blob: 84922befea8414468eafe1330ffc372ec9bdb8da [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * linux/kernel/seccomp.c
3 *
4 * Copyright 2004-2005 Andrea Arcangeli <andrea@cpushare.com>
5 *
Will Drewrye2cfabdf2012-04-12 16:47:57 -05006 * Copyright (C) 2012 Google, Inc.
7 * Will Drewry <wad@chromium.org>
8 *
9 * This defines a simple but solid secure-computing facility.
10 *
11 * Mode 1 uses a fixed list of allowed system calls.
12 * Mode 2 allows user-defined system call filters in the form
13 * of Berkeley Packet Filters/Linux Socket Filters.
Linus Torvalds1da177e2005-04-16 15:20:36 -070014 */
15
Will Drewrye2cfabdf2012-04-12 16:47:57 -050016#include <linux/atomic.h>
Eric Paris85e7bac2012-01-03 14:23:05 -050017#include <linux/audit.h>
Roland McGrath5b101742009-02-27 23:25:54 -080018#include <linux/compat.h>
Will Drewrye2cfabdf2012-04-12 16:47:57 -050019#include <linux/sched.h>
20#include <linux/seccomp.h>
Kees Cookc8bee432014-06-27 15:16:33 -070021#include <linux/slab.h>
Kees Cook48dc92b2014-06-25 16:08:24 -070022#include <linux/syscalls.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070023
24/* #define SECCOMP_DEBUG 1 */
Will Drewrye2cfabdf2012-04-12 16:47:57 -050025
26#ifdef CONFIG_SECCOMP_FILTER
27#include <asm/syscall.h>
28#include <linux/filter.h>
Kees Cookc2e1f2e2014-06-05 00:23:17 -070029#include <linux/pid.h>
Will Drewryfb0fadf2012-04-12 16:48:02 -050030#include <linux/ptrace.h>
Will Drewrye2cfabdf2012-04-12 16:47:57 -050031#include <linux/security.h>
Will Drewrye2cfabdf2012-04-12 16:47:57 -050032#include <linux/tracehook.h>
33#include <linux/uaccess.h>
34
35/**
36 * struct seccomp_filter - container for seccomp BPF programs
37 *
38 * @usage: reference count to manage the object lifetime.
39 * get/put helpers should be used when accessing an instance
40 * outside of a lifetime-guarded section. In general, this
41 * is only needed for handling filters shared across tasks.
42 * @prev: points to a previously installed, or inherited, filter
43 * @len: the number of instructions in the program
Fabian Frederick119ce5c2014-06-06 14:37:53 -070044 * @insnsi: the BPF program instructions to evaluate
Will Drewrye2cfabdf2012-04-12 16:47:57 -050045 *
46 * seccomp_filter objects are organized in a tree linked via the @prev
47 * pointer. For any task, it appears to be a singly-linked list starting
48 * with current->seccomp.filter, the most recently attached or inherited filter.
49 * However, multiple filters may share a @prev node, by way of fork(), which
50 * results in a unidirectional tree existing in memory. This is similar to
51 * how namespaces work.
52 *
53 * seccomp_filter objects should never be modified after being attached
54 * to a task_struct (other than @usage).
55 */
56struct seccomp_filter {
57 atomic_t usage;
58 struct seccomp_filter *prev;
Alexei Starovoitov7ae457c2014-07-30 20:34:16 -070059 struct bpf_prog *prog;
Will Drewrye2cfabdf2012-04-12 16:47:57 -050060};
61
62/* Limit any path through the tree to 256KB worth of instructions. */
63#define MAX_INSNS_PER_PATH ((1 << 18) / sizeof(struct sock_filter))
64
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +010065/*
Will Drewrye2cfabdf2012-04-12 16:47:57 -050066 * Endianness is explicitly ignored and left for BPF program authors to manage
67 * as per the specific architecture.
68 */
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +010069static void populate_seccomp_data(struct seccomp_data *sd)
Will Drewrye2cfabdf2012-04-12 16:47:57 -050070{
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +010071 struct task_struct *task = current;
72 struct pt_regs *regs = task_pt_regs(task);
Daniel Borkmann2eac7642014-04-14 21:02:59 +020073 unsigned long args[6];
Will Drewrye2cfabdf2012-04-12 16:47:57 -050074
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +010075 sd->nr = syscall_get_nr(task, regs);
Linus Torvalds0b747172014-04-12 12:38:53 -070076 sd->arch = syscall_get_arch();
Daniel Borkmann2eac7642014-04-14 21:02:59 +020077 syscall_get_arguments(task, regs, 0, 6, args);
78 sd->args[0] = args[0];
79 sd->args[1] = args[1];
80 sd->args[2] = args[2];
81 sd->args[3] = args[3];
82 sd->args[4] = args[4];
83 sd->args[5] = args[5];
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +010084 sd->instruction_pointer = KSTK_EIP(task);
Will Drewrye2cfabdf2012-04-12 16:47:57 -050085}
86
87/**
88 * seccomp_check_filter - verify seccomp filter code
89 * @filter: filter to verify
90 * @flen: length of filter
91 *
Alexei Starovoitov4df95ff2014-07-30 20:34:14 -070092 * Takes a previously checked filter (by bpf_check_classic) and
Will Drewrye2cfabdf2012-04-12 16:47:57 -050093 * redirects all filter code that loads struct sk_buff data
94 * and related data through seccomp_bpf_load. It also
95 * enforces length and alignment checking of those loads.
