mirror of
https://github.com/torvalds/linux.git
synced 2024-11-25 13:41:51 +00:00
Merge branch 'next-seccomp' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
Pull seccomp updates from James Morris: "Add support for retrieving seccomp metadata" * 'next-seccomp' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: ptrace, seccomp: add support for retrieving seccomp metadata seccomp: hoist out filter resolving logic
This commit is contained in:
commit
3dbc4f5485
@ -95,11 +95,19 @@ static inline void get_seccomp_filter(struct task_struct *tsk)
|
||||
#if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
|
||||
extern long seccomp_get_filter(struct task_struct *task,
|
||||
unsigned long filter_off, void __user *data);
|
||||
extern long seccomp_get_metadata(struct task_struct *task,
|
||||
unsigned long filter_off, void __user *data);
|
||||
#else
|
||||
static inline long seccomp_get_filter(struct task_struct *task,
|
||||
unsigned long n, void __user *data)
|
||||
{
|
||||
return -EINVAL;
|
||||
}
|
||||
static inline long seccomp_get_metadata(struct task_struct *task,
|
||||
unsigned long filter_off,
|
||||
void __user *data)
|
||||
{
|
||||
return -EINVAL;
|
||||
}
|
||||
#endif /* CONFIG_SECCOMP_FILTER && CONFIG_CHECKPOINT_RESTORE */
|
||||
#endif /* _LINUX_SECCOMP_H */
|
||||
|
@ -66,6 +66,12 @@ struct ptrace_peeksiginfo_args {
|
||||
#define PTRACE_SETSIGMASK 0x420b
|
||||
|
||||
#define PTRACE_SECCOMP_GET_FILTER 0x420c
|
||||
#define PTRACE_SECCOMP_GET_METADATA 0x420d
|
||||
|
||||
struct seccomp_metadata {
|
||||
unsigned long filter_off; /* Input: which filter */
|
||||
unsigned int flags; /* Output: filter's flags */
|
||||
};
|
||||
|
||||
/* Read signals from a shared (process wide) queue */
|
||||
#define PTRACE_PEEKSIGINFO_SHARED (1 << 0)
|
||||
|
@ -1092,6 +1092,10 @@ int ptrace_request(struct task_struct *child, long request,
|
||||
ret = seccomp_get_filter(child, addr, datavp);
|
||||
break;
|
||||
|
||||
case PTRACE_SECCOMP_GET_METADATA:
|
||||
ret = seccomp_get_metadata(child, addr, datavp);
|
||||
break;
|
||||
|
||||
default:
|
||||
break;
|
||||
}
|
||||
|
116
kernel/seccomp.c
116
kernel/seccomp.c
@ -978,48 +978,67 @@ long prctl_set_seccomp(unsigned long seccomp_mode, char __user *filter)
|
||||
}
|
||||
|
||||
#if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
|
||||
static struct seccomp_filter *get_nth_filter(struct task_struct *task,
|
||||
unsigned long filter_off)
|
||||
{
|
||||
struct seccomp_filter *orig, *filter;
|
||||
unsigned long count;
|
||||
|
||||
/*
|
||||
* Note: this is only correct because the caller should be the (ptrace)
|
||||
* tracer of the task, otherwise lock_task_sighand is needed.
