Merge branch 'for-5.1' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
[sfrench/cifs-2.6.git] / kernel / seccomp.c
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * linux/kernel/seccomp.c
4  *
5  * Copyright 2004-2005  Andrea Arcangeli <andrea@cpushare.com>
6  *
7  * Copyright (C) 2012 Google, Inc.
8  * Will Drewry <wad@chromium.org>
9  *
10  * This defines a simple but solid secure-computing facility.
11  *
12  * Mode 1 uses a fixed list of allowed system calls.
13  * Mode 2 allows user-defined system call filters in the form
14  *        of Berkeley Packet Filters/Linux Socket Filters.
15  */
16
17 #include <linux/refcount.h>
18 #include <linux/audit.h>
19 #include <linux/compat.h>
20 #include <linux/coredump.h>
21 #include <linux/kmemleak.h>
22 #include <linux/nospec.h>
23 #include <linux/prctl.h>
24 #include <linux/sched.h>
25 #include <linux/sched/task_stack.h>
26 #include <linux/seccomp.h>
27 #include <linux/slab.h>
28 #include <linux/syscalls.h>
29 #include <linux/sysctl.h>
30
31 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
32 #include <asm/syscall.h>
33 #endif
34
35 #ifdef CONFIG_SECCOMP_FILTER
36 #include <linux/file.h>
37 #include <linux/filter.h>
38 #include <linux/pid.h>
39 #include <linux/ptrace.h>
40 #include <linux/security.h>
41 #include <linux/tracehook.h>
42 #include <linux/uaccess.h>
43 #include <linux/anon_inodes.h>
44
45 enum notify_state {
46         SECCOMP_NOTIFY_INIT,
47         SECCOMP_NOTIFY_SENT,
48         SECCOMP_NOTIFY_REPLIED,
49 };
50
51 struct seccomp_knotif {
52         /* The struct pid of the task whose filter triggered the notification */
53         struct task_struct *task;
54
55         /* The "cookie" for this request; this is unique for this filter. */
56         u64 id;
57
58         /*
59          * The seccomp data. This pointer is valid the entire time this
60          * notification is active, since it comes from __seccomp_filter which
61          * eclipses the entire lifecycle here.
62          */
63         const struct seccomp_data *data;
64
65         /*
66          * Notification states. When SECCOMP_RET_USER_NOTIF is returned, a
67          * struct seccomp_knotif is created and starts out in INIT. Once the
68          * handler reads the notification off of an FD, it transitions to SENT.
69          * If a signal is received the state transitions back to INIT and
70          * another message is sent. When the userspace handler replies, state
71          * transitions to REPLIED.
72          */
73         enum notify_state state;
74
75         /* The return values, only valid when in SECCOMP_NOTIFY_REPLIED */
76         int error;
77         long val;
78
79         /* Signals when this has entered SECCOMP_NOTIFY_REPLIED */
80         struct completion ready;
81
82         struct list_head list;
83 };
84
85 /**
86  * struct notification - container for seccomp userspace notifications. Since
87  * most seccomp filters will not have notification listeners attached and this
88  * structure is fairly large, we store the notification-specific stuff in a
89  * separate structure.
90  *
91  * @request: A semaphore that users of this notification can wait on for
92  *           changes. Actual reads and writes are still controlled with
93  *           filter->notify_lock.
94  * @next_id: The id of the next request.
95  * @notifications: A list of struct seccomp_knotif elements.
96  * @wqh: A wait queue for poll.
97  */
98 struct notification {
99         struct semaphore request;
100         u64 next_id;
101         struct list_head notifications;
102         wait_queue_head_t wqh;
103 };
104
105 /**
106  * struct seccomp_filter - container for seccomp BPF programs
107  *
108  * @usage: reference count to manage the object lifetime.
109  *         get/put helpers should be used when accessing an instance
110  *         outside of a lifetime-guarded section.  In general, this
111  *         is only needed for handling filters shared across tasks.
112  * @log: true if all actions except for SECCOMP_RET_ALLOW should be logged
113  * @prev: points to a previously installed, or inherited, filter
114  * @prog: the BPF program to evaluate
115  * @notif: the struct that holds all notification related information
116  * @notify_lock: A lock for all notification-related accesses.
117  *
118  * seccomp_filter objects are organized in a tree linked via the @prev
119  * pointer.  For any task, it appears to be a singly-linked list starting
120  * with current->seccomp.filter, the most recently attached or inherited filter.
121  * However, multiple filters may share a @prev node, by way of fork(), which
122  * results in a unidirectional tree existing in memory.  This is similar to
123  * how namespaces work.
124  *
125  * seccomp_filter objects should never be modified after being attached
126  * to a task_struct (other than @usage).
127  */
128 struct seccomp_filter {
129         refcount_t usage;
130         bool log;
131         struct seccomp_filter *prev;
132         struct bpf_prog *prog;
133         struct notification *notif;
134         struct mutex notify_lock;
135 };
136
137 /* Limit any path through the tree to 256KB worth of instructions. */
138 #define MAX_INSNS_PER_PATH ((1 << 18) / sizeof(struct sock_filter))
139
140 /*
141  * Endianness is explicitly ignored and left for BPF program authors to manage
142  * as per the specific architecture.
143  */
144 static void populate_seccomp_data(struct seccomp_data *sd)
145 {
146         struct task_struct *task = current;
147         struct pt_regs *regs = task_pt_regs(task);
148         unsigned long args[6];
149
150         sd->nr = syscall_get_nr(task, regs);
151         sd->arch = syscall_get_arch();
152         syscall_get_arguments(task, regs, 0, 6, args);
153         sd->args[0] = args[0];
154         sd->args[1] = args[1];
155         sd->args[2] = args[2];
156         sd->args[3] = args[3];
157         sd->args[4] = args[4];
158         sd->args[5] = args[5];
159         sd->instruction_pointer = KSTK_EIP(task);
160 }
161
162 /**
163  *      seccomp_check_filter - verify seccomp filter code
164  *      @filter: filter to verify
165  *      @flen: length of filter
166  *
167  * Takes a previously checked filter (by bpf_check_classic) and
168  * redirects all filter code that loads struct sk_buff data
169  * and related data through seccomp_bpf_load.  It also
170  * enforces length and alignment checking of those loads.
171  *
172  * Returns 0 if the rule set is legal or -EINVAL if not.
