Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'seccomp-v6.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
Pull seccomp updates from Kees Cook:
- avoid the lock trip seccomp_filter_release in common case (Mateusz
Guzik)
- remove unused 'sd' argument through-out (Oleg Nesterov)
- selftests/seccomp: Add hard-coded __NR_uretprobe for x86_64
* tag 'seccomp-v6.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
seccomp: avoid the lock trip seccomp_filter_release in common case
seccomp: remove the 'sd' argument from __seccomp_filter()
seccomp: remove the 'sd' argument from __secure_computing()
seccomp: fix the __secure_computing() stub for !HAVE_ARCH_SECCOMP_FILTER
seccomp/mips: change syscall_trace_enter() to use secure_computing()
selftests/seccomp: Add hard-coded __NR_uretprobe for x86_64
+43
-48
+2
-18
arch/mips/kernel/ptrace.c
+2
-18
arch/mips/kernel/ptrace.c
···
1326
1326
return -1;
1327
1327
}
1328
1328
1329
-
#ifdef CONFIG_SECCOMP
1330
-
if (unlikely(test_thread_flag(TIF_SECCOMP))) {
1331
-
int ret, i;
1332
-
struct seccomp_data sd;
1333
-
unsigned long args[6];
1334
-
1335
-
sd.nr = current_thread_info()->syscall;
1336
-
sd.arch = syscall_get_arch(current);
1337
-
syscall_get_arguments(current, regs, args);
1338
-
for (i = 0; i < 6; i++)
1339
-
sd.args[i] = args[i];
1340
-
sd.instruction_pointer = KSTK_EIP(current);
1341
-
1342
-
ret = __secure_computing(&sd);
1343
-
if (ret == -1)
1344
-
return ret;
1345
-
}
1346
-
#endif
1329
+
if (secure_computing())
1330
+
return -1;
1347
1331
1348
1332
if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
1349
1333
trace_sys_enter(regs, regs->regs[2]);
+1
-1
arch/powerpc/kernel/ptrace/ptrace.c
+1
-1
arch/powerpc/kernel/ptrace/ptrace.c
+4
-8
include/linux/seccomp.h
+4
-8
include/linux/seccomp.h
···
22
22
#include <linux/atomic.h>
23
23
#include <asm/seccomp.h>
24
24
25
+
extern int __secure_computing(void);
26
+
25
27
#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
26
-
extern int __secure_computing(const struct seccomp_data *sd);
27
28
static inline int secure_computing(void)
28
29
{
29
30
if (unlikely(test_syscall_work(SECCOMP)))
30
-
return __secure_computing(NULL);
31
+
return __secure_computing();
31
32
return 0;
32
33
}
33
34
#else
34
35
extern void secure_computing_strict(int this_syscall);
35
-
static inline int __secure_computing(const struct seccomp_data *sd)
36
-
{
37
-
secure_computing_strict(sd->nr);
38
-
return 0;
39
-
}
40
36
#endif
41
37
42
38
extern long prctl_get_seccomp(void);
···
54
58
#else
55
59
static inline void secure_computing_strict(int this_syscall) { return; }
56
60
#endif
57
-
static inline int __secure_computing(const struct seccomp_data *sd) { return 0; }
61
+
static inline int __secure_computing(void) { return 0; }
58
62
59
63
static inline long prctl_get_seccomp(void)
60
64
{
+1
-1
kernel/entry/common.c
+1
-1
kernel/entry/common.c
+29
-20
kernel/seccomp.c
+29
-20
kernel/seccomp.c
···
29
29
#include <linux/syscalls.h>
30
30
#include <linux/sysctl.h>
31
31
32
+
#include <asm/syscall.h>
33
+
32
34
/* Not exposed in headers: strictly internal use only. */
33
35
#define SECCOMP_MODE_DEAD (SECCOMP_MODE_FILTER + 1)
34
-
35
-
#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
36
-
#include <asm/syscall.h>
37
-
#endif
38
36
39
37
#ifdef CONFIG_SECCOMP_FILTER
40
38
#include <linux/file.h>
···
574
576
if (WARN_ON((tsk->flags & PF_EXITING) == 0))
575
577
return;
576
578
579
+
if (READ_ONCE(tsk->seccomp.filter) == NULL)
580
+
return;
581
+
577
582
spin_lock_irq(&tsk->sighand->siglock);
578
583
orig = tsk->seccomp.filter;
579
584
/* Detach task from its filter tree. */
···
601
600
602
601
BUG_ON(!mutex_is_locked(¤t->signal->cred_guard_mutex));
603
602
assert_spin_locked(¤t->sighand->siglock);
603
+
604
+
/*
605
+
* Don't touch any of the threads if the process is being killed.
