seccomp: Move config option SECCOMP to arch/Kconfig

In order to make adding configurable features into seccomp easier,
it's better to have the options at one single location, considering
especially that the bulk of seccomp code is arch-independent. An quick
look also show that many SECCOMP descriptions are outdated; they talk
about /proc rather than prctl.

As a result of moving the config option and keeping it default on,
architectures arm, arm64, csky, riscv, sh, and xtensa did not have SECCOMP
on by default prior to this and SECCOMP will be default in this change.

Architectures microblaze, mips, powerpc, s390, sh, and sparc have an
outdated depend on PROC_FS and this dependency is removed in this change.

Suggested-by: Jann Horn <jannh@google.com>
Link: https://lore.kernel.org/lkml/CAG48ez1YWz9cnp08UZgeieYRhHdqh-ch7aNwc4JRBnGyrmgfMg@mail.gmail.com/
Signed-off-by: YiFei Zhu <yifeifz2@illinois.edu>
[kees: added HAVE_ARCH_SECCOMP help text, tweaked wording]
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/9ede6ef35c847e58d61e476c6a39540520066613.1600951211.git.yifeifz2@illinois.edu

diff --git a/arch/Kconfig b/arch/Kconfig
index af14a567b493fc915fc9229bab07c1a331463b82..21a3675a7a3a03f39f5e7f3ac40f90830c7d3a5f 100644 (file)
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -444,10 +444,23 @@ config ARCH_WANT_OLD_COMPAT_IPC
        select ARCH_WANT_COMPAT_IPC_PARSE_VERSION
        bool
 
+config HAVE_ARCH_SECCOMP
+       bool
+       help
+         An arch should select this symbol to support seccomp mode 1 (the fixed
+         syscall policy), and must provide an overrides for __NR_seccomp_sigreturn,
+         and compat syscalls if the asm-generic/seccomp.h defaults need adjustment:
+         - __NR_seccomp_read_32
+         - __NR_seccomp_write_32
+         - __NR_seccomp_exit_32
+         - __NR_seccomp_sigreturn_32
+
 config HAVE_ARCH_SECCOMP_FILTER
        bool
+       select HAVE_ARCH_SECCOMP
        help
          An arch should select this symbol if it provides all of these things:
+         - all the requirements for HAVE_ARCH_SECCOMP
          - syscall_get_arch()
          - syscall_get_arguments()
          - syscall_rollback()
@@ -458,6 +471,23 @@ config HAVE_ARCH_SECCOMP_FILTER
            results in the system call being skipped immediately.
          - seccomp syscall wired up
 
+config SECCOMP
+       prompt "Enable seccomp to safely execute untrusted bytecode"
+       def_bool y
+       depends on HAVE_ARCH_SECCOMP
+       help
+         This kernel feature is useful for number crunching applications
+         that may need to handle untrusted bytecode during their
+         execution. By using pipes or other transports made available
+         to the process as file descriptors supporting the read/write
+         syscalls, it's possible to isolate those applications in their
+         own address space using seccomp. Once seccomp is enabled via
+         prctl(PR_SET_SECCOMP) or the seccomp() syscall, it cannot be
+         disabled and the task is only allowed to execute a few safe
+         syscalls defined by each seccomp mode.
+
+         If unsure, say Y.
+
 config SECCOMP_FILTER
        def_bool y
        depends on HAVE_ARCH_SECCOMP_FILTER && SECCOMP && NET

diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index e00d94b1665876594ca693593aa7231f83cf84e5..e26c19a162844c51bf7c48a13eccd0b9da55d0d6 100644 (file)
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -67,6 +67,7 @@ config ARM
        select HAVE_ARCH_JUMP_LABEL if !XIP_KERNEL && !CPU_ENDIAN_BE32 && MMU
        select HAVE_ARCH_KGDB if !CPU_ENDIAN_BE32 && MMU
        select HAVE_ARCH_MMAP_RND_BITS if MMU
+       select HAVE_ARCH_SECCOMP
        select HAVE_ARCH_SECCOMP_FILTER if AEABI && !OABI_COMPAT
        select HAVE_ARCH_THREAD_STRUCT_WHITELIST
        select HAVE_ARCH_TRACEHOOK
@@ -1617,20 +1618,6 @@ config UACCESS_WITH_MEMCPY
          However, if the CPU data cache is using a write-allocate mode,
          this option is unlikely to provide any performance gain.
 
