Merge tag 'irq-urgent-2021-05-23' of git://git.kernel.org/pub/scm/linux/kernel/git...
[linux-2.6-microblaze.git] / kernel / seccomp.c
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * linux/kernel/seccomp.c
4  *
5  * Copyright 2004-2005  Andrea Arcangeli <andrea@cpushare.com>
6  *
7  * Copyright (C) 2012 Google, Inc.
8  * Will Drewry <wad@chromium.org>
9  *
10  * This defines a simple but solid secure-computing facility.
11  *
12  * Mode 1 uses a fixed list of allowed system calls.
13  * Mode 2 allows user-defined system call filters in the form
14  *        of Berkeley Packet Filters/Linux Socket Filters.
15  */
16 #define pr_fmt(fmt) "seccomp: " fmt
17
18 #include <linux/refcount.h>
19 #include <linux/audit.h>
20 #include <linux/compat.h>
21 #include <linux/coredump.h>
22 #include <linux/kmemleak.h>
23 #include <linux/nospec.h>
24 #include <linux/prctl.h>
25 #include <linux/sched.h>
26 #include <linux/sched/task_stack.h>
27 #include <linux/seccomp.h>
28 #include <linux/slab.h>
29 #include <linux/syscalls.h>
30 #include <linux/sysctl.h>
31
32 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
33 #include <asm/syscall.h>
34 #endif
35
36 #ifdef CONFIG_SECCOMP_FILTER
37 #include <linux/file.h>
38 #include <linux/filter.h>
39 #include <linux/pid.h>
40 #include <linux/ptrace.h>
41 #include <linux/capability.h>
42 #include <linux/tracehook.h>
43 #include <linux/uaccess.h>
44 #include <linux/anon_inodes.h>
45 #include <linux/lockdep.h>
46
47 /*
48  * When SECCOMP_IOCTL_NOTIF_ID_VALID was first introduced, it had the
49  * wrong direction flag in the ioctl number. This is the broken one,
50  * which the kernel needs to keep supporting until all userspaces stop
51  * using the wrong command number.
52  */
53 #define SECCOMP_IOCTL_NOTIF_ID_VALID_WRONG_DIR  SECCOMP_IOR(2, __u64)
54
55 enum notify_state {
56         SECCOMP_NOTIFY_INIT,
57         SECCOMP_NOTIFY_SENT,
58         SECCOMP_NOTIFY_REPLIED,
59 };
60
61 struct seccomp_knotif {
62         /* The struct pid of the task whose filter triggered the notification */
63         struct task_struct *task;
64
65         /* The "cookie" for this request; this is unique for this filter. */
66         u64 id;
67
68         /*
69          * The seccomp data. This pointer is valid the entire time this
70          * notification is active, since it comes from __seccomp_filter which
71          * eclipses the entire lifecycle here.
72          */
73         const struct seccomp_data *data;
74
75         /*
76          * Notification states. When SECCOMP_RET_USER_NOTIF is returned, a
77          * struct seccomp_knotif is created and starts out in INIT. Once the
78          * handler reads the notification off of an FD, it transitions to SENT.
79          * If a signal is received the state transitions back to INIT and
80          * another message is sent. When the userspace handler replies, state
81          * transitions to REPLIED.
82          */
83         enum notify_state state;
84
85         /* The return values, only valid when in SECCOMP_NOTIFY_REPLIED */
86         int error;
87         long val;
88         u32 flags;
89
90         /*
91          * Signals when this has changed states, such as the listener
92          * dying, a new seccomp addfd message, or changing to REPLIED
93          */
94         struct completion ready;
95
96         struct list_head list;
97
98         /* outstanding addfd requests */
99         struct list_head addfd;
100 };
101
102 /**
103  * struct seccomp_kaddfd - container for seccomp_addfd ioctl messages
104  *
105  * @file: A reference to the file to install in the other task
106  * @fd: The fd number to install it at. If the fd number is -1, it means the
107  *      installing process should allocate the fd as normal.
108  * @flags: The flags for the new file descriptor. At the moment, only O_CLOEXEC
109  *         is allowed.
110  * @ret: The return value of the installing process. It is set to the fd num
111  *       upon success (>= 0).
112  * @completion: Indicates that the installing process has completed fd
113  *              installation, or gone away (either due to successful
114  *              reply, or signal)
115  *
116  */
117 struct seccomp_kaddfd {
118         struct file *file;
119         int fd;
120         unsigned int flags;
121
122         union {
123                 bool setfd;
124                 /* To only be set on reply */
125                 int ret;
126         };
127         struct completion completion;
128         struct list_head list;
129 };
130
131 /**
132  * struct notification - container for seccomp userspace notifications. Since
133  * most seccomp filters will not have notification listeners attached and this
134  * structure is fairly large, we store the notification-specific stuff in a
135  * separate structure.
136  *
137  * @request: A semaphore that users of this notification can wait on for
138  *           changes. Actual reads and writes are still controlled with
139  *           filter->notify_lock.
140  * @next_id: The id of the next request.
141  * @notifications: A list of struct seccomp_knotif elements.
142  */
143 struct notification {
144         struct semaphore request;
145         u64 next_id;
146         struct list_head notifications;
147 };
148
149 #ifdef SECCOMP_ARCH_NATIVE
150 /**
151  * struct action_cache - per-filter cache of seccomp actions per
152  * arch/syscall pair
153  *
154  * @allow_native: A bitmap where each bit represents whether the
155  *                filter will always allow the syscall, for the
156  *                native architecture.
157  * @allow_compat: A bitmap where each bit represents whether the
158  *                filter will always allow the syscall, for the
159  *                compat architecture.
160  */
161 struct action_cache {
162         DECLARE_BITMAP(allow_native, SECCOMP_ARCH_NATIVE_NR);
163 #ifdef SECCOMP_ARCH_COMPAT
164         DECLARE_BITMAP(allow_compat, SECCOMP_ARCH_COMPAT_NR);
165 #endif
166 };
167 #else
168 struct action_cache { };
169
170 static inline bool seccomp_cache_check_allow(const struct seccomp_filter *sfilter,
171                                              const struct seccomp_data *sd)
172 {
173         return false;
174 }
175
176 static inline void seccomp_cache_prepare(struct seccomp_filter *sfilter)
177 {
178 }
179 #endif /* SECCOMP_ARCH_NATIVE */
180
181 /**
182  * struct seccomp_filter - container for seccomp BPF programs
183  *
184  * @refs: Reference count to manage the object lifetime.
185  *        A filter's reference count is incremented for each directly
186  *        attached task, once for the dependent filter, and if
187  *        requested for the user notifier. When @refs reaches zero,
188  *        the filter can be freed.
189  * @users: A filter's @users count is incremented for each directly
190  *         attached task (filter installation, fork(), thread_sync),
191  *         and once for the dependent filter (tracked in filter->prev).
192  *         When it reaches zero it indicates that no direct or indirect
193  *         users of that filter exist. No new tasks can get associated with
194  *         this filter after reaching 0. The @users count is always smaller
195  *         or equal to @refs. Hence, reaching 0 for @users does not mean
196  *         the filter can be freed.
197  * @cache: cache of arch/syscall mappings to actions
198  * @log: true if all actions except for SECCOMP_RET_ALLOW should be logged
199  * @prev: points to a previously installed, or inherited, filter
200  * @prog: the BPF program to evaluate
201  * @notif: the struct that holds all notification related information
202  * @notify_lock: A lock for all notification-related accesses.
203  * @wqh: A wait queue for poll if a notifier is in use.
204  *
205  * seccomp_filter objects are organized in a tree linked via the @prev
206  * pointer.  For any task, it appears to be a singly-linked list starting
207  * with current->seccomp.filter, the most recently attached or inherited filter.
208  * However, multiple filters may share a @prev node, by way of fork(), which
209  * results in a unidirectional tree existing in memory.  This is similar to
210  * how namespaces work.
211  *
212  * seccomp_filter objects should never be modified after being attached
213  * to a task_struct (other than @refs).
214  */
215 struct seccomp_filter {
216         refcount_t refs;
217         refcount_t users;
218         bool log;
219         struct action_cache cache;
220         struct seccomp_filter *prev;
221         struct bpf_prog *prog;
222         struct notification *notif;
223         struct mutex notify_lock;
224         wait_queue_head_t wqh;
225 };
226
227 /* Limit any path through the tree to 256KB worth of instructions. */
228 #define MAX_INSNS_PER_PATH ((1 << 18) / sizeof(struct sock_filter))
229
230 /*
231  * Endianness is explicitly ignored and left for BPF program authors to manage
232  * as per the specific architecture.
233  */
234 static void populate_seccomp_data(struct seccomp_data *sd)
235 {
236         /*
237          * Instead of using current_pt_reg(), we're already doing the work
238          * to safely fetch "current", so just use "task" everywhere below.
239          */
240         struct task_struct *task = current;
241         struct pt_regs *regs = task_pt_regs(task);
242         unsigned long args[6];
243
244         sd->nr = syscall_get_nr(task, regs);
245         sd->arch = syscall_get_arch(task);
246         syscall_get_arguments(task, regs, args);
247         sd->args[0] = args[0];
248         sd->args[1] = args[1];
249         sd->args[2] = args[2];
250         sd->args[3] = args[3];
251         sd->args[4] = args[4];
252         sd->args[5] = args[5];
253         sd->instruction_pointer = KSTK_EIP(task);
254 }
255
256 /**
257  *      seccomp_check_filter - verify seccomp filter code
258  *      @filter: filter to verify
259  *      @flen: length of filter
260  *
261  * Takes a previously checked filter (by bpf_check_classic) and
262  * redirects all filter code that loads struct sk_buff data
263  * and related data through seccomp_bpf_load.  It also
264  * enforces length and alignment checking of those loads.
265  *
266  * Returns 0 if the rule set is legal or -EINVAL if not.