96 *
97 * Returns 0 if the rule set is legal or -EINVAL if not.
98 */
99static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen)
100{
101 int pc;
102 for (pc = 0; pc < flen; pc++) {
103 struct sock_filter *ftest = &filter[pc];
104 u16 code = ftest->code;
105 u32 k = ftest->k;
106
107 switch (code) {
Daniel Borkmann34805932014-05-29 10:22:50 +0200108 case BPF_LD | BPF_W | BPF_ABS:
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100109 ftest->code = BPF_LDX | BPF_W | BPF_ABS;
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500110 /* 32-bit aligned and not out of bounds. */
111 if (k >= sizeof(struct seccomp_data) || k & 3)
112 return -EINVAL;
113 continue;
Daniel Borkmann34805932014-05-29 10:22:50 +0200114 case BPF_LD | BPF_W | BPF_LEN:
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100115 ftest->code = BPF_LD | BPF_IMM;
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500116 ftest->k = sizeof(struct seccomp_data);
117 continue;
Daniel Borkmann34805932014-05-29 10:22:50 +0200118 case BPF_LDX | BPF_W | BPF_LEN:
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100119 ftest->code = BPF_LDX | BPF_IMM;
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500120 ftest->k = sizeof(struct seccomp_data);
121 continue;
122 /* Explicitly include allowed calls. */
Daniel Borkmann34805932014-05-29 10:22:50 +0200123 case BPF_RET | BPF_K:
124 case BPF_RET | BPF_A:
125 case BPF_ALU | BPF_ADD | BPF_K:
126 case BPF_ALU | BPF_ADD | BPF_X:
127 case BPF_ALU | BPF_SUB | BPF_K:
128 case BPF_ALU | BPF_SUB | BPF_X:
129 case BPF_ALU | BPF_MUL | BPF_K:
130 case BPF_ALU | BPF_MUL | BPF_X:
131 case BPF_ALU | BPF_DIV | BPF_K:
132 case BPF_ALU | BPF_DIV | BPF_X:
133 case BPF_ALU | BPF_AND | BPF_K:
134 case BPF_ALU | BPF_AND | BPF_X:
135 case BPF_ALU | BPF_OR | BPF_K:
136 case BPF_ALU | BPF_OR | BPF_X:
137 case BPF_ALU | BPF_XOR | BPF_K:
138 case BPF_ALU | BPF_XOR | BPF_X:
139 case BPF_ALU | BPF_LSH | BPF_K:
140 case BPF_ALU | BPF_LSH | BPF_X:
141 case BPF_ALU | BPF_RSH | BPF_K:
142 case BPF_ALU | BPF_RSH | BPF_X:
143 case BPF_ALU | BPF_NEG:
144 case BPF_LD | BPF_IMM:
145 case BPF_LDX | BPF_IMM:
146 case BPF_MISC | BPF_TAX:
147 case BPF_MISC | BPF_TXA:
148 case BPF_LD | BPF_MEM:
149 case BPF_LDX | BPF_MEM:
150 case BPF_ST:
151 case BPF_STX:
152 case BPF_JMP | BPF_JA:
153 case BPF_JMP | BPF_JEQ | BPF_K:
154 case BPF_JMP | BPF_JEQ | BPF_X:
155 case BPF_JMP | BPF_JGE | BPF_K:
156 case BPF_JMP | BPF_JGE | BPF_X:
157 case BPF_JMP | BPF_JGT | BPF_K:
158 case BPF_JMP | BPF_JGT | BPF_X:
159 case BPF_JMP | BPF_JSET | BPF_K:
160 case BPF_JMP | BPF_JSET | BPF_X:
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500161 continue;
162 default:
163 return -EINVAL;
164 }
165 }
166 return 0;
167}
168
169/**
170 * seccomp_run_filters - evaluates all seccomp filters against @syscall
171 * @syscall: number of the current system call
172 *
173 * Returns valid seccomp BPF response codes.
174 */
175static u32 seccomp_run_filters(int syscall)
176{
Kees Cook3ba25302014-06-27 15:01:35 -0700177 struct seccomp_filter *f = ACCESS_ONCE(current->seccomp.filter);
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100178 struct seccomp_data sd;
Will Drewryacf3b2c2012-04-12 16:47:59 -0500179 u32 ret = SECCOMP_RET_ALLOW;
180
181 /* Ensure unexpected behavior doesn't result in failing open. */
Kees Cook3ba25302014-06-27 15:01:35 -0700182 if (unlikely(WARN_ON(f == NULL)))
Will Drewryacf3b2c2012-04-12 16:47:59 -0500183 return SECCOMP_RET_KILL;
184
Kees Cook3ba25302014-06-27 15:01:35 -0700185 /* Make sure cross-thread synced filter points somewhere sane. */
186 smp_read_barrier_depends();
187
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100188 populate_seccomp_data(&sd);
189
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500190 /*
191 * All filters in the list are evaluated and the lowest BPF return
Will Drewryacf3b2c2012-04-12 16:47:59 -0500192 * value always takes priority (ignoring the DATA).
