blob: 158ae456e8b1c6cabd535f6d226bf8a1be166188 [file] [log] [blame]
Greg Kroah-Hartmanb2441312017-11-01 15:07:57 +01001// SPDX-License-Identifier: GPL-2.0
Linus Torvalds1da177e2005-04-16 15:20:36 -07002/*
3 * linux/kernel/seccomp.c
4 *
5 * Copyright 2004-2005 Andrea Arcangeli <andrea@cpushare.com>
6 *
Will Drewrye2cfabdf2012-04-12 16:47:57 -05007 * Copyright (C) 2012 Google, Inc.
8 * Will Drewry <wad@chromium.org>
9 *
10 * This defines a simple but solid secure-computing facility.
11 *
12 * Mode 1 uses a fixed list of allowed system calls.
13 * Mode 2 allows user-defined system call filters in the form
14 * of Berkeley Packet Filters/Linux Socket Filters.
Linus Torvalds1da177e2005-04-16 15:20:36 -070015 */
16
Kees Cook0b5fa222017-06-26 09:24:00 -070017#include <linux/refcount.h>
Eric Paris85e7bac2012-01-03 14:23:05 -050018#include <linux/audit.h>
Roland McGrath5b101742009-02-27 23:25:54 -080019#include <linux/compat.h>
Mike Frysingerb25e6712017-01-19 22:28:57 -060020#include <linux/coredump.h>
Tyler Hicks8e5f1ad2017-08-11 04:33:52 +000021#include <linux/kmemleak.h>
Kees Cook87895ae2018-05-01 15:07:31 -070022#include <linux/nospec.h>
23#include <linux/prctl.h>
Will Drewrye2cfabdf2012-04-12 16:47:57 -050024#include <linux/sched.h>
Ingo Molnar68db0cf2017-02-08 18:51:37 +010025#include <linux/sched/task_stack.h>
Will Drewrye2cfabdf2012-04-12 16:47:57 -050026#include <linux/seccomp.h>
Kees Cookc8bee432014-06-27 15:16:33 -070027#include <linux/slab.h>
Kees Cook48dc92b2014-06-25 16:08:24 -070028#include <linux/syscalls.h>
Tyler Hicks8e5f1ad2017-08-11 04:33:52 +000029#include <linux/sysctl.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070030
Kees Cookb39e0212022-02-07 20:21:13 -080031/* Not exposed in headers: strictly internal use only. */
32#define SECCOMP_MODE_DEAD (SECCOMP_MODE_FILTER + 1)
33
Andy Lutomirskia4412fc2014-07-21 18:49:14 -070034#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
Will Drewrye2cfabdf2012-04-12 16:47:57 -050035#include <asm/syscall.h>
Andy Lutomirskia4412fc2014-07-21 18:49:14 -070036#endif
Will Drewrye2cfabdf2012-04-12 16:47:57 -050037
38#ifdef CONFIG_SECCOMP_FILTER
Will Drewrye2cfabdf2012-04-12 16:47:57 -050039#include <linux/filter.h>
Kees Cookc2e1f2e2014-06-05 00:23:17 -070040#include <linux/pid.h>
Will Drewryfb0fadf2012-04-12 16:48:02 -050041#include <linux/ptrace.h>
Will Drewrye2cfabdf2012-04-12 16:47:57 -050042#include <linux/security.h>
Will Drewrye2cfabdf2012-04-12 16:47:57 -050043#include <linux/tracehook.h>
44#include <linux/uaccess.h>
45
46/**
47 * struct seccomp_filter - container for seccomp BPF programs
48 *
49 * @usage: reference count to manage the object lifetime.
50 * get/put helpers should be used when accessing an instance
51 * outside of a lifetime-guarded section. In general, this
52 * is only needed for handling filters shared across tasks.
Tyler Hickse66a3992017-08-11 04:33:56 +000053 * @log: true if all actions except for SECCOMP_RET_ALLOW should be logged
Will Drewrye2cfabdf2012-04-12 16:47:57 -050054 * @prev: points to a previously installed, or inherited, filter
Mickaël Salaün285fdfc2016-09-20 19:39:47 +020055 * @prog: the BPF program to evaluate
Will Drewrye2cfabdf2012-04-12 16:47:57 -050056 *
57 * seccomp_filter objects are organized in a tree linked via the @prev
58 * pointer. For any task, it appears to be a singly-linked list starting
59 * with current->seccomp.filter, the most recently attached or inherited filter.
60 * However, multiple filters may share a @prev node, by way of fork(), which
61 * results in a unidirectional tree existing in memory. This is similar to
62 * how namespaces work.
63 *
64 * seccomp_filter objects should never be modified after being attached
65 * to a task_struct (other than @usage).
66 */
67struct seccomp_filter {
Kees Cook0b5fa222017-06-26 09:24:00 -070068 refcount_t usage;
Tyler Hickse66a3992017-08-11 04:33:56 +000069 bool log;
Will Drewrye2cfabdf2012-04-12 16:47:57 -050070 struct seccomp_filter *prev;
Alexei Starovoitov7ae457c2014-07-30 20:34:16 -070071 struct bpf_prog *prog;
Will Drewrye2cfabdf2012-04-12 16:47:57 -050072};
73
74/* Limit any path through the tree to 256KB worth of instructions. */
75#define MAX_INSNS_PER_PATH ((1 << 18) / sizeof(struct sock_filter))
76
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +010077/*
Will Drewrye2cfabdf2012-04-12 16:47:57 -050078 * Endianness is explicitly ignored and left for BPF program authors to manage
79 * as per the specific architecture.
80 */
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +010081static void populate_seccomp_data(struct seccomp_data *sd)
Will Drewrye2cfabdf2012-04-12 16:47:57 -050082{
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +010083 struct task_struct *task = current;
84 struct pt_regs *regs = task_pt_regs(task);
Daniel Borkmann2eac7642014-04-14 21:02:59 +020085 unsigned long args[6];
Will Drewrye2cfabdf2012-04-12 16:47:57 -050086
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +010087 sd->nr = syscall_get_nr(task, regs);
Linus Torvalds0b747172014-04-12 12:38:53 -070088 sd->arch = syscall_get_arch();
Daniel Borkmann2eac7642014-04-14 21:02:59 +020089 syscall_get_arguments(task, regs, 0, 6, args);
90 sd->args[0] = args[0];
91 sd->args[1] = args[1];
92 sd->args[2] = args[2];
93 sd->args[3] = args[3];
94 sd->args[4] = args[4];
95 sd->args[5] = args[5];
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +010096 sd->instruction_pointer = KSTK_EIP(task);
Will Drewrye2cfabdf2012-04-12 16:47:57 -050097}
98
99/**
100 * seccomp_check_filter - verify seccomp filter code
101 * @filter: filter to verify
102 * @flen: length of filter
103 *
Alexei Starovoitov4df95ff2014-07-30 20:34:14 -0700104 * Takes a previously checked filter (by bpf_check_classic) and
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500105 * redirects all filter code that loads struct sk_buff data
106 * and related data through seccomp_bpf_load. It also
107 * enforces length and alignment checking of those loads.
108 *
109 * Returns 0 if the rule set is legal or -EINVAL if not.
