2 * linux/kernel/seccomp.c
4 * Copyright 2004-2005 Andrea Arcangeli <andrea@cpushare.com>
6 * Copyright (C) 2012 Google, Inc.
7 * Will Drewry <wad@chromium.org>
9 * This defines a simple but solid secure-computing facility.
11 * Mode 1 uses a fixed list of allowed system calls.
12 * Mode 2 allows user-defined system call filters in the form
13 * of Berkeley Packet Filters/Linux Socket Filters.
16 #include <linux/atomic.h>
17 #include <linux/audit.h>
18 #include <linux/compat.h>
19 #include <linux/sched.h>
20 #include <linux/seccomp.h>
21 #include <linux/slab.h>
22 #include <linux/syscalls.h>
24 /* #define SECCOMP_DEBUG 1 */
26 #ifdef CONFIG_SECCOMP_FILTER
27 #include <asm/syscall.h>
28 #include <linux/filter.h>
29 #include <linux/ptrace.h>
30 #include <linux/security.h>
31 #include <linux/tracehook.h>
32 #include <linux/uaccess.h>
35 * struct seccomp_filter - container for seccomp BPF programs
37 * @usage: reference count to manage the object lifetime.
38 * get/put helpers should be used when accessing an instance
39 * outside of a lifetime-guarded section. In general, this
40 * is only needed for handling filters shared across tasks.
41 * @prev: points to a previously installed, or inherited, filter
42 * @len: the number of instructions in the program
43 * @insnsi: the BPF program instructions to evaluate
45 * seccomp_filter objects are organized in a tree linked via the @prev
46 * pointer. For any task, it appears to be a singly-linked list starting
47 * with current->seccomp.filter, the most recently attached or inherited filter.
48 * However, multiple filters may share a @prev node, by way of fork(), which
49 * results in a unidirectional tree existing in memory. This is similar to
50 * how namespaces work.
52 * seccomp_filter objects should never be modified after being attached
53 * to a task_struct (other than @usage).
55 struct seccomp_filter
{
57 struct seccomp_filter
*prev
;
58 struct sk_filter
*prog
;
61 /* Limit any path through the tree to 256KB worth of instructions. */
62 #define MAX_INSNS_PER_PATH ((1 << 18) / sizeof(struct sock_filter))
65 * Endianness is explicitly ignored and left for BPF program authors to manage
66 * as per the specific architecture.
68 static void populate_seccomp_data(struct seccomp_data
*sd
)
70 struct task_struct
*task
= current
;
71 struct pt_regs
*regs
= task_pt_regs(task
);
72 unsigned long args
[6];
74 sd
->nr
= syscall_get_nr(task
, regs
);
75 sd
->arch
= syscall_get_arch();
76 syscall_get_arguments(task
, regs
, 0, 6, args
);
77 sd
->args
[0] = args
[0];
78 sd
->args
[1] = args
[1];
79 sd
->args
[2] = args
[2];
80 sd
->args
[3] = args
[3];
81 sd
->args
[4] = args
[4];
82 sd
->args
[5] = args
[5];
83 sd
->instruction_pointer
= KSTK_EIP(task
);
87 * seccomp_check_filter - verify seccomp filter code
88 * @filter: filter to verify
89 * @flen: length of filter
91 * Takes a previously checked filter (by sk_chk_filter) and
92 * redirects all filter code that loads struct sk_buff data
93 * and related data through seccomp_bpf_load. It also
94 * enforces length and alignment checking of those loads.
96 * Returns 0 if the rule set is legal or -EINVAL if not.
