Linux 5.9-rc2
[linux-block.git] / kernel / seccomp.c
CommitLineData
b2441318 1// SPDX-License-Identifier: GPL-2.0
1da177e4
LT
2/*
3 * linux/kernel/seccomp.c
4 *
5 * Copyright 2004-2005 Andrea Arcangeli <andrea@cpushare.com>
6 *
e2cfabdf
WD
7 * Copyright (C) 2012 Google, Inc.
8 * Will Drewry <wad@chromium.org>
9 *
10 * This defines a simple but solid secure-computing facility.
11 *
12 * Mode 1 uses a fixed list of allowed system calls.
13 * Mode 2 allows user-defined system call filters in the form
14 * of Berkeley Packet Filters/Linux Socket Filters.
1da177e4 15 */
e68f9d49 16#define pr_fmt(fmt) "seccomp: " fmt
1da177e4 17
0b5fa229 18#include <linux/refcount.h>
85e7bac3 19#include <linux/audit.h>
5b101740 20#include <linux/compat.h>
b25e6716 21#include <linux/coredump.h>
8e5f1ad1 22#include <linux/kmemleak.h>
5c307089
KC
23#include <linux/nospec.h>
24#include <linux/prctl.h>
e2cfabdf 25#include <linux/sched.h>
68db0cf1 26#include <linux/sched/task_stack.h>
e2cfabdf 27#include <linux/seccomp.h>
c8bee430 28#include <linux/slab.h>
48dc92b9 29#include <linux/syscalls.h>
8e5f1ad1 30#include <linux/sysctl.h>
1da177e4 31
a4412fc9 32#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
e2cfabdf 33#include <asm/syscall.h>
a4412fc9 34#endif
e2cfabdf
WD
35
36#ifdef CONFIG_SECCOMP_FILTER
6a21cc50 37#include <linux/file.h>
e2cfabdf 38#include <linux/filter.h>
c2e1f2e3 39#include <linux/pid.h>
fb0fadf9 40#include <linux/ptrace.h>
e2cfabdf 41#include <linux/security.h>
e2cfabdf
WD
42#include <linux/tracehook.h>
43#include <linux/uaccess.h>
6a21cc50 44#include <linux/anon_inodes.h>
9f87dcf1 45#include <linux/lockdep.h>
6a21cc50 46
47e33c05
KC
47/*
48 * When SECCOMP_IOCTL_NOTIF_ID_VALID was first introduced, it had the
49 * wrong direction flag in the ioctl number. This is the broken one,
50 * which the kernel needs to keep supporting until all userspaces stop
51 * using the wrong command number.
52 */
53#define SECCOMP_IOCTL_NOTIF_ID_VALID_WRONG_DIR SECCOMP_IOR(2, __u64)
54
6a21cc50
TA
55enum notify_state {
56 SECCOMP_NOTIFY_INIT,
57 SECCOMP_NOTIFY_SENT,
58 SECCOMP_NOTIFY_REPLIED,
59};
60
61struct seccomp_knotif {
62 /* The struct pid of the task whose filter triggered the notification */
63 struct task_struct *task;
64
65 /* The "cookie" for this request; this is unique for this filter. */
66 u64 id;
67
68 /*
69 * The seccomp data. This pointer is valid the entire time this
70 * notification is active, since it comes from __seccomp_filter which
71 * eclipses the entire lifecycle here.
72 */
73 const struct seccomp_data *data;
74
75 /*
76 * Notification states. When SECCOMP_RET_USER_NOTIF is returned, a
77 * struct seccomp_knotif is created and starts out in INIT. Once the
78 * handler reads the notification off of an FD, it transitions to SENT.
79 * If a signal is received the state transitions back to INIT and
80 * another message is sent. When the userspace handler replies, state
81 * transitions to REPLIED.
82 */
83 enum notify_state state;
84
85 /* The return values, only valid when in SECCOMP_NOTIFY_REPLIED */
86 int error;
87 long val;
fb3c5386 88 u32 flags;
6a21cc50 89
7cf97b12
SD
90 /*
91 * Signals when this has changed states, such as the listener
92 * dying, a new seccomp addfd message, or changing to REPLIED
93 */
6a21cc50
TA
94 struct completion ready;
95
96 struct list_head list;
7cf97b12
SD
97
98 /* outstanding addfd requests */
99 struct list_head addfd;
100};
101
102/**
103 * struct seccomp_kaddfd - container for seccomp_addfd ioctl messages
104 *
105 * @file: A reference to the file to install in the other task
106 * @fd: The fd number to install it at. If the fd number is -1, it means the
107 * installing process should allocate the fd as normal.
108 * @flags: The flags for the new file descriptor. At the moment, only O_CLOEXEC
109 * is allowed.
110 * @ret: The return value of the installing process. It is set to the fd num
111 * upon success (>= 0).
112 * @completion: Indicates that the installing process has completed fd
113 * installation, or gone away (either due to successful
114 * reply, or signal)
115 *
116 */
117struct seccomp_kaddfd {
118 struct file *file;
119 int fd;
120 unsigned int flags;
121
122 /* To only be set on reply */
123 int ret;
124 struct completion completion;
125 struct list_head list;
6a21cc50
TA
126};
127
128/**
129 * struct notification - container for seccomp userspace notifications. Since
130 * most seccomp filters will not have notification listeners attached and this
131 * structure is fairly large, we store the notification-specific stuff in a
132 * separate structure.
133 *
134 * @request: A semaphore that users of this notification can wait on for
135 * changes. Actual reads and writes are still controlled with
136 * filter->notify_lock.
137 * @next_id: The id of the next request.
138 * @notifications: A list of struct seccomp_knotif elements.
6a21cc50
TA
139 */
140struct notification {
141 struct semaphore request;
142 u64 next_id;
143 struct list_head notifications;
6a21cc50 144};
e2cfabdf
WD
145
146/**
147 * struct seccomp_filter - container for seccomp BPF programs
148 *
b707ddee
CB
149 * @refs: Reference count to manage the object lifetime.
150 * A filter's reference count is incremented for each directly
151 * attached task, once for the dependent filter, and if
152 * requested for the user notifier. When @refs reaches zero,
153 * the filter can be freed.
99cdb8b9
CB
154 * @users: A filter's @users count is incremented for each directly
155 * attached task (filter installation, fork(), thread_sync),
156 * and once for the dependent filter (tracked in filter->prev).
157 * When it reaches zero it indicates that no direct or indirect
158 * users of that filter exist. No new tasks can get associated with
159 * this filter after reaching 0. The @users count is always smaller
160 * or equal to @refs. Hence, reaching 0 for @users does not mean
161 * the filter can be freed.
e66a3997 162 * @log: true if all actions except for SECCOMP_RET_ALLOW should be logged
e2cfabdf 163 * @prev: points to a previously installed, or inherited, filter
285fdfc5 164 * @prog: the BPF program to evaluate
6a21cc50
TA
165 * @notif: the struct that holds all notification related information
166 * @notify_lock: A lock for all notification-related accesses.
76194c4e 167 * @wqh: A wait queue for poll if a notifier is in use.
e2cfabdf
WD
168 *
169 * seccomp_filter objects are organized in a tree linked via the @prev
170 * pointer. For any task, it appears to be a singly-linked list starting
171 * with current->seccomp.filter, the most recently attached or inherited filter.
172 * However, multiple filters may share a @prev node, by way of fork(), which
173 * results in a unidirectional tree existing in memory. This is similar to
174 * how namespaces work.
175 *
176 * seccomp_filter objects should never be modified after being attached
b707ddee 177 * to a task_struct (other than @refs).
e2cfabdf
WD
178 */
179struct seccomp_filter {
b707ddee 180 refcount_t refs;
99cdb8b9 181 refcount_t users;
e66a3997 182 bool log;
e2cfabdf 183 struct seccomp_filter *prev;
7ae457c1 184 struct bpf_prog *prog;
6a21cc50
TA
185 struct notification *notif;
186 struct mutex notify_lock;
76194c4e 187 wait_queue_head_t wqh;
e2cfabdf
WD
188};
189
190/* Limit any path through the tree to 256KB worth of instructions. */
191#define MAX_INSNS_PER_PATH ((1 << 18) / sizeof(struct sock_filter))
192
bd4cf0ed 193/*
e2cfabdf
WD
194 * Endianness is explicitly ignored and left for BPF program authors to manage
195 * as per the specific architecture.
196 */
bd4cf0ed 197static void populate_seccomp_data(struct seccomp_data *sd)
e2cfabdf 198{
bd4cf0ed
AS
199 struct task_struct *task = current;
200 struct pt_regs *regs = task_pt_regs(task);
2eac7648 201 unsigned long args[6];
e2cfabdf 202
bd4cf0ed 203 sd->nr = syscall_get_nr(task, regs);
16add411 204 sd->arch = syscall_get_arch(task);
b35f549d 205 syscall_get_arguments(task, regs, args);
2eac7648
DB
206 sd->args[0] = args[0];
207 sd->args[1] = args[1];
208 sd->args[2] = args[2];
209 sd->args[3] = args[3];
210 sd->args[4] = args[4];
211 sd->args[5] = args[5];
bd4cf0ed 212 sd->instruction_pointer = KSTK_EIP(task);
e2cfabdf
WD
213}
214
215/**
216 * seccomp_check_filter - verify seccomp filter code
217 * @filter: filter to verify
218 * @flen: length of filter
219 *
4df95ff4 220 * Takes a previously checked filter (by bpf_check_classic) and
e2cfabdf
WD
221 * redirects all filter code that loads struct sk_buff data
222 * and related data through seccomp_bpf_load. It also
223 * enforces length and alignment checking of those loads.
224 *
225 * Returns 0 if the rule set is legal or -EINVAL if not.
