kernel/seccomp.c

   1 /*
   2  * linux/kernel/seccomp.c
   3  *
   4  * Copyright 2004-2005  Andrea Arcangeli <andrea@cpushare.com>
   5  *
   6  * Copyright (C) 2012 Google, Inc.
   7  * Will Drewry <wad@chromium.org>
   8  *
   9  * This defines a simple but solid secure-computing facility.
  10  *
  11  * Mode 1 uses a fixed list of allowed system calls.
  12  * Mode 2 allows user-defined system call filters in the form
  13  *        of Berkeley Packet Filters/Linux Socket Filters.
  14  */
  15
  16 #include <linux/atomic.h>
  17 #include <linux/audit.h>
  18 #include <linux/compat.h>
  19 #include <linux/sched.h>
  20 #include <linux/seccomp.h>
  21
  22 /* #define SECCOMP_DEBUG 1 */
  23
  24 #ifdef CONFIG_SECCOMP_FILTER
  25 #include <asm/syscall.h>
  26 #include <linux/filter.h>
  27 #include <linux/ptrace.h>
  28 #include <linux/security.h>
  29 #include <linux/slab.h>
  30 #include <linux/tracehook.h>
  31 #include <linux/uaccess.h>
  32
  33 /**
  34  * struct seccomp_filter - container for seccomp BPF programs
  35  *
  36  * @usage: reference count to manage the object lifetime.
  37  *         get/put helpers should be used when accessing an instance
  38  *         outside of a lifetime-guarded section.  In general, this
  39  *         is only needed for handling filters shared across tasks.
  40  * @prev: points to a previously installed, or inherited, filter
  41  * @len: the number of instructions in the program
  42  * @insnsi: the BPF program instructions to evaluate
  43  *
  44  * seccomp_filter objects are organized in a tree linked via the @prev
  45  * pointer.  For any task, it appears to be a singly-linked list starting
  46  * with current->seccomp.filter, the most recently attached or inherited filter.
  47  * However, multiple filters may share a @prev node, by way of fork(), which
  48  * results in a unidirectional tree existing in memory.  This is similar to
  49  * how namespaces work.
  50  *
  51  * seccomp_filter objects should never be modified after being attached
  52  * to a task_struct (other than @usage).
  53  */
  54 struct seccomp_filter {
  55         atomic_t usage;
  56         struct seccomp_filter *prev;
  57         struct sk_filter *prog;
  58 };
  59
  60 /* Limit any path through the tree to 256KB worth of instructions. */
  61 #define MAX_INSNS_PER_PATH ((1 << 18) / sizeof(struct sock_filter))
  62
  63 /*
  64  * Endianness is explicitly ignored and left for BPF program authors to manage
  65  * as per the specific architecture.
  66  */
  67 static void populate_seccomp_data(struct seccomp_data *sd)
  68 {
  69         struct task_struct *task = current;
  70         struct pt_regs *regs = task_pt_regs(task);
  71         unsigned long args[6];
  72
  73         sd->nr = syscall_get_nr(task, regs);
  74         sd->arch = syscall_get_arch();
  75         syscall_get_arguments(task, regs, 0, 6, args);
  76         sd->args[0] = args[0];
  77         sd->args[1] = args[1];
  78         sd->args[2] = args[2];
  79         sd->args[3] = args[3];
  80         sd->args[4] = args[4];
  81         sd->args[5] = args[5];
  82         sd->instruction_pointer = KSTK_EIP(task);
  83 }
  84
  85 /**
  86  *      seccomp_check_filter - verify seccomp filter code
  87  *      @filter: filter to verify
  88  *      @flen: length of filter
  89  *
  90  * Takes a previously checked filter (by sk_chk_filter) and
  91  * redirects all filter code that loads struct sk_buff data
  92  * and related data through seccomp_bpf_load.  It also
  93  * enforces length and alignment checking of those loads.
  94  *
  95  * Returns 0 if the rule set is legal or -EINVAL if not.
