on failure.
2113 */
2114long prctl_set_seccomp(unsigned long seccomp_mode, void __user *filter)
2115{
2116	unsigned int op;
2117	void __user *uargs;
2118
2119	switch (seccomp_mode) {
2120	case SECCOMP_MODE_STRICT:
2121		op = SECCOMP_SET_MODE_STRICT;
2122		/*
2123		 * Setting strict mode through prctl always ignored filter,
2124		 * so make sure it is always NULL here to pass the internal
2125		 * check in do_seccomp().
2126		 */
2127		uargs = NULL;
2128		break;
2129	case SECCOMP_MODE_FILTER:
2130		op = SECCOMP_SET_MODE_FILTER;
2131		uargs = filter;
2132		break;
2133	default:
2134		return -EINVAL;
2135	}
2136
2137	/* prctl interface doesn't have flags, so they are always zero. */
2138	return do_seccomp(op, 0, uargs);
2139}
2140
2141#if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
2142static struct seccomp_filter *get_nth_filter(struct task_struct *task,
2143					     unsigned long filter_off)
2144{
2145	struct seccomp_filter *orig, *filter;
2146	unsigned long count;
2147
2148	/*
2149	 * Note: this is only correct because the caller should be the (ptrace)
2150	 * tracer of the task, otherwise lock_task_sighand is needed.
2151	 */
2152	spin_lock_irq(&task->sighand->siglock);
2153
2154	if (task->seccomp.mode != SECCOMP_MODE_FILTER) {
2155		spin_unlock_irq(&task->sighand->siglock);
2156		return ERR_PTR(-EINVAL);
2157	}
2158
2159	orig = task->seccomp.filter;
2160	__get_seccomp_filter(orig);
2161	spin_unlock_irq(&task->sighand->siglock);
2162
2163	count = 0;
2164	for (filter = orig; filter; filter = filter->prev)
2165		count++;
2166
2167	if (filter_off >= count) {
2168		filter = ERR_PTR(-ENOENT);
2169		goto out;
2170	}
2171
2172	count -= filter_off;
2173	for (filter = orig; filter && count > 1; filter = filter->prev)
2174		count--;
2175
2176	if (WARN_ON(count != 1 || !filter)) {
2177		filter = ERR_PTR(-ENOENT);
2178		goto out;
2179	}
2180
2181	__get_seccomp_filter(filter);
2182
2183out:
2184	__put_seccomp_filter(orig);
2185	return filter;
2186}
2187
2188long seccomp_get_filter(struct task_struct *task, unsigned long filter_off,
2189			void __user *data)
2190{
2191	struct seccomp_filter *filter;
2192	struct sock_fprog_kern *fprog;
2193	long ret;
2194
2195	if (!capable(CAP_SYS_ADMIN) ||
2196	    current->seccomp.mode != SECCOMP_MODE_DISABLED) {
2197		return -EACCES;
2198	}
2199
2200	filter = get_nth_filter(task, filter_off);
2201	if (IS_ERR(filter))
2202		return PTR_ERR(filter);
2203
2204	fprog = filter->prog->orig_prog;
2205	if (!fprog) {
2206		/* This must be a new non-cBPF filter, since we save
2207		 * every cBPF filter's orig_prog above when
2208		 * CONFIG_CHECKPOINT_RESTORE is enabled.
2209		 */
2210		ret = -EMEDIUMTYPE;
2211		goto out;
2212	}
2213
2214	ret = fprog->len;
2215	if (!data)
2216		goto out;
2217
2218	if (copy_to_user(data, fprog->filter, bpf_classic_proglen(fprog)))
2219		ret = -EFAULT;
2220
2221out:
2222	__put_seccomp_filter(filter);
2223	return ret;
2224}
2225
2226long seccomp_get_metadata(struct task_struct *task,
2227			  unsigned long size, void __user *data)
2228{
2229	long ret;
2230	struct seccomp_filter *filter;
2231	struct seccomp_metadata kmd = {};
2232
2233	if (!capable(CAP_SYS_ADMIN) ||