267  */
268 static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen)
269 {
270         int pc;
271         for (pc = 0; pc < flen; pc++) {
272                 struct sock_filter *ftest = &filter[pc];
273                 u16 code = ftest->code;
274                 u32 k = ftest->k;
275
276                 switch (code) {
277                 case BPF_LD | BPF_W | BPF_ABS:
278                         ftest->code = BPF_LDX | BPF_W | BPF_ABS;
279                         /* 32-bit aligned and not out of bounds. */
280                         if (k >= sizeof(struct seccomp_data) || k & 3)
281                                 return -EINVAL;
282                         continue;
283                 case BPF_LD | BPF_W | BPF_LEN:
284                         ftest->code = BPF_LD | BPF_IMM;
285                         ftest->k = sizeof(struct seccomp_data);
286                         continue;
287                 case BPF_LDX | BPF_W | BPF_LEN:
288                         ftest->code = BPF_LDX | BPF_IMM;
289                         ftest->k = sizeof(struct seccomp_data);
290                         continue;
291                 /* Explicitly include allowed calls. */
292                 case BPF_RET | BPF_K:
293                 case BPF_RET | BPF_A:
294                 case BPF_ALU | BPF_ADD | BPF_K:
295                 case BPF_ALU | BPF_ADD | BPF_X:
296                 case BPF_ALU | BPF_SUB | BPF_K:
297                 case BPF_ALU | BPF_SUB | BPF_X:
298                 case BPF_ALU | BPF_MUL | BPF_K:
299                 case BPF_ALU | BPF_MUL | BPF_X:
300                 case BPF_ALU | BPF_DIV | BPF_K:
301                 case BPF_ALU | BPF_DIV | BPF_X:
302                 case BPF_ALU | BPF_AND | BPF_K:
303                 case BPF_ALU | BPF_AND | BPF_X:
304                 case BPF_ALU | BPF_OR | BPF_K:
305                 case BPF_ALU | BPF_OR | BPF_X:
306                 case BPF_ALU | BPF_XOR | BPF_K:
307                 case BPF_ALU | BPF_XOR | BPF_X:
308                 case BPF_ALU | BPF_LSH | BPF_K:
309                 case BPF_ALU | BPF_LSH | BPF_X:
310                 case BPF_ALU | BPF_RSH | BPF_K:
311                 case BPF_ALU | BPF_RSH | BPF_X:
312                 case BPF_ALU | BPF_NEG:
313                 case BPF_LD | BPF_IMM:
314                 case BPF_LDX | BPF_IMM:
315                 case BPF_MISC | BPF_TAX:
316                 case BPF_MISC | BPF_TXA:
317                 case BPF_LD | BPF_MEM:
318                 case BPF_LDX | BPF_MEM:
319                 case BPF_ST:
320                 case BPF_STX:
321                 case BPF_JMP | BPF_JA:
322                 case BPF_JMP | BPF_JEQ | BPF_K:
323                 case BPF_JMP | BPF_JEQ | BPF_X:
324                 case BPF_JMP | BPF_JGE | BPF_K:
325                 case BPF_JMP | BPF_JGE | BPF_X:
326                 case BPF_JMP | BPF_JGT | BPF_K:
327                 case BPF_JMP | BPF_JGT | BPF_X:
328                 case BPF_JMP | BPF_JSET | BPF_K:
329                 case BPF_JMP | BPF_JSET | BPF_X:
330                         continue;
331                 default:
332                         return -EINVAL;
333                 }
334         }
335         return 0;
336 }
337
338 #ifdef SECCOMP_ARCH_NATIVE
339 static inline bool seccomp_cache_check_allow_bitmap(const void *bitmap,
340                                                     size_t bitmap_size,
341                                                     int syscall_nr)
342 {
343         if (unlikely(syscall_nr < 0 || syscall_nr >= bitmap_size))
344                 return false;
345         syscall_nr = array_index_nospec(syscall_nr, bitmap_size);
346
347         return test_bit(syscall_nr, bitmap);
348 }
349
350 /**
351  * seccomp_cache_check_allow - lookup seccomp cache
352  * @sfilter: The seccomp filter
353  * @sd: The seccomp data to lookup the cache with
354  *
355  * Returns true if the seccomp_data is cached and allowed.
356  */
357 static inline bool seccomp_cache_check_allow(const struct seccomp_filter *sfilter,
358                                              const struct seccomp_data *sd)
359 {
360         int syscall_nr = sd->nr;
361         const struct action_cache *cache = &sfilter->cache;
362
363 #ifndef SECCOMP_ARCH_COMPAT
364         /* A native-only architecture doesn't need to check sd->arch. */
365         return seccomp_cache_check_allow_bitmap(cache->allow_native,
366                                                 SECCOMP_ARCH_NATIVE_NR,
367                                                 syscall_nr);
368 #else
369         if (likely(sd->arch == SECCOMP_ARCH_NATIVE))
370                 return seccomp_cache_check_allow_bitmap(cache->allow_native,
371                                                         SECCOMP_ARCH_NATIVE_NR,
372                                                         syscall_nr);
373         if (likely(sd->arch == SECCOMP_ARCH_COMPAT))
374                 return seccomp_cache_check_allow_bitmap(cache->allow_compat,
375                                                         SECCOMP_ARCH_COMPAT_NR,
376                                                         syscall_nr);
377 #endif /* SECCOMP_ARCH_COMPAT */
378
379         WARN_ON_ONCE(true);
380         return false;
381 }
382 #endif /* SECCOMP_ARCH_NATIVE */
383
384 /**
385  * seccomp_run_filters - evaluates all seccomp filters against @sd
386  * @sd: optional seccomp data to be passed to filters
387  * @match: stores struct seccomp_filter that resulted in the return value,
388  *         unless filter returned SECCOMP_RET_ALLOW, in which case it will
389  *         be unchanged.
390  *
391  * Returns valid seccomp BPF response codes.
392  */
393 #define ACTION_ONLY(ret) ((s32)((ret) & (SECCOMP_RET_ACTION_FULL)))
394 static u32 seccomp_run_filters(const struct seccomp_data *sd,
395                                struct seccomp_filter **match)
396 {
397         u32 ret = SECCOMP_RET_ALLOW;
398         /* Make sure cross-thread synced filter points somewhere sane. */
399         struct seccomp_filter *f =
400                         READ_ONCE(current->seccomp.filter);
401
402         /* Ensure unexpected behavior doesn't result in failing open. */
403         if (WARN_ON(f == NULL))
404                 return SECCOMP_RET_KILL_PROCESS;
405
406         if (seccomp_cache_check_allow(f, sd))
407                 return SECCOMP_RET_ALLOW;
408
409         /*
410          * All filters in the list are evaluated and the lowest BPF return
411          * value always takes priority (ignoring the DATA).
412          */
413         for (; f; f = f->prev) {
414                 u32 cur_ret = bpf_prog_run_pin_on_cpu(f->prog, sd);
415
416                 if (ACTION_ONLY(cur_ret) < ACTION_ONLY(ret)) {
417                         ret = cur_ret;
418                         *match = f;
419                 }
420         }
421         return ret;
422 }
423 #endif /* CONFIG_SECCOMP_FILTER */
424
425 static inline bool seccomp_may_assign_mode(unsigned long seccomp_mode)
426 {
427         assert_spin_locked(&current->sighand->siglock);
428
429         if (current->seccomp.mode && current->seccomp.mode != seccomp_mode)
430                 return false;
431
432         return true;
433 }
434
435 void __weak arch_seccomp_spec_mitigate(struct task_struct *task) { }
436
437 static inline void seccomp_assign_mode(struct task_struct *task,
438                                        unsigned long seccomp_mode,
439                                        unsigned long flags)
440 {
441         assert_spin_locked(&task->sighand->siglock);
442
443         task->seccomp.mode = seccomp_mode;
444         /*
445          * Make sure SYSCALL_WORK_SECCOMP cannot be set before the mode (and
446          * filter) is set.
447          */
448         smp_mb__before_atomic();
449         /* Assume default seccomp processes want spec flaw mitigation. */
450         if ((flags & SECCOMP_FILTER_FLAG_SPEC_ALLOW) == 0)
451                 arch_seccomp_spec_mitigate(task);
452         set_task_syscall_work(task, SECCOMP);
453 }
454
455 #ifdef CONFIG_SECCOMP_FILTER
456 /* Returns 1 if the parent is an ancestor of the child. */
457 static int is_ancestor(struct seccomp_filter *parent,
458                        struct seccomp_filter *child)
459 {
460         /* NULL is the root ancestor. */
461         if (parent == NULL)
462                 return 1;
463         for (; child; child = child->prev)
464                 if (child == parent)
465                         return 1;
466         return 0;
467 }
468
469 /**
470  * seccomp_can_sync_threads: checks if all threads can be synchronized
471  *
472  * Expects sighand and cred_guard_mutex locks to be held.
473  *
474  * Returns 0 on success, -ve on error, or the pid of a thread which was
475  * either not in the correct seccomp mode or did not have an ancestral
476  * seccomp filter.
477  */
478 static inline pid_t seccomp_can_sync_threads(void)
479 {
480         struct task_struct *thread, *caller;
481
482         BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
483         assert_spin_locked(&current->sighand->siglock);
484
485         /* Validate all threads being eligible for synchronization. */
486         caller = current;
487         for_each_thread(caller, thread) {
488                 pid_t failed;
489
490                 /* Skip current, since it is initiating the sync. */
491                 if (thread == caller)
492                         continue;
493
494                 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED ||
495                     (thread->seccomp.mode == SECCOMP_MODE_FILTER &&
496                      is_ancestor(thread->seccomp.filter,
497                                  caller->seccomp.filter)))
498                         continue;
499
500                 /* Return the first thread that cannot be synchronized. */
501                 failed = task_pid_vnr(thread);
502                 /* If the pid cannot be resolved, then return -ESRCH */
503                 if (WARN_ON(failed == 0))
504                         failed = -ESRCH;
505                 return failed;
506         }
507
508         return 0;
509 }
510
511 static inline void seccomp_filter_free(struct seccomp_filter *filter)
512 {
513         if (filter) {
514                 bpf_prog_destroy(filter->prog);
515                 kfree(filter);
516         }
517 }
518
519 static void __seccomp_filter_orphan(struct seccomp_filter *orig)
520 {
521         while (orig && refcount_dec_and_test(&orig->users)) {
522                 if (waitqueue_active(&orig->wqh))
523                         wake_up_poll(&orig->wqh, EPOLLHUP);
524                 orig = orig->prev;
525         }
526 }
527
528 static void __put_seccomp_filter(struct seccomp_filter *orig)
529 {
530         /* Clean up single-reference branches iteratively. */
531         while (orig && refcount_dec_and_test(&orig->refs)) {
532                 struct seccomp_filter *freeme = orig;
533                 orig = orig->prev;
534                 seccomp_filter_free(freeme);
535         }
536 }
537
538 static void __seccomp_filter_release(struct seccomp_filter *orig)
539 {
540         /* Notify about any unused filters in the task's former filter tree. */
541         __seccomp_filter_orphan(orig);
542         /* Finally drop all references to the task's former tree. */
543         __put_seccomp_filter(orig);
544 }
545
546 /**
547  * seccomp_filter_release - Detach the task from its filter tree,
548  *                          drop its reference count, and notify
549  *                          about unused filters
550  *
551  * This function should only be called when the task is exiting as
552  * it detaches it from its filter tree. As such, READ_ONCE() and
553  * barriers are not needed here, as would normally be needed.
554  */
555 void seccomp_filter_release(struct task_struct *tsk)
556 {
557         struct seccomp_filter *orig = tsk->seccomp.filter;
558
559         /* We are effectively holding the siglock by not having any sighand. */
560         WARN_ON(tsk->sighand != NULL);
561
562         /* Detach task from its filter tree. */
563         tsk->seccomp.filter = NULL;
564         __seccomp_filter_release(orig);
565 }
566
567 /**
568  * seccomp_sync_threads: sets all threads to use current's filter
569  *
570  * Expects sighand and cred_guard_mutex locks to be held, and for
571  * seccomp_can_sync_threads() to have returned success already
572  * without dropping the locks.
