MAINTAINERS: remove Xavier as maintainer of HISILICON ROCE DRIVER
[linux-2.6-microblaze.git] / kernel / seccomp.c
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * linux/kernel/seccomp.c
4  *
5  * Copyright 2004-2005  Andrea Arcangeli <andrea@cpushare.com>
6  *
7  * Copyright (C) 2012 Google, Inc.
8  * Will Drewry <wad@chromium.org>
9  *
10  * This defines a simple but solid secure-computing facility.
11  *
12  * Mode 1 uses a fixed list of allowed system calls.
13  * Mode 2 allows user-defined system call filters in the form
14  *        of Berkeley Packet Filters/Linux Socket Filters.
15  */
16 #define pr_fmt(fmt) "seccomp: " fmt
17
18 #include <linux/refcount.h>
19 #include <linux/audit.h>
20 #include <linux/compat.h>
21 #include <linux/coredump.h>
22 #include <linux/kmemleak.h>
23 #include <linux/nospec.h>
24 #include <linux/prctl.h>
25 #include <linux/sched.h>
26 #include <linux/sched/task_stack.h>
27 #include <linux/seccomp.h>
28 #include <linux/slab.h>
29 #include <linux/syscalls.h>
30 #include <linux/sysctl.h>
31
32 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
33 #include <asm/syscall.h>
34 #endif
35
36 #ifdef CONFIG_SECCOMP_FILTER
37 #include <linux/file.h>
38 #include <linux/filter.h>
39 #include <linux/pid.h>
40 #include <linux/ptrace.h>
41 #include <linux/capability.h>
42 #include <linux/tracehook.h>
43 #include <linux/uaccess.h>
44 #include <linux/anon_inodes.h>
45 #include <linux/lockdep.h>
46
47 /*
48  * When SECCOMP_IOCTL_NOTIF_ID_VALID was first introduced, it had the
49  * wrong direction flag in the ioctl number. This is the broken one,
50  * which the kernel needs to keep supporting until all userspaces stop
51  * using the wrong command number.
52  */
53 #define SECCOMP_IOCTL_NOTIF_ID_VALID_WRONG_DIR  SECCOMP_IOR(2, __u64)
54
55 enum notify_state {
56         SECCOMP_NOTIFY_INIT,
57         SECCOMP_NOTIFY_SENT,
58         SECCOMP_NOTIFY_REPLIED,
59 };
60
61 struct seccomp_knotif {
62         /* The struct pid of the task whose filter triggered the notification */
63         struct task_struct *task;
64
65         /* The "cookie" for this request; this is unique for this filter. */
66         u64 id;
67
68         /*
69          * The seccomp data. This pointer is valid the entire time this
70          * notification is active, since it comes from __seccomp_filter which
71          * eclipses the entire lifecycle here.
72          */
73         const struct seccomp_data *data;
74
75         /*
76          * Notification states. When SECCOMP_RET_USER_NOTIF is returned, a
77          * struct seccomp_knotif is created and starts out in INIT. Once the
78          * handler reads the notification off of an FD, it transitions to SENT.
79          * If a signal is received the state transitions back to INIT and
80          * another message is sent. When the userspace handler replies, state
81          * transitions to REPLIED.
82          */
83         enum notify_state state;
84
85         /* The return values, only valid when in SECCOMP_NOTIFY_REPLIED */
86         int error;
87         long val;
88         u32 flags;
89
90         /*
91          * Signals when this has changed states, such as the listener
92          * dying, a new seccomp addfd message, or changing to REPLIED
93          */
94         struct completion ready;
95
96         struct list_head list;
97
98         /* outstanding addfd requests */
99         struct list_head addfd;
100 };
101
102 /**
103  * struct seccomp_kaddfd - container for seccomp_addfd ioctl messages
104  *
105  * @file: A reference to the file to install in the other task
106  * @fd: The fd number to install it at. If the fd number is -1, it means the
107  *      installing process should allocate the fd as normal.
108  * @flags: The flags for the new file descriptor. At the moment, only O_CLOEXEC
109  *         is allowed.
110  * @ret: The return value of the installing process. It is set to the fd num
111  *       upon success (>= 0).
112  * @completion: Indicates that the installing process has completed fd
113  *              installation, or gone away (either due to successful
114  *              reply, or signal)
115  *
116  */
117 struct seccomp_kaddfd {
118         struct file *file;
119         int fd;
120         unsigned int flags;
121
122         /* To only be set on reply */
123         int ret;
124         struct completion completion;
125         struct list_head list;
126 };
127
128 /**
129  * struct notification - container for seccomp userspace notifications. Since
130  * most seccomp filters will not have notification listeners attached and this
131  * structure is fairly large, we store the notification-specific stuff in a
132  * separate structure.
133  *
134  * @request: A semaphore that users of this notification can wait on for
135  *           changes. Actual reads and writes are still controlled with
136  *           filter->notify_lock.
137  * @next_id: The id of the next request.
138  * @notifications: A list of struct seccomp_knotif elements.
139  */
140 struct notification {
141         struct semaphore request;
142         u64 next_id;
143         struct list_head notifications;
144 };
145
146 #ifdef SECCOMP_ARCH_NATIVE
147 /**
148  * struct action_cache - per-filter cache of seccomp actions per
149  * arch/syscall pair
150  *
151  * @allow_native: A bitmap where each bit represents whether the
152  *                filter will always allow the syscall, for the
153  *                native architecture.
154  * @allow_compat: A bitmap where each bit represents whether the
155  *                filter will always allow the syscall, for the
156  *                compat architecture.
157  */
158 struct action_cache {
159         DECLARE_BITMAP(allow_native, SECCOMP_ARCH_NATIVE_NR);
160 #ifdef SECCOMP_ARCH_COMPAT
161         DECLARE_BITMAP(allow_compat, SECCOMP_ARCH_COMPAT_NR);
162 #endif
163 };
164 #else
165 struct action_cache { };
166
167 static inline bool seccomp_cache_check_allow(const struct seccomp_filter *sfilter,
168                                              const struct seccomp_data *sd)
169 {
170         return false;
171 }
172
173 static inline void seccomp_cache_prepare(struct seccomp_filter *sfilter)
174 {
175 }
176 #endif /* SECCOMP_ARCH_NATIVE */
177
178 /**
179  * struct seccomp_filter - container for seccomp BPF programs
180  *
181  * @refs: Reference count to manage the object lifetime.
182  *        A filter's reference count is incremented for each directly
183  *        attached task, once for the dependent filter, and if
184  *        requested for the user notifier. When @refs reaches zero,
185  *        the filter can be freed.
186  * @users: A filter's @users count is incremented for each directly
187  *         attached task (filter installation, fork(), thread_sync),
188  *         and once for the dependent filter (tracked in filter->prev).
189  *         When it reaches zero it indicates that no direct or indirect
190  *         users of that filter exist. No new tasks can get associated with
191  *         this filter after reaching 0. The @users count is always smaller
192  *         or equal to @refs. Hence, reaching 0 for @users does not mean
193  *         the filter can be freed.
194  * @cache: cache of arch/syscall mappings to actions
195  * @log: true if all actions except for SECCOMP_RET_ALLOW should be logged
196  * @prev: points to a previously installed, or inherited, filter
197  * @prog: the BPF program to evaluate
198  * @notif: the struct that holds all notification related information
199  * @notify_lock: A lock for all notification-related accesses.
200  * @wqh: A wait queue for poll if a notifier is in use.
201  *
202  * seccomp_filter objects are organized in a tree linked via the @prev
203  * pointer.  For any task, it appears to be a singly-linked list starting
204  * with current->seccomp.filter, the most recently attached or inherited filter.
205  * However, multiple filters may share a @prev node, by way of fork(), which
206  * results in a unidirectional tree existing in memory.  This is similar to
207  * how namespaces work.
208  *
209  * seccomp_filter objects should never be modified after being attached
210  * to a task_struct (other than @refs).
211  */
212 struct seccomp_filter {
213         refcount_t refs;
214         refcount_t users;
215         bool log;
216         struct action_cache cache;
217         struct seccomp_filter *prev;
218         struct bpf_prog *prog;
219         struct notification *notif;
220         struct mutex notify_lock;
221         wait_queue_head_t wqh;
222 };
223
224 /* Limit any path through the tree to 256KB worth of instructions. */
225 #define MAX_INSNS_PER_PATH ((1 << 18) / sizeof(struct sock_filter))
226
227 /*
228  * Endianness is explicitly ignored and left for BPF program authors to manage
229  * as per the specific architecture.
230  */
231 static void populate_seccomp_data(struct seccomp_data *sd)
232 {
233         /*
234          * Instead of using current_pt_reg(), we're already doing the work
235          * to safely fetch "current", so just use "task" everywhere below.
236          */
237         struct task_struct *task = current;
238         struct pt_regs *regs = task_pt_regs(task);
239         unsigned long args[6];
240
241         sd->nr = syscall_get_nr(task, regs);
242         sd->arch = syscall_get_arch(task);
243         syscall_get_arguments(task, regs, args);
244         sd->args[0] = args[0];
245         sd->args[1] = args[1];
246         sd->args[2] = args[2];
247         sd->args[3] = args[3];
248         sd->args[4] = args[4];
249         sd->args[5] = args[5];
250         sd->instruction_pointer = KSTK_EIP(task);
251 }
252
253 /**
254  *      seccomp_check_filter - verify seccomp filter code
255  *      @filter: filter to verify
256  *      @flen: length of filter
257  *
258  * Takes a previously checked filter (by bpf_check_classic) and
259  * redirects all filter code that loads struct sk_buff data
260  * and related data through seccomp_bpf_load.  It also
261  * enforces length and alignment checking of those loads.
262  *
263  * Returns 0 if the rule set is legal or -EINVAL if not.
