2 * linux/kernel/seccomp.c
4 * Copyright 2004-2005 Andrea Arcangeli <andrea@cpushare.com>
6 * Copyright (C) 2012 Google, Inc.
7 * Will Drewry <wad@chromium.org>
9 * This defines a simple but solid secure-computing facility.
11 * Mode 1 uses a fixed list of allowed system calls.
12 * Mode 2 allows user-defined system call filters in the form
13 * of Berkeley Packet Filters/Linux Socket Filters.
16 #include <linux/atomic.h>
17 #include <linux/audit.h>
18 #include <linux/compat.h>
19 #include <linux/sched.h>
20 #include <linux/seccomp.h>
22 /* #define SECCOMP_DEBUG 1 */
24 #ifdef CONFIG_SECCOMP_FILTER
25 #include <asm/syscall.h>
26 #include <linux/filter.h>
27 #include <linux/ptrace.h>
28 #include <linux/security.h>
29 #include <linux/slab.h>
30 #include <linux/tracehook.h>
31 #include <linux/uaccess.h>
34 * struct seccomp_filter - container for seccomp BPF programs
36 * @usage: reference count to manage the object lifetime.
37 * get/put helpers should be used when accessing an instance
38 * outside of a lifetime-guarded section. In general, this
39 * is only needed for handling filters shared across tasks.
40 * @prev: points to a previously installed, or inherited, filter
41 * @len: the number of instructions in the program
42 * @insns: the BPF program instructions to evaluate
44 * seccomp_filter objects are organized in a tree linked via the @prev
45 * pointer. For any task, it appears to be a singly-linked list starting
46 * with current->seccomp.filter, the most recently attached or inherited filter.
47 * However, multiple filters may share a @prev node, by way of fork(), which
48 * results in a unidirectional tree existing in memory. This is similar to
49 * how namespaces work.
51 * seccomp_filter objects should never be modified after being attached
52 * to a task_struct (other than @usage).
54 struct seccomp_filter
{
56 struct seccomp_filter
*prev
;
57 struct sk_filter
*prog
;
60 /* Limit any path through the tree to 256KB worth of instructions. */
61 #define MAX_INSNS_PER_PATH ((1 << 18) / sizeof(struct sock_filter))
64 * Endianness is explicitly ignored and left for BPF program authors to manage
65 * as per the specific architecture.
67 static void populate_seccomp_data(struct seccomp_data
*sd
)
69 struct task_struct
*task
= current
;
70 struct pt_regs
*regs
= task_pt_regs(task
);
71 unsigned long args
[6];
73 sd
->nr
= syscall_get_nr(task
, regs
);
74 sd
->arch
= syscall_get_arch();
75 syscall_get_arguments(task
, regs
, 0, 6, args
);
76 sd
->args
[0] = args
[0];
77 sd
->args
[1] = args
[1];
78 sd
->args
[2] = args
[2];
79 sd
->args
[3] = args
[3];
80 sd
->args
[4] = args
[4];
81 sd
->args
[5] = args
[5];
82 sd
->instruction_pointer
= KSTK_EIP(task
);
86 * seccomp_check_filter - verify seccomp filter code
87 * @filter: filter to verify
88 * @flen: length of filter
90 * Takes a previously checked filter (by sk_chk_filter) and
91 * redirects all filter code that loads struct sk_buff data
92 * and related data through seccomp_bpf_load. It also
93 * enforces length and alignment checking of those loads.
95 * Returns 0 if the rule set is legal or -EINVAL if not.