-config SECCOMP
-       bool
-       prompt "Enable seccomp to safely compute untrusted bytecode"
-       help
-         This kernel feature is useful for number crunching applications
-         that may need to compute untrusted bytecode during their
-         execution. By using pipes or other transports made available to
-         the process as file descriptors supporting the read/write
-         syscalls, it's possible to isolate those applications in
-         their own address space using seccomp. Once seccomp is
-         enabled via prctl(PR_SET_SECCOMP), it cannot be disabled
-         and the task is only allowed to execute a few safe syscalls
-         defined by each seccomp mode.
-
 config PARAVIRT
        bool "Enable paravirtualization code"
        help

diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 6d232837cbeee8abb0c5a9c37b05c8566260156f..98c4e34cbec18c85ed4c8fb87ee2f6f8433b2501 100644 (file)
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -1033,19 +1033,6 @@ config ARCH_ENABLE_SPLIT_PMD_PTLOCK
 config CC_HAVE_SHADOW_CALL_STACK
        def_bool $(cc-option, -fsanitize=shadow-call-stack -ffixed-x18)
 
-config SECCOMP
-       bool "Enable seccomp to safely compute untrusted bytecode"
-       help
-         This kernel feature is useful for number crunching applications
-         that may need to compute untrusted bytecode during their
-         execution. By using pipes or other transports made available to
-         the process as file descriptors supporting the read/write
-         syscalls, it's possible to isolate those applications in
-         their own address space using seccomp. Once seccomp is
-         enabled via prctl(PR_SET_SECCOMP), it cannot be disabled
-         and the task is only allowed to execute a few safe syscalls
-         defined by each seccomp mode.
-
 config PARAVIRT
        bool "Enable paravirtualization code"
        help

diff --git a/arch/csky/Kconfig b/arch/csky/Kconfig
index 3d5afb5f568543d20fe0d714615c407508cd8e1b..7f424c85772c411f99578820f70e2df6588628b0 100644 (file)
--- a/arch/csky/Kconfig
+++ b/arch/csky/Kconfig
@@ -309,16 +309,3 @@ endmenu
 source "arch/csky/Kconfig.platforms"
 
 source "kernel/Kconfig.hz"
-
-config SECCOMP
-       bool "Enable seccomp to safely compute untrusted bytecode"
-       help
-         This kernel feature is useful for number crunching applications
-         that may need to compute untrusted bytecode during their
-         execution. By using pipes or other transports made available to
-         the process as file descriptors supporting the read/write
-         syscalls, it's possible to isolate those applications in
-         their own address space using seccomp. Once seccomp is
-         enabled via prctl(PR_SET_SECCOMP), it cannot be disabled
-         and the task is only allowed to execute a few safe syscalls
-         defined by each seccomp mode.

diff --git a/arch/microblaze/Kconfig b/arch/microblaze/Kconfig
index d262ac0c8714bd804b8a43e61d05e939092592d6..37bd6a5f38fbb7bc31cf0a4a17f439e83749a0ba 100644 (file)
--- a/arch/microblaze/Kconfig
+++ b/arch/microblaze/Kconfig
@@ -26,6 +26,7 @@ config MICROBLAZE
        select GENERIC_SCHED_CLOCK
        select HAVE_ARCH_HASH
        select HAVE_ARCH_KGDB
+       select HAVE_ARCH_SECCOMP
        select HAVE_DEBUG_KMEMLEAK
        select HAVE_DMA_CONTIGUOUS
        select HAVE_DYNAMIC_FTRACE
@@ -120,23 +121,6 @@ config CMDLINE_FORCE
          Set this to have arguments from the default kernel command string
          override those passed by the boot loader.
 