264  */
265 static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen)
266 {
267         int pc;
268         for (pc = 0; pc < flen; pc++) {
269                 struct sock_filter *ftest = &filter[pc];
270                 u16 code = ftest->code;
271                 u32 k = ftest->k;
272
273                 switch (code) {
274                 case BPF_LD | BPF_W | BPF_ABS:
275                         ftest->code = BPF_LDX | BPF_W | BPF_ABS;
276                         /* 32-bit aligned and not out of bounds. */
277                         if (k >= sizeof(struct seccomp_data) || k & 3)
278                                 return -EINVAL;
279                         continue;
280                 case BPF_LD | BPF_W | BPF_LEN:
281                         ftest->code = BPF_LD | BPF_IMM;
282                         ftest->k = sizeof(struct seccomp_data);
283                         continue;
284                 case BPF_LDX | BPF_W | BPF_LEN:
285                         ftest->code = BPF_LDX | BPF_IMM;
286                         ftest->k = sizeof(struct seccomp_data);
287                         continue;
288                 /* Explicitly include allowed calls. */
289                 case BPF_RET | BPF_K:
290                 case BPF_RET | BPF_A:
291                 case BPF_ALU | BPF_ADD | BPF_K:
292                 case BPF_ALU | BPF_ADD | BPF_X:
293                 case BPF_ALU | BPF_SUB | BPF_K:
294                 case BPF_ALU | BPF_SUB | BPF_X:
295                 case BPF_ALU | BPF_MUL | BPF_K:
296                 case BPF_ALU | BPF_MUL | BPF_X:
297                 case BPF_ALU | BPF_DIV | BPF_K:
298                 case BPF_ALU | BPF_DIV | BPF_X:
299                 case BPF_ALU | BPF_AND | BPF_K:
300                 case BPF_ALU | BPF_AND | BPF_X:
301                 case BPF_ALU | BPF_OR | BPF_K:
302                 case BPF_ALU | BPF_OR | BPF_X:
303                 case BPF_ALU | BPF_XOR | BPF_K:
304                 case BPF_ALU | BPF_XOR | BPF_X:
305                 case BPF_ALU | BPF_LSH | BPF_K:
306                 case BPF_ALU | BPF_LSH | BPF_X:
307                 case BPF_ALU | BPF_RSH | BPF_K:
308                 case BPF_ALU | BPF_RSH | BPF_X:
309                 case BPF_ALU | BPF_NEG:
310                 case BPF_LD | BPF_IMM:
311                 case BPF_LDX | BPF_IMM:
312                 case BPF_MISC | BPF_TAX:
313                 case BPF_MISC | BPF_TXA:
314                 case BPF_LD | BPF_MEM:
315                 case BPF_LDX | BPF_MEM:
316                 case BPF_ST:
317                 case BPF_STX:
318                 case BPF_JMP | BPF_JA:
319                 case BPF_JMP | BPF_JEQ | BPF_K:
320                 case BPF_JMP | BPF_JEQ | BPF_X:
321                 case BPF_JMP | BPF_JGE | BPF_K:
322                 case BPF_JMP | BPF_JGE | BPF_X:
323                 case BPF_JMP | BPF_JGT | BPF_K:
324                 case BPF_JMP | BPF_JGT | BPF_X:
325                 case BPF_JMP | BPF_JSET | BPF_K:
326                 case BPF_JMP | BPF_JSET | BPF_X:
327                         continue;
328                 default:
329                         return -EINVAL;
330                 }
331         }
332         return 0;
333 }
334
335 #ifdef SECCOMP_ARCH_NATIVE
336 static inline bool seccomp_cache_check_allow_bitmap(const void *bitmap,
337                                                     size_t bitmap_size,
338                                                     int syscall_nr)
339 {
340         if (unlikely(syscall_nr < 0 || syscall_nr >= bitmap_size))
341                 return false;
342         syscall_nr = array_index_nospec(syscall_nr, bitmap_size);
343
344         return test_bit(syscall_nr, bitmap);
345 }
346
347 /**
348  * seccomp_cache_check_allow - lookup seccomp cache
349  * @sfilter: The seccomp filter
350  * @sd: The seccomp data to lookup the cache with
351  *
352  * Returns true if the seccomp_data is cached and allowed.
353  */
354 static inline bool seccomp_cache_check_allow(const struct seccomp_filter *sfilter,
355                                              const struct seccomp_data *sd)
356 {
357         int syscall_nr = sd->nr;
358         const struct action_cache *cache = &sfilter->cache;
359
360 #ifndef SECCOMP_ARCH_COMPAT
361         /* A native-only architecture doesn't need to check sd->arch. */
362         return seccomp_cache_check_allow_bitmap(cache->allow_native,
363                                                 SECCOMP_ARCH_NATIVE_NR,
364                                                 syscall_nr);
365 #else
366         if (likely(sd->arch == SECCOMP_ARCH_NATIVE))
367                 return seccomp_cache_check_allow_bitmap(cache->allow_native,
368                                                         SECCOMP_ARCH_NATIVE_NR,
369                                                         syscall_nr);
370         if (likely(sd->arch == SECCOMP_ARCH_COMPAT))
371                 return seccomp_cache_check_allow_bitmap(cache->allow_compat,
372                                                         SECCOMP_ARCH_COMPAT_NR,
373                                                         syscall_nr);
374 #endif /* SECCOMP_ARCH_COMPAT */
375
376         WARN_ON_ONCE(true);
377         return false;
378 }
379 #endif /* SECCOMP_ARCH_NATIVE */
380
381 /**
382  * seccomp_run_filters - evaluates all seccomp filters against @sd
383  * @sd: optional seccomp data to be passed to filters
384  * @match: stores struct seccomp_filter that resulted in the return value,
385  *         unless filter returned SECCOMP_RET_ALLOW, in which case it will
386  *         be unchanged.
387  *
388  * Returns valid seccomp BPF response codes.
389  */
390 #define ACTION_ONLY(ret) ((s32)((ret) & (SECCOMP_RET_ACTION_FULL)))
391 static u32 seccomp_run_filters(const struct seccomp_data *sd,
392                                struct seccomp_filter **match)
393 {
394         u32 ret = SECCOMP_RET_ALLOW;
395         /* Make sure cross-thread synced filter points somewhere sane. */
396         struct seccomp_filter *f =
397                         READ_ONCE(current->seccomp.filter);
398
399         /* Ensure unexpected behavior doesn't result in failing open. */
400         if (WARN_ON(f == NULL))
401                 return SECCOMP_RET_KILL_PROCESS;
402
403         if (seccomp_cache_check_allow(f, sd))
404                 return SECCOMP_RET_ALLOW;
405
406         /*
407          * All filters in the list are evaluated and the lowest BPF return
408          * value always takes priority (ignoring the DATA).
409          */
410         for (; f; f = f->prev) {
411                 u32 cur_ret = bpf_prog_run_pin_on_cpu(f->prog, sd);
412
413                 if (ACTION_ONLY(cur_ret) < ACTION_ONLY(ret)) {
414                         ret = cur_ret;
415                         *match = f;
416                 }
417         }
418         return ret;
419 }
420 #endif /* CONFIG_SECCOMP_FILTER */
421
422 static inline bool seccomp_may_assign_mode(unsigned long seccomp_mode)
423 {
424         assert_spin_locked(&current->sighand->siglock);
425
426         if (current->seccomp.mode && current->seccomp.mode != seccomp_mode)
427                 return false;
428
429         return true;
430 }
431
432 void __weak arch_seccomp_spec_mitigate(struct task_struct *task) { }
433
434 static inline void seccomp_assign_mode(struct task_struct *task,
435                                        unsigned long seccomp_mode,
436                                        unsigned long flags)
437 {
438         assert_spin_locked(&task->sighand->siglock);
439
440         task->seccomp.mode = seccomp_mode;
441         /*
442          * Make sure SYSCALL_WORK_SECCOMP cannot be set before the mode (and
443          * filter) is set.
444          */
445         smp_mb__before_atomic();
446         /* Assume default seccomp processes want spec flaw mitigation. */
447         if ((flags & SECCOMP_FILTER_FLAG_SPEC_ALLOW) == 0)
448                 arch_seccomp_spec_mitigate(task);
449         set_task_syscall_work(task, SECCOMP);
450 }
451
452 #ifdef CONFIG_SECCOMP_FILTER
453 /* Returns 1 if the parent is an ancestor of the child. */
454 static int is_ancestor(struct seccomp_filter *parent,
455                        struct seccomp_filter *child)
456 {
457         /* NULL is the root ancestor. */
458         if (parent == NULL)
459                 return 1;
460         for (; child; child = child->prev)
461                 if (child == parent)
462                         return 1;
463         return 0;
464 }
465
466 /**
467  * seccomp_can_sync_threads: checks if all threads can be synchronized
468  *
469  * Expects sighand and cred_guard_mutex locks to be held.
470  *
471  * Returns 0 on success, -ve on error, or the pid of a thread which was
472  * either not in the correct seccomp mode or did not have an ancestral
473  * seccomp filter.
474  */
475 static inline pid_t seccomp_can_sync_threads(void)
476 {
477         struct task_struct *thread, *caller;
478
479         BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
480         assert_spin_locked(&current->sighand->siglock);
481
482         /* Validate all threads being eligible for synchronization. */
483         caller = current;
484         for_each_thread(caller, thread) {
485                 pid_t failed;
486
487                 /* Skip current, since it is initiating the sync. */
488                 if (thread == caller)
489                         continue;
490
491                 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED ||
492                     (thread->seccomp.mode == SECCOMP_MODE_FILTER &&
493                      is_ancestor(thread->seccomp.filter,
494                                  caller->seccomp.filter)))
495                         continue;
496
497                 /* Return the first thread that cannot be synchronized. */
498                 failed = task_pid_vnr(thread);
499                 /* If the pid cannot be resolved, then return -ESRCH */
500                 if (WARN_ON(failed == 0))
501                         failed = -ESRCH;
502                 return failed;
503         }
504
505         return 0;
506 }
507
508 static inline void seccomp_filter_free(struct seccomp_filter *filter)
509 {
510         if (filter) {
511                 bpf_prog_destroy(filter->prog);
512                 kfree(filter);
513         }
514 }
515
516 static void __seccomp_filter_orphan(struct seccomp_filter *orig)
517 {
518         while (orig && refcount_dec_and_test(&orig->users)) {
519                 if (waitqueue_active(&orig->wqh))
520                         wake_up_poll(&orig->wqh, EPOLLHUP);
521                 orig = orig->prev;
522         }
523 }
524
525 static void __put_seccomp_filter(struct seccomp_filter *orig)
526 {
527         /* Clean up single-reference branches iteratively. */
528         while (orig && refcount_dec_and_test(&orig->refs)) {
529                 struct seccomp_filter *freeme = orig;
530                 orig = orig->prev;
531                 seccomp_filter_free(freeme);
532         }
533 }
534
535 static void __seccomp_filter_release(struct seccomp_filter *orig)
536 {
537         /* Notify about any unused filters in the task's former filter tree. */
538         __seccomp_filter_orphan(orig);
539         /* Finally drop all references to the task's former tree. */
540         __put_seccomp_filter(orig);
541 }
542
543 /**
544  * seccomp_filter_release - Detach the task from its filter tree,
545  *                          drop its reference count, and notify
546  *                          about unused filters
547  *
548  * This function should only be called when the task is exiting as
549  * it detaches it from its filter tree. As such, READ_ONCE() and
550  * barriers are not needed here, as would normally be needed.
551  */
552 void seccomp_filter_release(struct task_struct *tsk)
553 {
554         struct seccomp_filter *orig = tsk->seccomp.filter;
555
556         /* We are effectively holding the siglock by not having any sighand. */
557         WARN_ON(tsk->sighand != NULL);
558
559         /* Detach task from its filter tree. */
560         tsk->seccomp.filter = NULL;
561         __seccomp_filter_release(orig);
562 }
563
564 /**
565  * seccomp_sync_threads: sets all threads to use current's filter
566  *
567  * Expects sighand and cred_guard_mutex locks to be held, and for
568  * seccomp_can_sync_threads() to have returned success already
569  * without dropping the locks.
