1 /*
2 * linux/kernel/seccomp.c
3 *
4 * Copyright 2004-2005 Andrea Arcangeli <andrea@cpushare.com>
5 *
6 * Copyright (C) 2012 Google, Inc.
7 * Will Drewry <wad@chromium.org>
8 *
9 * This defines a simple but solid secure-computing facility.
10 *
11 * Mode 1 uses a fixed list of allowed system calls.
12 * Mode 2 allows user-defined system call filters in the form
13 * of Berkeley Packet Filters/Linux Socket Filters.
14 */
15
16 #include <linux/atomic.h>
17 #include <linux/audit.h>
18 #include <linux/compat.h>
19 #include <linux/sched.h>
20 #include <linux/seccomp.h>
21 #include <linux/slab.h>
22 #include <linux/syscalls.h>
23
24 /* #define SECCOMP_DEBUG 1 */
25
26 #ifdef CONFIG_SECCOMP_FILTER
27 #include <asm/syscall.h>
28 #include <linux/filter.h>
29 #include <linux/pid.h>
30 #include <linux/ptrace.h>
31 #include <linux/security.h>
32 #include <linux/tracehook.h>
33 #include <linux/uaccess.h>
34
35 /**
36 * struct seccomp_filter - container for seccomp BPF programs
37 *
38 * @usage: reference count to manage the object lifetime.
39 * get/put helpers should be used when accessing an instance
40 * outside of a lifetime-guarded section. In general, this
41 * is only needed for handling filters shared across tasks.
42 * @prev: points to a previously installed, or inherited, filter
43 * @len: the number of instructions in the program
44 * @insns: the BPF program instructions to evaluate
45 *
46 * seccomp_filter objects are organized in a tree linked via the @prev
47 * pointer. For any task, it appears to be a singly-linked list starting
48 * with current->seccomp.filter, the most recently attached or inherited filter.
49 * However, multiple filters may share a @prev node, by way of fork(), which
50 * results in a unidirectional tree existing in memory. This is similar to
51 * how namespaces work.
52 *
53 * seccomp_filter objects should never be modified after being attached
54 * to a task_struct (other than @usage).
55 */
56 struct seccomp_filter {
57 atomic_t usage;
58 struct seccomp_filter *prev;
59 unsigned short len; /* Instruction count */
60 struct sock_filter insns[];
61 };
62
63 /* Limit any path through the tree to 256KB worth of instructions. */
64 #define MAX_INSNS_PER_PATH ((1 << 18) / sizeof(struct sock_filter))
65
66 /**
67 * get_u32 - returns a u32 offset into data
68 * @data: a unsigned 64 bit value
69 * @index: 0 or 1 to return the first or second 32-bits
70 *
71 * This inline exists to hide the length of unsigned long. If a 32-bit
72 * unsigned long is passed in, it will be extended and the top 32-bits will be
73 * 0. If it is a 64-bit unsigned long, then whatever data is resident will be
74 * properly returned.
75 *
76 * Endianness is explicitly ignored and left for BPF program authors to manage
77 * as per the specific architecture.
78 */
get_u32(u64 data,int index)79 static inline u32 get_u32(u64 data, int index)
80 {
81 return ((u32 *)&data)[index];
82 }
83
84 /* Helper for bpf_load below. */
85 #define BPF_DATA(_name) offsetof(struct seccomp_data, _name)
86 /**
87 * bpf_load: checks and returns a pointer to the requested offset
88 * @off: offset into struct seccomp_data to load from
89 *
90 * Returns the requested 32-bits of data.
91 * seccomp_check_filter() should assure that @off is 32-bit aligned
92 * and not out of bounds. Failure to do so is a BUG.
93 */
seccomp_bpf_load(int off)94 u32 seccomp_bpf_load(int off)
95 {
96 struct pt_regs *regs = task_pt_regs(current);
97 if (off == BPF_DATA(nr))
98 return syscall_get_nr(current, regs);
99 if (off == BPF_DATA(arch))
100 return syscall_get_arch();
101 if (off >= BPF_DATA(args[0]) && off < BPF_DATA(args[6])) {
102 unsigned long value;
103 int arg = (off - BPF_DATA(args[0])) / sizeof(u64);
104 int index = !!(off % sizeof(u64));
105 syscall_get_arguments(current, regs, arg, 1, &value);
106 return get_u32(value, index);
107 }
108 if (off == BPF_DATA(instruction_pointer))
109 return get_u32(KSTK_EIP(current), 0);
110 if (off == BPF_DATA(instruction_pointer) + sizeof(u32))
111 return get_u32(KSTK_EIP(current), 1);
112 /* seccomp_check_filter should make this impossible. */
113 BUG();
114 }
115
116 /**
117 * seccomp_check_filter - verify seccomp filter code
118 * @filter: filter to verify
119 * @flen: length of filter
120 *
121 * Takes a previously checked filter (by sk_chk_filter) and
122 * redirects all filter code that loads struct sk_buff data
123 * and related data through seccomp_bpf_load. It also
124 * enforces length and alignment checking of those loads.