573  *
574  */
575 static inline void seccomp_sync_threads(unsigned long flags)
576 {
577         struct task_struct *thread, *caller;
578
579         BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
580         assert_spin_locked(&current->sighand->siglock);
581
582         /* Synchronize all threads. */
583         caller = current;
584         for_each_thread(caller, thread) {
585                 /* Skip current, since it needs no changes. */
586                 if (thread == caller)
587                         continue;
588
589                 /* Get a task reference for the new leaf node. */
590                 get_seccomp_filter(caller);
591
592                 /*
593                  * Drop the task reference to the shared ancestor since
594                  * current's path will hold a reference.  (This also
595                  * allows a put before the assignment.)
596                  */
597                 __seccomp_filter_release(thread->seccomp.filter);
598
599                 /* Make our new filter tree visible. */
600                 smp_store_release(&thread->seccomp.filter,
601                                   caller->seccomp.filter);
602                 atomic_set(&thread->seccomp.filter_count,
603                            atomic_read(&thread->seccomp.filter_count));
604
605                 /*
606                  * Don't let an unprivileged task work around
607                  * the no_new_privs restriction by creating
608                  * a thread that sets it up, enters seccomp,
609                  * then dies.
610                  */
611                 if (task_no_new_privs(caller))
612                         task_set_no_new_privs(thread);
613
614                 /*
615                  * Opt the other thread into seccomp if needed.
616                  * As threads are considered to be trust-realm
617                  * equivalent (see ptrace_may_access), it is safe to
618                  * allow one thread to transition the other.
619                  */
620                 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED)
621                         seccomp_assign_mode(thread, SECCOMP_MODE_FILTER,
622                                             flags);
623         }
624 }
625
626 /**
627  * seccomp_prepare_filter: Prepares a seccomp filter for use.
628  * @fprog: BPF program to install
629  *
630  * Returns filter on success or an ERR_PTR on failure.
631  */
632 static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog)
633 {
634         struct seccomp_filter *sfilter;
635         int ret;
636         const bool save_orig =
637 #if defined(CONFIG_CHECKPOINT_RESTORE) || defined(SECCOMP_ARCH_NATIVE)
638                 true;
639 #else
640                 false;
641 #endif
642
643         if (fprog->len == 0 || fprog->len > BPF_MAXINSNS)
644                 return ERR_PTR(-EINVAL);
645
646         BUG_ON(INT_MAX / fprog->len < sizeof(struct sock_filter));
647
648         /*
649          * Installing a seccomp filter requires that the task has
650          * CAP_SYS_ADMIN in its namespace or be running with no_new_privs.
651          * This avoids scenarios where unprivileged tasks can affect the
652          * behavior of privileged children.
653          */
654         if (!task_no_new_privs(current) &&
655                         !ns_capable_noaudit(current_user_ns(), CAP_SYS_ADMIN))
656                 return ERR_PTR(-EACCES);
657
658         /* Allocate a new seccomp_filter */
659         sfilter = kzalloc(sizeof(*sfilter), GFP_KERNEL | __GFP_NOWARN);
660         if (!sfilter)
661                 return ERR_PTR(-ENOMEM);
662
663         mutex_init(&sfilter->notify_lock);
664         ret = bpf_prog_create_from_user(&sfilter->prog, fprog,
665                                         seccomp_check_filter, save_orig);
666         if (ret < 0) {
667                 kfree(sfilter);
668                 return ERR_PTR(ret);
669         }
670
671         refcount_set(&sfilter->refs, 1);
672         refcount_set(&sfilter->users, 1);
673         init_waitqueue_head(&sfilter->wqh);
674
675         return sfilter;
676 }
677
678 /**
679  * seccomp_prepare_user_filter - prepares a user-supplied sock_fprog
680  * @user_filter: pointer to the user data containing a sock_fprog.
681  *
682  * Returns 0 on success and non-zero otherwise.
683  */
684 static struct seccomp_filter *
685 seccomp_prepare_user_filter(const char __user *user_filter)
686 {
687         struct sock_fprog fprog;
688         struct seccomp_filter *filter = ERR_PTR(-EFAULT);
689
690 #ifdef CONFIG_COMPAT
691         if (in_compat_syscall()) {
692                 struct compat_sock_fprog fprog32;
693                 if (copy_from_user(&fprog32, user_filter, sizeof(fprog32)))
694                         goto out;
695                 fprog.len = fprog32.len;
696                 fprog.filter = compat_ptr(fprog32.filter);
697         } else /* falls through to the if below. */
698 #endif
699         if (copy_from_user(&fprog, user_filter, sizeof(fprog)))
700                 goto out;
701         filter = seccomp_prepare_filter(&fprog);
702 out:
703         return filter;
704 }
705
706 #ifdef SECCOMP_ARCH_NATIVE
707 /**
708  * seccomp_is_const_allow - check if filter is constant allow with given data
709  * @fprog: The BPF programs
710  * @sd: The seccomp data to check against, only syscall number and arch
711  *      number are considered constant.
712  */
713 static bool seccomp_is_const_allow(struct sock_fprog_kern *fprog,
714                                    struct seccomp_data *sd)
715 {
716         unsigned int reg_value = 0;
717         unsigned int pc;
718         bool op_res;
719
720         if (WARN_ON_ONCE(!fprog))
721                 return false;
722
723         for (pc = 0; pc < fprog->len; pc++) {
724                 struct sock_filter *insn = &fprog->filter[pc];
725                 u16 code = insn->code;
726                 u32 k = insn->k;
727
728                 switch (code) {
729                 case BPF_LD | BPF_W | BPF_ABS:
730                         switch (k) {
731                         case offsetof(struct seccomp_data, nr):
732                                 reg_value = sd->nr;
733                                 break;
734                         case offsetof(struct seccomp_data, arch):
735                                 reg_value = sd->arch;
736                                 break;
737                         default:
738                                 /* can't optimize (non-constant value load) */
739                                 return false;
740                         }
741                         break;
742                 case BPF_RET | BPF_K:
743                         /* reached return with constant values only, check allow */
744                         return k == SECCOMP_RET_ALLOW;
745                 case BPF_JMP | BPF_JA:
746                         pc += insn->k;
747                         break;
748                 case BPF_JMP | BPF_JEQ | BPF_K:
749                 case BPF_JMP | BPF_JGE | BPF_K:
750                 case BPF_JMP | BPF_JGT | BPF_K:
751                 case BPF_JMP | BPF_JSET | BPF_K:
752                         switch (BPF_OP(code)) {
753                         case BPF_JEQ:
754                                 op_res = reg_value == k;
755                                 break;
756                         case BPF_JGE:
757                                 op_res = reg_value >= k;
758                                 break;
759                         case BPF_JGT:
760                                 op_res = reg_value > k;
761                                 break;
762                         case BPF_JSET:
763                                 op_res = !!(reg_value & k);
764                                 break;
765                         default:
766                                 /* can't optimize (unknown jump) */
767                                 return false;
768                         }
769
770                         pc += op_res ? insn->jt : insn->jf;
771                         break;
772                 case BPF_ALU | BPF_AND | BPF_K:
773                         reg_value &= k;
774                         break;
775                 default:
776                         /* can't optimize (unknown insn) */
777                         return false;
778                 }
779         }
780
781         /* ran off the end of the filter?! */
782         WARN_ON(1);
783         return false;
784 }
785
786 static void seccomp_cache_prepare_bitmap(struct seccomp_filter *sfilter,
787                                          void *bitmap, const void *bitmap_prev,
788                                          size_t bitmap_size, int arch)
789 {
790         struct sock_fprog_kern *fprog = sfilter->prog->orig_prog;
791         struct seccomp_data sd;
792         int nr;
793
794         if (bitmap_prev) {
795                 /* The new filter must be as restrictive as the last. */
796                 bitmap_copy(bitmap, bitmap_prev, bitmap_size);
797         } else {
798                 /* Before any filters, all syscalls are always allowed. */
799                 bitmap_fill(bitmap, bitmap_size);
800         }
801
802         for (nr = 0; nr < bitmap_size; nr++) {
803                 /* No bitmap change: not a cacheable action. */
804                 if (!test_bit(nr, bitmap))
805                         continue;
806
807                 sd.nr = nr;
808                 sd.arch = arch;
809
810                 /* No bitmap change: continue to always allow. */
811                 if (seccomp_is_const_allow(fprog, &sd))
812                         continue;
813
814                 /*
815                  * Not a cacheable action: always run filters.
816                  * atomic clear_bit() not needed, filter not visible yet.
817                  */
818                 __clear_bit(nr, bitmap);
819         }
820 }
821
822 /**
823  * seccomp_cache_prepare - emulate the filter to find cacheable syscalls
824  * @sfilter: The seccomp filter
825  *
826  * Returns 0 if successful or -errno if error occurred.
827  */
828 static void seccomp_cache_prepare(struct seccomp_filter *sfilter)
829 {
830         struct action_cache *cache = &sfilter->cache;
831         const struct action_cache *cache_prev =
832                 sfilter->prev ? &sfilter->prev->cache : NULL;
833
834         seccomp_cache_prepare_bitmap(sfilter, cache->allow_native,
835                                      cache_prev ? cache_prev->allow_native : NULL,
836                                      SECCOMP_ARCH_NATIVE_NR,
837                                      SECCOMP_ARCH_NATIVE);
838
839 #ifdef SECCOMP_ARCH_COMPAT
840         seccomp_cache_prepare_bitmap(sfilter, cache->allow_compat,
841                                      cache_prev ? cache_prev->allow_compat : NULL,
842                                      SECCOMP_ARCH_COMPAT_NR,
843                                      SECCOMP_ARCH_COMPAT);
844 #endif /* SECCOMP_ARCH_COMPAT */
845 }
846 #endif /* SECCOMP_ARCH_NATIVE */
847
848 /**
849  * seccomp_attach_filter: validate and attach filter
850  * @flags:  flags to change filter behavior
851  * @filter: seccomp filter to add to the current process
852  *
853  * Caller must be holding current->sighand->siglock lock.
854  *
855  * Returns 0 on success, -ve on error, or
856  *   - in TSYNC mode: the pid of a thread which was either not in the correct
857  *     seccomp mode or did not have an ancestral seccomp filter
858  *   - in NEW_LISTENER mode: the fd of the new listener
859  */
860 static long seccomp_attach_filter(unsigned int flags,
861                                   struct seccomp_filter *filter)
862 {
863         unsigned long total_insns;
864         struct seccomp_filter *walker;
865
866         assert_spin_locked(&current->sighand->siglock);
867
868         /* Validate resulting filter length. */
869         total_insns = filter->prog->len;
870         for (walker = current->seccomp.filter; walker; walker = walker->prev)
871                 total_insns += walker->prog->len + 4;  /* 4 instr penalty */
872         if (total_insns > MAX_INSNS_PER_PATH)
873                 return -ENOMEM;
874
875         /* If thread sync has been requested, check that it is possible. */
876         if (flags & SECCOMP_FILTER_FLAG_TSYNC) {
877                 int ret;
878
879                 ret = seccomp_can_sync_threads();
880                 if (ret) {
881                         if (flags & SECCOMP_FILTER_FLAG_TSYNC_ESRCH)
882                                 return -ESRCH;
883                         else
884                                 return ret;
885                 }
886         }
887
888         /* Set log flag, if present. */
889         if (flags & SECCOMP_FILTER_FLAG_LOG)
890                 filter->log = true;
891
892         /*
893          * If there is an existing filter, make it the prev and don't drop its
894          * task reference.