98 static int seccomp_check_filter(struct sock_filter
*filter
, unsigned int flen
)
101 for (pc
= 0; pc
< flen
; pc
++) {
102 struct sock_filter
*ftest
= &filter
[pc
];
103 u16 code
= ftest
->code
;
107 case BPF_LD
| BPF_W
| BPF_ABS
:
108 ftest
->code
= BPF_LDX
| BPF_W
| BPF_ABS
;
109 /* 32-bit aligned and not out of bounds. */
110 if (k
>= sizeof(struct seccomp_data
) || k
& 3)
113 case BPF_LD
| BPF_W
| BPF_LEN
:
114 ftest
->code
= BPF_LD
| BPF_IMM
;
115 ftest
->k
= sizeof(struct seccomp_data
);
117 case BPF_LDX
| BPF_W
| BPF_LEN
:
118 ftest
->code
= BPF_LDX
| BPF_IMM
;
119 ftest
->k
= sizeof(struct seccomp_data
);
121 /* Explicitly include allowed calls. */
122 case BPF_RET
| BPF_K
:
123 case BPF_RET
| BPF_A
:
124 case BPF_ALU
| BPF_ADD
| BPF_K
:
125 case BPF_ALU
| BPF_ADD
| BPF_X
:
126 case BPF_ALU
| BPF_SUB
| BPF_K
:
127 case BPF_ALU
| BPF_SUB
| BPF_X
:
128 case BPF_ALU
| BPF_MUL
| BPF_K
:
129 case BPF_ALU
| BPF_MUL
| BPF_X
:
130 case BPF_ALU
| BPF_DIV
| BPF_K
:
131 case BPF_ALU
| BPF_DIV
| BPF_X
:
132 case BPF_ALU
| BPF_AND
| BPF_K
:
133 case BPF_ALU
| BPF_AND
| BPF_X
:
134 case BPF_ALU
| BPF_OR
| BPF_K
:
135 case BPF_ALU
| BPF_OR
| BPF_X
:
136 case BPF_ALU
| BPF_XOR
| BPF_K
:
137 case BPF_ALU
| BPF_XOR
| BPF_X
:
138 case BPF_ALU
| BPF_LSH
| BPF_K
:
139 case BPF_ALU
| BPF_LSH
| BPF_X
:
140 case BPF_ALU
| BPF_RSH
| BPF_K
:
141 case BPF_ALU
| BPF_RSH
| BPF_X
:
142 case BPF_ALU
| BPF_NEG
:
143 case BPF_LD
| BPF_IMM
:
144 case BPF_LDX
| BPF_IMM
:
145 case BPF_MISC
| BPF_TAX
:
146 case BPF_MISC
| BPF_TXA
:
147 case BPF_LD
| BPF_MEM
:
148 case BPF_LDX
| BPF_MEM
:
151 case BPF_JMP
| BPF_JA
:
152 case BPF_JMP
| BPF_JEQ
| BPF_K
:
153 case BPF_JMP
| BPF_JEQ
| BPF_X
:
154 case BPF_JMP
| BPF_JGE
| BPF_K
:
155 case BPF_JMP
| BPF_JGE
| BPF_X
:
156 case BPF_JMP
| BPF_JGT
| BPF_K
:
157 case BPF_JMP
| BPF_JGT
| BPF_X
:
158 case BPF_JMP
| BPF_JSET
| BPF_K
:
159 case BPF_JMP
| BPF_JSET
| BPF_X
:
169 * seccomp_run_filters - evaluates all seccomp filters against @syscall
170 * @syscall: number of the current system call
172 * Returns valid seccomp BPF response codes.
174 static u32
seccomp_run_filters(int syscall
)
176 struct seccomp_filter
*f
;
177 struct seccomp_data sd
;
178 u32 ret
= SECCOMP_RET_ALLOW
;
180 /* Ensure unexpected behavior doesn't result in failing open. */
181 if (WARN_ON(current
->seccomp
.filter
== NULL
))
182 return SECCOMP_RET_KILL
;
184 populate_seccomp_data(&sd
);
187 * All filters in the list are evaluated and the lowest BPF return
188 * value always takes priority (ignoring the DATA).
190 for (f
= current
->seccomp
.filter
; f
; f
= f
->prev
) {
191 u32 cur_ret
= SK_RUN_FILTER(f
->prog
, (void *)&sd
);
193 if ((cur_ret
& SECCOMP_RET_ACTION
) < (ret
& SECCOMP_RET_ACTION
))
198 #endif /* CONFIG_SECCOMP_FILTER */
200 static inline bool seccomp_may_assign_mode(unsigned long seccomp_mode
)
202 if (current
->seccomp
.mode
&& current
->seccomp
.mode
!= seccomp_mode
)
208 static inline void seccomp_assign_mode(unsigned long seccomp_mode
)
210 current
->seccomp
.mode
= seccomp_mode
;
211 set_tsk_thread_flag(current
, TIF_SECCOMP
);
214 #ifdef CONFIG_SECCOMP_FILTER
216 * seccomp_prepare_filter: Prepares a seccomp filter for use.