226 */
227static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen)
228{
229 int pc;
230 for (pc = 0; pc < flen; pc++) {
231 struct sock_filter *ftest = &filter[pc];
232 u16 code = ftest->code;
233 u32 k = ftest->k;
234
235 switch (code) {
34805931 236 case BPF_LD | BPF_W | BPF_ABS:
bd4cf0ed 237 ftest->code = BPF_LDX | BPF_W | BPF_ABS;
e2cfabdf
WD
238 /* 32-bit aligned and not out of bounds. */
239 if (k >= sizeof(struct seccomp_data) || k & 3)
240 return -EINVAL;
241 continue;
34805931 242 case BPF_LD | BPF_W | BPF_LEN:
bd4cf0ed 243 ftest->code = BPF_LD | BPF_IMM;
e2cfabdf
WD
244 ftest->k = sizeof(struct seccomp_data);
245 continue;
34805931 246 case BPF_LDX | BPF_W | BPF_LEN:
bd4cf0ed 247 ftest->code = BPF_LDX | BPF_IMM;
e2cfabdf
WD
248 ftest->k = sizeof(struct seccomp_data);
249 continue;
250 /* Explicitly include allowed calls. */
34805931
DB
251 case BPF_RET | BPF_K:
252 case BPF_RET | BPF_A:
253 case BPF_ALU | BPF_ADD | BPF_K:
254 case BPF_ALU | BPF_ADD | BPF_X:
255 case BPF_ALU | BPF_SUB | BPF_K:
256 case BPF_ALU | BPF_SUB | BPF_X:
257 case BPF_ALU | BPF_MUL | BPF_K:
258 case BPF_ALU | BPF_MUL | BPF_X:
259 case BPF_ALU | BPF_DIV | BPF_K:
260 case BPF_ALU | BPF_DIV | BPF_X:
261 case BPF_ALU | BPF_AND | BPF_K:
262 case BPF_ALU | BPF_AND | BPF_X:
263 case BPF_ALU | BPF_OR | BPF_K:
264 case BPF_ALU | BPF_OR | BPF_X:
265 case BPF_ALU | BPF_XOR | BPF_K:
266 case BPF_ALU | BPF_XOR | BPF_X:
267 case BPF_ALU | BPF_LSH | BPF_K:
268 case BPF_ALU | BPF_LSH | BPF_X:
269 case BPF_ALU | BPF_RSH | BPF_K:
270 case BPF_ALU | BPF_RSH | BPF_X:
271 case BPF_ALU | BPF_NEG:
272 case BPF_LD | BPF_IMM:
273 case BPF_LDX | BPF_IMM:
274 case BPF_MISC | BPF_TAX:
275 case BPF_MISC | BPF_TXA:
276 case BPF_LD | BPF_MEM:
277 case BPF_LDX | BPF_MEM:
278 case BPF_ST:
279 case BPF_STX:
280 case BPF_JMP | BPF_JA:
281 case BPF_JMP | BPF_JEQ | BPF_K:
282 case BPF_JMP | BPF_JEQ | BPF_X:
283 case BPF_JMP | BPF_JGE | BPF_K:
284 case BPF_JMP | BPF_JGE | BPF_X:
285 case BPF_JMP | BPF_JGT | BPF_K:
286 case BPF_JMP | BPF_JGT | BPF_X:
287 case BPF_JMP | BPF_JSET | BPF_K:
288 case BPF_JMP | BPF_JSET | BPF_X:
e2cfabdf
WD
289 continue;
290 default:
291 return -EINVAL;
292 }
293 }
294 return 0;
295}
296
297/**
285fdfc5
MS
298 * seccomp_run_filters - evaluates all seccomp filters against @sd
299 * @sd: optional seccomp data to be passed to filters
deb4de8b
KC
300 * @match: stores struct seccomp_filter that resulted in the return value,
301 * unless filter returned SECCOMP_RET_ALLOW, in which case it will
302 * be unchanged.
e2cfabdf
WD
303 *
304 * Returns valid seccomp BPF response codes.
305 */
0466bdb9 306#define ACTION_ONLY(ret) ((s32)((ret) & (SECCOMP_RET_ACTION_FULL)))
deb4de8b
KC
307static u32 seccomp_run_filters(const struct seccomp_data *sd,
308 struct seccomp_filter **match)
e2cfabdf 309{
acf3b2c7 310 u32 ret = SECCOMP_RET_ALLOW;
8225d385
PK
311 /* Make sure cross-thread synced filter points somewhere sane. */
312 struct seccomp_filter *f =
506458ef 313 READ_ONCE(current->seccomp.filter);
acf3b2c7
WD
314
315 /* Ensure unexpected behavior doesn't result in failing open. */
0d42d73a 316 if (WARN_ON(f == NULL))
4d3b0b05 317 return SECCOMP_RET_KILL_PROCESS;
acf3b2c7 318
e2cfabdf
WD
319 /*
320 * All filters in the list are evaluated and the lowest BPF return
acf3b2c7 321 * value always takes priority (ignoring the DATA).
e2cfabdf 322 */
3ba2530c 323 for (; f; f = f->prev) {
3d9f773c 324 u32 cur_ret = bpf_prog_run_pin_on_cpu(f->prog, sd);
8f577cad 325
0466bdb9 326 if (ACTION_ONLY(cur_ret) < ACTION_ONLY(ret)) {
acf3b2c7 327 ret = cur_ret;
deb4de8b
KC
328 *match = f;
329 }
e2cfabdf
WD
330 }
331 return ret;
332}
1f41b450 333#endif /* CONFIG_SECCOMP_FILTER */
e2cfabdf 334
1f41b450
KC
335static inline bool seccomp_may_assign_mode(unsigned long seccomp_mode)
336{
69f6a34b 337 assert_spin_locked(&current->sighand->siglock);
dbd95212 338
1f41b450
KC
339 if (current->seccomp.mode && current->seccomp.mode != seccomp_mode)
340 return false;
341
342 return true;
343}
344
8bf37d8c 345void __weak arch_seccomp_spec_mitigate(struct task_struct *task) { }
5c307089 346
3ba2530c 347static inline void seccomp_assign_mode(struct task_struct *task,
00a02d0c
KC
348 unsigned long seccomp_mode,
349 unsigned long flags)
1f41b450 350{
69f6a34b 351 assert_spin_locked(&task->sighand->siglock);
dbd95212 352
3ba2530c
KC
353 task->seccomp.mode = seccomp_mode;
354 /*
355 * Make sure TIF_SECCOMP cannot be set before the mode (and
356 * filter) is set.
357 */
358 smp_mb__before_atomic();
00a02d0c
KC
359 /* Assume default seccomp processes want spec flaw mitigation. */
360 if ((flags & SECCOMP_FILTER_FLAG_SPEC_ALLOW) == 0)
8bf37d8c 361 arch_seccomp_spec_mitigate(task);
3ba2530c 362 set_tsk_thread_flag(task, TIF_SECCOMP);
1f41b450
KC
363}
364
365#ifdef CONFIG_SECCOMP_FILTER
c2e1f2e3
KC
366/* Returns 1 if the parent is an ancestor of the child. */
367static int is_ancestor(struct seccomp_filter *parent,
368 struct seccomp_filter *child)
369{
370 /* NULL is the root ancestor. */
371 if (parent == NULL)
372 return 1;
373 for (; child; child = child->prev)
374 if (child == parent)
375 return 1;
376 return 0;
377}
378
379/**
380 * seccomp_can_sync_threads: checks if all threads can be synchronized
381 *
382 * Expects sighand and cred_guard_mutex locks to be held.
383 *
384 * Returns 0 on success, -ve on error, or the pid of a thread which was
6beff00b 385 * either not in the correct seccomp mode or did not have an ancestral
c2e1f2e3
KC
386 * seccomp filter.
387 */
388static inline pid_t seccomp_can_sync_threads(void)
389{
390 struct task_struct *thread, *caller;
391
392 BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
69f6a34b 393 assert_spin_locked(&current->sighand->siglock);
c2e1f2e3
KC
394
395 /* Validate all threads being eligible for synchronization. */
396 caller = current;
397 for_each_thread(caller, thread) {
398 pid_t failed;
399
400 /* Skip current, since it is initiating the sync. */
401 if (thread == caller)
402 continue;
403
404 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED ||
405 (thread->seccomp.mode == SECCOMP_MODE_FILTER &&
406 is_ancestor(thread->seccomp.filter,
407 caller->seccomp.filter)))
408 continue;
409
410 /* Return the first thread that cannot be synchronized. */
411 failed = task_pid_vnr(thread);
412 /* If the pid cannot be resolved, then return -ESRCH */
0d42d73a 413 if (WARN_ON(failed == 0))
c2e1f2e3
KC
414 failed = -ESRCH;
415 return failed;
416 }
417
418 return 0;
419}
420
3a15fb6e
CB
421static inline void seccomp_filter_free(struct seccomp_filter *filter)
422{
423 if (filter) {
424 bpf_prog_destroy(filter->prog);
425 kfree(filter);
426 }
427}
428
99cdb8b9
CB
429static void __seccomp_filter_orphan(struct seccomp_filter *orig)
430{
431 while (orig && refcount_dec_and_test(&orig->users)) {
432 if (waitqueue_active(&orig->wqh))
433 wake_up_poll(&orig->wqh, EPOLLHUP);
434 orig = orig->prev;
435 }
436}
437
3a15fb6e
CB
438static void __put_seccomp_filter(struct seccomp_filter *orig)
439{
440 /* Clean up single-reference branches iteratively. */
441 while (orig && refcount_dec_and_test(&orig->refs)) {
442 struct seccomp_filter *freeme = orig;
443 orig = orig->prev;
444 seccomp_filter_free(freeme);
445 }
446}
447
99cdb8b9
CB
448static void __seccomp_filter_release(struct seccomp_filter *orig)
449{
450 /* Notify about any unused filters in the task's former filter tree. */
451 __seccomp_filter_orphan(orig);
452 /* Finally drop all references to the task's former tree. */
453 __put_seccomp_filter(orig);
454}
455
3a15fb6e 456/**
99cdb8b9
CB
457 * seccomp_filter_release - Detach the task from its filter tree,
458 * drop its reference count, and notify
459 * about unused filters
3a15fb6e
CB
460 *
461 * This function should only be called when the task is exiting as
462 * it detaches it from its filter tree. As such, READ_ONCE() and
463 * barriers are not needed here, as would normally be needed.
464 */
465void seccomp_filter_release(struct task_struct *tsk)
466{
467 struct seccomp_filter *orig = tsk->seccomp.filter;
468
469 /* Detach task from its filter tree. */
470 tsk->seccomp.filter = NULL;
99cdb8b9 471 __seccomp_filter_release(orig);
3a15fb6e
CB
472}
473
c2e1f2e3
KC
474/**
475 * seccomp_sync_threads: sets all threads to use current's filter
476 *
477 * Expects sighand and cred_guard_mutex locks to be held, and for
478 * seccomp_can_sync_threads() to have returned success already
479 * without dropping the locks.
480 *
481 */
00a02d0c 482static inline void seccomp_sync_threads(unsigned long flags)
c2e1f2e3
KC
483{
484 struct task_struct *thread, *caller;
485
486 BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
69f6a34b 487 assert_spin_locked(&current->sighand->siglock);
c2e1f2e3
KC
488
489 /* Synchronize all threads. */
490 caller = current;
491 for_each_thread(caller, thread) {
492 /* Skip current, since it needs no changes. */
493 if (thread == caller)
494 continue;
495
496 /* Get a task reference for the new leaf node. */
497 get_seccomp_filter(caller);
99cdb8b9 498
c2e1f2e3
KC
499 /*
500 * Drop the task reference to the shared ancestor since
501 * current's path will hold a reference. (This also
502 * allows a put before the assignment.)