|
||||
*/
|
||||
spin_lock_irq(&task->sighand->siglock);
|
||||
|
||||
if (task->seccomp.mode != SECCOMP_MODE_FILTER) {
|
||||
spin_unlock_irq(&task->sighand->siglock);
|
||||
return ERR_PTR(-EINVAL);
|
||||
}
|
||||
|
||||
orig = task->seccomp.filter;
|
||||
__get_seccomp_filter(orig);
|
||||
spin_unlock_irq(&task->sighand->siglock);
|
||||
|
||||
count = 0;
|
||||
for (filter = orig; filter; filter = filter->prev)
|
||||
count++;
|
||||
|
||||
if (filter_off >= count) {
|
||||
filter = ERR_PTR(-ENOENT);
|
||||
goto out;
|
||||
}
|
||||
|
||||
count -= filter_off;
|
||||
for (filter = orig; filter && count > 1; filter = filter->prev)
|
||||
count--;
|
||||
|
||||
if (WARN_ON(count != 1 || !filter)) {
|
||||
filter = ERR_PTR(-ENOENT);
|
||||
goto out;
|
||||
}
|
||||
|
||||
__get_seccomp_filter(filter);
|
||||
|
||||
out:
|
||||
__put_seccomp_filter(orig);
|
||||
return filter;
|
||||
}
|
||||
|
||||
long seccomp_get_filter(struct task_struct *task, unsigned long filter_off,
|
||||
void __user *data)
|
||||
{
|
||||
struct seccomp_filter *filter;
|
||||
struct sock_fprog_kern *fprog;
|
||||
long ret;
|
||||
unsigned long count = 0;
|
||||
|
||||
if (!capable(CAP_SYS_ADMIN) ||
|
||||
current->seccomp.mode != SECCOMP_MODE_DISABLED) {
|
||||
return -EACCES;
|
||||
}
|
||||
|
||||
spin_lock_irq(&task->sighand->siglock);
|
||||
if (task->seccomp.mode != SECCOMP_MODE_FILTER) {
|
||||
ret = -EINVAL;
|
||||
goto out;
|
||||
}
|
||||
|
||||
filter = task->seccomp.filter;
|
||||
while (filter) {
|
||||
filter = filter->prev;
|
||||
count++;
|
||||
}
|
||||
|
||||
if (filter_off >= count) {
|
||||
ret = -ENOENT;
|
||||
goto out;
|
||||
}
|
||||
count -= filter_off;
|
||||
|
||||
filter = task->seccomp.filter;
|
||||
while (filter && count > 1) {
|
||||
filter = filter->prev;
|
||||
count--;
|
||||
}
|
||||
|
||||
if (WARN_ON(count != 1 || !filter)) {
|
||||
/* The filter tree shouldn't shrink while we're using it. */
|
||||
ret = -ENOENT;
|
||||
goto out;
|
||||
}
|
||||
filter = get_nth_filter(task, filter_off);
|
||||
if (IS_ERR(filter))
|
||||
return PTR_ERR(filter);
|
||||
|
||||
fprog = filter->prog->orig_prog;
|
||||
if (!fprog) {
|
||||
@ -1035,17 +1054,44 @@ long seccomp_get_filter(struct task_struct *task, unsigned long filter_off,
|
||||
if (!data)
|
||||
goto out;
|
||||
|
||||
__get_seccomp_filter(filter);
|
||||
spin_unlock_irq(&task->sighand->siglock);
|
||||
|
||||
if (copy_to_user(data, fprog->filter, bpf_classic_proglen(fprog)))
|
||||
ret = -EFAULT;
|
||||
|
||||
out:
|
||||
__put_seccomp_filter(filter);
|
||||
return ret;
|
||||
}
|
||||
|
||||
out:
|
||||
spin_unlock_irq(&task->sighand->siglock);
|
||||
long seccomp_get_metadata(struct task_struct *task,
|
||||
unsigned long size, void __user *data)
|
||||
{
|
||||
long ret;
|
||||
struct seccomp_filter *filter;
|
||||
struct seccomp_metadata kmd = {};
|
||||
|
||||
if (!capable(CAP_SYS_ADMIN) ||
|
||||
current->seccomp.mode != SECCOMP_MODE_DISABLED) {
|
||||
return -EACCES;
|
||||
}
|
||||
|
||||
size = min_t(unsigned long, size, sizeof(kmd));
|
||||
|
||||
if (copy_from_user(&kmd, data, size))
|
||||
return -EFAULT;
|
||||
|
||||
filter = get_nth_filter(task, kmd.filter_off);
|
||||
if (IS_ERR(filter))
|
||||
return PTR_ERR(filter);
|
||||
|
||||
memset(&kmd, 0, sizeof(kmd));
|
||||
if (filter->log)
|
||||
kmd.flags |= SECCOMP_FILTER_FLAG_LOG;
|
||||
|
||||
ret = size;
|
||||
if (copy_to_user(data, &kmd, size))
|
||||
ret = -EFAULT;
|
||||
|
||||
__put_seccomp_filter(filter);
|
||||
return ret;
|
||||
}
|
||||
#endif
|
||||
|
Loading…
Reference in New Issue
Block a user