895          */
896         filter->prev = current->seccomp.filter;
897         seccomp_cache_prepare(filter);
898         current->seccomp.filter = filter;
899         atomic_inc(&current->seccomp.filter_count);
900
901         /* Now that the new filter is in place, synchronize to all threads. */
902         if (flags & SECCOMP_FILTER_FLAG_TSYNC)
903                 seccomp_sync_threads(flags);
904
905         return 0;
906 }
907
908 static void __get_seccomp_filter(struct seccomp_filter *filter)
909 {
910         refcount_inc(&filter->refs);
911 }
912
913 /* get_seccomp_filter - increments the reference count of the filter on @tsk */
914 void get_seccomp_filter(struct task_struct *tsk)
915 {
916         struct seccomp_filter *orig = tsk->seccomp.filter;
917         if (!orig)
918                 return;
919         __get_seccomp_filter(orig);
920         refcount_inc(&orig->users);
921 }
922
923 static void seccomp_init_siginfo(kernel_siginfo_t *info, int syscall, int reason)
924 {
925         clear_siginfo(info);
926         info->si_signo = SIGSYS;
927         info->si_code = SYS_SECCOMP;
928         info->si_call_addr = (void __user *)KSTK_EIP(current);
929         info->si_errno = reason;
930         info->si_arch = syscall_get_arch(current);
931         info->si_syscall = syscall;
932 }
933
934 /**
935  * seccomp_send_sigsys - signals the task to allow in-process syscall emulation
936  * @syscall: syscall number to send to userland
937  * @reason: filter-supplied reason code to send to userland (via si_errno)
938  *
939  * Forces a SIGSYS with a code of SYS_SECCOMP and related sigsys info.
940  */
941 static void seccomp_send_sigsys(int syscall, int reason)
942 {
943         struct kernel_siginfo info;
944         seccomp_init_siginfo(&info, syscall, reason);
945         force_sig_info(&info);
946 }
947 #endif  /* CONFIG_SECCOMP_FILTER */
948
949 /* For use with seccomp_actions_logged */
950 #define SECCOMP_LOG_KILL_PROCESS        (1 << 0)
951 #define SECCOMP_LOG_KILL_THREAD         (1 << 1)
952 #define SECCOMP_LOG_TRAP                (1 << 2)
953 #define SECCOMP_LOG_ERRNO               (1 << 3)
954 #define SECCOMP_LOG_TRACE               (1 << 4)
955 #define SECCOMP_LOG_LOG                 (1 << 5)
956 #define SECCOMP_LOG_ALLOW               (1 << 6)
957 #define SECCOMP_LOG_USER_NOTIF          (1 << 7)
958
959 static u32 seccomp_actions_logged = SECCOMP_LOG_KILL_PROCESS |
960                                     SECCOMP_LOG_KILL_THREAD  |
961                                     SECCOMP_LOG_TRAP  |
962                                     SECCOMP_LOG_ERRNO |
963                                     SECCOMP_LOG_USER_NOTIF |
964                                     SECCOMP_LOG_TRACE |
965                                     SECCOMP_LOG_LOG;
966
967 static inline void seccomp_log(unsigned long syscall, long signr, u32 action,
968                                bool requested)
969 {
970         bool log = false;
971
972         switch (action) {
973         case SECCOMP_RET_ALLOW:
974                 break;
975         case SECCOMP_RET_TRAP:
976                 log = requested && seccomp_actions_logged & SECCOMP_LOG_TRAP;
977                 break;
978         case SECCOMP_RET_ERRNO:
979                 log = requested && seccomp_actions_logged & SECCOMP_LOG_ERRNO;
980                 break;
981         case SECCOMP_RET_TRACE:
982                 log = requested && seccomp_actions_logged & SECCOMP_LOG_TRACE;
983                 break;
984         case SECCOMP_RET_USER_NOTIF:
985                 log = requested && seccomp_actions_logged & SECCOMP_LOG_USER_NOTIF;
986                 break;
987         case SECCOMP_RET_LOG:
988                 log = seccomp_actions_logged & SECCOMP_LOG_LOG;
989                 break;
990         case SECCOMP_RET_KILL_THREAD:
991                 log = seccomp_actions_logged & SECCOMP_LOG_KILL_THREAD;
992                 break;
993         case SECCOMP_RET_KILL_PROCESS:
994         default:
995                 log = seccomp_actions_logged & SECCOMP_LOG_KILL_PROCESS;
996         }
997
998         /*
999          * Emit an audit message when the action is RET_KILL_*, RET_LOG, or the
1000          * FILTER_FLAG_LOG bit was set. The admin has the ability to silence
1001          * any action from being logged by removing the action name from the
1002          * seccomp_actions_logged sysctl.
1003          */
1004         if (!log)
1005                 return;
1006
1007         audit_seccomp(syscall, signr, action);
1008 }
1009
1010 /*
1011  * Secure computing mode 1 allows only read/write/exit/sigreturn.
1012  * To be fully secure this must be combined with rlimit
1013  * to limit the stack allocations too.
1014  */
1015 static const int mode1_syscalls[] = {
1016         __NR_seccomp_read, __NR_seccomp_write, __NR_seccomp_exit, __NR_seccomp_sigreturn,
1017         -1, /* negative terminated */
1018 };
1019
1020 static void __secure_computing_strict(int this_syscall)
1021 {
1022         const int *allowed_syscalls = mode1_syscalls;
1023 #ifdef CONFIG_COMPAT
1024         if (in_compat_syscall())
1025                 allowed_syscalls = get_compat_mode1_syscalls();
1026 #endif
1027         do {
1028                 if (*allowed_syscalls == this_syscall)
1029                         return;
1030         } while (*++allowed_syscalls != -1);
1031
1032 #ifdef SECCOMP_DEBUG
1033         dump_stack();
1034 #endif
1035         seccomp_log(this_syscall, SIGKILL, SECCOMP_RET_KILL_THREAD, true);
1036         do_exit(SIGKILL);
1037 }
1038
1039 #ifndef CONFIG_HAVE_ARCH_SECCOMP_FILTER
1040 void secure_computing_strict(int this_syscall)
1041 {
1042         int mode = current->seccomp.mode;
1043
1044         if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) &&
1045             unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
1046                 return;
1047
1048         if (mode == SECCOMP_MODE_DISABLED)
1049                 return;
1050         else if (mode == SECCOMP_MODE_STRICT)
1051                 __secure_computing_strict(this_syscall);
1052         else
1053                 BUG();
1054 }
1055 #else
1056
1057 #ifdef CONFIG_SECCOMP_FILTER
1058 static u64 seccomp_next_notify_id(struct seccomp_filter *filter)
1059 {
1060         /*
1061          * Note: overflow is ok here, the id just needs to be unique per
1062          * filter.
1063          */
1064         lockdep_assert_held(&filter->notify_lock);
1065         return filter->notif->next_id++;
1066 }
1067
1068 static void seccomp_handle_addfd(struct seccomp_kaddfd *addfd)
1069 {
1070         /*
1071          * Remove the notification, and reset the list pointers, indicating
1072          * that it has been handled.
1073          */
1074         list_del_init(&addfd->list);
1075         if (!addfd->setfd)
1076                 addfd->ret = receive_fd(addfd->file, addfd->flags);
1077         else
1078                 addfd->ret = receive_fd_replace(addfd->fd, addfd->file,
1079                                                 addfd->flags);
1080         complete(&addfd->completion);
1081 }
1082
1083 static int seccomp_do_user_notification(int this_syscall,
1084                                         struct seccomp_filter *match,
1085                                         const struct seccomp_data *sd)
1086 {
1087         int err;
1088         u32 flags = 0;
1089         long ret = 0;
1090         struct seccomp_knotif n = {};
1091         struct seccomp_kaddfd *addfd, *tmp;
1092
1093         mutex_lock(&match->notify_lock);
1094         err = -ENOSYS;
1095         if (!match->notif)
1096                 goto out;
1097
1098         n.task = current;
1099         n.state = SECCOMP_NOTIFY_INIT;
1100         n.data = sd;
1101         n.id = seccomp_next_notify_id(match);
1102         init_completion(&n.ready);
1103         list_add(&n.list, &match->notif->notifications);
1104         INIT_LIST_HEAD(&n.addfd);
1105
1106         up(&match->notif->request);
1107         wake_up_poll(&match->wqh, EPOLLIN | EPOLLRDNORM);
1108         mutex_unlock(&match->notify_lock);
1109
1110         /*
1111          * This is where we wait for a reply from userspace.
1112          */
1113 wait:
1114         err = wait_for_completion_interruptible(&n.ready);
1115         mutex_lock(&match->notify_lock);
1116         if (err == 0) {
1117                 /* Check if we were woken up by a addfd message */
1118                 addfd = list_first_entry_or_null(&n.addfd,
1119                                                  struct seccomp_kaddfd, list);
1120                 if (addfd && n.state != SECCOMP_NOTIFY_REPLIED) {
1121                         seccomp_handle_addfd(addfd);
1122                         mutex_unlock(&match->notify_lock);
1123                         goto wait;
1124                 }
1125                 ret = n.val;
1126                 err = n.error;
1127                 flags = n.flags;
1128         }
1129
1130         /* If there were any pending addfd calls, clear them out */
1131         list_for_each_entry_safe(addfd, tmp, &n.addfd, list) {
1132                 /* The process went away before we got a chance to handle it */
1133                 addfd->ret = -ESRCH;
1134                 list_del_init(&addfd->list);
1135                 complete(&addfd->completion);
1136         }
1137
1138         /*
1139          * Note that it's possible the listener died in between the time when
1140          * we were notified of a response (or a signal) and when we were able to
1141          * re-acquire the lock, so only delete from the list if the
1142          * notification actually exists.
1143          *
1144          * Also note that this test is only valid because there's no way to
1145          * *reattach* to a notifier right now. If one is added, we'll need to
1146          * keep track of the notif itself and make sure they match here.
1147          */
1148         if (match->notif)
1149                 list_del(&n.list);
1150 out:
1151         mutex_unlock(&match->notify_lock);
1152
1153         /* Userspace requests to continue the syscall. */
1154         if (flags & SECCOMP_USER_NOTIF_FLAG_CONTINUE)
1155                 return 0;
1156
1157         syscall_set_return_value(current, current_pt_regs(),
1158                                  err, ret);
1159         return -1;
1160 }
1161
1162 static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
1163                             const bool recheck_after_trace)
1164 {
1165         u32 filter_ret, action;
1166         struct seccomp_filter *match = NULL;
1167         int data;
1168         struct seccomp_data sd_local;
1169
1170         /*
1171          * Make sure that any changes to mode from another thread have
1172          * been seen after SYSCALL_WORK_SECCOMP was seen.