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500193 */
Kees Cook3ba25302014-06-27 15:01:35 -0700194 for (; f; f = f->prev) {
Alexei Starovoitov7ae457c2014-07-30 20:34:16 -0700195 u32 cur_ret = BPF_PROG_RUN(f->prog, (void *)&sd);
Alexei Starovoitov8f577ca2014-05-13 19:50:47 -0700196
Will Drewryacf3b2c2012-04-12 16:47:59 -0500197 if ((cur_ret & SECCOMP_RET_ACTION) < (ret & SECCOMP_RET_ACTION))
198 ret = cur_ret;
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500199 }
200 return ret;
201}
Kees Cook1f41b4502014-06-25 15:38:02 -0700202#endif /* CONFIG_SECCOMP_FILTER */
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500203
Kees Cook1f41b4502014-06-25 15:38:02 -0700204static inline bool seccomp_may_assign_mode(unsigned long seccomp_mode)
205{
Guenter Roeck69f6a342014-08-10 20:50:30 -0700206 assert_spin_locked(&current->sighand->siglock);
Kees Cookdbd952122014-06-27 15:18:48 -0700207
Kees Cook1f41b4502014-06-25 15:38:02 -0700208 if (current->seccomp.mode && current->seccomp.mode != seccomp_mode)
209 return false;
210
211 return true;
212}
213
Kees Cook3ba25302014-06-27 15:01:35 -0700214static inline void seccomp_assign_mode(struct task_struct *task,
215 unsigned long seccomp_mode)
Kees Cook1f41b4502014-06-25 15:38:02 -0700216{
Guenter Roeck69f6a342014-08-10 20:50:30 -0700217 assert_spin_locked(&task->sighand->siglock);
Kees Cookdbd952122014-06-27 15:18:48 -0700218
Kees Cook3ba25302014-06-27 15:01:35 -0700219 task->seccomp.mode = seccomp_mode;
220 /*
221 * Make sure TIF_SECCOMP cannot be set before the mode (and
222 * filter) is set.
223 */
224 smp_mb__before_atomic();
225 set_tsk_thread_flag(task, TIF_SECCOMP);
Kees Cook1f41b4502014-06-25 15:38:02 -0700226}
227
228#ifdef CONFIG_SECCOMP_FILTER
Kees Cookc2e1f2e2014-06-05 00:23:17 -0700229/* Returns 1 if the parent is an ancestor of the child. */
230static int is_ancestor(struct seccomp_filter *parent,
231 struct seccomp_filter *child)
232{
233 /* NULL is the root ancestor. */
234 if (parent == NULL)
235 return 1;
236 for (; child; child = child->prev)
237 if (child == parent)
238 return 1;
239 return 0;
240}
241
242/**
243 * seccomp_can_sync_threads: checks if all threads can be synchronized
244 *
245 * Expects sighand and cred_guard_mutex locks to be held.
246 *
247 * Returns 0 on success, -ve on error, or the pid of a thread which was
248 * either not in the correct seccomp mode or it did not have an ancestral
249 * seccomp filter.
250 */
251static inline pid_t seccomp_can_sync_threads(void)
252{
253 struct task_struct *thread, *caller;
254
255 BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
Guenter Roeck69f6a342014-08-10 20:50:30 -0700256 assert_spin_locked(&current->sighand->siglock);
Kees Cookc2e1f2e2014-06-05 00:23:17 -0700257
258 /* Validate all threads being eligible for synchronization. */
259 caller = current;
260 for_each_thread(caller, thread) {
261 pid_t failed;
262
263 /* Skip current, since it is initiating the sync. */
264 if (thread == caller)
265 continue;
266
267 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED ||
268 (thread->seccomp.mode == SECCOMP_MODE_FILTER &&
269 is_ancestor(thread->seccomp.filter,
270 caller->seccomp.filter)))
271 continue;
272
273 /* Return the first thread that cannot be synchronized. */
274 failed = task_pid_vnr(thread);
275 /* If the pid cannot be resolved, then return -ESRCH */
276 if (unlikely(WARN_ON(failed == 0)))
277 failed = -ESRCH;
278 return failed;
279 }
280
281 return 0;
282}
283
284/**
285 * seccomp_sync_threads: sets all threads to use current's filter
286 *
287 * Expects sighand and cred_guard_mutex locks to be held, and for
288 * seccomp_can_sync_threads() to have returned success already
289 * without dropping the locks.
290 *
291 */
292static inline void seccomp_sync_threads(void)
293{
294 struct task_struct *thread, *caller;
295
296 BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
Guenter Roeck69f6a342014-08-10 20:50:30 -0700297 assert_spin_locked(&current->sighand->siglock);
Kees Cookc2e1f2e2014-06-05 00:23:17 -0700298
299 /* Synchronize all threads. */
300 caller = current;
301 for_each_thread(caller, thread) {
302 /* Skip current, since it needs no changes. */
303 if (thread == caller)
304 continue;
305
306 /* Get a task reference for the new leaf node. */
307 get_seccomp_filter(caller);
308 /*
309 * Drop the task reference to the shared ancestor since
310 * current's path will hold a reference. (This also
311 * allows a put before the assignment.)
312 */
313 put_seccomp_filter(thread);
314 smp_store_release(&thread->seccomp.filter,
315 caller->seccomp.filter);
316 /*
317 * Opt the other thread into seccomp if needed.