173  */
174 static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen)
175 {
176         int pc;
177         for (pc = 0; pc < flen; pc++) {
178                 struct sock_filter *ftest = &filter[pc];
179                 u16 code = ftest->code;
180                 u32 k = ftest->k;
181
182                 switch (code) {
183                 case BPF_LD | BPF_W | BPF_ABS:
184                         ftest->code = BPF_LDX | BPF_W | BPF_ABS;
185                         /* 32-bit aligned and not out of bounds. */
186                         if (k >= sizeof(struct seccomp_data) || k & 3)
187                                 return -EINVAL;
188                         continue;
189                 case BPF_LD | BPF_W | BPF_LEN:
190                         ftest->code = BPF_LD | BPF_IMM;
191                         ftest->k = sizeof(struct seccomp_data);
192                         continue;
193                 case BPF_LDX | BPF_W | BPF_LEN:
194                         ftest->code = BPF_LDX | BPF_IMM;
195                         ftest->k = sizeof(struct seccomp_data);
196                         continue;
197                 /* Explicitly include allowed calls. */
198                 case BPF_RET | BPF_K:
199                 case BPF_RET | BPF_A:
200                 case BPF_ALU | BPF_ADD | BPF_K:
201                 case BPF_ALU | BPF_ADD | BPF_X:
202                 case BPF_ALU | BPF_SUB | BPF_K:
203                 case BPF_ALU | BPF_SUB | BPF_X:
204                 case BPF_ALU | BPF_MUL | BPF_K:
205                 case BPF_ALU | BPF_MUL | BPF_X:
206                 case BPF_ALU | BPF_DIV | BPF_K:
207                 case BPF_ALU | BPF_DIV | BPF_X:
208                 case BPF_ALU | BPF_AND | BPF_K:
209                 case BPF_ALU | BPF_AND | BPF_X:
210                 case BPF_ALU | BPF_OR | BPF_K:
211                 case BPF_ALU | BPF_OR | BPF_X:
212                 case BPF_ALU | BPF_XOR | BPF_K:
213                 case BPF_ALU | BPF_XOR | BPF_X:
214                 case BPF_ALU | BPF_LSH | BPF_K:
215                 case BPF_ALU | BPF_LSH | BPF_X:
216                 case BPF_ALU | BPF_RSH | BPF_K:
217                 case BPF_ALU | BPF_RSH | BPF_X:
218                 case BPF_ALU | BPF_NEG:
219                 case BPF_LD | BPF_IMM:
220                 case BPF_LDX | BPF_IMM:
221                 case BPF_MISC | BPF_TAX:
222                 case BPF_MISC | BPF_TXA:
223                 case BPF_LD | BPF_MEM:
224                 case BPF_LDX | BPF_MEM:
225                 case BPF_ST:
226                 case BPF_STX:
227                 case BPF_JMP | BPF_JA:
228                 case BPF_JMP | BPF_JEQ | BPF_K:
229                 case BPF_JMP | BPF_JEQ | BPF_X:
230                 case BPF_JMP | BPF_JGE | BPF_K:
231                 case BPF_JMP | BPF_JGE | BPF_X:
232                 case BPF_JMP | BPF_JGT | BPF_K:
233                 case BPF_JMP | BPF_JGT | BPF_X:
234                 case BPF_JMP | BPF_JSET | BPF_K:
235                 case BPF_JMP | BPF_JSET | BPF_X:
236                         continue;
237                 default:
238                         return -EINVAL;
239                 }
240         }
241         return 0;
242 }
243
244 /**
245  * seccomp_run_filters - evaluates all seccomp filters against @sd
246  * @sd: optional seccomp data to be passed to filters
247  * @match: stores struct seccomp_filter that resulted in the return value,
248  *         unless filter returned SECCOMP_RET_ALLOW, in which case it will
249  *         be unchanged.
250  *
251  * Returns valid seccomp BPF response codes.
252  */
253 #define ACTION_ONLY(ret) ((s32)((ret) & (SECCOMP_RET_ACTION_FULL)))
254 static u32 seccomp_run_filters(const struct seccomp_data *sd,
255                                struct seccomp_filter **match)
256 {
257         u32 ret = SECCOMP_RET_ALLOW;
258         /* Make sure cross-thread synced filter points somewhere sane. */
259         struct seccomp_filter *f =
260                         READ_ONCE(current->seccomp.filter);
261
262         /* Ensure unexpected behavior doesn't result in failing open. */
263         if (WARN_ON(f == NULL))
264                 return SECCOMP_RET_KILL_PROCESS;
265
266         /*
267          * All filters in the list are evaluated and the lowest BPF return
268          * value always takes priority (ignoring the DATA).
269          */
270         preempt_disable();
271         for (; f; f = f->prev) {
272                 u32 cur_ret = BPF_PROG_RUN(f->prog, sd);
273
274                 if (ACTION_ONLY(cur_ret) < ACTION_ONLY(ret)) {
275                         ret = cur_ret;
276                         *match = f;
277                 }
278         }
279         preempt_enable();
280         return ret;
281 }
282 #endif /* CONFIG_SECCOMP_FILTER */
283
284 static inline bool seccomp_may_assign_mode(unsigned long seccomp_mode)
285 {
286         assert_spin_locked(&current->sighand->siglock);
287
288         if (current->seccomp.mode && current->seccomp.mode != seccomp_mode)
289                 return false;
290
291         return true;
292 }
293
294 void __weak arch_seccomp_spec_mitigate(struct task_struct *task) { }
295
296 static inline void seccomp_assign_mode(struct task_struct *task,
297                                        unsigned long seccomp_mode,
298                                        unsigned long flags)
299 {
300         assert_spin_locked(&task->sighand->siglock);
301
302         task->seccomp.mode = seccomp_mode;
303         /*
304          * Make sure TIF_SECCOMP cannot be set before the mode (and
305          * filter) is set.
306          */
307         smp_mb__before_atomic();
308         /* Assume default seccomp processes want spec flaw mitigation. */
309         if ((flags & SECCOMP_FILTER_FLAG_SPEC_ALLOW) == 0)
310                 arch_seccomp_spec_mitigate(task);
311         set_tsk_thread_flag(task, TIF_SECCOMP);
312 }
313
314 #ifdef CONFIG_SECCOMP_FILTER
315 /* Returns 1 if the parent is an ancestor of the child. */
316 static int is_ancestor(struct seccomp_filter *parent,
317                        struct seccomp_filter *child)
318 {
319         /* NULL is the root ancestor. */
320         if (parent == NULL)
321                 return 1;
322         for (; child; child = child->prev)
323                 if (child == parent)
324                         return 1;
325         return 0;
326 }
327
328 /**
329  * seccomp_can_sync_threads: checks if all threads can be synchronized
330  *
331  * Expects sighand and cred_guard_mutex locks to be held.
332  *
333  * Returns 0 on success, -ve on error, or the pid of a thread which was
334  * either not in the correct seccomp mode or it did not have an ancestral
335  * seccomp filter.
336  */
337 static inline pid_t seccomp_can_sync_threads(void)
338 {
339         struct task_struct *thread, *caller;
340
341         BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
342         assert_spin_locked(&current->sighand->siglock);
343
344         /* Validate all threads being eligible for synchronization. */
345         caller = current;
346         for_each_thread(caller, thread) {
347                 pid_t failed;
348
349                 /* Skip current, since it is initiating the sync. */
350                 if (thread == caller)
351                         continue;
352
353                 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED ||
354                     (thread->seccomp.mode == SECCOMP_MODE_FILTER &&
355                      is_ancestor(thread->seccomp.filter,
356                                  caller->seccomp.filter)))
357                         continue;
358
359                 /* Return the first thread that cannot be synchronized. */
360                 failed = task_pid_vnr(thread);
361                 /* If the pid cannot be resolved, then return -ESRCH */
362                 if (WARN_ON(failed == 0))
363                         failed = -ESRCH;
364                 return failed;
365         }
366
367         return 0;
368 }
369
370 /**
371  * seccomp_sync_threads: sets all threads to use current's filter
372  *
373  * Expects sighand and cred_guard_mutex locks to be held, and for
374  * seccomp_can_sync_threads() to have returned success already
375  * without dropping the locks.
376  *
377  */
378 static inline void seccomp_sync_threads(unsigned long flags)
379 {
380         struct task_struct *thread, *caller;
381
382         BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
383         assert_spin_locked(&current->sighand->siglock);
384
385         /* Synchronize all threads. */
386         caller = current;
387         for_each_thread(caller, thread) {
388                 /* Skip current, since it needs no changes. */
389                 if (thread == caller)
390                         continue;
391
392                 /* Get a task reference for the new leaf node. */
393                 get_seccomp_filter(caller);
394                 /*
395                  * Drop the task reference to the shared ancestor since
396                  * current's path will hold a reference.  (This also
397                  * allows a put before the assignment.)
398                  */
399                 put_seccomp_filter(thread);
400                 smp_store_release(&thread->seccomp.filter,
401                                   caller->seccomp.filter);
402
403                 /*
404                  * Don't let an unprivileged task work around
405                  * the no_new_privs restriction by creating
406                  * a thread that sets it up, enters seccomp,
407                  * then dies.
408                  */
409                 if (task_no_new_privs(caller))
410                         task_set_no_new_privs(thread);
411
412                 /*
413                  * Opt the other thread into seccomp if needed.
414                  * As threads are considered to be trust-realm
415                  * equivalent (see ptrace_may_access), it is safe to
416                  * allow one thread to transition the other.
417                  */
418                 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED)
419                         seccomp_assign_mode(thread, SECCOMP_MODE_FILTER,
420                                             flags);
421         }
422 }
423
424 /**
425  * seccomp_prepare_filter: Prepares a seccomp filter for use.
426  * @fprog: BPF program to install
427  *
428  * Returns filter on success or an ERR_PTR on failure.
