seccomp.c

   1// SPDX-License-Identifier: GPL-2.0
   2/*
   3 * linux/kernel/seccomp.c
   4 *
   5 * Copyright 2004-2005  Andrea Arcangeli <andrea@cpushare.com>
   6 *
   7 * Copyright (C) 2012 Google, Inc.
   8 * Will Drewry <wad@chromium.org>
   9 *
  10 * This defines a simple but solid secure-computing facility.
  11 *
  12 * Mode 1 uses a fixed list of allowed system calls.
  13 * Mode 2 allows user-defined system call filters in the form
  14 *        of Berkeley Packet Filters/Linux Socket Filters.
  15 */
  16#define pr_fmt(fmt) "seccomp: " fmt
  17
  18#include <linux/refcount.h>
  19#include <linux/audit.h>
  20#include <linux/compat.h>
  21#include <linux/coredump.h>
  22#include <linux/kmemleak.h>
  23#include <linux/nospec.h>
  24#include <linux/prctl.h>
  25#include <linux/sched.h>
  26#include <linux/sched/task_stack.h>
  27#include <linux/seccomp.h>
  28#include <linux/slab.h>
  29#include <linux/syscalls.h>
  30#include <linux/sysctl.h>
  31
  32#include <asm/syscall.h>
  33
  34/* Not exposed in headers: strictly internal use only. */
  35#define SECCOMP_MODE_DEAD	(SECCOMP_MODE_FILTER + 1)
  36
  37#ifdef CONFIG_SECCOMP_FILTER
  38#include <linux/file.h>
  39#include <linux/filter.h>
  40#include <linux/pid.h>
  41#include <linux/ptrace.h>
  42#include <linux/capability.h>
  43#include <linux/uaccess.h>
  44#include <linux/anon_inodes.h>
  45#include <linux/lockdep.h>
  46
  47/*
  48 * When SECCOMP_IOCTL_NOTIF_ID_VALID was first introduced, it had the
  49 * wrong direction flag in the ioctl number. This is the broken one,
  50 * which the kernel needs to keep supporting until all userspaces stop
  51 * using the wrong command number.
  52 */
  53#define SECCOMP_IOCTL_NOTIF_ID_VALID_WRONG_DIR	SECCOMP_IOR(2, __u64)
  54
  55enum notify_state {
  56	SECCOMP_NOTIFY_INIT,
  57	SECCOMP_NOTIFY_SENT,
  58	SECCOMP_NOTIFY_REPLIED,
  59};
  60
  61struct seccomp_knotif {
  62	/* The struct pid of the task whose filter triggered the notification */
  63	struct task_struct *task;
  64
  65	/* The "cookie" for this request; this is unique for this filter. */
  66	u64 id;
  67
  68	/*
  69	 * The seccomp data. This pointer is valid the entire time this
  70	 * notification is active, since it comes from __seccomp_filter which
  71	 * eclipses the entire lifecycle here.
  72	 */
  73	const struct seccomp_data *data;
  74
  75	/*
  76	 * Notification states. When SECCOMP_RET_USER_NOTIF is returned, a
  77	 * struct seccomp_knotif is created and starts out in INIT. Once the
  78	 * handler reads the notification off of an FD, it transitions to SENT.
  79	 * If a signal is received the state transitions back to INIT and
  80	 * another message is sent. When the userspace handler replies, state
  81	 * transitions to REPLIED.
  82	 */
  83	enum notify_state state;
  84
  85	/* The return values, only valid when in SECCOMP_NOTIFY_REPLIED */
  86	int error;
  87	long val;
  88	u32 flags;
  89
  90	/*
  91	 * Signals when this has changed states, such as the listener
  92	 * dying, a new seccomp addfd message, or changing to REPLIED
  93	 */
  94	struct completion ready;
  95
  96	struct list_head list;
  97
  98	/* outstanding addfd requests */
  99	struct list_head addfd;
 100};
 101
 102/**
 103 * struct seccomp_kaddfd - container for seccomp_addfd ioctl messages
 104 *
 105 * @file: A reference to the file to install in the other task
 106 * @fd: The fd number to install it at. If the fd number is -1, it means the
 107 *      installing process should allocate the fd as normal.
 108 * @flags: The flags for the new file descriptor. At the moment, only O_CLOEXEC
 109 *         is allowed.
 110 * @ioctl_flags: The flags used for the seccomp_addfd ioctl.
 111 * @setfd: whether or not SECCOMP_ADDFD_FLAG_SETFD was set during notify_addfd
 112 * @ret: The return value of the installing process. It is set to the fd num
 113 *       upon success (>= 0).
 114 * @completion: Indicates that the installing process has completed fd
 115 *              installation, or gone away (either due to successful
 116 *              reply, or signal)
 117 * @list: list_head for chaining seccomp_kaddfd together.
 118 *
 119 */
 120struct seccomp_kaddfd {
 121	struct file *file;
 122	int fd;
 123	unsigned int flags;
 124	__u32 ioctl_flags;
 125
 126	union {
 127		bool setfd;
 128		/* To only be set on reply */
 129		int ret;
 130	};
 131	struct completion completion;
 132	struct list_head list;
 133};
 134
 135/**
 136 * struct notification - container for seccomp userspace notifications. Since
 137 * most seccomp filters will not have notification listeners attached and this
 138 * structure is fairly large, we store the notification-specific stuff in a
 139 * separate structure.
 140 *
 141 * @requests: A semaphore that users of this notification can wait on for
 142 *            changes. Actual reads and writes are still controlled with
 143 *            filter->notify_lock.
 144 * @flags: A set of SECCOMP_USER_NOTIF_FD_* flags.
 145 * @next_id: The id of the next request.
 146 * @notifications: A list of struct seccomp_knotif elements.
 147 */
 148
 149struct notification {
 150	atomic_t requests;
 151	u32 flags;
 152	u64 next_id;
 153	struct list_head notifications;
 154};
 155
 156#ifdef SECCOMP_ARCH_NATIVE
 157/**
 158 * struct action_cache - per-filter cache of seccomp actions per
 159 * arch/syscall pair
 160 *
 161 * @allow_native: A bitmap where each bit represents whether the
 162 *		  filter will always allow the syscall, for the
 163 *		  native architecture.
 164 * @allow_compat: A bitmap where each bit represents whether the
 165 *		  filter will always allow the syscall, for the
 166 *		  compat architecture.
 167 */
 168struct action_cache {
 169	DECLARE_BITMAP(allow_native, SECCOMP_ARCH_NATIVE_NR);
 170#ifdef SECCOMP_ARCH_COMPAT
 171	DECLARE_BITMAP(allow_compat, SECCOMP_ARCH_COMPAT_NR);
 172#endif
 173};
 174#else
 175struct action_cache { };
 176
 177static inline bool seccomp_cache_check_allow(const struct seccomp_filter *sfilter,
 178					     const struct seccomp_data *sd)
 179{
 180	return false;
 181}
 182
 183static inline void seccomp_cache_prepare(struct seccomp_filter *sfilter)
 184{
 185}
 186#endif /* SECCOMP_ARCH_NATIVE */
 187
 188/**
 189 * struct seccomp_filter - container for seccomp BPF programs
 190 *
 191 * @refs: Reference count to manage the object lifetime.
 192 *	  A filter's reference count is incremented for each directly
 193 *	  attached task, once for the dependent filter, and if
 194 *	  requested for the user notifier. When @refs reaches zero,
 195 *	  the filter can be freed.
 196 * @users: A filter's @users count is incremented for each directly
 197 *         attached task (filter installation, fork(), thread_sync),
 198 *	   and once for the dependent filter (tracked in filter->prev).
 199 *	   When it reaches zero it indicates that no direct or indirect
 200 *	   users of that filter exist. No new tasks can get associated with
 201 *	   this filter after reaching 0. The @users count is always smaller
 202 *	   or equal to @refs. Hence, reaching 0 for @users does not mean
 203 *	   the filter can be freed.
 204 * @cache: cache of arch/syscall mappings to actions
 205 * @log: true if all actions except for SECCOMP_RET_ALLOW should be logged
 206 * @wait_killable_recv: Put notifying process in killable state once the
 207 *			notification is received by the userspace listener.
 208 * @prev: points to a previously installed, or inherited, filter
 209 * @prog: the BPF program to evaluate
 210 * @notif: the struct that holds all notification related information
 211 * @notify_lock: A lock for all notification-related accesses.
 212 * @wqh: A wait queue for poll if a notifier is in use.
 213 *
 214 * seccomp_filter objects are organized in a tree linked via the @prev
 215 * pointer.  For any task, it appears to be a singly-linked list starting
 216 * with current->seccomp.filter, the most recently attached or inherited filter.
 217 * However, multiple filters may share a @prev node, by way of fork(), which
 218 * results in a unidirectional tree existing in memory.  This is similar to
 219 * how namespaces work.
 220 *
 221 * seccomp_filter objects should never be modified after being attached
 222 * to a task_struct (other than @refs).
 223 */
 224struct seccomp_filter {
 225	refcount_t refs;
 226	refcount_t users;
 227	bool log;
 228	bool wait_killable_recv;
 229	struct action_cache cache;
 230	struct seccomp_filter *prev;
 231	struct bpf_prog *prog;
 232	struct notification *notif;
 233	struct mutex notify_lock;
 234	wait_queue_head_t wqh;
 235};
 236
 237/* Limit any path through the tree to 256KB worth of instructions. */
 238#define MAX_INSNS_PER_PATH ((1 << 18) / sizeof(struct sock_filter))
 239
 240/*
 241 * Endianness is explicitly ignored and left for BPF program authors to manage
 242 * as per the specific architecture.
 243 */
 244static void populate_seccomp_data(struct seccomp_data *sd)
 245{
 246	/*
 247	 * Instead of using current_pt_reg(), we're already doing the work
 248	 * to safely fetch "current", so just use "task" everywhere below.
 249	 */
 250	struct task_struct *task = current;
 251	struct pt_regs *regs = task_pt_regs(task);
 252	unsigned long args[6];
 253
 254	sd->nr = syscall_get_nr(task, regs);
 255	sd->arch = syscall_get_arch(task);
 256	syscall_get_arguments(task, regs, args);
 257	sd->args[0] = args[0];
 258	sd->args[1] = args[1];
 259	sd->args[2] = args[2];
 260	sd->args[3] = args[3];
 261	sd->args[4] = args[4];
 262	sd->args[5] = args[5];
 263	sd->instruction_pointer = KSTK_EIP(task);
 264}
 265
 266/**
 267 *	seccomp_check_filter - verify seccomp filter code
 268 *	@filter: filter to verify
 269 *	@flen: length of filter
 270 *
 271 * Takes a previously checked filter (by bpf_check_classic) and
 272 * redirects all filter code that loads struct sk_buff data
 273 * and related data through seccomp_bpf_load.  It also
 274 * enforces length and alignment checking of those loads.
 275 *
 276 * Returns 0 if the rule set is legal or -EINVAL if not.
