1 // SPDX-License-Identifier: GPL-2.0
3 * linux/kernel/seccomp.c
5 * Copyright 2004-2005 Andrea Arcangeli <andrea@cpushare.com>
7 * Copyright (C) 2012 Google, Inc.
8 * Will Drewry <wad@chromium.org>
10 * This defines a simple but solid secure-computing facility.
12 * Mode 1 uses a fixed list of allowed system calls.
13 * Mode 2 allows user-defined system call filters in the form
14 * of Berkeley Packet Filters/Linux Socket Filters.
17 #include <linux/refcount.h>
18 #include <linux/audit.h>
19 #include <linux/compat.h>
20 #include <linux/coredump.h>
21 #include <linux/kmemleak.h>
22 #include <linux/nospec.h>
23 #include <linux/prctl.h>
24 #include <linux/sched.h>
25 #include <linux/sched/task_stack.h>
26 #include <linux/seccomp.h>
27 #include <linux/slab.h>
28 #include <linux/syscalls.h>
29 #include <linux/sysctl.h>
31 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
32 #include <asm/syscall.h>
35 #ifdef CONFIG_SECCOMP_FILTER
36 #include <linux/file.h>
37 #include <linux/filter.h>
38 #include <linux/pid.h>
39 #include <linux/ptrace.h>
40 #include <linux/security.h>
41 #include <linux/tracehook.h>
42 #include <linux/uaccess.h>
43 #include <linux/anon_inodes.h>
48 SECCOMP_NOTIFY_REPLIED
,
51 struct seccomp_knotif
{
52 /* The struct pid of the task whose filter triggered the notification */
53 struct task_struct
*task
;
55 /* The "cookie" for this request; this is unique for this filter. */
59 * The seccomp data. This pointer is valid the entire time this
60 * notification is active, since it comes from __seccomp_filter which
61 * eclipses the entire lifecycle here.
63 const struct seccomp_data
*data
;
66 * Notification states. When SECCOMP_RET_USER_NOTIF is returned, a
67 * struct seccomp_knotif is created and starts out in INIT. Once the
68 * handler reads the notification off of an FD, it transitions to SENT.
69 * If a signal is received the state transitions back to INIT and
70 * another message is sent. When the userspace handler replies, state
71 * transitions to REPLIED.
73 enum notify_state state
;
75 /* The return values, only valid when in SECCOMP_NOTIFY_REPLIED */
80 /* Signals when this has entered SECCOMP_NOTIFY_REPLIED */
81 struct completion ready
;
83 struct list_head list
;
87 * struct notification - container for seccomp userspace notifications. Since
88 * most seccomp filters will not have notification listeners attached and this
89 * structure is fairly large, we store the notification-specific stuff in a
92 * @request: A semaphore that users of this notification can wait on for
93 * changes. Actual reads and writes are still controlled with
94 * filter->notify_lock.
95 * @next_id: The id of the next request.
96 * @notifications: A list of struct seccomp_knotif elements.
97 * @wqh: A wait queue for poll.
100 struct semaphore request
;
102 struct list_head notifications
;
103 wait_queue_head_t wqh
;
107 * struct seccomp_filter - container for seccomp BPF programs
109 * @usage: reference count to manage the object lifetime.
110 * get/put helpers should be used when accessing an instance
111 * outside of a lifetime-guarded section. In general, this
112 * is only needed for handling filters shared across tasks.
113 * @log: true if all actions except for SECCOMP_RET_ALLOW should be logged
114 * @prev: points to a previously installed, or inherited, filter
115 * @prog: the BPF program to evaluate
116 * @notif: the struct that holds all notification related information
117 * @notify_lock: A lock for all notification-related accesses.
119 * seccomp_filter objects are organized in a tree linked via the @prev
120 * pointer. For any task, it appears to be a singly-linked list starting
121 * with current->seccomp.filter, the most recently attached or inherited filter.
122 * However, multiple filters may share a @prev node, by way of fork(), which
123 * results in a unidirectional tree existing in memory. This is similar to
124 * how namespaces work.
126 * seccomp_filter objects should never be modified after being attached
127 * to a task_struct (other than @usage).
129 struct seccomp_filter
{
132 struct seccomp_filter
*prev
;
133 struct bpf_prog
*prog
;
134 struct notification
*notif
;
135 struct mutex notify_lock
;
138 /* Limit any path through the tree to 256KB worth of instructions. */
139 #define MAX_INSNS_PER_PATH ((1 << 18) / sizeof(struct sock_filter))
142 * Endianness is explicitly ignored and left for BPF program authors to manage
143 * as per the specific architecture.
145 static void populate_seccomp_data(struct seccomp_data
*sd
)
147 struct task_struct
*task
= current
;
148 struct pt_regs
*regs
= task_pt_regs(task
);
149 unsigned long args
[6];
151 sd
->nr
= syscall_get_nr(task
, regs
);
152 sd
->arch
= syscall_get_arch(task
);
153 syscall_get_arguments(task
, regs
, args
);
154 sd
->args
[0] = args
[0];
155 sd
->args
[1] = args
[1];
156 sd
->args
[2] = args
[2];
157 sd
->args
[3] = args
[3];
158 sd
->args
[4] = args
[4];
159 sd
->args
[5] = args
[5];
160 sd
->instruction_pointer
= KSTK_EIP(task
);
164 * seccomp_check_filter - verify seccomp filter code
165 * @filter: filter to verify
166 * @flen: length of filter
168 * Takes a previously checked filter (by bpf_check_classic) and
169 * redirects all filter code that loads struct sk_buff data
170 * and related data through seccomp_bpf_load. It also
171 * enforces length and alignment checking of those loads.
173 * Returns 0 if the rule set is legal or -EINVAL if not.
