github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-03 12:03:54 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

add support for retrieving seccomp filter metadata (Tycho Andersen)

Browse Source 
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 Comment: Kees Cook <kees@outflux.net>
 
 iQIcBAABCgAGBQJaHgEiAAoJEIly9N/cbcAmCrIP/0tWyifZuGh/3YrqFOohMMsK
 EreSg1K47jwviC/QDD/HmraGzjGXbG1KALoEAGFi8TLfLJj4KlEvyUDQ1+VsLcDU
 ed2PJjNPLPOJMxtGWAk6ge5Jy9KsfJJctRC44fcJZ1kYn5ZjFfneMNg1awolXuHb
 +tc5Xl4XjcmK27H0p0V2gDNX4KCsw50TfkIpOIdFIZKln8RDvGTKIyFDtQ9J/Uh2
 dbnrn3icwrHy8iVa+ht65An8276tOqGMukWOAzNc4z6Buvs6DA+CEfkpOKCP/QHc
 jtALPWVgw109l94jSgoAYu9ifZ4XYKVxOdNjYvvkewUQT7MRTVhGFNPmSj3ls5MW
 6bfKvoquPTPU4kjfkP2yf4H3k2pjt+GmsToLeC9QtnNMIDmC3mPEKqYZ4a/cTWg7
 PdFtaBonBHvcb8ZwnC7npUwI+0ap+A9LGaUa9NWtbOiwiJyPAENPNINAUoz87M8D
 NTMDECueXuPLS8nqwNQteF1Z32ZNttrq+RLATyKXUnB1vvpbXsqidMV2dyi1yvk/
 z/WmdmxHaKzgI5A/djuVxDD32O+qfI4hR5Zl4EZbOOdFQ/heT6pmaY/D5ULPIsig
 n2Inb3ZnQUa1T3QmYJL0ceUzTqgvLp5XArGj+QYYreulAlIqFd6RZzDnDIYe0ztk
 RUKaw8y5M24kR9D6Npjr
 =MkdB
 -----END PGP SIGNATURE-----

Merge tag 'seccomp-next' of https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux into next-seccomp

add support for retrieving seccomp filter metadata (Tycho Andersen)
This commit is contained in:
James Morris 2017-11-29 12:48:48 +11:00
commit 26025bf58b
4 changed files with 99 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
include/linux/seccomp.h
View File

@ -95,11 +95,19 @@ static inline void get_seccomp_filter(struct task_struct *tsk)
#if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
extern long seccomp_get_filter(struct task_struct *task,
unsigned long filter_off, void __user *data);
extern long seccomp_get_metadata(struct task_struct *task,
unsigned long filter_off, void __user *data);
#else
static inline long seccomp_get_filter(struct task_struct *task,
unsigned long n, void __user *data)
{
return -EINVAL;
}
static inline long seccomp_get_metadata(struct task_struct *task,
unsigned long filter_off,
void __user *data)
{
return -EINVAL;
}
#endif /* CONFIG_SECCOMP_FILTER && CONFIG_CHECKPOINT_RESTORE */
#endif /* _LINUX_SECCOMP_H */

6
include/uapi/linux/ptrace.h
View File

@ -66,6 +66,12 @@ struct ptrace_peeksiginfo_args {
#define PTRACE_SETSIGMASK 0x420b
#define PTRACE_SECCOMP_GET_FILTER 0x420c
#define PTRACE_SECCOMP_GET_METADATA 0x420d
struct seccomp_metadata {
unsigned long filter_off; /* Input: which filter */
unsigned int flags; /* Output: filter's flags */
};
/* Read signals from a shared (process wide) queue */
#define PTRACE_PEEKSIGINFO_SHARED (1 << 0)

4
kernel/ptrace.c
View File

@ -1092,6 +1092,10 @@ int ptrace_request(struct task_struct *child, long request,
ret = seccomp_get_filter(child, addr, datavp);
break;
case PTRACE_SECCOMP_GET_METADATA:
ret = seccomp_get_metadata(child, addr, datavp);
break;
default:
break;
}