 277 */
 278static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen)
 279{
 280	int pc;
 281	for (pc = 0; pc < flen; pc++) {
 282		struct sock_filter *ftest = &filter[pc];
 283		u16 code = ftest->code;
 284		u32 k = ftest->k;
 285
 286		switch (code) {
 287		case BPF_LD | BPF_W | BPF_ABS:
 288			ftest->code = BPF_LDX | BPF_W | BPF_ABS;
 289			/* 32-bit aligned and not out of bounds. */
 290			if (k >= sizeof(struct seccomp_data) || k & 3)
 291				return -EINVAL;
 292			continue;
 293		case BPF_LD | BPF_W | BPF_LEN:
 294			ftest->code = BPF_LD | BPF_IMM;
 295			ftest->k = sizeof(struct seccomp_data);
 296			continue;
 297		case BPF_LDX | BPF_W | BPF_LEN:
 298			ftest->code = BPF_LDX | BPF_IMM;
 299			ftest->k = sizeof(struct seccomp_data);
 300			continue;
 301		/* Explicitly include allowed calls. */
 302		case BPF_RET | BPF_K:
 303		case BPF_RET | BPF_A:
 304		case BPF_ALU | BPF_ADD | BPF_K:
 305		case BPF_ALU | BPF_ADD | BPF_X:
 306		case BPF_ALU | BPF_SUB | BPF_K:
 307		case BPF_ALU | BPF_SUB | BPF_X:
 308		case BPF_ALU | BPF_MUL | BPF_K:
 309		case BPF_ALU | BPF_MUL | BPF_X:
 310		case BPF_ALU | BPF_DIV | BPF_K:
 311		case BPF_ALU | BPF_DIV | BPF_X:
 312		case BPF_ALU | BPF_AND | BPF_K:
 313		case BPF_ALU | BPF_AND | BPF_X:
 314		case BPF_ALU | BPF_OR | BPF_K:
 315		case BPF_ALU | BPF_OR | BPF_X:
 316		case BPF_ALU | BPF_XOR | BPF_K:
 317		case BPF_ALU | BPF_XOR | BPF_X:
 318		case BPF_ALU | BPF_LSH | BPF_K:
 319		case BPF_ALU | BPF_LSH | BPF_X:
 320		case BPF_ALU | BPF_RSH | BPF_K:
 321		case BPF_ALU | BPF_RSH | BPF_X:
 322		case BPF_ALU | BPF_NEG:
 323		case BPF_LD | BPF_IMM:
 324		case BPF_LDX | BPF_IMM:
 325		case BPF_MISC | BPF_TAX:
 326		case BPF_MISC | BPF_TXA:
 327		case BPF_LD | BPF_MEM:
 328		case BPF_LDX | BPF_MEM:
 329		case BPF_ST:
 330		case BPF_STX:
 331		case BPF_JMP | BPF_JA:
 332		case BPF_JMP | BPF_JEQ | BPF_K:
 333		case BPF_JMP | BPF_JEQ | BPF_X:
 334		case BPF_JMP | BPF_JGE | BPF_K:
 335		case BPF_JMP | BPF_JGE | BPF_X:
 336		case BPF_JMP | BPF_JGT | BPF_K:
 337		case BPF_JMP | BPF_JGT | BPF_X:
 338		case BPF_JMP | BPF_JSET | BPF_K:
 339		case BPF_JMP | BPF_JSET | BPF_X:
 340			continue;
 341		default:
 342			return -EINVAL;
 343		}
 344	}
 345	return 0;
 346}
 347
 348#ifdef SECCOMP_ARCH_NATIVE
 349static inline bool seccomp_cache_check_allow_bitmap(const void *bitmap,
 350						    size_t bitmap_size,
 351						    int syscall_nr)
 352{
 353	if (unlikely(syscall_nr < 0 || syscall_nr >= bitmap_size))
 354		return false;
 355	syscall_nr = array_index_nospec(syscall_nr, bitmap_size);
 356
 357	return test_bit(syscall_nr, bitmap);
 358}
 359
 360/**
 361 * seccomp_cache_check_allow - lookup seccomp cache
 362 * @sfilter: The seccomp filter
 363 * @sd: The seccomp data to lookup the cache with
 364 *
 365 * Returns true if the seccomp_data is cached and allowed.
 366 */
 367static inline bool seccomp_cache_check_allow(const struct seccomp_filter *sfilter,
 368					     const struct seccomp_data *sd)
 369{
 370	int syscall_nr = sd->nr;
 371	const struct action_cache *cache = &sfilter->cache;
 372
 373#ifndef SECCOMP_ARCH_COMPAT
 374	/* A native-only architecture doesn't need to check sd->arch. */
 375	return seccomp_cache_check_allow_bitmap(cache->allow_native,
 376						SECCOMP_ARCH_NATIVE_NR,
 377						syscall_nr);
 378#else
 379	if (likely(sd->arch == SECCOMP_ARCH_NATIVE))
 380		return seccomp_cache_check_allow_bitmap(cache->allow_native,
 381							SECCOMP_ARCH_NATIVE_NR,
 382							syscall_nr);
 383	if (likely(sd->arch == SECCOMP_ARCH_COMPAT))
 384		return seccomp_cache_check_allow_bitmap(cache->allow_compat,
 385							SECCOMP_ARCH_COMPAT_NR,
 386							syscall_nr);
 387#endif /* SECCOMP_ARCH_COMPAT */
 388
 389	WARN_ON_ONCE(true);
 390	return false;
 391}
 392#endif /* SECCOMP_ARCH_NATIVE */
 393
 394#define ACTION_ONLY(ret) ((s32)((ret) & (SECCOMP_RET_ACTION_FULL)))
 395/**
 396 * seccomp_run_filters - evaluates all seccomp filters against @sd
 397 * @sd: optional seccomp data to be passed to filters
 398 * @match: stores struct seccomp_filter that resulted in the return value,
 399 *         unless filter returned SECCOMP_RET_ALLOW, in which case it will
 400 *         be unchanged.
 401 *
 402 * Returns valid seccomp BPF response codes.
 403 */
 404static u32 seccomp_run_filters(const struct seccomp_data *sd,
 405			       struct seccomp_filter **match)
 406{
 407	u32 ret = SECCOMP_RET_ALLOW;
 408	/* Make sure cross-thread synced filter points somewhere sane. */
 409	struct seccomp_filter *f =
 410			READ_ONCE(current->seccomp.filter);
 411
 412	/* Ensure unexpected behavior doesn't result in failing open. */
 413	if (WARN_ON(f == NULL))
 414		return SECCOMP_RET_KILL_PROCESS;
 415
 416	if (seccomp_cache_check_allow(f, sd))
 417		return SECCOMP_RET_ALLOW;
 418
 419	/*
 420	 * All filters in the list are evaluated and the lowest BPF return
 421	 * value always takes priority (ignoring the DATA).
 422	 */
 423	for (; f; f = f->prev) {
 424		u32 cur_ret = bpf_prog_run_pin_on_cpu(f->prog, sd);
 425
 426		if (ACTION_ONLY(cur_ret) < ACTION_ONLY(ret)) {
 427			ret = cur_ret;
 428			*match = f;
 429		}
 430	}
 431	return ret;
 432}
 433#endif /* CONFIG_SECCOMP_FILTER */
 434
 435static inline bool seccomp_may_assign_mode(unsigned long seccomp_mode)
 436{
 437	assert_spin_locked(&current->sighand->siglock);
 438
 439	if (current->seccomp.mode && current->seccomp.mode != seccomp_mode)
 440		return false;
 441
 442	return true;
 443}
 444
 445void __weak arch_seccomp_spec_mitigate(struct task_struct *task) { }
 446
 447static inline void seccomp_assign_mode(struct task_struct *task,
 448				       unsigned long seccomp_mode,
 449				       unsigned long flags)
 450{
 451	assert_spin_locked(&task->sighand->siglock);
 452
 453	task->seccomp.mode = seccomp_mode;
 454	/*
 455	 * Make sure SYSCALL_WORK_SECCOMP cannot be set before the mode (and
 456	 * filter) is set.
 457	 */
 458	smp_mb__before_atomic();
 459	/* Assume default seccomp processes want spec flaw mitigation. */
 460	if ((flags & SECCOMP_FILTER_FLAG_SPEC_ALLOW) == 0)
 461		arch_seccomp_spec_mitigate(task);
 462	set_task_syscall_work(task, SECCOMP);
 463}
 464
 465#ifdef CONFIG_SECCOMP_FILTER
 466/* Returns 1 if the parent is an ancestor of the child. */
 467static int is_ancestor(struct seccomp_filter *parent,
 468		       struct seccomp_filter *child)
 469{
 470	/* NULL is the root ancestor. */
 471	if (parent == NULL)
 472		return 1;
 473	for (; child; child = child->prev)
 474		if (child == parent)
 475			return 1;
 476	return 0;
 477}
 478
 479/**
 480 * seccomp_can_sync_threads: checks if all threads can be synchronized
 481 *
 482 * Expects sighand and cred_guard_mutex locks to be held.
 483 *
 484 * Returns 0 on success, -ve on error, or the pid of a thread which was
 485 * either not in the correct seccomp mode or did not have an ancestral
 486 * seccomp filter.
 487 */
 488static inline pid_t seccomp_can_sync_threads(void)
 489{
 490	struct task_struct *thread, *caller;
 491
 492	BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
 493	assert_spin_locked(&current->sighand->siglock);
 494
 495	/* Validate all threads being eligible for synchronization. */
 496	caller = current;
 497	for_each_thread(caller, thread) {
 498		pid_t failed;
 499
 500		/* Skip current, since it is initiating the sync. */
 501		if (thread == caller)
 502			continue;
 503		/* Skip exited threads. */
 504		if (thread->flags & PF_EXITING)
 505			continue;
 506
 507		if (thread->seccomp.mode == SECCOMP_MODE_DISABLED ||
 508		    (thread->seccomp.mode == SECCOMP_MODE_FILTER &&
 509		     is_ancestor(thread->seccomp.filter,
 510				 caller->seccomp.filter)))
 511			continue;
 512
 513		/* Return the first thread that cannot be synchronized. */
 514		failed = task_pid_vnr(thread);
 515		/* If the pid cannot be resolved, then return -ESRCH */
 516		if (WARN_ON(failed == 0))
 517			failed = -ESRCH;
 518		return failed;
 519	}
 520
 521	return 0;
 522}
 523
 524static inline void seccomp_filter_free(struct seccomp_filter *filter)
 525{
 526	if (filter) {
 527		bpf_prog_destroy(filter->prog);
 528		kfree(filter);
 529	}
 530}
 531
 532static void __seccomp_filter_orphan(struct seccomp_filter *orig)
 533{
 534	while (orig && refcount_dec_and_test(&orig->users)) {
 535		if (waitqueue_active(&orig->wqh))
 536			wake_up_poll(&orig->wqh, EPOLLHUP);
 537		orig = orig->prev;
 538	}
 539}
 540
 541static void __put_seccomp_filter(struct seccomp_filter *orig)
 542{
 543	/* Clean up single-reference branches iteratively. */
 544	while (orig && refcount_dec_and_test(&orig->refs)) {
 545		struct seccomp_filter *freeme = orig;
 546		orig = orig->prev;
 547		seccomp_filter_free(freeme);
 548	}
 549}
 550
 551static void __seccomp_filter_release(struct seccomp_filter *orig)
 552{
 553	/* Notify about any unused filters in the task's former filter tree. */
 554	__seccomp_filter_orphan(orig);
 555	/* Finally drop all references to the task's former tree. */
 556	__put_seccomp_filter(orig);
 557}
 558
 559/**
 560 * seccomp_filter_release - Detach the task from its filter tree,
 561 *			    drop its reference count, and notify
 562 *			    about unused filters
 563 *
 564 * @tsk: task the filter should be released from.
 565 *
 566 * This function should only be called when the task is exiting as
 567 * it detaches it from its filter tree. PF_EXITING has to be set
 568 * for the task.
 569 */
 570void seccomp_filter_release(struct task_struct *tsk)
 571{
 572	struct seccomp_filter *orig;
 573
 574	if (WARN_ON((tsk->flags & PF_EXITING) == 0))
 575		return;
 576
 577	if (READ_ONCE(tsk->seccomp.filter) == NULL)
 578		return;
 579
 580	spin_lock_irq(&tsk->sighand->siglock);
 581	orig = tsk->seccomp.filter;
 582	/* Detach task from its filter tree. */
 583	tsk->seccomp.filter = NULL;
 584	spin_unlock_irq(&tsk->sighand->siglock);
 585	__seccomp_filter_release(orig);
 586}
 587
 588/**
 589 * seccomp_sync_threads: sets all threads to use current's filter
 590 *
 591 * @flags: SECCOMP_FILTER_FLAG_* flags to set during sync.