125 *
126 * Returns 0 if the rule set is legal or -EINVAL if not.
127 */
seccomp_check_filter(struct sock_filter * filter,unsigned int flen)128 static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen)
129 {
130 int pc;
131 for (pc = 0; pc < flen; pc++) {
132 struct sock_filter *ftest = &filter[pc];
133 u16 code = ftest->code;
134 u32 k = ftest->k;
135
136 switch (code) {
137 case BPF_S_LD_W_ABS:
138 ftest->code = BPF_S_ANC_SECCOMP_LD_W;
139 /* 32-bit aligned and not out of bounds. */
140 if (k >= sizeof(struct seccomp_data) || k & 3)
141 return -EINVAL;
142 continue;
143 case BPF_S_LD_W_LEN:
144 ftest->code = BPF_S_LD_IMM;
145 ftest->k = sizeof(struct seccomp_data);
146 continue;
147 case BPF_S_LDX_W_LEN:
148 ftest->code = BPF_S_LDX_IMM;
149 ftest->k = sizeof(struct seccomp_data);
150 continue;
151 /* Explicitly include allowed calls. */
152 case BPF_S_RET_K:
153 case BPF_S_RET_A:
154 case BPF_S_ALU_ADD_K:
155 case BPF_S_ALU_ADD_X:
156 case BPF_S_ALU_SUB_K:
157 case BPF_S_ALU_SUB_X:
158 case BPF_S_ALU_MUL_K:
159 case BPF_S_ALU_MUL_X:
160 case BPF_S_ALU_DIV_X:
161 case BPF_S_ALU_AND_K:
162 case BPF_S_ALU_AND_X:
163 case BPF_S_ALU_OR_K:
164 case BPF_S_ALU_OR_X:
165 case BPF_S_ALU_XOR_K:
166 case BPF_S_ALU_XOR_X:
167 case BPF_S_ALU_LSH_K:
168 case BPF_S_ALU_LSH_X:
169 case BPF_S_ALU_RSH_K:
170 case BPF_S_ALU_RSH_X:
171 case BPF_S_ALU_NEG:
172 case BPF_S_LD_IMM:
173 case BPF_S_LDX_IMM:
174 case BPF_S_MISC_TAX:
175 case BPF_S_MISC_TXA:
176 case BPF_S_ALU_DIV_K:
177 case BPF_S_LD_MEM:
178 case BPF_S_LDX_MEM:
179 case BPF_S_ST:
180 case BPF_S_STX:
181 case BPF_S_JMP_JA:
182 case BPF_S_JMP_JEQ_K:
183 case BPF_S_JMP_JEQ_X:
184 case BPF_S_JMP_JGE_K:
185 case BPF_S_JMP_JGE_X:
186 case BPF_S_JMP_JGT_K:
187 case BPF_S_JMP_JGT_X:
188 case BPF_S_JMP_JSET_K:
189 case BPF_S_JMP_JSET_X:
190 continue;
191 default:
192 return -EINVAL;
193 }
194 }
195 return 0;
196 }
197
198 /**
199 * seccomp_run_filters - evaluates all seccomp filters against @syscall
200 * @syscall: number of the current system call
201 *
202 * Returns valid seccomp BPF response codes.
203 */
seccomp_run_filters(int syscall)204 static u32 seccomp_run_filters(int syscall)
205 {
206 struct seccomp_filter *f = ACCESS_ONCE(current->seccomp.filter);
207 u32 ret = SECCOMP_RET_ALLOW;
208
209 /* Ensure unexpected behavior doesn't result in failing open. */
210 if (unlikely(WARN_ON(f == NULL)))
211 return SECCOMP_RET_KILL;
212
213 /* Make sure cross-thread synced filter points somewhere sane. */
214 smp_read_barrier_depends();
215
216 /*
217 * All filters in the list are evaluated and the lowest BPF return
218 * value always takes priority (ignoring the DATA).