217 * @fprog: BPF program to install
219 * Returns filter on success or an ERR_PTR on failure.
221 static struct seccomp_filter
*seccomp_prepare_filter(struct sock_fprog
*fprog
)
223 struct seccomp_filter
*filter
;
224 unsigned long fp_size
;
225 struct sock_filter
*fp
;
229 if (fprog
->len
== 0 || fprog
->len
> BPF_MAXINSNS
)
230 return ERR_PTR(-EINVAL
);
231 BUG_ON(INT_MAX
/ fprog
->len
< sizeof(struct sock_filter
));
232 fp_size
= fprog
->len
* sizeof(struct sock_filter
);
235 * Installing a seccomp filter requires that the task has
236 * CAP_SYS_ADMIN in its namespace or be running with no_new_privs.
237 * This avoids scenarios where unprivileged tasks can affect the
238 * behavior of privileged children.
240 if (!task_no_new_privs(current
) &&
241 security_capable_noaudit(current_cred(), current_user_ns(),
243 return ERR_PTR(-EACCES
);
245 fp
= kzalloc(fp_size
, GFP_KERNEL
|__GFP_NOWARN
);
247 return ERR_PTR(-ENOMEM
);
249 /* Copy the instructions from fprog. */
251 if (copy_from_user(fp
, fprog
->filter
, fp_size
))
254 /* Check and rewrite the fprog via the skb checker */
255 ret
= sk_chk_filter(fp
, fprog
->len
);
259 /* Check and rewrite the fprog for seccomp use */
260 ret
= seccomp_check_filter(fp
, fprog
->len
);
264 /* Convert 'sock_filter' insns to 'sock_filter_int' insns */
265 ret
= sk_convert_filter(fp
, fprog
->len
, NULL
, &new_len
);
269 /* Allocate a new seccomp_filter */
271 filter
= kzalloc(sizeof(struct seccomp_filter
),
272 GFP_KERNEL
|__GFP_NOWARN
);
276 filter
->prog
= kzalloc(sk_filter_size(new_len
),
277 GFP_KERNEL
|__GFP_NOWARN
);
281 ret
= sk_convert_filter(fp
, fprog
->len
, filter
->prog
->insnsi
, &new_len
);
283 goto free_filter_prog
;
286 atomic_set(&filter
->usage
, 1);
287 filter
->prog
->len
= new_len
;
289 sk_filter_select_runtime(filter
->prog
);
303 * seccomp_prepare_user_filter - prepares a user-supplied sock_fprog
304 * @user_filter: pointer to the user data containing a sock_fprog.
306 * Returns 0 on success and non-zero otherwise.
308 static struct seccomp_filter
*
309 seccomp_prepare_user_filter(const char __user
*user_filter
)
311 struct sock_fprog fprog
;
312 struct seccomp_filter
*filter
= ERR_PTR(-EFAULT
);
315 if (is_compat_task()) {
316 struct compat_sock_fprog fprog32
;
317 if (copy_from_user(&fprog32
, user_filter
, sizeof(fprog32
)))
319 fprog
.len
= fprog32
.len
;
320 fprog
.filter
= compat_ptr(fprog32
.filter
);
321 } else /* falls through to the if below. */
323 if (copy_from_user(&fprog
, user_filter
, sizeof(fprog
)))
325 filter
= seccomp_prepare_filter(&fprog
);
331 * seccomp_attach_filter: validate and attach filter
332 * @flags: flags to change filter behavior
333 * @filter: seccomp filter to add to the current process
335 * Returns 0 on success, -ve on error.