 592 *
 593 * Expects sighand and cred_guard_mutex locks to be held, and for
 594 * seccomp_can_sync_threads() to have returned success already
 595 * without dropping the locks.
 596 *
 597 */
 598static inline void seccomp_sync_threads(unsigned long flags)
 599{
 600	struct task_struct *thread, *caller;
 601
 602	BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
 603	assert_spin_locked(&current->sighand->siglock);
 604
 605	/*
 606	 * Don't touch any of the threads if the process is being killed.
 607	 * This allows for a lockless check in seccomp_filter_release.
 608	 */
 609	if (current->signal->flags & SIGNAL_GROUP_EXIT)
 610		return;
 611
 612	/* Synchronize all threads. */
 613	caller = current;
 614	for_each_thread(caller, thread) {
 615		/* Skip current, since it needs no changes. */
 616		if (thread == caller)
 617			continue;
 618
 619		/*
 620		 * Skip exited threads. seccomp_filter_release could have
 621		 * been already called for this task.
 622		 */
 623		if (thread->flags & PF_EXITING)
 624			continue;
 625
 626		/* Get a task reference for the new leaf node. */
 627		get_seccomp_filter(caller);
 628
 629		/*
 630		 * Drop the task reference to the shared ancestor since
 631		 * current's path will hold a reference.  (This also
 632		 * allows a put before the assignment.)
 633		 */
 634		__seccomp_filter_release(thread->seccomp.filter);
 635
 636		/* Make our new filter tree visible. */
 637		smp_store_release(&thread->seccomp.filter,
 638				  caller->seccomp.filter);
 639		atomic_set(&thread->seccomp.filter_count,
 640			   atomic_read(&caller->seccomp.filter_count));
 641
 642		/*
 643		 * Don't let an unprivileged task work around
 644		 * the no_new_privs restriction by creating
 645		 * a thread that sets it up, enters seccomp,
 646		 * then dies.
 647		 */
 648		if (task_no_new_privs(caller))
 649			task_set_no_new_privs(thread);
 650
 651		/*
 652		 * Opt the other thread into seccomp if needed.
 653		 * As threads are considered to be trust-realm
 654		 * equivalent (see ptrace_may_access), it is safe to
 655		 * allow one thread to transition the other.
 656		 */
 657		if (thread->seccomp.mode == SECCOMP_MODE_DISABLED)
 658			seccomp_assign_mode(thread, SECCOMP_MODE_FILTER,
 659					    flags);
 660	}
 661}
 662
 663/**
 664 * seccomp_prepare_filter: Prepares a seccomp filter for use.
 665 * @fprog: BPF program to install
 666 *
 667 * Returns filter on success or an ERR_PTR on failure.
 668 */
 669static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog)
 670{
 671	struct seccomp_filter *sfilter;
 672	int ret;
 673	const bool save_orig =
 674#if defined(CONFIG_CHECKPOINT_RESTORE) || defined(SECCOMP_ARCH_NATIVE)
 675		true;
 676#else
 677		false;
 678#endif
 679
 680	if (fprog->len == 0 || fprog->len > BPF_MAXINSNS)
 681		return ERR_PTR(-EINVAL);
 682
 683	BUG_ON(INT_MAX / fprog->len < sizeof(struct sock_filter));
 684
 685	/*
 686	 * Installing a seccomp filter requires that the task has
 687	 * CAP_SYS_ADMIN in its namespace or be running with no_new_privs.
 688	 * This avoids scenarios where unprivileged tasks can affect the
 689	 * behavior of privileged children.
 690	 */
 691	if (!task_no_new_privs(current) &&
 692			!ns_capable_noaudit(current_user_ns(), CAP_SYS_ADMIN))
 693		return ERR_PTR(-EACCES);
 694
 695	/* Allocate a new seccomp_filter */
 696	sfilter = kzalloc(sizeof(*sfilter), GFP_KERNEL | __GFP_NOWARN);
 697	if (!sfilter)
 698		return ERR_PTR(-ENOMEM);
 699
 700	mutex_init(&sfilter->notify_lock);
 701	ret = bpf_prog_create_from_user(&sfilter->prog, fprog,
 702					seccomp_check_filter, save_orig);
 703	if (ret < 0) {
 704		kfree(sfilter);
 705		return ERR_PTR(ret);
 706	}
 707
 708	refcount_set(&sfilter->refs, 1);
 709	refcount_set(&sfilter->users, 1);
 710	init_waitqueue_head(&sfilter->wqh);
 711
 712	return sfilter;
 713}
 714
 715/**
 716 * seccomp_prepare_user_filter - prepares a user-supplied sock_fprog
 717 * @user_filter: pointer to the user data containing a sock_fprog.
 718 *
 719 * Returns 0 on success and non-zero otherwise.
 720 */
 721static struct seccomp_filter *
 722seccomp_prepare_user_filter(const char __user *user_filter)
 723{
 724	struct sock_fprog fprog;
 725	struct seccomp_filter *filter = ERR_PTR(-EFAULT);
 726
 727#ifdef CONFIG_COMPAT
 728	if (in_compat_syscall()) {
 729		struct compat_sock_fprog fprog32;
 730		if (copy_from_user(&fprog32, user_filter, sizeof(fprog32)))
 731			goto out;
 732		fprog.len = fprog32.len;
 733		fprog.filter = compat_ptr(fprog32.filter);
 734	} else /* falls through to the if below. */
 735#endif
 736	if (copy_from_user(&fprog, user_filter, sizeof(fprog)))
 737		goto out;
 738	filter = seccomp_prepare_filter(&fprog);
 739out:
 740	return filter;
 741}
 742
 743#ifdef SECCOMP_ARCH_NATIVE
 744static bool seccomp_uprobe_exception(struct seccomp_data *sd)
 745{
 746#if defined __NR_uretprobe || defined __NR_uprobe
 747#ifdef SECCOMP_ARCH_COMPAT
 748	if (sd->arch == SECCOMP_ARCH_NATIVE)
 749#endif
 750	{
 751#ifdef __NR_uretprobe
 752		if (sd->nr == __NR_uretprobe)
 753			return true;
 754#endif
 755#ifdef __NR_uprobe
 756		if (sd->nr == __NR_uprobe)
 757			return true;
 758#endif
 759	}
 760#endif
 761	return false;
 762}
 763
 764/**
 765 * seccomp_is_const_allow - check if filter is constant allow with given data
 766 * @fprog: The BPF programs
 767 * @sd: The seccomp data to check against, only syscall number and arch
 768 *      number are considered constant.
 769 */
 770static bool seccomp_is_const_allow(struct sock_fprog_kern *fprog,
 771				   struct seccomp_data *sd)
 772{
 773	unsigned int reg_value = 0;
 774	unsigned int pc;
 775	bool op_res;
 776
 777	if (WARN_ON_ONCE(!fprog))
 778		return false;
 779
 780	/* Our single exception to filtering. */
 781	if (seccomp_uprobe_exception(sd))
 782		return true;
 783
 784	for (pc = 0; pc < fprog->len; pc++) {
 785		struct sock_filter *insn = &fprog->filter[pc];
 786		u16 code = insn->code;
 787		u32 k = insn->k;
 788
 789		switch (code) {
 790		case BPF_LD | BPF_W | BPF_ABS:
 791			switch (k) {
 792			case offsetof(struct seccomp_data, nr):
 793				reg_value = sd->nr;
 794				break;
 795			case offsetof(struct seccomp_data, arch):
 796				reg_value = sd->arch;
 797				break;
 798			default:
 799				/* can't optimize (non-constant value load) */
 800				return false;
 801			}
 802			break;
 803		case BPF_RET | BPF_K:
 804			/* reached return with constant values only, check allow */
 805			return k == SECCOMP_RET_ALLOW;
 806		case BPF_JMP | BPF_JA:
 807			pc += insn->k;
 808			break;
 809		case BPF_JMP | BPF_JEQ | BPF_K:
 810		case BPF_JMP | BPF_JGE | BPF_K:
 811		case BPF_JMP | BPF_JGT | BPF_K:
 812		case BPF_JMP | BPF_JSET | BPF_K:
 813			switch (BPF_OP(code)) {
 814			case BPF_JEQ:
 815				op_res = reg_value == k;
 816				break;
 817			case BPF_JGE:
 818				op_res = reg_value >= k;
 819				break;
 820			case BPF_JGT:
 821				op_res = reg_value > k;
 822				break;
 823			case BPF_JSET:
 824				op_res = !!(reg_value & k);
 825				break;
 826			default:
 827				/* can't optimize (unknown jump) */
 828				return false;
 829			}
 830
 831			pc += op_res ? insn->jt : insn->jf;
 832			break;
 833		case BPF_ALU | BPF_AND | BPF_K:
 834			reg_value &= k;
 835			break;
 836		default:
 837			/* can't optimize (unknown insn) */
 838			return false;
 839		}
 840	}
 841
 842	/* ran off the end of the filter?! */
 843	WARN_ON(1);
 844	return false;
 845}
 846
 847static void seccomp_cache_prepare_bitmap(struct seccomp_filter *sfilter,
 848					 void *bitmap, const void *bitmap_prev,
 849					 size_t bitmap_size, int arch)
 850{
 851	struct sock_fprog_kern *fprog = sfilter->prog->orig_prog;
 852	struct seccomp_data sd;
 853	int nr;
 854
 855	if (bitmap_prev) {
 856		/* The new filter must be as restrictive as the last. */
 857		bitmap_copy(bitmap, bitmap_prev, bitmap_size);
 858	} else {
 859		/* Before any filters, all syscalls are always allowed. */
 860		bitmap_fill(bitmap, bitmap_size);
 861	}
 862
 863	for (nr = 0; nr < bitmap_size; nr++) {
 864		/* No bitmap change: not a cacheable action. */
 865		if (!test_bit(nr, bitmap))
 866			continue;
 867
 868		sd.nr = nr;
 869		sd.arch = arch;
 870
 871		/* No bitmap change: continue to always allow. */
 872		if (seccomp_is_const_allow(fprog, &sd))
 873			continue;
 874
 875		/*
 876		 * Not a cacheable action: always run filters.
 877		 * atomic clear_bit() not needed, filter not visible yet.
 878		 */
 879		__clear_bit(nr, bitmap);
 880	}
 881}
 882
 883/**
 884 * seccomp_cache_prepare - emulate the filter to find cacheable syscalls
 885 * @sfilter: The seccomp filter
 886 *
 887 * Returns 0 if successful or -errno if error occurred.
 888 */
 889static void seccomp_cache_prepare(struct seccomp_filter *sfilter)
 890{
 891	struct action_cache *cache = &sfilter->cache;
 892	const struct action_cache *cache_prev =
 893		sfilter->prev ? &sfilter->prev->cache : NULL;
 894
 895	seccomp_cache_prepare_bitmap(sfilter, cache->allow_native,
 896				     cache_prev ? cache_prev->allow_native : NULL,
 897				     SECCOMP_ARCH_NATIVE_NR,
 898				     SECCOMP_ARCH_NATIVE);
 899
 900#ifdef SECCOMP_ARCH_COMPAT
 901	seccomp_cache_prepare_bitmap(sfilter, cache->allow_compat,
 902				     cache_prev ? cache_prev->allow_compat : NULL,
 903				     SECCOMP_ARCH_COMPAT_NR,
 904				     SECCOMP_ARCH_COMPAT);
 905#endif /* SECCOMP_ARCH_COMPAT */
 906}
 907#endif /* SECCOMP_ARCH_NATIVE */
 908
 909/**
 910 * seccomp_attach_filter: validate and attach filter
 911 * @flags:  flags to change filter behavior
 912 * @filter: seccomp filter to add to the current process
 913 *
 914 * Caller must be holding current->sighand->siglock lock.