219 */
220 for (; f; f = f->prev) {
221 u32 cur_ret = sk_run_filter(NULL, f->insns);
222
223 if ((cur_ret & SECCOMP_RET_ACTION) < (ret & SECCOMP_RET_ACTION))
224 ret = cur_ret;
225 }
226 return ret;
227 }
228 #endif /* CONFIG_SECCOMP_FILTER */
229
seccomp_may_assign_mode(unsigned long seccomp_mode)230 static inline bool seccomp_may_assign_mode(unsigned long seccomp_mode)
231 {
232 assert_spin_locked(¤t->sighand->siglock);
233
234 if (current->seccomp.mode && current->seccomp.mode != seccomp_mode)
235 return false;
236
237 return true;
238 }
239
seccomp_assign_mode(struct task_struct * task,unsigned long seccomp_mode)240 static inline void seccomp_assign_mode(struct task_struct *task,
241 unsigned long seccomp_mode)
242 {
243 assert_spin_locked(&task->sighand->siglock);
244
245 task->seccomp.mode = seccomp_mode;
246 /*
247 * Make sure TIF_SECCOMP cannot be set before the mode (and
248 * filter) is set.
249 */
250 smp_mb();
251 set_tsk_thread_flag(task, TIF_SECCOMP);
252 }
253
254 #ifdef CONFIG_SECCOMP_FILTER
255 /* Returns 1 if the parent is an ancestor of the child. */
is_ancestor(struct seccomp_filter * parent,struct seccomp_filter * child)256 static int is_ancestor(struct seccomp_filter *parent,
257 struct seccomp_filter *child)
258 {
259 /* NULL is the root ancestor. */
260 if (parent == NULL)
261 return 1;
262 for (; child; child = child->prev)
263 if (child == parent)
264 return 1;
265 return 0;
266 }
267
268 /**
269 * seccomp_can_sync_threads: checks if all threads can be synchronized
270 *
271 * Expects sighand and cred_guard_mutex locks to be held.
272 *
273 * Returns 0 on success, -ve on error, or the pid of a thread which was
274 * either not in the correct seccomp mode or it did not have an ancestral
275 * seccomp filter.
276 */
seccomp_can_sync_threads(void)277 static inline pid_t seccomp_can_sync_threads(void)
278 {
279 struct task_struct *thread, *caller;
280
281 BUG_ON(!mutex_is_locked(¤t->signal->cred_guard_mutex));
282 assert_spin_locked(¤t->sighand->siglock);
283
284 /* Validate all threads being eligible for synchronization. */
285 caller = current;
286 for_each_thread(caller, thread) {
287 pid_t failed;
288
289 /* Skip current, since it is initiating the sync. */
290 if (thread == caller)
291 continue;
292
293 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED ||
294 (thread->seccomp.mode == SECCOMP_MODE_FILTER &&
295 is_ancestor(thread->seccomp.filter,
296 caller->seccomp.filter)))
297 continue;
298
299 /* Return the first thread that cannot be synchronized. */
300 failed = task_pid_vnr(thread);
301 /* If the pid cannot be resolved, then return -ESRCH */
302 if (unlikely(WARN_ON(failed == 0)))
303 failed = -ESRCH;
304 return failed;
305 }
306
307 return 0;
308 }
309
310 /**
311 * seccomp_sync_threads: sets all threads to use current's filter
312 *
313 * Expects sighand and cred_guard_mutex locks to be held, and for
314 * seccomp_can_sync_threads() to have returned success already
315 * without dropping the locks.
316 *
317 */
seccomp_sync_threads(void)318 static inline void seccomp_sync_threads(void)
319 {
320 struct task_struct *thread, *caller;
321
322 BUG_ON(!mutex_is_locked(¤t->signal->cred_guard_mutex));
323 assert_spin_locked(¤t->sighand->siglock);
324
325 /* Synchronize all threads. */
326 caller = current;
327 for_each_thread(caller, thread) {
328 /* Skip current, since it needs no changes. */
329 if (thread == caller)
330 continue;
331
332 /* Get a task reference for the new leaf node. */
333 get_seccomp_filter(caller);
334 /*
335 * Drop the task reference to the shared ancestor since
336 * current's path will hold a reference. (This also
337 * allows a put before the assignment.)