1173          */
1174         smp_rmb();
1175
1176         if (!sd) {
1177                 populate_seccomp_data(&sd_local);
1178                 sd = &sd_local;
1179         }
1180
1181         filter_ret = seccomp_run_filters(sd, &match);
1182         data = filter_ret & SECCOMP_RET_DATA;
1183         action = filter_ret & SECCOMP_RET_ACTION_FULL;
1184
1185         switch (action) {
1186         case SECCOMP_RET_ERRNO:
1187                 /* Set low-order bits as an errno, capped at MAX_ERRNO. */
1188                 if (data > MAX_ERRNO)
1189                         data = MAX_ERRNO;
1190                 syscall_set_return_value(current, current_pt_regs(),
1191                                          -data, 0);
1192                 goto skip;
1193
1194         case SECCOMP_RET_TRAP:
1195                 /* Show the handler the original registers. */
1196                 syscall_rollback(current, current_pt_regs());
1197                 /* Let the filter pass back 16 bits of data. */
1198                 seccomp_send_sigsys(this_syscall, data);
1199                 goto skip;
1200
1201         case SECCOMP_RET_TRACE:
1202                 /* We've been put in this state by the ptracer already. */
1203                 if (recheck_after_trace)
1204                         return 0;
1205
1206                 /* ENOSYS these calls if there is no tracer attached. */
1207                 if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP)) {
1208                         syscall_set_return_value(current,
1209                                                  current_pt_regs(),
1210                                                  -ENOSYS, 0);
1211                         goto skip;
1212                 }
1213
1214                 /* Allow the BPF to provide the event message */
1215                 ptrace_event(PTRACE_EVENT_SECCOMP, data);
1216                 /*
1217                  * The delivery of a fatal signal during event
1218                  * notification may silently skip tracer notification,
1219                  * which could leave us with a potentially unmodified
1220                  * syscall that the tracer would have liked to have
1221                  * changed. Since the process is about to die, we just
1222                  * force the syscall to be skipped and let the signal
1223                  * kill the process and correctly handle any tracer exit
1224                  * notifications.
1225                  */
1226                 if (fatal_signal_pending(current))
1227                         goto skip;
1228                 /* Check if the tracer forced the syscall to be skipped. */
1229                 this_syscall = syscall_get_nr(current, current_pt_regs());
1230                 if (this_syscall < 0)
1231                         goto skip;
1232
1233                 /*
1234                  * Recheck the syscall, since it may have changed. This
1235                  * intentionally uses a NULL struct seccomp_data to force
1236                  * a reload of all registers. This does not goto skip since
1237                  * a skip would have already been reported.
1238                  */
1239                 if (__seccomp_filter(this_syscall, NULL, true))
1240                         return -1;
1241
1242                 return 0;
1243
1244         case SECCOMP_RET_USER_NOTIF:
1245                 if (seccomp_do_user_notification(this_syscall, match, sd))
1246                         goto skip;
1247
1248                 return 0;
1249
1250         case SECCOMP_RET_LOG:
1251                 seccomp_log(this_syscall, 0, action, true);
1252                 return 0;
1253
1254         case SECCOMP_RET_ALLOW:
1255                 /*
1256                  * Note that the "match" filter will always be NULL for
1257                  * this action since SECCOMP_RET_ALLOW is the starting
1258                  * state in seccomp_run_filters().
1259                  */
1260                 return 0;
1261
1262         case SECCOMP_RET_KILL_THREAD:
1263         case SECCOMP_RET_KILL_PROCESS:
1264         default:
1265                 seccomp_log(this_syscall, SIGSYS, action, true);
1266                 /* Dump core only if this is the last remaining thread. */
1267                 if (action != SECCOMP_RET_KILL_THREAD ||
1268                     get_nr_threads(current) == 1) {
1269                         kernel_siginfo_t info;
1270
1271                         /* Show the original registers in the dump. */
1272                         syscall_rollback(current, current_pt_regs());
1273                         /* Trigger a manual coredump since do_exit skips it. */
1274                         seccomp_init_siginfo(&info, this_syscall, data);
1275                         do_coredump(&info);
1276                 }
1277                 if (action == SECCOMP_RET_KILL_THREAD)
1278                         do_exit(SIGSYS);
1279                 else
1280                         do_group_exit(SIGSYS);
1281         }
1282
1283         unreachable();
1284
1285 skip:
1286         seccomp_log(this_syscall, 0, action, match ? match->log : false);
1287         return -1;
1288 }
1289 #else
1290 static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
1291                             const bool recheck_after_trace)
1292 {
1293         BUG();
1294
1295         return -1;
1296 }
1297 #endif
1298
1299 int __secure_computing(const struct seccomp_data *sd)
1300 {
1301         int mode = current->seccomp.mode;
1302         int this_syscall;
1303
1304         if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) &&
1305             unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
1306                 return 0;
1307
1308         this_syscall = sd ? sd->nr :
1309                 syscall_get_nr(current, current_pt_regs());
1310
1311         switch (mode) {
1312         case SECCOMP_MODE_STRICT:
1313                 __secure_computing_strict(this_syscall);  /* may call do_exit */
1314                 return 0;
1315         case SECCOMP_MODE_FILTER:
1316                 return __seccomp_filter(this_syscall, sd, false);
1317         default:
1318                 BUG();
1319         }
1320 }
1321 #endif /* CONFIG_HAVE_ARCH_SECCOMP_FILTER */
1322
1323 long prctl_get_seccomp(void)
1324 {
1325         return current->seccomp.mode;
1326 }
1327
1328 /**
1329  * seccomp_set_mode_strict: internal function for setting strict seccomp
1330  *
1331  * Once current->seccomp.mode is non-zero, it may not be changed.
1332  *
1333  * Returns 0 on success or -EINVAL on failure.
1334  */
1335 static long seccomp_set_mode_strict(void)
1336 {
1337         const unsigned long seccomp_mode = SECCOMP_MODE_STRICT;
1338         long ret = -EINVAL;
1339
1340         spin_lock_irq(&current->sighand->siglock);
1341
1342         if (!seccomp_may_assign_mode(seccomp_mode))
1343                 goto out;
1344
1345 #ifdef TIF_NOTSC
1346         disable_TSC();
1347 #endif
1348         seccomp_assign_mode(current, seccomp_mode, 0);
1349         ret = 0;
1350
1351 out:
1352         spin_unlock_irq(&current->sighand->siglock);
1353
1354         return ret;
1355 }
1356
1357 #ifdef CONFIG_SECCOMP_FILTER
1358 static void seccomp_notify_free(struct seccomp_filter *filter)
1359 {
1360         kfree(filter->notif);
1361         filter->notif = NULL;
1362 }
1363
1364 static void seccomp_notify_detach(struct seccomp_filter *filter)
1365 {
1366         struct seccomp_knotif *knotif;
1367
1368         if (!filter)
1369                 return;
1370
1371         mutex_lock(&filter->notify_lock);
1372
1373         /*
1374          * If this file is being closed because e.g. the task who owned it
1375          * died, let's wake everyone up who was waiting on us.
1376          */
1377         list_for_each_entry(knotif, &filter->notif->notifications, list) {
1378                 if (knotif->state == SECCOMP_NOTIFY_REPLIED)
1379                         continue;
1380
1381                 knotif->state = SECCOMP_NOTIFY_REPLIED;
1382                 knotif->error = -ENOSYS;
1383                 knotif->val = 0;
1384
1385                 /*
1386                  * We do not need to wake up any pending addfd messages, as
1387                  * the notifier will do that for us, as this just looks
1388                  * like a standard reply.
1389                  */
1390                 complete(&knotif->ready);
1391         }
1392
1393         seccomp_notify_free(filter);
1394         mutex_unlock(&filter->notify_lock);
1395 }
1396
1397 static int seccomp_notify_release(struct inode *inode, struct file *file)
1398 {
1399         struct seccomp_filter *filter = file->private_data;
1400
1401         seccomp_notify_detach(filter);
1402         __put_seccomp_filter(filter);
1403         return 0;
1404 }
1405
1406 /* must be called with notif_lock held */
1407 static inline struct seccomp_knotif *
1408 find_notification(struct seccomp_filter *filter, u64 id)
1409 {
1410         struct seccomp_knotif *cur;
1411
1412         lockdep_assert_held(&filter->notify_lock);
1413
1414         list_for_each_entry(cur, &filter->notif->notifications, list) {
1415                 if (cur->id == id)
1416                         return cur;
1417         }
1418
1419         return NULL;
1420 }
1421
1422
1423 static long seccomp_notify_recv(struct seccomp_filter *filter,
1424                                 void __user *buf)
1425 {
1426         struct seccomp_knotif *knotif = NULL, *cur;
1427         struct seccomp_notif unotif;
1428         ssize_t ret;
1429
1430         /* Verify that we're not given garbage to keep struct extensible. */
1431         ret = check_zeroed_user(buf, sizeof(unotif));
1432         if (ret < 0)
1433                 return ret;
1434         if (!ret)
1435                 return -EINVAL;
1436
1437         memset(&unotif, 0, sizeof(unotif));
1438
1439         ret = down_interruptible(&filter->notif->request);
1440         if (ret < 0)
1441                 return ret;
1442
1443         mutex_lock(&filter->notify_lock);
1444         list_for_each_entry(cur, &filter->notif->notifications, list) {
1445                 if (cur->state == SECCOMP_NOTIFY_INIT) {
1446                         knotif = cur;
1447                         break;
1448                 }
1449         }
1450
1451         /*
1452          * If we didn't find a notification, it could be that the task was
1453          * interrupted by a fatal signal between the time we were woken and
1454          * when we were able to acquire the rw lock.
1455          */
1456         if (!knotif) {
1457                 ret = -ENOENT;
1458                 goto out;
1459         }
1460
1461         unotif.id = knotif->id;
1462         unotif.pid = task_pid_vnr(knotif->task);
1463         unotif.data = *(knotif->data);
1464
1465         knotif->state = SECCOMP_NOTIFY_SENT;
1466         wake_up_poll(&filter->wqh, EPOLLOUT | EPOLLWRNORM);
1467         ret = 0;
1468 out:
1469         mutex_unlock(&filter->notify_lock);
1470
1471         if (ret == 0 && copy_to_user(buf, &unotif, sizeof(unotif))) {
1472                 ret = -EFAULT;
1473
1474                 /*
1475                  * Userspace screwed up. To make sure that we keep this
1476                  * notification alive, let's reset it back to INIT. It
1477                  * may have died when we released the lock, so we need to make
1478                  * sure it's still around.