110 */
111static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen)
112{
113 int pc;
114 for (pc = 0; pc < flen; pc++) {
115 struct sock_filter *ftest = &filter[pc];
116 u16 code = ftest->code;
117 u32 k = ftest->k;
118
119 switch (code) {
Daniel Borkmann34805932014-05-29 10:22:50 +0200120 case BPF_LD | BPF_W | BPF_ABS:
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100121 ftest->code = BPF_LDX | BPF_W | BPF_ABS;
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500122 /* 32-bit aligned and not out of bounds. */
123 if (k >= sizeof(struct seccomp_data) || k & 3)
124 return -EINVAL;
125 continue;
Daniel Borkmann34805932014-05-29 10:22:50 +0200126 case BPF_LD | BPF_W | BPF_LEN:
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100127 ftest->code = BPF_LD | BPF_IMM;
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500128 ftest->k = sizeof(struct seccomp_data);
129 continue;
Daniel Borkmann34805932014-05-29 10:22:50 +0200130 case BPF_LDX | BPF_W | BPF_LEN:
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100131 ftest->code = BPF_LDX | BPF_IMM;
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500132 ftest->k = sizeof(struct seccomp_data);
133 continue;
134 /* Explicitly include allowed calls. */
Daniel Borkmann34805932014-05-29 10:22:50 +0200135 case BPF_RET | BPF_K:
136 case BPF_RET | BPF_A:
137 case BPF_ALU | BPF_ADD | BPF_K:
138 case BPF_ALU | BPF_ADD | BPF_X:
139 case BPF_ALU | BPF_SUB | BPF_K:
140 case BPF_ALU | BPF_SUB | BPF_X:
141 case BPF_ALU | BPF_MUL | BPF_K:
142 case BPF_ALU | BPF_MUL | BPF_X:
143 case BPF_ALU | BPF_DIV | BPF_K:
144 case BPF_ALU | BPF_DIV | BPF_X:
145 case BPF_ALU | BPF_AND | BPF_K:
146 case BPF_ALU | BPF_AND | BPF_X:
147 case BPF_ALU | BPF_OR | BPF_K:
148 case BPF_ALU | BPF_OR | BPF_X:
149 case BPF_ALU | BPF_XOR | BPF_K:
150 case BPF_ALU | BPF_XOR | BPF_X:
151 case BPF_ALU | BPF_LSH | BPF_K:
152 case BPF_ALU | BPF_LSH | BPF_X:
153 case BPF_ALU | BPF_RSH | BPF_K:
154 case BPF_ALU | BPF_RSH | BPF_X:
155 case BPF_ALU | BPF_NEG:
156 case BPF_LD | BPF_IMM:
157 case BPF_LDX | BPF_IMM:
158 case BPF_MISC | BPF_TAX:
159 case BPF_MISC | BPF_TXA:
160 case BPF_LD | BPF_MEM:
161 case BPF_LDX | BPF_MEM:
162 case BPF_ST:
163 case BPF_STX:
164 case BPF_JMP | BPF_JA:
165 case BPF_JMP | BPF_JEQ | BPF_K:
166 case BPF_JMP | BPF_JEQ | BPF_X:
167 case BPF_JMP | BPF_JGE | BPF_K:
168 case BPF_JMP | BPF_JGE | BPF_X:
169 case BPF_JMP | BPF_JGT | BPF_K:
170 case BPF_JMP | BPF_JGT | BPF_X:
171 case BPF_JMP | BPF_JSET | BPF_K:
172 case BPF_JMP | BPF_JSET | BPF_X:
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500173 continue;
174 default:
175 return -EINVAL;
176 }
177 }
178 return 0;
179}
180
181/**
Mickaël Salaün285fdfc2016-09-20 19:39:47 +0200182 * seccomp_run_filters - evaluates all seccomp filters against @sd
183 * @sd: optional seccomp data to be passed to filters
Kees Cookdeb4de82017-08-02 15:00:40 -0700184 * @match: stores struct seccomp_filter that resulted in the return value,
185 * unless filter returned SECCOMP_RET_ALLOW, in which case it will
186 * be unchanged.
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500187 *
188 * Returns valid seccomp BPF response codes.
189 */
Kees Cook0466bdb2017-08-11 13:12:11 -0700190#define ACTION_ONLY(ret) ((s32)((ret) & (SECCOMP_RET_ACTION_FULL)))
Kees Cookdeb4de82017-08-02 15:00:40 -0700191static u32 seccomp_run_filters(const struct seccomp_data *sd,
192 struct seccomp_filter **match)
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500193{
Andy Lutomirskid39bd002014-07-21 18:49:16 -0700194 struct seccomp_data sd_local;
Will Drewryacf3b2c2012-04-12 16:47:59 -0500195 u32 ret = SECCOMP_RET_ALLOW;
Pranith Kumar8225d382014-11-21 10:06:01 -0500196 /* Make sure cross-thread synced filter points somewhere sane. */
197 struct seccomp_filter *f =
Will Deacon5383f452017-10-24 11:22:48 +0100198 READ_ONCE(current->seccomp.filter);
Will Drewryacf3b2c2012-04-12 16:47:59 -0500199
200 /* Ensure unexpected behavior doesn't result in failing open. */
Kees Cook3ba25302014-06-27 15:01:35 -0700201 if (unlikely(WARN_ON(f == NULL)))
Kees Cook4d3b0b02017-08-11 13:01:39 -0700202 return SECCOMP_RET_KILL_PROCESS;
Will Drewryacf3b2c2012-04-12 16:47:59 -0500203
Andy Lutomirskid39bd002014-07-21 18:49:16 -0700204 if (!sd) {
205 populate_seccomp_data(&sd_local);
206 sd = &sd_local;
207 }
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100208
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500209 /*
210 * All filters in the list are evaluated and the lowest BPF return
Will Drewryacf3b2c2012-04-12 16:47:59 -0500211 * value always takes priority (ignoring the DATA).
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500212 */
Kees Cook3ba25302014-06-27 15:01:35 -0700213 for (; f; f = f->prev) {
Daniel Borkmann88575192016-11-26 01:28:04 +0100214 u32 cur_ret = BPF_PROG_RUN(f->prog, sd);
Alexei Starovoitov8f577ca2014-05-13 19:50:47 -0700215
Kees Cook0466bdb2017-08-11 13:12:11 -0700216 if (ACTION_ONLY(cur_ret) < ACTION_ONLY(ret)) {
Will Drewryacf3b2c2012-04-12 16:47:59 -0500217 ret = cur_ret;
Kees Cookdeb4de82017-08-02 15:00:40 -0700218 *match = f;
219 }
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500220 }
221 return ret;
222}
Kees Cook1f41b4502014-06-25 15:38:02 -0700223#endif /* CONFIG_SECCOMP_FILTER */
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500224
Kees Cook1f41b4502014-06-25 15:38:02 -0700225static inline bool seccomp_may_assign_mode(unsigned long seccomp_mode)
226{
Guenter Roeck69f6a342014-08-10 20:50:30 -0700227 assert_spin_locked(&current->sighand->siglock);
Kees Cookdbd952122014-06-27 15:18:48 -0700228
Kees Cook1f41b4502014-06-25 15:38:02 -0700229 if (current->seccomp.mode && current->seccomp.mode != seccomp_mode)
230 return false;
231
232 return true;
233}
234
Thomas Gleixner61dfdc12018-05-04 15:12:06 +0200235void __weak arch_seccomp_spec_mitigate(struct task_struct *task) { }
Kees Cook87895ae2018-05-01 15:07:31 -0700236
Kees Cook3ba25302014-06-27 15:01:35 -0700237static inline void seccomp_assign_mode(struct task_struct *task,
Kees Cook9939db72018-05-03 14:56:12 -0700238 unsigned long seccomp_mode,
239 unsigned long flags)
Kees Cook1f41b4502014-06-25 15:38:02 -0700240{
Guenter Roeck69f6a342014-08-10 20:50:30 -0700241 assert_spin_locked(&task->sighand->siglock);
Kees Cookdbd952122014-06-27 15:18:48 -0700242
Kees Cook3ba25302014-06-27 15:01:35 -0700243 task->seccomp.mode = seccomp_mode;
244 /*
245 * Make sure TIF_SECCOMP cannot be set before the mode (and
246 * filter) is set.
247 */
248 smp_mb__before_atomic();
Kees Cook9939db72018-05-03 14:56:12 -0700249 /* Assume default seccomp processes want spec flaw mitigation. */
250 if ((flags & SECCOMP_FILTER_FLAG_SPEC_ALLOW) == 0)
Thomas Gleixner61dfdc12018-05-04 15:12:06 +0200251 arch_seccomp_spec_mitigate(task);
Kees Cook3ba25302014-06-27 15:01:35 -0700252 set_tsk_thread_flag(task, TIF_SECCOMP);
Kees Cook1f41b4502014-06-25 15:38:02 -0700253}
254
255#ifdef CONFIG_SECCOMP_FILTER
Kees Cookc2e1f2e2014-06-05 00:23:17 -0700256/* Returns 1 if the parent is an ancestor of the child. */
257static int is_ancestor(struct seccomp_filter *parent,
258 struct seccomp_filter *child)
259{
260 /* NULL is the root ancestor. */
261 if (parent == NULL)
262 return 1;
263 for (; child; child = child->prev)
264 if (child == parent)
265 return 1;
266 return 0;
267}
268
269/**
270 * seccomp_can_sync_threads: checks if all threads can be synchronized
271 *
272 * Expects sighand and cred_guard_mutex locks to be held.
273 *
274 * Returns 0 on success, -ve on error, or the pid of a thread which was
275 * either not in the correct seccomp mode or it did not have an ancestral
276 * seccomp filter.