2234	    current->seccomp.mode != SECCOMP_MODE_DISABLED) {
2235		return -EACCES;
2236	}
2237
2238	size = min_t(unsigned long, size, sizeof(kmd));
2239
2240	if (size < sizeof(kmd.filter_off))
2241		return -EINVAL;
2242
2243	if (copy_from_user(&kmd.filter_off, data, sizeof(kmd.filter_off)))
2244		return -EFAULT;
2245
2246	filter = get_nth_filter(task, kmd.filter_off);
2247	if (IS_ERR(filter))
2248		return PTR_ERR(filter);
2249
2250	if (filter->log)
2251		kmd.flags |= SECCOMP_FILTER_FLAG_LOG;
2252
2253	ret = size;
2254	if (copy_to_user(data, &kmd, size))
2255		ret = -EFAULT;
2256
2257	__put_seccomp_filter(filter);
2258	return ret;
2259}
2260#endif
2261
2262#ifdef CONFIG_SYSCTL
2263
2264/* Human readable action names for friendly sysctl interaction */
2265#define SECCOMP_RET_KILL_PROCESS_NAME	"kill_process"
2266#define SECCOMP_RET_KILL_THREAD_NAME	"kill_thread"
2267#define SECCOMP_RET_TRAP_NAME		"trap"
2268#define SECCOMP_RET_ERRNO_NAME		"errno"
2269#define SECCOMP_RET_USER_NOTIF_NAME	"user_notif"
2270#define SECCOMP_RET_TRACE_NAME		"trace"
2271#define SECCOMP_RET_LOG_NAME		"log"
2272#define SECCOMP_RET_ALLOW_NAME		"allow"
2273
2274static const char seccomp_actions_avail[] =
2275				SECCOMP_RET_KILL_PROCESS_NAME	" "
2276				SECCOMP_RET_KILL_THREAD_NAME	" "
2277				SECCOMP_RET_TRAP_NAME		" "
2278				SECCOMP_RET_ERRNO_NAME		" "
2279				SECCOMP_RET_USER_NOTIF_NAME     " "
2280				SECCOMP_RET_TRACE_NAME		" "
2281				SECCOMP_RET_LOG_NAME		" "
2282				SECCOMP_RET_ALLOW_NAME;
2283
2284struct seccomp_log_name {
2285	u32		log;
2286	const char	*name;
2287};
2288
2289static const struct seccomp_log_name seccomp_log_names[] = {
2290	{ SECCOMP_LOG_KILL_PROCESS, SECCOMP_RET_KILL_PROCESS_NAME },
2291	{ SECCOMP_LOG_KILL_THREAD, SECCOMP_RET_KILL_THREAD_NAME },
2292	{ SECCOMP_LOG_TRAP, SECCOMP_RET_TRAP_NAME },
2293	{ SECCOMP_LOG_ERRNO, SECCOMP_RET_ERRNO_NAME },
2294	{ SECCOMP_LOG_USER_NOTIF, SECCOMP_RET_USER_NOTIF_NAME },
2295	{ SECCOMP_LOG_TRACE, SECCOMP_RET_TRACE_NAME },
2296	{ SECCOMP_LOG_LOG, SECCOMP_RET_LOG_NAME },
2297	{ SECCOMP_LOG_ALLOW, SECCOMP_RET_ALLOW_NAME },
2298	{ }
2299};
2300
2301static bool seccomp_names_from_actions_logged(char *names, size_t size,
2302					      u32 actions_logged,
2303					      const char *sep)
2304{
2305	const struct seccomp_log_name *cur;
2306	bool append_sep = false;
2307
2308	for (cur = seccomp_log_names; cur->name && size; cur++) {
2309		ssize_t ret;
2310
2311		if (!(actions_logged & cur->log))
2312			continue;
2313
2314		if (append_sep) {
2315			ret = strscpy(names, sep, size);
2316			if (ret < 0)
2317				return false;
2318
2319			names += ret;
2320			size -= ret;
2321		} else
2322			append_sep = true;
2323
2324		ret = strscpy(names, cur->name, size);
2325		if (ret < 0)
2326			return false;
2327
2328		names += ret;
2329		size -= ret;
2330	}
2331
2332	return true;
2333}
2334
2335static bool seccomp_action_logged_from_name(u32 *action_logged,
2336					    const char *name)
2337{
2338	const struct seccomp_log_name *cur;
2339
2340	for (cur = seccomp_log_names; cur->name; cur++) {
2341		if (!strcmp(cur->name, name)) {
2342			*action_logged = cur->log;
2343			return true;
2344		}
2345	}
2346
2347	return false;