318 * As threads are considered to be trust-realm
319 * equivalent (see ptrace_may_access), it is safe to
320 * allow one thread to transition the other.
321 */
322 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED) {
323 /*
324 * Don't let an unprivileged task work around
325 * the no_new_privs restriction by creating
326 * a thread that sets it up, enters seccomp,
327 * then dies.
328 */
329 if (task_no_new_privs(caller))
330 task_set_no_new_privs(thread);
331
332 seccomp_assign_mode(thread, SECCOMP_MODE_FILTER);
333 }
334 }
335}
336
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500337/**
Kees Cookc8bee432014-06-27 15:16:33 -0700338 * seccomp_prepare_filter: Prepares a seccomp filter for use.
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500339 * @fprog: BPF program to install
340 *
Kees Cookc8bee432014-06-27 15:16:33 -0700341 * Returns filter on success or an ERR_PTR on failure.
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500342 */
Kees Cookc8bee432014-06-27 15:16:33 -0700343static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog)
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500344{
345 struct seccomp_filter *filter;
Kees Cookc8bee432014-06-27 15:16:33 -0700346 unsigned long fp_size;
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100347 struct sock_filter *fp;
348 int new_len;
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500349 long ret;
350
351 if (fprog->len == 0 || fprog->len > BPF_MAXINSNS)
Kees Cookc8bee432014-06-27 15:16:33 -0700352 return ERR_PTR(-EINVAL);
353 BUG_ON(INT_MAX / fprog->len < sizeof(struct sock_filter));
354 fp_size = fprog->len * sizeof(struct sock_filter);
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500355
356 /*
Fabian Frederick119ce5c2014-06-06 14:37:53 -0700357 * Installing a seccomp filter requires that the task has
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500358 * CAP_SYS_ADMIN in its namespace or be running with no_new_privs.
359 * This avoids scenarios where unprivileged tasks can affect the
360 * behavior of privileged children.
361 */
Kees Cook1d4457f2014-05-21 15:23:46 -0700362 if (!task_no_new_privs(current) &&
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500363 security_capable_noaudit(current_cred(), current_user_ns(),
364 CAP_SYS_ADMIN) != 0)
Kees Cookc8bee432014-06-27 15:16:33 -0700365 return ERR_PTR(-EACCES);
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500366
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100367 fp = kzalloc(fp_size, GFP_KERNEL|__GFP_NOWARN);
368 if (!fp)
Kees Cookc8bee432014-06-27 15:16:33 -0700369 return ERR_PTR(-ENOMEM);
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500370
371 /* Copy the instructions from fprog. */
372 ret = -EFAULT;
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100373 if (copy_from_user(fp, fprog->filter, fp_size))
374 goto free_prog;
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500375
376 /* Check and rewrite the fprog via the skb checker */
Alexei Starovoitov4df95ff2014-07-30 20:34:14 -0700377 ret = bpf_check_classic(fp, fprog->len);
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500378 if (ret)
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100379 goto free_prog;
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500380
381 /* Check and rewrite the fprog for seccomp use */
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100382 ret = seccomp_check_filter(fp, fprog->len);
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500383 if (ret)
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100384 goto free_prog;
385
Alexei Starovoitov2695fb52014-07-24 16:38:21 -0700386 /* Convert 'sock_filter' insns to 'bpf_insn' insns */
Alexei Starovoitov8fb575c2014-07-30 20:34:15 -0700387 ret = bpf_convert_filter(fp, fprog->len, NULL, &new_len);
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100388 if (ret)
389 goto free_prog;
390
391 /* Allocate a new seccomp_filter */
Kees Cook0acf07d2014-04-16 10:54:34 -0700392 ret = -ENOMEM;
Alexei Starovoitov8f577ca2014-05-13 19:50:47 -0700393 filter = kzalloc(sizeof(struct seccomp_filter),
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100394 GFP_KERNEL|__GFP_NOWARN);
395 if (!filter)
396 goto free_prog;
397
Daniel Borkmann60a3b222014-09-02 22:53:44 +0200398 filter->prog = bpf_prog_alloc(bpf_prog_size(new_len), __GFP_NOWARN);
Alexei Starovoitov8f577ca2014-05-13 19:50:47 -0700399 if (!filter->prog)
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100400 goto free_filter;
Alexei Starovoitov8f577ca2014-05-13 19:50:47 -0700401
Alexei Starovoitov8fb575c2014-07-30 20:34:15 -0700402 ret = bpf_convert_filter(fp, fprog->len, filter->prog->insnsi, &new_len);
Alexei Starovoitov8f577ca2014-05-13 19:50:47 -0700403 if (ret)
404 goto free_filter_prog;
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100405
Daniel Borkmann60a3b222014-09-02 22:53:44 +0200406 kfree(fp);
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100407 atomic_set(&filter->usage, 1);
Alexei Starovoitov8f577ca2014-05-13 19:50:47 -0700408 filter->prog->len = new_len;
Alexei Starovoitov8f577ca2014-05-13 19:50:47 -0700409
Alexei Starovoitov7ae457c2014-07-30 20:34:16 -0700410 bpf_prog_select_runtime(filter->prog);
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500411
Kees Cookc8bee432014-06-27 15:16:33 -0700412 return filter;
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100413
Alexei Starovoitov8f577ca2014-05-13 19:50:47 -0700414free_filter_prog:
Daniel Borkmann60a3b222014-09-02 22:53:44 +0200415 __bpf_prog_free(filter->prog);
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100416free_filter:
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500417 kfree(filter);
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100418free_prog:
419 kfree(fp);
Kees Cookc8bee432014-06-27 15:16:33 -0700420 return ERR_PTR(ret);
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500421}
422
423/**
Kees Cookc8bee432014-06-27 15:16:33 -0700424 * seccomp_prepare_user_filter - prepares a user-supplied sock_fprog
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500425 * @user_filter: pointer to the user data containing a sock_fprog.