175 static int seccomp_check_filter(struct sock_filter
*filter
, unsigned int flen
)
178 for (pc
= 0; pc
< flen
; pc
++) {
179 struct sock_filter
*ftest
= &filter
[pc
];
180 u16 code
= ftest
->code
;
184 case BPF_LD
| BPF_W
| BPF_ABS
:
185 ftest
->code
= BPF_LDX
| BPF_W
| BPF_ABS
;
186 /* 32-bit aligned and not out of bounds. */
187 if (k
>= sizeof(struct seccomp_data
) || k
& 3)
190 case BPF_LD
| BPF_W
| BPF_LEN
:
191 ftest
->code
= BPF_LD
| BPF_IMM
;
192 ftest
->k
= sizeof(struct seccomp_data
);
194 case BPF_LDX
| BPF_W
| BPF_LEN
:
195 ftest
->code
= BPF_LDX
| BPF_IMM
;
196 ftest
->k
= sizeof(struct seccomp_data
);
198 /* Explicitly include allowed calls. */
199 case BPF_RET
| BPF_K
:
200 case BPF_RET
| BPF_A
:
201 case BPF_ALU
| BPF_ADD
| BPF_K
:
202 case BPF_ALU
| BPF_ADD
| BPF_X
:
203 case BPF_ALU
| BPF_SUB
| BPF_K
:
204 case BPF_ALU
| BPF_SUB
| BPF_X
:
205 case BPF_ALU
| BPF_MUL
| BPF_K
:
206 case BPF_ALU
| BPF_MUL
| BPF_X
:
207 case BPF_ALU
| BPF_DIV
| BPF_K
:
208 case BPF_ALU
| BPF_DIV
| BPF_X
:
209 case BPF_ALU
| BPF_AND
| BPF_K
:
210 case BPF_ALU
| BPF_AND
| BPF_X
:
211 case BPF_ALU
| BPF_OR
| BPF_K
:
212 case BPF_ALU
| BPF_OR
| BPF_X
:
213 case BPF_ALU
| BPF_XOR
| BPF_K
:
214 case BPF_ALU
| BPF_XOR
| BPF_X
:
215 case BPF_ALU
| BPF_LSH
| BPF_K
:
216 case BPF_ALU
| BPF_LSH
| BPF_X
:
217 case BPF_ALU
| BPF_RSH
| BPF_K
:
218 case BPF_ALU
| BPF_RSH
| BPF_X
:
219 case BPF_ALU
| BPF_NEG
:
220 case BPF_LD
| BPF_IMM
:
221 case BPF_LDX
| BPF_IMM
:
222 case BPF_MISC
| BPF_TAX
:
223 case BPF_MISC
| BPF_TXA
:
224 case BPF_LD
| BPF_MEM
:
225 case BPF_LDX
| BPF_MEM
:
228 case BPF_JMP
| BPF_JA
:
229 case BPF_JMP
| BPF_JEQ
| BPF_K
:
230 case BPF_JMP
| BPF_JEQ
| BPF_X
:
231 case BPF_JMP
| BPF_JGE
| BPF_K
:
232 case BPF_JMP
| BPF_JGE
| BPF_X
:
233 case BPF_JMP
| BPF_JGT
| BPF_K
:
234 case BPF_JMP
| BPF_JGT
| BPF_X
:
235 case BPF_JMP
| BPF_JSET
| BPF_K
:
236 case BPF_JMP
| BPF_JSET
| BPF_X
:
246 * seccomp_run_filters - evaluates all seccomp filters against @sd
247 * @sd: optional seccomp data to be passed to filters
248 * @match: stores struct seccomp_filter that resulted in the return value,
249 * unless filter returned SECCOMP_RET_ALLOW, in which case it will
252 * Returns valid seccomp BPF response codes.
254 #define ACTION_ONLY(ret) ((s32)((ret) & (SECCOMP_RET_ACTION_FULL)))
255 static u32
seccomp_run_filters(const struct seccomp_data
*sd
,
256 struct seccomp_filter
**match
)
258 u32 ret
= SECCOMP_RET_ALLOW
;
259 /* Make sure cross-thread synced filter points somewhere sane. */
260 struct seccomp_filter
*f
=
261 READ_ONCE(current
->seccomp
.filter
);
263 /* Ensure unexpected behavior doesn't result in failing open. */
264 if (WARN_ON(f
== NULL
))
265 return SECCOMP_RET_KILL_PROCESS
;
268 * All filters in the list are evaluated and the lowest BPF return
269 * value always takes priority (ignoring the DATA).
272 for (; f
; f
= f
->prev
) {
273 u32 cur_ret
= BPF_PROG_RUN(f
->prog
, sd
);
275 if (ACTION_ONLY(cur_ret
) < ACTION_ONLY(ret
)) {
283 #endif /* CONFIG_SECCOMP_FILTER */
285 static inline bool seccomp_may_assign_mode(unsigned long seccomp_mode
)
287 assert_spin_locked(¤t
->sighand
->siglock
);
289 if (current
->seccomp
.mode
&& current
->seccomp
.mode
!= seccomp_mode
)
295 void __weak
arch_seccomp_spec_mitigate(struct task_struct
*task
) { }
297 static inline void seccomp_assign_mode(struct task_struct
*task
,
298 unsigned long seccomp_mode
,
301 assert_spin_locked(&task
->sighand
->siglock
);
303 task
->seccomp
.mode
= seccomp_mode
;
305 * Make sure TIF_SECCOMP cannot be set before the mode (and
308 smp_mb__before_atomic();
309 /* Assume default seccomp processes want spec flaw mitigation. */
310 if ((flags
& SECCOMP_FILTER_FLAG_SPEC_ALLOW
) == 0)
311 arch_seccomp_spec_mitigate(task
);
312 set_tsk_thread_flag(task
, TIF_SECCOMP
);
315 #ifdef CONFIG_SECCOMP_FILTER
316 /* Returns 1 if the parent is an ancestor of the child. */
317 static int is_ancestor(struct seccomp_filter
*parent
,
318 struct seccomp_filter
*child
)
320 /* NULL is the root ancestor. */
323 for (; child
; child
= child
->prev
)
330 * seccomp_can_sync_threads: checks if all threads can be synchronized
332 * Expects sighand and cred_guard_mutex locks to be held.
334 * Returns 0 on success, -ve on error, or the pid of a thread which was
335 * either not in the correct seccomp mode or did not have an ancestral
338 static inline pid_t
seccomp_can_sync_threads(void)
340 struct task_struct
*thread
, *caller
;
342 BUG_ON(!mutex_is_locked(¤t
->signal
->cred_guard_mutex
));
343 assert_spin_locked(¤t
->sighand
->siglock
);
345 /* Validate all threads being eligible for synchronization. */
347 for_each_thread(caller
, thread
) {
350 /* Skip current, since it is initiating the sync. */
351 if (thread
== caller
)
354 if (thread
->seccomp
.mode
== SECCOMP_MODE_DISABLED
||
355 (thread
->seccomp
.mode
== SECCOMP_MODE_FILTER
&&
356 is_ancestor(thread
->seccomp
.filter
,
357 caller
->seccomp
.filter
)))
360 /* Return the first thread that cannot be synchronized. */
361 failed
= task_pid_vnr(thread
);
362 /* If the pid cannot be resolved, then return -ESRCH */
363 if (WARN_ON(failed
== 0))
372 * seccomp_sync_threads: sets all threads to use current's filter
374 * Expects sighand and cred_guard_mutex locks to be held, and for
375 * seccomp_can_sync_threads() to have returned success already
376 * without dropping the locks.
379 static inline void seccomp_sync_threads(unsigned long flags
)
381 struct task_struct
*thread
, *caller
;
383 BUG_ON(!mutex_is_locked(¤t
->signal
->cred_guard_mutex
));
384 assert_spin_locked(¤t
->sighand
->siglock
);
386 /* Synchronize all threads. */
388 for_each_thread(caller
, thread
) {
389 /* Skip current, since it needs no changes. */
390 if (thread
== caller
)
393 /* Get a task reference for the new leaf node. */
394 get_seccomp_filter(caller
);
396 * Drop the task reference to the shared ancestor since
397 * current's path will hold a reference. (This also
398 * allows a put before the assignment.)