 915 *
 916 * Returns 0 on success, -ve on error, or
 917 *   - in TSYNC mode: the pid of a thread which was either not in the correct
 918 *     seccomp mode or did not have an ancestral seccomp filter
 919 *   - in NEW_LISTENER mode: the fd of the new listener
 920 */
 921static long seccomp_attach_filter(unsigned int flags,
 922				  struct seccomp_filter *filter)
 923{
 924	unsigned long total_insns;
 925	struct seccomp_filter *walker;
 926
 927	assert_spin_locked(&current->sighand->siglock);
 928
 929	/* Validate resulting filter length. */
 930	total_insns = filter->prog->len;
 931	for (walker = current->seccomp.filter; walker; walker = walker->prev)
 932		total_insns += walker->prog->len + 4;  /* 4 instr penalty */
 933	if (total_insns > MAX_INSNS_PER_PATH)
 934		return -ENOMEM;
 935
 936	/* If thread sync has been requested, check that it is possible. */
 937	if (flags & SECCOMP_FILTER_FLAG_TSYNC) {
 938		int ret;
 939
 940		ret = seccomp_can_sync_threads();
 941		if (ret) {
 942			if (flags & SECCOMP_FILTER_FLAG_TSYNC_ESRCH)
 943				return -ESRCH;
 944			else
 945				return ret;
 946		}
 947	}
 948
 949	/* Set log flag, if present. */
 950	if (flags & SECCOMP_FILTER_FLAG_LOG)
 951		filter->log = true;
 952
 953	/* Set wait killable flag, if present. */
 954	if (flags & SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV)
 955		filter->wait_killable_recv = true;
 956
 957	/*
 958	 * If there is an existing filter, make it the prev and don't drop its
 959	 * task reference.
 960	 */
 961	filter->prev = current->seccomp.filter;
 962	seccomp_cache_prepare(filter);
 963	current->seccomp.filter = filter;
 964	atomic_inc(&current->seccomp.filter_count);
 965
 966	/* Now that the new filter is in place, synchronize to all threads. */
 967	if (flags & SECCOMP_FILTER_FLAG_TSYNC)
 968		seccomp_sync_threads(flags);
 969
 970	return 0;
 971}
 972
 973static void __get_seccomp_filter(struct seccomp_filter *filter)
 974{
 975	refcount_inc(&filter->refs);
 976}
 977
 978/* get_seccomp_filter - increments the reference count of the filter on @tsk */
 979void get_seccomp_filter(struct task_struct *tsk)
 980{
 981	struct seccomp_filter *orig = tsk->seccomp.filter;
 982	if (!orig)
 983		return;
 984	__get_seccomp_filter(orig);
 985	refcount_inc(&orig->users);
 986}
 987
 988#endif	/* CONFIG_SECCOMP_FILTER */
 989
 990/* For use with seccomp_actions_logged */
 991#define SECCOMP_LOG_KILL_PROCESS	(1 << 0)
 992#define SECCOMP_LOG_KILL_THREAD		(1 << 1)
 993#define SECCOMP_LOG_TRAP		(1 << 2)
 994#define SECCOMP_LOG_ERRNO		(1 << 3)
 995#define SECCOMP_LOG_TRACE		(1 << 4)
 996#define SECCOMP_LOG_LOG			(1 << 5)
 997#define SECCOMP_LOG_ALLOW		(1 << 6)
 998#define SECCOMP_LOG_USER_NOTIF		(1 << 7)
 999
1000static u32 seccomp_actions_logged = SECCOMP_LOG_KILL_PROCESS |
1001				    SECCOMP_LOG_KILL_THREAD  |
1002				    SECCOMP_LOG_TRAP  |
1003				    SECCOMP_LOG_ERRNO |
1004				    SECCOMP_LOG_USER_NOTIF |
1005				    SECCOMP_LOG_TRACE |
1006				    SECCOMP_LOG_LOG;
1007
1008static inline void seccomp_log(unsigned long syscall, long signr, u32 action,
1009			       bool requested)
1010{
1011	bool log = false;
1012
1013	switch (action) {
1014	case SECCOMP_RET_ALLOW:
1015		break;
1016	case SECCOMP_RET_TRAP:
1017		log = requested && seccomp_actions_logged & SECCOMP_LOG_TRAP;
1018		break;
1019	case SECCOMP_RET_ERRNO:
1020		log = requested && seccomp_actions_logged & SECCOMP_LOG_ERRNO;
1021		break;
1022	case SECCOMP_RET_TRACE:
1023		log = requested && seccomp_actions_logged & SECCOMP_LOG_TRACE;
1024		break;
1025	case SECCOMP_RET_USER_NOTIF:
1026		log = requested && seccomp_actions_logged & SECCOMP_LOG_USER_NOTIF;
1027		break;
1028	case SECCOMP_RET_LOG:
1029		log = seccomp_actions_logged & SECCOMP_LOG_LOG;
1030		break;
1031	case SECCOMP_RET_KILL_THREAD:
1032		log = seccomp_actions_logged & SECCOMP_LOG_KILL_THREAD;
1033		break;
1034	case SECCOMP_RET_KILL_PROCESS:
1035	default:
1036		log = seccomp_actions_logged & SECCOMP_LOG_KILL_PROCESS;
1037	}
1038
1039	/*
1040	 * Emit an audit message when the action is RET_KILL_*, RET_LOG, or the
1041	 * FILTER_FLAG_LOG bit was set. The admin has the ability to silence
1042	 * any action from being logged by removing the action name from the
1043	 * seccomp_actions_logged sysctl.
1044	 */
1045	if (!log)
1046		return;
1047
1048	audit_seccomp(syscall, signr, action);
1049}
1050
1051/*
1052 * Secure computing mode 1 allows only read/write/exit/sigreturn.
1053 * To be fully secure this must be combined with rlimit
1054 * to limit the stack allocations too.
1055 */
1056static const int mode1_syscalls[] = {
1057	__NR_seccomp_read, __NR_seccomp_write, __NR_seccomp_exit, __NR_seccomp_sigreturn,
1058#ifdef __NR_uretprobe
1059	__NR_uretprobe,
1060#endif
1061#ifdef __NR_uprobe
1062	__NR_uprobe,
1063#endif
1064	-1, /* negative terminated */
1065};
1066
1067static void __secure_computing_strict(int this_syscall)
1068{
1069	const int *allowed_syscalls = mode1_syscalls;
1070#ifdef CONFIG_COMPAT
1071	if (in_compat_syscall())
1072		allowed_syscalls = get_compat_mode1_syscalls();
1073#endif
1074	do {
1075		if (*allowed_syscalls == this_syscall)
1076			return;
1077	} while (*++allowed_syscalls != -1);
1078
1079#ifdef SECCOMP_DEBUG
1080	dump_stack();
1081#endif
1082	current->seccomp.mode = SECCOMP_MODE_DEAD;
1083	seccomp_log(this_syscall, SIGKILL, SECCOMP_RET_KILL_THREAD, true);
1084	do_exit(SIGKILL);
1085}
1086
1087#ifndef CONFIG_HAVE_ARCH_SECCOMP_FILTER
1088void secure_computing_strict(int this_syscall)
1089{
1090	int mode = current->seccomp.mode;
1091
1092	if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) &&
1093	    unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
1094		return;
1095
1096	if (mode == SECCOMP_MODE_DISABLED)
1097		return;
1098	else if (mode == SECCOMP_MODE_STRICT)
1099		__secure_computing_strict(this_syscall);
1100	else
1101		BUG();
1102}
1103int __secure_computing(void)
1104{
1105	int this_syscall = syscall_get_nr(current, current_pt_regs());
1106
1107	secure_computing_strict(this_syscall);
1108	return 0;
1109}
1110#else
1111
1112#ifdef CONFIG_SECCOMP_FILTER
1113static u64 seccomp_next_notify_id(struct seccomp_filter *filter)
1114{
1115	/*
1116	 * Note: overflow is ok here, the id just needs to be unique per
1117	 * filter.
1118	 */
1119	lockdep_assert_held(&filter->notify_lock);
1120	return filter->notif->next_id++;
1121}
1122
1123static void seccomp_handle_addfd(struct seccomp_kaddfd *addfd, struct seccomp_knotif *n)
1124{
1125	int fd;
1126
1127	/*
1128	 * Remove the notification, and reset the list pointers, indicating
1129	 * that it has been handled.
1130	 */
1131	list_del_init(&addfd->list);
1132	if (!addfd->setfd)
1133		fd = receive_fd(addfd->file, NULL, addfd->flags);
1134	else
1135		fd = receive_fd_replace(addfd->fd, addfd->file, addfd->flags);
1136	addfd->ret = fd;
1137
1138	if (addfd->ioctl_flags & SECCOMP_ADDFD_FLAG_SEND) {
1139		/* If we fail reset and return an error to the notifier */
1140		if (fd < 0) {
1141			n->state = SECCOMP_NOTIFY_SENT;
1142		} else {
1143			/* Return the FD we just added */
1144			n->flags = 0;
1145			n->error = 0;
1146			n->val = fd;
1147		}
1148	}
1149
1150	/*
1151	 * Mark the notification as completed. From this point, addfd mem
1152	 * might be invalidated and we can't safely read it anymore.
1153	 */
1154	complete(&addfd->completion);
1155}
1156
1157static bool should_sleep_killable(struct seccomp_filter *match,
1158				  struct seccomp_knotif *n)
1159{
1160	return match->wait_killable_recv && n->state >= SECCOMP_NOTIFY_SENT;
1161}
1162
1163static int seccomp_do_user_notification(int this_syscall,
1164					struct seccomp_filter *match,
1165					const struct seccomp_data *sd)
1166{
1167	int err;
1168	u32 flags = 0;
1169	long ret = 0;
1170	struct seccomp_knotif n = {};
1171	struct seccomp_kaddfd *addfd, *tmp;
1172
1173	mutex_lock(&match->notify_lock);
1174	err = -ENOSYS;
1175	if (!match->notif)
1176		goto out;
1177
1178	n.task = current;
1179	n.state = SECCOMP_NOTIFY_INIT;
1180	n.data = sd;
1181	n.id = seccomp_next_notify_id(match);
1182	init_completion(&n.ready);
1183	list_add_tail(&n.list, &match->notif->notifications);
1184	INIT_LIST_HEAD(&n.addfd);
1185
1186	atomic_inc(&match->notif->requests);
1187	if (match->notif->flags & SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP)
1188		wake_up_poll_on_current_cpu(&match->wqh, EPOLLIN | EPOLLRDNORM);
1189	else
1190		wake_up_poll(&match->wqh, EPOLLIN | EPOLLRDNORM);
1191
1192	/*
1193	 * This is where we wait for a reply from userspace.
1194	 */
1195	do {
1196		bool wait_killable = should_sleep_killable(match, &n);
1197
1198		mutex_unlock(&match->notify_lock);
1199		if (wait_killable)
1200			err = wait_for_completion_killable(&n.ready);
1201		else
1202			err = wait_for_completion_interruptible(&n.ready);
1203		mutex_lock(&match->notify_lock);
1204
1205		if (err != 0) {
1206			/*
1207			 * Check to see whether we should switch to wait
1208			 * killable. Only return the interrupted error if not.
1209			 */
1210			if (!(!wait_killable && should_sleep_killable(match, &n)))
1211				goto interrupted;
1212		}
1213
1214		addfd = list_first_entry_or_null(&n.addfd,
1215						 struct seccomp_kaddfd, list);
1216		/* Check if we were woken up by a addfd message */
1217		if (addfd)
1218			seccomp_handle_addfd(addfd, &n);
1219
1220	}  while (n.state != SECCOMP_NOTIFY_REPLIED);
1221
1222	ret = n.val;
1223	err = n.error;
1224	flags = n.flags;
1225
1226interrupted:
1227	/* If there were any pending addfd calls, clear them out */
1228	list_for_each_entry_safe(addfd, tmp, &n.addfd, list) {
1229		/* The process went away before we got a chance to handle it */
1230		addfd->ret = -ESRCH;
1231		list_del_init(&addfd->list);
1232		complete(&addfd->completion);
1233	}
1234
1235	/*
1236	 * Note that it's possible the listener died in between the time when
1237	 * we were notified of a response (or a signal) and when we were able to
1238	 * re-acquire the lock, so only delete from the list if the
1239	 * notification actually exists.