426 *
427 * Returns 0 on success and non-zero otherwise.
428 */
Kees Cookc8bee432014-06-27 15:16:33 -0700429static struct seccomp_filter *
430seccomp_prepare_user_filter(const char __user *user_filter)
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500431{
432 struct sock_fprog fprog;
Kees Cookc8bee432014-06-27 15:16:33 -0700433 struct seccomp_filter *filter = ERR_PTR(-EFAULT);
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500434
435#ifdef CONFIG_COMPAT
436 if (is_compat_task()) {
437 struct compat_sock_fprog fprog32;
438 if (copy_from_user(&fprog32, user_filter, sizeof(fprog32)))
439 goto out;
440 fprog.len = fprog32.len;
441 fprog.filter = compat_ptr(fprog32.filter);
442 } else /* falls through to the if below. */
443#endif
444 if (copy_from_user(&fprog, user_filter, sizeof(fprog)))
445 goto out;
Kees Cookc8bee432014-06-27 15:16:33 -0700446 filter = seccomp_prepare_filter(&fprog);
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500447out:
Kees Cookc8bee432014-06-27 15:16:33 -0700448 return filter;
449}
450
451/**
452 * seccomp_attach_filter: validate and attach filter
453 * @flags: flags to change filter behavior
454 * @filter: seccomp filter to add to the current process
455 *
Kees Cookdbd952122014-06-27 15:18:48 -0700456 * Caller must be holding current->sighand->siglock lock.
457 *
Kees Cookc8bee432014-06-27 15:16:33 -0700458 * Returns 0 on success, -ve on error.
459 */
460static long seccomp_attach_filter(unsigned int flags,
461 struct seccomp_filter *filter)
462{
463 unsigned long total_insns;
464 struct seccomp_filter *walker;
465
Guenter Roeck69f6a342014-08-10 20:50:30 -0700466 assert_spin_locked(&current->sighand->siglock);
Kees Cookdbd952122014-06-27 15:18:48 -0700467
Kees Cookc8bee432014-06-27 15:16:33 -0700468 /* Validate resulting filter length. */
469 total_insns = filter->prog->len;
470 for (walker = current->seccomp.filter; walker; walker = walker->prev)
471 total_insns += walker->prog->len + 4; /* 4 instr penalty */
472 if (total_insns > MAX_INSNS_PER_PATH)
473 return -ENOMEM;
474
Kees Cookc2e1f2e2014-06-05 00:23:17 -0700475 /* If thread sync has been requested, check that it is possible. */
476 if (flags & SECCOMP_FILTER_FLAG_TSYNC) {
477 int ret;
478
479 ret = seccomp_can_sync_threads();
480 if (ret)
481 return ret;
482 }
483
Kees Cookc8bee432014-06-27 15:16:33 -0700484 /*
485 * If there is an existing filter, make it the prev and don't drop its
486 * task reference.
487 */
488 filter->prev = current->seccomp.filter;
489 current->seccomp.filter = filter;
490
Kees Cookc2e1f2e2014-06-05 00:23:17 -0700491 /* Now that the new filter is in place, synchronize to all threads. */
492 if (flags & SECCOMP_FILTER_FLAG_TSYNC)
493 seccomp_sync_threads();
494
Kees Cookc8bee432014-06-27 15:16:33 -0700495 return 0;
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500496}
497
498/* get_seccomp_filter - increments the reference count of the filter on @tsk */
499void get_seccomp_filter(struct task_struct *tsk)
500{
501 struct seccomp_filter *orig = tsk->seccomp.filter;
502 if (!orig)
503 return;
504 /* Reference count is bounded by the number of total processes. */
505 atomic_inc(&orig->usage);
506}
507
Kees Cookc8bee432014-06-27 15:16:33 -0700508static inline void seccomp_filter_free(struct seccomp_filter *filter)
509{
510 if (filter) {
Linus Torvaldsae045e22014-08-06 09:38:14 -0700511 bpf_prog_free(filter->prog);
Kees Cookc8bee432014-06-27 15:16:33 -0700512 kfree(filter);
513 }
514}
515
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500516/* put_seccomp_filter - decrements the ref count of tsk->seccomp.filter */
517void put_seccomp_filter(struct task_struct *tsk)
518{
519 struct seccomp_filter *orig = tsk->seccomp.filter;
520 /* Clean up single-reference branches iteratively. */
521 while (orig && atomic_dec_and_test(&orig->usage)) {
522 struct seccomp_filter *freeme = orig;
523 orig = orig->prev;
Kees Cookc8bee432014-06-27 15:16:33 -0700524 seccomp_filter_free(freeme);
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500525 }
526}
Will Drewrybb6ea432012-04-12 16:48:01 -0500527
528/**
529 * seccomp_send_sigsys - signals the task to allow in-process syscall emulation
530 * @syscall: syscall number to send to userland
531 * @reason: filter-supplied reason code to send to userland (via si_errno)
532 *
533 * Forces a SIGSYS with a code of SYS_SECCOMP and related sigsys info.