-config SECCOMP
-       bool "Enable seccomp to safely compute untrusted bytecode"
-       depends on PROC_FS
-       default y
-       help
-         This kernel feature is useful for number crunching applications
-         that may need to compute untrusted bytecode during their
-         execution. By using pipes or other transports made available to
-         the process as file descriptors supporting the read/write
-         syscalls, it's possible to isolate those applications in
-         their own address space using seccomp. Once seccomp is
-         enabled via /proc/<pid>/seccomp, it cannot be disabled
-         and the task is only allowed to execute a few safe syscalls
-         defined by each seccomp mode.
-
-         If unsure, say Y. Only embedded should say N here.
-
 endmenu
 
 menu "Kernel features"

diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index c95fa3a2484cf056c9dc4238980acd896ef13ca6..5f88a8fc11fc5fd2df93c9768770303dc36388f5 100644 (file)
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -3004,23 +3004,6 @@ config PHYSICAL_START
          specified in the "crashkernel=YM@XM" command line boot parameter
          passed to the panic-ed kernel).
 
-config SECCOMP
-       bool "Enable seccomp to safely compute untrusted bytecode"
-       depends on PROC_FS
-       default y
-       help
-         This kernel feature is useful for number crunching applications
-         that may need to compute untrusted bytecode during their
-         execution. By using pipes or other transports made available to
-         the process as file descriptors supporting the read/write
-         syscalls, it's possible to isolate those applications in
-         their own address space using seccomp. Once seccomp is
-         enabled via /proc/<pid>/seccomp, it cannot be disabled
-         and the task is only allowed to execute a few safe syscalls
-         defined by each seccomp mode.
-
-         If unsure, say Y. Only embedded should say N here.
-
 config MIPS_O32_FP64_SUPPORT
        bool "Support for O32 binaries using 64-bit FP" if !CPU_MIPSR6
        depends on 32BIT || MIPS32_O32

diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig
index 3b0f53dd70bc9b80c5cbb487557a9623ba8ad483..cd4afe1e7a6c770dd1f0b13df74768d319017858 100644 (file)
--- a/arch/parisc/Kconfig
+++ b/arch/parisc/Kconfig
@@ -378,19 +378,3 @@ endmenu
 
 
 source "drivers/parisc/Kconfig"
-
-config SECCOMP
-       def_bool y
-       prompt "Enable seccomp to safely compute untrusted bytecode"
-       help
-         This kernel feature is useful for number crunching applications
-         that may need to compute untrusted bytecode during their
-         execution. By using pipes or other transports made available to
-         the process as file descriptors supporting the read/write
-         syscalls, it's possible to isolate those applications in
-         their own address space using seccomp. Once seccomp is
-         enabled via prctl(PR_SET_SECCOMP), it cannot be disabled
-         and the task is only allowed to execute a few safe syscalls
-         defined by each seccomp mode.
-
-         If unsure, say Y. Only embedded should say N here.

diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 1f48bbfb3ce99dc9eccbee3612689e88be4ae675..136fe860caef03d68312e8bff938365bc61ecaf9 100644 (file)
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -934,23 +934,6 @@ config ARCH_WANTS_FREEZER_CONTROL
 
 source "kernel/power/Kconfig"
 
-config SECCOMP
-       bool "Enable seccomp to safely compute untrusted bytecode"
-       depends on PROC_FS
-       default y
-       help
-         This kernel feature is useful for number crunching applications
-         that may need to compute untrusted bytecode during their
-         execution. By using pipes or other transports made available to
-         the process as file descriptors supporting the read/write
-         syscalls, it's possible to isolate those applications in
-         their own address space using seccomp. Once seccomp is
-         enabled via /proc/<pid>/seccomp, it cannot be disabled
-         and the task is only allowed to execute a few safe syscalls
-         defined by each seccomp mode.
-
-         If unsure, say Y. Only embedded should say N here.
-
 config PPC_MEM_KEYS
        prompt "PowerPC Memory Protection Keys"
        def_bool y

diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
index df18372861d8d22e3c0f6b8485c6128c65de733b..c456b558fab9dab6ee6b6616aec60025a8bb3184 100644 (file)
--- a/arch/riscv/Kconfig
+++ b/arch/riscv/Kconfig
@@ -333,19 +333,6 @@ menu "Kernel features"
 
 source "kernel/Kconfig.hz"
 
