2 * linux/kernel/seccomp.c
4 * Copyright 2004-2005 Andrea Arcangeli <andrea@cpushare.com>
6 * Copyright (C) 2012 Google, Inc.
7 * Will Drewry <wad@chromium.org>
9 * This defines a simple but solid secure-computing facility.
11 * Mode 1 uses a fixed list of allowed system calls.
12 * Mode 2 allows user-defined system call filters in the form
13 * of Berkeley Packet Filters/Linux Socket Filters.
16 #include <linux/atomic.h>
17 #include <linux/audit.h>
18 #include <linux/compat.h>
19 #include <linux/sched.h>
20 #include <linux/seccomp.h>
22 /* #define SECCOMP_DEBUG 1 */
24 #ifdef CONFIG_SECCOMP_FILTER
25 #include <asm/syscall.h>
26 #include <linux/filter.h>
27 #include <linux/ptrace.h>
28 #include <linux/security.h>
29 #include <linux/slab.h>
30 #include <linux/tracehook.h>
31 #include <linux/uaccess.h>
34 * struct seccomp_filter - container for seccomp BPF programs
36 * @usage: reference count to manage the object lifetime.
37 * get/put helpers should be used when accessing an instance
38 * outside of a lifetime-guarded section. In general, this
39 * is only needed for handling filters shared across tasks.
40 * @prev: points to a previously installed, or inherited, filter
41 * @len: the number of instructions in the program
42 * @insnsi: the BPF program instructions to evaluate
44 * seccomp_filter objects are organized in a tree linked via the @prev
45 * pointer. For any task, it appears to be a singly-linked list starting
46 * with current->seccomp.filter, the most recently attached or inherited filter.
47 * However, multiple filters may share a @prev node, by way of fork(), which
48 * results in a unidirectional tree existing in memory. This is similar to
49 * how namespaces work.
51 * seccomp_filter objects should never be modified after being attached
52 * to a task_struct (other than @usage).
54 struct seccomp_filter
{
56 struct seccomp_filter
*prev
;
57 struct sk_filter
*prog
;
60 /* Limit any path through the tree to 256KB worth of instructions. */
61 #define MAX_INSNS_PER_PATH ((1 << 18) / sizeof(struct sock_filter))
64 * Endianness is explicitly ignored and left for BPF program authors to manage
65 * as per the specific architecture.
67 static void populate_seccomp_data(struct seccomp_data
*sd
)
69 struct task_struct
*task
= current
;
70 struct pt_regs
*regs
= task_pt_regs(task
);
71 unsigned long args
[6];
73 sd
->nr
= syscall_get_nr(task
, regs
);
74 sd
->arch
= syscall_get_arch();
75 syscall_get_arguments(task
, regs
, 0, 6, args
);
76 sd
->args
[0] = args
[0];
77 sd
->args
[1] = args
[1];
78 sd
->args
[2] = args
[2];
79 sd
->args
[3] = args
[3];
80 sd
->args
[4] = args
[4];
81 sd
->args
[5] = args
[5];
82 sd
->instruction_pointer
= KSTK_EIP(task
);
86 * seccomp_check_filter - verify seccomp filter code
87 * @filter: filter to verify
88 * @flen: length of filter
90 * Takes a previously checked filter (by sk_chk_filter) and
91 * redirects all filter code that loads struct sk_buff data
92 * and related data through seccomp_bpf_load. It also
93 * enforces length and alignment checking of those loads.
95 * Returns 0 if the rule set is legal or -EINVAL if not.
