api: add support for the SPEC_ALLOW flag

Signed-off-by: Tycho Andersen <tycho@tycho.ws>
Signed-off-by: Paul Moore <paul@paul-moore.com>

diff --git a/doc/man/man3/seccomp_api_get.3 b/doc/man/man3/seccomp_api_get.3
index 0def6863aa6dac95af1b7ec53ad9c9e690ce7d63..ac3c2ff88d0c134dc4215cbf89059273895b6062 100644 (file)
--- a/doc/man/man3/seccomp_api_get.3
+++ b/doc/man/man3/seccomp_api_get.3
@@ -50,6 +50,9 @@ syscall to load the seccomp filter into the kernel.
 .TP
 .B 3
 The SCMP_FLTATR_CTL_LOG filter attribute and the SCMP_ACT_LOG action are supported.
+.TP
+.B 4
+The SCMP_FLTATR_SPEC_ALLOW filter attribute is supported.
 .\" //////////////////////////////////////////////////////////////////////////
 .SH RETURN VALUE
 .\" //////////////////////////////////////////////////////////////////////////

diff --git a/doc/man/man3/seccomp_attr_set.3 b/doc/man/man3/seccomp_attr_set.3
index 7050d5f928449f0cea3b025e2854750488aaf647..113200430a7bf93aa36a4922474f9226ba87e6e0 100644 (file)
--- a/doc/man/man3/seccomp_attr_set.3
+++ b/doc/man/man3/seccomp_attr_set.3
@@ -94,6 +94,12 @@ the
 action. Defaults to off (
 .I value
 == 0).
+.TP
+.B SCMP_FLTATR_SPEC_ALLOW
+A flag to disable Speculative Store Bypass mitigations for this filter.
+Defaults to off (
+.I value
+== 0).
 .\" //////////////////////////////////////////////////////////////////////////
 .SH RETURN VALUE
 .\" //////////////////////////////////////////////////////////////////////////

diff --git a/include/seccomp.h.in b/include/seccomp.h.in
index 118d2fdadbf0c579a40c9662c70e7b5a94f4364a..eaa56740b831d74da97bdc8ecb1e0e2aafc88dfb 100644 (file)
--- a/include/seccomp.h.in
+++ b/include/seccomp.h.in
@@ -65,6 +65,7 @@ enum scmp_filter_attr {
        SCMP_FLTATR_CTL_TSYNC = 4,      /**< sync threads on filter load */
        SCMP_FLTATR_API_TSKIP = 5,      /**< allow rules with a -1 syscall */
        SCMP_FLTATR_CTL_LOG = 6,        /**< log not-allowed actions */
+       SCMP_FLTATR_SPEC_ALLOW = 7, /**< disable SSB mitigation */
        _SCMP_FLTATR_MAX,
 };
 
@@ -367,6 +368,7 @@ const struct scmp_version *seccomp_version(void);
  *  3 : support for the SCMP_FLTATR_CTL_LOG filter attribute
  *      support for the SCMP_ACT_LOG action
  *      support for the SCMP_ACT_KILL_PROCESS action
+ *  4 : support for the SCMP_FLTATR_SPEC_ALLOW filter attrbute
  *
  */
 unsigned int seccomp_api_get(void);

diff --git a/src/api.c b/src/api.c
index 94039a7b2738ff50d30005b48a78f496e2a61b95..34fd9c712771fd0c985762316e53c80f0cef66fa 100644 (file)
--- a/src/api.c
+++ b/src/api.c
@@ -108,6 +108,10 @@ static unsigned int _seccomp_api_update(void)
            sys_chk_seccomp_action(SCMP_ACT_LOG) == 1)
                level = 3;
 
+       if (level == 3 &&
+           sys_chk_seccomp_flag(SECCOMP_FILTER_FLAG_SPEC_ALLOW) == 1)
+               level = 4;
+
        /* update the stored api level and return */
        seccomp_api_level = level;
        return seccomp_api_level;
@@ -151,6 +155,14 @@ API int seccomp_api_set(unsigned int level)
                sys_set_seccomp_action(SCMP_ACT_LOG, true);
                sys_set_seccomp_action(SCMP_ACT_KILL_PROCESS, true);
                break;
+       case 4:
+               sys_set_seccomp_syscall(true);
+               sys_set_seccomp_flag(SECCOMP_FILTER_FLAG_TSYNC, true);
+               sys_set_seccomp_flag(SECCOMP_FILTER_FLAG_LOG, true);
+               sys_set_seccomp_action(SCMP_ACT_LOG, true);
+               sys_set_seccomp_action(SCMP_ACT_KILL_PROCESS, true);
+               sys_set_seccomp_flag(SECCOMP_FILTER_FLAG_SPEC_ALLOW, true);
+               break;
        default:
                return -EINVAL;
        }