2348}
2349
2350static bool seccomp_actions_logged_from_names(u32 *actions_logged, char *names)
2351{
2352	char *name;
2353
2354	*actions_logged = 0;
2355	while ((name = strsep(&names, " ")) && *name) {
2356		u32 action_logged = 0;
2357
2358		if (!seccomp_action_logged_from_name(&action_logged, name))
2359			return false;
2360
2361		*actions_logged |= action_logged;
2362	}
2363
2364	return true;
2365}
2366
2367static int read_actions_logged(const struct ctl_table *ro_table, void *buffer,
2368			       size_t *lenp, loff_t *ppos)
2369{
2370	char names[sizeof(seccomp_actions_avail)];
2371	struct ctl_table table;
2372
2373	memset(names, 0, sizeof(names));
2374
2375	if (!seccomp_names_from_actions_logged(names, sizeof(names),
2376					       seccomp_actions_logged, " "))
2377		return -EINVAL;
2378
2379	table = *ro_table;
2380	table.data = names;
2381	table.maxlen = sizeof(names);
2382	return proc_dostring(&table, 0, buffer, lenp, ppos);
2383}
2384
2385static int write_actions_logged(const struct ctl_table *ro_table, void *buffer,
2386				size_t *lenp, loff_t *ppos, u32 *actions_logged)
2387{
2388	char names[sizeof(seccomp_actions_avail)];
2389	struct ctl_table table;
2390	int ret;
2391
2392	if (!capable(CAP_SYS_ADMIN))
2393		return -EPERM;
2394
2395	memset(names, 0, sizeof(names));
2396
2397	table = *ro_table;
2398	table.data = names;
2399	table.maxlen = sizeof(names);
2400	ret = proc_dostring(&table, 1, buffer, lenp, ppos);
2401	if (ret)
2402		return ret;
2403
2404	if (!seccomp_actions_logged_from_names(actions_logged, table.data))
2405		return -EINVAL;
2406
2407	if (*actions_logged & SECCOMP_LOG_ALLOW)
2408		return -EINVAL;
2409
2410	seccomp_actions_logged = *actions_logged;
2411	return 0;
2412}
2413
2414static void audit_actions_logged(u32 actions_logged, u32 old_actions_logged,
2415				 int ret)
2416{
2417	char names[sizeof(seccomp_actions_avail)];
2418	char old_names[sizeof(seccomp_actions_avail)];
2419	const char *new = names;
2420	const char *old = old_names;
2421
2422	if (!audit_enabled)
2423		return;
2424
2425	memset(names, 0, sizeof(names));
2426	memset(old_names, 0, sizeof(old_names));
2427
2428	if (ret)
2429		new = "?";
2430	else if (!actions_logged)
2431		new = "(none)";
2432	else if (!seccomp_names_from_actions_logged(names, sizeof(names),
2433						    actions_logged, ","))
2434		new = "?";
2435
2436	if (!old_actions_logged)
2437		old = "(none)";
2438	else if (!seccomp_names_from_actions_logged(old_names,
2439						    sizeof(old_names),
2440						    old_actions_logged, ","))
2441		old = "?";
2442
2443	return audit_seccomp_actions_logged(new, old, !ret);
2444}
2445
2446static int seccomp_actions_logged_handler(const struct ctl_table *ro_table, int write,
2447					  void *buffer, size_t *lenp,
2448					  loff_t *ppos)
2449{
2450	int ret;
2451
2452	if (write) {
2453		u32 actions_logged = 0;
2454		u32 old_actions_logged = seccomp_actions_logged;
2455
2456		ret = write_actions_logged(ro_table, buffer, lenp, ppos,
2457					   &actions_logged);
2458		audit_actions_logged(actions_logged, old_actions_logged, ret);
2459	} else
2460		ret = read_actions_logged(ro_table, buffer, lenp, ppos);
2461
2462	return ret;
2463}
2464
 