570  *
571  */
572 static inline void seccomp_sync_threads(unsigned long flags)
573 {
574         struct task_struct *thread, *caller;
575
576         BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
577         assert_spin_locked(&current->sighand->siglock);
578
579         /* Synchronize all threads. */
580         caller = current;
581         for_each_thread(caller, thread) {
582                 /* Skip current, since it needs no changes. */
583                 if (thread == caller)
584                         continue;
585
586                 /* Get a task reference for the new leaf node. */
587                 get_seccomp_filter(caller);
588
589                 /*
590                  * Drop the task reference to the shared ancestor since
591                  * current's path will hold a reference.  (This also
592                  * allows a put before the assignment.)
593                  */
594                 __seccomp_filter_release(thread->seccomp.filter);
595
596                 /* Make our new filter tree visible. */
597                 smp_store_release(&thread->seccomp.filter,
598                                   caller->seccomp.filter);
599                 atomic_set(&thread->seccomp.filter_count,
600                            atomic_read(&thread->seccomp.filter_count));
601
602                 /*
603                  * Don't let an unprivileged task work around
604                  * the no_new_privs restriction by creating
605                  * a thread that sets it up, enters seccomp,
606                  * then dies.
607                  */
608                 if (task_no_new_privs(caller))
609                         task_set_no_new_privs(thread);
610
611                 /*
612                  * Opt the other thread into seccomp if needed.
613                  * As threads are considered to be trust-realm
614                  * equivalent (see ptrace_may_access), it is safe to
615                  * allow one thread to transition the other.
616                  */
617                 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED)
618                         seccomp_assign_mode(thread, SECCOMP_MODE_FILTER,
619                                             flags);
620         }
621 }
622
623 /**
624  * seccomp_prepare_filter: Prepares a seccomp filter for use.
625  * @fprog: BPF program to install
626  *
627  * Returns filter on success or an ERR_PTR on failure.
628  */
629 static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog)
630 {
631         struct seccomp_filter *sfilter;
632         int ret;
633         const bool save_orig =
634 #if defined(CONFIG_CHECKPOINT_RESTORE) || defined(SECCOMP_ARCH_NATIVE)
635                 true;
636 #else
637                 false;
638 #endif
639
640         if (fprog->len == 0 || fprog->len > BPF_MAXINSNS)
641                 return ERR_PTR(-EINVAL);
642
643         BUG_ON(INT_MAX / fprog->len < sizeof(struct sock_filter));
644
645         /*
646          * Installing a seccomp filter requires that the task has
647          * CAP_SYS_ADMIN in its namespace or be running with no_new_privs.
648          * This avoids scenarios where unprivileged tasks can affect the
649          * behavior of privileged children.
650          */
651         if (!task_no_new_privs(current) &&
652                         !ns_capable_noaudit(current_user_ns(), CAP_SYS_ADMIN))
653                 return ERR_PTR(-EACCES);
654
655         /* Allocate a new seccomp_filter */
656         sfilter = kzalloc(sizeof(*sfilter), GFP_KERNEL | __GFP_NOWARN);
657         if (!sfilter)
658                 return ERR_PTR(-ENOMEM);
659
660         mutex_init(&sfilter->notify_lock);
661         ret = bpf_prog_create_from_user(&sfilter->prog, fprog,
662                                         seccomp_check_filter, save_orig);
663         if (ret < 0) {
664                 kfree(sfilter);
665                 return ERR_PTR(ret);
666         }
667
668         refcount_set(&sfilter->refs, 1);
669         refcount_set(&sfilter->users, 1);
670         init_waitqueue_head(&sfilter->wqh);
671
672         return sfilter;
673 }
674
675 /**
676  * seccomp_prepare_user_filter - prepares a user-supplied sock_fprog
677  * @user_filter: pointer to the user data containing a sock_fprog.
678  *
679  * Returns 0 on success and non-zero otherwise.
680  */
681 static struct seccomp_filter *
682 seccomp_prepare_user_filter(const char __user *user_filter)
683 {
684         struct sock_fprog fprog;
685         struct seccomp_filter *filter = ERR_PTR(-EFAULT);
686
687 #ifdef CONFIG_COMPAT
688         if (in_compat_syscall()) {
689                 struct compat_sock_fprog fprog32;
690                 if (copy_from_user(&fprog32, user_filter, sizeof(fprog32)))
691                         goto out;
692                 fprog.len = fprog32.len;
693                 fprog.filter = compat_ptr(fprog32.filter);
694         } else /* falls through to the if below. */
695 #endif
696         if (copy_from_user(&fprog, user_filter, sizeof(fprog)))
697                 goto out;
698         filter = seccomp_prepare_filter(&fprog);
699 out:
700         return filter;
701 }
702
703 #ifdef SECCOMP_ARCH_NATIVE
704 /**
705  * seccomp_is_const_allow - check if filter is constant allow with given data
706  * @fprog: The BPF programs
707  * @sd: The seccomp data to check against, only syscall number and arch
708  *      number are considered constant.
709  */
710 static bool seccomp_is_const_allow(struct sock_fprog_kern *fprog,
711                                    struct seccomp_data *sd)
712 {
713         unsigned int reg_value = 0;
714         unsigned int pc;
715         bool op_res;
716
717         if (WARN_ON_ONCE(!fprog))
718                 return false;
719
720         for (pc = 0; pc < fprog->len; pc++) {
721                 struct sock_filter *insn = &fprog->filter[pc];
722                 u16 code = insn->code;
723                 u32 k = insn->k;
724
725                 switch (code) {
726                 case BPF_LD | BPF_W | BPF_ABS:
727                         switch (k) {
728                         case offsetof(struct seccomp_data, nr):
729                                 reg_value = sd->nr;
730                                 break;
731                         case offsetof(struct seccomp_data, arch):
732                                 reg_value = sd->arch;
733                                 break;
734                         default:
735                                 /* can't optimize (non-constant value load) */
736                                 return false;
737                         }
738                         break;
739                 case BPF_RET | BPF_K:
740                         /* reached return with constant values only, check allow */
741                         return k == SECCOMP_RET_ALLOW;
742                 case BPF_JMP | BPF_JA:
743                         pc += insn->k;
744                         break;
745                 case BPF_JMP | BPF_JEQ | BPF_K:
746                 case BPF_JMP | BPF_JGE | BPF_K:
747                 case BPF_JMP | BPF_JGT | BPF_K:
748                 case BPF_JMP | BPF_JSET | BPF_K:
749                         switch (BPF_OP(code)) {
750                         case BPF_JEQ:
751                                 op_res = reg_value == k;
752                                 break;
753                         case BPF_JGE:
754                                 op_res = reg_value >= k;
755                                 break;
756                         case BPF_JGT:
757                                 op_res = reg_value > k;
758                                 break;
759                         case BPF_JSET:
760                                 op_res = !!(reg_value & k);
761                                 break;
762                         default:
763                                 /* can't optimize (unknown jump) */
764                                 return false;
765                         }
766
767                         pc += op_res ? insn->jt : insn->jf;
768                         break;
769                 case BPF_ALU | BPF_AND | BPF_K:
770                         reg_value &= k;
771                         break;
772                 default:
773                         /* can't optimize (unknown insn) */
774                         return false;
775                 }
776         }
777
778         /* ran off the end of the filter?! */
779         WARN_ON(1);
780         return false;
781 }
782
783 static void seccomp_cache_prepare_bitmap(struct seccomp_filter *sfilter,
784                                          void *bitmap, const void *bitmap_prev,
785                                          size_t bitmap_size, int arch)
786 {
787         struct sock_fprog_kern *fprog = sfilter->prog->orig_prog;
788         struct seccomp_data sd;
789         int nr;
790
791         if (bitmap_prev) {
792                 /* The new filter must be as restrictive as the last. */
793                 bitmap_copy(bitmap, bitmap_prev, bitmap_size);
794         } else {
795                 /* Before any filters, all syscalls are always allowed. */
796                 bitmap_fill(bitmap, bitmap_size);
797         }
798
799         for (nr = 0; nr < bitmap_size; nr++) {
800                 /* No bitmap change: not a cacheable action. */
801                 if (!test_bit(nr, bitmap))
802                         continue;
803
804                 sd.nr = nr;
805                 sd.arch = arch;
806
807                 /* No bitmap change: continue to always allow. */
808                 if (seccomp_is_const_allow(fprog, &sd))
809                         continue;
810
811                 /*
812                  * Not a cacheable action: always run filters.
813                  * atomic clear_bit() not needed, filter not visible yet.
814                  */
815                 __clear_bit(nr, bitmap);
816         }
817 }
818
819 /**
820  * seccomp_cache_prepare - emulate the filter to find cachable syscalls
821  * @sfilter: The seccomp filter
822  *
823  * Returns 0 if successful or -errno if error occurred.
824  */
825 static void seccomp_cache_prepare(struct seccomp_filter *sfilter)
826 {
827         struct action_cache *cache = &sfilter->cache;
828         const struct action_cache *cache_prev =
829                 sfilter->prev ? &sfilter->prev->cache : NULL;
830
831         seccomp_cache_prepare_bitmap(sfilter, cache->allow_native,
832                                      cache_prev ? cache_prev->allow_native : NULL,
833                                      SECCOMP_ARCH_NATIVE_NR,
834                                      SECCOMP_ARCH_NATIVE);
835
836 #ifdef SECCOMP_ARCH_COMPAT
837         seccomp_cache_prepare_bitmap(sfilter, cache->allow_compat,
838                                      cache_prev ? cache_prev->allow_compat : NULL,
839                                      SECCOMP_ARCH_COMPAT_NR,
840                                      SECCOMP_ARCH_COMPAT);
841 #endif /* SECCOMP_ARCH_COMPAT */
842 }
843 #endif /* SECCOMP_ARCH_NATIVE */
844
845 /**
846  * seccomp_attach_filter: validate and attach filter
847  * @flags:  flags to change filter behavior
848  * @filter: seccomp filter to add to the current process
849  *
850  * Caller must be holding current->sighand->siglock lock.
851  *
852  * Returns 0 on success, -ve on error, or
853  *   - in TSYNC mode: the pid of a thread which was either not in the correct
854  *     seccomp mode or did not have an ancestral seccomp filter
855  *   - in NEW_LISTENER mode: the fd of the new listener
856  */
857 static long seccomp_attach_filter(unsigned int flags,
858                                   struct seccomp_filter *filter)
859 {
860         unsigned long total_insns;
861         struct seccomp_filter *walker;
862
863         assert_spin_locked(&current->sighand->siglock);
864
865         /* Validate resulting filter length. */
866         total_insns = filter->prog->len;
867         for (walker = current->seccomp.filter; walker; walker = walker->prev)
868                 total_insns += walker->prog->len + 4;  /* 4 instr penalty */
869         if (total_insns > MAX_INSNS_PER_PATH)
870                 return -ENOMEM;
871
872         /* If thread sync has been requested, check that it is possible. */
873         if (flags & SECCOMP_FILTER_FLAG_TSYNC) {
874                 int ret;
875
876                 ret = seccomp_can_sync_threads();
877                 if (ret) {
878                         if (flags & SECCOMP_FILTER_FLAG_TSYNC_ESRCH)
879                                 return -ESRCH;
880                         else
881                                 return ret;
882                 }
883         }
884
885         /* Set log flag, if present. */
886         if (flags & SECCOMP_FILTER_FLAG_LOG)
887                 filter->log = true;
888
889         /*
890          * If there is an existing filter, make it the prev and don't drop its
891          * task reference.