1479                  */
1480                 mutex_lock(&filter->notify_lock);
1481                 knotif = find_notification(filter, unotif.id);
1482                 if (knotif) {
1483                         knotif->state = SECCOMP_NOTIFY_INIT;
1484                         up(&filter->notif->request);
1485                 }
1486                 mutex_unlock(&filter->notify_lock);
1487         }
1488
1489         return ret;
1490 }
1491
1492 static long seccomp_notify_send(struct seccomp_filter *filter,
1493                                 void __user *buf)
1494 {
1495         struct seccomp_notif_resp resp = {};
1496         struct seccomp_knotif *knotif;
1497         long ret;
1498
1499         if (copy_from_user(&resp, buf, sizeof(resp)))
1500                 return -EFAULT;
1501
1502         if (resp.flags & ~SECCOMP_USER_NOTIF_FLAG_CONTINUE)
1503                 return -EINVAL;
1504
1505         if ((resp.flags & SECCOMP_USER_NOTIF_FLAG_CONTINUE) &&
1506             (resp.error || resp.val))
1507                 return -EINVAL;
1508
1509         ret = mutex_lock_interruptible(&filter->notify_lock);
1510         if (ret < 0)
1511                 return ret;
1512
1513         knotif = find_notification(filter, resp.id);
1514         if (!knotif) {
1515                 ret = -ENOENT;
1516                 goto out;
1517         }
1518
1519         /* Allow exactly one reply. */
1520         if (knotif->state != SECCOMP_NOTIFY_SENT) {
1521                 ret = -EINPROGRESS;
1522                 goto out;
1523         }
1524
1525         ret = 0;
1526         knotif->state = SECCOMP_NOTIFY_REPLIED;
1527         knotif->error = resp.error;
1528         knotif->val = resp.val;
1529         knotif->flags = resp.flags;
1530         complete(&knotif->ready);
1531 out:
1532         mutex_unlock(&filter->notify_lock);
1533         return ret;
1534 }
1535
1536 static long seccomp_notify_id_valid(struct seccomp_filter *filter,
1537                                     void __user *buf)
1538 {
1539         struct seccomp_knotif *knotif;
1540         u64 id;
1541         long ret;
1542
1543         if (copy_from_user(&id, buf, sizeof(id)))
1544                 return -EFAULT;
1545
1546         ret = mutex_lock_interruptible(&filter->notify_lock);
1547         if (ret < 0)
1548                 return ret;
1549
1550         knotif = find_notification(filter, id);
1551         if (knotif && knotif->state == SECCOMP_NOTIFY_SENT)
1552                 ret = 0;
1553         else
1554                 ret = -ENOENT;
1555
1556         mutex_unlock(&filter->notify_lock);
1557         return ret;
1558 }
1559
1560 static long seccomp_notify_addfd(struct seccomp_filter *filter,
1561                                  struct seccomp_notif_addfd __user *uaddfd,
1562                                  unsigned int size)
1563 {
1564         struct seccomp_notif_addfd addfd;
1565         struct seccomp_knotif *knotif;
1566         struct seccomp_kaddfd kaddfd;
1567         int ret;
1568
1569         BUILD_BUG_ON(sizeof(addfd) < SECCOMP_NOTIFY_ADDFD_SIZE_VER0);
1570         BUILD_BUG_ON(sizeof(addfd) != SECCOMP_NOTIFY_ADDFD_SIZE_LATEST);
1571
1572         if (size < SECCOMP_NOTIFY_ADDFD_SIZE_VER0 || size >= PAGE_SIZE)
1573                 return -EINVAL;
1574
1575         ret = copy_struct_from_user(&addfd, sizeof(addfd), uaddfd, size);
1576         if (ret)
1577                 return ret;
1578
1579         if (addfd.newfd_flags & ~O_CLOEXEC)
1580                 return -EINVAL;
1581
1582         if (addfd.flags & ~SECCOMP_ADDFD_FLAG_SETFD)
1583                 return -EINVAL;
1584
1585         if (addfd.newfd && !(addfd.flags & SECCOMP_ADDFD_FLAG_SETFD))
1586                 return -EINVAL;
1587
1588         kaddfd.file = fget(addfd.srcfd);
1589         if (!kaddfd.file)
1590                 return -EBADF;
1591
1592         kaddfd.flags = addfd.newfd_flags;
1593         kaddfd.setfd = addfd.flags & SECCOMP_ADDFD_FLAG_SETFD;
1594         kaddfd.fd = addfd.newfd;
1595         init_completion(&kaddfd.completion);
1596
1597         ret = mutex_lock_interruptible(&filter->notify_lock);
1598         if (ret < 0)
1599                 goto out;
1600
1601         knotif = find_notification(filter, addfd.id);
1602         if (!knotif) {
1603                 ret = -ENOENT;
1604                 goto out_unlock;
1605         }
1606
1607         /*
1608          * We do not want to allow for FD injection to occur before the
1609          * notification has been picked up by a userspace handler, or after
1610          * the notification has been replied to.
1611          */
1612         if (knotif->state != SECCOMP_NOTIFY_SENT) {
1613                 ret = -EINPROGRESS;
1614                 goto out_unlock;
1615         }
1616
1617         list_add(&kaddfd.list, &knotif->addfd);
1618         complete(&knotif->ready);
1619         mutex_unlock(&filter->notify_lock);
1620
1621         /* Now we wait for it to be processed or be interrupted */
1622         ret = wait_for_completion_interruptible(&kaddfd.completion);
1623         if (ret == 0) {
1624                 /*
1625                  * We had a successful completion. The other side has already
1626                  * removed us from the addfd queue, and
1627                  * wait_for_completion_interruptible has a memory barrier upon
1628                  * success that lets us read this value directly without
1629                  * locking.
1630                  */
1631                 ret = kaddfd.ret;
1632                 goto out;
1633         }
1634
1635         mutex_lock(&filter->notify_lock);
1636         /*
1637          * Even though we were woken up by a signal and not a successful
1638          * completion, a completion may have happened in the mean time.
1639          *
1640          * We need to check again if the addfd request has been handled,
1641          * and if not, we will remove it from the queue.
1642          */
1643         if (list_empty(&kaddfd.list))
1644                 ret = kaddfd.ret;
1645         else
1646                 list_del(&kaddfd.list);
1647
1648 out_unlock:
1649         mutex_unlock(&filter->notify_lock);
1650 out:
1651         fput(kaddfd.file);
1652
1653         return ret;
1654 }
1655
1656 static long seccomp_notify_ioctl(struct file *file, unsigned int cmd,
1657                                  unsigned long arg)
1658 {
1659         struct seccomp_filter *filter = file->private_data;
1660         void __user *buf = (void __user *)arg;
1661
1662         /* Fixed-size ioctls */
1663         switch (cmd) {
1664         case SECCOMP_IOCTL_NOTIF_RECV:
1665                 return seccomp_notify_recv(filter, buf);
1666         case SECCOMP_IOCTL_NOTIF_SEND:
1667                 return seccomp_notify_send(filter, buf);
1668         case SECCOMP_IOCTL_NOTIF_ID_VALID_WRONG_DIR:
1669         case SECCOMP_IOCTL_NOTIF_ID_VALID:
1670                 return seccomp_notify_id_valid(filter, buf);
1671         }
1672
1673         /* Extensible Argument ioctls */
1674 #define EA_IOCTL(cmd)   ((cmd) & ~(IOC_INOUT | IOCSIZE_MASK))
1675         switch (EA_IOCTL(cmd)) {
1676         case EA_IOCTL(SECCOMP_IOCTL_NOTIF_ADDFD):
1677                 return seccomp_notify_addfd(filter, buf, _IOC_SIZE(cmd));
1678         default:
1679                 return -EINVAL;
1680         }
1681 }
1682
1683 static __poll_t seccomp_notify_poll(struct file *file,
1684                                     struct poll_table_struct *poll_tab)
1685 {
1686         struct seccomp_filter *filter = file->private_data;
1687         __poll_t ret = 0;
1688         struct seccomp_knotif *cur;
1689
1690         poll_wait(file, &filter->wqh, poll_tab);
1691
1692         if (mutex_lock_interruptible(&filter->notify_lock) < 0)
1693                 return EPOLLERR;
1694
1695         list_for_each_entry(cur, &filter->notif->notifications, list) {
1696                 if (cur->state == SECCOMP_NOTIFY_INIT)
1697                         ret |= EPOLLIN | EPOLLRDNORM;
1698                 if (cur->state == SECCOMP_NOTIFY_SENT)
1699                         ret |= EPOLLOUT | EPOLLWRNORM;
1700                 if ((ret & EPOLLIN) && (ret & EPOLLOUT))
1701                         break;
1702         }
1703
1704         mutex_unlock(&filter->notify_lock);
1705
1706         if (refcount_read(&filter->users) == 0)
1707                 ret |= EPOLLHUP;
1708
1709         return ret;
1710 }
1711
1712 static const struct file_operations seccomp_notify_ops = {
1713         .poll = seccomp_notify_poll,
1714         .release = seccomp_notify_release,
1715         .unlocked_ioctl = seccomp_notify_ioctl,
1716         .compat_ioctl = seccomp_notify_ioctl,
1717 };
1718
1719 static struct file *init_listener(struct seccomp_filter *filter)
1720 {
1721         struct file *ret;
1722
1723         ret = ERR_PTR(-ENOMEM);
1724         filter->notif = kzalloc(sizeof(*(filter->notif)), GFP_KERNEL);
1725         if (!filter->notif)
1726                 goto out;
1727
1728         sema_init(&filter->notif->request, 0);
1729         filter->notif->next_id = get_random_u64();
1730         INIT_LIST_HEAD(&filter->notif->notifications);
1731
1732         ret = anon_inode_getfile("seccomp notify", &seccomp_notify_ops,
1733                                  filter, O_RDWR);
1734         if (IS_ERR(ret))
1735                 goto out_notif;
1736
1737         /* The file has a reference to it now */
1738         __get_seccomp_filter(filter);
1739
1740 out_notif:
1741         if (IS_ERR(ret))
1742                 seccomp_notify_free(filter);
1743 out:
1744         return ret;
1745 }
1746
1747 /*
1748  * Does @new_child have a listener while an ancestor also has a listener?
1749  * If so, we'll want to reject this filter.
1750  * This only has to be tested for the current process, even in the TSYNC case,
1751  * because TSYNC installs @child with the same parent on all threads.
1752  * Note that @new_child is not hooked up to its parent at this point yet, so
1753  * we use current->seccomp.filter.
1754  */
1755 static bool has_duplicate_listener(struct seccomp_filter *new_child)
1756 {
1757         struct seccomp_filter *cur;
1758
1759         /* must be protected against concurrent TSYNC */
1760         lockdep_assert_held(&current->sighand->siglock);
1761
1762         if (!new_child->notif)
1763                 return false;
1764         for (cur = current->seccomp.filter; cur; cur = cur->prev) {
1765                 if (cur->notif)
1766                         return true;
1767         }
1768
1769         return false;
1770 }
1771
1772 /**
1773  * seccomp_set_mode_filter: internal function for setting seccomp filter
1774  * @flags:  flags to change filter behavior
1775  * @filter: struct sock_fprog containing filter
1776  *
1777  * This function may be called repeatedly to install additional filters.
1778  * Every filter successfully installed will be evaluated (in reverse order)
1779  * for each system call the task makes.
1780  *
1781  * Once current->seccomp.mode is non-zero, it may not be changed.
1782  *
1783  * Returns 0 on success or -EINVAL on failure.
1784  */
1785 static long seccomp_set_mode_filter(unsigned int flags,
1786                                     const char __user *filter)
1787 {
1788         const unsigned long seccomp_mode = SECCOMP_MODE_FILTER;
1789         struct seccomp_filter *prepared = NULL;
1790         long ret = -EINVAL;
1791         int listener = -1;
1792         struct file *listener_f = NULL;
1793
1794         /* Validate flags. */
1795         if (flags & ~SECCOMP_FILTER_FLAG_MASK)
1796                 return -EINVAL;
1797
1798         /*
1799          * In the successful case, NEW_LISTENER returns the new listener fd.