503 */
99cdb8b9
CB
504 __seccomp_filter_release(thread->seccomp.filter);
505
506 /* Make our new filter tree visible. */
c2e1f2e3
KC
507 smp_store_release(&thread->seccomp.filter,
508 caller->seccomp.filter);
c818c03b
KC
509 atomic_set(&thread->seccomp.filter_count,
510 atomic_read(&thread->seccomp.filter_count));
103502a3
JH
511
512 /*
513 * Don't let an unprivileged task work around
514 * the no_new_privs restriction by creating
515 * a thread that sets it up, enters seccomp,
516 * then dies.
517 */
518 if (task_no_new_privs(caller))
519 task_set_no_new_privs(thread);
520
c2e1f2e3
KC
521 /*
522 * Opt the other thread into seccomp if needed.
523 * As threads are considered to be trust-realm
524 * equivalent (see ptrace_may_access), it is safe to
525 * allow one thread to transition the other.
526 */
103502a3 527 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED)
00a02d0c
KC
528 seccomp_assign_mode(thread, SECCOMP_MODE_FILTER,
529 flags);
c2e1f2e3
KC
530 }
531}
532
e2cfabdf 533/**
c8bee430 534 * seccomp_prepare_filter: Prepares a seccomp filter for use.
e2cfabdf
WD
535 * @fprog: BPF program to install
536 *
c8bee430 537 * Returns filter on success or an ERR_PTR on failure.
e2cfabdf 538 */
c8bee430 539static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog)
e2cfabdf 540{
ac67eb2c
DB
541 struct seccomp_filter *sfilter;
542 int ret;
97f2645f 543 const bool save_orig = IS_ENABLED(CONFIG_CHECKPOINT_RESTORE);
e2cfabdf
WD
544
545 if (fprog->len == 0 || fprog->len > BPF_MAXINSNS)
c8bee430 546 return ERR_PTR(-EINVAL);
d9e12f42 547
c8bee430 548 BUG_ON(INT_MAX / fprog->len < sizeof(struct sock_filter));
e2cfabdf
WD
549
550 /*
119ce5c8 551 * Installing a seccomp filter requires that the task has
e2cfabdf
WD
552 * CAP_SYS_ADMIN in its namespace or be running with no_new_privs.
553 * This avoids scenarios where unprivileged tasks can affect the
554 * behavior of privileged children.
555 */
1d4457f9 556 if (!task_no_new_privs(current) &&
c1a85a00
MM
557 security_capable(current_cred(), current_user_ns(),
558 CAP_SYS_ADMIN, CAP_OPT_NOAUDIT) != 0)
c8bee430 559 return ERR_PTR(-EACCES);
e2cfabdf 560
bd4cf0ed 561 /* Allocate a new seccomp_filter */
ac67eb2c
DB
562 sfilter = kzalloc(sizeof(*sfilter), GFP_KERNEL | __GFP_NOWARN);
563 if (!sfilter)
d9e12f42 564 return ERR_PTR(-ENOMEM);
ac67eb2c 565
6a21cc50 566 mutex_init(&sfilter->notify_lock);
ac67eb2c 567 ret = bpf_prog_create_from_user(&sfilter->prog, fprog,
f8e529ed 568 seccomp_check_filter, save_orig);
ac67eb2c
DB
569 if (ret < 0) {
570 kfree(sfilter);
571 return ERR_PTR(ret);
d9e12f42 572 }
bd4cf0ed 573
b707ddee 574 refcount_set(&sfilter->refs, 1);
99cdb8b9 575 refcount_set(&sfilter->users, 1);
76194c4e 576 init_waitqueue_head(&sfilter->wqh);
e2cfabdf 577
ac67eb2c 578 return sfilter;
e2cfabdf
WD
579}
580
581/**
c8bee430 582 * seccomp_prepare_user_filter - prepares a user-supplied sock_fprog
e2cfabdf
WD
583 * @user_filter: pointer to the user data containing a sock_fprog.
584 *
585 * Returns 0 on success and non-zero otherwise.
586 */
c8bee430
KC
587static struct seccomp_filter *
588seccomp_prepare_user_filter(const char __user *user_filter)
e2cfabdf
WD
589{
590 struct sock_fprog fprog;
c8bee430 591 struct seccomp_filter *filter = ERR_PTR(-EFAULT);
e2cfabdf
WD
592
593#ifdef CONFIG_COMPAT
5c38065e 594 if (in_compat_syscall()) {
e2cfabdf
WD
595 struct compat_sock_fprog fprog32;
596 if (copy_from_user(&fprog32, user_filter, sizeof(fprog32)))
597 goto out;
598 fprog.len = fprog32.len;
599 fprog.filter = compat_ptr(fprog32.filter);
600 } else /* falls through to the if below. */
601#endif
602 if (copy_from_user(&fprog, user_filter, sizeof(fprog)))
603 goto out;
c8bee430 604 filter = seccomp_prepare_filter(&fprog);
e2cfabdf 605out:
c8bee430
KC
606 return filter;
607}
608
609/**
610 * seccomp_attach_filter: validate and attach filter
611 * @flags: flags to change filter behavior
612 * @filter: seccomp filter to add to the current process
613 *
dbd95212
KC
614 * Caller must be holding current->sighand->siglock lock.
615 *
7a0df7fb
TA
616 * Returns 0 on success, -ve on error, or
617 * - in TSYNC mode: the pid of a thread which was either not in the correct
618 * seccomp mode or did not have an ancestral seccomp filter
619 * - in NEW_LISTENER mode: the fd of the new listener
c8bee430
KC
620 */
621static long seccomp_attach_filter(unsigned int flags,
622 struct seccomp_filter *filter)
623{
624 unsigned long total_insns;
625 struct seccomp_filter *walker;
626
69f6a34b 627 assert_spin_locked(&current->sighand->siglock);
dbd95212 628
c8bee430
KC
629 /* Validate resulting filter length. */
630 total_insns = filter->prog->len;
631 for (walker = current->seccomp.filter; walker; walker = walker->prev)
632 total_insns += walker->prog->len + 4; /* 4 instr penalty */
633 if (total_insns > MAX_INSNS_PER_PATH)
634 return -ENOMEM;
635
c2e1f2e3
KC
636 /* If thread sync has been requested, check that it is possible. */
637 if (flags & SECCOMP_FILTER_FLAG_TSYNC) {
638 int ret;
639
640 ret = seccomp_can_sync_threads();
51891498
TA
641 if (ret) {
642 if (flags & SECCOMP_FILTER_FLAG_TSYNC_ESRCH)
643 return -ESRCH;
644 else
645 return ret;
646 }
c2e1f2e3
KC
647 }
648
e66a3997
TH
649 /* Set log flag, if present. */
650 if (flags & SECCOMP_FILTER_FLAG_LOG)
651 filter->log = true;
652
c8bee430
KC
653 /*
654 * If there is an existing filter, make it the prev and don't drop its
655 * task reference.
656 */
657 filter->prev = current->seccomp.filter;
658 current->seccomp.filter = filter;
c818c03b 659 atomic_inc(&current->seccomp.filter_count);
c8bee430 660
c2e1f2e3
KC
661 /* Now that the new filter is in place, synchronize to all threads. */
662 if (flags & SECCOMP_FILTER_FLAG_TSYNC)
00a02d0c 663 seccomp_sync_threads(flags);
c2e1f2e3 664
c8bee430 665 return 0;
e2cfabdf
WD
666}
667
084f5601 668static void __get_seccomp_filter(struct seccomp_filter *filter)
66a733ea 669{
b707ddee 670 refcount_inc(&filter->refs);
66a733ea
ON
671}
672
e2cfabdf
WD
673/* get_seccomp_filter - increments the reference count of the filter on @tsk */
674void get_seccomp_filter(struct task_struct *tsk)
675{
676 struct seccomp_filter *orig = tsk->seccomp.filter;
677 if (!orig)
678 return;
66a733ea 679 __get_seccomp_filter(orig);
99cdb8b9 680 refcount_inc(&orig->users);
e2cfabdf
WD
681}
682
ae7795bc 683static void seccomp_init_siginfo(kernel_siginfo_t *info, int syscall, int reason)
b25e6716 684{
3b10db2b 685 clear_siginfo(info);
b25e6716
MF
686 info->si_signo = SIGSYS;
687 info->si_code = SYS_SECCOMP;
688 info->si_call_addr = (void __user *)KSTK_EIP(current);
689 info->si_errno = reason;
16add411 690 info->si_arch = syscall_get_arch(current);
b25e6716
MF
691 info->si_syscall = syscall;
692}
693
bb6ea430
WD
694/**
695 * seccomp_send_sigsys - signals the task to allow in-process syscall emulation
696 * @syscall: syscall number to send to userland
697 * @reason: filter-supplied reason code to send to userland (via si_errno)
698 *
699 * Forces a SIGSYS with a code of SYS_SECCOMP and related sigsys info.
700 */
701static void seccomp_send_sigsys(int syscall, int reason)
702{
ae7795bc 703 struct kernel_siginfo info;
b25e6716 704 seccomp_init_siginfo(&info, syscall, reason);
a89e9b8a 705 force_sig_info(&info);
bb6ea430 706}
e2cfabdf 707#endif /* CONFIG_SECCOMP_FILTER */
1da177e4 708
0ddec0fc 709/* For use with seccomp_actions_logged */
4d3b0b05
KC
710#define SECCOMP_LOG_KILL_PROCESS (1 << 0)
711#define SECCOMP_LOG_KILL_THREAD (1 << 1)
0ddec0fc
TH
712#define SECCOMP_LOG_TRAP (1 << 2)
713#define SECCOMP_LOG_ERRNO (1 << 3)
714#define SECCOMP_LOG_TRACE (1 << 4)
59f5cf44
TH
715#define SECCOMP_LOG_LOG (1 << 5)
716#define SECCOMP_LOG_ALLOW (1 << 6)
6a21cc50 717#define SECCOMP_LOG_USER_NOTIF (1 << 7)
0ddec0fc 718
4d3b0b05
KC
719static u32 seccomp_actions_logged = SECCOMP_LOG_KILL_PROCESS |
720 SECCOMP_LOG_KILL_THREAD |
fd76875c
KC
721 SECCOMP_LOG_TRAP |
722 SECCOMP_LOG_ERRNO |
6a21cc50 723 SECCOMP_LOG_USER_NOTIF |
fd76875c 724 SECCOMP_LOG_TRACE |
59f5cf44 725 SECCOMP_LOG_LOG;
0ddec0fc 726
e66a3997
TH
727static inline void seccomp_log(unsigned long syscall, long signr, u32 action,
728 bool requested)
0ddec0fc
TH
729{
730 bool log = false;
731
732 switch (action) {
733 case SECCOMP_RET_ALLOW:
e66a3997 734 break;
0ddec0fc 735 case SECCOMP_RET_TRAP:
e66a3997
TH
736 log = requested && seccomp_actions_logged & SECCOMP_LOG_TRAP;
737 break;
0ddec0fc 738 case SECCOMP_RET_ERRNO:
e66a3997
TH
739 log = requested && seccomp_actions_logged & SECCOMP_LOG_ERRNO;
740 break;
0ddec0fc 741 case SECCOMP_RET_TRACE:
e66a3997 742 log = requested && seccomp_actions_logged & SECCOMP_LOG_TRACE;
0ddec0fc 743 break;
6a21cc50
TA
744 case SECCOMP_RET_USER_NOTIF:
745 log = requested && seccomp_actions_logged & SECCOMP_LOG_USER_NOTIF;
746 break;
59f5cf44
TH
747 case SECCOMP_RET_LOG:
748 log = seccomp_actions_logged & SECCOMP_LOG_LOG;
749 break;
fd76875c 750 case SECCOMP_RET_KILL_THREAD:
fd76875c 751 log = seccomp_actions_logged & SECCOMP_LOG_KILL_THREAD;
4d3b0b05
KC
752 break;
753 case SECCOMP_RET_KILL_PROCESS:
754 default:
755 log = seccomp_actions_logged & SECCOMP_LOG_KILL_PROCESS;
0ddec0fc
TH
756 }
757
758 /*
326bee02
TH
759 * Emit an audit message when the action is RET_KILL_*, RET_LOG, or the
760 * FILTER_FLAG_LOG bit was set. The admin has the ability to silence
761 * any action from being logged by removing the action name from the
762 * seccomp_actions_logged sysctl.