892          */
893         filter->prev = current->seccomp.filter;
894         seccomp_cache_prepare(filter);
895         current->seccomp.filter = filter;
896         atomic_inc(&current->seccomp.filter_count);
897
898         /* Now that the new filter is in place, synchronize to all threads. */
899         if (flags & SECCOMP_FILTER_FLAG_TSYNC)
900                 seccomp_sync_threads(flags);
901
902         return 0;
903 }
904
905 static void __get_seccomp_filter(struct seccomp_filter *filter)
906 {
907         refcount_inc(&filter->refs);
908 }
909
910 /* get_seccomp_filter - increments the reference count of the filter on @tsk */
911 void get_seccomp_filter(struct task_struct *tsk)
912 {
913         struct seccomp_filter *orig = tsk->seccomp.filter;
914         if (!orig)
915                 return;
916         __get_seccomp_filter(orig);
917         refcount_inc(&orig->users);
918 }
919
920 static void seccomp_init_siginfo(kernel_siginfo_t *info, int syscall, int reason)
921 {
922         clear_siginfo(info);
923         info->si_signo = SIGSYS;
924         info->si_code = SYS_SECCOMP;
925         info->si_call_addr = (void __user *)KSTK_EIP(current);
926         info->si_errno = reason;
927         info->si_arch = syscall_get_arch(current);
928         info->si_syscall = syscall;
929 }
930
931 /**
932  * seccomp_send_sigsys - signals the task to allow in-process syscall emulation
933  * @syscall: syscall number to send to userland
934  * @reason: filter-supplied reason code to send to userland (via si_errno)
935  *
936  * Forces a SIGSYS with a code of SYS_SECCOMP and related sigsys info.
937  */
938 static void seccomp_send_sigsys(int syscall, int reason)
939 {
940         struct kernel_siginfo info;
941         seccomp_init_siginfo(&info, syscall, reason);
942         force_sig_info(&info);
943 }
944 #endif  /* CONFIG_SECCOMP_FILTER */
945
946 /* For use with seccomp_actions_logged */
947 #define SECCOMP_LOG_KILL_PROCESS        (1 << 0)
948 #define SECCOMP_LOG_KILL_THREAD         (1 << 1)
949 #define SECCOMP_LOG_TRAP                (1 << 2)
950 #define SECCOMP_LOG_ERRNO               (1 << 3)
951 #define SECCOMP_LOG_TRACE               (1 << 4)
952 #define SECCOMP_LOG_LOG                 (1 << 5)
953 #define SECCOMP_LOG_ALLOW               (1 << 6)
954 #define SECCOMP_LOG_USER_NOTIF          (1 << 7)
955
956 static u32 seccomp_actions_logged = SECCOMP_LOG_KILL_PROCESS |
957                                     SECCOMP_LOG_KILL_THREAD  |
958                                     SECCOMP_LOG_TRAP  |
959                                     SECCOMP_LOG_ERRNO |
960                                     SECCOMP_LOG_USER_NOTIF |
961                                     SECCOMP_LOG_TRACE |
962                                     SECCOMP_LOG_LOG;
963
964 static inline void seccomp_log(unsigned long syscall, long signr, u32 action,
965                                bool requested)
966 {
967         bool log = false;
968
969         switch (action) {
970         case SECCOMP_RET_ALLOW:
971                 break;
972         case SECCOMP_RET_TRAP:
973                 log = requested && seccomp_actions_logged & SECCOMP_LOG_TRAP;
974                 break;
975         case SECCOMP_RET_ERRNO:
976                 log = requested && seccomp_actions_logged & SECCOMP_LOG_ERRNO;
977                 break;
978         case SECCOMP_RET_TRACE:
979                 log = requested && seccomp_actions_logged & SECCOMP_LOG_TRACE;
980                 break;
981         case SECCOMP_RET_USER_NOTIF:
982                 log = requested && seccomp_actions_logged & SECCOMP_LOG_USER_NOTIF;
983                 break;
984         case SECCOMP_RET_LOG:
985                 log = seccomp_actions_logged & SECCOMP_LOG_LOG;
986                 break;
987         case SECCOMP_RET_KILL_THREAD:
988                 log = seccomp_actions_logged & SECCOMP_LOG_KILL_THREAD;
989                 break;
990         case SECCOMP_RET_KILL_PROCESS:
991         default:
992                 log = seccomp_actions_logged & SECCOMP_LOG_KILL_PROCESS;
993         }
994
995         /*
996          * Emit an audit message when the action is RET_KILL_*, RET_LOG, or the
997          * FILTER_FLAG_LOG bit was set. The admin has the ability to silence
998          * any action from being logged by removing the action name from the
999          * seccomp_actions_logged sysctl.
1000          */
1001         if (!log)
1002                 return;
1003
1004         audit_seccomp(syscall, signr, action);
1005 }
1006
1007 /*
1008  * Secure computing mode 1 allows only read/write/exit/sigreturn.
1009  * To be fully secure this must be combined with rlimit
1010  * to limit the stack allocations too.
1011  */
1012 static const int mode1_syscalls[] = {
1013         __NR_seccomp_read, __NR_seccomp_write, __NR_seccomp_exit, __NR_seccomp_sigreturn,
1014         -1, /* negative terminated */
1015 };
1016
1017 static void __secure_computing_strict(int this_syscall)
1018 {
1019         const int *allowed_syscalls = mode1_syscalls;
1020 #ifdef CONFIG_COMPAT
1021         if (in_compat_syscall())
1022                 allowed_syscalls = get_compat_mode1_syscalls();
1023 #endif
1024         do {
1025                 if (*allowed_syscalls == this_syscall)
1026                         return;
1027         } while (*++allowed_syscalls != -1);
1028
1029 #ifdef SECCOMP_DEBUG
1030         dump_stack();
1031 #endif
1032         seccomp_log(this_syscall, SIGKILL, SECCOMP_RET_KILL_THREAD, true);
1033         do_exit(SIGKILL);
1034 }
1035
1036 #ifndef CONFIG_HAVE_ARCH_SECCOMP_FILTER
1037 void secure_computing_strict(int this_syscall)
1038 {
1039         int mode = current->seccomp.mode;
1040
1041         if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) &&
1042             unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
1043                 return;
1044
1045         if (mode == SECCOMP_MODE_DISABLED)
1046                 return;
1047         else if (mode == SECCOMP_MODE_STRICT)
1048                 __secure_computing_strict(this_syscall);
1049         else
1050                 BUG();
1051 }
1052 #else
1053
1054 #ifdef CONFIG_SECCOMP_FILTER
1055 static u64 seccomp_next_notify_id(struct seccomp_filter *filter)
1056 {
1057         /*
1058          * Note: overflow is ok here, the id just needs to be unique per
1059          * filter.
1060          */
1061         lockdep_assert_held(&filter->notify_lock);
1062         return filter->notif->next_id++;
1063 }
1064
1065 static void seccomp_handle_addfd(struct seccomp_kaddfd *addfd)
1066 {
1067         /*
1068          * Remove the notification, and reset the list pointers, indicating
1069          * that it has been handled.
1070          */
1071         list_del_init(&addfd->list);
1072         addfd->ret = receive_fd_replace(addfd->fd, addfd->file, addfd->flags);
1073         complete(&addfd->completion);
1074 }
1075
1076 static int seccomp_do_user_notification(int this_syscall,
1077                                         struct seccomp_filter *match,
1078                                         const struct seccomp_data *sd)
1079 {
1080         int err;
1081         u32 flags = 0;
1082         long ret = 0;
1083         struct seccomp_knotif n = {};
1084         struct seccomp_kaddfd *addfd, *tmp;
1085
1086         mutex_lock(&match->notify_lock);
1087         err = -ENOSYS;
1088         if (!match->notif)
1089                 goto out;
1090
1091         n.task = current;
1092         n.state = SECCOMP_NOTIFY_INIT;
1093         n.data = sd;
1094         n.id = seccomp_next_notify_id(match);
1095         init_completion(&n.ready);
1096         list_add(&n.list, &match->notif->notifications);
1097         INIT_LIST_HEAD(&n.addfd);
1098
1099         up(&match->notif->request);
1100         wake_up_poll(&match->wqh, EPOLLIN | EPOLLRDNORM);
1101         mutex_unlock(&match->notify_lock);
1102
1103         /*
1104          * This is where we wait for a reply from userspace.
1105          */
1106 wait:
1107         err = wait_for_completion_interruptible(&n.ready);
1108         mutex_lock(&match->notify_lock);
1109         if (err == 0) {
1110                 /* Check if we were woken up by a addfd message */
1111                 addfd = list_first_entry_or_null(&n.addfd,
1112                                                  struct seccomp_kaddfd, list);
1113                 if (addfd && n.state != SECCOMP_NOTIFY_REPLIED) {
1114                         seccomp_handle_addfd(addfd);
1115                         mutex_unlock(&match->notify_lock);
1116                         goto wait;
1117                 }
1118                 ret = n.val;
1119                 err = n.error;
1120                 flags = n.flags;
1121         }
1122
1123         /* If there were any pending addfd calls, clear them out */
1124         list_for_each_entry_safe(addfd, tmp, &n.addfd, list) {
1125                 /* The process went away before we got a chance to handle it */
1126                 addfd->ret = -ESRCH;
1127                 list_del_init(&addfd->list);
1128                 complete(&addfd->completion);
1129         }
1130
1131         /*
1132          * Note that it's possible the listener died in between the time when
1133          * we were notified of a response (or a signal) and when we were able to
1134          * re-acquire the lock, so only delete from the list if the
1135          * notification actually exists.
1136          *
1137          * Also note that this test is only valid because there's no way to
1138          * *reattach* to a notifier right now. If one is added, we'll need to
1139          * keep track of the notif itself and make sure they match here.
1140          */
1141         if (match->notif)
1142                 list_del(&n.list);
1143 out:
1144         mutex_unlock(&match->notify_lock);
1145
1146         /* Userspace requests to continue the syscall. */
1147         if (flags & SECCOMP_USER_NOTIF_FLAG_CONTINUE)
1148                 return 0;
1149
1150         syscall_set_return_value(current, current_pt_regs(),
1151                                  err, ret);
1152         return -1;
1153 }
1154
1155 static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
1156                             const bool recheck_after_trace)
1157 {
1158         u32 filter_ret, action;
1159         struct seccomp_filter *match = NULL;
1160         int data;
1161         struct seccomp_data sd_local;
1162
1163         /*
1164          * Make sure that any changes to mode from another thread have
1165          * been seen after SYSCALL_WORK_SECCOMP was seen.