400 put_seccomp_filter(thread
);
401 smp_store_release(&thread
->seccomp
.filter
,
402 caller
->seccomp
.filter
);
405 * Don't let an unprivileged task work around
406 * the no_new_privs restriction by creating
407 * a thread that sets it up, enters seccomp,
410 if (task_no_new_privs(caller
))
411 task_set_no_new_privs(thread
);
414 * Opt the other thread into seccomp if needed.
415 * As threads are considered to be trust-realm
416 * equivalent (see ptrace_may_access), it is safe to
417 * allow one thread to transition the other.
419 if (thread
->seccomp
.mode
== SECCOMP_MODE_DISABLED
)
420 seccomp_assign_mode(thread
, SECCOMP_MODE_FILTER
,
426 * seccomp_prepare_filter: Prepares a seccomp filter for use.
427 * @fprog: BPF program to install
429 * Returns filter on success or an ERR_PTR on failure.
431 static struct seccomp_filter
*seccomp_prepare_filter(struct sock_fprog
*fprog
)
433 struct seccomp_filter
*sfilter
;
435 const bool save_orig
= IS_ENABLED(CONFIG_CHECKPOINT_RESTORE
);
437 if (fprog
->len
== 0 || fprog
->len
> BPF_MAXINSNS
)
438 return ERR_PTR(-EINVAL
);
440 BUG_ON(INT_MAX
/ fprog
->len
< sizeof(struct sock_filter
));
443 * Installing a seccomp filter requires that the task has
444 * CAP_SYS_ADMIN in its namespace or be running with no_new_privs.
445 * This avoids scenarios where unprivileged tasks can affect the
446 * behavior of privileged children.
448 if (!task_no_new_privs(current
) &&
449 security_capable(current_cred(), current_user_ns(),
450 CAP_SYS_ADMIN
, CAP_OPT_NOAUDIT
) != 0)
451 return ERR_PTR(-EACCES
);
453 /* Allocate a new seccomp_filter */
454 sfilter
= kzalloc(sizeof(*sfilter
), GFP_KERNEL
| __GFP_NOWARN
);
456 return ERR_PTR(-ENOMEM
);
458 mutex_init(&sfilter
->notify_lock
);
459 ret
= bpf_prog_create_from_user(&sfilter
->prog
, fprog
,
460 seccomp_check_filter
, save_orig
);
466 refcount_set(&sfilter
->usage
, 1);
472 * seccomp_prepare_user_filter - prepares a user-supplied sock_fprog
473 * @user_filter: pointer to the user data containing a sock_fprog.
475 * Returns 0 on success and non-zero otherwise.
477 static struct seccomp_filter
*
478 seccomp_prepare_user_filter(const char __user
*user_filter
)
480 struct sock_fprog fprog
;
481 struct seccomp_filter
*filter
= ERR_PTR(-EFAULT
);
484 if (in_compat_syscall()) {
485 struct compat_sock_fprog fprog32
;
486 if (copy_from_user(&fprog32
, user_filter
, sizeof(fprog32
)))
488 fprog
.len
= fprog32
.len
;
489 fprog
.filter
= compat_ptr(fprog32
.filter
);
490 } else /* falls through to the if below. */
492 if (copy_from_user(&fprog
, user_filter
, sizeof(fprog
)))
494 filter
= seccomp_prepare_filter(&fprog
);
500 * seccomp_attach_filter: validate and attach filter
501 * @flags: flags to change filter behavior
502 * @filter: seccomp filter to add to the current process
504 * Caller must be holding current->sighand->siglock lock.
506 * Returns 0 on success, -ve on error, or
507 * - in TSYNC mode: the pid of a thread which was either not in the correct
508 * seccomp mode or did not have an ancestral seccomp filter
509 * - in NEW_LISTENER mode: the fd of the new listener
511 static long seccomp_attach_filter(unsigned int flags
,
512 struct seccomp_filter
*filter
)
514 unsigned long total_insns
;
515 struct seccomp_filter
*walker
;
517 assert_spin_locked(¤t
->sighand
->siglock
);
519 /* Validate resulting filter length. */
520 total_insns
= filter
->prog
->len
;
521 for (walker
= current
->seccomp
.filter
; walker
; walker
= walker
->prev
)
522 total_insns
+= walker
->prog
->len
+ 4; /* 4 instr penalty */
523 if (total_insns
> MAX_INSNS_PER_PATH
)
526 /* If thread sync has been requested, check that it is possible. */
527 if (flags
& SECCOMP_FILTER_FLAG_TSYNC
) {
530 ret
= seccomp_can_sync_threads();
532 if (flags
& SECCOMP_FILTER_FLAG_TSYNC_ESRCH
)
539 /* Set log flag, if present. */
540 if (flags
& SECCOMP_FILTER_FLAG_LOG
)
544 * If there is an existing filter, make it the prev and don't drop its
547 filter
->prev
= current
->seccomp
.filter
;
548 current
->seccomp
.filter
= filter
;
550 /* Now that the new filter is in place, synchronize to all threads. */
551 if (flags
& SECCOMP_FILTER_FLAG_TSYNC
)
552 seccomp_sync_threads(flags
);
557 static void __get_seccomp_filter(struct seccomp_filter
*filter
)
559 refcount_inc(&filter
->usage
);
562 /* get_seccomp_filter - increments the reference count of the filter on @tsk */
563 void get_seccomp_filter(struct task_struct
*tsk
)
565 struct seccomp_filter
*orig
= tsk
->seccomp
.filter
;
568 __get_seccomp_filter(orig
);
571 static inline void seccomp_filter_free(struct seccomp_filter
*filter
)
574 bpf_prog_destroy(filter
->prog
);
579 static void __put_seccomp_filter(struct seccomp_filter
*orig
)
581 /* Clean up single-reference branches iteratively. */
582 while (orig
&& refcount_dec_and_test(&orig
->usage
)) {
583 struct seccomp_filter
*freeme
= orig
;
585 seccomp_filter_free(freeme
);
589 /* put_seccomp_filter - decrements the ref count of tsk->seccomp.filter */
590 void put_seccomp_filter(struct task_struct
*tsk
)
592 __put_seccomp_filter(tsk
->seccomp
.filter
);
595 static void seccomp_init_siginfo(kernel_siginfo_t
*info
, int syscall
, int reason
)
598 info
->si_signo
= SIGSYS
;
599 info
->si_code
= SYS_SECCOMP
;
600 info
->si_call_addr
= (void __user
*)KSTK_EIP(current
);
601 info
->si_errno
= reason
;
602 info
->si_arch
= syscall_get_arch(current
);
603 info
->si_syscall
= syscall
;
607 * seccomp_send_sigsys - signals the task to allow in-process syscall emulation
608 * @syscall: syscall number to send to userland
609 * @reason: filter-supplied reason code to send to userland (via si_errno)
611 * Forces a SIGSYS with a code of SYS_SECCOMP and related sigsys info.