534 */
535static void seccomp_send_sigsys(int syscall, int reason)
536{
537 struct siginfo info;
538 memset(&info, 0, sizeof(info));
539 info.si_signo = SIGSYS;
540 info.si_code = SYS_SECCOMP;
541 info.si_call_addr = (void __user *)KSTK_EIP(current);
542 info.si_errno = reason;
Eric Paris5e937a92014-03-11 12:48:43 -0400543 info.si_arch = syscall_get_arch();
Will Drewrybb6ea432012-04-12 16:48:01 -0500544 info.si_syscall = syscall;
545 force_sig_info(SIGSYS, &info, current);
546}
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500547#endif /* CONFIG_SECCOMP_FILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700548
549/*
550 * Secure computing mode 1 allows only read/write/exit/sigreturn.
551 * To be fully secure this must be combined with rlimit
552 * to limit the stack allocations too.
553 */
554static int mode1_syscalls[] = {
555 __NR_seccomp_read, __NR_seccomp_write, __NR_seccomp_exit, __NR_seccomp_sigreturn,
556 0, /* null terminated */
557};
558
Roland McGrath5b101742009-02-27 23:25:54 -0800559#ifdef CONFIG_COMPAT
Linus Torvalds1da177e2005-04-16 15:20:36 -0700560static int mode1_syscalls_32[] = {
561 __NR_seccomp_read_32, __NR_seccomp_write_32, __NR_seccomp_exit_32, __NR_seccomp_sigreturn_32,
562 0, /* null terminated */
563};
564#endif
565
Will Drewryacf3b2c2012-04-12 16:47:59 -0500566int __secure_computing(int this_syscall)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700567{
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500568 int exit_sig = 0;
569 int *syscall;
Will Drewry8156b452012-04-17 14:48:58 -0500570 u32 ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700571
Kees Cook3ba25302014-06-27 15:01:35 -0700572 /*
573 * Make sure that any changes to mode from another thread have
574 * been seen after TIF_SECCOMP was seen.
575 */
576 rmb();
577
578 switch (current->seccomp.mode) {
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500579 case SECCOMP_MODE_STRICT:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700580 syscall = mode1_syscalls;
Roland McGrath5b101742009-02-27 23:25:54 -0800581#ifdef CONFIG_COMPAT
582 if (is_compat_task())
Linus Torvalds1da177e2005-04-16 15:20:36 -0700583 syscall = mode1_syscalls_32;
584#endif
585 do {
586 if (*syscall == this_syscall)
Will Drewryacf3b2c2012-04-12 16:47:59 -0500587 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700588 } while (*++syscall);
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500589 exit_sig = SIGKILL;
Will Drewry8156b452012-04-17 14:48:58 -0500590 ret = SECCOMP_RET_KILL;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700591 break;
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500592#ifdef CONFIG_SECCOMP_FILTER
Will Drewry8156b452012-04-17 14:48:58 -0500593 case SECCOMP_MODE_FILTER: {
594 int data;
Andy Lutomirski87b526d2012-10-01 11:40:45 -0700595 struct pt_regs *regs = task_pt_regs(current);
Will Drewryacf3b2c2012-04-12 16:47:59 -0500596 ret = seccomp_run_filters(this_syscall);
597 data = ret & SECCOMP_RET_DATA;
Will Drewry8156b452012-04-17 14:48:58 -0500598 ret &= SECCOMP_RET_ACTION;
599 switch (ret) {
Will Drewryacf3b2c2012-04-12 16:47:59 -0500600 case SECCOMP_RET_ERRNO:
601 /* Set the low-order 16-bits as a errno. */
Andy Lutomirski87b526d2012-10-01 11:40:45 -0700602 syscall_set_return_value(current, regs,
Will Drewryacf3b2c2012-04-12 16:47:59 -0500603 -data, 0);
604 goto skip;
Will Drewrybb6ea432012-04-12 16:48:01 -0500605 case SECCOMP_RET_TRAP:
606 /* Show the handler the original registers. */
Andy Lutomirski87b526d2012-10-01 11:40:45 -0700607 syscall_rollback(current, regs);
Will Drewrybb6ea432012-04-12 16:48:01 -0500608 /* Let the filter pass back 16 bits of data. */
609 seccomp_send_sigsys(this_syscall, data);
610 goto skip;
Will Drewryfb0fadf2012-04-12 16:48:02 -0500611 case SECCOMP_RET_TRACE:
612 /* Skip these calls if there is no tracer. */
Andy Lutomirski87b526d2012-10-01 11:40:45 -0700613 if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP)) {
614 syscall_set_return_value(current, regs,
615 -ENOSYS, 0);
Will Drewryfb0fadf2012-04-12 16:48:02 -0500616 goto skip;
Andy Lutomirski87b526d2012-10-01 11:40:45 -0700617 }
Will Drewryfb0fadf2012-04-12 16:48:02 -0500618 /* Allow the BPF to provide the event message */
619 ptrace_event(PTRACE_EVENT_SECCOMP, data);
620 /*
621 * The delivery of a fatal signal during event
622 * notification may silently skip tracer notification.