1166          */
1167         smp_rmb();
1168
1169         if (!sd) {
1170                 populate_seccomp_data(&sd_local);
1171                 sd = &sd_local;
1172         }
1173
1174         filter_ret = seccomp_run_filters(sd, &match);
1175         data = filter_ret & SECCOMP_RET_DATA;
1176         action = filter_ret & SECCOMP_RET_ACTION_FULL;
1177
1178         switch (action) {
1179         case SECCOMP_RET_ERRNO:
1180                 /* Set low-order bits as an errno, capped at MAX_ERRNO. */
1181                 if (data > MAX_ERRNO)
1182                         data = MAX_ERRNO;
1183                 syscall_set_return_value(current, current_pt_regs(),
1184                                          -data, 0);
1185                 goto skip;
1186
1187         case SECCOMP_RET_TRAP:
1188                 /* Show the handler the original registers. */
1189                 syscall_rollback(current, current_pt_regs());
1190                 /* Let the filter pass back 16 bits of data. */
1191                 seccomp_send_sigsys(this_syscall, data);
1192                 goto skip;
1193
1194         case SECCOMP_RET_TRACE:
1195                 /* We've been put in this state by the ptracer already. */
1196                 if (recheck_after_trace)
1197                         return 0;
1198
1199                 /* ENOSYS these calls if there is no tracer attached. */
1200                 if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP)) {
1201                         syscall_set_return_value(current,
1202                                                  current_pt_regs(),
1203                                                  -ENOSYS, 0);
1204                         goto skip;
1205                 }
1206
1207                 /* Allow the BPF to provide the event message */
1208                 ptrace_event(PTRACE_EVENT_SECCOMP, data);
1209                 /*
1210                  * The delivery of a fatal signal during event
1211                  * notification may silently skip tracer notification,
1212                  * which could leave us with a potentially unmodified
1213                  * syscall that the tracer would have liked to have
1214                  * changed. Since the process is about to die, we just
1215                  * force the syscall to be skipped and let the signal
1216                  * kill the process and correctly handle any tracer exit
1217                  * notifications.
1218                  */
1219                 if (fatal_signal_pending(current))
1220                         goto skip;
1221                 /* Check if the tracer forced the syscall to be skipped. */
1222                 this_syscall = syscall_get_nr(current, current_pt_regs());
1223                 if (this_syscall < 0)
1224                         goto skip;
1225
1226                 /*
1227                  * Recheck the syscall, since it may have changed. This
1228                  * intentionally uses a NULL struct seccomp_data to force
1229                  * a reload of all registers. This does not goto skip since
1230                  * a skip would have already been reported.
1231                  */
1232                 if (__seccomp_filter(this_syscall, NULL, true))
1233                         return -1;
1234
1235                 return 0;
1236
1237         case SECCOMP_RET_USER_NOTIF:
1238                 if (seccomp_do_user_notification(this_syscall, match, sd))
1239                         goto skip;
1240
1241                 return 0;
1242
1243         case SECCOMP_RET_LOG:
1244                 seccomp_log(this_syscall, 0, action, true);
1245                 return 0;
1246
1247         case SECCOMP_RET_ALLOW:
1248                 /*
1249                  * Note that the "match" filter will always be NULL for
1250                  * this action since SECCOMP_RET_ALLOW is the starting
1251                  * state in seccomp_run_filters().
1252                  */
1253                 return 0;
1254
1255         case SECCOMP_RET_KILL_THREAD:
1256         case SECCOMP_RET_KILL_PROCESS:
1257         default:
1258                 seccomp_log(this_syscall, SIGSYS, action, true);
1259                 /* Dump core only if this is the last remaining thread. */
1260                 if (action != SECCOMP_RET_KILL_THREAD ||
1261                     get_nr_threads(current) == 1) {
1262                         kernel_siginfo_t info;
1263
1264                         /* Show the original registers in the dump. */
1265                         syscall_rollback(current, current_pt_regs());
1266                         /* Trigger a manual coredump since do_exit skips it. */
1267                         seccomp_init_siginfo(&info, this_syscall, data);
1268                         do_coredump(&info);
1269                 }
1270                 if (action == SECCOMP_RET_KILL_THREAD)
1271                         do_exit(SIGSYS);
1272                 else
1273                         do_group_exit(SIGSYS);
1274         }
1275
1276         unreachable();
1277
1278 skip:
1279         seccomp_log(this_syscall, 0, action, match ? match->log : false);
1280         return -1;
1281 }
1282 #else
1283 static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
1284                             const bool recheck_after_trace)
1285 {
1286         BUG();
1287
1288         return -1;
1289 }
1290 #endif
1291
1292 int __secure_computing(const struct seccomp_data *sd)
1293 {
1294         int mode = current->seccomp.mode;
1295         int this_syscall;
1296
1297         if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) &&
1298             unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
1299                 return 0;
1300
1301         this_syscall = sd ? sd->nr :
1302                 syscall_get_nr(current, current_pt_regs());
1303
1304         switch (mode) {
1305         case SECCOMP_MODE_STRICT:
1306                 __secure_computing_strict(this_syscall);  /* may call do_exit */
1307                 return 0;
1308         case SECCOMP_MODE_FILTER:
1309                 return __seccomp_filter(this_syscall, sd, false);
1310         default:
1311                 BUG();
1312         }
1313 }
1314 #endif /* CONFIG_HAVE_ARCH_SECCOMP_FILTER */
1315
1316 long prctl_get_seccomp(void)
1317 {
1318         return current->seccomp.mode;
1319 }
1320
1321 /**
1322  * seccomp_set_mode_strict: internal function for setting strict seccomp
1323  *
1324  * Once current->seccomp.mode is non-zero, it may not be changed.
1325  *
1326  * Returns 0 on success or -EINVAL on failure.
1327  */
1328 static long seccomp_set_mode_strict(void)
1329 {
1330         const unsigned long seccomp_mode = SECCOMP_MODE_STRICT;
1331         long ret = -EINVAL;
1332
1333         spin_lock_irq(&current->sighand->siglock);
1334
1335         if (!seccomp_may_assign_mode(seccomp_mode))
1336                 goto out;
1337
1338 #ifdef TIF_NOTSC
1339         disable_TSC();
1340 #endif
1341         seccomp_assign_mode(current, seccomp_mode, 0);
1342         ret = 0;
1343
1344 out:
1345         spin_unlock_irq(&current->sighand->siglock);
1346
1347         return ret;
1348 }
1349
1350 #ifdef CONFIG_SECCOMP_FILTER
1351 static void seccomp_notify_free(struct seccomp_filter *filter)
1352 {
1353         kfree(filter->notif);
1354         filter->notif = NULL;
1355 }
1356
1357 static void seccomp_notify_detach(struct seccomp_filter *filter)
1358 {
1359         struct seccomp_knotif *knotif;
1360
1361         if (!filter)
1362                 return;
1363
1364         mutex_lock(&filter->notify_lock);
1365
1366         /*
1367          * If this file is being closed because e.g. the task who owned it
1368          * died, let's wake everyone up who was waiting on us.
1369          */
1370         list_for_each_entry(knotif, &filter->notif->notifications, list) {
1371                 if (knotif->state == SECCOMP_NOTIFY_REPLIED)
1372                         continue;
1373
1374                 knotif->state = SECCOMP_NOTIFY_REPLIED;
1375                 knotif->error = -ENOSYS;
1376                 knotif->val = 0;
1377
1378                 /*
1379                  * We do not need to wake up any pending addfd messages, as
1380                  * the notifier will do that for us, as this just looks
1381                  * like a standard reply.
1382                  */
1383                 complete(&knotif->ready);
1384         }
1385
1386         seccomp_notify_free(filter);
1387         mutex_unlock(&filter->notify_lock);
1388 }
1389
1390 static int seccomp_notify_release(struct inode *inode, struct file *file)
1391 {
1392         struct seccomp_filter *filter = file->private_data;
1393
1394         seccomp_notify_detach(filter);
1395         __put_seccomp_filter(filter);
1396         return 0;
1397 }
1398
1399 /* must be called with notif_lock held */
1400 static inline struct seccomp_knotif *
1401 find_notification(struct seccomp_filter *filter, u64 id)
1402 {
1403         struct seccomp_knotif *cur;
1404
1405         lockdep_assert_held(&filter->notify_lock);
1406
1407         list_for_each_entry(cur, &filter->notif->notifications, list) {
1408                 if (cur->id == id)
1409                         return cur;
1410         }
1411
1412         return NULL;
1413 }
1414
1415
1416 static long seccomp_notify_recv(struct seccomp_filter *filter,
1417                                 void __user *buf)
1418 {
1419         struct seccomp_knotif *knotif = NULL, *cur;
1420         struct seccomp_notif unotif;
1421         ssize_t ret;
1422
1423         /* Verify that we're not given garbage to keep struct extensible. */
1424         ret = check_zeroed_user(buf, sizeof(unotif));
1425         if (ret < 0)
1426                 return ret;
1427         if (!ret)
1428                 return -EINVAL;
1429
1430         memset(&unotif, 0, sizeof(unotif));
1431
1432         ret = down_interruptible(&filter->notif->request);
1433         if (ret < 0)
1434                 return ret;
1435
1436         mutex_lock(&filter->notify_lock);
1437         list_for_each_entry(cur, &filter->notif->notifications, list) {
1438                 if (cur->state == SECCOMP_NOTIFY_INIT) {
1439                         knotif = cur;
1440                         break;
1441                 }
1442         }
1443
1444         /*
1445          * If we didn't find a notification, it could be that the task was
1446          * interrupted by a fatal signal between the time we were woken and
1447          * when we were able to acquire the rw lock.
1448          */
1449         if (!knotif) {
1450                 ret = -ENOENT;
1451                 goto out;
1452         }
1453
1454         unotif.id = knotif->id;
1455         unotif.pid = task_pid_vnr(knotif->task);
1456         unotif.data = *(knotif->data);
1457
1458         knotif->state = SECCOMP_NOTIFY_SENT;
1459         wake_up_poll(&filter->wqh, EPOLLOUT | EPOLLWRNORM);
1460         ret = 0;
1461 out:
1462         mutex_unlock(&filter->notify_lock);
1463
1464         if (ret == 0 && copy_to_user(buf, &unotif, sizeof(unotif))) {
1465                 ret = -EFAULT;
1466
1467                 /*
1468                  * Userspace screwed up. To make sure that we keep this
1469                  * notification alive, let's reset it back to INIT. It
1470                  * may have died when we released the lock, so we need to make
1471                  * sure it's still around.