613 static void seccomp_send_sigsys(int syscall
, int reason
)
615 struct kernel_siginfo info
;
616 seccomp_init_siginfo(&info
, syscall
, reason
);
617 force_sig_info(&info
);
619 #endif /* CONFIG_SECCOMP_FILTER */
621 /* For use with seccomp_actions_logged */
622 #define SECCOMP_LOG_KILL_PROCESS (1 << 0)
623 #define SECCOMP_LOG_KILL_THREAD (1 << 1)
624 #define SECCOMP_LOG_TRAP (1 << 2)
625 #define SECCOMP_LOG_ERRNO (1 << 3)
626 #define SECCOMP_LOG_TRACE (1 << 4)
627 #define SECCOMP_LOG_LOG (1 << 5)
628 #define SECCOMP_LOG_ALLOW (1 << 6)
629 #define SECCOMP_LOG_USER_NOTIF (1 << 7)
631 static u32 seccomp_actions_logged
= SECCOMP_LOG_KILL_PROCESS
|
632 SECCOMP_LOG_KILL_THREAD
|
635 SECCOMP_LOG_USER_NOTIF
|
639 static inline void seccomp_log(unsigned long syscall
, long signr
, u32 action
,
645 case SECCOMP_RET_ALLOW
:
647 case SECCOMP_RET_TRAP
:
648 log
= requested
&& seccomp_actions_logged
& SECCOMP_LOG_TRAP
;
650 case SECCOMP_RET_ERRNO
:
651 log
= requested
&& seccomp_actions_logged
& SECCOMP_LOG_ERRNO
;
653 case SECCOMP_RET_TRACE
:
654 log
= requested
&& seccomp_actions_logged
& SECCOMP_LOG_TRACE
;
656 case SECCOMP_RET_USER_NOTIF
:
657 log
= requested
&& seccomp_actions_logged
& SECCOMP_LOG_USER_NOTIF
;
659 case SECCOMP_RET_LOG
:
660 log
= seccomp_actions_logged
& SECCOMP_LOG_LOG
;
662 case SECCOMP_RET_KILL_THREAD
:
663 log
= seccomp_actions_logged
& SECCOMP_LOG_KILL_THREAD
;
665 case SECCOMP_RET_KILL_PROCESS
:
667 log
= seccomp_actions_logged
& SECCOMP_LOG_KILL_PROCESS
;
671 * Emit an audit message when the action is RET_KILL_*, RET_LOG, or the
672 * FILTER_FLAG_LOG bit was set. The admin has the ability to silence
673 * any action from being logged by removing the action name from the
674 * seccomp_actions_logged sysctl.
679 audit_seccomp(syscall
, signr
, action
);
683 * Secure computing mode 1 allows only read/write/exit/sigreturn.
684 * To be fully secure this must be combined with rlimit
685 * to limit the stack allocations too.
687 static const int mode1_syscalls
[] = {
688 __NR_seccomp_read
, __NR_seccomp_write
, __NR_seccomp_exit
, __NR_seccomp_sigreturn
,
689 0, /* null terminated */
692 static void __secure_computing_strict(int this_syscall
)
694 const int *syscall_whitelist
= mode1_syscalls
;
696 if (in_compat_syscall())
697 syscall_whitelist
= get_compat_mode1_syscalls();
700 if (*syscall_whitelist
== this_syscall
)
702 } while (*++syscall_whitelist
);
707 seccomp_log(this_syscall
, SIGKILL
, SECCOMP_RET_KILL_THREAD
, true);
711 #ifndef CONFIG_HAVE_ARCH_SECCOMP_FILTER
712 void secure_computing_strict(int this_syscall
)
714 int mode
= current
->seccomp
.mode
;
716 if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE
) &&
717 unlikely(current
->ptrace
& PT_SUSPEND_SECCOMP
))
720 if (mode
== SECCOMP_MODE_DISABLED
)
722 else if (mode
== SECCOMP_MODE_STRICT
)
723 __secure_computing_strict(this_syscall
);
729 #ifdef CONFIG_SECCOMP_FILTER
730 static u64
seccomp_next_notify_id(struct seccomp_filter
*filter
)
733 * Note: overflow is ok here, the id just needs to be unique per
736 lockdep_assert_held(&filter
->notify_lock
);
737 return filter
->notif
->next_id
++;
740 static int seccomp_do_user_notification(int this_syscall
,
741 struct seccomp_filter
*match
,
742 const struct seccomp_data
*sd
)
747 struct seccomp_knotif n
= {};
749 mutex_lock(&match
->notify_lock
);
755 n
.state
= SECCOMP_NOTIFY_INIT
;
757 n
.id
= seccomp_next_notify_id(match
);
758 init_completion(&n
.ready
);
759 list_add(&n
.list
, &match
->notif
->notifications
);
761 up(&match
->notif
->request
);
762 wake_up_poll(&match
->notif
->wqh
, EPOLLIN
| EPOLLRDNORM
);
763 mutex_unlock(&match
->notify_lock
);
766 * This is where we wait for a reply from userspace.
768 err
= wait_for_completion_interruptible(&n
.ready
);
769 mutex_lock(&match
->notify_lock
);
777 * Note that it's possible the listener died in between the time when
778 * we were notified of a respons (or a signal) and when we were able to
779 * re-acquire the lock, so only delete from the list if the
780 * notification actually exists.
782 * Also note that this test is only valid because there's no way to
783 * *reattach* to a notifier right now. If one is added, we'll need to
784 * keep track of the notif itself and make sure they match here.
789 mutex_unlock(&match
->notify_lock
);
791 /* Userspace requests to continue the syscall. */
792 if (flags
& SECCOMP_USER_NOTIF_FLAG_CONTINUE
)
795 syscall_set_return_value(current
, task_pt_regs(current
),
800 static int __seccomp_filter(int this_syscall
, const struct seccomp_data
*sd
,
801 const bool recheck_after_trace
)
803 u32 filter_ret
, action
;
804 struct seccomp_filter
*match
= NULL
;
806 struct seccomp_data sd_local
;
809 * Make sure that any changes to mode from another thread have
810 * been seen after TIF_SECCOMP was seen.