623 * Terminating the task now avoids executing a system
624 * call that may not be intended.
625 */
626 if (fatal_signal_pending(current))
627 break;
Andy Lutomirski87b526d2012-10-01 11:40:45 -0700628 if (syscall_get_nr(current, regs) < 0)
629 goto skip; /* Explicit request to skip. */
630
Will Drewryfb0fadf2012-04-12 16:48:02 -0500631 return 0;
Will Drewryacf3b2c2012-04-12 16:47:59 -0500632 case SECCOMP_RET_ALLOW:
633 return 0;
634 case SECCOMP_RET_KILL:
635 default:
636 break;
637 }
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500638 exit_sig = SIGSYS;
639 break;
Will Drewry8156b452012-04-17 14:48:58 -0500640 }
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500641#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -0700642 default:
643 BUG();
644 }
645
646#ifdef SECCOMP_DEBUG
647 dump_stack();
648#endif
Will Drewryacf3b2c2012-04-12 16:47:59 -0500649 audit_seccomp(this_syscall, exit_sig, ret);
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500650 do_exit(exit_sig);
Will Drewry8156b452012-04-17 14:48:58 -0500651#ifdef CONFIG_SECCOMP_FILTER
Will Drewryacf3b2c2012-04-12 16:47:59 -0500652skip:
653 audit_seccomp(this_syscall, exit_sig, ret);
Will Drewry8156b452012-04-17 14:48:58 -0500654#endif
Will Drewryacf3b2c2012-04-12 16:47:59 -0500655 return -1;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700656}
Andrea Arcangeli1d9d02f2007-07-15 23:41:32 -0700657
658long prctl_get_seccomp(void)
659{
660 return current->seccomp.mode;
661}
662
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500663/**
Kees Cook3b23dd12014-06-25 15:55:25 -0700664 * seccomp_set_mode_strict: internal function for setting strict seccomp
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500665 *
666 * Once current->seccomp.mode is non-zero, it may not be changed.
667 *
668 * Returns 0 on success or -EINVAL on failure.
669 */
Kees Cook3b23dd12014-06-25 15:55:25 -0700670static long seccomp_set_mode_strict(void)
Andrea Arcangeli1d9d02f2007-07-15 23:41:32 -0700671{
Kees Cook3b23dd12014-06-25 15:55:25 -0700672 const unsigned long seccomp_mode = SECCOMP_MODE_STRICT;
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500673 long ret = -EINVAL;
Andrea Arcangeli1d9d02f2007-07-15 23:41:32 -0700674
Kees Cookdbd952122014-06-27 15:18:48 -0700675 spin_lock_irq(&current->sighand->siglock);
676
Kees Cook1f41b4502014-06-25 15:38:02 -0700677 if (!seccomp_may_assign_mode(seccomp_mode))
Andrea Arcangeli1d9d02f2007-07-15 23:41:32 -0700678 goto out;
679
Andrea Arcangelicf99aba2007-07-15 23:41:33 -0700680#ifdef TIF_NOTSC
Kees Cook3b23dd12014-06-25 15:55:25 -0700681 disable_TSC();
Andrea Arcangelicf99aba2007-07-15 23:41:33 -0700682#endif
Kees Cook3ba25302014-06-27 15:01:35 -0700683 seccomp_assign_mode(current, seccomp_mode);
Kees Cook3b23dd12014-06-25 15:55:25 -0700684 ret = 0;
685
686out:
Kees Cookdbd952122014-06-27 15:18:48 -0700687 spin_unlock_irq(&current->sighand->siglock);
Kees Cook3b23dd12014-06-25 15:55:25 -0700688
689 return ret;
690}
691
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500692#ifdef CONFIG_SECCOMP_FILTER
Kees Cook3b23dd12014-06-25 15:55:25 -0700693/**
694 * seccomp_set_mode_filter: internal function for setting seccomp filter
Kees Cook48dc92b2014-06-25 16:08:24 -0700695 * @flags: flags to change filter behavior
Kees Cook3b23dd12014-06-25 15:55:25 -0700696 * @filter: struct sock_fprog containing filter
697 *
698 * This function may be called repeatedly to install additional filters.
699 * Every filter successfully installed will be evaluated (in reverse order)
700 * for each system call the task makes.
701 *
702 * Once current->seccomp.mode is non-zero, it may not be changed.
703 *
704 * Returns 0 on success or -EINVAL on failure.
705 */
Kees Cook48dc92b2014-06-25 16:08:24 -0700706static long seccomp_set_mode_filter(unsigned int flags,
707 const char __user *filter)
Kees Cook3b23dd12014-06-25 15:55:25 -0700708{
709 const unsigned long seccomp_mode = SECCOMP_MODE_FILTER;
Kees Cookc8bee432014-06-27 15:16:33 -0700710 struct seccomp_filter *prepared = NULL;
Kees Cook3b23dd12014-06-25 15:55:25 -0700711 long ret = -EINVAL;
712
Kees Cook48dc92b2014-06-25 16:08:24 -0700713 /* Validate flags. */
Kees Cookc2e1f2e2014-06-05 00:23:17 -0700714 if (flags & ~SECCOMP_FILTER_FLAG_MASK)
Kees Cookdbd952122014-06-27 15:18:48 -0700715 return -EINVAL;
Kees Cook48dc92b2014-06-25 16:08:24 -0700716
Kees Cookc8bee432014-06-27 15:16:33 -0700717 /* Prepare the new filter before holding any locks. */
718 prepared = seccomp_prepare_user_filter(filter);
719 if (IS_ERR(prepared))
720 return PTR_ERR(prepared);
721
Kees Cookc2e1f2e2014-06-05 00:23:17 -0700722 /*
723 * Make sure we cannot change seccomp or nnp state via TSYNC
724 * while another thread is in the middle of calling exec.