1472                  */
1473                 mutex_lock(&filter->notify_lock);
1474                 knotif = find_notification(filter, unotif.id);
1475                 if (knotif) {
1476                         knotif->state = SECCOMP_NOTIFY_INIT;
1477                         up(&filter->notif->request);
1478                 }
1479                 mutex_unlock(&filter->notify_lock);
1480         }
1481
1482         return ret;
1483 }
1484
1485 static long seccomp_notify_send(struct seccomp_filter *filter,
1486                                 void __user *buf)
1487 {
1488         struct seccomp_notif_resp resp = {};
1489         struct seccomp_knotif *knotif;
1490         long ret;
1491
1492         if (copy_from_user(&resp, buf, sizeof(resp)))
1493                 return -EFAULT;
1494
1495         if (resp.flags & ~SECCOMP_USER_NOTIF_FLAG_CONTINUE)
1496                 return -EINVAL;
1497
1498         if ((resp.flags & SECCOMP_USER_NOTIF_FLAG_CONTINUE) &&
1499             (resp.error || resp.val))
1500                 return -EINVAL;
1501
1502         ret = mutex_lock_interruptible(&filter->notify_lock);
1503         if (ret < 0)
1504                 return ret;
1505
1506         knotif = find_notification(filter, resp.id);
1507         if (!knotif) {
1508                 ret = -ENOENT;
1509                 goto out;
1510         }
1511
1512         /* Allow exactly one reply. */
1513         if (knotif->state != SECCOMP_NOTIFY_SENT) {
1514                 ret = -EINPROGRESS;
1515                 goto out;
1516         }
1517
1518         ret = 0;
1519         knotif->state = SECCOMP_NOTIFY_REPLIED;
1520         knotif->error = resp.error;
1521         knotif->val = resp.val;
1522         knotif->flags = resp.flags;
1523         complete(&knotif->ready);
1524 out:
1525         mutex_unlock(&filter->notify_lock);
1526         return ret;
1527 }
1528
1529 static long seccomp_notify_id_valid(struct seccomp_filter *filter,
1530                                     void __user *buf)
1531 {
1532         struct seccomp_knotif *knotif;
1533         u64 id;
1534         long ret;
1535
1536         if (copy_from_user(&id, buf, sizeof(id)))
1537                 return -EFAULT;
1538
1539         ret = mutex_lock_interruptible(&filter->notify_lock);
1540         if (ret < 0)
1541                 return ret;
1542
1543         knotif = find_notification(filter, id);
1544         if (knotif && knotif->state == SECCOMP_NOTIFY_SENT)
1545                 ret = 0;
1546         else
1547                 ret = -ENOENT;
1548
1549         mutex_unlock(&filter->notify_lock);
1550         return ret;
1551 }
1552
1553 static long seccomp_notify_addfd(struct seccomp_filter *filter,
1554                                  struct seccomp_notif_addfd __user *uaddfd,
1555                                  unsigned int size)
1556 {
1557         struct seccomp_notif_addfd addfd;
1558         struct seccomp_knotif *knotif;
1559         struct seccomp_kaddfd kaddfd;
1560         int ret;
1561
1562         BUILD_BUG_ON(sizeof(addfd) < SECCOMP_NOTIFY_ADDFD_SIZE_VER0);
1563         BUILD_BUG_ON(sizeof(addfd) != SECCOMP_NOTIFY_ADDFD_SIZE_LATEST);
1564
1565         if (size < SECCOMP_NOTIFY_ADDFD_SIZE_VER0 || size >= PAGE_SIZE)
1566                 return -EINVAL;
1567
1568         ret = copy_struct_from_user(&addfd, sizeof(addfd), uaddfd, size);
1569         if (ret)
1570                 return ret;
1571
1572         if (addfd.newfd_flags & ~O_CLOEXEC)
1573                 return -EINVAL;
1574
1575         if (addfd.flags & ~SECCOMP_ADDFD_FLAG_SETFD)
1576                 return -EINVAL;
1577
1578         if (addfd.newfd && !(addfd.flags & SECCOMP_ADDFD_FLAG_SETFD))
1579                 return -EINVAL;
1580
1581         kaddfd.file = fget(addfd.srcfd);
1582         if (!kaddfd.file)
1583                 return -EBADF;
1584
1585         kaddfd.flags = addfd.newfd_flags;
1586         kaddfd.fd = (addfd.flags & SECCOMP_ADDFD_FLAG_SETFD) ?
1587                     addfd.newfd : -1;
1588         init_completion(&kaddfd.completion);
1589
1590         ret = mutex_lock_interruptible(&filter->notify_lock);
1591         if (ret < 0)
1592                 goto out;
1593
1594         knotif = find_notification(filter, addfd.id);
1595         if (!knotif) {
1596                 ret = -ENOENT;
1597                 goto out_unlock;
1598         }
1599
1600         /*
1601          * We do not want to allow for FD injection to occur before the
1602          * notification has been picked up by a userspace handler, or after
1603          * the notification has been replied to.
1604          */
1605         if (knotif->state != SECCOMP_NOTIFY_SENT) {
1606                 ret = -EINPROGRESS;
1607                 goto out_unlock;
1608         }
1609
1610         list_add(&kaddfd.list, &knotif->addfd);
1611         complete(&knotif->ready);
1612         mutex_unlock(&filter->notify_lock);
1613
1614         /* Now we wait for it to be processed or be interrupted */
1615         ret = wait_for_completion_interruptible(&kaddfd.completion);
1616         if (ret == 0) {
1617                 /*
1618                  * We had a successful completion. The other side has already
1619                  * removed us from the addfd queue, and
1620                  * wait_for_completion_interruptible has a memory barrier upon
1621                  * success that lets us read this value directly without
1622                  * locking.
1623                  */
1624                 ret = kaddfd.ret;
1625                 goto out;
1626         }
1627
1628         mutex_lock(&filter->notify_lock);
1629         /*
1630          * Even though we were woken up by a signal and not a successful
1631          * completion, a completion may have happened in the mean time.
1632          *
1633          * We need to check again if the addfd request has been handled,
1634          * and if not, we will remove it from the queue.
1635          */
1636         if (list_empty(&kaddfd.list))
1637                 ret = kaddfd.ret;
1638         else
1639                 list_del(&kaddfd.list);
1640
1641 out_unlock:
1642         mutex_unlock(&filter->notify_lock);
1643 out:
1644         fput(kaddfd.file);
1645
1646         return ret;
1647 }
1648
1649 static long seccomp_notify_ioctl(struct file *file, unsigned int cmd,
1650                                  unsigned long arg)
1651 {
1652         struct seccomp_filter *filter = file->private_data;
1653         void __user *buf = (void __user *)arg;
1654
1655         /* Fixed-size ioctls */
1656         switch (cmd) {
1657         case SECCOMP_IOCTL_NOTIF_RECV:
1658                 return seccomp_notify_recv(filter, buf);
1659         case SECCOMP_IOCTL_NOTIF_SEND:
1660                 return seccomp_notify_send(filter, buf);
1661         case SECCOMP_IOCTL_NOTIF_ID_VALID_WRONG_DIR:
1662         case SECCOMP_IOCTL_NOTIF_ID_VALID:
1663                 return seccomp_notify_id_valid(filter, buf);
1664         }
1665
1666         /* Extensible Argument ioctls */
1667 #define EA_IOCTL(cmd)   ((cmd) & ~(IOC_INOUT | IOCSIZE_MASK))
1668         switch (EA_IOCTL(cmd)) {
1669         case EA_IOCTL(SECCOMP_IOCTL_NOTIF_ADDFD):
1670                 return seccomp_notify_addfd(filter, buf, _IOC_SIZE(cmd));
1671         default:
1672                 return -EINVAL;
1673         }
1674 }
1675
1676 static __poll_t seccomp_notify_poll(struct file *file,
1677                                     struct poll_table_struct *poll_tab)
1678 {
1679         struct seccomp_filter *filter = file->private_data;
1680         __poll_t ret = 0;
1681         struct seccomp_knotif *cur;
1682
1683         poll_wait(file, &filter->wqh, poll_tab);
1684
1685         if (mutex_lock_interruptible(&filter->notify_lock) < 0)
1686                 return EPOLLERR;
1687
1688         list_for_each_entry(cur, &filter->notif->notifications, list) {
1689                 if (cur->state == SECCOMP_NOTIFY_INIT)
1690                         ret |= EPOLLIN | EPOLLRDNORM;
1691                 if (cur->state == SECCOMP_NOTIFY_SENT)
1692                         ret |= EPOLLOUT | EPOLLWRNORM;
1693                 if ((ret & EPOLLIN) && (ret & EPOLLOUT))
1694                         break;
1695         }
1696
1697         mutex_unlock(&filter->notify_lock);
1698
1699         if (refcount_read(&filter->users) == 0)
1700                 ret |= EPOLLHUP;
1701
1702         return ret;
1703 }
1704
1705 static const struct file_operations seccomp_notify_ops = {
1706         .poll = seccomp_notify_poll,
1707         .release = seccomp_notify_release,
1708         .unlocked_ioctl = seccomp_notify_ioctl,
1709         .compat_ioctl = seccomp_notify_ioctl,
1710 };
1711
1712 static struct file *init_listener(struct seccomp_filter *filter)
1713 {
1714         struct file *ret;
1715
1716         ret = ERR_PTR(-ENOMEM);
1717         filter->notif = kzalloc(sizeof(*(filter->notif)), GFP_KERNEL);
1718         if (!filter->notif)
1719                 goto out;
1720
1721         sema_init(&filter->notif->request, 0);
1722         filter->notif->next_id = get_random_u64();
1723         INIT_LIST_HEAD(&filter->notif->notifications);
1724
1725         ret = anon_inode_getfile("seccomp notify", &seccomp_notify_ops,
1726                                  filter, O_RDWR);
1727         if (IS_ERR(ret))
1728                 goto out_notif;
1729
1730         /* The file has a reference to it now */
1731         __get_seccomp_filter(filter);
1732
1733 out_notif:
1734         if (IS_ERR(ret))
1735                 seccomp_notify_free(filter);
1736 out:
1737         return ret;
1738 }
1739
1740 /*
1741  * Does @new_child have a listener while an ancestor also has a listener?
1742  * If so, we'll want to reject this filter.
1743  * This only has to be tested for the current process, even in the TSYNC case,
1744  * because TSYNC installs @child with the same parent on all threads.
1745  * Note that @new_child is not hooked up to its parent at this point yet, so
1746  * we use current->seccomp.filter.
1747  */
1748 static bool has_duplicate_listener(struct seccomp_filter *new_child)
1749 {
1750         struct seccomp_filter *cur;
1751
1752         /* must be protected against concurrent TSYNC */
1753         lockdep_assert_held(&current->sighand->siglock);
1754
1755         if (!new_child->notif)
1756                 return false;
1757         for (cur = current->seccomp.filter; cur; cur = cur->prev) {
1758                 if (cur->notif)
1759                         return true;
1760         }
1761
1762         return false;
1763 }
1764
1765 /**
1766  * seccomp_set_mode_filter: internal function for setting seccomp filter
1767  * @flags:  flags to change filter behavior
1768  * @filter: struct sock_fprog containing filter
1769  *
1770  * This function may be called repeatedly to install additional filters.
1771  * Every filter successfully installed will be evaluated (in reverse order)
1772  * for each system call the task makes.
1773  *
1774  * Once current->seccomp.mode is non-zero, it may not be changed.
1775  *
1776  * Returns 0 on success or -EINVAL on failure.
1777  */
1778 static long seccomp_set_mode_filter(unsigned int flags,
1779                                     const char __user *filter)
1780 {
1781         const unsigned long seccomp_mode = SECCOMP_MODE_FILTER;
1782         struct seccomp_filter *prepared = NULL;
1783         long ret = -EINVAL;
1784         int listener = -1;
1785         struct file *listener_f = NULL;
1786
1787         /* Validate flags. */
1788         if (flags & ~SECCOMP_FILTER_FLAG_MASK)
1789                 return -EINVAL;
1790
1791         /*
1792          * In the successful case, NEW_LISTENER returns the new listener fd.