337 static long seccomp_attach_filter(unsigned int flags
,
338 struct seccomp_filter
*filter
)
340 unsigned long total_insns
;
341 struct seccomp_filter
*walker
;
343 /* Validate resulting filter length. */
344 total_insns
= filter
->prog
->len
;
345 for (walker
= current
->seccomp
.filter
; walker
; walker
= walker
->prev
)
346 total_insns
+= walker
->prog
->len
+ 4; /* 4 instr penalty */
347 if (total_insns
> MAX_INSNS_PER_PATH
)
351 * If there is an existing filter, make it the prev and don't drop its
354 filter
->prev
= current
->seccomp
.filter
;
355 current
->seccomp
.filter
= filter
;
360 /* get_seccomp_filter - increments the reference count of the filter on @tsk */
361 void get_seccomp_filter(struct task_struct
*tsk
)
363 struct seccomp_filter
*orig
= tsk
->seccomp
.filter
;
366 /* Reference count is bounded by the number of total processes. */
367 atomic_inc(&orig
->usage
);
370 static inline void seccomp_filter_free(struct seccomp_filter
*filter
)
373 sk_filter_free(filter
->prog
);
378 /* put_seccomp_filter - decrements the ref count of tsk->seccomp.filter */
379 void put_seccomp_filter(struct task_struct
*tsk
)
381 struct seccomp_filter
*orig
= tsk
->seccomp
.filter
;
382 /* Clean up single-reference branches iteratively. */
383 while (orig
&& atomic_dec_and_test(&orig
->usage
)) {
384 struct seccomp_filter
*freeme
= orig
;
386 seccomp_filter_free(freeme
);
391 * seccomp_send_sigsys - signals the task to allow in-process syscall emulation
392 * @syscall: syscall number to send to userland
393 * @reason: filter-supplied reason code to send to userland (via si_errno)
395 * Forces a SIGSYS with a code of SYS_SECCOMP and related sigsys info.
397 static void seccomp_send_sigsys(int syscall
, int reason
)
400 memset(&info
, 0, sizeof(info
));
401 info
.si_signo
= SIGSYS
;
402 info
.si_code
= SYS_SECCOMP
;
403 info
.si_call_addr
= (void __user
*)KSTK_EIP(current
);
404 info
.si_errno
= reason
;
405 info
.si_arch
= syscall_get_arch();
406 info
.si_syscall
= syscall
;
407 force_sig_info(SIGSYS
, &info
, current
);
409 #endif /* CONFIG_SECCOMP_FILTER */
412 * Secure computing mode 1 allows only read/write/exit/sigreturn.
413 * To be fully secure this must be combined with rlimit
414 * to limit the stack allocations too.
416 static int mode1_syscalls
[] = {
417 __NR_seccomp_read
, __NR_seccomp_write
, __NR_seccomp_exit
, __NR_seccomp_sigreturn
,
418 0, /* null terminated */
422 static int mode1_syscalls_32
[] = {
423 __NR_seccomp_read_32
, __NR_seccomp_write_32
, __NR_seccomp_exit_32
, __NR_seccomp_sigreturn_32
,
424 0, /* null terminated */
428 int __secure_computing(int this_syscall
)
430 int mode
= current
->seccomp
.mode
;
436 case SECCOMP_MODE_STRICT
:
437 syscall
= mode1_syscalls
;
439 if (is_compat_task())
440 syscall
= mode1_syscalls_32
;
443 if (*syscall
== this_syscall
)
445 } while (*++syscall
);
447 ret
= SECCOMP_RET_KILL
;
449 #ifdef CONFIG_SECCOMP_FILTER
450 case SECCOMP_MODE_FILTER
: {
452 struct pt_regs
*regs
= task_pt_regs(current
);
453 ret
= seccomp_run_filters(this_syscall
);
454 data
= ret
& SECCOMP_RET_DATA
;
455 ret
&= SECCOMP_RET_ACTION
;
457 case SECCOMP_RET_ERRNO
:
458 /* Set the low-order 16-bits as a errno. */
459 syscall_set_return_value(current
, regs
,
462 case SECCOMP_RET_TRAP
:
463 /* Show the handler the original registers. */
464 syscall_rollback(current
, regs
);
465 /* Let the filter pass back 16 bits of data. */
466 seccomp_send_sigsys(this_syscall
, data
);
468 case SECCOMP_RET_TRACE
:
469 /* Skip these calls if there is no tracer. */
470 if (!ptrace_event_enabled(current
, PTRACE_EVENT_SECCOMP
)) {
471 syscall_set_return_value(current
, regs
,
475 /* Allow the BPF to provide the event message */
476 ptrace_event(PTRACE_EVENT_SECCOMP
, data
);
478 * The delivery of a fatal signal during event
479 * notification may silently skip tracer notification.