  96  */
  97 static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen)
  98 {
  99         int pc;
 100         for (pc = 0; pc < flen; pc++) {
 101                 struct sock_filter *ftest = &filter[pc];
 102                 u16 code = ftest->code;
 103                 u32 k = ftest->k;
 104
 105                 switch (code) {
 106                 case BPF_LD | BPF_W | BPF_ABS:
 107                         ftest->code = BPF_LDX | BPF_W | BPF_ABS;
 108                         /* 32-bit aligned and not out of bounds. */
 109                         if (k >= sizeof(struct seccomp_data) || k & 3)
 110                                 return -EINVAL;
 111                         continue;
 112                 case BPF_LD | BPF_W | BPF_LEN:
 113                         ftest->code = BPF_LD | BPF_IMM;
 114                         ftest->k = sizeof(struct seccomp_data);
 115                         continue;
 116                 case BPF_LDX | BPF_W | BPF_LEN:
 117                         ftest->code = BPF_LDX | BPF_IMM;
 118                         ftest->k = sizeof(struct seccomp_data);
 119                         continue;
 120                 /* Explicitly include allowed calls. */
 121                 case BPF_RET | BPF_K:
 122                 case BPF_RET | BPF_A:
 123                 case BPF_ALU | BPF_ADD | BPF_K:
 124                 case BPF_ALU | BPF_ADD | BPF_X:
 125                 case BPF_ALU | BPF_SUB | BPF_K:
 126                 case BPF_ALU | BPF_SUB | BPF_X:
 127                 case BPF_ALU | BPF_MUL | BPF_K:
 128                 case BPF_ALU | BPF_MUL | BPF_X:
 129                 case BPF_ALU | BPF_DIV | BPF_K:
 130                 case BPF_ALU | BPF_DIV | BPF_X:
 131                 case BPF_ALU | BPF_AND | BPF_K:
 132                 case BPF_ALU | BPF_AND | BPF_X:
 133                 case BPF_ALU | BPF_OR | BPF_K:
 134                 case BPF_ALU | BPF_OR | BPF_X:
 135                 case BPF_ALU | BPF_XOR | BPF_K:
 136                 case BPF_ALU | BPF_XOR | BPF_X:
 137                 case BPF_ALU | BPF_LSH | BPF_K:
 138                 case BPF_ALU | BPF_LSH | BPF_X:
 139                 case BPF_ALU | BPF_RSH | BPF_K:
 140                 case BPF_ALU | BPF_RSH | BPF_X:
 141                 case BPF_ALU | BPF_NEG:
 142                 case BPF_LD | BPF_IMM:
 143                 case BPF_LDX | BPF_IMM:
 144                 case BPF_MISC | BPF_TAX:
 145                 case BPF_MISC | BPF_TXA:
 146                 case BPF_LD | BPF_MEM:
 147                 case BPF_LDX | BPF_MEM:
 148                 case BPF_ST:
 149                 case BPF_STX:
 150                 case BPF_JMP | BPF_JA:
 151                 case BPF_JMP | BPF_JEQ | BPF_K:
 152                 case BPF_JMP | BPF_JEQ | BPF_X:
 153                 case BPF_JMP | BPF_JGE | BPF_K:
 154                 case BPF_JMP | BPF_JGE | BPF_X:
 155                 case BPF_JMP | BPF_JGT | BPF_K:
 156                 case BPF_JMP | BPF_JGT | BPF_X:
 157                 case BPF_JMP | BPF_JSET | BPF_K:
 158                 case BPF_JMP | BPF_JSET | BPF_X:
 159                         continue;
 160                 default:
 161                         return -EINVAL;
 162                 }
 163         }
 164         return 0;
 165 }
 166
 167 /**
 168  * seccomp_run_filters - evaluates all seccomp filters against @syscall
 169  * @syscall: number of the current system call
 170  *
 171  * Returns valid seccomp BPF response codes.
 172  */
 173 static u32 seccomp_run_filters(int syscall)
 174 {
 175         struct seccomp_filter *f;
 176         struct seccomp_data sd;
 177         u32 ret = SECCOMP_RET_ALLOW;
 178
 179         /* Ensure unexpected behavior doesn't result in failing open. */
 180         if (WARN_ON(current->seccomp.filter == NULL))
 181                 return SECCOMP_RET_KILL;
 182
 183         populate_seccomp_data(&sd);
 184
 185         /*
 186          * All filters in the list are evaluated and the lowest BPF return
 187          * value always takes priority (ignoring the DATA).
 188          */
 189         for (f = current->seccomp.filter; f; f = f->prev) {
 190                 u32 cur_ret = SK_RUN_FILTER(f->prog, (void *)&sd);
 191
 192                 if ((cur_ret & SECCOMP_RET_ACTION) < (ret & SECCOMP_RET_ACTION))
 193                         ret = cur_ret;
 194         }
 195         return ret;
 196 }
 197 #endif /* CONFIG_SECCOMP_FILTER */
 198
 199 static inline bool seccomp_may_assign_mode(unsigned long seccomp_mode)
 200 {
 201         if (current->seccomp.mode && current->seccomp.mode != seccomp_mode)
 202                 return false;
 203
 204         return true;
 205 }
 206
 207 static inline void seccomp_assign_mode(unsigned long seccomp_mode)
 208 {
 209         current->seccomp.mode = seccomp_mode;
 210         set_tsk_thread_flag(current, TIF_SECCOMP);
 211 }
 212
 213 #ifdef CONFIG_SECCOMP_FILTER
 214 /**
 215  * seccomp_attach_filter: Attaches a seccomp filter to current.