277 */
278static inline pid_t seccomp_can_sync_threads(void)
279{
280 struct task_struct *thread, *caller;
281
282 BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
Guenter Roeck69f6a342014-08-10 20:50:30 -0700283 assert_spin_locked(&current->sighand->siglock);
Kees Cookc2e1f2e2014-06-05 00:23:17 -0700284
285 /* Validate all threads being eligible for synchronization. */
286 caller = current;
287 for_each_thread(caller, thread) {
288 pid_t failed;
289
290 /* Skip current, since it is initiating the sync. */
291 if (thread == caller)
292 continue;
293
294 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED ||
295 (thread->seccomp.mode == SECCOMP_MODE_FILTER &&
296 is_ancestor(thread->seccomp.filter,
297 caller->seccomp.filter)))
298 continue;
299
300 /* Return the first thread that cannot be synchronized. */
301 failed = task_pid_vnr(thread);
302 /* If the pid cannot be resolved, then return -ESRCH */
303 if (unlikely(WARN_ON(failed == 0)))
304 failed = -ESRCH;
305 return failed;
306 }
307
308 return 0;
309}
310
311/**
312 * seccomp_sync_threads: sets all threads to use current's filter
313 *
314 * Expects sighand and cred_guard_mutex locks to be held, and for
315 * seccomp_can_sync_threads() to have returned success already
316 * without dropping the locks.
317 *
318 */
Kees Cook9939db72018-05-03 14:56:12 -0700319static inline void seccomp_sync_threads(unsigned long flags)
Kees Cookc2e1f2e2014-06-05 00:23:17 -0700320{
321 struct task_struct *thread, *caller;
322
323 BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
Guenter Roeck69f6a342014-08-10 20:50:30 -0700324 assert_spin_locked(&current->sighand->siglock);
Kees Cookc2e1f2e2014-06-05 00:23:17 -0700325
326 /* Synchronize all threads. */
327 caller = current;
328 for_each_thread(caller, thread) {
329 /* Skip current, since it needs no changes. */
330 if (thread == caller)
331 continue;
332
333 /* Get a task reference for the new leaf node. */
334 get_seccomp_filter(caller);
335 /*
336 * Drop the task reference to the shared ancestor since
337 * current's path will hold a reference. (This also
338 * allows a put before the assignment.)
339 */
340 put_seccomp_filter(thread);
341 smp_store_release(&thread->seccomp.filter,
342 caller->seccomp.filter);
Jann Horn103502a2015-12-26 06:00:48 +0100343
344 /*
345 * Don't let an unprivileged task work around
346 * the no_new_privs restriction by creating
347 * a thread that sets it up, enters seccomp,
348 * then dies.
349 */
350 if (task_no_new_privs(caller))
351 task_set_no_new_privs(thread);
352
Kees Cookc2e1f2e2014-06-05 00:23:17 -0700353 /*
354 * Opt the other thread into seccomp if needed.
355 * As threads are considered to be trust-realm
356 * equivalent (see ptrace_may_access), it is safe to
357 * allow one thread to transition the other.
358 */
Jann Horn103502a2015-12-26 06:00:48 +0100359 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED)
Kees Cook9939db72018-05-03 14:56:12 -0700360 seccomp_assign_mode(thread, SECCOMP_MODE_FILTER,
361 flags);
Kees Cookc2e1f2e2014-06-05 00:23:17 -0700362 }
363}
364
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500365/**
Kees Cookc8bee432014-06-27 15:16:33 -0700366 * seccomp_prepare_filter: Prepares a seccomp filter for use.
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500367 * @fprog: BPF program to install
368 *
Kees Cookc8bee432014-06-27 15:16:33 -0700369 * Returns filter on success or an ERR_PTR on failure.
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500370 */
Kees Cookc8bee432014-06-27 15:16:33 -0700371static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog)
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500372{
Daniel Borkmannac67eb22015-05-06 16:12:30 +0200373 struct seccomp_filter *sfilter;
374 int ret;
Masahiro Yamada97f26452016-08-03 13:45:50 -0700375 const bool save_orig = IS_ENABLED(CONFIG_CHECKPOINT_RESTORE);
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500376
377 if (fprog->len == 0 || fprog->len > BPF_MAXINSNS)
Kees Cookc8bee432014-06-27 15:16:33 -0700378 return ERR_PTR(-EINVAL);
Nicolas Schichand9e12f42015-05-06 16:12:28 +0200379
Kees Cookc8bee432014-06-27 15:16:33 -0700380 BUG_ON(INT_MAX / fprog->len < sizeof(struct sock_filter));
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500381
382 /*
Fabian Frederick119ce5c2014-06-06 14:37:53 -0700383 * Installing a seccomp filter requires that the task has
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500384 * CAP_SYS_ADMIN in its namespace or be running with no_new_privs.
385 * This avoids scenarios where unprivileged tasks can affect the
386 * behavior of privileged children.
387 */
Kees Cook1d4457f2014-05-21 15:23:46 -0700388 if (!task_no_new_privs(current) &&
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500389 security_capable_noaudit(current_cred(), current_user_ns(),
390 CAP_SYS_ADMIN) != 0)
Kees Cookc8bee432014-06-27 15:16:33 -0700391 return ERR_PTR(-EACCES);
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500392
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100393 /* Allocate a new seccomp_filter */
Daniel Borkmannac67eb22015-05-06 16:12:30 +0200394 sfilter = kzalloc(sizeof(*sfilter), GFP_KERNEL | __GFP_NOWARN);
395 if (!sfilter)
Nicolas Schichand9e12f42015-05-06 16:12:28 +0200396 return ERR_PTR(-ENOMEM);
Daniel Borkmannac67eb22015-05-06 16:12:30 +0200397
398 ret = bpf_prog_create_from_user(&sfilter->prog, fprog,
Tycho Andersenf8e529e2015-10-27 09:23:59 +0900399 seccomp_check_filter, save_orig);
Daniel Borkmannac67eb22015-05-06 16:12:30 +0200400 if (ret < 0) {
401 kfree(sfilter);
402 return ERR_PTR(ret);
Nicolas Schichand9e12f42015-05-06 16:12:28 +0200403 }
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100404
Kees Cook0b5fa222017-06-26 09:24:00 -0700405 refcount_set(&sfilter->usage, 1);
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500406
Daniel Borkmannac67eb22015-05-06 16:12:30 +0200407 return sfilter;
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500408}
409
410/**
Kees Cookc8bee432014-06-27 15:16:33 -0700411 * seccomp_prepare_user_filter - prepares a user-supplied sock_fprog
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500412 * @user_filter: pointer to the user data containing a sock_fprog.
413 *
414 * Returns 0 on success and non-zero otherwise.
415 */
Kees Cookc8bee432014-06-27 15:16:33 -0700416static struct seccomp_filter *
417seccomp_prepare_user_filter(const char __user *user_filter)
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500418{
419 struct sock_fprog fprog;
Kees Cookc8bee432014-06-27 15:16:33 -0700420 struct seccomp_filter *filter = ERR_PTR(-EFAULT);
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500421
422#ifdef CONFIG_COMPAT
Andy Lutomirski5c380652016-03-22 14:24:52 -0700423 if (in_compat_syscall()) {
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500424 struct compat_sock_fprog fprog32;
425 if (copy_from_user(&fprog32, user_filter, sizeof(fprog32)))
426 goto out;
427 fprog.len = fprog32.len;
428 fprog.filter = compat_ptr(fprog32.filter);
429 } else /* falls through to the if below. */
430#endif
431 if (copy_from_user(&fprog, user_filter, sizeof(fprog)))
432 goto out;
Kees Cookc8bee432014-06-27 15:16:33 -0700433 filter = seccomp_prepare_filter(&fprog);
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500434out:
Kees Cookc8bee432014-06-27 15:16:33 -0700435 return filter;
436}
437
438/**
439 * seccomp_attach_filter: validate and attach filter
440 * @flags: flags to change filter behavior
441 * @filter: seccomp filter to add to the current process
442 *
Kees Cookdbd952122014-06-27 15:18:48 -0700443 * Caller must be holding current->sighand->siglock lock.
444 *
Kees Cookc8bee432014-06-27 15:16:33 -0700445 * Returns 0 on success, -ve on error.