1793          * But in the failure case, TSYNC returns the thread that died. If you
1794          * combine these two flags, there's no way to tell whether something
1795          * succeeded or failed. So, let's disallow this combination if the user
1796          * has not explicitly requested no errors from TSYNC.
1797          */
1798         if ((flags & SECCOMP_FILTER_FLAG_TSYNC) &&
1799             (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) &&
1800             ((flags & SECCOMP_FILTER_FLAG_TSYNC_ESRCH) == 0))
1801                 return -EINVAL;
1802
1803         /* Prepare the new filter before holding any locks. */
1804         prepared = seccomp_prepare_user_filter(filter);
1805         if (IS_ERR(prepared))
1806                 return PTR_ERR(prepared);
1807
1808         if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) {
1809                 listener = get_unused_fd_flags(O_CLOEXEC);
1810                 if (listener < 0) {
1811                         ret = listener;
1812                         goto out_free;
1813                 }
1814
1815                 listener_f = init_listener(prepared);
1816                 if (IS_ERR(listener_f)) {
1817                         put_unused_fd(listener);
1818                         ret = PTR_ERR(listener_f);
1819                         goto out_free;
1820                 }
1821         }
1822
1823         /*
1824          * Make sure we cannot change seccomp or nnp state via TSYNC
1825          * while another thread is in the middle of calling exec.
1826          */
1827         if (flags & SECCOMP_FILTER_FLAG_TSYNC &&
1828             mutex_lock_killable(&current->signal->cred_guard_mutex))
1829                 goto out_put_fd;
1830
1831         spin_lock_irq(&current->sighand->siglock);
1832
1833         if (!seccomp_may_assign_mode(seccomp_mode))
1834                 goto out;
1835
1836         if (has_duplicate_listener(prepared)) {
1837                 ret = -EBUSY;
1838                 goto out;
1839         }
1840
1841         ret = seccomp_attach_filter(flags, prepared);
1842         if (ret)
1843                 goto out;
1844         /* Do not free the successfully attached filter. */
1845         prepared = NULL;
1846
1847         seccomp_assign_mode(current, seccomp_mode, flags);
1848 out:
1849         spin_unlock_irq(&current->sighand->siglock);
1850         if (flags & SECCOMP_FILTER_FLAG_TSYNC)
1851                 mutex_unlock(&current->signal->cred_guard_mutex);
1852 out_put_fd:
1853         if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) {
1854                 if (ret) {
1855                         listener_f->private_data = NULL;
1856                         fput(listener_f);
1857                         put_unused_fd(listener);
1858                         seccomp_notify_detach(prepared);
1859                 } else {
1860                         fd_install(listener, listener_f);
1861                         ret = listener;
1862                 }
1863         }
1864 out_free:
1865         seccomp_filter_free(prepared);
1866         return ret;
1867 }
1868 #else
1869 static inline long seccomp_set_mode_filter(unsigned int flags,
1870                                            const char __user *filter)
1871 {
1872         return -EINVAL;
1873 }
1874 #endif
1875
1876 static long seccomp_get_action_avail(const char __user *uaction)
1877 {
1878         u32 action;
1879
1880         if (copy_from_user(&action, uaction, sizeof(action)))
1881                 return -EFAULT;
1882
1883         switch (action) {
1884         case SECCOMP_RET_KILL_PROCESS:
1885         case SECCOMP_RET_KILL_THREAD:
1886         case SECCOMP_RET_TRAP:
1887         case SECCOMP_RET_ERRNO:
1888         case SECCOMP_RET_USER_NOTIF:
1889         case SECCOMP_RET_TRACE:
1890         case SECCOMP_RET_LOG:
1891         case SECCOMP_RET_ALLOW:
1892                 break;
1893         default:
1894                 return -EOPNOTSUPP;
1895         }
1896
1897         return 0;
1898 }
1899
1900 static long seccomp_get_notif_sizes(void __user *usizes)
1901 {
1902         struct seccomp_notif_sizes sizes = {
1903                 .seccomp_notif = sizeof(struct seccomp_notif),
1904                 .seccomp_notif_resp = sizeof(struct seccomp_notif_resp),
1905                 .seccomp_data = sizeof(struct seccomp_data),
1906         };
1907
1908         if (copy_to_user(usizes, &sizes, sizeof(sizes)))
1909                 return -EFAULT;
1910
1911         return 0;
1912 }
1913
1914 /* Common entry point for both prctl and syscall. */
1915 static long do_seccomp(unsigned int op, unsigned int flags,
1916                        void __user *uargs)
1917 {
1918         switch (op) {
1919         case SECCOMP_SET_MODE_STRICT:
1920                 if (flags != 0 || uargs != NULL)
1921                         return -EINVAL;
1922                 return seccomp_set_mode_strict();
1923         case SECCOMP_SET_MODE_FILTER:
1924                 return seccomp_set_mode_filter(flags, uargs);
1925         case SECCOMP_GET_ACTION_AVAIL:
1926                 if (flags != 0)
1927                         return -EINVAL;
1928
1929                 return seccomp_get_action_avail(uargs);
1930         case SECCOMP_GET_NOTIF_SIZES:
1931                 if (flags != 0)
1932                         return -EINVAL;
1933
1934                 return seccomp_get_notif_sizes(uargs);
1935         default:
1936                 return -EINVAL;
1937         }
1938 }
1939
1940 SYSCALL_DEFINE3(seccomp, unsigned int, op, unsigned int, flags,
1941                          void __user *, uargs)
1942 {
1943         return do_seccomp(op, flags, uargs);
1944 }
1945
1946 /**
1947  * prctl_set_seccomp: configures current->seccomp.mode
1948  * @seccomp_mode: requested mode to use
1949  * @filter: optional struct sock_fprog for use with SECCOMP_MODE_FILTER
1950  *
1951  * Returns 0 on success or -EINVAL on failure.
1952  */
1953 long prctl_set_seccomp(unsigned long seccomp_mode, void __user *filter)
1954 {
1955         unsigned int op;
1956         void __user *uargs;
1957
1958         switch (seccomp_mode) {
1959         case SECCOMP_MODE_STRICT:
1960                 op = SECCOMP_SET_MODE_STRICT;
1961                 /*
1962                  * Setting strict mode through prctl always ignored filter,
1963                  * so make sure it is always NULL here to pass the internal
1964                  * check in do_seccomp().
1965                  */
1966                 uargs = NULL;
1967                 break;
1968         case SECCOMP_MODE_FILTER:
1969                 op = SECCOMP_SET_MODE_FILTER;
1970                 uargs = filter;
1971                 break;
1972         default:
1973                 return -EINVAL;
1974         }
1975
1976         /* prctl interface doesn't have flags, so they are always zero. */
1977         return do_seccomp(op, 0, uargs);
1978 }
1979
1980 #if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
1981 static struct seccomp_filter *get_nth_filter(struct task_struct *task,
1982                                              unsigned long filter_off)
1983 {
1984         struct seccomp_filter *orig, *filter;
1985         unsigned long count;
1986
1987         /*
1988          * Note: this is only correct because the caller should be the (ptrace)
1989          * tracer of the task, otherwise lock_task_sighand is needed.
1990          */
1991         spin_lock_irq(&task->sighand->siglock);
1992
1993         if (task->seccomp.mode != SECCOMP_MODE_FILTER) {
1994                 spin_unlock_irq(&task->sighand->siglock);
1995                 return ERR_PTR(-EINVAL);
1996         }
1997
1998         orig = task->seccomp.filter;
1999         __get_seccomp_filter(orig);
2000         spin_unlock_irq(&task->sighand->siglock);
2001
2002         count = 0;
2003         for (filter = orig; filter; filter = filter->prev)
2004                 count++;
2005
2006         if (filter_off >= count) {
2007                 filter = ERR_PTR(-ENOENT);
2008                 goto out;
2009         }
2010
2011         count -= filter_off;
2012         for (filter = orig; filter && count > 1; filter = filter->prev)
2013                 count--;
2014
2015         if (WARN_ON(count != 1 || !filter)) {
2016                 filter = ERR_PTR(-ENOENT);
2017                 goto out;
2018         }
2019
2020         __get_seccomp_filter(filter);
2021
2022 out:
2023         __put_seccomp_filter(orig);
2024         return filter;
2025 }
2026
2027 long seccomp_get_filter(struct task_struct *task, unsigned long filter_off,
2028                         void __user *data)
2029 {
2030         struct seccomp_filter *filter;
2031         struct sock_fprog_kern *fprog;
2032         long ret;
2033
2034         if (!capable(CAP_SYS_ADMIN) ||
2035             current->seccomp.mode != SECCOMP_MODE_DISABLED) {
2036                 return -EACCES;
2037         }
2038
2039         filter = get_nth_filter(task, filter_off);
2040         if (IS_ERR(filter))
2041                 return PTR_ERR(filter);
2042
2043         fprog = filter->prog->orig_prog;
2044         if (!fprog) {
2045                 /* This must be a new non-cBPF filter, since we save
2046                  * every cBPF filter's orig_prog above when
2047                  * CONFIG_CHECKPOINT_RESTORE is enabled.