429  */
430 static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog)
431 {
432         struct seccomp_filter *sfilter;
433         int ret;
434         const bool save_orig = IS_ENABLED(CONFIG_CHECKPOINT_RESTORE);
435
436         if (fprog->len == 0 || fprog->len > BPF_MAXINSNS)
437                 return ERR_PTR(-EINVAL);
438
439         BUG_ON(INT_MAX / fprog->len < sizeof(struct sock_filter));
440
441         /*
442          * Installing a seccomp filter requires that the task has
443          * CAP_SYS_ADMIN in its namespace or be running with no_new_privs.
444          * This avoids scenarios where unprivileged tasks can affect the
445          * behavior of privileged children.
446          */
447         if (!task_no_new_privs(current) &&
448             security_capable_noaudit(current_cred(), current_user_ns(),
449                                      CAP_SYS_ADMIN) != 0)
450                 return ERR_PTR(-EACCES);
451
452         /* Allocate a new seccomp_filter */
453         sfilter = kzalloc(sizeof(*sfilter), GFP_KERNEL | __GFP_NOWARN);
454         if (!sfilter)
455                 return ERR_PTR(-ENOMEM);
456
457         mutex_init(&sfilter->notify_lock);
458         ret = bpf_prog_create_from_user(&sfilter->prog, fprog,
459                                         seccomp_check_filter, save_orig);
460         if (ret < 0) {
461                 kfree(sfilter);
462                 return ERR_PTR(ret);
463         }
464
465         refcount_set(&sfilter->usage, 1);
466
467         return sfilter;
468 }
469
470 /**
471  * seccomp_prepare_user_filter - prepares a user-supplied sock_fprog
472  * @user_filter: pointer to the user data containing a sock_fprog.
473  *
474  * Returns 0 on success and non-zero otherwise.
475  */
476 static struct seccomp_filter *
477 seccomp_prepare_user_filter(const char __user *user_filter)
478 {
479         struct sock_fprog fprog;
480         struct seccomp_filter *filter = ERR_PTR(-EFAULT);
481
482 #ifdef CONFIG_COMPAT
483         if (in_compat_syscall()) {
484                 struct compat_sock_fprog fprog32;
485                 if (copy_from_user(&fprog32, user_filter, sizeof(fprog32)))
486                         goto out;
487                 fprog.len = fprog32.len;
488                 fprog.filter = compat_ptr(fprog32.filter);
489         } else /* falls through to the if below. */
490 #endif
491         if (copy_from_user(&fprog, user_filter, sizeof(fprog)))
492                 goto out;
493         filter = seccomp_prepare_filter(&fprog);
494 out:
495         return filter;
496 }
497
498 /**
499  * seccomp_attach_filter: validate and attach filter
500  * @flags:  flags to change filter behavior
501  * @filter: seccomp filter to add to the current process
502  *
503  * Caller must be holding current->sighand->siglock lock.
504  *
505  * Returns 0 on success, -ve on error.
506  */
507 static long seccomp_attach_filter(unsigned int flags,
508                                   struct seccomp_filter *filter)
509 {
510         unsigned long total_insns;
511         struct seccomp_filter *walker;
512
513         assert_spin_locked(&current->sighand->siglock);
514
515         /* Validate resulting filter length. */
516         total_insns = filter->prog->len;
517         for (walker = current->seccomp.filter; walker; walker = walker->prev)
518                 total_insns += walker->prog->len + 4;  /* 4 instr penalty */
519         if (total_insns > MAX_INSNS_PER_PATH)
520                 return -ENOMEM;
521
522         /* If thread sync has been requested, check that it is possible. */
523         if (flags & SECCOMP_FILTER_FLAG_TSYNC) {
524                 int ret;
525
526                 ret = seccomp_can_sync_threads();
527                 if (ret)
528                         return ret;
529         }
530
531         /* Set log flag, if present. */
532         if (flags & SECCOMP_FILTER_FLAG_LOG)
533                 filter->log = true;
534
535         /*
536          * If there is an existing filter, make it the prev and don't drop its
537          * task reference.
538          */
539         filter->prev = current->seccomp.filter;
540         current->seccomp.filter = filter;
541
542         /* Now that the new filter is in place, synchronize to all threads. */
543         if (flags & SECCOMP_FILTER_FLAG_TSYNC)
544                 seccomp_sync_threads(flags);
545
546         return 0;
547 }
548
549 static void __get_seccomp_filter(struct seccomp_filter *filter)
550 {
551         refcount_inc(&filter->usage);
552 }
553
554 /* get_seccomp_filter - increments the reference count of the filter on @tsk */
555 void get_seccomp_filter(struct task_struct *tsk)
556 {
557         struct seccomp_filter *orig = tsk->seccomp.filter;
558         if (!orig)
559                 return;
560         __get_seccomp_filter(orig);
561 }
562
563 static inline void seccomp_filter_free(struct seccomp_filter *filter)
564 {
565         if (filter) {
566                 bpf_prog_destroy(filter->prog);
567                 kfree(filter);
568         }
569 }
570
571 static void __put_seccomp_filter(struct seccomp_filter *orig)
572 {
573         /* Clean up single-reference branches iteratively. */
574         while (orig && refcount_dec_and_test(&orig->usage)) {
575                 struct seccomp_filter *freeme = orig;
576                 orig = orig->prev;
577                 seccomp_filter_free(freeme);
578         }
579 }
580
581 /* put_seccomp_filter - decrements the ref count of tsk->seccomp.filter */
582 void put_seccomp_filter(struct task_struct *tsk)
583 {
584         __put_seccomp_filter(tsk->seccomp.filter);
585 }
586
587 static void seccomp_init_siginfo(kernel_siginfo_t *info, int syscall, int reason)
588 {
589         clear_siginfo(info);
590         info->si_signo = SIGSYS;
591         info->si_code = SYS_SECCOMP;
592         info->si_call_addr = (void __user *)KSTK_EIP(current);
593         info->si_errno = reason;
594         info->si_arch = syscall_get_arch();
595         info->si_syscall = syscall;
596 }
597
598 /**
599  * seccomp_send_sigsys - signals the task to allow in-process syscall emulation
600  * @syscall: syscall number to send to userland
601  * @reason: filter-supplied reason code to send to userland (via si_errno)
602  *
603  * Forces a SIGSYS with a code of SYS_SECCOMP and related sigsys info.
604  */
605 static void seccomp_send_sigsys(int syscall, int reason)
606 {
607         struct kernel_siginfo info;
608         seccomp_init_siginfo(&info, syscall, reason);
609         force_sig_info(SIGSYS, &info, current);
610 }
611 #endif  /* CONFIG_SECCOMP_FILTER */
612
613 /* For use with seccomp_actions_logged */
614 #define SECCOMP_LOG_KILL_PROCESS        (1 << 0)
615 #define SECCOMP_LOG_KILL_THREAD         (1 << 1)
616 #define SECCOMP_LOG_TRAP                (1 << 2)
617 #define SECCOMP_LOG_ERRNO               (1 << 3)
618 #define SECCOMP_LOG_TRACE               (1 << 4)
619 #define SECCOMP_LOG_LOG                 (1 << 5)
620 #define SECCOMP_LOG_ALLOW               (1 << 6)
621 #define SECCOMP_LOG_USER_NOTIF          (1 << 7)
622
623 static u32 seccomp_actions_logged = SECCOMP_LOG_KILL_PROCESS |
624                                     SECCOMP_LOG_KILL_THREAD  |
625                                     SECCOMP_LOG_TRAP  |
626                                     SECCOMP_LOG_ERRNO |
627                                     SECCOMP_LOG_USER_NOTIF |
628                                     SECCOMP_LOG_TRACE |
629                                     SECCOMP_LOG_LOG;
630
631 static inline void seccomp_log(unsigned long syscall, long signr, u32 action,
632                                bool requested)
633 {
634         bool log = false;
635
636         switch (action) {
637         case SECCOMP_RET_ALLOW:
638                 break;
639         case SECCOMP_RET_TRAP:
640                 log = requested && seccomp_actions_logged & SECCOMP_LOG_TRAP;
641                 break;
642         case SECCOMP_RET_ERRNO:
643                 log = requested && seccomp_actions_logged & SECCOMP_LOG_ERRNO;
644                 break;
645         case SECCOMP_RET_TRACE:
646                 log = requested && seccomp_actions_logged & SECCOMP_LOG_TRACE;
647                 break;
648         case SECCOMP_RET_USER_NOTIF:
649                 log = requested && seccomp_actions_logged & SECCOMP_LOG_USER_NOTIF;
650                 break;
651         case SECCOMP_RET_LOG:
652                 log = seccomp_actions_logged & SECCOMP_LOG_LOG;
653                 break;
654         case SECCOMP_RET_KILL_THREAD:
655                 log = seccomp_actions_logged & SECCOMP_LOG_KILL_THREAD;
656                 break;
657         case SECCOMP_RET_KILL_PROCESS:
658         default:
659                 log = seccomp_actions_logged & SECCOMP_LOG_KILL_PROCESS;
660         }
661
662         /*
663          * Emit an audit message when the action is RET_KILL_*, RET_LOG, or the
664          * FILTER_FLAG_LOG bit was set. The admin has the ability to silence
665          * any action from being logged by removing the action name from the
666          * seccomp_actions_logged sysctl.