815 populate_seccomp_data(&sd_local
);
819 filter_ret
= seccomp_run_filters(sd
, &match
);
820 data
= filter_ret
& SECCOMP_RET_DATA
;
821 action
= filter_ret
& SECCOMP_RET_ACTION_FULL
;
824 case SECCOMP_RET_ERRNO
:
825 /* Set low-order bits as an errno, capped at MAX_ERRNO. */
826 if (data
> MAX_ERRNO
)
828 syscall_set_return_value(current
, task_pt_regs(current
),
832 case SECCOMP_RET_TRAP
:
833 /* Show the handler the original registers. */
834 syscall_rollback(current
, task_pt_regs(current
));
835 /* Let the filter pass back 16 bits of data. */
836 seccomp_send_sigsys(this_syscall
, data
);
839 case SECCOMP_RET_TRACE
:
840 /* We've been put in this state by the ptracer already. */
841 if (recheck_after_trace
)
844 /* ENOSYS these calls if there is no tracer attached. */
845 if (!ptrace_event_enabled(current
, PTRACE_EVENT_SECCOMP
)) {
846 syscall_set_return_value(current
,
847 task_pt_regs(current
),
852 /* Allow the BPF to provide the event message */
853 ptrace_event(PTRACE_EVENT_SECCOMP
, data
);
855 * The delivery of a fatal signal during event
856 * notification may silently skip tracer notification,
857 * which could leave us with a potentially unmodified
858 * syscall that the tracer would have liked to have
859 * changed. Since the process is about to die, we just
860 * force the syscall to be skipped and let the signal
861 * kill the process and correctly handle any tracer exit
864 if (fatal_signal_pending(current
))
866 /* Check if the tracer forced the syscall to be skipped. */
867 this_syscall
= syscall_get_nr(current
, task_pt_regs(current
));
868 if (this_syscall
< 0)
872 * Recheck the syscall, since it may have changed. This
873 * intentionally uses a NULL struct seccomp_data to force
874 * a reload of all registers. This does not goto skip since
875 * a skip would have already been reported.
877 if (__seccomp_filter(this_syscall
, NULL
, true))
882 case SECCOMP_RET_USER_NOTIF
:
883 if (seccomp_do_user_notification(this_syscall
, match
, sd
))
888 case SECCOMP_RET_LOG
:
889 seccomp_log(this_syscall
, 0, action
, true);
892 case SECCOMP_RET_ALLOW
:
894 * Note that the "match" filter will always be NULL for
895 * this action since SECCOMP_RET_ALLOW is the starting
896 * state in seccomp_run_filters().
900 case SECCOMP_RET_KILL_THREAD
:
901 case SECCOMP_RET_KILL_PROCESS
:
903 seccomp_log(this_syscall
, SIGSYS
, action
, true);
904 /* Dump core only if this is the last remaining thread. */
905 if (action
== SECCOMP_RET_KILL_PROCESS
||
906 get_nr_threads(current
) == 1) {
907 kernel_siginfo_t info
;
909 /* Show the original registers in the dump. */
910 syscall_rollback(current
, task_pt_regs(current
));
911 /* Trigger a manual coredump since do_exit skips it. */
912 seccomp_init_siginfo(&info
, this_syscall
, data
);
915 if (action
== SECCOMP_RET_KILL_PROCESS
)
916 do_group_exit(SIGSYS
);
924 seccomp_log(this_syscall
, 0, action
, match
? match
->log
: false);
928 static int __seccomp_filter(int this_syscall
, const struct seccomp_data
*sd
,
929 const bool recheck_after_trace
)
935 int __secure_computing(const struct seccomp_data
*sd
)
937 int mode
= current
->seccomp
.mode
;
940 if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE
) &&
941 unlikely(current
->ptrace
& PT_SUSPEND_SECCOMP
))
944 this_syscall
= sd
? sd
->nr
:
945 syscall_get_nr(current
, task_pt_regs(current
));
948 case SECCOMP_MODE_STRICT
:
949 __secure_computing_strict(this_syscall
); /* may call do_exit */
951 case SECCOMP_MODE_FILTER
:
952 return __seccomp_filter(this_syscall
, sd
, false);
957 #endif /* CONFIG_HAVE_ARCH_SECCOMP_FILTER */
959 long prctl_get_seccomp(void)
961 return current
->seccomp
.mode
;
965 * seccomp_set_mode_strict: internal function for setting strict seccomp
967 * Once current->seccomp.mode is non-zero, it may not be changed.
969 * Returns 0 on success or -EINVAL on failure.
971 static long seccomp_set_mode_strict(void)
973 const unsigned long seccomp_mode
= SECCOMP_MODE_STRICT
;
976 spin_lock_irq(¤t
->sighand
->siglock
);
978 if (!seccomp_may_assign_mode(seccomp_mode
))
984 seccomp_assign_mode(current
, seccomp_mode
, 0);
988 spin_unlock_irq(¤t
->sighand
->siglock
);
993 #ifdef CONFIG_SECCOMP_FILTER
994 static int seccomp_notify_release(struct inode
*inode
, struct file
*file
)
996 struct seccomp_filter
*filter
= file
->private_data
;
997 struct seccomp_knotif
*knotif
;
1002 mutex_lock(&filter
->notify_lock
);
1005 * If this file is being closed because e.g. the task who owned it
1006 * died, let's wake everyone up who was waiting on us.
1008 list_for_each_entry(knotif
, &filter
->notif
->notifications
, list
) {
1009 if (knotif
->state
== SECCOMP_NOTIFY_REPLIED
)
1012 knotif
->state
= SECCOMP_NOTIFY_REPLIED
;
1013 knotif
->error
= -ENOSYS
;
1016 complete(&knotif
->ready
);
1019 kfree(filter
->notif
);
1020 filter
->notif
= NULL
;
1021 mutex_unlock(&filter
->notify_lock
);
1022 __put_seccomp_filter(filter
);
1026 static long seccomp_notify_recv(struct seccomp_filter
*filter
,
1029 struct seccomp_knotif
*knotif
= NULL
, *cur
;
1030 struct seccomp_notif unotif
;
1033 /* Verify that we're not given garbage to keep struct extensible. */
1034 ret
= check_zeroed_user(buf
, sizeof(unotif
));
1040 memset(&unotif
, 0, sizeof(unotif
));
1042 ret
= down_interruptible(&filter
->notif
->request
);
1046 mutex_lock(&filter
->notify_lock
);
1047 list_for_each_entry(cur
, &filter
->notif
->notifications
, list
) {
1048 if (cur
->state
== SECCOMP_NOTIFY_INIT
) {
1055 * If we didn't find a notification, it could be that the task was
1056 * interrupted by a fatal signal between the time we were woken and
1057 * when we were able to acquire the rw lock.
1064 unotif
.id
= knotif
->id
;
1065 unotif
.pid
= task_pid_vnr(knotif
->task
);
1066 unotif
.data
= *(knotif
->data
);
1068 knotif
->state
= SECCOMP_NOTIFY_SENT
;
1069 wake_up_poll(&filter
->notif
->wqh
, EPOLLOUT
| EPOLLWRNORM
);
1072 mutex_unlock(&filter
->notify_lock
);
1074 if (ret
== 0 && copy_to_user(buf
, &unotif
, sizeof(unotif
))) {
1078 * Userspace screwed up. To make sure that we keep this
1079 * notification alive, let's reset it back to INIT. It
1080 * may have died when we released the lock, so we need to make
1081 * sure it's still around.