 
 
 
 
 
2465static struct ctl_table seccomp_sysctl_table[] = {
2466	{
2467		.procname	= "actions_avail",
2468		.data		= (void *) &seccomp_actions_avail,
2469		.maxlen		= sizeof(seccomp_actions_avail),
2470		.mode		= 0444,
2471		.proc_handler	= proc_dostring,
2472	},
2473	{
2474		.procname	= "actions_logged",
2475		.mode		= 0644,
2476		.proc_handler	= seccomp_actions_logged_handler,
2477	},
 
2478};
2479
2480static int __init seccomp_sysctl_init(void)
2481{
2482	register_sysctl_init("kernel/seccomp", seccomp_sysctl_table);
 
 
 
 
 
 
 
2483	return 0;
2484}
2485
2486device_initcall(seccomp_sysctl_init)
2487
2488#endif /* CONFIG_SYSCTL */
2489
2490#ifdef CONFIG_SECCOMP_CACHE_DEBUG
2491/* Currently CONFIG_SECCOMP_CACHE_DEBUG implies SECCOMP_ARCH_NATIVE */
2492static void proc_pid_seccomp_cache_arch(struct seq_file *m, const char *name,
2493					const void *bitmap, size_t bitmap_size)
2494{
2495	int nr;
2496
2497	for (nr = 0; nr < bitmap_size; nr++) {
2498		bool cached = test_bit(nr, bitmap);
2499		char *status = cached ? "ALLOW" : "FILTER";
2500
2501		seq_printf(m, "%s %d %s\n", name, nr, status);
2502	}
2503}
2504
2505int proc_pid_seccomp_cache(struct seq_file *m, struct pid_namespace *ns,
2506			   struct pid *pid, struct task_struct *task)
2507{
2508	struct seccomp_filter *f;
2509	unsigned long flags;
2510
2511	/*
2512	 * We don't want some sandboxed process to know what their seccomp
2513	 * filters consist of.
2514	 */
2515	if (!file_ns_capable(m->file, &init_user_ns, CAP_SYS_ADMIN))
2516		return -EACCES;
2517
2518	if (!lock_task_sighand(task, &flags))
2519		return -ESRCH;
2520
2521	f = READ_ONCE(task->seccomp.filter);
2522	if (!f) {
2523		unlock_task_sighand(task, &flags);
2524		return 0;
2525	}
2526
2527	/* prevent filter from being freed while we are printing it */
2528	__get_seccomp_filter(f);
2529	unlock_task_sighand(task, &flags);
2530
2531	proc_pid_seccomp_cache_arch(m, SECCOMP_ARCH_NATIVE_NAME,
2532				    f->cache.allow_native,
2533				    SECCOMP_ARCH_NATIVE_NR);
2534
2535#ifdef SECCOMP_ARCH_COMPAT
2536	proc_pid_seccomp_cache_arch(m, SECCOMP_ARCH_COMPAT_NAME,
2537				    f->cache.allow_compat,
2538				    SECCOMP_ARCH_COMPAT_NR);
2539#endif /* SECCOMP_ARCH_COMPAT */
2540
2541	__put_seccomp_filter(f);
2542	return 0;
2543}
2544#endif /* CONFIG_SECCOMP_CACHE_DEBUG */