0ddec0fc 763 */
326bee02
TH
764 if (!log)
765 return;
0ddec0fc 766
326bee02 767 audit_seccomp(syscall, signr, action);
0ddec0fc
TH
768}
769
1da177e4
LT
770/*
771 * Secure computing mode 1 allows only read/write/exit/sigreturn.
772 * To be fully secure this must be combined with rlimit
773 * to limit the stack allocations too.
774 */
cb4253aa 775static const int mode1_syscalls[] = {
1da177e4 776 __NR_seccomp_read, __NR_seccomp_write, __NR_seccomp_exit, __NR_seccomp_sigreturn,
fe4bfff8 777 -1, /* negative terminated */
1da177e4
LT
778};
779
a4412fc9 780static void __secure_computing_strict(int this_syscall)
1da177e4 781{
fe4bfff8 782 const int *allowed_syscalls = mode1_syscalls;
a4412fc9 783#ifdef CONFIG_COMPAT
5c38065e 784 if (in_compat_syscall())
fe4bfff8 785 allowed_syscalls = get_compat_mode1_syscalls();
a4412fc9
AL
786#endif
787 do {
fe4bfff8 788 if (*allowed_syscalls == this_syscall)
a4412fc9 789 return;
fe4bfff8 790 } while (*++allowed_syscalls != -1);
a4412fc9
AL
791
792#ifdef SECCOMP_DEBUG
793 dump_stack();
794#endif
fd76875c 795 seccomp_log(this_syscall, SIGKILL, SECCOMP_RET_KILL_THREAD, true);
a4412fc9
AL
796 do_exit(SIGKILL);
797}
798
799#ifndef CONFIG_HAVE_ARCH_SECCOMP_FILTER
800void secure_computing_strict(int this_syscall)
801{
802 int mode = current->seccomp.mode;
803
97f2645f 804 if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) &&
13c4a901
TA
805 unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
806 return;
807
221272f9 808 if (mode == SECCOMP_MODE_DISABLED)
a4412fc9
AL
809 return;
810 else if (mode == SECCOMP_MODE_STRICT)
811 __secure_computing_strict(this_syscall);
812 else
813 BUG();
814}
815#else
13aa72f0
AL
816
817#ifdef CONFIG_SECCOMP_FILTER
6a21cc50
TA
818static u64 seccomp_next_notify_id(struct seccomp_filter *filter)
819{
820 /*
821 * Note: overflow is ok here, the id just needs to be unique per
822 * filter.
823 */
824 lockdep_assert_held(&filter->notify_lock);
825 return filter->notif->next_id++;
826}
827
7cf97b12
SD
828static void seccomp_handle_addfd(struct seccomp_kaddfd *addfd)
829{
830 /*
831 * Remove the notification, and reset the list pointers, indicating
832 * that it has been handled.
833 */
834 list_del_init(&addfd->list);
835 addfd->ret = receive_fd_replace(addfd->fd, addfd->file, addfd->flags);
836 complete(&addfd->completion);
837}
838
fb3c5386
CB
839static int seccomp_do_user_notification(int this_syscall,
840 struct seccomp_filter *match,
841 const struct seccomp_data *sd)
6a21cc50
TA
842{
843 int err;
fb3c5386 844 u32 flags = 0;
6a21cc50
TA
845 long ret = 0;
846 struct seccomp_knotif n = {};
7cf97b12 847 struct seccomp_kaddfd *addfd, *tmp;
6a21cc50
TA
848
849 mutex_lock(&match->notify_lock);
850 err = -ENOSYS;
851 if (!match->notif)
852 goto out;
853
854 n.task = current;
855 n.state = SECCOMP_NOTIFY_INIT;
856 n.data = sd;
857 n.id = seccomp_next_notify_id(match);
858 init_completion(&n.ready);
859 list_add(&n.list, &match->notif->notifications);
7cf97b12 860 INIT_LIST_HEAD(&n.addfd);
6a21cc50
TA
861
862 up(&match->notif->request);
76194c4e 863 wake_up_poll(&match->wqh, EPOLLIN | EPOLLRDNORM);
6a21cc50
TA
864 mutex_unlock(&match->notify_lock);
865
866 /*
867 * This is where we wait for a reply from userspace.
868 */
7cf97b12 869wait:
6a21cc50
TA
870 err = wait_for_completion_interruptible(&n.ready);
871 mutex_lock(&match->notify_lock);
872 if (err == 0) {
7cf97b12
SD
873 /* Check if we were woken up by a addfd message */
874 addfd = list_first_entry_or_null(&n.addfd,
875 struct seccomp_kaddfd, list);
876 if (addfd && n.state != SECCOMP_NOTIFY_REPLIED) {
877 seccomp_handle_addfd(addfd);
878 mutex_unlock(&match->notify_lock);
879 goto wait;
880 }
6a21cc50
TA
881 ret = n.val;
882 err = n.error;
fb3c5386 883 flags = n.flags;
6a21cc50
TA
884 }
885
7cf97b12
SD
886 /* If there were any pending addfd calls, clear them out */
887 list_for_each_entry_safe(addfd, tmp, &n.addfd, list) {
888 /* The process went away before we got a chance to handle it */
889 addfd->ret = -ESRCH;
890 list_del_init(&addfd->list);
891 complete(&addfd->completion);
892 }
893
6a21cc50
TA
894 /*
895 * Note that it's possible the listener died in between the time when
7cf97b12 896 * we were notified of a response (or a signal) and when we were able to
6a21cc50
TA
897 * re-acquire the lock, so only delete from the list if the
898 * notification actually exists.
899 *
900 * Also note that this test is only valid because there's no way to
901 * *reattach* to a notifier right now. If one is added, we'll need to
902 * keep track of the notif itself and make sure they match here.
903 */
904 if (match->notif)
905 list_del(&n.list);
906out:
907 mutex_unlock(&match->notify_lock);
fb3c5386
CB
908
909 /* Userspace requests to continue the syscall. */
910 if (flags & SECCOMP_USER_NOTIF_FLAG_CONTINUE)
911 return 0;
912
6a21cc50
TA
913 syscall_set_return_value(current, task_pt_regs(current),
914 err, ret);
fb3c5386 915 return -1;
6a21cc50
TA
916}
917
ce6526e8
KC
918static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
919 const bool recheck_after_trace)
13aa72f0
AL
920{
921 u32 filter_ret, action;
deb4de8b 922 struct seccomp_filter *match = NULL;
13aa72f0 923 int data;
db511391 924 struct seccomp_data sd_local;
1da177e4 925
3ba2530c
KC
926 /*
927 * Make sure that any changes to mode from another thread have
928 * been seen after TIF_SECCOMP was seen.
929 */
930 rmb();
931
db511391
TA
932 if (!sd) {
933 populate_seccomp_data(&sd_local);
934 sd = &sd_local;
935 }
936
deb4de8b 937 filter_ret = seccomp_run_filters(sd, &match);
13aa72f0 938 data = filter_ret & SECCOMP_RET_DATA;
0466bdb9 939 action = filter_ret & SECCOMP_RET_ACTION_FULL;
13aa72f0
AL
940
941 switch (action) {
942 case SECCOMP_RET_ERRNO:
580c57f1
KC
943 /* Set low-order bits as an errno, capped at MAX_ERRNO. */
944 if (data > MAX_ERRNO)
945 data = MAX_ERRNO;
d39bd00d 946 syscall_set_return_value(current, task_pt_regs(current),
13aa72f0
AL
947 -data, 0);
948 goto skip;
949
950 case SECCOMP_RET_TRAP:
951 /* Show the handler the original registers. */
d39bd00d 952 syscall_rollback(current, task_pt_regs(current));
13aa72f0
AL
953 /* Let the filter pass back 16 bits of data. */
954 seccomp_send_sigsys(this_syscall, data);
955 goto skip;
956
957 case SECCOMP_RET_TRACE:
ce6526e8
KC
958 /* We've been put in this state by the ptracer already. */
959 if (recheck_after_trace)
960 return 0;
961
8112c4f1
KC
962 /* ENOSYS these calls if there is no tracer attached. */
963 if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP)) {
964 syscall_set_return_value(current,
965 task_pt_regs(current),
966 -ENOSYS, 0);
967 goto skip;
968 }
969
970 /* Allow the BPF to provide the event message */
971 ptrace_event(PTRACE_EVENT_SECCOMP, data);
972 /*
973 * The delivery of a fatal signal during event
485a252a
KC
974 * notification may silently skip tracer notification,
975 * which could leave us with a potentially unmodified
976 * syscall that the tracer would have liked to have
977 * changed. Since the process is about to die, we just
978 * force the syscall to be skipped and let the signal
979 * kill the process and correctly handle any tracer exit
980 * notifications.
8112c4f1
KC
981 */
982 if (fatal_signal_pending(current))
485a252a 983 goto skip;
8112c4f1
KC
984 /* Check if the tracer forced the syscall to be skipped. */
985 this_syscall = syscall_get_nr(current, task_pt_regs(current));
986 if (this_syscall < 0)
987 goto skip;
988
ce6526e8
KC
989 /*
990 * Recheck the syscall, since it may have changed. This
991 * intentionally uses a NULL struct seccomp_data to force
992 * a reload of all registers. This does not goto skip since
993 * a skip would have already been reported.