-config SECCOMP
-       bool "Enable seccomp to safely compute untrusted bytecode"
-       help
-         This kernel feature is useful for number crunching applications
-         that may need to compute untrusted bytecode during their
-         execution. By using pipes or other transports made available to
-         the process as file descriptors supporting the read/write
-         syscalls, it's possible to isolate those applications in
-         their own address space using seccomp. Once seccomp is
-         enabled via prctl(PR_SET_SECCOMP), it cannot be disabled
-         and the task is only allowed to execute a few safe syscalls
-         defined by each seccomp mode.
-
 config RISCV_SBI_V01
        bool "SBI v0.1 support"
        default y

diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index 3d86e12e8e3c21ed6a23395f6d946f95411000f0..7f7b40ec699e074675a68e6795d87a5ebe731908 100644 (file)
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -791,23 +791,6 @@ config CRASH_DUMP
 
 endmenu
 
-config SECCOMP
-       def_bool y
-       prompt "Enable seccomp to safely compute untrusted bytecode"
-       depends on PROC_FS
-       help
-         This kernel feature is useful for number crunching applications
-         that may need to compute untrusted bytecode during their
-         execution. By using pipes or other transports made available to
-         the process as file descriptors supporting the read/write
-         syscalls, it's possible to isolate those applications in
-         their own address space using seccomp. Once seccomp is
-         enabled via /proc/<pid>/seccomp, it cannot be disabled
-         and the task is only allowed to execute a few safe syscalls
-         defined by each seccomp mode.
-
-         If unsure, say Y.
-
 config CCW
        def_bool y
 

diff --git a/arch/sh/Kconfig b/arch/sh/Kconfig
index d20927128fce05b7e6e997733ce0336a82124e97..18278152c91c02284f2017328abd89758076790e 100644 (file)
--- a/arch/sh/Kconfig
+++ b/arch/sh/Kconfig
@@ -600,22 +600,6 @@ config PHYSICAL_START
          where the fail safe kernel needs to run at a different address
          than the panic-ed kernel.
 
-config SECCOMP
-       bool "Enable seccomp to safely compute untrusted bytecode"
-       depends on PROC_FS
-       help
-         This kernel feature is useful for number crunching applications
-         that may need to compute untrusted bytecode during their
-         execution. By using pipes or other transports made available to
-         the process as file descriptors supporting the read/write
-         syscalls, it's possible to isolate those applications in
-         their own address space using seccomp. Once seccomp is
-         enabled via prctl, it cannot be disabled and the task is only
-         allowed to execute a few safe syscalls defined by each seccomp
-         mode.
-
-         If unsure, say N.
-
 config SMP
        bool "Symmetric multi-processing support"
        depends on SYS_SUPPORTS_SMP

diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index efeff2c896a54451d29cb4254b48d76e17c0096d..d62ce83cf009f2886997cc20e8040e06b5fedd7b 100644 (file)
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -23,6 +23,7 @@ config SPARC
        select HAVE_OPROFILE
        select HAVE_ARCH_KGDB if !SMP || SPARC64
        select HAVE_ARCH_TRACEHOOK
+       select HAVE_ARCH_SECCOMP if SPARC64
        select HAVE_EXIT_THREAD
        select HAVE_PCI
        select SYSCTL_EXCEPTION_TRACE
@@ -226,23 +227,6 @@ config EARLYFB
        help
          Say Y here to enable a faster early framebuffer boot console.
 