97 static int seccomp_check_filter(struct sock_filter
*filter
, unsigned int flen
)
100 for (pc
= 0; pc
< flen
; pc
++) {
101 struct sock_filter
*ftest
= &filter
[pc
];
102 u16 code
= ftest
->code
;
106 case BPF_LD
| BPF_W
| BPF_ABS
:
107 ftest
->code
= BPF_LDX
| BPF_W
| BPF_ABS
;
108 /* 32-bit aligned and not out of bounds. */
109 if (k
>= sizeof(struct seccomp_data
) || k
& 3)
112 case BPF_LD
| BPF_W
| BPF_LEN
:
113 ftest
->code
= BPF_LD
| BPF_IMM
;
114 ftest
->k
= sizeof(struct seccomp_data
);
116 case BPF_LDX
| BPF_W
| BPF_LEN
:
117 ftest
->code
= BPF_LDX
| BPF_IMM
;
118 ftest
->k
= sizeof(struct seccomp_data
);
120 /* Explicitly include allowed calls. */
121 case BPF_RET
| BPF_K
:
122 case BPF_RET
| BPF_A
:
123 case BPF_ALU
| BPF_ADD
| BPF_K
:
124 case BPF_ALU
| BPF_ADD
| BPF_X
:
125 case BPF_ALU
| BPF_SUB
| BPF_K
:
126 case BPF_ALU
| BPF_SUB
| BPF_X
:
127 case BPF_ALU
| BPF_MUL
| BPF_K
:
128 case BPF_ALU
| BPF_MUL
| BPF_X
:
129 case BPF_ALU
| BPF_DIV
| BPF_K
:
130 case BPF_ALU
| BPF_DIV
| BPF_X
:
131 case BPF_ALU
| BPF_AND
| BPF_K
:
132 case BPF_ALU
| BPF_AND
| BPF_X
:
133 case BPF_ALU
| BPF_OR
| BPF_K
:
134 case BPF_ALU
| BPF_OR
| BPF_X
:
135 case BPF_ALU
| BPF_XOR
| BPF_K
:
136 case BPF_ALU
| BPF_XOR
| BPF_X
:
137 case BPF_ALU
| BPF_LSH
| BPF_K
:
138 case BPF_ALU
| BPF_LSH
| BPF_X
:
139 case BPF_ALU
| BPF_RSH
| BPF_K
:
140 case BPF_ALU
| BPF_RSH
| BPF_X
:
141 case BPF_ALU
| BPF_NEG
:
142 case BPF_LD
| BPF_IMM
:
143 case BPF_LDX
| BPF_IMM
:
144 case BPF_MISC
| BPF_TAX
:
145 case BPF_MISC
| BPF_TXA
:
146 case BPF_LD
| BPF_MEM
:
147 case BPF_LDX
| BPF_MEM
:
150 case BPF_JMP
| BPF_JA
:
151 case BPF_JMP
| BPF_JEQ
| BPF_K
:
152 case BPF_JMP
| BPF_JEQ
| BPF_X
:
153 case BPF_JMP
| BPF_JGE
| BPF_K
:
154 case BPF_JMP
| BPF_JGE
| BPF_X
:
155 case BPF_JMP
| BPF_JGT
| BPF_K
:
156 case BPF_JMP
| BPF_JGT
| BPF_X
:
157 case BPF_JMP
| BPF_JSET
| BPF_K
:
158 case BPF_JMP
| BPF_JSET
| BPF_X
:
168 * seccomp_run_filters - evaluates all seccomp filters against @syscall
169 * @syscall: number of the current system call
171 * Returns valid seccomp BPF response codes.
173 static u32
seccomp_run_filters(int syscall
)
175 struct seccomp_filter
*f
;
176 struct seccomp_data sd
;
177 u32 ret
= SECCOMP_RET_ALLOW
;
179 /* Ensure unexpected behavior doesn't result in failing open. */
180 if (WARN_ON(current
->seccomp
.filter
== NULL
))
181 return SECCOMP_RET_KILL
;
183 populate_seccomp_data(&sd
);
186 * All filters in the list are evaluated and the lowest BPF return
187 * value always takes priority (ignoring the DATA).
189 for (f
= current
->seccomp
.filter
; f
; f
= f
->prev
) {
190 u32 cur_ret
= SK_RUN_FILTER(f
->prog
, (void *)&sd
);
192 if ((cur_ret
& SECCOMP_RET_ACTION
) < (ret
& SECCOMP_RET_ACTION
))
197 #endif /* CONFIG_SECCOMP_FILTER */
199 static inline bool seccomp_may_assign_mode(unsigned long seccomp_mode
)
201 if (current
->seccomp
.mode
&& current
->seccomp
.mode
!= seccomp_mode
)
207 static inline void seccomp_assign_mode(unsigned long seccomp_mode
)
209 current
->seccomp
.mode
= seccomp_mode
;
210 set_tsk_thread_flag(current
, TIF_SECCOMP
);
213 #ifdef CONFIG_SECCOMP_FILTER
215 * seccomp_attach_filter: Attaches a seccomp filter to current.
216 * @fprog: BPF program to install
218 * Returns 0 on success or an errno on failure.