667          */
668         if (!log)
669                 return;
670
671         audit_seccomp(syscall, signr, action);
672 }
673
674 /*
675  * Secure computing mode 1 allows only read/write/exit/sigreturn.
676  * To be fully secure this must be combined with rlimit
677  * to limit the stack allocations too.
678  */
679 static const int mode1_syscalls[] = {
680         __NR_seccomp_read, __NR_seccomp_write, __NR_seccomp_exit, __NR_seccomp_sigreturn,
681         0, /* null terminated */
682 };
683
684 static void __secure_computing_strict(int this_syscall)
685 {
686         const int *syscall_whitelist = mode1_syscalls;
687 #ifdef CONFIG_COMPAT
688         if (in_compat_syscall())
689                 syscall_whitelist = get_compat_mode1_syscalls();
690 #endif
691         do {
692                 if (*syscall_whitelist == this_syscall)
693                         return;
694         } while (*++syscall_whitelist);
695
696 #ifdef SECCOMP_DEBUG
697         dump_stack();
698 #endif
699         seccomp_log(this_syscall, SIGKILL, SECCOMP_RET_KILL_THREAD, true);
700         do_exit(SIGKILL);
701 }
702
703 #ifndef CONFIG_HAVE_ARCH_SECCOMP_FILTER
704 void secure_computing_strict(int this_syscall)
705 {
706         int mode = current->seccomp.mode;
707
708         if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) &&
709             unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
710                 return;
711
712         if (mode == SECCOMP_MODE_DISABLED)
713                 return;
714         else if (mode == SECCOMP_MODE_STRICT)
715                 __secure_computing_strict(this_syscall);
716         else
717                 BUG();
718 }
719 #else
720
721 #ifdef CONFIG_SECCOMP_FILTER
722 static u64 seccomp_next_notify_id(struct seccomp_filter *filter)
723 {
724         /*
725          * Note: overflow is ok here, the id just needs to be unique per
726          * filter.
727          */
728         lockdep_assert_held(&filter->notify_lock);
729         return filter->notif->next_id++;
730 }
731
732 static void seccomp_do_user_notification(int this_syscall,
733                                          struct seccomp_filter *match,
734                                          const struct seccomp_data *sd)
735 {
736         int err;
737         long ret = 0;
738         struct seccomp_knotif n = {};
739
740         mutex_lock(&match->notify_lock);
741         err = -ENOSYS;
742         if (!match->notif)
743                 goto out;
744
745         n.task = current;
746         n.state = SECCOMP_NOTIFY_INIT;
747         n.data = sd;
748         n.id = seccomp_next_notify_id(match);
749         init_completion(&n.ready);
750         list_add(&n.list, &match->notif->notifications);
751
752         up(&match->notif->request);
753         wake_up_poll(&match->notif->wqh, EPOLLIN | EPOLLRDNORM);
754         mutex_unlock(&match->notify_lock);
755
756         /*
757          * This is where we wait for a reply from userspace.
758          */
759         err = wait_for_completion_interruptible(&n.ready);
760         mutex_lock(&match->notify_lock);
761         if (err == 0) {
762                 ret = n.val;
763                 err = n.error;
764         }
765
766         /*
767          * Note that it's possible the listener died in between the time when
768          * we were notified of a respons (or a signal) and when we were able to
769          * re-acquire the lock, so only delete from the list if the
770          * notification actually exists.
771          *
772          * Also note that this test is only valid because there's no way to
773          * *reattach* to a notifier right now. If one is added, we'll need to
774          * keep track of the notif itself and make sure they match here.
775          */
776         if (match->notif)
777                 list_del(&n.list);
778 out:
779         mutex_unlock(&match->notify_lock);
780         syscall_set_return_value(current, task_pt_regs(current),
781                                  err, ret);
782 }
783
784 static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
785                             const bool recheck_after_trace)
786 {
787         u32 filter_ret, action;
788         struct seccomp_filter *match = NULL;
789         int data;
790         struct seccomp_data sd_local;
791
792         /*
793          * Make sure that any changes to mode from another thread have
794          * been seen after TIF_SECCOMP was seen.
795          */
796         rmb();
797
798         if (!sd) {
799                 populate_seccomp_data(&sd_local);
800                 sd = &sd_local;
801         }
802
803         filter_ret = seccomp_run_filters(sd, &match);
804         data = filter_ret & SECCOMP_RET_DATA;
805         action = filter_ret & SECCOMP_RET_ACTION_FULL;
806
807         switch (action) {
808         case SECCOMP_RET_ERRNO:
809                 /* Set low-order bits as an errno, capped at MAX_ERRNO. */
810                 if (data > MAX_ERRNO)
811                         data = MAX_ERRNO;
812                 syscall_set_return_value(current, task_pt_regs(current),
813                                          -data, 0);
814                 goto skip;
815
816         case SECCOMP_RET_TRAP:
817                 /* Show the handler the original registers. */
818                 syscall_rollback(current, task_pt_regs(current));
819                 /* Let the filter pass back 16 bits of data. */
820                 seccomp_send_sigsys(this_syscall, data);
821                 goto skip;
822
823         case SECCOMP_RET_TRACE:
824                 /* We've been put in this state by the ptracer already. */
825                 if (recheck_after_trace)
826                         return 0;
827
828                 /* ENOSYS these calls if there is no tracer attached. */
829                 if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP)) {
830                         syscall_set_return_value(current,
831                                                  task_pt_regs(current),
832                                                  -ENOSYS, 0);
833                         goto skip;
834                 }
835
836                 /* Allow the BPF to provide the event message */
837                 ptrace_event(PTRACE_EVENT_SECCOMP, data);
838                 /*
839                  * The delivery of a fatal signal during event
840                  * notification may silently skip tracer notification,
841                  * which could leave us with a potentially unmodified
842                  * syscall that the tracer would have liked to have
843                  * changed. Since the process is about to die, we just
844                  * force the syscall to be skipped and let the signal
845                  * kill the process and correctly handle any tracer exit
846                  * notifications.
847                  */
848                 if (fatal_signal_pending(current))
849                         goto skip;
850                 /* Check if the tracer forced the syscall to be skipped. */
851                 this_syscall = syscall_get_nr(current, task_pt_regs(current));
852                 if (this_syscall < 0)
853                         goto skip;
854
855                 /*
856                  * Recheck the syscall, since it may have changed. This
857                  * intentionally uses a NULL struct seccomp_data to force
858                  * a reload of all registers. This does not goto skip since
859                  * a skip would have already been reported.
860                  */
861                 if (__seccomp_filter(this_syscall, NULL, true))
862                         return -1;
863
864                 return 0;
865
866         case SECCOMP_RET_USER_NOTIF:
867                 seccomp_do_user_notification(this_syscall, match, sd);
868                 goto skip;
869
870         case SECCOMP_RET_LOG:
871                 seccomp_log(this_syscall, 0, action, true);
872                 return 0;
873
874         case SECCOMP_RET_ALLOW:
875                 /*
876                  * Note that the "match" filter will always be NULL for
877                  * this action since SECCOMP_RET_ALLOW is the starting
878                  * state in seccomp_run_filters().