97 static int seccomp_check_filter(struct sock_filter
*filter
, unsigned int flen
)
100 for (pc
= 0; pc
< flen
; pc
++) {
101 struct sock_filter
*ftest
= &filter
[pc
];
102 u16 code
= ftest
->code
;
107 ftest
->code
= BPF_LDX
| BPF_W
| BPF_ABS
;
108 /* 32-bit aligned and not out of bounds. */
109 if (k
>= sizeof(struct seccomp_data
) || k
& 3)
113 ftest
->code
= BPF_LD
| BPF_IMM
;
114 ftest
->k
= sizeof(struct seccomp_data
);
116 case BPF_S_LDX_W_LEN
:
117 ftest
->code
= BPF_LDX
| BPF_IMM
;
118 ftest
->k
= sizeof(struct seccomp_data
);
120 /* Explicitly include allowed calls. */
123 case BPF_S_ALU_ADD_K
:
124 case BPF_S_ALU_ADD_X
:
125 case BPF_S_ALU_SUB_K
:
126 case BPF_S_ALU_SUB_X
:
127 case BPF_S_ALU_MUL_K
:
128 case BPF_S_ALU_MUL_X
:
129 case BPF_S_ALU_DIV_X
:
130 case BPF_S_ALU_AND_K
:
131 case BPF_S_ALU_AND_X
:
134 case BPF_S_ALU_XOR_K
:
135 case BPF_S_ALU_XOR_X
:
136 case BPF_S_ALU_LSH_K
:
137 case BPF_S_ALU_LSH_X
:
138 case BPF_S_ALU_RSH_K
:
139 case BPF_S_ALU_RSH_X
:
145 case BPF_S_ALU_DIV_K
:
151 case BPF_S_JMP_JEQ_K
:
152 case BPF_S_JMP_JEQ_X
:
153 case BPF_S_JMP_JGE_K
:
154 case BPF_S_JMP_JGE_X
:
155 case BPF_S_JMP_JGT_K
:
156 case BPF_S_JMP_JGT_X
:
157 case BPF_S_JMP_JSET_K
:
158 case BPF_S_JMP_JSET_X
:
159 sk_decode_filter(ftest
, ftest
);
169 * seccomp_run_filters - evaluates all seccomp filters against @syscall
170 * @syscall: number of the current system call
172 * Returns valid seccomp BPF response codes.
174 static u32
seccomp_run_filters(int syscall
)
176 struct seccomp_filter
*f
;
177 struct seccomp_data sd
;
178 u32 ret
= SECCOMP_RET_ALLOW
;
180 /* Ensure unexpected behavior doesn't result in failing open. */
181 if (WARN_ON(current
->seccomp
.filter
== NULL
))
182 return SECCOMP_RET_KILL
;
184 populate_seccomp_data(&sd
);
187 * All filters in the list are evaluated and the lowest BPF return
188 * value always takes priority (ignoring the DATA).
190 for (f
= current
->seccomp
.filter
; f
; f
= f
->prev
) {
191 u32 cur_ret
= SK_RUN_FILTER(f
->prog
, (void *)&sd
);
193 if ((cur_ret
& SECCOMP_RET_ACTION
) < (ret
& SECCOMP_RET_ACTION
))
200 * seccomp_attach_filter: Attaches a seccomp filter to current.
201 * @fprog: BPF program to install
203 * Returns 0 on success or an errno on failure.
205 static long seccomp_attach_filter(struct sock_fprog
*fprog
)
207 struct seccomp_filter
*filter
;
208 unsigned long fp_size
= fprog
->len
* sizeof(struct sock_filter
);
209 unsigned long total_insns
= fprog
->len
;
210 struct sock_filter
*fp
;
214 if (fprog
->len
== 0 || fprog
->len
> BPF_MAXINSNS
)
217 for (filter
= current
->seccomp
.filter
; filter
; filter
= filter
->prev
)
218 total_insns
+= filter
->prog
->len
+ 4; /* include a 4 instr penalty */
219 if (total_insns
> MAX_INSNS_PER_PATH
)
223 * Installing a seccomp filter requires that the task have
224 * CAP_SYS_ADMIN in its namespace or be running with no_new_privs.
225 * This avoids scenarios where unprivileged tasks can affect the
226 * behavior of privileged children.