220 static long seccomp_attach_filter(struct sock_fprog
*fprog
)
222 struct seccomp_filter
*filter
;
223 unsigned long fp_size
= fprog
->len
* sizeof(struct sock_filter
);
224 unsigned long total_insns
= fprog
->len
;
225 struct sock_filter
*fp
;
229 if (fprog
->len
== 0 || fprog
->len
> BPF_MAXINSNS
)
232 for (filter
= current
->seccomp
.filter
; filter
; filter
= filter
->prev
)
233 total_insns
+= filter
->prog
->len
+ 4; /* include a 4 instr penalty */
234 if (total_insns
> MAX_INSNS_PER_PATH
)
238 * Installing a seccomp filter requires that the task has
239 * CAP_SYS_ADMIN in its namespace or be running with no_new_privs.
240 * This avoids scenarios where unprivileged tasks can affect the
241 * behavior of privileged children.
243 if (!current
->no_new_privs
&&
244 security_capable_noaudit(current_cred(), current_user_ns(),
248 fp
= kzalloc(fp_size
, GFP_KERNEL
|__GFP_NOWARN
);
252 /* Copy the instructions from fprog. */
254 if (copy_from_user(fp
, fprog
->filter
, fp_size
))
257 /* Check and rewrite the fprog via the skb checker */
258 ret
= sk_chk_filter(fp
, fprog
->len
);
262 /* Check and rewrite the fprog for seccomp use */
263 ret
= seccomp_check_filter(fp
, fprog
->len
);
267 /* Convert 'sock_filter' insns to 'sock_filter_int' insns */
268 ret
= sk_convert_filter(fp
, fprog
->len
, NULL
, &new_len
);
272 /* Allocate a new seccomp_filter */
274 filter
= kzalloc(sizeof(struct seccomp_filter
),
275 GFP_KERNEL
|__GFP_NOWARN
);
279 filter
->prog
= kzalloc(sk_filter_size(new_len
),
280 GFP_KERNEL
|__GFP_NOWARN
);
284 ret
= sk_convert_filter(fp
, fprog
->len
, filter
->prog
->insnsi
, &new_len
);
286 goto free_filter_prog
;
289 atomic_set(&filter
->usage
, 1);
290 filter
->prog
->len
= new_len
;
292 sk_filter_select_runtime(filter
->prog
);
295 * If there is an existing filter, make it the prev and don't drop its
298 filter
->prev
= current
->seccomp
.filter
;
299 current
->seccomp
.filter
= filter
;
312 * seccomp_attach_user_filter - attaches a user-supplied sock_fprog
313 * @user_filter: pointer to the user data containing a sock_fprog.
315 * Returns 0 on success and non-zero otherwise.
317 static long seccomp_attach_user_filter(char __user
*user_filter
)
319 struct sock_fprog fprog
;
323 if (is_compat_task()) {
324 struct compat_sock_fprog fprog32
;
325 if (copy_from_user(&fprog32
, user_filter
, sizeof(fprog32
)))
327 fprog
.len
= fprog32
.len
;
328 fprog
.filter
= compat_ptr(fprog32
.filter
);
329 } else /* falls through to the if below. */
331 if (copy_from_user(&fprog
, user_filter
, sizeof(fprog
)))
333 ret
= seccomp_attach_filter(&fprog
);
338 /* get_seccomp_filter - increments the reference count of the filter on @tsk */
339 void get_seccomp_filter(struct task_struct
*tsk
)
341 struct seccomp_filter
*orig
= tsk
->seccomp
.filter
;
344 /* Reference count is bounded by the number of total processes. */
345 atomic_inc(&orig
->usage
);
348 /* put_seccomp_filter - decrements the ref count of tsk->seccomp.filter */
349 void put_seccomp_filter(struct task_struct
*tsk
)
351 struct seccomp_filter
*orig
= tsk
->seccomp
.filter
;
352 /* Clean up single-reference branches iteratively. */
353 while (orig
&& atomic_dec_and_test(&orig
->usage
)) {
354 struct seccomp_filter
*freeme
= orig
;
356 sk_filter_free(freeme
->prog
);
362 * seccomp_send_sigsys - signals the task to allow in-process syscall emulation
363 * @syscall: syscall number to send to userland
364 * @reason: filter-supplied reason code to send to userland (via si_errno)
366 * Forces a SIGSYS with a code of SYS_SECCOMP and related sigsys info.
368 static void seccomp_send_sigsys(int syscall
, int reason
)
371 memset(&info
, 0, sizeof(info
));
372 info
.si_signo
= SIGSYS
;
373 info
.si_code
= SYS_SECCOMP
;
374 info
.si_call_addr
= (void __user
*)KSTK_EIP(current
);
375 info
.si_errno
= reason
;
376 info
.si_arch
= syscall_get_arch();
377 info
.si_syscall
= syscall
;
378 force_sig_info(SIGSYS
, &info
, current
);
380 #endif /* CONFIG_SECCOMP_FILTER */
383 * Secure computing mode 1 allows only read/write/exit/sigreturn.