446 */
447static long seccomp_attach_filter(unsigned int flags,
448 struct seccomp_filter *filter)
449{
450 unsigned long total_insns;
451 struct seccomp_filter *walker;
452
Guenter Roeck69f6a342014-08-10 20:50:30 -0700453 assert_spin_locked(&current->sighand->siglock);
Kees Cookdbd952122014-06-27 15:18:48 -0700454
Kees Cookc8bee432014-06-27 15:16:33 -0700455 /* Validate resulting filter length. */
456 total_insns = filter->prog->len;
457 for (walker = current->seccomp.filter; walker; walker = walker->prev)
458 total_insns += walker->prog->len + 4; /* 4 instr penalty */
459 if (total_insns > MAX_INSNS_PER_PATH)
460 return -ENOMEM;
461
Kees Cookc2e1f2e2014-06-05 00:23:17 -0700462 /* If thread sync has been requested, check that it is possible. */
463 if (flags & SECCOMP_FILTER_FLAG_TSYNC) {
464 int ret;
465
466 ret = seccomp_can_sync_threads();
467 if (ret)
468 return ret;
469 }
470
Tyler Hickse66a3992017-08-11 04:33:56 +0000471 /* Set log flag, if present. */
472 if (flags & SECCOMP_FILTER_FLAG_LOG)
473 filter->log = true;
474
Kees Cookc8bee432014-06-27 15:16:33 -0700475 /*
476 * If there is an existing filter, make it the prev and don't drop its
477 * task reference.
478 */
479 filter->prev = current->seccomp.filter;
480 current->seccomp.filter = filter;
481
Kees Cookc2e1f2e2014-06-05 00:23:17 -0700482 /* Now that the new filter is in place, synchronize to all threads. */
483 if (flags & SECCOMP_FILTER_FLAG_TSYNC)
Kees Cook9939db72018-05-03 14:56:12 -0700484 seccomp_sync_threads(flags);
Kees Cookc2e1f2e2014-06-05 00:23:17 -0700485
Kees Cookc8bee432014-06-27 15:16:33 -0700486 return 0;
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500487}
488
Colin Ian King084f5602017-09-29 14:26:48 +0100489static void __get_seccomp_filter(struct seccomp_filter *filter)
Oleg Nesterov66a733e2017-09-27 09:25:30 -0600490{
491 /* Reference count is bounded by the number of total processes. */
492 refcount_inc(&filter->usage);
493}
494
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500495/* get_seccomp_filter - increments the reference count of the filter on @tsk */
496void get_seccomp_filter(struct task_struct *tsk)
497{
498 struct seccomp_filter *orig = tsk->seccomp.filter;
499 if (!orig)
500 return;
Oleg Nesterov66a733e2017-09-27 09:25:30 -0600501 __get_seccomp_filter(orig);
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500502}
503
Kees Cookc8bee432014-06-27 15:16:33 -0700504static inline void seccomp_filter_free(struct seccomp_filter *filter)
505{
506 if (filter) {
Daniel Borkmannbab18992015-10-02 15:17:33 +0200507 bpf_prog_destroy(filter->prog);
Kees Cookc8bee432014-06-27 15:16:33 -0700508 kfree(filter);
509 }
510}
511
Oleg Nesterov66a733e2017-09-27 09:25:30 -0600512static void __put_seccomp_filter(struct seccomp_filter *orig)
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500513{
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500514 /* Clean up single-reference branches iteratively. */
Kees Cook0b5fa222017-06-26 09:24:00 -0700515 while (orig && refcount_dec_and_test(&orig->usage)) {
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500516 struct seccomp_filter *freeme = orig;
517 orig = orig->prev;
Kees Cookc8bee432014-06-27 15:16:33 -0700518 seccomp_filter_free(freeme);
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500519 }
520}
Will Drewrybb6ea432012-04-12 16:48:01 -0500521
Oleg Nesterov66a733e2017-09-27 09:25:30 -0600522/* put_seccomp_filter - decrements the ref count of tsk->seccomp.filter */
523void put_seccomp_filter(struct task_struct *tsk)
524{
525 __put_seccomp_filter(tsk->seccomp.filter);
526}
527
Mike Frysingerb25e6712017-01-19 22:28:57 -0600528static void seccomp_init_siginfo(siginfo_t *info, int syscall, int reason)
529{
530 memset(info, 0, sizeof(*info));
531 info->si_signo = SIGSYS;
532 info->si_code = SYS_SECCOMP;
533 info->si_call_addr = (void __user *)KSTK_EIP(current);
534 info->si_errno = reason;
535 info->si_arch = syscall_get_arch();
536 info->si_syscall = syscall;
537}
538
Will Drewrybb6ea432012-04-12 16:48:01 -0500539/**
540 * seccomp_send_sigsys - signals the task to allow in-process syscall emulation
541 * @syscall: syscall number to send to userland
542 * @reason: filter-supplied reason code to send to userland (via si_errno)
543 *
544 * Forces a SIGSYS with a code of SYS_SECCOMP and related sigsys info.
545 */
546static void seccomp_send_sigsys(int syscall, int reason)
547{
548 struct siginfo info;
Mike Frysingerb25e6712017-01-19 22:28:57 -0600549 seccomp_init_siginfo(&info, syscall, reason);
Will Drewrybb6ea432012-04-12 16:48:01 -0500550 force_sig_info(SIGSYS, &info, current);
551}
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500552#endif /* CONFIG_SECCOMP_FILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700553
Tyler Hicks0ddec0f2017-08-11 04:33:54 +0000554/* For use with seccomp_actions_logged */
Kees Cook4d3b0b02017-08-11 13:01:39 -0700555#define SECCOMP_LOG_KILL_PROCESS (1 << 0)
556#define SECCOMP_LOG_KILL_THREAD (1 << 1)
Tyler Hicks0ddec0f2017-08-11 04:33:54 +0000557#define SECCOMP_LOG_TRAP (1 << 2)
558#define SECCOMP_LOG_ERRNO (1 << 3)
559#define SECCOMP_LOG_TRACE (1 << 4)
Tyler Hicks59f5cf42017-08-11 04:33:57 +0000560#define SECCOMP_LOG_LOG (1 << 5)
561#define SECCOMP_LOG_ALLOW (1 << 6)
Tyler Hicks0ddec0f2017-08-11 04:33:54 +0000562
Kees Cook4d3b0b02017-08-11 13:01:39 -0700563static u32 seccomp_actions_logged = SECCOMP_LOG_KILL_PROCESS |
564 SECCOMP_LOG_KILL_THREAD |
Kees Cookfd768752017-08-11 12:53:18 -0700565 SECCOMP_LOG_TRAP |
566 SECCOMP_LOG_ERRNO |
567 SECCOMP_LOG_TRACE |
Tyler Hicks59f5cf42017-08-11 04:33:57 +0000568 SECCOMP_LOG_LOG;
Tyler Hicks0ddec0f2017-08-11 04:33:54 +0000569
Tyler Hickse66a3992017-08-11 04:33:56 +0000570static inline void seccomp_log(unsigned long syscall, long signr, u32 action,
571 bool requested)
Tyler Hicks0ddec0f2017-08-11 04:33:54 +0000572{
573 bool log = false;
574
575 switch (action) {
576 case SECCOMP_RET_ALLOW:
Tyler Hickse66a3992017-08-11 04:33:56 +0000577 break;
Tyler Hicks0ddec0f2017-08-11 04:33:54 +0000578 case SECCOMP_RET_TRAP:
Tyler Hickse66a3992017-08-11 04:33:56 +0000579 log = requested && seccomp_actions_logged & SECCOMP_LOG_TRAP;
580 break;
Tyler Hicks0ddec0f2017-08-11 04:33:54 +0000581 case SECCOMP_RET_ERRNO:
Tyler Hickse66a3992017-08-11 04:33:56 +0000582 log = requested && seccomp_actions_logged & SECCOMP_LOG_ERRNO;
583 break;
Tyler Hicks0ddec0f2017-08-11 04:33:54 +0000584 case SECCOMP_RET_TRACE:
Tyler Hickse66a3992017-08-11 04:33:56 +0000585 log = requested && seccomp_actions_logged & SECCOMP_LOG_TRACE;
Tyler Hicks0ddec0f2017-08-11 04:33:54 +0000586 break;
Tyler Hicks59f5cf42017-08-11 04:33:57 +0000587 case SECCOMP_RET_LOG:
588 log = seccomp_actions_logged & SECCOMP_LOG_LOG;
589 break;
Kees Cookfd768752017-08-11 12:53:18 -0700590 case SECCOMP_RET_KILL_THREAD:
Kees Cookfd768752017-08-11 12:53:18 -0700591 log = seccomp_actions_logged & SECCOMP_LOG_KILL_THREAD;
Kees Cook4d3b0b02017-08-11 13:01:39 -0700592 break;
593 case SECCOMP_RET_KILL_PROCESS:
594 default:
595 log = seccomp_actions_logged & SECCOMP_LOG_KILL_PROCESS;
Tyler Hicks0ddec0f2017-08-11 04:33:54 +0000596 }
597
598 /*
Kees Cookfd768752017-08-11 12:53:18 -0700599 * Force an audit message to be emitted when the action is RET_KILL_*,
Tyler Hicks59f5cf42017-08-11 04:33:57 +0000600 * RET_LOG, or the FILTER_FLAG_LOG bit was set and the action is
601 * allowed to be logged by the admin.