994 */
995 if (__seccomp_filter(this_syscall, NULL, true))
996 return -1;
997
8112c4f1 998 return 0;
13aa72f0 999
6a21cc50 1000 case SECCOMP_RET_USER_NOTIF:
fb3c5386
CB
1001 if (seccomp_do_user_notification(this_syscall, match, sd))
1002 goto skip;
1003
1004 return 0;
6a21cc50 1005
59f5cf44
TH
1006 case SECCOMP_RET_LOG:
1007 seccomp_log(this_syscall, 0, action, true);
1008 return 0;
1009
13aa72f0 1010 case SECCOMP_RET_ALLOW:
deb4de8b
KC
1011 /*
1012 * Note that the "match" filter will always be NULL for
1013 * this action since SECCOMP_RET_ALLOW is the starting
1014 * state in seccomp_run_filters().
1015 */
8112c4f1 1016 return 0;
13aa72f0 1017
fd76875c 1018 case SECCOMP_RET_KILL_THREAD:
4d3b0b05 1019 case SECCOMP_RET_KILL_PROCESS:
131b6351 1020 default:
e66a3997 1021 seccomp_log(this_syscall, SIGSYS, action, true);
d7276e32 1022 /* Dump core only if this is the last remaining thread. */
4d3b0b05
KC
1023 if (action == SECCOMP_RET_KILL_PROCESS ||
1024 get_nr_threads(current) == 1) {
ae7795bc 1025 kernel_siginfo_t info;
131b6351 1026
d7276e32
KC
1027 /* Show the original registers in the dump. */
1028 syscall_rollback(current, task_pt_regs(current));
1029 /* Trigger a manual coredump since do_exit skips it. */
1030 seccomp_init_siginfo(&info, this_syscall, data);
1031 do_coredump(&info);
1032 }
4d3b0b05
KC
1033 if (action == SECCOMP_RET_KILL_PROCESS)
1034 do_group_exit(SIGSYS);
1035 else
1036 do_exit(SIGSYS);
13aa72f0
AL
1037 }
1038
1039 unreachable();
1040
1041skip:
e66a3997 1042 seccomp_log(this_syscall, 0, action, match ? match->log : false);
8112c4f1
KC
1043 return -1;
1044}
1045#else
ce6526e8
KC
1046static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
1047 const bool recheck_after_trace)
8112c4f1
KC
1048{
1049 BUG();
13aa72f0 1050}
1da177e4 1051#endif
13aa72f0 1052
8112c4f1 1053int __secure_computing(const struct seccomp_data *sd)
13aa72f0
AL
1054{
1055 int mode = current->seccomp.mode;
8112c4f1 1056 int this_syscall;
13aa72f0 1057
97f2645f 1058 if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) &&
13c4a901 1059 unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
8112c4f1
KC
1060 return 0;
1061
1062 this_syscall = sd ? sd->nr :
1063 syscall_get_nr(current, task_pt_regs(current));
13c4a901 1064
13aa72f0 1065 switch (mode) {
e2cfabdf 1066 case SECCOMP_MODE_STRICT:
13aa72f0 1067 __secure_computing_strict(this_syscall); /* may call do_exit */
8112c4f1 1068 return 0;
13aa72f0 1069 case SECCOMP_MODE_FILTER:
ce6526e8 1070 return __seccomp_filter(this_syscall, sd, false);
1da177e4
LT
1071 default:
1072 BUG();
1073 }
13aa72f0 1074}
a4412fc9 1075#endif /* CONFIG_HAVE_ARCH_SECCOMP_FILTER */
1d9d02fe
AA
1076
1077long prctl_get_seccomp(void)
1078{
1079 return current->seccomp.mode;
1080}
1081
e2cfabdf 1082/**
3b23dd12 1083 * seccomp_set_mode_strict: internal function for setting strict seccomp
e2cfabdf
WD
1084 *
1085 * Once current->seccomp.mode is non-zero, it may not be changed.
1086 *
1087 * Returns 0 on success or -EINVAL on failure.
1088 */
3b23dd12 1089static long seccomp_set_mode_strict(void)
1d9d02fe 1090{
3b23dd12 1091 const unsigned long seccomp_mode = SECCOMP_MODE_STRICT;
e2cfabdf 1092 long ret = -EINVAL;
1d9d02fe 1093
dbd95212
KC
1094 spin_lock_irq(&current->sighand->siglock);
1095
1f41b450 1096 if (!seccomp_may_assign_mode(seccomp_mode))
1d9d02fe
AA
1097 goto out;
1098
cf99abac 1099#ifdef TIF_NOTSC
3b23dd12 1100 disable_TSC();
cf99abac 1101#endif
00a02d0c 1102 seccomp_assign_mode(current, seccomp_mode, 0);
3b23dd12
KC
1103 ret = 0;
1104
1105out:
dbd95212 1106 spin_unlock_irq(&current->sighand->siglock);
3b23dd12
KC
1107
1108 return ret;
1109}
1110
e2cfabdf 1111#ifdef CONFIG_SECCOMP_FILTER
6a21cc50
TA
1112static int seccomp_notify_release(struct inode *inode, struct file *file)
1113{
1114 struct seccomp_filter *filter = file->private_data;
1115 struct seccomp_knotif *knotif;
1116
a811dc61
TA
1117 if (!filter)
1118 return 0;
1119
6a21cc50
TA
1120 mutex_lock(&filter->notify_lock);
1121
1122 /*
1123 * If this file is being closed because e.g. the task who owned it
1124 * died, let's wake everyone up who was waiting on us.
1125 */
1126 list_for_each_entry(knotif, &filter->notif->notifications, list) {
1127 if (knotif->state == SECCOMP_NOTIFY_REPLIED)
1128 continue;
1129
1130 knotif->state = SECCOMP_NOTIFY_REPLIED;
1131 knotif->error = -ENOSYS;
1132 knotif->val = 0;
1133
7cf97b12
SD
1134 /*
1135 * We do not need to wake up any pending addfd messages, as
1136 * the notifier will do that for us, as this just looks
1137 * like a standard reply.
1138 */
6a21cc50
TA
1139 complete(&knotif->ready);
1140 }
1141
1142 kfree(filter->notif);
1143 filter->notif = NULL;
1144 mutex_unlock(&filter->notify_lock);
1145 __put_seccomp_filter(filter);
1146 return 0;
1147}
1148
9f87dcf1
SD
1149/* must be called with notif_lock held */
1150static inline struct seccomp_knotif *
1151find_notification(struct seccomp_filter *filter, u64 id)
1152{
1153 struct seccomp_knotif *cur;
1154
1155 lockdep_assert_held(&filter->notify_lock);
1156
1157 list_for_each_entry(cur, &filter->notif->notifications, list) {
1158 if (cur->id == id)
1159 return cur;
1160 }
1161
1162 return NULL;
1163}
1164
1165
6a21cc50
TA
1166static long seccomp_notify_recv(struct seccomp_filter *filter,
1167 void __user *buf)
1168{
1169 struct seccomp_knotif *knotif = NULL, *cur;
1170 struct seccomp_notif unotif;
1171 ssize_t ret;
1172
2882d53c
SD
1173 /* Verify that we're not given garbage to keep struct extensible. */
1174 ret = check_zeroed_user(buf, sizeof(unotif));
1175 if (ret < 0)
1176 return ret;
1177 if (!ret)
1178 return -EINVAL;
1179
6a21cc50
TA
1180 memset(&unotif, 0, sizeof(unotif));
1181
1182 ret = down_interruptible(&filter->notif->request);
1183 if (ret < 0)
1184 return ret;
1185
1186 mutex_lock(&filter->notify_lock);
1187 list_for_each_entry(cur, &filter->notif->notifications, list) {
1188 if (cur->state == SECCOMP_NOTIFY_INIT) {
1189 knotif = cur;
1190 break;
1191 }
1192 }
1193
1194 /*
1195 * If we didn't find a notification, it could be that the task was
1196 * interrupted by a fatal signal between the time we were woken and
1197 * when we were able to acquire the rw lock.
1198 */
1199 if (!knotif) {
1200 ret = -ENOENT;
1201 goto out;
1202 }
1203
1204 unotif.id = knotif->id;
1205 unotif.pid = task_pid_vnr(knotif->task);
1206 unotif.data = *(knotif->data);
1207
1208 knotif->state = SECCOMP_NOTIFY_SENT;
76194c4e 1209 wake_up_poll(&filter->wqh, EPOLLOUT | EPOLLWRNORM);
6a21cc50
TA
1210 ret = 0;
1211out:
1212 mutex_unlock(&filter->notify_lock);
1213
1214 if (ret == 0 && copy_to_user(buf, &unotif, sizeof(unotif))) {
1215 ret = -EFAULT;
1216
1217 /*
1218 * Userspace screwed up. To make sure that we keep this
1219 * notification alive, let's reset it back to INIT. It
1220 * may have died when we released the lock, so we need to make
1221 * sure it's still around.