228 if (!current
->no_new_privs
&&
229 security_capable_noaudit(current_cred(), current_user_ns(),
233 fp
= kzalloc(fp_size
, GFP_KERNEL
|__GFP_NOWARN
);
237 /* Copy the instructions from fprog. */
239 if (copy_from_user(fp
, fprog
->filter
, fp_size
))
242 /* Check and rewrite the fprog via the skb checker */
243 ret
= sk_chk_filter(fp
, fprog
->len
);
247 /* Check and rewrite the fprog for seccomp use */
248 ret
= seccomp_check_filter(fp
, fprog
->len
);
252 /* Convert 'sock_filter' insns to 'sock_filter_int' insns */
253 ret
= sk_convert_filter(fp
, fprog
->len
, NULL
, &new_len
);
257 /* Allocate a new seccomp_filter */
259 filter
= kzalloc(sizeof(struct seccomp_filter
),
260 GFP_KERNEL
|__GFP_NOWARN
);
264 filter
->prog
= kzalloc(sk_filter_size(new_len
),
265 GFP_KERNEL
|__GFP_NOWARN
);
269 ret
= sk_convert_filter(fp
, fprog
->len
, filter
->prog
->insnsi
, &new_len
);
271 goto free_filter_prog
;
274 atomic_set(&filter
->usage
, 1);
275 filter
->prog
->len
= new_len
;
276 filter
->prog
->bpf_func
= (void *)sk_run_filter_int_seccomp
;
278 /* JIT internal BPF into native HW instructions */
279 bpf_int_jit_compile(filter
->prog
);
282 * If there is an existing filter, make it the prev and don't drop its
285 filter
->prev
= current
->seccomp
.filter
;
286 current
->seccomp
.filter
= filter
;
299 * seccomp_attach_user_filter - attaches a user-supplied sock_fprog
300 * @user_filter: pointer to the user data containing a sock_fprog.
302 * Returns 0 on success and non-zero otherwise.
304 static long seccomp_attach_user_filter(char __user
*user_filter
)
306 struct sock_fprog fprog
;
310 if (is_compat_task()) {
311 struct compat_sock_fprog fprog32
;
312 if (copy_from_user(&fprog32
, user_filter
, sizeof(fprog32
)))
314 fprog
.len
= fprog32
.len
;
315 fprog
.filter
= compat_ptr(fprog32
.filter
);
316 } else /* falls through to the if below. */
318 if (copy_from_user(&fprog
, user_filter
, sizeof(fprog
)))
320 ret
= seccomp_attach_filter(&fprog
);
325 /* get_seccomp_filter - increments the reference count of the filter on @tsk */
326 void get_seccomp_filter(struct task_struct
*tsk
)
328 struct seccomp_filter
*orig
= tsk
->seccomp
.filter
;
331 /* Reference count is bounded by the number of total processes. */
332 atomic_inc(&orig
->usage
);
335 /* put_seccomp_filter - decrements the ref count of tsk->seccomp.filter */
336 void put_seccomp_filter(struct task_struct
*tsk
)
338 struct seccomp_filter
*orig
= tsk
->seccomp
.filter
;
339 /* Clean up single-reference branches iteratively. */
340 while (orig
&& atomic_dec_and_test(&orig
->usage
)) {
341 struct seccomp_filter
*freeme
= orig
;
343 bpf_jit_free(freeme
->prog
);
349 * seccomp_send_sigsys - signals the task to allow in-process syscall emulation
350 * @syscall: syscall number to send to userland
351 * @reason: filter-supplied reason code to send to userland (via si_errno)
353 * Forces a SIGSYS with a code of SYS_SECCOMP and related sigsys info.
355 static void seccomp_send_sigsys(int syscall
, int reason
)
358 memset(&info
, 0, sizeof(info
));
359 info
.si_signo
= SIGSYS
;
360 info
.si_code
= SYS_SECCOMP
;
361 info
.si_call_addr
= (void __user
*)KSTK_EIP(current
);
362 info
.si_errno
= reason
;
363 info
.si_arch
= syscall_get_arch();
364 info
.si_syscall
= syscall
;
365 force_sig_info(SIGSYS
, &info
, current
);
367 #endif /* CONFIG_SECCOMP_FILTER */
370 * Secure computing mode 1 allows only read/write/exit/sigreturn.