Tyler Hicks0ddec0f2017-08-11 04:33:54 +0000602 */
603 if (log)
604 return __audit_seccomp(syscall, signr, action);
605
606 /*
607 * Let the audit subsystem decide if the action should be audited based
608 * on whether the current task itself is being audited.
609 */
610 return audit_seccomp(syscall, signr, action);
611}
612
Linus Torvalds1da177e2005-04-16 15:20:36 -0700613/*
614 * Secure computing mode 1 allows only read/write/exit/sigreturn.
615 * To be fully secure this must be combined with rlimit
616 * to limit the stack allocations too.
617 */
Matt Redfearncb4253a2016-03-29 09:35:34 +0100618static const int mode1_syscalls[] = {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700619 __NR_seccomp_read, __NR_seccomp_write, __NR_seccomp_exit, __NR_seccomp_sigreturn,
620 0, /* null terminated */
621};
622
Andy Lutomirskia4412fc2014-07-21 18:49:14 -0700623static void __secure_computing_strict(int this_syscall)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700624{
Matt Redfearncb4253a2016-03-29 09:35:34 +0100625 const int *syscall_whitelist = mode1_syscalls;
Andy Lutomirskia4412fc2014-07-21 18:49:14 -0700626#ifdef CONFIG_COMPAT
Andy Lutomirski5c380652016-03-22 14:24:52 -0700627 if (in_compat_syscall())
Matt Redfearnc983f0e2016-03-29 09:35:32 +0100628 syscall_whitelist = get_compat_mode1_syscalls();
Andy Lutomirskia4412fc2014-07-21 18:49:14 -0700629#endif
630 do {
631 if (*syscall_whitelist == this_syscall)
632 return;
633 } while (*++syscall_whitelist);
634
635#ifdef SECCOMP_DEBUG
636 dump_stack();
637#endif
Kees Cookb39e0212022-02-07 20:21:13 -0800638 current->seccomp.mode = SECCOMP_MODE_DEAD;
Kees Cookfd768752017-08-11 12:53:18 -0700639 seccomp_log(this_syscall, SIGKILL, SECCOMP_RET_KILL_THREAD, true);
Andy Lutomirskia4412fc2014-07-21 18:49:14 -0700640 do_exit(SIGKILL);
641}
642
643#ifndef CONFIG_HAVE_ARCH_SECCOMP_FILTER
644void secure_computing_strict(int this_syscall)
645{
646 int mode = current->seccomp.mode;
647
Masahiro Yamada97f26452016-08-03 13:45:50 -0700648 if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) &&
Tycho Andersen13c4a902015-06-13 09:02:48 -0600649 unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
650 return;
651
Kees Cook221272f2015-06-15 15:29:16 -0700652 if (mode == SECCOMP_MODE_DISABLED)
Andy Lutomirskia4412fc2014-07-21 18:49:14 -0700653 return;
654 else if (mode == SECCOMP_MODE_STRICT)
655 __secure_computing_strict(this_syscall);
656 else
657 BUG();
658}
659#else
Andy Lutomirski13aa72f2014-07-21 18:49:15 -0700660
661#ifdef CONFIG_SECCOMP_FILTER
Kees Cookce6526e2016-06-01 19:29:15 -0700662static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
663 const bool recheck_after_trace)
Andy Lutomirski13aa72f2014-07-21 18:49:15 -0700664{
665 u32 filter_ret, action;
Kees Cookdeb4de82017-08-02 15:00:40 -0700666 struct seccomp_filter *match = NULL;
Andy Lutomirski13aa72f2014-07-21 18:49:15 -0700667 int data;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700668
Kees Cook3ba25302014-06-27 15:01:35 -0700669 /*
670 * Make sure that any changes to mode from another thread have
671 * been seen after TIF_SECCOMP was seen.
672 */
673 rmb();
674
Kees Cookdeb4de82017-08-02 15:00:40 -0700675 filter_ret = seccomp_run_filters(sd, &match);
Andy Lutomirski13aa72f2014-07-21 18:49:15 -0700676 data = filter_ret & SECCOMP_RET_DATA;
Kees Cook0466bdb2017-08-11 13:12:11 -0700677 action = filter_ret & SECCOMP_RET_ACTION_FULL;
Andy Lutomirski87b526d2012-10-01 11:40:45 -0700678
Andy Lutomirski13aa72f2014-07-21 18:49:15 -0700679 switch (action) {
680 case SECCOMP_RET_ERRNO:
Kees Cook580c57f2015-02-17 13:48:00 -0800681 /* Set low-order bits as an errno, capped at MAX_ERRNO. */
682 if (data > MAX_ERRNO)
683 data = MAX_ERRNO;
Andy Lutomirskid39bd002014-07-21 18:49:16 -0700684 syscall_set_return_value(current, task_pt_regs(current),
Andy Lutomirski13aa72f2014-07-21 18:49:15 -0700685 -data, 0);
686 goto skip;
687
688 case SECCOMP_RET_TRAP:
689 /* Show the handler the original registers. */
Andy Lutomirskid39bd002014-07-21 18:49:16 -0700690 syscall_rollback(current, task_pt_regs(current));
Andy Lutomirski13aa72f2014-07-21 18:49:15 -0700691 /* Let the filter pass back 16 bits of data. */
692 seccomp_send_sigsys(this_syscall, data);
693 goto skip;
694
695 case SECCOMP_RET_TRACE:
Kees Cookce6526e2016-06-01 19:29:15 -0700696 /* We've been put in this state by the ptracer already. */
697 if (recheck_after_trace)
698 return 0;
699
Kees Cook8112c4f2016-06-01 16:02:17 -0700700 /* ENOSYS these calls if there is no tracer attached. */
701 if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP)) {
702 syscall_set_return_value(current,
703 task_pt_regs(current),
704 -ENOSYS, 0);
705 goto skip;
706 }
707
708 /* Allow the BPF to provide the event message */
709 ptrace_event(PTRACE_EVENT_SECCOMP, data);
710 /*
711 * The delivery of a fatal signal during event
Kees Cook485a2522016-08-10 16:28:09 -0700712 * notification may silently skip tracer notification,
713 * which could leave us with a potentially unmodified
714 * syscall that the tracer would have liked to have
715 * changed. Since the process is about to die, we just
716 * force the syscall to be skipped and let the signal
717 * kill the process and correctly handle any tracer exit
718 * notifications.
Kees Cook8112c4f2016-06-01 16:02:17 -0700719 */
720 if (fatal_signal_pending(current))
Kees Cook485a2522016-08-10 16:28:09 -0700721 goto skip;
Kees Cook8112c4f2016-06-01 16:02:17 -0700722 /* Check if the tracer forced the syscall to be skipped. */
723 this_syscall = syscall_get_nr(current, task_pt_regs(current));
724 if (this_syscall < 0)
725 goto skip;
726
Kees Cookce6526e2016-06-01 19:29:15 -0700727 /*
728 * Recheck the syscall, since it may have changed. This
729 * intentionally uses a NULL struct seccomp_data to force
730 * a reload of all registers. This does not goto skip since
731 * a skip would have already been reported.
732 */
733 if (__seccomp_filter(this_syscall, NULL, true))
734 return -1;
735
Kees Cook8112c4f2016-06-01 16:02:17 -0700736 return 0;
Andy Lutomirski13aa72f2014-07-21 18:49:15 -0700737
Tyler Hicks59f5cf42017-08-11 04:33:57 +0000738 case SECCOMP_RET_LOG:
739 seccomp_log(this_syscall, 0, action, true);
740 return 0;
741
Andy Lutomirski13aa72f2014-07-21 18:49:15 -0700742 case SECCOMP_RET_ALLOW:
Kees Cookdeb4de82017-08-02 15:00:40 -0700743 /*
744 * Note that the "match" filter will always be NULL for
745 * this action since SECCOMP_RET_ALLOW is the starting
746 * state in seccomp_run_filters().