1800          * But in the failure case, TSYNC returns the thread that died. If you
1801          * combine these two flags, there's no way to tell whether something
1802          * succeeded or failed. So, let's disallow this combination if the user
1803          * has not explicitly requested no errors from TSYNC.
1804          */
1805         if ((flags & SECCOMP_FILTER_FLAG_TSYNC) &&
1806             (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) &&
1807             ((flags & SECCOMP_FILTER_FLAG_TSYNC_ESRCH) == 0))
1808                 return -EINVAL;
1809
1810         /* Prepare the new filter before holding any locks. */
1811         prepared = seccomp_prepare_user_filter(filter);
1812         if (IS_ERR(prepared))
1813                 return PTR_ERR(prepared);
1814
1815         if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) {
1816                 listener = get_unused_fd_flags(O_CLOEXEC);
1817                 if (listener < 0) {
1818                         ret = listener;
1819                         goto out_free;
1820                 }
1821
1822                 listener_f = init_listener(prepared);
1823                 if (IS_ERR(listener_f)) {
1824                         put_unused_fd(listener);
1825                         ret = PTR_ERR(listener_f);
1826                         goto out_free;
1827                 }
1828         }
1829
1830         /*
1831          * Make sure we cannot change seccomp or nnp state via TSYNC
1832          * while another thread is in the middle of calling exec.
1833          */
1834         if (flags & SECCOMP_FILTER_FLAG_TSYNC &&
1835             mutex_lock_killable(&current->signal->cred_guard_mutex))
1836                 goto out_put_fd;
1837
1838         spin_lock_irq(&current->sighand->siglock);
1839
1840         if (!seccomp_may_assign_mode(seccomp_mode))
1841                 goto out;
1842
1843         if (has_duplicate_listener(prepared)) {
1844                 ret = -EBUSY;
1845                 goto out;
1846         }
1847
1848         ret = seccomp_attach_filter(flags, prepared);
1849         if (ret)
1850                 goto out;
1851         /* Do not free the successfully attached filter. */
1852         prepared = NULL;
1853
1854         seccomp_assign_mode(current, seccomp_mode, flags);
1855 out:
1856         spin_unlock_irq(&current->sighand->siglock);
1857         if (flags & SECCOMP_FILTER_FLAG_TSYNC)
1858                 mutex_unlock(&current->signal->cred_guard_mutex);
1859 out_put_fd:
1860         if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) {
1861                 if (ret) {
1862                         listener_f->private_data = NULL;
1863                         fput(listener_f);
1864                         put_unused_fd(listener);
1865                         seccomp_notify_detach(prepared);
1866                 } else {
1867                         fd_install(listener, listener_f);
1868                         ret = listener;
1869                 }
1870         }
1871 out_free:
1872         seccomp_filter_free(prepared);
1873         return ret;
1874 }
1875 #else
1876 static inline long seccomp_set_mode_filter(unsigned int flags,
1877                                            const char __user *filter)
1878 {
1879         return -EINVAL;
1880 }
1881 #endif
1882
1883 static long seccomp_get_action_avail(const char __user *uaction)
1884 {
1885         u32 action;
1886
1887         if (copy_from_user(&action, uaction, sizeof(action)))
1888                 return -EFAULT;
1889
1890         switch (action) {
1891         case SECCOMP_RET_KILL_PROCESS:
1892         case SECCOMP_RET_KILL_THREAD:
1893         case SECCOMP_RET_TRAP:
1894         case SECCOMP_RET_ERRNO:
1895         case SECCOMP_RET_USER_NOTIF:
1896         case SECCOMP_RET_TRACE:
1897         case SECCOMP_RET_LOG:
1898         case SECCOMP_RET_ALLOW:
1899                 break;
1900         default:
1901                 return -EOPNOTSUPP;
1902         }
1903
1904         return 0;
1905 }
1906
1907 static long seccomp_get_notif_sizes(void __user *usizes)
1908 {
1909         struct seccomp_notif_sizes sizes = {
1910                 .seccomp_notif = sizeof(struct seccomp_notif),
1911                 .seccomp_notif_resp = sizeof(struct seccomp_notif_resp),
1912                 .seccomp_data = sizeof(struct seccomp_data),
1913         };
1914
1915         if (copy_to_user(usizes, &sizes, sizeof(sizes)))
1916                 return -EFAULT;
1917
1918         return 0;
1919 }
1920
1921 /* Common entry point for both prctl and syscall. */
1922 static long do_seccomp(unsigned int op, unsigned int flags,
1923                        void __user *uargs)
1924 {
1925         switch (op) {
1926         case SECCOMP_SET_MODE_STRICT:
1927                 if (flags != 0 || uargs != NULL)
1928                         return -EINVAL;
1929                 return seccomp_set_mode_strict();
1930         case SECCOMP_SET_MODE_FILTER:
1931                 return seccomp_set_mode_filter(flags, uargs);
1932         case SECCOMP_GET_ACTION_AVAIL:
1933                 if (flags != 0)
1934                         return -EINVAL;
1935
1936                 return seccomp_get_action_avail(uargs);
1937         case SECCOMP_GET_NOTIF_SIZES:
1938                 if (flags != 0)
1939                         return -EINVAL;
1940
1941                 return seccomp_get_notif_sizes(uargs);
1942         default:
1943                 return -EINVAL;
1944         }
1945 }
1946
1947 SYSCALL_DEFINE3(seccomp, unsigned int, op, unsigned int, flags,
1948                          void __user *, uargs)
1949 {
1950         return do_seccomp(op, flags, uargs);
1951 }
1952
1953 /**
1954  * prctl_set_seccomp: configures current->seccomp.mode
1955  * @seccomp_mode: requested mode to use
1956  * @filter: optional struct sock_fprog for use with SECCOMP_MODE_FILTER
1957  *
1958  * Returns 0 on success or -EINVAL on failure.
1959  */
1960 long prctl_set_seccomp(unsigned long seccomp_mode, void __user *filter)
1961 {
1962         unsigned int op;
1963         void __user *uargs;
1964
1965         switch (seccomp_mode) {
1966         case SECCOMP_MODE_STRICT:
1967                 op = SECCOMP_SET_MODE_STRICT;
1968                 /*
1969                  * Setting strict mode through prctl always ignored filter,
1970                  * so make sure it is always NULL here to pass the internal
1971                  * check in do_seccomp().
1972                  */
1973                 uargs = NULL;
1974                 break;
1975         case SECCOMP_MODE_FILTER:
1976                 op = SECCOMP_SET_MODE_FILTER;
1977                 uargs = filter;
1978                 break;
1979         default:
1980                 return -EINVAL;
1981         }
1982
1983         /* prctl interface doesn't have flags, so they are always zero. */
1984         return do_seccomp(op, 0, uargs);
1985 }
1986
1987 #if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
1988 static struct seccomp_filter *get_nth_filter(struct task_struct *task,
1989                                              unsigned long filter_off)
1990 {
1991         struct seccomp_filter *orig, *filter;
1992         unsigned long count;
1993
1994         /*
1995          * Note: this is only correct because the caller should be the (ptrace)
1996          * tracer of the task, otherwise lock_task_sighand is needed.
1997          */
1998         spin_lock_irq(&task->sighand->siglock);
1999
2000         if (task->seccomp.mode != SECCOMP_MODE_FILTER) {
2001                 spin_unlock_irq(&task->sighand->siglock);
2002                 return ERR_PTR(-EINVAL);
2003         }
2004
2005         orig = task->seccomp.filter;
2006         __get_seccomp_filter(orig);
2007         spin_unlock_irq(&task->sighand->siglock);
2008
2009         count = 0;
2010         for (filter = orig; filter; filter = filter->prev)
2011                 count++;
2012
2013         if (filter_off >= count) {
2014                 filter = ERR_PTR(-ENOENT);
2015                 goto out;
2016         }
2017
2018         count -= filter_off;
2019         for (filter = orig; filter && count > 1; filter = filter->prev)
2020                 count--;
2021
2022         if (WARN_ON(count != 1 || !filter)) {
2023                 filter = ERR_PTR(-ENOENT);
2024                 goto out;
2025         }
2026
2027         __get_seccomp_filter(filter);
2028
2029 out:
2030         __put_seccomp_filter(orig);
2031         return filter;
2032 }
2033
2034 long seccomp_get_filter(struct task_struct *task, unsigned long filter_off,
2035                         void __user *data)
2036 {
2037         struct seccomp_filter *filter;
2038         struct sock_fprog_kern *fprog;
2039         long ret;
2040
2041         if (!capable(CAP_SYS_ADMIN) ||
2042             current->seccomp.mode != SECCOMP_MODE_DISABLED) {
2043                 return -EACCES;
2044         }
2045
2046         filter = get_nth_filter(task, filter_off);
2047         if (IS_ERR(filter))
2048                 return PTR_ERR(filter);
2049
2050         fprog = filter->prog->orig_prog;
2051         if (!fprog) {
2052                 /* This must be a new non-cBPF filter, since we save
2053                  * every cBPF filter's orig_prog above when
2054                  * CONFIG_CHECKPOINT_RESTORE is enabled.