879                  */
880                 return 0;
881
882         case SECCOMP_RET_KILL_THREAD:
883         case SECCOMP_RET_KILL_PROCESS:
884         default:
885                 seccomp_log(this_syscall, SIGSYS, action, true);
886                 /* Dump core only if this is the last remaining thread. */
887                 if (action == SECCOMP_RET_KILL_PROCESS ||
888                     get_nr_threads(current) == 1) {
889                         kernel_siginfo_t info;
890
891                         /* Show the original registers in the dump. */
892                         syscall_rollback(current, task_pt_regs(current));
893                         /* Trigger a manual coredump since do_exit skips it. */
894                         seccomp_init_siginfo(&info, this_syscall, data);
895                         do_coredump(&info);
896                 }
897                 if (action == SECCOMP_RET_KILL_PROCESS)
898                         do_group_exit(SIGSYS);
899                 else
900                         do_exit(SIGSYS);
901         }
902
903         unreachable();
904
905 skip:
906         seccomp_log(this_syscall, 0, action, match ? match->log : false);
907         return -1;
908 }
909 #else
910 static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
911                             const bool recheck_after_trace)
912 {
913         BUG();
914 }
915 #endif
916
917 int __secure_computing(const struct seccomp_data *sd)
918 {
919         int mode = current->seccomp.mode;
920         int this_syscall;
921
922         if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) &&
923             unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
924                 return 0;
925
926         this_syscall = sd ? sd->nr :
927                 syscall_get_nr(current, task_pt_regs(current));
928
929         switch (mode) {
930         case SECCOMP_MODE_STRICT:
931                 __secure_computing_strict(this_syscall);  /* may call do_exit */
932                 return 0;
933         case SECCOMP_MODE_FILTER:
934                 return __seccomp_filter(this_syscall, sd, false);
935         default:
936                 BUG();
937         }
938 }
939 #endif /* CONFIG_HAVE_ARCH_SECCOMP_FILTER */
940
941 long prctl_get_seccomp(void)
942 {
943         return current->seccomp.mode;
944 }
945
946 /**
947  * seccomp_set_mode_strict: internal function for setting strict seccomp
948  *
949  * Once current->seccomp.mode is non-zero, it may not be changed.
950  *
951  * Returns 0 on success or -EINVAL on failure.
952  */
953 static long seccomp_set_mode_strict(void)
954 {
955         const unsigned long seccomp_mode = SECCOMP_MODE_STRICT;
956         long ret = -EINVAL;
957
958         spin_lock_irq(&current->sighand->siglock);
959
960         if (!seccomp_may_assign_mode(seccomp_mode))
961                 goto out;
962
963 #ifdef TIF_NOTSC
964         disable_TSC();
965 #endif
966         seccomp_assign_mode(current, seccomp_mode, 0);
967         ret = 0;
968
969 out:
970         spin_unlock_irq(&current->sighand->siglock);
971
972         return ret;
973 }
974
975 #ifdef CONFIG_SECCOMP_FILTER
976 static int seccomp_notify_release(struct inode *inode, struct file *file)
977 {
978         struct seccomp_filter *filter = file->private_data;
979         struct seccomp_knotif *knotif;
980
981         if (!filter)
982                 return 0;
983
984         mutex_lock(&filter->notify_lock);
985
986         /*
987          * If this file is being closed because e.g. the task who owned it
988          * died, let's wake everyone up who was waiting on us.
989          */
990         list_for_each_entry(knotif, &filter->notif->notifications, list) {
991                 if (knotif->state == SECCOMP_NOTIFY_REPLIED)
992                         continue;
993
994                 knotif->state = SECCOMP_NOTIFY_REPLIED;
995                 knotif->error = -ENOSYS;
996                 knotif->val = 0;
997
998                 complete(&knotif->ready);
999         }
1000
1001         kfree(filter->notif);
1002         filter->notif = NULL;
1003         mutex_unlock(&filter->notify_lock);
1004         __put_seccomp_filter(filter);
1005         return 0;
1006 }
1007
1008 static long seccomp_notify_recv(struct seccomp_filter *filter,
1009                                 void __user *buf)
1010 {
1011         struct seccomp_knotif *knotif = NULL, *cur;
1012         struct seccomp_notif unotif;
1013         ssize_t ret;
1014
1015         memset(&unotif, 0, sizeof(unotif));
1016
1017         ret = down_interruptible(&filter->notif->request);
1018         if (ret < 0)
1019                 return ret;
1020
1021         mutex_lock(&filter->notify_lock);
1022         list_for_each_entry(cur, &filter->notif->notifications, list) {
1023                 if (cur->state == SECCOMP_NOTIFY_INIT) {
1024                         knotif = cur;
1025                         break;
1026                 }
1027         }
1028
1029         /*
1030          * If we didn't find a notification, it could be that the task was
1031          * interrupted by a fatal signal between the time we were woken and
1032          * when we were able to acquire the rw lock.
1033          */
1034         if (!knotif) {
1035                 ret = -ENOENT;
1036                 goto out;
1037         }
1038
1039         unotif.id = knotif->id;
1040         unotif.pid = task_pid_vnr(knotif->task);
1041         unotif.data = *(knotif->data);
1042
1043         knotif->state = SECCOMP_NOTIFY_SENT;
1044         wake_up_poll(&filter->notif->wqh, EPOLLOUT | EPOLLWRNORM);
1045         ret = 0;
1046 out:
1047         mutex_unlock(&filter->notify_lock);
1048
1049         if (ret == 0 && copy_to_user(buf, &unotif, sizeof(unotif))) {
1050                 ret = -EFAULT;
1051
1052                 /*
1053                  * Userspace screwed up. To make sure that we keep this
1054                  * notification alive, let's reset it back to INIT. It
1055                  * may have died when we released the lock, so we need to make
1056                  * sure it's still around.