338 */
339 put_seccomp_filter(thread);
340 smp_store_release(&thread->seccomp.filter,
341 caller->seccomp.filter);
342
343 /*
344 * Don't let an unprivileged task work around
345 * the no_new_privs restriction by creating
346 * a thread that sets it up, enters seccomp,
347 * then dies.
348 */
349 if (task_no_new_privs(caller))
350 task_set_no_new_privs(thread);
351
352 /*
353 * Opt the other thread into seccomp if needed.
354 * As threads are considered to be trust-realm
355 * equivalent (see ptrace_may_access), it is safe to
356 * allow one thread to transition the other.
357 */
358 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED)
359 seccomp_assign_mode(thread, SECCOMP_MODE_FILTER);
360 }
361 }
362
363 /**
364 * seccomp_prepare_filter: Prepares a seccomp filter for use.
365 * @fprog: BPF program to install
366 *
367 * Returns filter on success or an ERR_PTR on failure.
368 */
seccomp_prepare_filter(struct sock_fprog * fprog)369 static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog)
370 {
371 struct seccomp_filter *filter;
372 unsigned long fp_size = fprog->len * sizeof(struct sock_filter);
373 unsigned long total_insns = fprog->len;
374 long ret;
375
376 if (fprog->len == 0 || fprog->len > BPF_MAXINSNS)
377 return ERR_PTR(-EINVAL);
378 BUG_ON(INT_MAX / fprog->len < sizeof(struct sock_filter));
379
380 for (filter = current->seccomp.filter; filter; filter = filter->prev)
381 total_insns += filter->len + 4; /* include a 4 instr penalty */
382 if (total_insns > MAX_INSNS_PER_PATH)
383 return ERR_PTR(-ENOMEM);
384
385 /*
386 * Installing a seccomp filter requires that the task have
387 * CAP_SYS_ADMIN in its namespace or be running with no_new_privs.
388 * This avoids scenarios where unprivileged tasks can affect the
389 * behavior of privileged children.
390 */
391 if (!task_no_new_privs(current) &&
392 security_capable_noaudit(current_cred(), current_user_ns(),
393 CAP_SYS_ADMIN) != 0)
394 return ERR_PTR(-EACCES);
395
396 /* Allocate a new seccomp_filter */
397 filter = kzalloc(sizeof(struct seccomp_filter) + fp_size,
398 GFP_KERNEL|__GFP_NOWARN);
399 if (!filter)
400 return ERR_PTR(-ENOMEM);;
401 atomic_set(&filter->usage, 1);
402 filter->len = fprog->len;
403
404 /* Copy the instructions from fprog. */
405 ret = -EFAULT;
406 if (copy_from_user(filter->insns, fprog->filter, fp_size))
407 goto fail;
408
409 /* Check and rewrite the fprog via the skb checker */
410 ret = sk_chk_filter(filter->insns, filter->len);
411 if (ret)
412 goto fail;
413
414 /* Check and rewrite the fprog for seccomp use */
415 ret = seccomp_check_filter(filter->insns, filter->len);
416 if (ret)
417 goto fail;
418
419 return filter;
420
421 fail:
422 kfree(filter);
423 return ERR_PTR(ret);
424 }
425
426 /**
427 * seccomp_prepare_user_filter - prepares a user-supplied sock_fprog
428 * @user_filter: pointer to the user data containing a sock_fprog.
429 *
430 * Returns 0 on success and non-zero otherwise.
431 */
432 static struct seccomp_filter *
seccomp_prepare_user_filter(const char __user * user_filter)433 seccomp_prepare_user_filter(const char __user *user_filter)
434 {
435 struct sock_fprog fprog;
436 struct seccomp_filter *filter = ERR_PTR(-EFAULT);
437
438 #ifdef CONFIG_COMPAT
439 if (is_compat_task()) {
440 struct compat_sock_fprog fprog32;
441 if (copy_from_user(&fprog32, user_filter, sizeof(fprog32)))
442 goto out;
443 fprog.len = fprog32.len;
444 fprog.filter = compat_ptr(fprog32.filter);
445 } else /* falls through to the if below. */
446 #endif
447 if (copy_from_user(&fprog, user_filter, sizeof(fprog)))
448 goto out;
449 filter = seccomp_prepare_filter(&fprog);
450 out:
451 return filter;
452 }
453
454 /**
455 * seccomp_attach_filter: validate and attach filter
456 * @flags: flags to change filter behavior
457 * @filter: seccomp filter to add to the current process
458 *
459 * Caller must be holding current->sighand->siglock lock.