 216  * @fprog: BPF program to install
 217  *
 218  * Returns 0 on success or an errno on failure.
 219  */
 220 static long seccomp_attach_filter(struct sock_fprog *fprog)
 221 {
 222         struct seccomp_filter *filter;
 223         unsigned long fp_size = fprog->len * sizeof(struct sock_filter);
 224         unsigned long total_insns = fprog->len;
 225         struct sock_filter *fp;
 226         int new_len;
 227         long ret;
 228
 229         if (fprog->len == 0 || fprog->len > BPF_MAXINSNS)
 230                 return -EINVAL;
 231
 232         for (filter = current->seccomp.filter; filter; filter = filter->prev)
 233                 total_insns += filter->prog->len + 4;  /* include a 4 instr penalty */
 234         if (total_insns > MAX_INSNS_PER_PATH)
 235                 return -ENOMEM;
 236
 237         /*
 238          * Installing a seccomp filter requires that the task has
 239          * CAP_SYS_ADMIN in its namespace or be running with no_new_privs.
 240          * This avoids scenarios where unprivileged tasks can affect the
 241          * behavior of privileged children.
 242          */
 243         if (!current->no_new_privs &&
 244             security_capable_noaudit(current_cred(), current_user_ns(),
 245                                      CAP_SYS_ADMIN) != 0)
 246                 return -EACCES;
 247
 248         fp = kzalloc(fp_size, GFP_KERNEL|__GFP_NOWARN);
 249         if (!fp)
 250                 return -ENOMEM;
 251
 252         /* Copy the instructions from fprog. */
 253         ret = -EFAULT;
 254         if (copy_from_user(fp, fprog->filter, fp_size))
 255                 goto free_prog;
 256
 257         /* Check and rewrite the fprog via the skb checker */
 258         ret = sk_chk_filter(fp, fprog->len);
 259         if (ret)
 260                 goto free_prog;
 261
 262         /* Check and rewrite the fprog for seccomp use */
 263         ret = seccomp_check_filter(fp, fprog->len);
 264         if (ret)
 265                 goto free_prog;
 266
 267         /* Convert 'sock_filter' insns to 'sock_filter_int' insns */
 268         ret = sk_convert_filter(fp, fprog->len, NULL, &new_len);
 269         if (ret)
 270                 goto free_prog;
 271
 272         /* Allocate a new seccomp_filter */
 273         ret = -ENOMEM;
 274         filter = kzalloc(sizeof(struct seccomp_filter),
 275                          GFP_KERNEL|__GFP_NOWARN);
 276         if (!filter)
 277                 goto free_prog;
 278
 279         filter->prog = kzalloc(sk_filter_size(new_len),
 280                                GFP_KERNEL|__GFP_NOWARN);
 281         if (!filter->prog)
 282                 goto free_filter;
 283
 284         ret = sk_convert_filter(fp, fprog->len, filter->prog->insnsi, &new_len);
 285         if (ret)
 286                 goto free_filter_prog;
 287         kfree(fp);
 288
 289         atomic_set(&filter->usage, 1);
 290         filter->prog->len = new_len;
 291
 292         sk_filter_select_runtime(filter->prog);
 293
 294         /*
 295          * If there is an existing filter, make it the prev and don't drop its
 296          * task reference.
 297          */
 298         filter->prev = current->seccomp.filter;
 299         current->seccomp.filter = filter;
 300         return 0;
 301
 302 free_filter_prog:
 303         kfree(filter->prog);
 304 free_filter:
 305         kfree(filter);
 306 free_prog:
 307         kfree(fp);
 308         return ret;
 309 }
 310
 311 /**
 312  * seccomp_attach_user_filter - attaches a user-supplied sock_fprog
 313  * @user_filter: pointer to the user data containing a sock_fprog.
 314  *
 315  * Returns 0 on success and non-zero otherwise.