1057                  */
1058                 knotif = NULL;
1059                 mutex_lock(&filter->notify_lock);
1060                 list_for_each_entry(cur, &filter->notif->notifications, list) {
1061                         if (cur->id == unotif.id) {
1062                                 knotif = cur;
1063                                 break;
1064                         }
1065                 }
1066
1067                 if (knotif) {
1068                         knotif->state = SECCOMP_NOTIFY_INIT;
1069                         up(&filter->notif->request);
1070                 }
1071                 mutex_unlock(&filter->notify_lock);
1072         }
1073
1074         return ret;
1075 }
1076
1077 static long seccomp_notify_send(struct seccomp_filter *filter,
1078                                 void __user *buf)
1079 {
1080         struct seccomp_notif_resp resp = {};
1081         struct seccomp_knotif *knotif = NULL, *cur;
1082         long ret;
1083
1084         if (copy_from_user(&resp, buf, sizeof(resp)))
1085                 return -EFAULT;
1086
1087         if (resp.flags)
1088                 return -EINVAL;
1089
1090         ret = mutex_lock_interruptible(&filter->notify_lock);
1091         if (ret < 0)
1092                 return ret;
1093
1094         list_for_each_entry(cur, &filter->notif->notifications, list) {
1095                 if (cur->id == resp.id) {
1096                         knotif = cur;
1097                         break;
1098                 }
1099         }
1100
1101         if (!knotif) {
1102                 ret = -ENOENT;
1103                 goto out;
1104         }
1105
1106         /* Allow exactly one reply. */
1107         if (knotif->state != SECCOMP_NOTIFY_SENT) {
1108                 ret = -EINPROGRESS;
1109                 goto out;
1110         }
1111
1112         ret = 0;
1113         knotif->state = SECCOMP_NOTIFY_REPLIED;
1114         knotif->error = resp.error;
1115         knotif->val = resp.val;
1116         complete(&knotif->ready);
1117 out:
1118         mutex_unlock(&filter->notify_lock);
1119         return ret;
1120 }
1121
1122 static long seccomp_notify_id_valid(struct seccomp_filter *filter,
1123                                     void __user *buf)
1124 {
1125         struct seccomp_knotif *knotif = NULL;
1126         u64 id;
1127         long ret;
1128
1129         if (copy_from_user(&id, buf, sizeof(id)))
1130                 return -EFAULT;
1131
1132         ret = mutex_lock_interruptible(&filter->notify_lock);
1133         if (ret < 0)
1134                 return ret;
1135
1136         ret = -ENOENT;
1137         list_for_each_entry(knotif, &filter->notif->notifications, list) {
1138                 if (knotif->id == id) {
1139                         if (knotif->state == SECCOMP_NOTIFY_SENT)
1140                                 ret = 0;
1141                         goto out;
1142                 }
1143         }
1144
1145 out:
1146         mutex_unlock(&filter->notify_lock);
1147         return ret;
1148 }
1149
1150 static long seccomp_notify_ioctl(struct file *file, unsigned int cmd,
1151                                  unsigned long arg)
1152 {
1153         struct seccomp_filter *filter = file->private_data;
1154         void __user *buf = (void __user *)arg;
1155
1156         switch (cmd) {
1157         case SECCOMP_IOCTL_NOTIF_RECV:
1158                 return seccomp_notify_recv(filter, buf);
1159         case SECCOMP_IOCTL_NOTIF_SEND:
1160                 return seccomp_notify_send(filter, buf);
1161         case SECCOMP_IOCTL_NOTIF_ID_VALID:
1162                 return seccomp_notify_id_valid(filter, buf);
1163         default:
1164                 return -EINVAL;
1165         }
1166 }
1167
1168 static __poll_t seccomp_notify_poll(struct file *file,
1169                                     struct poll_table_struct *poll_tab)
1170 {
1171         struct seccomp_filter *filter = file->private_data;
1172         __poll_t ret = 0;
1173         struct seccomp_knotif *cur;
1174
1175         poll_wait(file, &filter->notif->wqh, poll_tab);
1176
1177         if (mutex_lock_interruptible(&filter->notify_lock) < 0)
1178                 return EPOLLERR;
1179
1180         list_for_each_entry(cur, &filter->notif->notifications, list) {
1181                 if (cur->state == SECCOMP_NOTIFY_INIT)
1182                         ret |= EPOLLIN | EPOLLRDNORM;
1183                 if (cur->state == SECCOMP_NOTIFY_SENT)
1184                         ret |= EPOLLOUT | EPOLLWRNORM;
1185                 if ((ret & EPOLLIN) && (ret & EPOLLOUT))
1186                         break;
1187         }
1188
1189         mutex_unlock(&filter->notify_lock);
1190
1191         return ret;
1192 }
1193
1194 static const struct file_operations seccomp_notify_ops = {
1195         .poll = seccomp_notify_poll,
1196         .release = seccomp_notify_release,
1197         .unlocked_ioctl = seccomp_notify_ioctl,
1198 };
1199
1200 static struct file *init_listener(struct seccomp_filter *filter)
1201 {
1202         struct file *ret = ERR_PTR(-EBUSY);
1203         struct seccomp_filter *cur;
1204
1205         for (cur = current->seccomp.filter; cur; cur = cur->prev) {
1206                 if (cur->notif)
1207                         goto out;
1208         }
1209
1210         ret = ERR_PTR(-ENOMEM);
1211         filter->notif = kzalloc(sizeof(*(filter->notif)), GFP_KERNEL);
1212         if (!filter->notif)
1213                 goto out;
1214
1215         sema_init(&filter->notif->request, 0);
1216         filter->notif->next_id = get_random_u64();
1217         INIT_LIST_HEAD(&filter->notif->notifications);
1218         init_waitqueue_head(&filter->notif->wqh);
1219
1220         ret = anon_inode_getfile("seccomp notify", &seccomp_notify_ops,
1221                                  filter, O_RDWR);
1222         if (IS_ERR(ret))
1223                 goto out_notif;
1224
1225         /* The file has a reference to it now */
1226         __get_seccomp_filter(filter);
1227
1228 out_notif:
1229         if (IS_ERR(ret))
1230                 kfree(filter->notif);
1231 out:
1232         return ret;
1233 }
1234
1235 /**
1236  * seccomp_set_mode_filter: internal function for setting seccomp filter
1237  * @flags:  flags to change filter behavior
1238  * @filter: struct sock_fprog containing filter
1239  *
1240  * This function may be called repeatedly to install additional filters.
1241  * Every filter successfully installed will be evaluated (in reverse order)
1242  * for each system call the task makes.
1243  *
1244  * Once current->seccomp.mode is non-zero, it may not be changed.
1245  *
1246  * Returns 0 on success or -EINVAL on failure.
1247  */
1248 static long seccomp_set_mode_filter(unsigned int flags,
1249                                     const char __user *filter)
1250 {
1251         const unsigned long seccomp_mode = SECCOMP_MODE_FILTER;
1252         struct seccomp_filter *prepared = NULL;
1253         long ret = -EINVAL;
1254         int listener = -1;
1255         struct file *listener_f = NULL;
1256
1257         /* Validate flags. */
1258         if (flags & ~SECCOMP_FILTER_FLAG_MASK)
1259                 return -EINVAL;
1260
1261         /* Prepare the new filter before holding any locks. */
1262         prepared = seccomp_prepare_user_filter(filter);
1263         if (IS_ERR(prepared))
1264                 return PTR_ERR(prepared);
1265
1266         if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) {
1267                 listener = get_unused_fd_flags(O_CLOEXEC);
1268                 if (listener < 0) {
1269                         ret = listener;
1270                         goto out_free;
1271                 }
1272
1273                 listener_f = init_listener(prepared);
1274                 if (IS_ERR(listener_f)) {
1275                         put_unused_fd(listener);
1276                         ret = PTR_ERR(listener_f);
1277                         goto out_free;
1278                 }
1279         }
1280
1281         /*
1282          * Make sure we cannot change seccomp or nnp state via TSYNC
1283          * while another thread is in the middle of calling exec.