384 * To be fully secure this must be combined with rlimit
385 * to limit the stack allocations too.
387 static int mode1_syscalls
[] = {
388 __NR_seccomp_read
, __NR_seccomp_write
, __NR_seccomp_exit
, __NR_seccomp_sigreturn
,
389 0, /* null terminated */
393 static int mode1_syscalls_32
[] = {
394 __NR_seccomp_read_32
, __NR_seccomp_write_32
, __NR_seccomp_exit_32
, __NR_seccomp_sigreturn_32
,
395 0, /* null terminated */
399 int __secure_computing(int this_syscall
)
401 int mode
= current
->seccomp
.mode
;
407 case SECCOMP_MODE_STRICT
:
408 syscall
= mode1_syscalls
;
410 if (is_compat_task())
411 syscall
= mode1_syscalls_32
;
414 if (*syscall
== this_syscall
)
416 } while (*++syscall
);
418 ret
= SECCOMP_RET_KILL
;
420 #ifdef CONFIG_SECCOMP_FILTER
421 case SECCOMP_MODE_FILTER
: {
423 struct pt_regs
*regs
= task_pt_regs(current
);
424 ret
= seccomp_run_filters(this_syscall
);
425 data
= ret
& SECCOMP_RET_DATA
;
426 ret
&= SECCOMP_RET_ACTION
;
428 case SECCOMP_RET_ERRNO
:
429 /* Set the low-order 16-bits as a errno. */
430 syscall_set_return_value(current
, regs
,
433 case SECCOMP_RET_TRAP
:
434 /* Show the handler the original registers. */
435 syscall_rollback(current
, regs
);
436 /* Let the filter pass back 16 bits of data. */
437 seccomp_send_sigsys(this_syscall
, data
);
439 case SECCOMP_RET_TRACE
:
440 /* Skip these calls if there is no tracer. */
441 if (!ptrace_event_enabled(current
, PTRACE_EVENT_SECCOMP
)) {
442 syscall_set_return_value(current
, regs
,
446 /* Allow the BPF to provide the event message */
447 ptrace_event(PTRACE_EVENT_SECCOMP
, data
);
449 * The delivery of a fatal signal during event
450 * notification may silently skip tracer notification.
451 * Terminating the task now avoids executing a system
452 * call that may not be intended.
454 if (fatal_signal_pending(current
))
456 if (syscall_get_nr(current
, regs
) < 0)
457 goto skip
; /* Explicit request to skip. */
460 case SECCOMP_RET_ALLOW
:
462 case SECCOMP_RET_KILL
:
477 audit_seccomp(this_syscall
, exit_sig
, ret
);
479 #ifdef CONFIG_SECCOMP_FILTER
481 audit_seccomp(this_syscall
, exit_sig
, ret
);
486 long prctl_get_seccomp(void)
488 return current
->seccomp
.mode
;
492 * seccomp_set_mode: internal function for setting seccomp mode
493 * @seccomp_mode: requested mode to use
494 * @filter: optional struct sock_fprog for use with SECCOMP_MODE_FILTER
496 * This function may be called repeatedly with a @seccomp_mode of
497 * SECCOMP_MODE_FILTER to install additional filters. Every filter
498 * successfully installed will be evaluated (in reverse order) for each system
499 * call the task makes.
501 * Once current->seccomp.mode is non-zero, it may not be changed.
503 * Returns 0 on success or -EINVAL on failure.
505 static long seccomp_set_mode(unsigned long seccomp_mode
, char __user
*filter
)
509 if (!seccomp_may_assign_mode(seccomp_mode
))
512 switch (seccomp_mode
) {
513 case SECCOMP_MODE_STRICT
:
519 #ifdef CONFIG_SECCOMP_FILTER
520 case SECCOMP_MODE_FILTER
:
521 ret
= seccomp_attach_user_filter(filter
);
530 seccomp_assign_mode(seccomp_mode
);
536 * prctl_set_seccomp: configures current->seccomp.mode
537 * @seccomp_mode: requested mode to use
538 * @filter: optional struct sock_fprog for use with SECCOMP_MODE_FILTER
540 * Returns 0 on success or -EINVAL on failure.
542 long prctl_set_seccomp(unsigned long seccomp_mode
, char __user
*filter
)
544 return seccomp_set_mode(seccomp_mode
, filter
);