460 *
461 * Returns 0 on success, -ve on error.
462 */
seccomp_attach_filter(unsigned int flags,struct seccomp_filter * filter)463 static long seccomp_attach_filter(unsigned int flags,
464 struct seccomp_filter *filter)
465 {
466 unsigned long total_insns;
467 struct seccomp_filter *walker;
468
469 assert_spin_locked(¤t->sighand->siglock);
470
471 /* Validate resulting filter length. */
472 total_insns = filter->len;
473 for (walker = current->seccomp.filter; walker; walker = walker->prev)
474 total_insns += walker->len + 4; /* 4 instr penalty */
475 if (total_insns > MAX_INSNS_PER_PATH)
476 return -ENOMEM;
477
478 /* If thread sync has been requested, check that it is possible. */
479 if (flags & SECCOMP_FILTER_FLAG_TSYNC) {
480 int ret;
481
482 ret = seccomp_can_sync_threads();
483 if (ret)
484 return ret;
485 }
486
487 /*
488 * If there is an existing filter, make it the prev and don't drop its
489 * task reference.
490 */
491 filter->prev = current->seccomp.filter;
492 current->seccomp.filter = filter;
493
494 /* Now that the new filter is in place, synchronize to all threads. */
495 if (flags & SECCOMP_FILTER_FLAG_TSYNC)
496 seccomp_sync_threads();
497
498 return 0;
499 }
500
501 /* get_seccomp_filter - increments the reference count of the filter on @tsk */
get_seccomp_filter(struct task_struct * tsk)502 void get_seccomp_filter(struct task_struct *tsk)
503 {
504 struct seccomp_filter *orig = tsk->seccomp.filter;
505 if (!orig)
506 return;
507 /* Reference count is bounded by the number of total processes. */
508 atomic_inc(&orig->usage);
509 }
510
seccomp_filter_free(struct seccomp_filter * filter)511 static inline void seccomp_filter_free(struct seccomp_filter *filter)
512 {
513 if (filter) {
514 kfree(filter);
515 }
516 }
517
518 /* put_seccomp_filter - decrements the ref count of tsk->seccomp.filter */
put_seccomp_filter(struct task_struct * tsk)519 void put_seccomp_filter(struct task_struct *tsk)
520 {
521 struct seccomp_filter *orig = tsk->seccomp.filter;
522 /* Clean up single-reference branches iteratively. */
523 while (orig && atomic_dec_and_test(&orig->usage)) {
524 struct seccomp_filter *freeme = orig;
525 orig = orig->prev;
526 seccomp_filter_free(freeme);
527 }
528 }
529
530 /**
531 * seccomp_send_sigsys - signals the task to allow in-process syscall emulation
532 * @syscall: syscall number to send to userland
533 * @reason: filter-supplied reason code to send to userland (via si_errno)
534 *
535 * Forces a SIGSYS with a code of SYS_SECCOMP and related sigsys info.
536 */
seccomp_send_sigsys(int syscall,int reason)537 static void seccomp_send_sigsys(int syscall, int reason)
538 {
539 struct siginfo info;
540 memset(&info, 0, sizeof(info));
541 info.si_signo = SIGSYS;
542 info.si_code = SYS_SECCOMP;
543 info.si_call_addr = (void __user *)KSTK_EIP(current);
544 info.si_errno = reason;
545 info.si_arch = syscall_get_arch();
546 info.si_syscall = syscall;
547 force_sig_info(SIGSYS, &info, current);
548 }
549 #endif /* CONFIG_SECCOMP_FILTER */
550
551 /*
552 * Secure computing mode 1 allows only read/write/exit/sigreturn.
553 * To be fully secure this must be combined with rlimit
554 * to limit the stack allocations too.
555 */
556 static int mode1_syscalls[] = {
557 __NR_seccomp_read, __NR_seccomp_write, __NR_seccomp_exit, __NR_seccomp_sigreturn,
558 0, /* null terminated */
559 };
560
561 #ifdef CONFIG_COMPAT
562 static int mode1_syscalls_32[] = {
563 __NR_seccomp_read_32, __NR_seccomp_write_32, __NR_seccomp_exit_32, __NR_seccomp_sigreturn_32,
564 0, /* null terminated */
565 };
566 #endif
567
__secure_computing(int this_syscall)568 int __secure_computing(int this_syscall)
569 {
570 int exit_sig = 0;
571 int *syscall;
572 u32 ret;
573
574 /*
575 * Make sure that any changes to mode from another thread have
576 * been seen after TIF_SECCOMP was seen.