diff --git a/src/db.c b/src/db.c
index 64e0924d4d55c76b599a57f3c97f71dc73511751..064f343a363ea1be2f09cd6d0a80ebd8ecfa8893 100644 (file)
--- a/src/db.c
+++ b/src/db.c
@@ -1280,6 +1280,9 @@ int db_col_attr_get(const struct db_filter_col *col,
        case SCMP_FLTATR_CTL_LOG:
                *value = col->attr.log_enable;
                break;
+       case SCMP_FLTATR_SPEC_ALLOW:
+               *value = col->attr.spec_allow;
+               break;
        default:
                rc = -EEXIST;
                break;
@@ -1341,6 +1344,17 @@ int db_col_attr_set(struct db_filter_col *col,
                        rc = -EOPNOTSUPP;
                }
                break;
+       case SCMP_FLTATR_SPEC_ALLOW:
+               rc = sys_chk_seccomp_flag(SECCOMP_FILTER_FLAG_SPEC_ALLOW);
+               if (rc == 1) {
+                       /* supported */
+                       rc = 0;
+                       col->attr.spec_allow = (value ? 1 : 0);
+               } else if (rc == 0) {
+                       /* unsupported */
+                       rc = -EOPNOTSUPP;
+               }
+               break;
        default:
                rc = -EEXIST;
                break;

diff --git a/src/db.h b/src/db.h
index 8a64623639dc093be58b00549102072c7f441b6f..fa9c08507e586e9568e49e45c466e3a758a5e63d 100644 (file)
--- a/src/db.h
+++ b/src/db.h
@@ -116,6 +116,8 @@ struct db_filter_attr {
        uint32_t api_tskip;
        /* SECCOMP_FILTER_FLAG_LOG related attributes */
        uint32_t log_enable;
+       /* SPEC_ALLOW related attributes */
+       uint32_t spec_allow;
 };
 
 struct db_filter {

diff --git a/src/python/libseccomp.pxd b/src/python/libseccomp.pxd
index 49d0be4c9de812b5a7548f424ca9c8f4732bf1ed..1293208a5bdd2e3e17129b7b3036e2ef3cf30e4b 100644 (file)
--- a/src/python/libseccomp.pxd
+++ b/src/python/libseccomp.pxd
@@ -58,6 +58,7 @@ cdef extern from "seccomp.h":
         SCMP_FLTATR_CTL_TSYNC
         SCMP_FLTATR_API_TSKIP
         SCMP_FLTATR_CTL_LOG
+        SCMP_FLTATR_SPEC_ALLOW
 
     cdef enum scmp_compare:
         SCMP_CMP_NE

diff --git a/src/python/seccomp.pyx b/src/python/seccomp.pyx
index 771b9c3f69390392b01dcd203e3fc37fd8b9e6e5..27211ad6c756f3132ab099c5baea5d13508efbf7 100644 (file)
--- a/src/python/seccomp.pyx
+++ b/src/python/seccomp.pyx
@@ -308,6 +308,7 @@ cdef class Attr:
     CTL_TSYNC = libseccomp.SCMP_FLTATR_CTL_TSYNC
     API_TSKIP = libseccomp.SCMP_FLTATR_API_TSKIP
     CTL_LOG = libseccomp.SCMP_FLTATR_CTL_LOG
+    SPEC_ALLOW = libseccomp.SCMP_FLTATR_SPEC_ALLOW
 
 cdef class Arg:
     """ Python object representing a SyscallFilter syscall argument.

diff --git a/src/system.c b/src/system.c
index 0501b76d05920cff075cc845162e8657f0e4d751..f45379c1c5f428d150895aed08328d6c769352f1 100644 (file)
--- a/src/system.c
+++ b/src/system.c
@@ -44,6 +44,7 @@ static int _support_seccomp_flag_tsync = -1;
 static int _support_seccomp_flag_log = -1;
 static int _support_seccomp_action_log = -1;
 static int _support_seccomp_kill_process = -1;
+static int _support_seccomp_flag_spec_allow = -1;
 