747 */
Kees Cook8112c4f2016-06-01 16:02:17 -0700748 return 0;
Andy Lutomirski13aa72f2014-07-21 18:49:15 -0700749
Kees Cookfd768752017-08-11 12:53:18 -0700750 case SECCOMP_RET_KILL_THREAD:
Kees Cook4d3b0b02017-08-11 13:01:39 -0700751 case SECCOMP_RET_KILL_PROCESS:
Kees Cook131b6352017-02-23 09:24:24 -0800752 default:
Kees Cookb39e0212022-02-07 20:21:13 -0800753 current->seccomp.mode = SECCOMP_MODE_DEAD;
Tyler Hickse66a3992017-08-11 04:33:56 +0000754 seccomp_log(this_syscall, SIGSYS, action, true);
Kees Cookd7276e32017-02-07 15:18:51 -0800755 /* Dump core only if this is the last remaining thread. */
Kees Cook4d3b0b02017-08-11 13:01:39 -0700756 if (action == SECCOMP_RET_KILL_PROCESS ||
757 get_nr_threads(current) == 1) {
Kees Cook131b6352017-02-23 09:24:24 -0800758 siginfo_t info;
759
Kees Cookd7276e32017-02-07 15:18:51 -0800760 /* Show the original registers in the dump. */
761 syscall_rollback(current, task_pt_regs(current));
762 /* Trigger a manual coredump since do_exit skips it. */
763 seccomp_init_siginfo(&info, this_syscall, data);
764 do_coredump(&info);
765 }
Kees Cook4d3b0b02017-08-11 13:01:39 -0700766 if (action == SECCOMP_RET_KILL_PROCESS)
767 do_group_exit(SIGSYS);
768 else
769 do_exit(SIGSYS);
Will Drewry8156b452012-04-17 14:48:58 -0500770 }
Andy Lutomirski13aa72f2014-07-21 18:49:15 -0700771
772 unreachable();
773
774skip:
Tyler Hickse66a3992017-08-11 04:33:56 +0000775 seccomp_log(this_syscall, 0, action, match ? match->log : false);
Kees Cook8112c4f2016-06-01 16:02:17 -0700776 return -1;
777}
778#else
Kees Cookce6526e2016-06-01 19:29:15 -0700779static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
780 const bool recheck_after_trace)
Kees Cook8112c4f2016-06-01 16:02:17 -0700781{
782 BUG();
Paul Cercueil44ae9252021-01-11 17:28:39 +0000783
784 return -1;
Andy Lutomirski13aa72f2014-07-21 18:49:15 -0700785}
786#endif
787
Kees Cook8112c4f2016-06-01 16:02:17 -0700788int __secure_computing(const struct seccomp_data *sd)
Andy Lutomirski13aa72f2014-07-21 18:49:15 -0700789{
790 int mode = current->seccomp.mode;
Kees Cook8112c4f2016-06-01 16:02:17 -0700791 int this_syscall;
Andy Lutomirski13aa72f2014-07-21 18:49:15 -0700792
Masahiro Yamada97f26452016-08-03 13:45:50 -0700793 if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) &&
Tycho Andersen13c4a902015-06-13 09:02:48 -0600794 unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
Kees Cook8112c4f2016-06-01 16:02:17 -0700795 return 0;
796
797 this_syscall = sd ? sd->nr :
798 syscall_get_nr(current, task_pt_regs(current));
Tycho Andersen13c4a902015-06-13 09:02:48 -0600799
Andy Lutomirski13aa72f2014-07-21 18:49:15 -0700800 switch (mode) {
801 case SECCOMP_MODE_STRICT:
802 __secure_computing_strict(this_syscall); /* may call do_exit */
Kees Cook8112c4f2016-06-01 16:02:17 -0700803 return 0;
Andy Lutomirski13aa72f2014-07-21 18:49:15 -0700804 case SECCOMP_MODE_FILTER:
Kees Cookce6526e2016-06-01 19:29:15 -0700805 return __seccomp_filter(this_syscall, sd, false);
Kees Cookb39e0212022-02-07 20:21:13 -0800806 /* Surviving SECCOMP_RET_KILL_* must be proactively impossible. */
807 case SECCOMP_MODE_DEAD:
808 WARN_ON_ONCE(1);
809 do_exit(SIGKILL);
810 return -1;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700811 default:
812 BUG();
813 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700814}
Andy Lutomirskia4412fc2014-07-21 18:49:14 -0700815#endif /* CONFIG_HAVE_ARCH_SECCOMP_FILTER */
Andrea Arcangeli1d9d02f2007-07-15 23:41:32 -0700816
817long prctl_get_seccomp(void)
818{
819 return current->seccomp.mode;
820}
821
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500822/**
Kees Cook3b23dd12014-06-25 15:55:25 -0700823 * seccomp_set_mode_strict: internal function for setting strict seccomp
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500824 *
825 * Once current->seccomp.mode is non-zero, it may not be changed.
826 *
827 * Returns 0 on success or -EINVAL on failure.
828 */
Kees Cook3b23dd12014-06-25 15:55:25 -0700829static long seccomp_set_mode_strict(void)
Andrea Arcangeli1d9d02f2007-07-15 23:41:32 -0700830{
Kees Cook3b23dd12014-06-25 15:55:25 -0700831 const unsigned long seccomp_mode = SECCOMP_MODE_STRICT;
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500832 long ret = -EINVAL;
Andrea Arcangeli1d9d02f2007-07-15 23:41:32 -0700833
Kees Cookdbd952122014-06-27 15:18:48 -0700834 spin_lock_irq(&current->sighand->siglock);
835
Kees Cook1f41b4502014-06-25 15:38:02 -0700836 if (!seccomp_may_assign_mode(seccomp_mode))
Andrea Arcangeli1d9d02f2007-07-15 23:41:32 -0700837 goto out;
838
Andrea Arcangelicf99aba2007-07-15 23:41:33 -0700839#ifdef TIF_NOTSC
Kees Cook3b23dd12014-06-25 15:55:25 -0700840 disable_TSC();
Andrea Arcangelicf99aba2007-07-15 23:41:33 -0700841#endif
Kees Cook9939db72018-05-03 14:56:12 -0700842 seccomp_assign_mode(current, seccomp_mode, 0);
Kees Cook3b23dd12014-06-25 15:55:25 -0700843 ret = 0;
844
845out:
Kees Cookdbd952122014-06-27 15:18:48 -0700846 spin_unlock_irq(&current->sighand->siglock);
Kees Cook3b23dd12014-06-25 15:55:25 -0700847
848 return ret;
849}
850
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500851#ifdef CONFIG_SECCOMP_FILTER
Kees Cook3b23dd12014-06-25 15:55:25 -0700852/**
853 * seccomp_set_mode_filter: internal function for setting seccomp filter
Kees Cook48dc92b2014-06-25 16:08:24 -0700854 * @flags: flags to change filter behavior
Kees Cook3b23dd12014-06-25 15:55:25 -0700855 * @filter: struct sock_fprog containing filter
856 *
857 * This function may be called repeatedly to install additional filters.
858 * Every filter successfully installed will be evaluated (in reverse order)
859 * for each system call the task makes.
860 *
861 * Once current->seccomp.mode is non-zero, it may not be changed.
862 *
863 * Returns 0 on success or -EINVAL on failure.
864 */
Kees Cook48dc92b2014-06-25 16:08:24 -0700865static long seccomp_set_mode_filter(unsigned int flags,
866 const char __user *filter)
Kees Cook3b23dd12014-06-25 15:55:25 -0700867{
868 const unsigned long seccomp_mode = SECCOMP_MODE_FILTER;
Kees Cookc8bee432014-06-27 15:16:33 -0700869 struct seccomp_filter *prepared = NULL;
Kees Cook3b23dd12014-06-25 15:55:25 -0700870 long ret = -EINVAL;
871
Kees Cook48dc92b2014-06-25 16:08:24 -0700872 /* Validate flags. */
Kees Cookc2e1f2e2014-06-05 00:23:17 -0700873 if (flags & ~SECCOMP_FILTER_FLAG_MASK)
Kees Cookdbd952122014-06-27 15:18:48 -0700874 return -EINVAL;
Kees Cook48dc92b2014-06-25 16:08:24 -0700875
Kees Cookc8bee432014-06-27 15:16:33 -0700876 /* Prepare the new filter before holding any locks. */
877 prepared = seccomp_prepare_user_filter(filter);
878 if (IS_ERR(prepared))
879 return PTR_ERR(prepared);
880
Kees Cookc2e1f2e2014-06-05 00:23:17 -0700881 /*
882 * Make sure we cannot change seccomp or nnp state via TSYNC
883 * while another thread is in the middle of calling exec.