1084 mutex_lock(&filter
->notify_lock
);
1085 list_for_each_entry(cur
, &filter
->notif
->notifications
, list
) {
1086 if (cur
->id
== unotif
.id
) {
1093 knotif
->state
= SECCOMP_NOTIFY_INIT
;
1094 up(&filter
->notif
->request
);
1096 mutex_unlock(&filter
->notify_lock
);
1102 static long seccomp_notify_send(struct seccomp_filter
*filter
,
1105 struct seccomp_notif_resp resp
= {};
1106 struct seccomp_knotif
*knotif
= NULL
, *cur
;
1109 if (copy_from_user(&resp
, buf
, sizeof(resp
)))
1112 if (resp
.flags
& ~SECCOMP_USER_NOTIF_FLAG_CONTINUE
)
1115 if ((resp
.flags
& SECCOMP_USER_NOTIF_FLAG_CONTINUE
) &&
1116 (resp
.error
|| resp
.val
))
1119 ret
= mutex_lock_interruptible(&filter
->notify_lock
);
1123 list_for_each_entry(cur
, &filter
->notif
->notifications
, list
) {
1124 if (cur
->id
== resp
.id
) {
1135 /* Allow exactly one reply. */
1136 if (knotif
->state
!= SECCOMP_NOTIFY_SENT
) {
1142 knotif
->state
= SECCOMP_NOTIFY_REPLIED
;
1143 knotif
->error
= resp
.error
;
1144 knotif
->val
= resp
.val
;
1145 knotif
->flags
= resp
.flags
;
1146 complete(&knotif
->ready
);
1148 mutex_unlock(&filter
->notify_lock
);
1152 static long seccomp_notify_id_valid(struct seccomp_filter
*filter
,
1155 struct seccomp_knotif
*knotif
= NULL
;
1159 if (copy_from_user(&id
, buf
, sizeof(id
)))
1162 ret
= mutex_lock_interruptible(&filter
->notify_lock
);
1167 list_for_each_entry(knotif
, &filter
->notif
->notifications
, list
) {
1168 if (knotif
->id
== id
) {
1169 if (knotif
->state
== SECCOMP_NOTIFY_SENT
)
1176 mutex_unlock(&filter
->notify_lock
);
1180 static long seccomp_notify_ioctl(struct file
*file
, unsigned int cmd
,
1183 struct seccomp_filter
*filter
= file
->private_data
;
1184 void __user
*buf
= (void __user
*)arg
;
1187 case SECCOMP_IOCTL_NOTIF_RECV
:
1188 return seccomp_notify_recv(filter
, buf
);
1189 case SECCOMP_IOCTL_NOTIF_SEND
:
1190 return seccomp_notify_send(filter
, buf
);
1191 case SECCOMP_IOCTL_NOTIF_ID_VALID
:
1192 return seccomp_notify_id_valid(filter
, buf
);
1198 static __poll_t
seccomp_notify_poll(struct file
*file
,
1199 struct poll_table_struct
*poll_tab
)
1201 struct seccomp_filter
*filter
= file
->private_data
;
1203 struct seccomp_knotif
*cur
;
1205 poll_wait(file
, &filter
->notif
->wqh
, poll_tab
);
1207 if (mutex_lock_interruptible(&filter
->notify_lock
) < 0)
1210 list_for_each_entry(cur
, &filter
->notif
->notifications
, list
) {
1211 if (cur
->state
== SECCOMP_NOTIFY_INIT
)
1212 ret
|= EPOLLIN
| EPOLLRDNORM
;
1213 if (cur
->state
== SECCOMP_NOTIFY_SENT
)
1214 ret
|= EPOLLOUT
| EPOLLWRNORM
;
1215 if ((ret
& EPOLLIN
) && (ret
& EPOLLOUT
))
1219 mutex_unlock(&filter
->notify_lock
);
1224 static const struct file_operations seccomp_notify_ops
= {
1225 .poll
= seccomp_notify_poll
,
1226 .release
= seccomp_notify_release
,
1227 .unlocked_ioctl
= seccomp_notify_ioctl
,
1228 .compat_ioctl
= seccomp_notify_ioctl
,
1231 static struct file
*init_listener(struct seccomp_filter
*filter
)
1233 struct file
*ret
= ERR_PTR(-EBUSY
);
1234 struct seccomp_filter
*cur
;
1236 for (cur
= current
->seccomp
.filter
; cur
; cur
= cur
->prev
) {
1241 ret
= ERR_PTR(-ENOMEM
);
1242 filter
->notif
= kzalloc(sizeof(*(filter
->notif
)), GFP_KERNEL
);
1246 sema_init(&filter
->notif
->request
, 0);
1247 filter
->notif
->next_id
= get_random_u64();
1248 INIT_LIST_HEAD(&filter
->notif
->notifications
);
1249 init_waitqueue_head(&filter
->notif
->wqh
);
1251 ret
= anon_inode_getfile("seccomp notify", &seccomp_notify_ops
,
1256 /* The file has a reference to it now */
1257 __get_seccomp_filter(filter
);
1261 kfree(filter
->notif
);
1267 * seccomp_set_mode_filter: internal function for setting seccomp filter
1268 * @flags: flags to change filter behavior
1269 * @filter: struct sock_fprog containing filter
1271 * This function may be called repeatedly to install additional filters.
1272 * Every filter successfully installed will be evaluated (in reverse order)
1273 * for each system call the task makes.
1275 * Once current->seccomp.mode is non-zero, it may not be changed.
1277 * Returns 0 on success or -EINVAL on failure.
1279 static long seccomp_set_mode_filter(unsigned int flags
,
1280 const char __user
*filter
)
1282 const unsigned long seccomp_mode
= SECCOMP_MODE_FILTER
;
1283 struct seccomp_filter
*prepared
= NULL
;
1286 struct file
*listener_f
= NULL
;
1288 /* Validate flags. */
1289 if (flags
& ~SECCOMP_FILTER_FLAG_MASK
)
1293 * In the successful case, NEW_LISTENER returns the new listener fd.
1294 * But in the failure case, TSYNC returns the thread that died. If you
1295 * combine these two flags, there's no way to tell whether something
1296 * succeeded or failed. So, let's disallow this combination if the user
1297 * has not explicitly requested no errors from TSYNC.
1299 if ((flags
& SECCOMP_FILTER_FLAG_TSYNC
) &&
1300 (flags
& SECCOMP_FILTER_FLAG_NEW_LISTENER
) &&
1301 ((flags
& SECCOMP_FILTER_FLAG_TSYNC_ESRCH
) == 0))
1304 /* Prepare the new filter before holding any locks. */
1305 prepared
= seccomp_prepare_user_filter(filter
);
1306 if (IS_ERR(prepared
))
1307 return PTR_ERR(prepared
);
1309 if (flags
& SECCOMP_FILTER_FLAG_NEW_LISTENER
) {
1310 listener
= get_unused_fd_flags(O_CLOEXEC
);
1316 listener_f
= init_listener(prepared
);
1317 if (IS_ERR(listener_f
)) {
1318 put_unused_fd(listener
);
1319 ret
= PTR_ERR(listener_f
);
1325 * Make sure we cannot change seccomp or nnp state via TSYNC
1326 * while another thread is in the middle of calling exec.