 /**
  * Check to see if the seccomp() syscall is supported
@@ -221,6 +222,11 @@ int sys_chk_seccomp_flag(int flag)
                        _support_seccomp_flag_log = _sys_chk_seccomp_flag_kernel(flag);
 
                return _support_seccomp_flag_log;
+       case SECCOMP_FILTER_FLAG_SPEC_ALLOW:
+               if (_support_seccomp_flag_spec_allow < 0)
+                       _support_seccomp_flag_spec_allow = _sys_chk_seccomp_flag_kernel(flag);
+
+               return _support_seccomp_flag_spec_allow;
        }
 
        return -EOPNOTSUPP;
@@ -244,6 +250,9 @@ void sys_set_seccomp_flag(int flag, bool enable)
        case SECCOMP_FILTER_FLAG_LOG:
                _support_seccomp_flag_log = (enable ? 1 : 0);
                break;
+       case SECCOMP_FILTER_FLAG_SPEC_ALLOW:
+               _support_seccomp_flag_spec_allow = (enable ? 1 : 0);
+               break;
        }
 }
 
@@ -280,6 +289,8 @@ int sys_filter_load(const struct db_filter_col *col)
                        flgs |= SECCOMP_FILTER_FLAG_TSYNC;
                if (col->attr.log_enable)
                        flgs |= SECCOMP_FILTER_FLAG_LOG;
+               if (col->attr.spec_allow)
+                       flgs |= SECCOMP_FILTER_FLAG_SPEC_ALLOW;
                rc = syscall(_nr_seccomp, SECCOMP_SET_MODE_FILTER, flgs, prgm);
                if (rc > 0 && col->attr.tsync_enable)
                        /* always return -ESRCH if we fail to sync threads */

diff --git a/tests/13-basic-attrs.c b/tests/13-basic-attrs.c
index 0fe4755035eee0acaaeb1690b01966459bb87262..29ef3210e6541dc379c6f37740337e4354590200 100644 (file)
--- a/tests/13-basic-attrs.c
+++ b/tests/13-basic-attrs.c
@@ -32,7 +32,7 @@ int main(int argc, char *argv[])
        uint32_t val = (uint32_t)(-1);
        scmp_filter_ctx ctx = NULL;
 
-       rc = seccomp_api_set(3);
+       rc = seccomp_api_set(4);
        if (rc != 0)
                return EOPNOTSUPP;
 
@@ -108,6 +108,20 @@ int main(int argc, char *argv[])
                goto out;
        }
 
+
+       rc = seccomp_attr_set(ctx, SCMP_FLTATR_SPEC_ALLOW, 1);
+       if (rc == -EOPNOTSUPP)
+               goto out;
+       else if (rc != 0)
+               goto out;
+       rc = seccomp_attr_get(ctx, SCMP_FLTATR_SPEC_ALLOW, &val);
+       if (rc != 0)
+               goto out;
+       if (val != 1) {
+               rc = -1;
+               goto out;
+       }
+
        rc = 0;
 out:
        seccomp_release(ctx);

diff --git a/tests/13-basic-attrs.py b/tests/13-basic-attrs.py
index 49759ee8459943d28fd47700e95de4bbb85c0bc4..7ee5df79d507705caf862599b1d6533ae2c66756 100755 (executable)
--- a/tests/13-basic-attrs.py
+++ b/tests/13-basic-attrs.py
@@ -29,7 +29,7 @@ import util
 from seccomp import *
 
 def test():
-    set_api(3)
+    set_api(4)
 
     f = SyscallFilter(ALLOW)
     if f.get_attr(Attr.ACT_DEFAULT) != ALLOW:
@@ -52,6 +52,9 @@ def test():
     f.set_attr(Attr.CTL_LOG, 1)
     if f.get_attr(Attr.CTL_LOG) != 1:
         raise RuntimeError("Failed getting Attr.CTL_LOG")
+    f.set_attr(Attr.SPEC_ALLOW, 1)
+    if f.get_attr(Attr.SPEC_ALLOW) != 1:
+        raise RuntimeError("Failed getting Attr.SPEC_ALLOW")
 
 test()