2048                  */
2049                 ret = -EMEDIUMTYPE;
2050                 goto out;
2051         }
2052
2053         ret = fprog->len;
2054         if (!data)
2055                 goto out;
2056
2057         if (copy_to_user(data, fprog->filter, bpf_classic_proglen(fprog)))
2058                 ret = -EFAULT;
2059
2060 out:
2061         __put_seccomp_filter(filter);
2062         return ret;
2063 }
2064
2065 long seccomp_get_metadata(struct task_struct *task,
2066                           unsigned long size, void __user *data)
2067 {
2068         long ret;
2069         struct seccomp_filter *filter;
2070         struct seccomp_metadata kmd = {};
2071
2072         if (!capable(CAP_SYS_ADMIN) ||
2073             current->seccomp.mode != SECCOMP_MODE_DISABLED) {
2074                 return -EACCES;
2075         }
2076
2077         size = min_t(unsigned long, size, sizeof(kmd));
2078
2079         if (size < sizeof(kmd.filter_off))
2080                 return -EINVAL;
2081
2082         if (copy_from_user(&kmd.filter_off, data, sizeof(kmd.filter_off)))
2083                 return -EFAULT;
2084
2085         filter = get_nth_filter(task, kmd.filter_off);
2086         if (IS_ERR(filter))
2087                 return PTR_ERR(filter);
2088
2089         if (filter->log)
2090                 kmd.flags |= SECCOMP_FILTER_FLAG_LOG;
2091
2092         ret = size;
2093         if (copy_to_user(data, &kmd, size))
2094                 ret = -EFAULT;
2095
2096         __put_seccomp_filter(filter);
2097         return ret;
2098 }
2099 #endif
2100
2101 #ifdef CONFIG_SYSCTL
2102
2103 /* Human readable action names for friendly sysctl interaction */
2104 #define SECCOMP_RET_KILL_PROCESS_NAME   "kill_process"
2105 #define SECCOMP_RET_KILL_THREAD_NAME    "kill_thread"
2106 #define SECCOMP_RET_TRAP_NAME           "trap"
2107 #define SECCOMP_RET_ERRNO_NAME          "errno"
2108 #define SECCOMP_RET_USER_NOTIF_NAME     "user_notif"
2109 #define SECCOMP_RET_TRACE_NAME          "trace"
2110 #define SECCOMP_RET_LOG_NAME            "log"
2111 #define SECCOMP_RET_ALLOW_NAME          "allow"
2112
2113 static const char seccomp_actions_avail[] =
2114                                 SECCOMP_RET_KILL_PROCESS_NAME   " "
2115                                 SECCOMP_RET_KILL_THREAD_NAME    " "
2116                                 SECCOMP_RET_TRAP_NAME           " "
2117                                 SECCOMP_RET_ERRNO_NAME          " "
2118                                 SECCOMP_RET_USER_NOTIF_NAME     " "
2119                                 SECCOMP_RET_TRACE_NAME          " "
2120                                 SECCOMP_RET_LOG_NAME            " "
2121                                 SECCOMP_RET_ALLOW_NAME;
2122
2123 struct seccomp_log_name {
2124         u32             log;
2125         const char      *name;
2126 };
2127
2128 static const struct seccomp_log_name seccomp_log_names[] = {
2129         { SECCOMP_LOG_KILL_PROCESS, SECCOMP_RET_KILL_PROCESS_NAME },
2130         { SECCOMP_LOG_KILL_THREAD, SECCOMP_RET_KILL_THREAD_NAME },
2131         { SECCOMP_LOG_TRAP, SECCOMP_RET_TRAP_NAME },
2132         { SECCOMP_LOG_ERRNO, SECCOMP_RET_ERRNO_NAME },
2133         { SECCOMP_LOG_USER_NOTIF, SECCOMP_RET_USER_NOTIF_NAME },
2134         { SECCOMP_LOG_TRACE, SECCOMP_RET_TRACE_NAME },
2135         { SECCOMP_LOG_LOG, SECCOMP_RET_LOG_NAME },
2136         { SECCOMP_LOG_ALLOW, SECCOMP_RET_ALLOW_NAME },
2137         { }
2138 };
2139
2140 static bool seccomp_names_from_actions_logged(char *names, size_t size,
2141                                               u32 actions_logged,
2142                                               const char *sep)
2143 {
2144         const struct seccomp_log_name *cur;
2145         bool append_sep = false;
2146
2147         for (cur = seccomp_log_names; cur->name && size; cur++) {
2148                 ssize_t ret;
2149
2150                 if (!(actions_logged & cur->log))
2151                         continue;
2152
2153                 if (append_sep) {
2154                         ret = strscpy(names, sep, size);
2155                         if (ret < 0)
2156                                 return false;
2157
2158                         names += ret;
2159                         size -= ret;
2160                 } else
2161                         append_sep = true;
2162
2163                 ret = strscpy(names, cur->name, size);
2164                 if (ret < 0)
2165                         return false;
2166
2167                 names += ret;
2168                 size -= ret;
2169         }
2170
2171         return true;
2172 }
2173
2174 static bool seccomp_action_logged_from_name(u32 *action_logged,
2175                                             const char *name)
2176 {
2177         const struct seccomp_log_name *cur;
2178
2179         for (cur = seccomp_log_names; cur->name; cur++) {
2180                 if (!strcmp(cur->name, name)) {
2181                         *action_logged = cur->log;
2182                         return true;
2183                 }
2184         }
2185
2186         return false;
2187 }
2188
2189 static bool seccomp_actions_logged_from_names(u32 *actions_logged, char *names)
2190 {
2191         char *name;
2192
2193         *actions_logged = 0;
2194         while ((name = strsep(&names, " ")) && *name) {
2195                 u32 action_logged = 0;
2196
2197                 if (!seccomp_action_logged_from_name(&action_logged, name))
2198                         return false;
2199
2200                 *actions_logged |= action_logged;
2201         }
2202
2203         return true;
2204 }
2205
2206 static int read_actions_logged(struct ctl_table *ro_table, void *buffer,
2207                                size_t *lenp, loff_t *ppos)
2208 {
2209         char names[sizeof(seccomp_actions_avail)];
2210         struct ctl_table table;
2211
2212         memset(names, 0, sizeof(names));
2213
2214         if (!seccomp_names_from_actions_logged(names, sizeof(names),
2215                                                seccomp_actions_logged, " "))
2216                 return -EINVAL;
2217
2218         table = *ro_table;
2219         table.data = names;
2220         table.maxlen = sizeof(names);
2221         return proc_dostring(&table, 0, buffer, lenp, ppos);
2222 }
2223
2224 static int write_actions_logged(struct ctl_table *ro_table, void *buffer,
2225                                 size_t *lenp, loff_t *ppos, u32 *actions_logged)
2226 {
2227         char names[sizeof(seccomp_actions_avail)];
2228         struct ctl_table table;
2229         int ret;
2230
2231         if (!capable(CAP_SYS_ADMIN))
2232                 return -EPERM;
2233
2234         memset(names, 0, sizeof(names));
2235
2236         table = *ro_table;
2237         table.data = names;
2238         table.maxlen = sizeof(names);
2239         ret = proc_dostring(&table, 1, buffer, lenp, ppos);
2240         if (ret)
2241                 return ret;
2242
2243         if (!seccomp_actions_logged_from_names(actions_logged, table.data))
2244                 return -EINVAL;
2245
2246         if (*actions_logged & SECCOMP_LOG_ALLOW)
2247                 return -EINVAL;
2248
2249         seccomp_actions_logged = *actions_logged;
2250         return 0;
2251 }
2252
2253 static void audit_actions_logged(u32 actions_logged, u32 old_actions_logged,
2254                                  int ret)
2255 {
2256         char names[sizeof(seccomp_actions_avail)];
2257         char old_names[sizeof(seccomp_actions_avail)];
2258         const char *new = names;
2259         const char *old = old_names;
2260
2261         if (!audit_enabled)
2262                 return;
2263
2264         memset(names, 0, sizeof(names));
2265         memset(old_names, 0, sizeof(old_names));
2266
2267         if (ret)
2268                 new = "?";
2269         else if (!actions_logged)
2270                 new = "(none)";
2271         else if (!seccomp_names_from_actions_logged(names, sizeof(names),
2272                                                     actions_logged, ","))
2273                 new = "?";
2274
2275         if (!old_actions_logged)
2276                 old = "(none)";
2277         else if (!seccomp_names_from_actions_logged(old_names,
2278                                                     sizeof(old_names),
2279                                                     old_actions_logged, ","))
2280                 old = "?";
2281
2282         return audit_seccomp_actions_logged(new, old, !ret);
2283 }
2284
2285 static int seccomp_actions_logged_handler(struct ctl_table *ro_table, int write,
2286                                           void *buffer, size_t *lenp,
2287                                           loff_t *ppos)
2288 {
2289         int ret;
2290
2291         if (write) {
2292                 u32 actions_logged = 0;
2293                 u32 old_actions_logged = seccomp_actions_logged;
2294
2295                 ret = write_actions_logged(ro_table, buffer, lenp, ppos,
2296                                            &actions_logged);
2297                 audit_actions_logged(actions_logged, old_actions_logged, ret);
2298         } else
2299                 ret = read_actions_logged(ro_table, buffer, lenp, ppos);
2300
2301         return ret;
2302 }
2303
2304 static struct ctl_path seccomp_sysctl_path[] = {
2305         { .procname = "kernel", },
2306         { .procname = "seccomp", },
2307         { }
2308 };
2309
2310 static struct ctl_table seccomp_sysctl_table[] = {
2311         {
2312                 .procname       = "actions_avail",
2313                 .data           = (void *) &seccomp_actions_avail,
2314                 .maxlen         = sizeof(seccomp_actions_avail),
2315                 .mode           = 0444,
2316                 .proc_handler   = proc_dostring,
2317         },
2318         {
2319                 .procname       = "actions_logged",
2320                 .mode           = 0644,
2321                 .proc_handler   = seccomp_actions_logged_handler,
2322         },
2323         { }
2324 };
2325
2326 static int __init seccomp_sysctl_init(void)
2327 {
2328         struct ctl_table_header *hdr;
2329
2330         hdr = register_sysctl_paths(seccomp_sysctl_path, seccomp_sysctl_table);
2331         if (!hdr)
2332                 pr_warn("sysctl registration failed\n");
2333         else
2334                 kmemleak_not_leak(hdr);
2335
2336         return 0;
2337 }
2338
2339 device_initcall(seccomp_sysctl_init)
2340
2341 #endif /* CONFIG_SYSCTL */
2342
2343 #ifdef CONFIG_SECCOMP_CACHE_DEBUG
2344 /* Currently CONFIG_SECCOMP_CACHE_DEBUG implies SECCOMP_ARCH_NATIVE */
2345 static void proc_pid_seccomp_cache_arch(struct seq_file *m, const char *name,
2346                                         const void *bitmap, size_t bitmap_size)
2347 {
2348         int nr;
2349
2350         for (nr = 0; nr < bitmap_size; nr++) {
2351                 bool cached = test_bit(nr, bitmap);
2352                 char *status = cached ? "ALLOW" : "FILTER";
2353
2354                 seq_printf(m, "%s %d %s\n", name, nr, status);
2355         }
2356 }
2357
2358 int proc_pid_seccomp_cache(struct seq_file *m, struct pid_namespace *ns,
2359                            struct pid *pid, struct task_struct *task)
2360 {
2361         struct seccomp_filter *f;
2362         unsigned long flags;
2363
2364         /*
2365          * We don't want some sandboxed process to know what their seccomp
2366          * filters consist of.
2367          */
2368         if (!file_ns_capable(m->file, &init_user_ns, CAP_SYS_ADMIN))
2369                 return -EACCES;
2370
2371         if (!lock_task_sighand(task, &flags))
2372                 return -ESRCH;
2373
2374         f = READ_ONCE(task->seccomp.filter);
2375         if (!f) {
2376                 unlock_task_sighand(task, &flags);
2377                 return 0;
2378         }
2379
2380         /* prevent filter from being freed while we are printing it */
2381         __get_seccomp_filter(f);
2382         unlock_task_sighand(task, &flags);
2383
2384         proc_pid_seccomp_cache_arch(m, SECCOMP_ARCH_NATIVE_NAME,
2385                                     f->cache.allow_native,
2386                                     SECCOMP_ARCH_NATIVE_NR);
2387
2388 #ifdef SECCOMP_ARCH_COMPAT
2389         proc_pid_seccomp_cache_arch(m, SECCOMP_ARCH_COMPAT_NAME,
2390                                     f->cache.allow_compat,
2391                                     SECCOMP_ARCH_COMPAT_NR);
2392 #endif /* SECCOMP_ARCH_COMPAT */
2393
2394         __put_seccomp_filter(f);
2395         return 0;
2396 }
2397 #endif /* CONFIG_SECCOMP_CACHE_DEBUG */