1328 if (flags
& SECCOMP_FILTER_FLAG_TSYNC
&&
1329 mutex_lock_killable(¤t
->signal
->cred_guard_mutex
))
1332 spin_lock_irq(¤t
->sighand
->siglock
);
1334 if (!seccomp_may_assign_mode(seccomp_mode
))
1337 ret
= seccomp_attach_filter(flags
, prepared
);
1340 /* Do not free the successfully attached filter. */
1343 seccomp_assign_mode(current
, seccomp_mode
, flags
);
1345 spin_unlock_irq(¤t
->sighand
->siglock
);
1346 if (flags
& SECCOMP_FILTER_FLAG_TSYNC
)
1347 mutex_unlock(¤t
->signal
->cred_guard_mutex
);
1349 if (flags
& SECCOMP_FILTER_FLAG_NEW_LISTENER
) {
1351 listener_f
->private_data
= NULL
;
1353 put_unused_fd(listener
);
1355 fd_install(listener
, listener_f
);
1360 seccomp_filter_free(prepared
);
1364 static inline long seccomp_set_mode_filter(unsigned int flags
,
1365 const char __user
*filter
)
1371 static long seccomp_get_action_avail(const char __user
*uaction
)
1375 if (copy_from_user(&action
, uaction
, sizeof(action
)))
1379 case SECCOMP_RET_KILL_PROCESS
:
1380 case SECCOMP_RET_KILL_THREAD
:
1381 case SECCOMP_RET_TRAP
:
1382 case SECCOMP_RET_ERRNO
:
1383 case SECCOMP_RET_USER_NOTIF
:
1384 case SECCOMP_RET_TRACE
:
1385 case SECCOMP_RET_LOG
:
1386 case SECCOMP_RET_ALLOW
:
1395 static long seccomp_get_notif_sizes(void __user
*usizes
)
1397 struct seccomp_notif_sizes sizes
= {
1398 .seccomp_notif
= sizeof(struct seccomp_notif
),
1399 .seccomp_notif_resp
= sizeof(struct seccomp_notif_resp
),
1400 .seccomp_data
= sizeof(struct seccomp_data
),
1403 if (copy_to_user(usizes
, &sizes
, sizeof(sizes
)))
1409 /* Common entry point for both prctl and syscall. */
1410 static long do_seccomp(unsigned int op
, unsigned int flags
,
1414 case SECCOMP_SET_MODE_STRICT
:
1415 if (flags
!= 0 || uargs
!= NULL
)
1417 return seccomp_set_mode_strict();
1418 case SECCOMP_SET_MODE_FILTER
:
1419 return seccomp_set_mode_filter(flags
, uargs
);
1420 case SECCOMP_GET_ACTION_AVAIL
:
1424 return seccomp_get_action_avail(uargs
);
1425 case SECCOMP_GET_NOTIF_SIZES
:
1429 return seccomp_get_notif_sizes(uargs
);
1435 SYSCALL_DEFINE3(seccomp
, unsigned int, op
, unsigned int, flags
,
1436 void __user
*, uargs
)
1438 return do_seccomp(op
, flags
, uargs
);
1442 * prctl_set_seccomp: configures current->seccomp.mode
1443 * @seccomp_mode: requested mode to use
1444 * @filter: optional struct sock_fprog for use with SECCOMP_MODE_FILTER
1446 * Returns 0 on success or -EINVAL on failure.
1448 long prctl_set_seccomp(unsigned long seccomp_mode
, void __user
*filter
)
1453 switch (seccomp_mode
) {
1454 case SECCOMP_MODE_STRICT
:
1455 op
= SECCOMP_SET_MODE_STRICT
;
1457 * Setting strict mode through prctl always ignored filter,
1458 * so make sure it is always NULL here to pass the internal
1459 * check in do_seccomp().
1463 case SECCOMP_MODE_FILTER
:
1464 op
= SECCOMP_SET_MODE_FILTER
;
1471 /* prctl interface doesn't have flags, so they are always zero. */
1472 return do_seccomp(op
, 0, uargs
);
1475 #if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
1476 static struct seccomp_filter
*get_nth_filter(struct task_struct
*task
,
1477 unsigned long filter_off
)
1479 struct seccomp_filter
*orig
, *filter
;
1480 unsigned long count
;
1483 * Note: this is only correct because the caller should be the (ptrace)
1484 * tracer of the task, otherwise lock_task_sighand is needed.
1486 spin_lock_irq(&task
->sighand
->siglock
);
1488 if (task
->seccomp
.mode
!= SECCOMP_MODE_FILTER
) {
1489 spin_unlock_irq(&task
->sighand
->siglock
);
1490 return ERR_PTR(-EINVAL
);
1493 orig
= task
->seccomp
.filter
;
1494 __get_seccomp_filter(orig
);
1495 spin_unlock_irq(&task
->sighand
->siglock
);
1498 for (filter
= orig
; filter
; filter
= filter
->prev
)
1501 if (filter_off
>= count
) {
1502 filter
= ERR_PTR(-ENOENT
);
1506 count
-= filter_off
;
1507 for (filter
= orig
; filter
&& count
> 1; filter
= filter
->prev
)
1510 if (WARN_ON(count
!= 1 || !filter
)) {
1511 filter
= ERR_PTR(-ENOENT
);
1515 __get_seccomp_filter(filter
);
1518 __put_seccomp_filter(orig
);
1522 long seccomp_get_filter(struct task_struct
*task
, unsigned long filter_off
,
1525 struct seccomp_filter
*filter
;
1526 struct sock_fprog_kern
*fprog
;
1529 if (!capable(CAP_SYS_ADMIN
) ||
1530 current
->seccomp
.mode
!= SECCOMP_MODE_DISABLED
) {
1534 filter
= get_nth_filter(task
, filter_off
);
1536 return PTR_ERR(filter
);
1538 fprog
= filter
->prog
->orig_prog
;
1540 /* This must be a new non-cBPF filter, since we save
1541 * every cBPF filter's orig_prog above when
1542 * CONFIG_CHECKPOINT_RESTORE is enabled.