884 */
885 if (flags & SECCOMP_FILTER_FLAG_TSYNC &&
886 mutex_lock_killable(&current->signal->cred_guard_mutex))
887 goto out_free;
888
Kees Cookdbd952122014-06-27 15:18:48 -0700889 spin_lock_irq(&current->sighand->siglock);
890
Kees Cook3b23dd12014-06-25 15:55:25 -0700891 if (!seccomp_may_assign_mode(seccomp_mode))
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500892 goto out;
Kees Cook3b23dd12014-06-25 15:55:25 -0700893
Kees Cookc8bee432014-06-27 15:16:33 -0700894 ret = seccomp_attach_filter(flags, prepared);
Kees Cook3b23dd12014-06-25 15:55:25 -0700895 if (ret)
896 goto out;
Kees Cookc8bee432014-06-27 15:16:33 -0700897 /* Do not free the successfully attached filter. */
898 prepared = NULL;
Andrea Arcangeli1d9d02f2007-07-15 23:41:32 -0700899
Kees Cook9939db72018-05-03 14:56:12 -0700900 seccomp_assign_mode(current, seccomp_mode, flags);
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500901out:
Kees Cookdbd952122014-06-27 15:18:48 -0700902 spin_unlock_irq(&current->sighand->siglock);
Kees Cookc2e1f2e2014-06-05 00:23:17 -0700903 if (flags & SECCOMP_FILTER_FLAG_TSYNC)
904 mutex_unlock(&current->signal->cred_guard_mutex);
905out_free:
Kees Cookc8bee432014-06-27 15:16:33 -0700906 seccomp_filter_free(prepared);
Andrea Arcangeli1d9d02f2007-07-15 23:41:32 -0700907 return ret;
908}
Kees Cook3b23dd12014-06-25 15:55:25 -0700909#else
Kees Cook48dc92b2014-06-25 16:08:24 -0700910static inline long seccomp_set_mode_filter(unsigned int flags,
911 const char __user *filter)
Kees Cook3b23dd12014-06-25 15:55:25 -0700912{
913 return -EINVAL;
914}
915#endif
Kees Cookd78ab022014-05-21 15:02:11 -0700916
Tyler Hicksd612b1f2017-08-11 04:33:53 +0000917static long seccomp_get_action_avail(const char __user *uaction)
918{
919 u32 action;
920
921 if (copy_from_user(&action, uaction, sizeof(action)))
922 return -EFAULT;
923
924 switch (action) {
Kees Cook0466bdb2017-08-11 13:12:11 -0700925 case SECCOMP_RET_KILL_PROCESS:
Kees Cookfd768752017-08-11 12:53:18 -0700926 case SECCOMP_RET_KILL_THREAD:
Tyler Hicksd612b1f2017-08-11 04:33:53 +0000927 case SECCOMP_RET_TRAP:
928 case SECCOMP_RET_ERRNO:
929 case SECCOMP_RET_TRACE:
Tyler Hicks59f5cf42017-08-11 04:33:57 +0000930 case SECCOMP_RET_LOG:
Tyler Hicksd612b1f2017-08-11 04:33:53 +0000931 case SECCOMP_RET_ALLOW:
932 break;
933 default:
934 return -EOPNOTSUPP;
935 }
936
937 return 0;
938}
939
Kees Cook48dc92b2014-06-25 16:08:24 -0700940/* Common entry point for both prctl and syscall. */
941static long do_seccomp(unsigned int op, unsigned int flags,
942 const char __user *uargs)
943{
944 switch (op) {
945 case SECCOMP_SET_MODE_STRICT:
946 if (flags != 0 || uargs != NULL)
947 return -EINVAL;
948 return seccomp_set_mode_strict();
949 case SECCOMP_SET_MODE_FILTER:
950 return seccomp_set_mode_filter(flags, uargs);
Tyler Hicksd612b1f2017-08-11 04:33:53 +0000951 case SECCOMP_GET_ACTION_AVAIL:
952 if (flags != 0)
953 return -EINVAL;
954
955 return seccomp_get_action_avail(uargs);
Kees Cook48dc92b2014-06-25 16:08:24 -0700956 default:
957 return -EINVAL;
958 }
959}
960
961SYSCALL_DEFINE3(seccomp, unsigned int, op, unsigned int, flags,
962 const char __user *, uargs)
963{
964 return do_seccomp(op, flags, uargs);
965}
966
Kees Cookd78ab022014-05-21 15:02:11 -0700967/**
968 * prctl_set_seccomp: configures current->seccomp.mode
969 * @seccomp_mode: requested mode to use
970 * @filter: optional struct sock_fprog for use with SECCOMP_MODE_FILTER
971 *
972 * Returns 0 on success or -EINVAL on failure.
973 */
974long prctl_set_seccomp(unsigned long seccomp_mode, char __user *filter)
975{
Kees Cook48dc92b2014-06-25 16:08:24 -0700976 unsigned int op;
977 char __user *uargs;
978
Kees Cook3b23dd12014-06-25 15:55:25 -0700979 switch (seccomp_mode) {
980 case SECCOMP_MODE_STRICT:
Kees Cook48dc92b2014-06-25 16:08:24 -0700981 op = SECCOMP_SET_MODE_STRICT;
982 /*
983 * Setting strict mode through prctl always ignored filter,
984 * so make sure it is always NULL here to pass the internal
985 * check in do_seccomp().
986 */
987 uargs = NULL;
988 break;
Kees Cook3b23dd12014-06-25 15:55:25 -0700989 case SECCOMP_MODE_FILTER:
Kees Cook48dc92b2014-06-25 16:08:24 -0700990 op = SECCOMP_SET_MODE_FILTER;
991 uargs = filter;
992 break;
Kees Cook3b23dd12014-06-25 15:55:25 -0700993 default:
994 return -EINVAL;
995 }
Kees Cook48dc92b2014-06-25 16:08:24 -0700996
997 /* prctl interface doesn't have flags, so they are always zero. */
998 return do_seccomp(op, 0, uargs);
Kees Cookd78ab022014-05-21 15:02:11 -0700999}
Tycho Andersenf8e529e2015-10-27 09:23:59 +09001000
1001#if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
1002long seccomp_get_filter(struct task_struct *task, unsigned long filter_off,
1003 void __user *data)
1004{
1005 struct seccomp_filter *filter;
1006 struct sock_fprog_kern *fprog;
1007 long ret;
1008 unsigned long count = 0;
1009
1010 if (!capable(CAP_SYS_ADMIN) ||
1011 current->seccomp.mode != SECCOMP_MODE_DISABLED) {
1012 return -EACCES;
1013 }
1014
1015 spin_lock_irq(&task->sighand->siglock);
1016 if (task->seccomp.mode != SECCOMP_MODE_FILTER) {
1017 ret = -EINVAL;
1018 goto out;
1019 }
1020
1021 filter = task->seccomp.filter;
1022 while (filter) {
1023 filter = filter->prev;
1024 count++;
1025 }
1026
1027 if (filter_off >= count) {
1028 ret = -ENOENT;
1029 goto out;
1030 }
1031 count -= filter_off;
1032
1033 filter = task->seccomp.filter;
1034 while (filter && count > 1) {
1035 filter = filter->prev;
1036 count--;
1037 }
1038
1039 if (WARN_ON(count != 1 || !filter)) {
1040 /* The filter tree shouldn't shrink while we're using it. */
1041 ret = -ENOENT;
1042 goto out;
1043 }
1044
1045 fprog = filter->prog->orig_prog;
1046 if (!fprog) {
Mickaël Salaün470bf1f2016-03-24 02:46:33 +01001047 /* This must be a new non-cBPF filter, since we save
Tycho Andersenf8e529e2015-10-27 09:23:59 +09001048 * every cBPF filter's orig_prog above when
1049 * CONFIG_CHECKPOINT_RESTORE is enabled.