1240	 *
1241	 * Also note that this test is only valid because there's no way to
1242	 * *reattach* to a notifier right now. If one is added, we'll need to
1243	 * keep track of the notif itself and make sure they match here.
1244	 */
1245	if (match->notif)
1246		list_del(&n.list);
1247out:
1248	mutex_unlock(&match->notify_lock);
1249
1250	/* Userspace requests to continue the syscall. */
1251	if (flags & SECCOMP_USER_NOTIF_FLAG_CONTINUE)
1252		return 0;
1253
1254	syscall_set_return_value(current, current_pt_regs(),
1255				 err, ret);
1256	return -1;
1257}
1258
1259static int __seccomp_filter(int this_syscall, const bool recheck_after_trace)
1260{
1261	u32 filter_ret, action;
1262	struct seccomp_data sd;
1263	struct seccomp_filter *match = NULL;
1264	int data;
1265
1266	/*
1267	 * Make sure that any changes to mode from another thread have
1268	 * been seen after SYSCALL_WORK_SECCOMP was seen.
1269	 */
1270	smp_rmb();
1271
1272	populate_seccomp_data(&sd);
1273
1274	filter_ret = seccomp_run_filters(&sd, &match);
1275	data = filter_ret & SECCOMP_RET_DATA;
1276	action = filter_ret & SECCOMP_RET_ACTION_FULL;
1277
1278	switch (action) {
1279	case SECCOMP_RET_ERRNO:
1280		/* Set low-order bits as an errno, capped at MAX_ERRNO. */
1281		if (data > MAX_ERRNO)
1282			data = MAX_ERRNO;
1283		syscall_set_return_value(current, current_pt_regs(),
1284					 -data, 0);
1285		goto skip;
1286
1287	case SECCOMP_RET_TRAP:
1288		/* Show the handler the original registers. */
1289		syscall_rollback(current, current_pt_regs());
1290		/* Let the filter pass back 16 bits of data. */
1291		force_sig_seccomp(this_syscall, data, false);
1292		goto skip;
1293
1294	case SECCOMP_RET_TRACE:
1295		/* We've been put in this state by the ptracer already. */
1296		if (recheck_after_trace)
1297			return 0;
1298
1299		/* ENOSYS these calls if there is no tracer attached. */
1300		if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP)) {
1301			syscall_set_return_value(current,
1302						 current_pt_regs(),
1303						 -ENOSYS, 0);
1304			goto skip;
1305		}
1306
1307		/* Allow the BPF to provide the event message */
1308		ptrace_event(PTRACE_EVENT_SECCOMP, data);
1309		/*
1310		 * The delivery of a fatal signal during event
1311		 * notification may silently skip tracer notification,
1312		 * which could leave us with a potentially unmodified
1313		 * syscall that the tracer would have liked to have
1314		 * changed. Since the process is about to die, we just
1315		 * force the syscall to be skipped and let the signal
1316		 * kill the process and correctly handle any tracer exit
1317		 * notifications.
1318		 */
1319		if (fatal_signal_pending(current))
1320			goto skip;
1321		/* Check if the tracer forced the syscall to be skipped. */
1322		this_syscall = syscall_get_nr(current, current_pt_regs());
1323		if (this_syscall < 0)
1324			goto skip;
1325
1326		/*
1327		 * Recheck the syscall, since it may have changed. This
1328		 * intentionally uses a NULL struct seccomp_data to force
1329		 * a reload of all registers. This does not goto skip since
1330		 * a skip would have already been reported.
1331		 */
1332		if (__seccomp_filter(this_syscall, true))
1333			return -1;
1334
1335		return 0;
1336
1337	case SECCOMP_RET_USER_NOTIF:
1338		if (seccomp_do_user_notification(this_syscall, match, &sd))
1339			goto skip;
1340
1341		return 0;
1342
1343	case SECCOMP_RET_LOG:
1344		seccomp_log(this_syscall, 0, action, true);
1345		return 0;
1346
1347	case SECCOMP_RET_ALLOW:
1348		/*
1349		 * Note that the "match" filter will always be NULL for
1350		 * this action since SECCOMP_RET_ALLOW is the starting
1351		 * state in seccomp_run_filters().
1352		 */
1353		return 0;
1354
1355	case SECCOMP_RET_KILL_THREAD:
1356	case SECCOMP_RET_KILL_PROCESS:
1357	default:
1358		current->seccomp.mode = SECCOMP_MODE_DEAD;
1359		seccomp_log(this_syscall, SIGSYS, action, true);
1360		/* Dump core only if this is the last remaining thread. */
1361		if (action != SECCOMP_RET_KILL_THREAD ||
1362		    (atomic_read(&current->signal->live) == 1)) {
1363			/* Show the original registers in the dump. */
1364			syscall_rollback(current, current_pt_regs());
1365			/* Trigger a coredump with SIGSYS */
1366			force_sig_seccomp(this_syscall, data, true);
1367		} else {
1368			do_exit(SIGSYS);
1369		}
1370		return -1; /* skip the syscall go directly to signal handling */
1371	}
1372
1373	unreachable();
1374
1375skip:
1376	seccomp_log(this_syscall, 0, action, match ? match->log : false);
1377	return -1;
1378}
1379#else
1380static int __seccomp_filter(int this_syscall, const bool recheck_after_trace)
1381{
1382	BUG();
1383
1384	return -1;
1385}
1386#endif
1387
1388int __secure_computing(void)
1389{
1390	int mode = current->seccomp.mode;
1391	int this_syscall;
1392
1393	if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) &&
1394	    unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
1395		return 0;
1396
1397	this_syscall = syscall_get_nr(current, current_pt_regs());
1398
1399	switch (mode) {
1400	case SECCOMP_MODE_STRICT:
1401		__secure_computing_strict(this_syscall);  /* may call do_exit */
1402		return 0;
1403	case SECCOMP_MODE_FILTER:
1404		return __seccomp_filter(this_syscall, false);
1405	/* Surviving SECCOMP_RET_KILL_* must be proactively impossible. */
1406	case SECCOMP_MODE_DEAD:
1407		WARN_ON_ONCE(1);
1408		do_exit(SIGKILL);
1409		return -1;
1410	default:
1411		BUG();
1412	}
1413}
1414#endif /* CONFIG_HAVE_ARCH_SECCOMP_FILTER */
1415
1416long prctl_get_seccomp(void)
1417{
1418	return current->seccomp.mode;
1419}
1420
1421/**
1422 * seccomp_set_mode_strict: internal function for setting strict seccomp
1423 *
1424 * Once current->seccomp.mode is non-zero, it may not be changed.
1425 *
1426 * Returns 0 on success or -EINVAL on failure.
1427 */
1428static long seccomp_set_mode_strict(void)
1429{
1430	const unsigned long seccomp_mode = SECCOMP_MODE_STRICT;
1431	long ret = -EINVAL;
1432
1433	spin_lock_irq(&current->sighand->siglock);
1434
1435	if (!seccomp_may_assign_mode(seccomp_mode))
1436		goto out;
1437
1438#ifdef TIF_NOTSC
1439	disable_TSC();
1440#endif
1441	seccomp_assign_mode(current, seccomp_mode, 0);
1442	ret = 0;
1443
1444out:
1445	spin_unlock_irq(&current->sighand->siglock);
1446
1447	return ret;
1448}
1449
1450#ifdef CONFIG_SECCOMP_FILTER
1451static void seccomp_notify_free(struct seccomp_filter *filter)
1452{
1453	kfree(filter->notif);
1454	filter->notif = NULL;
1455}
1456
1457static void seccomp_notify_detach(struct seccomp_filter *filter)
1458{
1459	struct seccomp_knotif *knotif;
1460
1461	if (!filter)
1462		return;
1463
1464	mutex_lock(&filter->notify_lock);
1465
1466	/*
1467	 * If this file is being closed because e.g. the task who owned it
1468	 * died, let's wake everyone up who was waiting on us.
1469	 */
1470	list_for_each_entry(knotif, &filter->notif->notifications, list) {
1471		if (knotif->state == SECCOMP_NOTIFY_REPLIED)
1472			continue;
1473
1474		knotif->state = SECCOMP_NOTIFY_REPLIED;
1475		knotif->error = -ENOSYS;
1476		knotif->val = 0;
1477
1478		/*
1479		 * We do not need to wake up any pending addfd messages, as
1480		 * the notifier will do that for us, as this just looks
1481		 * like a standard reply.
1482		 */
1483		complete(&knotif->ready);
1484	}
1485
1486	seccomp_notify_free(filter);
1487	mutex_unlock(&filter->notify_lock);
1488}
1489
1490static int seccomp_notify_release(struct inode *inode, struct file *file)
1491{
1492	struct seccomp_filter *filter = file->private_data;
1493
1494	seccomp_notify_detach(filter);
1495	__put_seccomp_filter(filter);
1496	return 0;
1497}
1498
1499/* must be called with notif_lock held */
1500static inline struct seccomp_knotif *
1501find_notification(struct seccomp_filter *filter, u64 id)
1502{
1503	struct seccomp_knotif *cur;
1504
1505	lockdep_assert_held(&filter->notify_lock);
1506
1507	list_for_each_entry(cur, &filter->notif->notifications, list) {
1508		if (cur->id == id)
1509			return cur;
1510	}
1511
1512	return NULL;
1513}
1514
1515static int recv_wake_function(wait_queue_entry_t *wait, unsigned int mode, int sync,
1516				  void *key)
1517{
1518	/* Avoid a wakeup if event not interesting for us. */
1519	if (key && !(key_to_poll(key) & (EPOLLIN | EPOLLERR | EPOLLHUP)))
1520		return 0;
1521	return autoremove_wake_function(wait, mode, sync, key);
1522}
1523
1524static int recv_wait_event(struct seccomp_filter *filter)
1525{
1526	DEFINE_WAIT_FUNC(wait, recv_wake_function);
1527	int ret;
1528
1529	if (refcount_read(&filter->users) == 0)
1530		return 0;
1531
1532	if (atomic_dec_if_positive(&filter->notif->requests) >= 0)
1533		return 0;
1534
1535	for (;;) {
1536		ret = prepare_to_wait_event(&filter->wqh, &wait, TASK_INTERRUPTIBLE);
1537
1538		if (atomic_dec_if_positive(&filter->notif->requests) >= 0)
1539			break;
1540		if (refcount_read(&filter->users) == 0)
1541			break;
1542
1543		if (ret)
1544			return ret;
1545
1546		schedule();
1547	}
1548	finish_wait(&filter->wqh, &wait);
1549	return 0;
1550}
1551
1552static long seccomp_notify_recv(struct seccomp_filter *filter,
1553				void __user *buf)
1554{
1555	struct seccomp_knotif *knotif = NULL, *cur;
1556	struct seccomp_notif unotif;
1557	ssize_t ret;
1558
1559	/* Verify that we're not given garbage to keep struct extensible. */
1560	ret = check_zeroed_user(buf, sizeof(unotif));
1561	if (ret < 0)
1562		return ret;
1563	if (!ret)
1564		return -EINVAL;
1565
1566	memset(&unotif, 0, sizeof(unotif));
1567
1568	ret = recv_wait_event(filter);
1569	if (ret < 0)
1570		return ret;
1571
1572	mutex_lock(&filter->notify_lock);
1573	list_for_each_entry(cur, &filter->notif->notifications, list) {
1574		if (cur->state == SECCOMP_NOTIFY_INIT) {
1575			knotif = cur;
1576			break;
1577		}
1578	}
1579
1580	/*
1581	 * If we didn't find a notification, it could be that the task was
1582	 * interrupted by a fatal signal between the time we were woken and
1583	 * when we were able to acquire the rw lock.