1552 if (copy_to_user(data
, fprog
->filter
, bpf_classic_proglen(fprog
)))
1556 __put_seccomp_filter(filter
);
1560 long seccomp_get_metadata(struct task_struct
*task
,
1561 unsigned long size
, void __user
*data
)
1564 struct seccomp_filter
*filter
;
1565 struct seccomp_metadata kmd
= {};
1567 if (!capable(CAP_SYS_ADMIN
) ||
1568 current
->seccomp
.mode
!= SECCOMP_MODE_DISABLED
) {
1572 size
= min_t(unsigned long, size
, sizeof(kmd
));
1574 if (size
< sizeof(kmd
.filter_off
))
1577 if (copy_from_user(&kmd
.filter_off
, data
, sizeof(kmd
.filter_off
)))
1580 filter
= get_nth_filter(task
, kmd
.filter_off
);
1582 return PTR_ERR(filter
);
1585 kmd
.flags
|= SECCOMP_FILTER_FLAG_LOG
;
1588 if (copy_to_user(data
, &kmd
, size
))
1591 __put_seccomp_filter(filter
);
1596 #ifdef CONFIG_SYSCTL
1598 /* Human readable action names for friendly sysctl interaction */
1599 #define SECCOMP_RET_KILL_PROCESS_NAME "kill_process"
1600 #define SECCOMP_RET_KILL_THREAD_NAME "kill_thread"
1601 #define SECCOMP_RET_TRAP_NAME "trap"
1602 #define SECCOMP_RET_ERRNO_NAME "errno"
1603 #define SECCOMP_RET_USER_NOTIF_NAME "user_notif"
1604 #define SECCOMP_RET_TRACE_NAME "trace"
1605 #define SECCOMP_RET_LOG_NAME "log"
1606 #define SECCOMP_RET_ALLOW_NAME "allow"
1608 static const char seccomp_actions_avail
[] =
1609 SECCOMP_RET_KILL_PROCESS_NAME
" "
1610 SECCOMP_RET_KILL_THREAD_NAME
" "
1611 SECCOMP_RET_TRAP_NAME
" "
1612 SECCOMP_RET_ERRNO_NAME
" "
1613 SECCOMP_RET_USER_NOTIF_NAME
" "
1614 SECCOMP_RET_TRACE_NAME
" "
1615 SECCOMP_RET_LOG_NAME
" "
1616 SECCOMP_RET_ALLOW_NAME
;
1618 struct seccomp_log_name
{
1623 static const struct seccomp_log_name seccomp_log_names
[] = {
1624 { SECCOMP_LOG_KILL_PROCESS
, SECCOMP_RET_KILL_PROCESS_NAME
},
1625 { SECCOMP_LOG_KILL_THREAD
, SECCOMP_RET_KILL_THREAD_NAME
},
1626 { SECCOMP_LOG_TRAP
, SECCOMP_RET_TRAP_NAME
},
1627 { SECCOMP_LOG_ERRNO
, SECCOMP_RET_ERRNO_NAME
},
1628 { SECCOMP_LOG_USER_NOTIF
, SECCOMP_RET_USER_NOTIF_NAME
},
1629 { SECCOMP_LOG_TRACE
, SECCOMP_RET_TRACE_NAME
},
1630 { SECCOMP_LOG_LOG
, SECCOMP_RET_LOG_NAME
},
1631 { SECCOMP_LOG_ALLOW
, SECCOMP_RET_ALLOW_NAME
},
1635 static bool seccomp_names_from_actions_logged(char *names
, size_t size
,
1639 const struct seccomp_log_name
*cur
;
1640 bool append_sep
= false;
1642 for (cur
= seccomp_log_names
; cur
->name
&& size
; cur
++) {
1645 if (!(actions_logged
& cur
->log
))
1649 ret
= strscpy(names
, sep
, size
);
1658 ret
= strscpy(names
, cur
->name
, size
);
1669 static bool seccomp_action_logged_from_name(u32
*action_logged
,
1672 const struct seccomp_log_name
*cur
;
1674 for (cur
= seccomp_log_names
; cur
->name
; cur
++) {
1675 if (!strcmp(cur
->name
, name
)) {
1676 *action_logged
= cur
->log
;
1684 static bool seccomp_actions_logged_from_names(u32
*actions_logged
, char *names
)
1688 *actions_logged
= 0;
1689 while ((name
= strsep(&names
, " ")) && *name
) {
1690 u32 action_logged
= 0;
1692 if (!seccomp_action_logged_from_name(&action_logged
, name
))
1695 *actions_logged
|= action_logged
;
1701 static int read_actions_logged(struct ctl_table
*ro_table
, void __user
*buffer
,
1702 size_t *lenp
, loff_t
*ppos
)
1704 char names
[sizeof(seccomp_actions_avail
)];
1705 struct ctl_table table
;
1707 memset(names
, 0, sizeof(names
));
1709 if (!seccomp_names_from_actions_logged(names
, sizeof(names
),
1710 seccomp_actions_logged
, " "))
1715 table
.maxlen
= sizeof(names
);
1716 return proc_dostring(&table
, 0, buffer
, lenp
, ppos
);
1719 static int write_actions_logged(struct ctl_table
*ro_table
, void __user
*buffer
,
1720 size_t *lenp
, loff_t
*ppos
, u32
*actions_logged
)
1722 char names
[sizeof(seccomp_actions_avail
)];
1723 struct ctl_table table
;
1726 if (!capable(CAP_SYS_ADMIN
))
1729 memset(names
, 0, sizeof(names
));
1733 table
.maxlen
= sizeof(names
);
1734 ret
= proc_dostring(&table
, 1, buffer
, lenp
, ppos
);
1738 if (!seccomp_actions_logged_from_names(actions_logged
, table
.data
))
1741 if (*actions_logged
& SECCOMP_LOG_ALLOW
)
1744 seccomp_actions_logged
= *actions_logged
;
1748 static void audit_actions_logged(u32 actions_logged
, u32 old_actions_logged
,
1751 char names
[sizeof(seccomp_actions_avail
)];
1752 char old_names
[sizeof(seccomp_actions_avail
)];
1753 const char *new = names
;
1754 const char *old
= old_names
;
1759 memset(names
, 0, sizeof(names
));
1760 memset(old_names
, 0, sizeof(old_names
));
1764 else if (!actions_logged
)
1766 else if (!seccomp_names_from_actions_logged(names
, sizeof(names
),
1767 actions_logged
, ","))
1770 if (!old_actions_logged
)
1772 else if (!seccomp_names_from_actions_logged(old_names
,
1774 old_actions_logged
, ","))
1777 return audit_seccomp_actions_logged(new, old
, !ret
);
1780 static int seccomp_actions_logged_handler(struct ctl_table
*ro_table
, int write
,
1781 void __user
*buffer
, size_t *lenp
,
1787 u32 actions_logged
= 0;
1788 u32 old_actions_logged
= seccomp_actions_logged
;
1790 ret
= write_actions_logged(ro_table
, buffer
, lenp
, ppos
,
1792 audit_actions_logged(actions_logged
, old_actions_logged
, ret
);
1794 ret
= read_actions_logged(ro_table
, buffer
, lenp
, ppos
);
1799 static struct ctl_path seccomp_sysctl_path
[] = {
1800 { .procname
= "kernel", },
1801 { .procname
= "seccomp", },
1805 static struct ctl_table seccomp_sysctl_table
[] = {
1807 .procname
= "actions_avail",
1808 .data
= (void *) &seccomp_actions_avail
,
1809 .maxlen
= sizeof(seccomp_actions_avail
),
1811 .proc_handler
= proc_dostring
,
1814 .procname
= "actions_logged",
1816 .proc_handler
= seccomp_actions_logged_handler
,
1821 static int __init
seccomp_sysctl_init(void)
1823 struct ctl_table_header
*hdr
;
1825 hdr
= register_sysctl_paths(seccomp_sysctl_path
, seccomp_sysctl_table
);
1827 pr_warn("seccomp: sysctl registration failed\n");
1829 kmemleak_not_leak(hdr
);
1834 device_initcall(seccomp_sysctl_init
)
1836 #endif /* CONFIG_SYSCTL */