1284          */
1285         if (flags & SECCOMP_FILTER_FLAG_TSYNC &&
1286             mutex_lock_killable(&current->signal->cred_guard_mutex))
1287                 goto out_put_fd;
1288
1289         spin_lock_irq(&current->sighand->siglock);
1290
1291         if (!seccomp_may_assign_mode(seccomp_mode))
1292                 goto out;
1293
1294         ret = seccomp_attach_filter(flags, prepared);
1295         if (ret)
1296                 goto out;
1297         /* Do not free the successfully attached filter. */
1298         prepared = NULL;
1299
1300         seccomp_assign_mode(current, seccomp_mode, flags);
1301 out:
1302         spin_unlock_irq(&current->sighand->siglock);
1303         if (flags & SECCOMP_FILTER_FLAG_TSYNC)
1304                 mutex_unlock(&current->signal->cred_guard_mutex);
1305 out_put_fd:
1306         if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) {
1307                 if (ret < 0) {
1308                         listener_f->private_data = NULL;
1309                         fput(listener_f);
1310                         put_unused_fd(listener);
1311                 } else {
1312                         fd_install(listener, listener_f);
1313                         ret = listener;
1314                 }
1315         }
1316 out_free:
1317         seccomp_filter_free(prepared);
1318         return ret;
1319 }
1320 #else
1321 static inline long seccomp_set_mode_filter(unsigned int flags,
1322                                            const char __user *filter)
1323 {
1324         return -EINVAL;
1325 }
1326 #endif
1327
1328 static long seccomp_get_action_avail(const char __user *uaction)
1329 {
1330         u32 action;
1331
1332         if (copy_from_user(&action, uaction, sizeof(action)))
1333                 return -EFAULT;
1334
1335         switch (action) {
1336         case SECCOMP_RET_KILL_PROCESS:
1337         case SECCOMP_RET_KILL_THREAD:
1338         case SECCOMP_RET_TRAP:
1339         case SECCOMP_RET_ERRNO:
1340         case SECCOMP_RET_USER_NOTIF:
1341         case SECCOMP_RET_TRACE:
1342         case SECCOMP_RET_LOG:
1343         case SECCOMP_RET_ALLOW:
1344                 break;
1345         default:
1346                 return -EOPNOTSUPP;
1347         }
1348
1349         return 0;
1350 }
1351
1352 static long seccomp_get_notif_sizes(void __user *usizes)
1353 {
1354         struct seccomp_notif_sizes sizes = {
1355                 .seccomp_notif = sizeof(struct seccomp_notif),
1356                 .seccomp_notif_resp = sizeof(struct seccomp_notif_resp),
1357                 .seccomp_data = sizeof(struct seccomp_data),
1358         };
1359
1360         if (copy_to_user(usizes, &sizes, sizeof(sizes)))
1361                 return -EFAULT;
1362
1363         return 0;
1364 }
1365
1366 /* Common entry point for both prctl and syscall. */
1367 static long do_seccomp(unsigned int op, unsigned int flags,
1368                        void __user *uargs)
1369 {
1370         switch (op) {
1371         case SECCOMP_SET_MODE_STRICT:
1372                 if (flags != 0 || uargs != NULL)
1373                         return -EINVAL;
1374                 return seccomp_set_mode_strict();
1375         case SECCOMP_SET_MODE_FILTER:
1376                 return seccomp_set_mode_filter(flags, uargs);
1377         case SECCOMP_GET_ACTION_AVAIL:
1378                 if (flags != 0)
1379                         return -EINVAL;
1380
1381                 return seccomp_get_action_avail(uargs);
1382         case SECCOMP_GET_NOTIF_SIZES:
1383                 if (flags != 0)
1384                         return -EINVAL;
1385
1386                 return seccomp_get_notif_sizes(uargs);
1387         default:
1388                 return -EINVAL;
1389         }
1390 }
1391
1392 SYSCALL_DEFINE3(seccomp, unsigned int, op, unsigned int, flags,
1393                          void __user *, uargs)
1394 {
1395         return do_seccomp(op, flags, uargs);
1396 }
1397
1398 /**
1399  * prctl_set_seccomp: configures current->seccomp.mode
1400  * @seccomp_mode: requested mode to use
1401  * @filter: optional struct sock_fprog for use with SECCOMP_MODE_FILTER
1402  *
1403  * Returns 0 on success or -EINVAL on failure.
1404  */
1405 long prctl_set_seccomp(unsigned long seccomp_mode, void __user *filter)
1406 {
1407         unsigned int op;
1408         void __user *uargs;
1409
1410         switch (seccomp_mode) {
1411         case SECCOMP_MODE_STRICT:
1412                 op = SECCOMP_SET_MODE_STRICT;
1413                 /*
1414                  * Setting strict mode through prctl always ignored filter,
1415                  * so make sure it is always NULL here to pass the internal
1416                  * check in do_seccomp().
1417                  */
1418                 uargs = NULL;
1419                 break;
1420         case SECCOMP_MODE_FILTER:
1421                 op = SECCOMP_SET_MODE_FILTER;
1422                 uargs = filter;
1423                 break;
1424         default:
1425                 return -EINVAL;
1426         }
1427
1428         /* prctl interface doesn't have flags, so they are always zero. */
1429         return do_seccomp(op, 0, uargs);
1430 }
1431
1432 #if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
1433 static struct seccomp_filter *get_nth_filter(struct task_struct *task,
1434                                              unsigned long filter_off)
1435 {
1436         struct seccomp_filter *orig, *filter;
1437         unsigned long count;
1438
1439         /*
1440          * Note: this is only correct because the caller should be the (ptrace)
1441          * tracer of the task, otherwise lock_task_sighand is needed.
1442          */
1443         spin_lock_irq(&task->sighand->siglock);
1444
1445         if (task->seccomp.mode != SECCOMP_MODE_FILTER) {
1446                 spin_unlock_irq(&task->sighand->siglock);
1447                 return ERR_PTR(-EINVAL);
1448         }
1449
1450         orig = task->seccomp.filter;
1451         __get_seccomp_filter(orig);
1452         spin_unlock_irq(&task->sighand->siglock);
1453
1454         count = 0;
1455         for (filter = orig; filter; filter = filter->prev)
1456                 count++;
1457
1458         if (filter_off >= count) {
1459                 filter = ERR_PTR(-ENOENT);
1460                 goto out;
1461         }
1462
1463         count -= filter_off;
1464         for (filter = orig; filter && count > 1; filter = filter->prev)
1465                 count--;
1466
1467         if (WARN_ON(count != 1 || !filter)) {
1468                 filter = ERR_PTR(-ENOENT);
1469                 goto out;
1470         }
1471
1472         __get_seccomp_filter(filter);
1473
1474 out:
1475         __put_seccomp_filter(orig);
1476         return filter;
1477 }
1478
1479 long seccomp_get_filter(struct task_struct *task, unsigned long filter_off,
1480                         void __user *data)
1481 {
1482         struct seccomp_filter *filter;
1483         struct sock_fprog_kern *fprog;
1484         long ret;
1485
1486         if (!capable(CAP_SYS_ADMIN) ||
1487             current->seccomp.mode != SECCOMP_MODE_DISABLED) {
1488                 return -EACCES;
1489         }
1490
1491         filter = get_nth_filter(task, filter_off);
1492         if (IS_ERR(filter))
1493                 return PTR_ERR(filter);
1494
1495         fprog = filter->prog->orig_prog;
1496         if (!fprog) {
1497                 /* This must be a new non-cBPF filter, since we save
1498                  * every cBPF filter's orig_prog above when
1499                  * CONFIG_CHECKPOINT_RESTORE is enabled.
1500                  */
1501                 ret = -EMEDIUMTYPE;
1502                 goto out;
1503         }
1504
1505         ret = fprog->len;
1506         if (!data)
1507                 goto out;
1508
1509         if (copy_to_user(data, fprog->filter, bpf_classic_proglen(fprog)))
1510                 ret = -EFAULT;
1511
1512 out:
1513         __put_seccomp_filter(filter);
1514         return ret;
1515 }
1516
1517 long seccomp_get_metadata(struct task_struct *task,
1518                           unsigned long size, void __user *data)
1519 {
1520         long ret;
1521         struct seccomp_filter *filter;
1522         struct seccomp_metadata kmd = {};
1523
1524         if (!capable(CAP_SYS_ADMIN) ||
1525             current->seccomp.mode != SECCOMP_MODE_DISABLED) {
1526                 return -EACCES;
1527         }
1528
1529         size = min_t(unsigned long, size, sizeof(kmd));
1530
1531         if (size < sizeof(kmd.filter_off))
1532                 return -EINVAL;
1533
1534         if (copy_from_user(&kmd.filter_off, data, sizeof(kmd.filter_off)))
1535                 return -EFAULT;
1536
1537         filter = get_nth_filter(task, kmd.filter_off);
1538         if (IS_ERR(filter))
1539                 return PTR_ERR(filter);
1540
1541         if (filter->log)
1542                 kmd.flags |= SECCOMP_FILTER_FLAG_LOG;
1543
1544         ret = size;
1545         if (copy_to_user(data, &kmd, size))
1546                 ret = -EFAULT;
1547