1222 */
6a21cc50 1223 mutex_lock(&filter->notify_lock);
9f87dcf1 1224 knotif = find_notification(filter, unotif.id);
6a21cc50
TA
1225 if (knotif) {
1226 knotif->state = SECCOMP_NOTIFY_INIT;
1227 up(&filter->notif->request);
1228 }
1229 mutex_unlock(&filter->notify_lock);
1230 }
1231
1232 return ret;
1233}
1234
1235static long seccomp_notify_send(struct seccomp_filter *filter,
1236 void __user *buf)
1237{
1238 struct seccomp_notif_resp resp = {};
9f87dcf1 1239 struct seccomp_knotif *knotif;
6a21cc50
TA
1240 long ret;
1241
1242 if (copy_from_user(&resp, buf, sizeof(resp)))
1243 return -EFAULT;
1244
fb3c5386
CB
1245 if (resp.flags & ~SECCOMP_USER_NOTIF_FLAG_CONTINUE)
1246 return -EINVAL;
1247
1248 if ((resp.flags & SECCOMP_USER_NOTIF_FLAG_CONTINUE) &&
1249 (resp.error || resp.val))
6a21cc50
TA
1250 return -EINVAL;
1251
1252 ret = mutex_lock_interruptible(&filter->notify_lock);
1253 if (ret < 0)
1254 return ret;
1255
9f87dcf1 1256 knotif = find_notification(filter, resp.id);
6a21cc50
TA
1257 if (!knotif) {
1258 ret = -ENOENT;
1259 goto out;
1260 }
1261
1262 /* Allow exactly one reply. */
1263 if (knotif->state != SECCOMP_NOTIFY_SENT) {
1264 ret = -EINPROGRESS;
1265 goto out;
1266 }
1267
1268 ret = 0;
1269 knotif->state = SECCOMP_NOTIFY_REPLIED;
1270 knotif->error = resp.error;
1271 knotif->val = resp.val;
fb3c5386 1272 knotif->flags = resp.flags;
6a21cc50
TA
1273 complete(&knotif->ready);
1274out:
1275 mutex_unlock(&filter->notify_lock);
1276 return ret;
1277}
1278
1279static long seccomp_notify_id_valid(struct seccomp_filter *filter,
1280 void __user *buf)
1281{
9f87dcf1 1282 struct seccomp_knotif *knotif;
6a21cc50
TA
1283 u64 id;
1284 long ret;
1285
1286 if (copy_from_user(&id, buf, sizeof(id)))
1287 return -EFAULT;
1288
1289 ret = mutex_lock_interruptible(&filter->notify_lock);
1290 if (ret < 0)
1291 return ret;
1292
9f87dcf1
SD
1293 knotif = find_notification(filter, id);
1294 if (knotif && knotif->state == SECCOMP_NOTIFY_SENT)
1295 ret = 0;
1296 else
1297 ret = -ENOENT;
6a21cc50 1298
6a21cc50
TA
1299 mutex_unlock(&filter->notify_lock);
1300 return ret;
1301}
1302
7cf97b12
SD
1303static long seccomp_notify_addfd(struct seccomp_filter *filter,
1304 struct seccomp_notif_addfd __user *uaddfd,
1305 unsigned int size)
1306{
1307 struct seccomp_notif_addfd addfd;
1308 struct seccomp_knotif *knotif;
1309 struct seccomp_kaddfd kaddfd;
1310 int ret;
1311
1312 BUILD_BUG_ON(sizeof(addfd) < SECCOMP_NOTIFY_ADDFD_SIZE_VER0);
1313 BUILD_BUG_ON(sizeof(addfd) != SECCOMP_NOTIFY_ADDFD_SIZE_LATEST);
1314
1315 if (size < SECCOMP_NOTIFY_ADDFD_SIZE_VER0 || size >= PAGE_SIZE)
1316 return -EINVAL;
1317
1318 ret = copy_struct_from_user(&addfd, sizeof(addfd), uaddfd, size);
1319 if (ret)
1320 return ret;
1321
1322 if (addfd.newfd_flags & ~O_CLOEXEC)
1323 return -EINVAL;
1324
1325 if (addfd.flags & ~SECCOMP_ADDFD_FLAG_SETFD)
1326 return -EINVAL;
1327
1328 if (addfd.newfd && !(addfd.flags & SECCOMP_ADDFD_FLAG_SETFD))
1329 return -EINVAL;
1330
1331 kaddfd.file = fget(addfd.srcfd);
1332 if (!kaddfd.file)
1333 return -EBADF;
1334
1335 kaddfd.flags = addfd.newfd_flags;
1336 kaddfd.fd = (addfd.flags & SECCOMP_ADDFD_FLAG_SETFD) ?
1337 addfd.newfd : -1;
1338 init_completion(&kaddfd.completion);
1339
1340 ret = mutex_lock_interruptible(&filter->notify_lock);
1341 if (ret < 0)
1342 goto out;
1343
1344 knotif = find_notification(filter, addfd.id);
1345 if (!knotif) {
1346 ret = -ENOENT;
1347 goto out_unlock;
1348 }
1349
1350 /*
1351 * We do not want to allow for FD injection to occur before the
1352 * notification has been picked up by a userspace handler, or after
1353 * the notification has been replied to.
1354 */
1355 if (knotif->state != SECCOMP_NOTIFY_SENT) {
1356 ret = -EINPROGRESS;
1357 goto out_unlock;
1358 }
1359
1360 list_add(&kaddfd.list, &knotif->addfd);
1361 complete(&knotif->ready);
1362 mutex_unlock(&filter->notify_lock);
1363
1364 /* Now we wait for it to be processed or be interrupted */
1365 ret = wait_for_completion_interruptible(&kaddfd.completion);
1366 if (ret == 0) {
1367 /*
1368 * We had a successful completion. The other side has already
1369 * removed us from the addfd queue, and
1370 * wait_for_completion_interruptible has a memory barrier upon
1371 * success that lets us read this value directly without
1372 * locking.
1373 */
1374 ret = kaddfd.ret;
1375 goto out;
1376 }
1377
1378 mutex_lock(&filter->notify_lock);
1379 /*
1380 * Even though we were woken up by a signal and not a successful
1381 * completion, a completion may have happened in the mean time.
1382 *
1383 * We need to check again if the addfd request has been handled,
1384 * and if not, we will remove it from the queue.
1385 */
1386 if (list_empty(&kaddfd.list))
1387 ret = kaddfd.ret;
1388 else
1389 list_del(&kaddfd.list);
1390
1391out_unlock:
1392 mutex_unlock(&filter->notify_lock);
1393out:
1394 fput(kaddfd.file);
1395
1396 return ret;
1397}
1398
6a21cc50
TA
1399static long seccomp_notify_ioctl(struct file *file, unsigned int cmd,
1400 unsigned long arg)
1401{
1402 struct seccomp_filter *filter = file->private_data;
1403 void __user *buf = (void __user *)arg;
1404
7cf97b12 1405 /* Fixed-size ioctls */
6a21cc50
TA
1406 switch (cmd) {
1407 case SECCOMP_IOCTL_NOTIF_RECV:
1408 return seccomp_notify_recv(filter, buf);
1409 case SECCOMP_IOCTL_NOTIF_SEND:
1410 return seccomp_notify_send(filter, buf);
47e33c05 1411 case SECCOMP_IOCTL_NOTIF_ID_VALID_WRONG_DIR:
6a21cc50
TA
1412 case SECCOMP_IOCTL_NOTIF_ID_VALID:
1413 return seccomp_notify_id_valid(filter, buf);
7cf97b12
SD
1414 }
1415
1416 /* Extensible Argument ioctls */
1417#define EA_IOCTL(cmd) ((cmd) & ~(IOC_INOUT | IOCSIZE_MASK))
1418 switch (EA_IOCTL(cmd)) {
1419 case EA_IOCTL(SECCOMP_IOCTL_NOTIF_ADDFD):
1420 return seccomp_notify_addfd(filter, buf, _IOC_SIZE(cmd));
6a21cc50
TA
1421 default:
1422 return -EINVAL;
1423 }
1424}
1425
1426static __poll_t seccomp_notify_poll(struct file *file,
1427 struct poll_table_struct *poll_tab)
1428{
1429 struct seccomp_filter *filter = file->private_data;
1430 __poll_t ret = 0;
1431 struct seccomp_knotif *cur;
1432
76194c4e 1433 poll_wait(file, &filter->wqh, poll_tab);
6a21cc50 1434
319deec7 1435 if (mutex_lock_interruptible(&filter->notify_lock) < 0)
6a21cc50
TA
1436 return EPOLLERR;
1437
1438 list_for_each_entry(cur, &filter->notif->notifications, list) {
1439 if (cur->state == SECCOMP_NOTIFY_INIT)
1440 ret |= EPOLLIN | EPOLLRDNORM;
1441 if (cur->state == SECCOMP_NOTIFY_SENT)
1442 ret |= EPOLLOUT | EPOLLWRNORM;
1443 if ((ret & EPOLLIN) && (ret & EPOLLOUT))
1444 break;
1445 }
1446
1447 mutex_unlock(&filter->notify_lock);
1448
99cdb8b9
CB
1449 if (refcount_read(&filter->users) == 0)
1450 ret |= EPOLLHUP;
1451
6a21cc50
TA
1452 return ret;
1453}
1454
1455static const struct file_operations seccomp_notify_ops = {
1456 .poll = seccomp_notify_poll,
1457 .release = seccomp_notify_release,
1458 .unlocked_ioctl = seccomp_notify_ioctl,
3db81afd 1459 .compat_ioctl = seccomp_notify_ioctl,
6a21cc50
TA
1460};
1461
1462static struct file *init_listener(struct seccomp_filter *filter)
1463{
1464 struct file *ret = ERR_PTR(-EBUSY);
1465 struct seccomp_filter *cur;
1466
1467 for (cur = current->seccomp.filter; cur; cur = cur->prev) {
1468 if (cur->notif)
1469 goto out;
1470 }
1471
1472 ret = ERR_PTR(-ENOMEM);
1473 filter->notif = kzalloc(sizeof(*(filter->notif)), GFP_KERNEL);
1474 if (!filter->notif)
1475 goto out;
1476
1477 sema_init(&filter->notif->request, 0);
1478 filter->notif->next_id = get_random_u64();
1479 INIT_LIST_HEAD(&filter->notif->notifications);
6a21cc50
TA
1480
1481 ret = anon_inode_getfile("seccomp notify", &seccomp_notify_ops,
1482 filter, O_RDWR);
1483 if (IS_ERR(ret))
1484 goto out_notif;
1485
1486 /* The file has a reference to it now */
1487 __get_seccomp_filter(filter);
1488
1489out_notif:
1490 if (IS_ERR(ret))
1491 kfree(filter->notif);
1492out:
1493 return ret;
1494}
1495
3b23dd12
KC
1496/**
1497 * seccomp_set_mode_filter: internal function for setting seccomp filter
48dc92b9 1498 * @flags: flags to change filter behavior
3b23dd12
KC
1499 * @filter: struct sock_fprog containing filter
1500 *
1501 * This function may be called repeatedly to install additional filters.
1502 * Every filter successfully installed will be evaluated (in reverse order)
1503 * for each system call the task makes.
1504 *
1505 * Once current->seccomp.mode is non-zero, it may not be changed.
1506 *
1507 * Returns 0 on success or -EINVAL on failure.
1508 */
48dc92b9
KC
1509static long seccomp_set_mode_filter(unsigned int flags,
1510 const char __user *filter)
3b23dd12
KC
1511{
1512 const unsigned long seccomp_mode = SECCOMP_MODE_FILTER;
c8bee430 1513 struct seccomp_filter *prepared = NULL;
3b23dd12 1514 long ret = -EINVAL;
6a21cc50
TA
1515 int listener = -1;
1516 struct file *listener_f = NULL;
3b23dd12 1517
48dc92b9 1518 /* Validate flags. */
c2e1f2e3 1519 if (flags & ~SECCOMP_FILTER_FLAG_MASK)
dbd95212 1520 return -EINVAL;
48dc92b9 1521
7a0df7fb
TA
1522 /*
1523 * In the successful case, NEW_LISTENER returns the new listener fd.
1524 * But in the failure case, TSYNC returns the thread that died. If you
1525 * combine these two flags, there's no way to tell whether something
51891498
TA
1526 * succeeded or failed. So, let's disallow this combination if the user
1527 * has not explicitly requested no errors from TSYNC.