-config SECCOMP
-       bool "Enable seccomp to safely compute untrusted bytecode"
-       depends on SPARC64 && PROC_FS
-       default y
-       help
-         This kernel feature is useful for number crunching applications
-         that may need to compute untrusted bytecode during their
-         execution. By using pipes or other transports made available to
-         the process as file descriptors supporting the read/write
-         syscalls, it's possible to isolate those applications in
-         their own address space using seccomp. Once seccomp is
-         enabled via /proc/<pid>/seccomp, it cannot be disabled
-         and the task is only allowed to execute a few safe syscalls
-         defined by each seccomp mode.
-
-         If unsure, say Y. Only embedded should say N here.
-
 config HOTPLUG_CPU
        bool "Support for hot-pluggable CPUs"
        depends on SPARC64 && SMP

diff --git a/arch/um/Kconfig b/arch/um/Kconfig
index eb51fec759484ab065d817704ac277102dde61b0..d49f471b02e3618322fcbc1cdda793aa082e2276 100644 (file)
--- a/arch/um/Kconfig
+++ b/arch/um/Kconfig
@@ -173,22 +173,6 @@ config PGTABLE_LEVELS
        default 3 if 3_LEVEL_PGTABLES
        default 2
 
-config SECCOMP
-       def_bool y
-       prompt "Enable seccomp to safely compute untrusted bytecode"
-       help
-         This kernel feature is useful for number crunching applications
-         that may need to compute untrusted bytecode during their
-         execution. By using pipes or other transports made available to
-         the process as file descriptors supporting the read/write
-         syscalls, it's possible to isolate those applications in
-         their own address space using seccomp. Once seccomp is
-         enabled via prctl(PR_SET_SECCOMP), it cannot be disabled
-         and the task is only allowed to execute a few safe syscalls
-         defined by each seccomp mode.
-
-         If unsure, say Y.
-
 config UML_TIME_TRAVEL_SUPPORT
        bool
        prompt "Support time-travel mode (e.g. for test execution)"

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 7101ac64bb209d31966ca255e07a2ddf704397e7..1ab22869a7650060e1bb00dfcafed63307a1d5cb 100644 (file)
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -1968,22 +1968,6 @@ config EFI_MIXED
 
           If unsure, say N.
 
-config SECCOMP
-       def_bool y
-       prompt "Enable seccomp to safely compute untrusted bytecode"
-       help
-         This kernel feature is useful for number crunching applications
-         that may need to compute untrusted bytecode during their
-         execution. By using pipes or other transports made available to
-         the process as file descriptors supporting the read/write
-         syscalls, it's possible to isolate those applications in
-         their own address space using seccomp. Once seccomp is
-         enabled via prctl(PR_SET_SECCOMP), it cannot be disabled
-         and the task is only allowed to execute a few safe syscalls
-         defined by each seccomp mode.
-
-         If unsure, say Y. Only embedded should say N here.
-
 source "kernel/Kconfig.hz"
 
 config KEXEC

diff --git a/arch/xtensa/Kconfig b/arch/xtensa/Kconfig
index e997e0119c02514a9f91b87f8f84fc065a9b1c10..d8a29dc5a2844b9068a163ce00c03ae9b3e9f811 100644 (file)
--- a/arch/xtensa/Kconfig
+++ b/arch/xtensa/Kconfig
@@ -217,20 +217,6 @@ config HOTPLUG_CPU
 
          Say N if you want to disable CPU hotplug.
 
-config SECCOMP
-       bool
-       prompt "Enable seccomp to safely compute untrusted bytecode"
-       help
-         This kernel feature is useful for number crunching applications
-         that may need to compute untrusted bytecode during their
-         execution. By using pipes or other transports made available to
-         the process as file descriptors supporting the read/write
-         syscalls, it's possible to isolate those applications in
-         their own address space using seccomp. Once seccomp is
-         enabled via prctl(PR_SET_SECCOMP), it cannot be disabled
-         and the task is only allowed to execute a few safe syscalls
-         defined by each seccomp mode.
-
 config FAST_SYSCALL_XTENSA
        bool "Enable fast atomic syscalls"
        default n