2055                  */
2056                 ret = -EMEDIUMTYPE;
2057                 goto out;
2058         }
2059
2060         ret = fprog->len;
2061         if (!data)
2062                 goto out;
2063
2064         if (copy_to_user(data, fprog->filter, bpf_classic_proglen(fprog)))
2065                 ret = -EFAULT;
2066
2067 out:
2068         __put_seccomp_filter(filter);
2069         return ret;
2070 }
2071
2072 long seccomp_get_metadata(struct task_struct *task,
2073                           unsigned long size, void __user *data)
2074 {
2075         long ret;
2076         struct seccomp_filter *filter;
2077         struct seccomp_metadata kmd = {};
2078
2079         if (!capable(CAP_SYS_ADMIN) ||
2080             current->seccomp.mode != SECCOMP_MODE_DISABLED) {
2081                 return -EACCES;
2082         }
2083
2084         size = min_t(unsigned long, size, sizeof(kmd));
2085
2086         if (size < sizeof(kmd.filter_off))
2087                 return -EINVAL;
2088
2089         if (copy_from_user(&kmd.filter_off, data, sizeof(kmd.filter_off)))
2090                 return -EFAULT;
2091
2092         filter = get_nth_filter(task, kmd.filter_off);
2093         if (IS_ERR(filter))
2094                 return PTR_ERR(filter);
2095
2096         if (filter->log)
2097                 kmd.flags |= SECCOMP_FILTER_FLAG_LOG;
2098
2099         ret = size;
2100         if (copy_to_user(data, &kmd, size))
2101                 ret = -EFAULT;
2102
2103         __put_seccomp_filter(filter);
2104         return ret;
2105 }
2106 #endif
2107
2108 #ifdef CONFIG_SYSCTL
2109
2110 /* Human readable action names for friendly sysctl interaction */
2111 #define SECCOMP_RET_KILL_PROCESS_NAME   "kill_process"
2112 #define SECCOMP_RET_KILL_THREAD_NAME    "kill_thread"
2113 #define SECCOMP_RET_TRAP_NAME           "trap"
2114 #define SECCOMP_RET_ERRNO_NAME          "errno"
2115 #define SECCOMP_RET_USER_NOTIF_NAME     "user_notif"
2116 #define SECCOMP_RET_TRACE_NAME          "trace"
2117 #define SECCOMP_RET_LOG_NAME            "log"
2118 #define SECCOMP_RET_ALLOW_NAME          "allow"
2119
2120 static const char seccomp_actions_avail[] =
2121                                 SECCOMP_RET_KILL_PROCESS_NAME   " "
2122                                 SECCOMP_RET_KILL_THREAD_NAME    " "
2123                                 SECCOMP_RET_TRAP_NAME           " "
2124                                 SECCOMP_RET_ERRNO_NAME          " "
2125                                 SECCOMP_RET_USER_NOTIF_NAME     " "
2126                                 SECCOMP_RET_TRACE_NAME          " "
2127                                 SECCOMP_RET_LOG_NAME            " "
2128                                 SECCOMP_RET_ALLOW_NAME;
2129
2130 struct seccomp_log_name {
2131         u32             log;
2132         const char      *name;
2133 };
2134
2135 static const struct seccomp_log_name seccomp_log_names[] = {
2136         { SECCOMP_LOG_KILL_PROCESS, SECCOMP_RET_KILL_PROCESS_NAME },
2137         { SECCOMP_LOG_KILL_THREAD, SECCOMP_RET_KILL_THREAD_NAME },
2138         { SECCOMP_LOG_TRAP, SECCOMP_RET_TRAP_NAME },
2139         { SECCOMP_LOG_ERRNO, SECCOMP_RET_ERRNO_NAME },
2140         { SECCOMP_LOG_USER_NOTIF, SECCOMP_RET_USER_NOTIF_NAME },
2141         { SECCOMP_LOG_TRACE, SECCOMP_RET_TRACE_NAME },
2142         { SECCOMP_LOG_LOG, SECCOMP_RET_LOG_NAME },
2143         { SECCOMP_LOG_ALLOW, SECCOMP_RET_ALLOW_NAME },
2144         { }
2145 };
2146
2147 static bool seccomp_names_from_actions_logged(char *names, size_t size,
2148                                               u32 actions_logged,
2149                                               const char *sep)
2150 {
2151         const struct seccomp_log_name *cur;
2152         bool append_sep = false;
2153
2154         for (cur = seccomp_log_names; cur->name && size; cur++) {
2155                 ssize_t ret;
2156
2157                 if (!(actions_logged & cur->log))
2158                         continue;
2159
2160                 if (append_sep) {
2161                         ret = strscpy(names, sep, size);
2162                         if (ret < 0)
2163                                 return false;
2164
2165                         names += ret;
2166                         size -= ret;
2167                 } else
2168                         append_sep = true;
2169
2170                 ret = strscpy(names, cur->name, size);
2171                 if (ret < 0)
2172                         return false;
2173
2174                 names += ret;
2175                 size -= ret;
2176         }
2177
2178         return true;
2179 }
2180
2181 static bool seccomp_action_logged_from_name(u32 *action_logged,
2182                                             const char *name)
2183 {
2184         const struct seccomp_log_name *cur;
2185
2186         for (cur = seccomp_log_names; cur->name; cur++) {
2187                 if (!strcmp(cur->name, name)) {
2188                         *action_logged = cur->log;
2189                         return true;
2190                 }
2191         }
2192
2193         return false;
2194 }
2195
2196 static bool seccomp_actions_logged_from_names(u32 *actions_logged, char *names)
2197 {
2198         char *name;
2199
2200         *actions_logged = 0;
2201         while ((name = strsep(&names, " ")) && *name) {
2202                 u32 action_logged = 0;
2203
2204                 if (!seccomp_action_logged_from_name(&action_logged, name))
2205                         return false;
2206
2207                 *actions_logged |= action_logged;
2208         }
2209
2210         return true;
2211 }
2212
2213 static int read_actions_logged(struct ctl_table *ro_table, void *buffer,
2214                                size_t *lenp, loff_t *ppos)
2215 {
2216         char names[sizeof(seccomp_actions_avail)];
2217         struct ctl_table table;
2218
2219         memset(names, 0, sizeof(names));
2220
2221         if (!seccomp_names_from_actions_logged(names, sizeof(names),
2222                                                seccomp_actions_logged, " "))
2223                 return -EINVAL;
2224
2225         table = *ro_table;
2226         table.data = names;
2227         table.maxlen = sizeof(names);
2228         return proc_dostring(&table, 0, buffer, lenp, ppos);
2229 }
2230
2231 static int write_actions_logged(struct ctl_table *ro_table, void *buffer,
2232                                 size_t *lenp, loff_t *ppos, u32 *actions_logged)
2233 {
2234         char names[sizeof(seccomp_actions_avail)];
2235         struct ctl_table table;
2236         int ret;
2237
2238         if (!capable(CAP_SYS_ADMIN))
2239                 return -EPERM;
2240
2241         memset(names, 0, sizeof(names));
2242
2243         table = *ro_table;
2244         table.data = names;
2245         table.maxlen = sizeof(names);
2246         ret = proc_dostring(&table, 1, buffer, lenp, ppos);
2247         if (ret)
2248                 return ret;
2249
2250         if (!seccomp_actions_logged_from_names(actions_logged, table.data))
2251                 return -EINVAL;
2252
2253         if (*actions_logged & SECCOMP_LOG_ALLOW)
2254                 return -EINVAL;
2255
2256         seccomp_actions_logged = *actions_logged;
2257         return 0;
2258 }
2259
2260 static void audit_actions_logged(u32 actions_logged, u32 old_actions_logged,
2261                                  int ret)
2262 {
2263         char names[sizeof(seccomp_actions_avail)];
2264         char old_names[sizeof(seccomp_actions_avail)];
2265         const char *new = names;
2266         const char *old = old_names;
2267
2268         if (!audit_enabled)
2269                 return;
2270
2271         memset(names, 0, sizeof(names));
2272         memset(old_names, 0, sizeof(old_names));
2273
2274         if (ret)
2275                 new = "?";
2276         else if (!actions_logged)
2277                 new = "(none)";
2278         else if (!seccomp_names_from_actions_logged(names, sizeof(names),
2279                                                     actions_logged, ","))
2280                 new = "?";
2281
2282         if (!old_actions_logged)
2283                 old = "(none)";
2284         else if (!seccomp_names_from_actions_logged(old_names,
2285                                                     sizeof(old_names),
2286                                                     old_actions_logged, ","))
2287                 old = "?";
2288
2289         return audit_seccomp_actions_logged(new, old, !ret);
2290 }
2291
2292 static int seccomp_actions_logged_handler(struct ctl_table *ro_table, int write,
2293                                           void *buffer, size_t *lenp,
2294                                           loff_t *ppos)
2295 {
2296         int ret;
2297
2298         if (write) {
2299                 u32 actions_logged = 0;
2300                 u32 old_actions_logged = seccomp_actions_logged;
2301
2302                 ret = write_actions_logged(ro_table, buffer, lenp, ppos,
2303                                            &actions_logged);
2304                 audit_actions_logged(actions_logged, old_actions_logged, ret);
2305         } else
2306                 ret = read_actions_logged(ro_table, buffer, lenp, ppos);
2307
2308         return ret;
2309 }
2310
2311 static struct ctl_path seccomp_sysctl_path[] = {
2312         { .procname = "kernel", },
2313         { .procname = "seccomp", },
2314         { }
2315 };
2316
2317 static struct ctl_table seccomp_sysctl_table[] = {
2318         {
2319                 .procname       = "actions_avail",
2320                 .data           = (void *) &seccomp_actions_avail,
2321                 .maxlen         = sizeof(seccomp_actions_avail),
2322                 .mode           = 0444,
2323                 .proc_handler   = proc_dostring,
2324         },
2325         {
2326                 .procname       = "actions_logged",
2327                 .mode           = 0644,
2328                 .proc_handler   = seccomp_actions_logged_handler,
2329         },
2330         { }
2331 };
2332
2333 static int __init seccomp_sysctl_init(void)
2334 {
2335         struct ctl_table_header *hdr;
2336
2337         hdr = register_sysctl_paths(seccomp_sysctl_path, seccomp_sysctl_table);
2338         if (!hdr)
2339                 pr_warn("sysctl registration failed\n");
2340         else
2341                 kmemleak_not_leak(hdr);
2342
2343         return 0;
2344 }
2345
2346 device_initcall(seccomp_sysctl_init)
2347
2348 #endif /* CONFIG_SYSCTL */
2349
2350 #ifdef CONFIG_SECCOMP_CACHE_DEBUG
2351 /* Currently CONFIG_SECCOMP_CACHE_DEBUG implies SECCOMP_ARCH_NATIVE */
2352 static void proc_pid_seccomp_cache_arch(struct seq_file *m, const char *name,
2353                                         const void *bitmap, size_t bitmap_size)
2354 {
2355         int nr;
2356
2357         for (nr = 0; nr < bitmap_size; nr++) {
2358                 bool cached = test_bit(nr, bitmap);
2359                 char *status = cached ? "ALLOW" : "FILTER";
2360
2361                 seq_printf(m, "%s %d %s\n", name, nr, status);
2362         }
2363 }
2364
2365 int proc_pid_seccomp_cache(struct seq_file *m, struct pid_namespace *ns,
2366                            struct pid *pid, struct task_struct *task)
2367 {
2368         struct seccomp_filter *f;
2369         unsigned long flags;
2370
2371         /*
2372          * We don't want some sandboxed process to know what their seccomp
2373          * filters consist of.
2374          */
2375         if (!file_ns_capable(m->file, &init_user_ns, CAP_SYS_ADMIN))
2376                 return -EACCES;
2377
2378         if (!lock_task_sighand(task, &flags))
2379                 return -ESRCH;
2380
2381         f = READ_ONCE(task->seccomp.filter);
2382         if (!f) {
2383                 unlock_task_sighand(task, &flags);
2384                 return 0;
2385         }
2386
2387         /* prevent filter from being freed while we are printing it */
2388         __get_seccomp_filter(f);
2389         unlock_task_sighand(task, &flags);
2390
2391         proc_pid_seccomp_cache_arch(m, SECCOMP_ARCH_NATIVE_NAME,
2392                                     f->cache.allow_native,
2393                                     SECCOMP_ARCH_NATIVE_NR);
2394
2395 #ifdef SECCOMP_ARCH_COMPAT
2396         proc_pid_seccomp_cache_arch(m, SECCOMP_ARCH_COMPAT_NAME,
2397                                     f->cache.allow_compat,
2398                                     SECCOMP_ARCH_COMPAT_NR);
2399 #endif /* SECCOMP_ARCH_COMPAT */
2400
2401         __put_seccomp_filter(f);
2402         return 0;
2403 }
2404 #endif /* CONFIG_SECCOMP_CACHE_DEBUG */