606
+
* This allows for a lockless check in seccomp_filter_release.
607
+
*/
608
+
if (current->signal->flags & SIGNAL_GROUP_EXIT)
609
+
return;
604
610
605
611
/* Synchronize all threads. */
606
612
caller = current;
···
1082
1074
else
1083
1075
BUG();
1084
1076
}
1077
+
int __secure_computing(void)
1078
+
{
1079
+
int this_syscall = syscall_get_nr(current, current_pt_regs());
1080
+
1081
+
secure_computing_strict(this_syscall);
1082
+
return 0;
1083
+
}
1085
1084
#else
1086
1085
1087
1086
#ifdef CONFIG_SECCOMP_FILTER
···
1240
1225
return -1;
1241
1226
}
1242
1227
1243
-
static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
1244
-
const bool recheck_after_trace)
1228
+
static int __seccomp_filter(int this_syscall, const bool recheck_after_trace)
1245
1229
{
1246
1230
u32 filter_ret, action;
1231
+
struct seccomp_data sd;
1247
1232
struct seccomp_filter *match = NULL;
1248
1233
int data;
1249
-
struct seccomp_data sd_local;
1250
1234
1251
1235
/*
1252
1236
* Make sure that any changes to mode from another thread have
···
1253
1239
*/
1254
1240
smp_rmb();
1255
1241
1256
-
if (!sd) {
1257
-
populate_seccomp_data(&sd_local);
1258
-
sd = &sd_local;
1259
-
}
1242
+
populate_seccomp_data(&sd);
1260
1243
1261
-
filter_ret = seccomp_run_filters(sd, &match);
1244
+
filter_ret = seccomp_run_filters(&sd, &match);
1262
1245
data = filter_ret & SECCOMP_RET_DATA;
1263
1246
action = filter_ret & SECCOMP_RET_ACTION_FULL;
1264
1247
···
1313
1302
* a reload of all registers. This does not goto skip since
1314
1303
* a skip would have already been reported.
1315
1304
*/
1316
-
if (__seccomp_filter(this_syscall, NULL, true))
1305
+
if (__seccomp_filter(this_syscall, true))
1317
1306
return -1;
1318
1307
1319
1308
return 0;
1320
1309
1321
1310
case SECCOMP_RET_USER_NOTIF:
1322
-
if (seccomp_do_user_notification(this_syscall, match, sd))
1311
+
if (seccomp_do_user_notification(this_syscall, match, &sd))
1323
1312
goto skip;
1324
1313
1325
1314
return 0;
···
1361
1350
return -1;
1362
1351
}
1363
1352
#else
1364
-
static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
1365
-
const bool recheck_after_trace)
1353
+
static int __seccomp_filter(int this_syscall, const bool recheck_after_trace)
1366
1354
{
1367
1355
BUG();
1368
1356
···
1369
1359
}
1370
1360
#endif
1371
1361
1372
-
int __secure_computing(const struct seccomp_data *sd)
1362
+
int __secure_computing(void)
1373
1363
{
1374
1364
int mode = current->seccomp.mode;
1375
1365
int this_syscall;
···
1378
1368
unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
1379
1369
return 0;
1380
1370
1381
-
this_syscall = sd ? sd->nr :
1382
-
syscall_get_nr(current, current_pt_regs());
1371
+
this_syscall = syscall_get_nr(current, current_pt_regs());
1383
1372
1384
1373
switch (mode) {
1385
1374
case SECCOMP_MODE_STRICT:
1386
1375
__secure_computing_strict(this_syscall); /* may call do_exit */
1387
1376
return 0;
1388
1377
case SECCOMP_MODE_FILTER:
1389
-
return __seccomp_filter(this_syscall, sd, false);
1378
+
return __seccomp_filter(this_syscall, false);
1390
1379
/* Surviving SECCOMP_RET_KILL_* must be proactively impossible. */
1391
1380
case SECCOMP_MODE_DEAD:
1392
1381
WARN_ON_ONCE(1);
+6
tools/testing/selftests/seccomp/seccomp_bpf.c
+6
tools/testing/selftests/seccomp/seccomp_bpf.c