577 */
578 rmb();
579
580 switch (current->seccomp.mode) {
581 case SECCOMP_MODE_STRICT:
582 syscall = mode1_syscalls;
583 #ifdef CONFIG_COMPAT
584 if (is_compat_task())
585 syscall = mode1_syscalls_32;
586 #endif
587 do {
588 if (*syscall == this_syscall)
589 return 0;
590 } while (*++syscall);
591 exit_sig = SIGKILL;
592 ret = SECCOMP_RET_KILL;
593 break;
594 #ifdef CONFIG_SECCOMP_FILTER
595 case SECCOMP_MODE_FILTER: {
596 int data;
597 struct pt_regs *regs = task_pt_regs(current);
598 ret = seccomp_run_filters(this_syscall);
599 data = ret & SECCOMP_RET_DATA;
600 ret &= SECCOMP_RET_ACTION;
601 switch (ret) {
602 case SECCOMP_RET_ERRNO:
603 /* Set low-order bits as an errno, capped at MAX_ERRNO. */
604 if (data > MAX_ERRNO)
605 data = MAX_ERRNO;
606 syscall_set_return_value(current, regs,
607 -data, 0);
608 goto skip;
609 case SECCOMP_RET_TRAP:
610 /* Show the handler the original registers. */
611 syscall_rollback(current, regs);
612 /* Let the filter pass back 16 bits of data. */
613 seccomp_send_sigsys(this_syscall, data);
614 goto skip;
615 case SECCOMP_RET_TRACE:
616 /* Skip these calls if there is no tracer. */
617 if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP)) {
618 syscall_set_return_value(current, regs,
619 -ENOSYS, 0);
620 goto skip;
621 }
622 /* Allow the BPF to provide the event message */
623 ptrace_event(PTRACE_EVENT_SECCOMP, data);
624 /*
625 * The delivery of a fatal signal during event
626 * notification may silently skip tracer notification.
627 * Terminating the task now avoids executing a system
628 * call that may not be intended.
629 */
630 if (fatal_signal_pending(current))
631 break;
632 if (syscall_get_nr(current, regs) < 0)
633 goto skip; /* Explicit request to skip. */
634
635 return 0;
636 case SECCOMP_RET_ALLOW:
637 return 0;
638 case SECCOMP_RET_KILL:
639 default:
640 break;
641 }
642 exit_sig = SIGSYS;
643 break;
644 }
645 #endif
646 default:
647 BUG();
648 }
649
650 #ifdef SECCOMP_DEBUG
651 dump_stack();
652 #endif
653 audit_seccomp(this_syscall, exit_sig, ret);
654 do_exit(exit_sig);
655 #ifdef CONFIG_SECCOMP_FILTER
656 skip:
657 audit_seccomp(this_syscall, exit_sig, ret);
658 #endif
659 return -1;
660 }
661
prctl_get_seccomp(void)662 long prctl_get_seccomp(void)
663 {
664 return current->seccomp.mode;
665 }
666
667 /**
668 * seccomp_set_mode_strict: internal function for setting strict seccomp
669 *
670 * Once current->seccomp.mode is non-zero, it may not be changed.
671 *
672 * Returns 0 on success or -EINVAL on failure.
673 */
seccomp_set_mode_strict(void)674 static long seccomp_set_mode_strict(void)
675 {
676 const unsigned long seccomp_mode = SECCOMP_MODE_STRICT;
677 long ret = -EINVAL;
678
679 spin_lock_irq(¤t->sighand->siglock);
680
681 if (!seccomp_may_assign_mode(seccomp_mode))
682 goto out;
683
684 #ifdef TIF_NOTSC
685 disable_TSC();
686 #endif
687 seccomp_assign_mode(current, seccomp_mode);
688 ret = 0;
689
690 out:
691 spin_unlock_irq(¤t->sighand->siglock);
692
693 return ret;
694 }
695
696 #ifdef CONFIG_SECCOMP_FILTER
697 /**
698 * seccomp_set_mode_filter: internal function for setting seccomp filter
699 * @flags: flags to change filter behavior
700 * @filter: struct sock_fprog containing filter
701 *
702 * This function may be called repeatedly to install additional filters.