1050 */
1051 ret = -EMEDIUMTYPE;
1052 goto out;
1053 }
1054
1055 ret = fprog->len;
1056 if (!data)
1057 goto out;
1058
Oleg Nesterov66a733e2017-09-27 09:25:30 -06001059 __get_seccomp_filter(filter);
Tycho Andersenf8e529e2015-10-27 09:23:59 +09001060 spin_unlock_irq(&task->sighand->siglock);
1061
1062 if (copy_to_user(data, fprog->filter, bpf_classic_proglen(fprog)))
1063 ret = -EFAULT;
1064
Oleg Nesterov66a733e2017-09-27 09:25:30 -06001065 __put_seccomp_filter(filter);
Tycho Andersenf8e529e2015-10-27 09:23:59 +09001066 return ret;
1067
1068out:
1069 spin_unlock_irq(&task->sighand->siglock);
1070 return ret;
1071}
1072#endif
Tyler Hicks8e5f1ad2017-08-11 04:33:52 +00001073
1074#ifdef CONFIG_SYSCTL
1075
1076/* Human readable action names for friendly sysctl interaction */
Kees Cook0466bdb2017-08-11 13:12:11 -07001077#define SECCOMP_RET_KILL_PROCESS_NAME "kill_process"
Kees Cookfd768752017-08-11 12:53:18 -07001078#define SECCOMP_RET_KILL_THREAD_NAME "kill_thread"
Tyler Hicks8e5f1ad2017-08-11 04:33:52 +00001079#define SECCOMP_RET_TRAP_NAME "trap"
1080#define SECCOMP_RET_ERRNO_NAME "errno"
1081#define SECCOMP_RET_TRACE_NAME "trace"
Tyler Hicks59f5cf42017-08-11 04:33:57 +00001082#define SECCOMP_RET_LOG_NAME "log"
Tyler Hicks8e5f1ad2017-08-11 04:33:52 +00001083#define SECCOMP_RET_ALLOW_NAME "allow"
1084
Kees Cookfd768752017-08-11 12:53:18 -07001085static const char seccomp_actions_avail[] =
Kees Cook0466bdb2017-08-11 13:12:11 -07001086 SECCOMP_RET_KILL_PROCESS_NAME " "
Kees Cookfd768752017-08-11 12:53:18 -07001087 SECCOMP_RET_KILL_THREAD_NAME " "
1088 SECCOMP_RET_TRAP_NAME " "
1089 SECCOMP_RET_ERRNO_NAME " "
1090 SECCOMP_RET_TRACE_NAME " "
1091 SECCOMP_RET_LOG_NAME " "
1092 SECCOMP_RET_ALLOW_NAME;
Tyler Hicks8e5f1ad2017-08-11 04:33:52 +00001093
Tyler Hicks0ddec0f2017-08-11 04:33:54 +00001094struct seccomp_log_name {
1095 u32 log;
1096 const char *name;
1097};
1098
1099static const struct seccomp_log_name seccomp_log_names[] = {
Kees Cook0466bdb2017-08-11 13:12:11 -07001100 { SECCOMP_LOG_KILL_PROCESS, SECCOMP_RET_KILL_PROCESS_NAME },
Kees Cookfd768752017-08-11 12:53:18 -07001101 { SECCOMP_LOG_KILL_THREAD, SECCOMP_RET_KILL_THREAD_NAME },
Tyler Hicks0ddec0f2017-08-11 04:33:54 +00001102 { SECCOMP_LOG_TRAP, SECCOMP_RET_TRAP_NAME },
1103 { SECCOMP_LOG_ERRNO, SECCOMP_RET_ERRNO_NAME },
1104 { SECCOMP_LOG_TRACE, SECCOMP_RET_TRACE_NAME },
Tyler Hicks59f5cf42017-08-11 04:33:57 +00001105 { SECCOMP_LOG_LOG, SECCOMP_RET_LOG_NAME },
Tyler Hicks0ddec0f2017-08-11 04:33:54 +00001106 { SECCOMP_LOG_ALLOW, SECCOMP_RET_ALLOW_NAME },
1107 { }
1108};
1109
1110static bool seccomp_names_from_actions_logged(char *names, size_t size,
1111 u32 actions_logged)
1112{
1113 const struct seccomp_log_name *cur;
1114 bool append_space = false;
1115
1116 for (cur = seccomp_log_names; cur->name && size; cur++) {
1117 ssize_t ret;
1118
1119 if (!(actions_logged & cur->log))
1120 continue;
1121
1122 if (append_space) {
1123 ret = strscpy(names, " ", size);
1124 if (ret < 0)
1125 return false;
1126
1127 names += ret;
1128 size -= ret;
1129 } else
1130 append_space = true;
1131
1132 ret = strscpy(names, cur->name, size);
1133 if (ret < 0)
1134 return false;
1135
1136 names += ret;
1137 size -= ret;
1138 }
1139
1140 return true;
1141}
1142
1143static bool seccomp_action_logged_from_name(u32 *action_logged,
1144 const char *name)
1145{
1146 const struct seccomp_log_name *cur;
1147
1148 for (cur = seccomp_log_names; cur->name; cur++) {
1149 if (!strcmp(cur->name, name)) {
1150 *action_logged = cur->log;
1151 return true;
1152 }
1153 }
1154
1155 return false;
1156}
1157
1158static bool seccomp_actions_logged_from_names(u32 *actions_logged, char *names)
1159{
1160 char *name;
1161
1162 *actions_logged = 0;
1163 while ((name = strsep(&names, " ")) && *name) {
1164 u32 action_logged = 0;
1165
1166 if (!seccomp_action_logged_from_name(&action_logged, name))
1167 return false;
1168
1169 *actions_logged |= action_logged;
1170 }
1171
1172 return true;
1173}
1174
1175static int seccomp_actions_logged_handler(struct ctl_table *ro_table, int write,
1176 void __user *buffer, size_t *lenp,
1177 loff_t *ppos)
1178{
1179 char names[sizeof(seccomp_actions_avail)];
1180 struct ctl_table table;
1181 int ret;
1182
1183 if (write && !capable(CAP_SYS_ADMIN))
1184 return -EPERM;
1185
1186 memset(names, 0, sizeof(names));
1187
1188 if (!write) {
1189 if (!seccomp_names_from_actions_logged(names, sizeof(names),
1190 seccomp_actions_logged))
1191 return -EINVAL;
1192 }
1193
1194 table = *ro_table;
1195 table.data = names;
1196 table.maxlen = sizeof(names);
1197 ret = proc_dostring(&table, write, buffer, lenp, ppos);
1198 if (ret)
1199 return ret;
1200
1201 if (write) {
1202 u32 actions_logged;
1203
1204 if (!seccomp_actions_logged_from_names(&actions_logged,
1205 table.data))
1206 return -EINVAL;
1207
1208 if (actions_logged & SECCOMP_LOG_ALLOW)
1209 return -EINVAL;
1210
1211 seccomp_actions_logged = actions_logged;
1212 }
1213
1214 return 0;
1215}
1216
Tyler Hicks8e5f1ad2017-08-11 04:33:52 +00001217static struct ctl_path seccomp_sysctl_path[] = {
1218 { .procname = "kernel", },
1219 { .procname = "seccomp", },
1220 { }
1221};
1222
1223static struct ctl_table seccomp_sysctl_table[] = {
1224 {
1225 .procname = "actions_avail",
1226 .data = (void *) &seccomp_actions_avail,
1227 .maxlen = sizeof(seccomp_actions_avail),
1228 .mode = 0444,
1229 .proc_handler = proc_dostring,
1230 },
Tyler Hicks0ddec0f2017-08-11 04:33:54 +00001231 {
1232 .procname = "actions_logged",
1233 .mode = 0644,
1234 .proc_handler = seccomp_actions_logged_handler,
1235 },
Tyler Hicks8e5f1ad2017-08-11 04:33:52 +00001236 { }
1237};
1238
1239static int __init seccomp_sysctl_init(void)
1240{
1241 struct ctl_table_header *hdr;
1242
1243 hdr = register_sysctl_paths(seccomp_sysctl_path, seccomp_sysctl_table);
1244 if (!hdr)
1245 pr_warn("seccomp: sysctl registration failed\n");
1246 else
1247 kmemleak_not_leak(hdr);
1248
1249 return 0;
1250}
1251
1252device_initcall(seccomp_sysctl_init)
1253
1254#endif /* CONFIG_SYSCTL */