1548         __put_seccomp_filter(filter);
1549         return ret;
1550 }
1551 #endif
1552
1553 #ifdef CONFIG_SYSCTL
1554
1555 /* Human readable action names for friendly sysctl interaction */
1556 #define SECCOMP_RET_KILL_PROCESS_NAME   "kill_process"
1557 #define SECCOMP_RET_KILL_THREAD_NAME    "kill_thread"
1558 #define SECCOMP_RET_TRAP_NAME           "trap"
1559 #define SECCOMP_RET_ERRNO_NAME          "errno"
1560 #define SECCOMP_RET_USER_NOTIF_NAME     "user_notif"
1561 #define SECCOMP_RET_TRACE_NAME          "trace"
1562 #define SECCOMP_RET_LOG_NAME            "log"
1563 #define SECCOMP_RET_ALLOW_NAME          "allow"
1564
1565 static const char seccomp_actions_avail[] =
1566                                 SECCOMP_RET_KILL_PROCESS_NAME   " "
1567                                 SECCOMP_RET_KILL_THREAD_NAME    " "
1568                                 SECCOMP_RET_TRAP_NAME           " "
1569                                 SECCOMP_RET_ERRNO_NAME          " "
1570                                 SECCOMP_RET_USER_NOTIF_NAME     " "
1571                                 SECCOMP_RET_TRACE_NAME          " "
1572                                 SECCOMP_RET_LOG_NAME            " "
1573                                 SECCOMP_RET_ALLOW_NAME;
1574
1575 struct seccomp_log_name {
1576         u32             log;
1577         const char      *name;
1578 };
1579
1580 static const struct seccomp_log_name seccomp_log_names[] = {
1581         { SECCOMP_LOG_KILL_PROCESS, SECCOMP_RET_KILL_PROCESS_NAME },
1582         { SECCOMP_LOG_KILL_THREAD, SECCOMP_RET_KILL_THREAD_NAME },
1583         { SECCOMP_LOG_TRAP, SECCOMP_RET_TRAP_NAME },
1584         { SECCOMP_LOG_ERRNO, SECCOMP_RET_ERRNO_NAME },
1585         { SECCOMP_LOG_USER_NOTIF, SECCOMP_RET_USER_NOTIF_NAME },
1586         { SECCOMP_LOG_TRACE, SECCOMP_RET_TRACE_NAME },
1587         { SECCOMP_LOG_LOG, SECCOMP_RET_LOG_NAME },
1588         { SECCOMP_LOG_ALLOW, SECCOMP_RET_ALLOW_NAME },
1589         { }
1590 };
1591
1592 static bool seccomp_names_from_actions_logged(char *names, size_t size,
1593                                               u32 actions_logged,
1594                                               const char *sep)
1595 {
1596         const struct seccomp_log_name *cur;
1597         bool append_sep = false;
1598
1599         for (cur = seccomp_log_names; cur->name && size; cur++) {
1600                 ssize_t ret;
1601
1602                 if (!(actions_logged & cur->log))
1603                         continue;
1604
1605                 if (append_sep) {
1606                         ret = strscpy(names, sep, size);
1607                         if (ret < 0)
1608                                 return false;
1609
1610                         names += ret;
1611                         size -= ret;
1612                 } else
1613                         append_sep = true;
1614
1615                 ret = strscpy(names, cur->name, size);
1616                 if (ret < 0)
1617                         return false;
1618
1619                 names += ret;
1620                 size -= ret;
1621         }
1622
1623         return true;
1624 }
1625
1626 static bool seccomp_action_logged_from_name(u32 *action_logged,
1627                                             const char *name)
1628 {
1629         const struct seccomp_log_name *cur;
1630
1631         for (cur = seccomp_log_names; cur->name; cur++) {
1632                 if (!strcmp(cur->name, name)) {
1633                         *action_logged = cur->log;
1634                         return true;
1635                 }
1636         }
1637
1638         return false;
1639 }
1640
1641 static bool seccomp_actions_logged_from_names(u32 *actions_logged, char *names)
1642 {
1643         char *name;
1644
1645         *actions_logged = 0;
1646         while ((name = strsep(&names, " ")) && *name) {
1647                 u32 action_logged = 0;
1648
1649                 if (!seccomp_action_logged_from_name(&action_logged, name))
1650                         return false;
1651
1652                 *actions_logged |= action_logged;
1653         }
1654
1655         return true;
1656 }
1657
1658 static int read_actions_logged(struct ctl_table *ro_table, void __user *buffer,
1659                                size_t *lenp, loff_t *ppos)
1660 {
1661         char names[sizeof(seccomp_actions_avail)];
1662         struct ctl_table table;
1663
1664         memset(names, 0, sizeof(names));
1665
1666         if (!seccomp_names_from_actions_logged(names, sizeof(names),
1667                                                seccomp_actions_logged, " "))
1668                 return -EINVAL;
1669
1670         table = *ro_table;
1671         table.data = names;
1672         table.maxlen = sizeof(names);
1673         return proc_dostring(&table, 0, buffer, lenp, ppos);
1674 }
1675
1676 static int write_actions_logged(struct ctl_table *ro_table, void __user *buffer,
1677                                 size_t *lenp, loff_t *ppos, u32 *actions_logged)
1678 {
1679         char names[sizeof(seccomp_actions_avail)];
1680         struct ctl_table table;
1681         int ret;
1682
1683         if (!capable(CAP_SYS_ADMIN))
1684                 return -EPERM;
1685
1686         memset(names, 0, sizeof(names));
1687
1688         table = *ro_table;
1689         table.data = names;
1690         table.maxlen = sizeof(names);
1691         ret = proc_dostring(&table, 1, buffer, lenp, ppos);
1692         if (ret)
1693                 return ret;
1694
1695         if (!seccomp_actions_logged_from_names(actions_logged, table.data))
1696                 return -EINVAL;
1697
1698         if (*actions_logged & SECCOMP_LOG_ALLOW)
1699                 return -EINVAL;
1700
1701         seccomp_actions_logged = *actions_logged;
1702         return 0;
1703 }
1704
1705 static void audit_actions_logged(u32 actions_logged, u32 old_actions_logged,
1706                                  int ret)
1707 {
1708         char names[sizeof(seccomp_actions_avail)];
1709         char old_names[sizeof(seccomp_actions_avail)];
1710         const char *new = names;
1711         const char *old = old_names;
1712
1713         if (!audit_enabled)
1714                 return;
1715
1716         memset(names, 0, sizeof(names));
1717         memset(old_names, 0, sizeof(old_names));
1718
1719         if (ret)
1720                 new = "?";
1721         else if (!actions_logged)
1722                 new = "(none)";
1723         else if (!seccomp_names_from_actions_logged(names, sizeof(names),
1724                                                     actions_logged, ","))
1725                 new = "?";
1726
1727         if (!old_actions_logged)
1728                 old = "(none)";
1729         else if (!seccomp_names_from_actions_logged(old_names,
1730                                                     sizeof(old_names),
1731                                                     old_actions_logged, ","))
1732                 old = "?";
1733
1734         return audit_seccomp_actions_logged(new, old, !ret);
1735 }
1736
1737 static int seccomp_actions_logged_handler(struct ctl_table *ro_table, int write,
1738                                           void __user *buffer, size_t *lenp,
1739                                           loff_t *ppos)
1740 {
1741         int ret;
1742
1743         if (write) {
1744                 u32 actions_logged = 0;
1745                 u32 old_actions_logged = seccomp_actions_logged;
1746
1747                 ret = write_actions_logged(ro_table, buffer, lenp, ppos,
1748                                            &actions_logged);
1749                 audit_actions_logged(actions_logged, old_actions_logged, ret);
1750         } else
1751                 ret = read_actions_logged(ro_table, buffer, lenp, ppos);
1752
1753         return ret;
1754 }
1755
1756 static struct ctl_path seccomp_sysctl_path[] = {
1757         { .procname = "kernel", },
1758         { .procname = "seccomp", },
1759         { }
1760 };
1761
1762 static struct ctl_table seccomp_sysctl_table[] = {
1763         {
1764                 .procname       = "actions_avail",
1765                 .data           = (void *) &seccomp_actions_avail,
1766                 .maxlen         = sizeof(seccomp_actions_avail),
1767                 .mode           = 0444,
1768                 .proc_handler   = proc_dostring,
1769         },
1770         {
1771                 .procname       = "actions_logged",
1772                 .mode           = 0644,
1773                 .proc_handler   = seccomp_actions_logged_handler,
1774         },
1775         { }
1776 };
1777
1778 static int __init seccomp_sysctl_init(void)
1779 {
1780         struct ctl_table_header *hdr;
1781
1782         hdr = register_sysctl_paths(seccomp_sysctl_path, seccomp_sysctl_table);
1783         if (!hdr)
1784                 pr_warn("seccomp: sysctl registration failed\n");
1785         else
1786                 kmemleak_not_leak(hdr);
1787
1788         return 0;
1789 }
1790
1791 device_initcall(seccomp_sysctl_init)
1792
1793 #endif /* CONFIG_SYSCTL */