7a0df7fb
TA
1528 */
1529 if ((flags & SECCOMP_FILTER_FLAG_TSYNC) &&
51891498
TA
1530 (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) &&
1531 ((flags & SECCOMP_FILTER_FLAG_TSYNC_ESRCH) == 0))
7a0df7fb
TA
1532 return -EINVAL;
1533
c8bee430
KC
1534 /* Prepare the new filter before holding any locks. */
1535 prepared = seccomp_prepare_user_filter(filter);
1536 if (IS_ERR(prepared))
1537 return PTR_ERR(prepared);
1538
6a21cc50
TA
1539 if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) {
1540 listener = get_unused_fd_flags(O_CLOEXEC);
1541 if (listener < 0) {
1542 ret = listener;
1543 goto out_free;
1544 }
1545
1546 listener_f = init_listener(prepared);
1547 if (IS_ERR(listener_f)) {
1548 put_unused_fd(listener);
1549 ret = PTR_ERR(listener_f);
1550 goto out_free;
1551 }
1552 }
1553
c2e1f2e3
KC
1554 /*
1555 * Make sure we cannot change seccomp or nnp state via TSYNC
1556 * while another thread is in the middle of calling exec.
1557 */
1558 if (flags & SECCOMP_FILTER_FLAG_TSYNC &&
1559 mutex_lock_killable(&current->signal->cred_guard_mutex))
6a21cc50 1560 goto out_put_fd;
c2e1f2e3 1561
dbd95212
KC
1562 spin_lock_irq(&current->sighand->siglock);
1563
3b23dd12
KC
1564 if (!seccomp_may_assign_mode(seccomp_mode))
1565 goto out;
1566
c8bee430 1567 ret = seccomp_attach_filter(flags, prepared);
3b23dd12 1568 if (ret)
e2cfabdf 1569 goto out;
c8bee430
KC
1570 /* Do not free the successfully attached filter. */
1571 prepared = NULL;
1d9d02fe 1572
00a02d0c 1573 seccomp_assign_mode(current, seccomp_mode, flags);
e2cfabdf 1574out:
dbd95212 1575 spin_unlock_irq(&current->sighand->siglock);
c2e1f2e3
KC
1576 if (flags & SECCOMP_FILTER_FLAG_TSYNC)
1577 mutex_unlock(&current->signal->cred_guard_mutex);
6a21cc50
TA
1578out_put_fd:
1579 if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) {
7a0df7fb 1580 if (ret) {
a811dc61 1581 listener_f->private_data = NULL;
6a21cc50
TA
1582 fput(listener_f);
1583 put_unused_fd(listener);
1584 } else {
1585 fd_install(listener, listener_f);
1586 ret = listener;
1587 }
1588 }
c2e1f2e3 1589out_free:
c8bee430 1590 seccomp_filter_free(prepared);
1d9d02fe
AA
1591 return ret;
1592}
3b23dd12 1593#else
48dc92b9
KC
1594static inline long seccomp_set_mode_filter(unsigned int flags,
1595 const char __user *filter)
3b23dd12
KC
1596{
1597 return -EINVAL;
1598}
1599#endif
d78ab02c 1600
d612b1fd
TH
1601static long seccomp_get_action_avail(const char __user *uaction)
1602{
1603 u32 action;
1604
1605 if (copy_from_user(&action, uaction, sizeof(action)))
1606 return -EFAULT;
1607
1608 switch (action) {
0466bdb9 1609 case SECCOMP_RET_KILL_PROCESS:
fd76875c 1610 case SECCOMP_RET_KILL_THREAD:
d612b1fd
TH
1611 case SECCOMP_RET_TRAP:
1612 case SECCOMP_RET_ERRNO:
6a21cc50 1613 case SECCOMP_RET_USER_NOTIF:
d612b1fd 1614 case SECCOMP_RET_TRACE:
59f5cf44 1615 case SECCOMP_RET_LOG:
d612b1fd
TH
1616 case SECCOMP_RET_ALLOW:
1617 break;
1618 default:
1619 return -EOPNOTSUPP;
1620 }
1621
1622 return 0;
1623}
1624
6a21cc50
TA
1625static long seccomp_get_notif_sizes(void __user *usizes)
1626{
1627 struct seccomp_notif_sizes sizes = {
1628 .seccomp_notif = sizeof(struct seccomp_notif),
1629 .seccomp_notif_resp = sizeof(struct seccomp_notif_resp),
1630 .seccomp_data = sizeof(struct seccomp_data),
1631 };
1632
1633 if (copy_to_user(usizes, &sizes, sizeof(sizes)))
1634 return -EFAULT;
1635
1636 return 0;
1637}
1638
48dc92b9
KC
1639/* Common entry point for both prctl and syscall. */
1640static long do_seccomp(unsigned int op, unsigned int flags,
a5662e4d 1641 void __user *uargs)
48dc92b9
KC
1642{
1643 switch (op) {
1644 case SECCOMP_SET_MODE_STRICT:
1645 if (flags != 0 || uargs != NULL)
1646 return -EINVAL;
1647 return seccomp_set_mode_strict();
1648 case SECCOMP_SET_MODE_FILTER:
1649 return seccomp_set_mode_filter(flags, uargs);
d612b1fd
TH
1650 case SECCOMP_GET_ACTION_AVAIL:
1651 if (flags != 0)
1652 return -EINVAL;
1653
1654 return seccomp_get_action_avail(uargs);
6a21cc50
TA
1655 case SECCOMP_GET_NOTIF_SIZES:
1656 if (flags != 0)
1657 return -EINVAL;
1658
1659 return seccomp_get_notif_sizes(uargs);
48dc92b9
KC
1660 default:
1661 return -EINVAL;
1662 }
1663}
1664
1665SYSCALL_DEFINE3(seccomp, unsigned int, op, unsigned int, flags,
a5662e4d 1666 void __user *, uargs)
48dc92b9
KC
1667{
1668 return do_seccomp(op, flags, uargs);
1669}
1670
d78ab02c
KC
1671/**
1672 * prctl_set_seccomp: configures current->seccomp.mode
1673 * @seccomp_mode: requested mode to use
1674 * @filter: optional struct sock_fprog for use with SECCOMP_MODE_FILTER
1675 *
1676 * Returns 0 on success or -EINVAL on failure.
1677 */
a5662e4d 1678long prctl_set_seccomp(unsigned long seccomp_mode, void __user *filter)
d78ab02c 1679{
48dc92b9 1680 unsigned int op;
a5662e4d 1681 void __user *uargs;
48dc92b9 1682
3b23dd12
KC
1683 switch (seccomp_mode) {
1684 case SECCOMP_MODE_STRICT:
48dc92b9
KC
1685 op = SECCOMP_SET_MODE_STRICT;
1686 /*
1687 * Setting strict mode through prctl always ignored filter,
1688 * so make sure it is always NULL here to pass the internal
1689 * check in do_seccomp().
1690 */
1691 uargs = NULL;
1692 break;
3b23dd12 1693 case SECCOMP_MODE_FILTER:
48dc92b9
KC
1694 op = SECCOMP_SET_MODE_FILTER;
1695 uargs = filter;
1696 break;
3b23dd12
KC
1697 default:
1698 return -EINVAL;
1699 }
48dc92b9
KC
1700
1701 /* prctl interface doesn't have flags, so they are always zero. */
1702 return do_seccomp(op, 0, uargs);
d78ab02c 1703}
f8e529ed
TA
1704
1705#if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
f06eae83
TA
1706static struct seccomp_filter *get_nth_filter(struct task_struct *task,
1707 unsigned long filter_off)
f8e529ed 1708{
f06eae83
TA
1709 struct seccomp_filter *orig, *filter;
1710 unsigned long count;
f8e529ed 1711
f06eae83
TA
1712 /*
1713 * Note: this is only correct because the caller should be the (ptrace)
1714 * tracer of the task, otherwise lock_task_sighand is needed.
1715 */
f8e529ed 1716 spin_lock_irq(&task->sighand->siglock);
f06eae83 1717
f8e529ed 1718 if (task->seccomp.mode != SECCOMP_MODE_FILTER) {
f06eae83
TA
1719 spin_unlock_irq(&task->sighand->siglock);
1720 return ERR_PTR(-EINVAL);
f8e529ed
TA
1721 }
1722
f06eae83
TA
1723 orig = task->seccomp.filter;
1724 __get_seccomp_filter(orig);
1725 spin_unlock_irq(&task->sighand->siglock);
1726
1727 count = 0;
1728 for (filter = orig; filter; filter = filter->prev)
f8e529ed 1729 count++;
f8e529ed
TA
1730
1731 if (filter_off >= count) {
f06eae83 1732 filter = ERR_PTR(-ENOENT);
f8e529ed
TA
1733 goto out;
1734 }
f8e529ed 1735
f06eae83
TA
1736 count -= filter_off;
1737 for (filter = orig; filter && count > 1; filter = filter->prev)
f8e529ed 1738 count--;
f8e529ed
TA
1739
1740 if (WARN_ON(count != 1 || !filter)) {
f06eae83 1741 filter = ERR_PTR(-ENOENT);
f8e529ed
TA
1742 goto out;
1743 }
1744
f06eae83
TA
1745 __get_seccomp_filter(filter);
1746
1747out:
1748 __put_seccomp_filter(orig);
1749 return filter;
1750}
1751
1752long seccomp_get_filter(struct task_struct *task, unsigned long filter_off,
1753 void __user *data)
1754{
1755 struct seccomp_filter *filter;
1756 struct sock_fprog_kern *fprog;
1757 long ret;
1758
1759 if (!capable(CAP_SYS_ADMIN) ||
1760 current->seccomp.mode != SECCOMP_MODE_DISABLED) {
1761 return -EACCES;
1762 }
1763
1764 filter = get_nth_filter(task, filter_off);
1765 if (IS_ERR(filter))
1766 return PTR_ERR(filter);
1767
f8e529ed
TA
1768 fprog = filter->prog->orig_prog;
1769 if (!fprog) {
470bf1f2 1770 /* This must be a new non-cBPF filter, since we save
f8e529ed
TA
1771 * every cBPF filter's orig_prog above when
1772 * CONFIG_CHECKPOINT_RESTORE is enabled.