703 * Every filter successfully installed will be evaluated (in reverse order)
704 * for each system call the task makes.
705 *
706 * Once current->seccomp.mode is non-zero, it may not be changed.
707 *
708 * Returns 0 on success or -EINVAL on failure.
709 */
seccomp_set_mode_filter(unsigned int flags,const char __user * filter)710 static long seccomp_set_mode_filter(unsigned int flags,
711 const char __user *filter)
712 {
713 const unsigned long seccomp_mode = SECCOMP_MODE_FILTER;
714 struct seccomp_filter *prepared = NULL;
715 long ret = -EINVAL;
716
717 /* Validate flags. */
718 if (flags & ~SECCOMP_FILTER_FLAG_MASK)
719 return -EINVAL;
720
721 /* Prepare the new filter before holding any locks. */
722 prepared = seccomp_prepare_user_filter(filter);
723 if (IS_ERR(prepared))
724 return PTR_ERR(prepared);
725
726 /*
727 * Make sure we cannot change seccomp or nnp state via TSYNC
728 * while another thread is in the middle of calling exec.
729 */
730 if (flags & SECCOMP_FILTER_FLAG_TSYNC &&
731 mutex_lock_killable(¤t->signal->cred_guard_mutex))
732 goto out_free;
733
734 spin_lock_irq(¤t->sighand->siglock);
735
736 if (!seccomp_may_assign_mode(seccomp_mode))
737 goto out;
738
739 ret = seccomp_attach_filter(flags, prepared);
740 if (ret)
741 goto out;
742 /* Do not free the successfully attached filter. */
743 prepared = NULL;
744
745 seccomp_assign_mode(current, seccomp_mode);
746 out:
747 spin_unlock_irq(¤t->sighand->siglock);
748 if (flags & SECCOMP_FILTER_FLAG_TSYNC)
749 mutex_unlock(¤t->signal->cred_guard_mutex);
750 out_free:
751 seccomp_filter_free(prepared);
752 return ret;
753 }
754 #else
seccomp_set_mode_filter(unsigned int flags,const char __user * filter)755 static inline long seccomp_set_mode_filter(unsigned int flags,
756 const char __user *filter)
757 {
758 return -EINVAL;
759 }
760 #endif
761
762 /* Common entry point for both prctl and syscall. */
do_seccomp(unsigned int op,unsigned int flags,const char __user * uargs)763 static long do_seccomp(unsigned int op, unsigned int flags,
764 const char __user *uargs)
765 {
766 switch (op) {
767 case SECCOMP_SET_MODE_STRICT:
768 if (flags != 0 || uargs != NULL)
769 return -EINVAL;
770 return seccomp_set_mode_strict();
771 case SECCOMP_SET_MODE_FILTER:
772 return seccomp_set_mode_filter(flags, uargs);
773 default:
774 return -EINVAL;
775 }
776 }
777
SYSCALL_DEFINE3(seccomp,unsigned int,op,unsigned int,flags,const char __user *,uargs)778 SYSCALL_DEFINE3(seccomp, unsigned int, op, unsigned int, flags,
779 const char __user *, uargs)
780 {
781 return do_seccomp(op, flags, uargs);
782 }
783
784 /**
785 * prctl_set_seccomp: configures current->seccomp.mode
786 * @seccomp_mode: requested mode to use
787 * @filter: optional struct sock_fprog for use with SECCOMP_MODE_FILTER
788 *
789 * Returns 0 on success or -EINVAL on failure.
790 */
prctl_set_seccomp(unsigned long seccomp_mode,char __user * filter)791 long prctl_set_seccomp(unsigned long seccomp_mode, char __user *filter)
792 {
793 unsigned int op;
794 char __user *uargs;
795
796 switch (seccomp_mode) {
797 case SECCOMP_MODE_STRICT:
798 op = SECCOMP_SET_MODE_STRICT;
799 /*
800 * Setting strict mode through prctl always ignored filter,
801 * so make sure it is always NULL here to pass the internal
802 * check in do_seccomp().
803 */
804 uargs = NULL;
805 break;
806 case SECCOMP_MODE_FILTER:
807 op = SECCOMP_SET_MODE_FILTER;
808 uargs = filter;
809 break;
810 default:
811 return -EINVAL;
812 }
813
814 /* prctl interface doesn't have flags, so they are always zero. */
815 return do_seccomp(op, 0, uargs);
816 }
817