116
kernel/seccomp.c
View File

@ -978,48 +978,67 @@ long prctl_set_seccomp(unsigned long seccomp_mode, char __user *filter)
}
#if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
static struct seccomp_filter *get_nth_filter(struct task_struct *task,
unsigned long filter_off)
{
struct seccomp_filter *orig, *filter;
unsigned long count;
/*
* Note: this is only correct because the caller should be the (ptrace)
* tracer of the task, otherwise lock_task_sighand is needed.
*/
spin_lock_irq(&task->sighand->siglock);
if (task->seccomp.mode != SECCOMP_MODE_FILTER) {
spin_unlock_irq(&task->sighand->siglock);
return ERR_PTR(-EINVAL);
}
orig = task->seccomp.filter;
__get_seccomp_filter(orig);
spin_unlock_irq(&task->sighand->siglock);
count = 0;
for (filter = orig; filter; filter = filter->prev)
count++;
if (filter_off >= count) {
filter = ERR_PTR(-ENOENT);
goto out;
}
count -= filter_off;
for (filter = orig; filter && count > 1; filter = filter->prev)
count--;
if (WARN_ON(count != 1 || !filter)) {
filter = ERR_PTR(-ENOENT);
goto out;
}
__get_seccomp_filter(filter);
out:
__put_seccomp_filter(orig);
return filter;
}
long seccomp_get_filter(struct task_struct *task, unsigned long filter_off,
void __user *data)
{
struct seccomp_filter *filter;
struct sock_fprog_kern *fprog;
long ret;
unsigned long count = 0;
if (!capable(CAP_SYS_ADMIN) ||
current->seccomp.mode != SECCOMP_MODE_DISABLED) {
return -EACCES;
}
spin_lock_irq(&task->sighand->siglock);
if (task->seccomp.mode != SECCOMP_MODE_FILTER) {
ret = -EINVAL;
goto out;
}
filter = task->seccomp.filter;
while (filter) {
filter = filter->prev;
count++;
}
if (filter_off >= count) {
ret = -ENOENT;
goto out;
}
count -= filter_off;
filter = task->seccomp.filter;
while (filter && count > 1) {
filter = filter->prev;
count--;
}
if (WARN_ON(count != 1 || !filter)) {
/* The filter tree shouldn't shrink while we're using it. */
ret = -ENOENT;
goto out;
}
filter = get_nth_filter(task, filter_off);
if (IS_ERR(filter))
return PTR_ERR(filter);
fprog = filter->prog->orig_prog;
if (!fprog) {
@ -1035,17 +1054,44 @@ long seccomp_get_filter(struct task_struct *task, unsigned long filter_off,
if (!data)
goto out;
__get_seccomp_filter(filter);
spin_unlock_irq(&task->sighand->siglock);
if (copy_to_user(data, fprog->filter, bpf_classic_proglen(fprog)))
ret = -EFAULT;
out:
__put_seccomp_filter(filter);
return ret;
}
out:
spin_unlock_irq(&task->sighand->siglock);
long seccomp_get_metadata(struct task_struct *task,
unsigned long size, void __user *data)
{
long ret;
struct seccomp_filter *filter;
struct seccomp_metadata kmd = {};
if (!capable(CAP_SYS_ADMIN) ||
current->seccomp.mode != SECCOMP_MODE_DISABLED) {
return -EACCES;
}
size = min_t(unsigned long, size, sizeof(kmd));
if (copy_from_user(&kmd, data, size))
return -EFAULT;
filter = get_nth_filter(task, kmd.filter_off);
if (IS_ERR(filter))
return PTR_ERR(filter);
memset(&kmd, 0, sizeof(kmd));
if (filter->log)
kmd.flags |= SECCOMP_FILTER_FLAG_LOG;
ret = size;
if (copy_to_user(data, &kmd, size))
ret = -EFAULT;
__put_seccomp_filter(filter);
return ret;
}
#endif