1773 */
1774 ret = -EMEDIUMTYPE;
1775 goto out;
1776 }
1777
1778 ret = fprog->len;
1779 if (!data)
1780 goto out;
1781
f8e529ed
TA
1782 if (copy_to_user(data, fprog->filter, bpf_classic_proglen(fprog)))
1783 ret = -EFAULT;
1784
f8e529ed 1785out:
66a733ea 1786 __put_seccomp_filter(filter);
f8e529ed 1787 return ret;
f8e529ed 1788}
f8e529ed 1789
26500475
TA
1790long seccomp_get_metadata(struct task_struct *task,
1791 unsigned long size, void __user *data)
1792{
1793 long ret;
1794 struct seccomp_filter *filter;
1795 struct seccomp_metadata kmd = {};
1796
1797 if (!capable(CAP_SYS_ADMIN) ||
1798 current->seccomp.mode != SECCOMP_MODE_DISABLED) {
1799 return -EACCES;
1800 }
1801
1802 size = min_t(unsigned long, size, sizeof(kmd));
1803
63bb0045
TA
1804 if (size < sizeof(kmd.filter_off))
1805 return -EINVAL;
1806
1807 if (copy_from_user(&kmd.filter_off, data, sizeof(kmd.filter_off)))
26500475
TA
1808 return -EFAULT;
1809
1810 filter = get_nth_filter(task, kmd.filter_off);
1811 if (IS_ERR(filter))
1812 return PTR_ERR(filter);
1813
26500475
TA
1814 if (filter->log)
1815 kmd.flags |= SECCOMP_FILTER_FLAG_LOG;
1816
1817 ret = size;
1818 if (copy_to_user(data, &kmd, size))
1819 ret = -EFAULT;
1820
1821 __put_seccomp_filter(filter);
f8e529ed
TA
1822 return ret;
1823}
1824#endif
8e5f1ad1
TH
1825
1826#ifdef CONFIG_SYSCTL
1827
1828/* Human readable action names for friendly sysctl interaction */
0466bdb9 1829#define SECCOMP_RET_KILL_PROCESS_NAME "kill_process"
fd76875c 1830#define SECCOMP_RET_KILL_THREAD_NAME "kill_thread"
8e5f1ad1
TH
1831#define SECCOMP_RET_TRAP_NAME "trap"
1832#define SECCOMP_RET_ERRNO_NAME "errno"
6a21cc50 1833#define SECCOMP_RET_USER_NOTIF_NAME "user_notif"
8e5f1ad1 1834#define SECCOMP_RET_TRACE_NAME "trace"
59f5cf44 1835#define SECCOMP_RET_LOG_NAME "log"
8e5f1ad1
TH
1836#define SECCOMP_RET_ALLOW_NAME "allow"
1837
fd76875c 1838static const char seccomp_actions_avail[] =
0466bdb9 1839 SECCOMP_RET_KILL_PROCESS_NAME " "
fd76875c
KC
1840 SECCOMP_RET_KILL_THREAD_NAME " "
1841 SECCOMP_RET_TRAP_NAME " "
1842 SECCOMP_RET_ERRNO_NAME " "
6a21cc50 1843 SECCOMP_RET_USER_NOTIF_NAME " "
fd76875c
KC
1844 SECCOMP_RET_TRACE_NAME " "
1845 SECCOMP_RET_LOG_NAME " "
1846 SECCOMP_RET_ALLOW_NAME;
8e5f1ad1 1847
0ddec0fc
TH
1848struct seccomp_log_name {
1849 u32 log;
1850 const char *name;
1851};
1852
1853static const struct seccomp_log_name seccomp_log_names[] = {
0466bdb9 1854 { SECCOMP_LOG_KILL_PROCESS, SECCOMP_RET_KILL_PROCESS_NAME },
fd76875c 1855 { SECCOMP_LOG_KILL_THREAD, SECCOMP_RET_KILL_THREAD_NAME },
0ddec0fc
TH
1856 { SECCOMP_LOG_TRAP, SECCOMP_RET_TRAP_NAME },
1857 { SECCOMP_LOG_ERRNO, SECCOMP_RET_ERRNO_NAME },
6a21cc50 1858 { SECCOMP_LOG_USER_NOTIF, SECCOMP_RET_USER_NOTIF_NAME },
0ddec0fc 1859 { SECCOMP_LOG_TRACE, SECCOMP_RET_TRACE_NAME },
59f5cf44 1860 { SECCOMP_LOG_LOG, SECCOMP_RET_LOG_NAME },
0ddec0fc
TH
1861 { SECCOMP_LOG_ALLOW, SECCOMP_RET_ALLOW_NAME },
1862 { }
1863};
1864
1865static bool seccomp_names_from_actions_logged(char *names, size_t size,
beb44aca
TH
1866 u32 actions_logged,
1867 const char *sep)
0ddec0fc
TH
1868{
1869 const struct seccomp_log_name *cur;
beb44aca 1870 bool append_sep = false;
0ddec0fc
TH
1871
1872 for (cur = seccomp_log_names; cur->name && size; cur++) {
1873 ssize_t ret;
1874
1875 if (!(actions_logged & cur->log))
1876 continue;
1877
beb44aca
TH
1878 if (append_sep) {
1879 ret = strscpy(names, sep, size);
0ddec0fc
TH
1880 if (ret < 0)
1881 return false;
1882
1883 names += ret;
1884 size -= ret;
1885 } else
beb44aca 1886 append_sep = true;
0ddec0fc
TH
1887
1888 ret = strscpy(names, cur->name, size);
1889 if (ret < 0)
1890 return false;
1891
1892 names += ret;
1893 size -= ret;
1894 }
1895
1896 return true;
1897}
1898
1899static bool seccomp_action_logged_from_name(u32 *action_logged,
1900 const char *name)
1901{
1902 const struct seccomp_log_name *cur;
1903
1904 for (cur = seccomp_log_names; cur->name; cur++) {
1905 if (!strcmp(cur->name, name)) {
1906 *action_logged = cur->log;
1907 return true;
1908 }
1909 }
1910
1911 return false;
1912}
1913
1914static bool seccomp_actions_logged_from_names(u32 *actions_logged, char *names)
1915{
1916 char *name;
1917
1918 *actions_logged = 0;
1919 while ((name = strsep(&names, " ")) && *name) {
1920 u32 action_logged = 0;
1921
1922 if (!seccomp_action_logged_from_name(&action_logged, name))
1923 return false;
1924
1925 *actions_logged |= action_logged;
1926 }
1927
1928 return true;
1929}
1930
d013db02
TH
1931static int read_actions_logged(struct ctl_table *ro_table, void __user *buffer,
1932 size_t *lenp, loff_t *ppos)
0ddec0fc
TH
1933{
1934 char names[sizeof(seccomp_actions_avail)];
1935 struct ctl_table table;
d013db02
TH
1936
1937 memset(names, 0, sizeof(names));
1938
1939 if (!seccomp_names_from_actions_logged(names, sizeof(names),
beb44aca 1940 seccomp_actions_logged, " "))
d013db02
TH
1941 return -EINVAL;
1942
1943 table = *ro_table;
1944 table.data = names;
1945 table.maxlen = sizeof(names);
1946 return proc_dostring(&table, 0, buffer, lenp, ppos);
1947}
1948
1949static int write_actions_logged(struct ctl_table *ro_table, void __user *buffer,
ea6eca77 1950 size_t *lenp, loff_t *ppos, u32 *actions_logged)
0ddec0fc
TH
1951{
1952 char names[sizeof(seccomp_actions_avail)];
1953 struct ctl_table table;
1954 int ret;
1955
d013db02 1956 if (!capable(CAP_SYS_ADMIN))
0ddec0fc
TH
1957 return -EPERM;
1958
1959 memset(names, 0, sizeof(names));
1960
0ddec0fc
TH
1961 table = *ro_table;
1962 table.data = names;
1963 table.maxlen = sizeof(names);
d013db02 1964 ret = proc_dostring(&table, 1, buffer, lenp, ppos);
0ddec0fc
TH
1965 if (ret)
1966 return ret;
1967
ea6eca77 1968 if (!seccomp_actions_logged_from_names(actions_logged, table.data))
d013db02 1969 return -EINVAL;
0ddec0fc 1970
ea6eca77 1971 if (*actions_logged & SECCOMP_LOG_ALLOW)
d013db02 1972 return -EINVAL;
0ddec0fc 1973
ea6eca77 1974 seccomp_actions_logged = *actions_logged;
0ddec0fc
TH
1975 return 0;
1976}
0ddec0fc 1977
ea6eca77
TH
1978static void audit_actions_logged(u32 actions_logged, u32 old_actions_logged,
1979 int ret)
1980{
1981 char names[sizeof(seccomp_actions_avail)];
1982 char old_names[sizeof(seccomp_actions_avail)];
1983 const char *new = names;
1984 const char *old = old_names;
0ddec0fc 1985
ea6eca77
TH
1986 if (!audit_enabled)
1987 return;
1988
1989 memset(names, 0, sizeof(names));
1990 memset(old_names, 0, sizeof(old_names));
1991
1992 if (ret)
1993 new = "?";
1994 else if (!actions_logged)
1995 new = "(none)";
1996 else if (!seccomp_names_from_actions_logged(names, sizeof(names),
1997 actions_logged, ","))
1998 new = "?";
1999
2000 if (!old_actions_logged)
2001 old = "(none)";
2002 else if (!seccomp_names_from_actions_logged(old_names,
2003 sizeof(old_names),
2004 old_actions_logged, ","))
2005 old = "?";
2006
2007 return audit_seccomp_actions_logged(new, old, !ret);
2008}
2009
d013db02 2010static int seccomp_actions_logged_handler(struct ctl_table *ro_table, int write,
32927393 2011 void *buffer, size_t *lenp,
d013db02
TH
2012 loff_t *ppos)
2013{
ea6eca77
TH
2014 int ret;
2015
2016 if (write) {
2017 u32 actions_logged = 0;
2018 u32 old_actions_logged = seccomp_actions_logged;
2019
2020 ret = write_actions_logged(ro_table, buffer, lenp, ppos,
2021 &actions_logged);
2022 audit_actions_logged(actions_logged, old_actions_logged, ret);
2023 } else
2024 ret = read_actions_logged(ro_table, buffer, lenp, ppos);
2025
2026 return ret;
0ddec0fc
TH
2027}
2028
8e5f1ad1
TH
2029static struct ctl_path seccomp_sysctl_path[] = {
2030 { .procname = "kernel", },
2031 { .procname = "seccomp", },
2032 { }
2033};
2034
2035static struct ctl_table seccomp_sysctl_table[] = {
2036 {
2037 .procname = "actions_avail",
2038 .data = (void *) &seccomp_actions_avail,
2039 .maxlen = sizeof(seccomp_actions_avail),
2040 .mode = 0444,
2041 .proc_handler = proc_dostring,
2042 },
0ddec0fc
TH
2043 {
2044 .procname = "actions_logged",
2045 .mode = 0644,
2046 .proc_handler = seccomp_actions_logged_handler,
2047 },
8e5f1ad1
TH
2048 { }
2049};
2050
2051static int __init seccomp_sysctl_init(void)
2052{
2053 struct ctl_table_header *hdr;
2054
2055 hdr = register_sysctl_paths(seccomp_sysctl_path, seccomp_sysctl_table);
2056 if (!hdr)
e68f9d49 2057 pr_warn("sysctl registration failed\n");
8e5f1ad1
TH
2058 else
2059 kmemleak_not_leak(hdr);
2060
2061 return 0;
2062}
2063
2064device_initcall(seccomp_sysctl_init)
2065
2066#endif /* CONFIG_SYSCTL */