 316  */
 317 static long seccomp_attach_user_filter(char __user *user_filter)
 318 {
 319         struct sock_fprog fprog;
 320         long ret = -EFAULT;
 321
 322 #ifdef CONFIG_COMPAT
 323         if (is_compat_task()) {
 324                 struct compat_sock_fprog fprog32;
 325                 if (copy_from_user(&fprog32, user_filter, sizeof(fprog32)))
 326                         goto out;
 327                 fprog.len = fprog32.len;
 328                 fprog.filter = compat_ptr(fprog32.filter);
 329         } else /* falls through to the if below. */
 330 #endif
 331         if (copy_from_user(&fprog, user_filter, sizeof(fprog)))
 332                 goto out;
 333         ret = seccomp_attach_filter(&fprog);
 334 out:
 335         return ret;
 336 }
 337
 338 /* get_seccomp_filter - increments the reference count of the filter on @tsk */
 339 void get_seccomp_filter(struct task_struct *tsk)
 340 {
 341         struct seccomp_filter *orig = tsk->seccomp.filter;
 342         if (!orig)
 343                 return;
 344         /* Reference count is bounded by the number of total processes. */
 345         atomic_inc(&orig->usage);
 346 }
 347
 348 /* put_seccomp_filter - decrements the ref count of tsk->seccomp.filter */
 349 void put_seccomp_filter(struct task_struct *tsk)
 350 {
 351         struct seccomp_filter *orig = tsk->seccomp.filter;
 352         /* Clean up single-reference branches iteratively. */
 353         while (orig && atomic_dec_and_test(&orig->usage)) {
 354                 struct seccomp_filter *freeme = orig;
 355                 orig = orig->prev;
 356                 sk_filter_free(freeme->prog);
 357                 kfree(freeme);
 358         }
 359 }
 360
 361 /**
 362  * seccomp_send_sigsys - signals the task to allow in-process syscall emulation
 363  * @syscall: syscall number to send to userland
 364  * @reason: filter-supplied reason code to send to userland (via si_errno)
 365  *
 366  * Forces a SIGSYS with a code of SYS_SECCOMP and related sigsys info.
 367  */
 368 static void seccomp_send_sigsys(int syscall, int reason)
 369 {
 370         struct siginfo info;
 371         memset(&info, 0, sizeof(info));
 372         info.si_signo = SIGSYS;
 373         info.si_code = SYS_SECCOMP;
 374         info.si_call_addr = (void __user *)KSTK_EIP(current);
 375         info.si_errno = reason;
 376         info.si_arch = syscall_get_arch();
 377         info.si_syscall = syscall;
 378         force_sig_info(SIGSYS, &info, current);
 379 }
 380 #endif  /* CONFIG_SECCOMP_FILTER */
 381
 382 /*
 383  * Secure computing mode 1 allows only read/write/exit/sigreturn.
 384  * To be fully secure this must be combined with rlimit
 385  * to limit the stack allocations too.
 386  */
 387 static int mode1_syscalls[] = {
 388         __NR_seccomp_read, __NR_seccomp_write, __NR_seccomp_exit, __NR_seccomp_sigreturn,
 389         0, /* null terminated */
 390 };
 391
 392 #ifdef CONFIG_COMPAT
 393 static int mode1_syscalls_32[] = {
 394         __NR_seccomp_read_32, __NR_seccomp_write_32, __NR_seccomp_exit_32, __NR_seccomp_sigreturn_32,
 395         0, /* null terminated */
 396 };
 397 #endif
 398
 399 int __secure_computing(int this_syscall)
 400 {
 401         int mode = current->seccomp.mode;
 402         int exit_sig = 0;
 403         int *syscall;
 404         u32 ret;
 405
 406         switch (mode) {
 407         case SECCOMP_MODE_STRICT:
 408                 syscall = mode1_syscalls;
 409 #ifdef CONFIG_COMPAT
 410                 if (is_compat_task())
 411                         syscall = mode1_syscalls_32;
 412 #endif
 413                 do {
 414                         if (*syscall == this_syscall)
 415                                 return 0;
 416                 } while (*++syscall);
 417                 exit_sig = SIGKILL;
 418                 ret = SECCOMP_RET_KILL;
 419                 break;
 420 #ifdef CONFIG_SECCOMP_FILTER
 421         case SECCOMP_MODE_FILTER: {
 422                 int data;
 423                 struct pt_regs *regs = task_pt_regs(current);
 424                 ret = seccomp_run_filters(this_syscall);
 425                 data = ret & SECCOMP_RET_DATA;
 426                 ret &= SECCOMP_RET_ACTION;
 427                 switch (ret) {
 428                 case SECCOMP_RET_ERRNO:
 429                         /* Set the low-order 16-bits as a errno. */
 430                         syscall_set_return_value(current, regs,
 431                                                  -data, 0);
 432                         goto skip;
 433                 case SECCOMP_RET_TRAP:
 434                         /* Show the handler the original registers. */
 435                         syscall_rollback(current, regs);
 436                         /* Let the filter pass back 16 bits of data. */
 437                         seccomp_send_sigsys(this_syscall, data);
 438                         goto skip;
 439                 case SECCOMP_RET_TRACE:
 440                         /* Skip these calls if there is no tracer. */
 441                         if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP)) {
 442                                 syscall_set_return_value(current, regs,
 443                                                          -ENOSYS, 0);
 444                                 goto skip;
 445                         }
 446                         /* Allow the BPF to provide the event message */
 447                         ptrace_event(PTRACE_EVENT_SECCOMP, data);
 448                         /*
 449                          * The delivery of a fatal signal during event
 450                          * notification may silently skip tracer notification.