725 */
726 if (flags & SECCOMP_FILTER_FLAG_TSYNC &&
727 mutex_lock_killable(&current->signal->cred_guard_mutex))
728 goto out_free;
729
Kees Cookdbd952122014-06-27 15:18:48 -0700730 spin_lock_irq(&current->sighand->siglock);
731
Kees Cook3b23dd12014-06-25 15:55:25 -0700732 if (!seccomp_may_assign_mode(seccomp_mode))
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500733 goto out;
Kees Cook3b23dd12014-06-25 15:55:25 -0700734
Kees Cookc8bee432014-06-27 15:16:33 -0700735 ret = seccomp_attach_filter(flags, prepared);
Kees Cook3b23dd12014-06-25 15:55:25 -0700736 if (ret)
737 goto out;
Kees Cookc8bee432014-06-27 15:16:33 -0700738 /* Do not free the successfully attached filter. */
739 prepared = NULL;
Andrea Arcangeli1d9d02f2007-07-15 23:41:32 -0700740
Kees Cook3ba25302014-06-27 15:01:35 -0700741 seccomp_assign_mode(current, seccomp_mode);
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500742out:
Kees Cookdbd952122014-06-27 15:18:48 -0700743 spin_unlock_irq(&current->sighand->siglock);
Kees Cookc2e1f2e2014-06-05 00:23:17 -0700744 if (flags & SECCOMP_FILTER_FLAG_TSYNC)
745 mutex_unlock(&current->signal->cred_guard_mutex);
746out_free:
Kees Cookc8bee432014-06-27 15:16:33 -0700747 seccomp_filter_free(prepared);
Andrea Arcangeli1d9d02f2007-07-15 23:41:32 -0700748 return ret;
749}
Kees Cook3b23dd12014-06-25 15:55:25 -0700750#else
Kees Cook48dc92b2014-06-25 16:08:24 -0700751static inline long seccomp_set_mode_filter(unsigned int flags,
752 const char __user *filter)
Kees Cook3b23dd12014-06-25 15:55:25 -0700753{
754 return -EINVAL;
755}
756#endif
Kees Cookd78ab022014-05-21 15:02:11 -0700757
Kees Cook48dc92b2014-06-25 16:08:24 -0700758/* Common entry point for both prctl and syscall. */
759static long do_seccomp(unsigned int op, unsigned int flags,
760 const char __user *uargs)
761{
762 switch (op) {
763 case SECCOMP_SET_MODE_STRICT:
764 if (flags != 0 || uargs != NULL)
765 return -EINVAL;
766 return seccomp_set_mode_strict();
767 case SECCOMP_SET_MODE_FILTER:
768 return seccomp_set_mode_filter(flags, uargs);
769 default:
770 return -EINVAL;
771 }
772}
773
774SYSCALL_DEFINE3(seccomp, unsigned int, op, unsigned int, flags,
775 const char __user *, uargs)
776{
777 return do_seccomp(op, flags, uargs);
778}
779
Kees Cookd78ab022014-05-21 15:02:11 -0700780/**
781 * prctl_set_seccomp: configures current->seccomp.mode
782 * @seccomp_mode: requested mode to use
783 * @filter: optional struct sock_fprog for use with SECCOMP_MODE_FILTER
784 *
785 * Returns 0 on success or -EINVAL on failure.
786 */
787long prctl_set_seccomp(unsigned long seccomp_mode, char __user *filter)
788{
Kees Cook48dc92b2014-06-25 16:08:24 -0700789 unsigned int op;
790 char __user *uargs;
791
Kees Cook3b23dd12014-06-25 15:55:25 -0700792 switch (seccomp_mode) {
793 case SECCOMP_MODE_STRICT:
Kees Cook48dc92b2014-06-25 16:08:24 -0700794 op = SECCOMP_SET_MODE_STRICT;
795 /*
796 * Setting strict mode through prctl always ignored filter,
797 * so make sure it is always NULL here to pass the internal
798 * check in do_seccomp().
799 */
800 uargs = NULL;
801 break;
Kees Cook3b23dd12014-06-25 15:55:25 -0700802 case SECCOMP_MODE_FILTER:
Kees Cook48dc92b2014-06-25 16:08:24 -0700803 op = SECCOMP_SET_MODE_FILTER;
804 uargs = filter;
805 break;
Kees Cook3b23dd12014-06-25 15:55:25 -0700806 default:
807 return -EINVAL;
808 }
Kees Cook48dc92b2014-06-25 16:08:24 -0700809
810 /* prctl interface doesn't have flags, so they are always zero. */
811 return do_seccomp(op, 0, uargs);
Kees Cookd78ab022014-05-21 15:02:11 -0700812}