1584	 */
1585	if (!knotif) {
1586		ret = -ENOENT;
1587		goto out;
1588	}
1589
1590	unotif.id = knotif->id;
1591	unotif.pid = task_pid_vnr(knotif->task);
1592	unotif.data = *(knotif->data);
1593
1594	knotif->state = SECCOMP_NOTIFY_SENT;
1595	wake_up_poll(&filter->wqh, EPOLLOUT | EPOLLWRNORM);
1596	ret = 0;
1597out:
1598	mutex_unlock(&filter->notify_lock);
1599
1600	if (ret == 0 && copy_to_user(buf, &unotif, sizeof(unotif))) {
1601		ret = -EFAULT;
1602
1603		/*
1604		 * Userspace screwed up. To make sure that we keep this
1605		 * notification alive, let's reset it back to INIT. It
1606		 * may have died when we released the lock, so we need to make
1607		 * sure it's still around.
1608		 */
1609		mutex_lock(&filter->notify_lock);
1610		knotif = find_notification(filter, unotif.id);
1611		if (knotif) {
1612			/* Reset the process to make sure it's not stuck */
1613			if (should_sleep_killable(filter, knotif))
1614				complete(&knotif->ready);
1615			knotif->state = SECCOMP_NOTIFY_INIT;
1616			atomic_inc(&filter->notif->requests);
1617			wake_up_poll(&filter->wqh, EPOLLIN | EPOLLRDNORM);
1618		}
1619		mutex_unlock(&filter->notify_lock);
1620	}
1621
1622	return ret;
1623}
1624
1625static long seccomp_notify_send(struct seccomp_filter *filter,
1626				void __user *buf)
1627{
1628	struct seccomp_notif_resp resp = {};
1629	struct seccomp_knotif *knotif;
1630	long ret;
1631
1632	if (copy_from_user(&resp, buf, sizeof(resp)))
1633		return -EFAULT;
1634
1635	if (resp.flags & ~SECCOMP_USER_NOTIF_FLAG_CONTINUE)
1636		return -EINVAL;
1637
1638	if ((resp.flags & SECCOMP_USER_NOTIF_FLAG_CONTINUE) &&
1639	    (resp.error || resp.val))
1640		return -EINVAL;
1641
1642	ret = mutex_lock_interruptible(&filter->notify_lock);
1643	if (ret < 0)
1644		return ret;
1645
1646	knotif = find_notification(filter, resp.id);
1647	if (!knotif) {
1648		ret = -ENOENT;
1649		goto out;
1650	}
1651
1652	/* Allow exactly one reply. */
1653	if (knotif->state != SECCOMP_NOTIFY_SENT) {
1654		ret = -EINPROGRESS;
1655		goto out;
1656	}
1657
1658	ret = 0;
1659	knotif->state = SECCOMP_NOTIFY_REPLIED;
1660	knotif->error = resp.error;
1661	knotif->val = resp.val;
1662	knotif->flags = resp.flags;
1663	if (filter->notif->flags & SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP)
1664		complete_on_current_cpu(&knotif->ready);
1665	else
1666		complete(&knotif->ready);
1667out:
1668	mutex_unlock(&filter->notify_lock);
1669	return ret;
1670}
1671
1672static long seccomp_notify_id_valid(struct seccomp_filter *filter,
1673				    void __user *buf)
1674{
1675	struct seccomp_knotif *knotif;
1676	u64 id;
1677	long ret;
1678
1679	if (copy_from_user(&id, buf, sizeof(id)))
1680		return -EFAULT;
1681
1682	ret = mutex_lock_interruptible(&filter->notify_lock);
1683	if (ret < 0)
1684		return ret;
1685
1686	knotif = find_notification(filter, id);
1687	if (knotif && knotif->state == SECCOMP_NOTIFY_SENT)
1688		ret = 0;
1689	else
1690		ret = -ENOENT;
1691
1692	mutex_unlock(&filter->notify_lock);
1693	return ret;
1694}
1695
1696static long seccomp_notify_set_flags(struct seccomp_filter *filter,
1697				    unsigned long flags)
1698{
1699	long ret;
1700
1701	if (flags & ~SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP)
1702		return -EINVAL;
1703
1704	ret = mutex_lock_interruptible(&filter->notify_lock);
1705	if (ret < 0)
1706		return ret;
1707	filter->notif->flags = flags;
1708	mutex_unlock(&filter->notify_lock);
1709	return 0;
1710}
1711
1712static long seccomp_notify_addfd(struct seccomp_filter *filter,
1713				 struct seccomp_notif_addfd __user *uaddfd,
1714				 unsigned int size)
1715{
1716	struct seccomp_notif_addfd addfd;
1717	struct seccomp_knotif *knotif;
1718	struct seccomp_kaddfd kaddfd;
1719	int ret;
1720
1721	BUILD_BUG_ON(sizeof(addfd) < SECCOMP_NOTIFY_ADDFD_SIZE_VER0);
1722	BUILD_BUG_ON(sizeof(addfd) != SECCOMP_NOTIFY_ADDFD_SIZE_LATEST);
1723
1724	if (size < SECCOMP_NOTIFY_ADDFD_SIZE_VER0 || size >= PAGE_SIZE)
1725		return -EINVAL;
1726
1727	ret = copy_struct_from_user(&addfd, sizeof(addfd), uaddfd, size);
1728	if (ret)
1729		return ret;
1730
1731	if (addfd.newfd_flags & ~O_CLOEXEC)
1732		return -EINVAL;
1733
1734	if (addfd.flags & ~(SECCOMP_ADDFD_FLAG_SETFD | SECCOMP_ADDFD_FLAG_SEND))
1735		return -EINVAL;
1736
1737	if (addfd.newfd && !(addfd.flags & SECCOMP_ADDFD_FLAG_SETFD))
1738		return -EINVAL;
1739
1740	kaddfd.file = fget(addfd.srcfd);
1741	if (!kaddfd.file)
1742		return -EBADF;
1743
1744	kaddfd.ioctl_flags = addfd.flags;
1745	kaddfd.flags = addfd.newfd_flags;
1746	kaddfd.setfd = addfd.flags & SECCOMP_ADDFD_FLAG_SETFD;
1747	kaddfd.fd = addfd.newfd;
1748	init_completion(&kaddfd.completion);
1749
1750	ret = mutex_lock_interruptible(&filter->notify_lock);
1751	if (ret < 0)
1752		goto out;
1753
1754	knotif = find_notification(filter, addfd.id);
1755	if (!knotif) {
1756		ret = -ENOENT;
1757		goto out_unlock;
1758	}
1759
1760	/*
1761	 * We do not want to allow for FD injection to occur before the
1762	 * notification has been picked up by a userspace handler, or after
1763	 * the notification has been replied to.
1764	 */
1765	if (knotif->state != SECCOMP_NOTIFY_SENT) {
1766		ret = -EINPROGRESS;
1767		goto out_unlock;
1768	}
1769
1770	if (addfd.flags & SECCOMP_ADDFD_FLAG_SEND) {
1771		/*
1772		 * Disallow queuing an atomic addfd + send reply while there are
1773		 * some addfd requests still to process.
1774		 *
1775		 * There is no clear reason to support it and allows us to keep
1776		 * the loop on the other side straight-forward.
1777		 */
1778		if (!list_empty(&knotif->addfd)) {
1779			ret = -EBUSY;
1780			goto out_unlock;
1781		}
1782
1783		/* Allow exactly only one reply */
1784		knotif->state = SECCOMP_NOTIFY_REPLIED;
1785	}
1786
1787	list_add(&kaddfd.list, &knotif->addfd);
1788	complete(&knotif->ready);
1789	mutex_unlock(&filter->notify_lock);
1790
1791	/* Now we wait for it to be processed or be interrupted */
1792	ret = wait_for_completion_interruptible(&kaddfd.completion);
1793	if (ret == 0) {
1794		/*
1795		 * We had a successful completion. The other side has already
1796		 * removed us from the addfd queue, and
1797		 * wait_for_completion_interruptible has a memory barrier upon
1798		 * success that lets us read this value directly without
1799		 * locking.
1800		 */
1801		ret = kaddfd.ret;
1802		goto out;
1803	}
1804
1805	mutex_lock(&filter->notify_lock);
1806	/*
1807	 * Even though we were woken up by a signal and not a successful
1808	 * completion, a completion may have happened in the mean time.
1809	 *
1810	 * We need to check again if the addfd request has been handled,
1811	 * and if not, we will remove it from the queue.
1812	 */
1813	if (list_empty(&kaddfd.list))
1814		ret = kaddfd.ret;
1815	else
1816		list_del(&kaddfd.list);
1817
1818out_unlock:
1819	mutex_unlock(&filter->notify_lock);
1820out:
1821	fput(kaddfd.file);
1822
1823	return ret;
1824}
1825
1826static long seccomp_notify_ioctl(struct file *file, unsigned int cmd,
1827				 unsigned long arg)
1828{
1829	struct seccomp_filter *filter = file->private_data;
1830	void __user *buf = (void __user *)arg;
1831
1832	/* Fixed-size ioctls */
1833	switch (cmd) {
1834	case SECCOMP_IOCTL_NOTIF_RECV:
1835		return seccomp_notify_recv(filter, buf);
1836	case SECCOMP_IOCTL_NOTIF_SEND:
1837		return seccomp_notify_send(filter, buf);
1838	case SECCOMP_IOCTL_NOTIF_ID_VALID_WRONG_DIR:
1839	case SECCOMP_IOCTL_NOTIF_ID_VALID:
1840		return seccomp_notify_id_valid(filter, buf);
1841	case SECCOMP_IOCTL_NOTIF_SET_FLAGS:
1842		return seccomp_notify_set_flags(filter, arg);
1843	}
1844
1845	/* Extensible Argument ioctls */
1846#define EA_IOCTL(cmd)	((cmd) & ~(IOC_INOUT | IOCSIZE_MASK))
1847	switch (EA_IOCTL(cmd)) {
1848	case EA_IOCTL(SECCOMP_IOCTL_NOTIF_ADDFD):
1849		return seccomp_notify_addfd(filter, buf, _IOC_SIZE(cmd));
1850	default:
1851		return -EINVAL;
1852	}
1853}
1854
1855static __poll_t seccomp_notify_poll(struct file *file,
1856				    struct poll_table_struct *poll_tab)
1857{
1858	struct seccomp_filter *filter = file->private_data;
1859	__poll_t ret = 0;
1860	struct seccomp_knotif *cur;
1861
1862	poll_wait(file, &filter->wqh, poll_tab);
1863
1864	if (mutex_lock_interruptible(&filter->notify_lock) < 0)
1865		return EPOLLERR;
1866
1867	list_for_each_entry(cur, &filter->notif->notifications, list) {
1868		if (cur->state == SECCOMP_NOTIFY_INIT)
1869			ret |= EPOLLIN | EPOLLRDNORM;
1870		if (cur->state == SECCOMP_NOTIFY_SENT)
1871			ret |= EPOLLOUT | EPOLLWRNORM;
1872		if ((ret & EPOLLIN) && (ret & EPOLLOUT))
1873			break;
1874	}
1875
1876	mutex_unlock(&filter->notify_lock);
1877
1878	if (refcount_read(&filter->users) == 0)
1879		ret |= EPOLLHUP;
1880
1881	return ret;
1882}
1883
1884static const struct file_operations seccomp_notify_ops = {
1885	.poll = seccomp_notify_poll,
1886	.release = seccomp_notify_release,
1887	.unlocked_ioctl = seccomp_notify_ioctl,
1888	.compat_ioctl = seccomp_notify_ioctl,
1889};
1890
1891static struct file *init_listener(struct seccomp_filter *filter)
1892{
1893	struct file *ret;
1894
1895	ret = ERR_PTR(-ENOMEM);
1896	filter->notif = kzalloc(sizeof(*(filter->notif)), GFP_KERNEL);
1897	if (!filter->notif)
1898		goto out;
1899
1900	filter->notif->next_id = get_random_u64();
1901	INIT_LIST_HEAD(&filter->notif->notifications);
1902
1903	ret = anon_inode_getfile("seccomp notify", &seccomp_notify_ops,
1904				 filter, O_RDWR);
1905	if (IS_ERR(ret))
1906		goto out_notif;
1907
1908	/* The file has a reference to it now */
1909	__get_seccomp_filter(filter);
1910
1911out_notif:
1912	if (IS_ERR(ret))
1913		seccomp_notify_free(filter);
1914out:
1915	return ret;
1916}
1917
1918/*
1919 * Does @new_child have a listener while an ancestor also has a listener?