 451                          * Terminating the task now avoids executing a system
 452                          * call that may not be intended.
 453                          */
 454                         if (fatal_signal_pending(current))
 455                                 break;
 456                         if (syscall_get_nr(current, regs) < 0)
 457                                 goto skip;  /* Explicit request to skip. */
 458
 459                         return 0;
 460                 case SECCOMP_RET_ALLOW:
 461                         return 0;
 462                 case SECCOMP_RET_KILL:
 463                 default:
 464                         break;
 465                 }
 466                 exit_sig = SIGSYS;
 467                 break;
 468         }
 469 #endif
 470         default:
 471                 BUG();
 472         }
 473
 474 #ifdef SECCOMP_DEBUG
 475         dump_stack();
 476 #endif
 477         audit_seccomp(this_syscall, exit_sig, ret);
 478         do_exit(exit_sig);
 479 #ifdef CONFIG_SECCOMP_FILTER
 480 skip:
 481         audit_seccomp(this_syscall, exit_sig, ret);
 482 #endif
 483         return -1;
 484 }
 485
 486 long prctl_get_seccomp(void)
 487 {
 488         return current->seccomp.mode;
 489 }
 490
 491 /**
 492  * seccomp_set_mode_strict: internal function for setting strict seccomp
 493  *
 494  * Once current->seccomp.mode is non-zero, it may not be changed.
 495  *
 496  * Returns 0 on success or -EINVAL on failure.
 497  */
 498 static long seccomp_set_mode_strict(void)
 499 {
 500         const unsigned long seccomp_mode = SECCOMP_MODE_STRICT;
 501         long ret = -EINVAL;
 502
 503         if (!seccomp_may_assign_mode(seccomp_mode))
 504                 goto out;
 505
 506 #ifdef TIF_NOTSC
 507         disable_TSC();
 508 #endif
 509         seccomp_assign_mode(seccomp_mode);
 510         ret = 0;
 511
 512 out:
 513
 514         return ret;
 515 }
 516
 517 #ifdef CONFIG_SECCOMP_FILTER
 518 /**
 519  * seccomp_set_mode_filter: internal function for setting seccomp filter
 520  * @filter: struct sock_fprog containing filter
 521  *
 522  * This function may be called repeatedly to install additional filters.
 523  * Every filter successfully installed will be evaluated (in reverse order)
 524  * for each system call the task makes.
 525  *
 526  * Once current->seccomp.mode is non-zero, it may not be changed.
 527  *
 528  * Returns 0 on success or -EINVAL on failure.
 529  */
 530 static long seccomp_set_mode_filter(char __user *filter)
 531 {
 532         const unsigned long seccomp_mode = SECCOMP_MODE_FILTER;
 533         long ret = -EINVAL;
 534
 535         if (!seccomp_may_assign_mode(seccomp_mode))
 536                 goto out;
 537
 538         ret = seccomp_attach_user_filter(filter);
 539         if (ret)
 540                 goto out;
 541
 542         seccomp_assign_mode(seccomp_mode);
 543 out:
 544         return ret;
 545 }
 546 #else
 547 static inline long seccomp_set_mode_filter(char __user *filter)
 548 {
 549         return -EINVAL;
 550 }
 551 #endif
 552
 553 /**
 554  * prctl_set_seccomp: configures current->seccomp.mode
 555  * @seccomp_mode: requested mode to use
 556  * @filter: optional struct sock_fprog for use with SECCOMP_MODE_FILTER
 557  *
 558  * Returns 0 on success or -EINVAL on failure.
 559  */
 560 long prctl_set_seccomp(unsigned long seccomp_mode, char __user *filter)
 561 {
 562         switch (seccomp_mode) {
 563         case SECCOMP_MODE_STRICT:
 564                 return seccomp_set_mode_strict();
 565         case SECCOMP_MODE_FILTER:
 566                 return seccomp_set_mode_filter(filter);
 567         default:
 568                 return -EINVAL;
 569         }
 570 }