480 * Terminating the task now avoids executing a system
481 * call that may not be intended.
483 if (fatal_signal_pending(current
))
485 if (syscall_get_nr(current
, regs
) < 0)
486 goto skip
; /* Explicit request to skip. */
489 case SECCOMP_RET_ALLOW
:
491 case SECCOMP_RET_KILL
:
506 audit_seccomp(this_syscall
, exit_sig
, ret
);
508 #ifdef CONFIG_SECCOMP_FILTER
510 audit_seccomp(this_syscall
, exit_sig
, ret
);
515 long prctl_get_seccomp(void)
517 return current
->seccomp
.mode
;
521 * seccomp_set_mode_strict: internal function for setting strict seccomp
523 * Once current->seccomp.mode is non-zero, it may not be changed.
525 * Returns 0 on success or -EINVAL on failure.
527 static long seccomp_set_mode_strict(void)
529 const unsigned long seccomp_mode
= SECCOMP_MODE_STRICT
;
532 if (!seccomp_may_assign_mode(seccomp_mode
))
538 seccomp_assign_mode(seccomp_mode
);
546 #ifdef CONFIG_SECCOMP_FILTER
548 * seccomp_set_mode_filter: internal function for setting seccomp filter
549 * @flags: flags to change filter behavior
550 * @filter: struct sock_fprog containing filter
552 * This function may be called repeatedly to install additional filters.
553 * Every filter successfully installed will be evaluated (in reverse order)
554 * for each system call the task makes.
556 * Once current->seccomp.mode is non-zero, it may not be changed.
558 * Returns 0 on success or -EINVAL on failure.
560 static long seccomp_set_mode_filter(unsigned int flags
,
561 const char __user
*filter
)
563 const unsigned long seccomp_mode
= SECCOMP_MODE_FILTER
;
564 struct seccomp_filter
*prepared
= NULL
;
567 /* Validate flags. */
571 /* Prepare the new filter before holding any locks. */
572 prepared
= seccomp_prepare_user_filter(filter
);
573 if (IS_ERR(prepared
))
574 return PTR_ERR(prepared
);
576 if (!seccomp_may_assign_mode(seccomp_mode
))
579 ret
= seccomp_attach_filter(flags
, prepared
);
582 /* Do not free the successfully attached filter. */
585 seccomp_assign_mode(seccomp_mode
);
587 seccomp_filter_free(prepared
);
591 static inline long seccomp_set_mode_filter(unsigned int flags
,
592 const char __user
*filter
)
598 /* Common entry point for both prctl and syscall. */
599 static long do_seccomp(unsigned int op
, unsigned int flags
,
600 const char __user
*uargs
)
603 case SECCOMP_SET_MODE_STRICT
:
604 if (flags
!= 0 || uargs
!= NULL
)
606 return seccomp_set_mode_strict();
607 case SECCOMP_SET_MODE_FILTER
:
608 return seccomp_set_mode_filter(flags
, uargs
);
614 SYSCALL_DEFINE3(seccomp
, unsigned int, op
, unsigned int, flags
,
615 const char __user
*, uargs
)
617 return do_seccomp(op
, flags
, uargs
);
621 * prctl_set_seccomp: configures current->seccomp.mode
622 * @seccomp_mode: requested mode to use
623 * @filter: optional struct sock_fprog for use with SECCOMP_MODE_FILTER
625 * Returns 0 on success or -EINVAL on failure.
627 long prctl_set_seccomp(unsigned long seccomp_mode
, char __user
*filter
)
632 switch (seccomp_mode
) {
633 case SECCOMP_MODE_STRICT
:
634 op
= SECCOMP_SET_MODE_STRICT
;
636 * Setting strict mode through prctl always ignored filter,
637 * so make sure it is always NULL here to pass the internal
638 * check in do_seccomp().
642 case SECCOMP_MODE_FILTER
:
643 op
= SECCOMP_SET_MODE_FILTER
;
650 /* prctl interface doesn't have flags, so they are always zero. */
651 return do_seccomp(op
, 0, uargs
);