1920 * If so, we'll want to reject this filter.
1921 * This only has to be tested for the current process, even in the TSYNC case,
1922 * because TSYNC installs @child with the same parent on all threads.
1923 * Note that @new_child is not hooked up to its parent at this point yet, so
1924 * we use current->seccomp.filter.
1925 */
1926static bool has_duplicate_listener(struct seccomp_filter *new_child)
1927{
1928	struct seccomp_filter *cur;
1929
1930	/* must be protected against concurrent TSYNC */
1931	lockdep_assert_held(&current->sighand->siglock);
1932
1933	if (!new_child->notif)
1934		return false;
1935	for (cur = current->seccomp.filter; cur; cur = cur->prev) {
1936		if (cur->notif)
1937			return true;
1938	}
1939
1940	return false;
1941}
1942
1943/**
1944 * seccomp_set_mode_filter: internal function for setting seccomp filter
1945 * @flags:  flags to change filter behavior
1946 * @filter: struct sock_fprog containing filter
1947 *
1948 * This function may be called repeatedly to install additional filters.
1949 * Every filter successfully installed will be evaluated (in reverse order)
1950 * for each system call the task makes.
1951 *
1952 * Once current->seccomp.mode is non-zero, it may not be changed.
1953 *
1954 * Returns 0 on success or -EINVAL on failure.
1955 */
1956static long seccomp_set_mode_filter(unsigned int flags,
1957				    const char __user *filter)
1958{
1959	const unsigned long seccomp_mode = SECCOMP_MODE_FILTER;
1960	struct seccomp_filter *prepared = NULL;
1961	long ret = -EINVAL;
1962	int listener = -1;
1963	struct file *listener_f = NULL;
1964
1965	/* Validate flags. */
1966	if (flags & ~SECCOMP_FILTER_FLAG_MASK)
1967		return -EINVAL;
1968
1969	/*
1970	 * In the successful case, NEW_LISTENER returns the new listener fd.
1971	 * But in the failure case, TSYNC returns the thread that died. If you
1972	 * combine these two flags, there's no way to tell whether something
1973	 * succeeded or failed. So, let's disallow this combination if the user
1974	 * has not explicitly requested no errors from TSYNC.
1975	 */
1976	if ((flags & SECCOMP_FILTER_FLAG_TSYNC) &&
1977	    (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) &&
1978	    ((flags & SECCOMP_FILTER_FLAG_TSYNC_ESRCH) == 0))
1979		return -EINVAL;
1980
1981	/*
1982	 * The SECCOMP_FILTER_FLAG_WAIT_KILLABLE_SENT flag doesn't make sense
1983	 * without the SECCOMP_FILTER_FLAG_NEW_LISTENER flag.
1984	 */
1985	if ((flags & SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV) &&
1986	    ((flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) == 0))
1987		return -EINVAL;
1988
1989	/* Prepare the new filter before holding any locks. */
1990	prepared = seccomp_prepare_user_filter(filter);
1991	if (IS_ERR(prepared))
1992		return PTR_ERR(prepared);
1993
1994	if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) {
1995		listener = get_unused_fd_flags(O_CLOEXEC);
1996		if (listener < 0) {
1997			ret = listener;
1998			goto out_free;
1999		}
2000
2001		listener_f = init_listener(prepared);
2002		if (IS_ERR(listener_f)) {
2003			put_unused_fd(listener);
2004			ret = PTR_ERR(listener_f);
2005			goto out_free;
2006		}
2007	}
2008
2009	/*
2010	 * Make sure we cannot change seccomp or nnp state via TSYNC
2011	 * while another thread is in the middle of calling exec.
2012	 */
2013	if (flags & SECCOMP_FILTER_FLAG_TSYNC &&
2014	    mutex_lock_killable(&current->signal->cred_guard_mutex))
2015		goto out_put_fd;
2016
2017	spin_lock_irq(&current->sighand->siglock);
2018
2019	if (!seccomp_may_assign_mode(seccomp_mode))
2020		goto out;
2021
2022	if (has_duplicate_listener(prepared)) {
2023		ret = -EBUSY;
2024		goto out;
2025	}
2026
2027	ret = seccomp_attach_filter(flags, prepared);
2028	if (ret)
2029		goto out;
2030	/* Do not free the successfully attached filter. */
2031	prepared = NULL;
2032
2033	seccomp_assign_mode(current, seccomp_mode, flags);
2034out:
2035	spin_unlock_irq(&current->sighand->siglock);
2036	if (flags & SECCOMP_FILTER_FLAG_TSYNC)
2037		mutex_unlock(&current->signal->cred_guard_mutex);
2038out_put_fd:
2039	if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) {
2040		if (ret) {
2041			listener_f->private_data = NULL;
2042			fput(listener_f);
2043			put_unused_fd(listener);
2044			seccomp_notify_detach(prepared);
2045		} else {
2046			fd_install(listener, listener_f);
2047			ret = listener;
2048		}
2049	}
2050out_free:
2051	seccomp_filter_free(prepared);
2052	return ret;
2053}
2054#else
2055static inline long seccomp_set_mode_filter(unsigned int flags,
2056					   const char __user *filter)
2057{
2058	return -EINVAL;
2059}
2060#endif
2061
2062static long seccomp_get_action_avail(const char __user *uaction)
2063{
2064	u32 action;
2065
2066	if (copy_from_user(&action, uaction, sizeof(action)))
2067		return -EFAULT;
2068
2069	switch (action) {
2070	case SECCOMP_RET_KILL_PROCESS:
2071	case SECCOMP_RET_KILL_THREAD:
2072	case SECCOMP_RET_TRAP:
2073	case SECCOMP_RET_ERRNO:
2074	case SECCOMP_RET_USER_NOTIF:
2075	case SECCOMP_RET_TRACE:
2076	case SECCOMP_RET_LOG:
2077	case SECCOMP_RET_ALLOW:
2078		break;
2079	default:
2080		return -EOPNOTSUPP;
2081	}
2082
2083	return 0;
2084}
2085
2086static long seccomp_get_notif_sizes(void __user *usizes)
2087{
2088	struct seccomp_notif_sizes sizes = {
2089		.seccomp_notif = sizeof(struct seccomp_notif),
2090		.seccomp_notif_resp = sizeof(struct seccomp_notif_resp),
2091		.seccomp_data = sizeof(struct seccomp_data),
2092	};
2093
2094	if (copy_to_user(usizes, &sizes, sizeof(sizes)))
2095		return -EFAULT;
2096
2097	return 0;
2098}
2099
2100/* Common entry point for both prctl and syscall. */
2101static long do_seccomp(unsigned int op, unsigned int flags,
2102		       void __user *uargs)
2103{
2104	switch (op) {
2105	case SECCOMP_SET_MODE_STRICT:
2106		if (flags != 0 || uargs != NULL)
2107			return -EINVAL;
2108		return seccomp_set_mode_strict();
2109	case SECCOMP_SET_MODE_FILTER:
2110		return seccomp_set_mode_filter(flags, uargs);
2111	case SECCOMP_GET_ACTION_AVAIL:
2112		if (flags != 0)
2113			return -EINVAL;
2114
2115		return seccomp_get_action_avail(uargs);
2116	case SECCOMP_GET_NOTIF_SIZES:
2117		if (flags != 0)
2118			return -EINVAL;
2119
2120		return seccomp_get_notif_sizes(uargs);
2121	default:
2122		return -EINVAL;
2123	}
2124}
2125
2126SYSCALL_DEFINE3(seccomp, unsigned int, op, unsigned int, flags,
2127			 void __user *, uargs)
2128{
2129	return do_seccomp(op, flags, uargs);
2130}
2131
2132/**
2133 * prctl_set_seccomp: configures current->seccomp.mode
2134 * @seccomp_mode: requested mode to use
2135 * @filter: optional struct sock_fprog for use with SECCOMP_MODE_FILTER
2136 *
2137 * Returns 0 on success or -EINVAL on failure.
2138 */
2139long prctl_set_seccomp(unsigned long seccomp_mode, void __user *filter)
2140{
2141	unsigned int op;
2142	void __user *uargs;
2143
2144	switch (seccomp_mode) {
2145	case SECCOMP_MODE_STRICT:
2146		op = SECCOMP_SET_MODE_STRICT;
2147		/*
2148		 * Setting strict mode through prctl always ignored filter,
2149		 * so make sure it is always NULL here to pass the internal
2150		 * check in do_seccomp().
2151		 */
2152		uargs = NULL;
2153		break;
2154	case SECCOMP_MODE_FILTER:
2155		op = SECCOMP_SET_MODE_FILTER;
2156		uargs = filter;
2157		break;
2158	default:
2159		return -EINVAL;
2160	}
2161
2162	/* prctl interface doesn't have flags, so they are always zero. */
2163	return do_seccomp(op, 0, uargs);
2164}
2165
2166#if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
2167static struct seccomp_filter *get_nth_filter(struct task_struct *task,
2168					     unsigned long filter_off)
2169{
2170	struct seccomp_filter *orig, *filter;
2171	unsigned long count;
2172
2173	/*
2174	 * Note: this is only correct because the caller should be the (ptrace)
2175	 * tracer of the task, otherwise lock_task_sighand is needed.
2176	 */
2177	spin_lock_irq(&task->sighand->siglock);
2178
2179	if (task->seccomp.mode != SECCOMP_MODE_FILTER) {
2180		spin_unlock_irq(&task->sighand->siglock);
2181		return ERR_PTR(-EINVAL);
2182	}
2183
2184	orig = task->seccomp.filter;
2185	__get_seccomp_filter(orig);
2186	spin_unlock_irq(&task->sighand->siglock);
2187
2188	count = 0;
2189	for (filter = orig; filter; filter = filter->prev)
2190		count++;
2191
2192	if (filter_off >= count) {
2193		filter = ERR_PTR(-ENOENT);
2194		goto out;
2195	}
2196
2197	count -= filter_off;
2198	for (filter = orig; filter && count > 1; filter = filter->prev)
2199		count--;
2200
2201	if (WARN_ON(count != 1 || !filter)) {
2202		filter = ERR_PTR(-ENOENT);
2203		goto out;
2204	}
2205
2206	__get_seccomp_filter(filter);
2207
2208out:
2209	__put_seccomp_filter(orig);
2210	return filter;
2211}
2212
2213long seccomp_get_filter(struct task_struct *task, unsigned long filter_off,
2214			void __user *data)
2215{
2216	struct seccomp_filter *filter;
2217	struct sock_fprog_kern *fprog;
2218	long ret;
2219
2220	if (!capable(CAP_SYS_ADMIN) ||
2221	    current->seccomp.mode != SECCOMP_MODE_DISABLED) {
2222		return -EACCES;
2223	}
2224
2225	filter = get_nth_filter(task, filter_off);
2226	if (IS_ERR(filter))
2227		return PTR_ERR(filter);
2228
2229	fprog = filter->prog->orig_prog;
2230	if (!fprog) {
2231		/* This must be a new non-cBPF filter, since we save
2232		 * every cBPF filter's orig_prog above when
2233		 * CONFIG_CHECKPOINT_RESTORE is enabled.