371 * To be fully secure this must be combined with rlimit
372 * to limit the stack allocations too.
374 static int mode1_syscalls
[] = {
375 __NR_seccomp_read
, __NR_seccomp_write
, __NR_seccomp_exit
, __NR_seccomp_sigreturn
,
376 0, /* null terminated */
380 static int mode1_syscalls_32
[] = {
381 __NR_seccomp_read_32
, __NR_seccomp_write_32
, __NR_seccomp_exit_32
, __NR_seccomp_sigreturn_32
,
382 0, /* null terminated */
386 int __secure_computing(int this_syscall
)
388 int mode
= current
->seccomp
.mode
;
394 case SECCOMP_MODE_STRICT
:
395 syscall
= mode1_syscalls
;
397 if (is_compat_task())
398 syscall
= mode1_syscalls_32
;
401 if (*syscall
== this_syscall
)
403 } while (*++syscall
);
405 ret
= SECCOMP_RET_KILL
;
407 #ifdef CONFIG_SECCOMP_FILTER
408 case SECCOMP_MODE_FILTER
: {
410 struct pt_regs
*regs
= task_pt_regs(current
);
411 ret
= seccomp_run_filters(this_syscall
);
412 data
= ret
& SECCOMP_RET_DATA
;
413 ret
&= SECCOMP_RET_ACTION
;
415 case SECCOMP_RET_ERRNO
:
416 /* Set the low-order 16-bits as a errno. */
417 syscall_set_return_value(current
, regs
,
420 case SECCOMP_RET_TRAP
:
421 /* Show the handler the original registers. */
422 syscall_rollback(current
, regs
);
423 /* Let the filter pass back 16 bits of data. */
424 seccomp_send_sigsys(this_syscall
, data
);
426 case SECCOMP_RET_TRACE
:
427 /* Skip these calls if there is no tracer. */
428 if (!ptrace_event_enabled(current
, PTRACE_EVENT_SECCOMP
)) {
429 syscall_set_return_value(current
, regs
,
433 /* Allow the BPF to provide the event message */
434 ptrace_event(PTRACE_EVENT_SECCOMP
, data
);
436 * The delivery of a fatal signal during event
437 * notification may silently skip tracer notification.
438 * Terminating the task now avoids executing a system
439 * call that may not be intended.
441 if (fatal_signal_pending(current
))
443 if (syscall_get_nr(current
, regs
) < 0)
444 goto skip
; /* Explicit request to skip. */
447 case SECCOMP_RET_ALLOW
:
449 case SECCOMP_RET_KILL
:
464 audit_seccomp(this_syscall
, exit_sig
, ret
);
466 #ifdef CONFIG_SECCOMP_FILTER
468 audit_seccomp(this_syscall
, exit_sig
, ret
);
473 long prctl_get_seccomp(void)
475 return current
->seccomp
.mode
;
479 * prctl_set_seccomp: configures current->seccomp.mode
480 * @seccomp_mode: requested mode to use
481 * @filter: optional struct sock_fprog for use with SECCOMP_MODE_FILTER
483 * This function may be called repeatedly with a @seccomp_mode of
484 * SECCOMP_MODE_FILTER to install additional filters. Every filter
485 * successfully installed will be evaluated (in reverse order) for each system
486 * call the task makes.
488 * Once current->seccomp.mode is non-zero, it may not be changed.
490 * Returns 0 on success or -EINVAL on failure.
492 long prctl_set_seccomp(unsigned long seccomp_mode
, char __user
*filter
)
496 if (current
->seccomp
.mode
&&
497 current
->seccomp
.mode
!= seccomp_mode
)
500 switch (seccomp_mode
) {
501 case SECCOMP_MODE_STRICT
:
507 #ifdef CONFIG_SECCOMP_FILTER
508 case SECCOMP_MODE_FILTER
:
509 ret
= seccomp_attach_user_filter(filter
);
518 current
->seccomp
.mode
= seccomp_mode
;
519 set_thread_flag(TIF_SECCOMP
);