2234		 */
2235		ret = -EMEDIUMTYPE;
2236		goto out;
2237	}
2238
2239	ret = fprog->len;
2240	if (!data)
2241		goto out;
2242
2243	if (copy_to_user(data, fprog->filter, bpf_classic_proglen(fprog)))
2244		ret = -EFAULT;
2245
2246out:
2247	__put_seccomp_filter(filter);
2248	return ret;
2249}
2250
2251long seccomp_get_metadata(struct task_struct *task,
2252			  unsigned long size, void __user *data)
2253{
2254	long ret;
2255	struct seccomp_filter *filter;
2256	struct seccomp_metadata kmd = {};
2257
2258	if (!capable(CAP_SYS_ADMIN) ||
2259	    current->seccomp.mode != SECCOMP_MODE_DISABLED) {
2260		return -EACCES;
2261	}
2262
2263	size = min_t(unsigned long, size, sizeof(kmd));
2264
2265	if (size < sizeof(kmd.filter_off))
2266		return -EINVAL;
2267
2268	if (copy_from_user(&kmd.filter_off, data, sizeof(kmd.filter_off)))
2269		return -EFAULT;
2270
2271	filter = get_nth_filter(task, kmd.filter_off);
2272	if (IS_ERR(filter))
2273		return PTR_ERR(filter);
2274
2275	if (filter->log)
2276		kmd.flags |= SECCOMP_FILTER_FLAG_LOG;
2277
2278	ret = size;
2279	if (copy_to_user(data, &kmd, size))
2280		ret = -EFAULT;
2281
2282	__put_seccomp_filter(filter);
2283	return ret;
2284}
2285#endif
2286
2287#ifdef CONFIG_SYSCTL
2288
2289/* Human readable action names for friendly sysctl interaction */
2290#define SECCOMP_RET_KILL_PROCESS_NAME	"kill_process"
2291#define SECCOMP_RET_KILL_THREAD_NAME	"kill_thread"
2292#define SECCOMP_RET_TRAP_NAME		"trap"
2293#define SECCOMP_RET_ERRNO_NAME		"errno"
2294#define SECCOMP_RET_USER_NOTIF_NAME	"user_notif"
2295#define SECCOMP_RET_TRACE_NAME		"trace"
2296#define SECCOMP_RET_LOG_NAME		"log"
2297#define SECCOMP_RET_ALLOW_NAME		"allow"
2298
2299static const char seccomp_actions_avail[] =
2300				SECCOMP_RET_KILL_PROCESS_NAME	" "
2301				SECCOMP_RET_KILL_THREAD_NAME	" "
2302				SECCOMP_RET_TRAP_NAME		" "
2303				SECCOMP_RET_ERRNO_NAME		" "
2304				SECCOMP_RET_USER_NOTIF_NAME     " "
2305				SECCOMP_RET_TRACE_NAME		" "
2306				SECCOMP_RET_LOG_NAME		" "
2307				SECCOMP_RET_ALLOW_NAME;
2308
2309struct seccomp_log_name {
2310	u32		log;
2311	const char	*name;
2312};
2313
2314static const struct seccomp_log_name seccomp_log_names[] = {
2315	{ SECCOMP_LOG_KILL_PROCESS, SECCOMP_RET_KILL_PROCESS_NAME },
2316	{ SECCOMP_LOG_KILL_THREAD, SECCOMP_RET_KILL_THREAD_NAME },
2317	{ SECCOMP_LOG_TRAP, SECCOMP_RET_TRAP_NAME },
2318	{ SECCOMP_LOG_ERRNO, SECCOMP_RET_ERRNO_NAME },
2319	{ SECCOMP_LOG_USER_NOTIF, SECCOMP_RET_USER_NOTIF_NAME },
2320	{ SECCOMP_LOG_TRACE, SECCOMP_RET_TRACE_NAME },
2321	{ SECCOMP_LOG_LOG, SECCOMP_RET_LOG_NAME },
2322	{ SECCOMP_LOG_ALLOW, SECCOMP_RET_ALLOW_NAME },
2323	{ }
2324};
2325
2326static bool seccomp_names_from_actions_logged(char *names, size_t size,
2327					      u32 actions_logged,
2328					      const char *sep)
2329{
2330	const struct seccomp_log_name *cur;
2331	bool append_sep = false;
2332
2333	for (cur = seccomp_log_names; cur->name && size; cur++) {
2334		ssize_t ret;
2335
2336		if (!(actions_logged & cur->log))
2337			continue;
2338
2339		if (append_sep) {
2340			ret = strscpy(names, sep, size);
2341			if (ret < 0)
2342				return false;
2343
2344			names += ret;
2345			size -= ret;
2346		} else
2347			append_sep = true;
2348
2349		ret = strscpy(names, cur->name, size);
2350		if (ret < 0)
2351			return false;
2352
2353		names += ret;
2354		size -= ret;
2355	}
2356
2357	return true;
2358}
2359
2360static bool seccomp_action_logged_from_name(u32 *action_logged,
2361					    const char *name)
2362{
2363	const struct seccomp_log_name *cur;
2364
2365	for (cur = seccomp_log_names; cur->name; cur++) {
2366		if (!strcmp(cur->name, name)) {
2367			*action_logged = cur->log;
2368			return true;
2369		}
2370	}
2371
2372	return false;
2373}
2374
2375static bool seccomp_actions_logged_from_names(u32 *actions_logged, char *names)
2376{
2377	char *name;
2378
2379	*actions_logged = 0;
2380	while ((name = strsep(&names, " ")) && *name) {
2381		u32 action_logged = 0;
2382
2383		if (!seccomp_action_logged_from_name(&action_logged, name))
2384			return false;
2385
2386		*actions_logged |= action_logged;
2387	}
2388
2389	return true;
2390}
2391
2392static int read_actions_logged(const struct ctl_table *ro_table, void *buffer,
2393			       size_t *lenp, loff_t *ppos)
2394{
2395	char names[sizeof(seccomp_actions_avail)];
2396	struct ctl_table table;
2397
2398	memset(names, 0, sizeof(names));
2399
2400	if (!seccomp_names_from_actions_logged(names, sizeof(names),
2401					       seccomp_actions_logged, " "))
2402		return -EINVAL;
2403
2404	table = *ro_table;
2405	table.data = names;
2406	table.maxlen = sizeof(names);
2407	return proc_dostring(&table, 0, buffer, lenp, ppos);
2408}
2409
2410static int write_actions_logged(const struct ctl_table *ro_table, void *buffer,
2411				size_t *lenp, loff_t *ppos, u32 *actions_logged)
2412{
2413	char names[sizeof(seccomp_actions_avail)];
2414	struct ctl_table table;
2415	int ret;
2416
2417	if (!capable(CAP_SYS_ADMIN))
2418		return -EPERM;
2419
2420	memset(names, 0, sizeof(names));
2421
2422	table = *ro_table;
2423	table.data = names;
2424	table.maxlen = sizeof(names);
2425	ret = proc_dostring(&table, 1, buffer, lenp, ppos);
2426	if (ret)
2427		return ret;
2428
2429	if (!seccomp_actions_logged_from_names(actions_logged, table.data))
2430		return -EINVAL;
2431
2432	if (*actions_logged & SECCOMP_LOG_ALLOW)
2433		return -EINVAL;
2434
2435	seccomp_actions_logged = *actions_logged;
2436	return 0;
2437}
2438
2439static void audit_actions_logged(u32 actions_logged, u32 old_actions_logged,
2440				 int ret)
2441{
2442	char names[sizeof(seccomp_actions_avail)];
2443	char old_names[sizeof(seccomp_actions_avail)];
2444	const char *new = names;
2445	const char *old = old_names;
2446
2447	if (!audit_enabled)
2448		return;
2449
2450	memset(names, 0, sizeof(names));
2451	memset(old_names, 0, sizeof(old_names));
2452
2453	if (ret)
2454		new = "?";
2455	else if (!actions_logged)
2456		new = "(none)";
2457	else if (!seccomp_names_from_actions_logged(names, sizeof(names),
2458						    actions_logged, ","))
2459		new = "?";
2460
2461	if (!old_actions_logged)
2462		old = "(none)";
2463	else if (!seccomp_names_from_actions_logged(old_names,
2464						    sizeof(old_names),
2465						    old_actions_logged, ","))
2466		old = "?";
2467
2468	return audit_seccomp_actions_logged(new, old, !ret);
2469}
2470
2471static int seccomp_actions_logged_handler(const struct ctl_table *ro_table, int write,
2472					  void *buffer, size_t *lenp,
2473					  loff_t *ppos)
2474{
2475	int ret;
2476
2477	if (write) {
2478		u32 actions_logged = 0;
2479		u32 old_actions_logged = seccomp_actions_logged;
2480
2481		ret = write_actions_logged(ro_table, buffer, lenp, ppos,
2482					   &actions_logged);
2483		audit_actions_logged(actions_logged, old_actions_logged, ret);
2484	} else
2485		ret = read_actions_logged(ro_table, buffer, lenp, ppos);
2486
2487	return ret;
2488}
2489
2490static const struct ctl_table seccomp_sysctl_table[] = {
2491	{
2492		.procname	= "actions_avail",
2493		.data		= (void *) &seccomp_actions_avail,
2494		.maxlen		= sizeof(seccomp_actions_avail),
2495		.mode		= 0444,
2496		.proc_handler	= proc_dostring,
2497	},
2498	{
2499		.procname	= "actions_logged",
2500		.mode		= 0644,
2501		.proc_handler	= seccomp_actions_logged_handler,
2502	},
2503};
2504
2505static int __init seccomp_sysctl_init(void)
2506{
2507	register_sysctl_init("kernel/seccomp", seccomp_sysctl_table);
2508	return 0;
2509}
2510
2511device_initcall(seccomp_sysctl_init)
2512
2513#endif /* CONFIG_SYSCTL */
2514
2515#ifdef CONFIG_SECCOMP_CACHE_DEBUG
2516/* Currently CONFIG_SECCOMP_CACHE_DEBUG implies SECCOMP_ARCH_NATIVE */
2517static void proc_pid_seccomp_cache_arch(struct seq_file *m, const char *name,
2518					const void *bitmap, size_t bitmap_size)
2519{
2520	int nr;
2521
2522	for (nr = 0; nr < bitmap_size; nr++) {
2523		bool cached = test_bit(nr, bitmap);
2524		char *status = cached ? "ALLOW" : "FILTER";
2525
2526		seq_printf(m, "%s %d %s\n", name, nr, status);
2527	}
2528}
2529
2530int proc_pid_seccomp_cache(struct seq_file *m, struct pid_namespace *ns,
2531			   struct pid *pid, struct task_struct *task)
2532{
2533	struct seccomp_filter *f;
2534	unsigned long flags;
2535
2536	/*
2537	 * We don't want some sandboxed process to know what their seccomp
2538	 * filters consist of.
2539	 */
2540	if (!file_ns_capable(m->file, &init_user_ns, CAP_SYS_ADMIN))
2541		return -EACCES;
2542
2543	if (!lock_task_sighand(task, &flags))
2544		return -ESRCH;
2545
2546	f = READ_ONCE(task->seccomp.filter);
2547	if (!f) {
2548		unlock_task_sighand(task, &flags);
2549		return 0;
2550	}
2551
2552	/* prevent filter from being freed while we are printing it */
2553	__get_seccomp_filter(f);
2554	unlock_task_sighand(task, &flags);
2555
2556	proc_pid_seccomp_cache_arch(m, SECCOMP_ARCH_NATIVE_NAME,
2557				    f->cache.allow_native,
2558				    SECCOMP_ARCH_NATIVE_NR);
2559
2560#ifdef SECCOMP_ARCH_COMPAT
2561	proc_pid_seccomp_cache_arch(m, SECCOMP_ARCH_COMPAT_NAME,
2562				    f->cache.allow_compat,
2563				    SECCOMP_ARCH_COMPAT_NR);
2564#endif /* SECCOMP_ARCH_COMPAT */
2565
2566	__put_seccomp_filter(f);
2567	return 0;
2568}
2569#endif /* CONFIG_SECCOMP_CACHE_DEBUG */