v2 of seccomp filter c/r patches

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 58ae9f4..ac3ed1c 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c

@@ -506,6 +506,30 @@ struct bpf_prog *bpf_prog_get(u32 ufd)
  }
  EXPORT_SYMBOL_GPL(bpf_prog_get);

+int bpf_prog_set(u32 ufd, struct bpf_prog *new)
+{
+	struct fd f;
+	struct bpf_prog *prog;
+
+	f = fdget(ufd);
+
+	prog = get_prog(f);
+	if (!IS_ERR(prog) && prog)
+		bpf_prog_put(prog);
+
+	atomic_inc(&new->aux->refcnt);
+	f.file->private_data = new;
+	fdput(f);
+	return 0;

Signed-off-by: Tycho Andersen <redacted>
CC: Kees Cook <redacted>
CC: Will Drewry <redacted>
CC: Oleg Nesterov <redacted>
CC: Andy Lutomirski <redacted>
CC: Pavel Emelyanov <redacted>
CC: Serge E. Hallyn <serge.hallyn-GeWIH/nMZzLQT0dZR+AlfA@public.gmane.org>
CC: Alexei Starovoitov <redacted>
CC: Daniel Borkmann <redacted>
---
 include/linux/bpf.h         | 12 ++++++++++
 include/linux/seccomp.h     | 14 +++++++++++
 include/uapi/linux/ptrace.h |  3 +++
 kernel/bpf/syscall.c        | 26 ++++++++++++++++++++-
 kernel/ptrace.c             |  7 ++++++
 kernel/seccomp.c            | 57 +++++++++++++++++++++++++++++++++++++++++++++
 6 files changed, 118 insertions(+), 1 deletion(-)

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index f57d7fe..bfd9cab 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h

@@ -162,6 +162,8 @@ void bpf_register_prog_type(struct bpf_prog_type_list *tl);
 void bpf_register_map_type(struct bpf_map_type_list *tl);

 struct bpf_prog *bpf_prog_get(u32 ufd);
+int bpf_prog_set(u32 ufd, struct bpf_prog *new);
+int bpf_new_fd(struct bpf_prog *prog, int flags);
 void bpf_prog_put(struct bpf_prog *prog);
 void bpf_prog_put_rcu(struct bpf_prog *prog);

@@ -180,6 +182,16 @@ static inline struct bpf_prog *bpf_prog_get(u32 ufd)
        return ERR_PTR(-EOPNOTSUPP);
 }

+static inline int bpf_prog_set(u32 ufd, struct bpf_prog *new)
+{
+       return -EINVAL;
+}
+
+static inline int bpf_new_fd(struct bpf_prog *prog, int flags)
+{
+       return -EINVAL;
+}
+
 static inline void bpf_prog_put(struct bpf_prog *prog)
 {
 }

diff --git a/include/linux/seccomp.h b/include/linux/seccomp.h
index a19ddac..41b083c 100644
--- a/include/linux/seccomp.h
+++ b/include/linux/seccomp.h

@@ -95,4 +95,18 @@ static inline void get_seccomp_filter(struct task_struct *tsk)
        return;
 }
 #endif /* CONFIG_SECCOMP_FILTER */
+
+#if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
+extern long seccomp_get_filter_fd(struct task_struct *child);
+extern long seccomp_next_filter(struct task_struct *child, u32 fd);
+#else
+static inline long seccomp_get_filter_fd(struct task_struct *child)
+{
+       return -EINVAL;
+}
+static inline long seccomp_next_filter(struct task_struct *child, u32 fd)
+{
+       return -EINVAL;
+}
+#endif /* CONFIG_SECCOMP_FILTER && CONFIG_CHECKPOINT_RESTORE */
 #endif /* _LINUX_SECCOMP_H */

diff --git a/include/uapi/linux/ptrace.h b/include/uapi/linux/ptrace.h
index cf1019e..041c3c3 100644
--- a/include/uapi/linux/ptrace.h
+++ b/include/uapi/linux/ptrace.h

@@ -23,6 +23,9 @@

 #define PTRACE_SYSCALL           24

+#define PTRACE_SECCOMP_GET_FILTER_FD   40
+#define PTRACE_SECCOMP_NEXT_FILTER     41
+
 /* 0x4200-0x4300 are reserved for architecture-independent additions.  */
 #define PTRACE_SETOPTIONS      0x4200
 #define PTRACE_GETEVENTMSG     0x4201

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 58ae9f4..ac3ed1c 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c

@@ -506,6 +506,30 @@ struct bpf_prog *bpf_prog_get(u32 ufd)
 }
 EXPORT_SYMBOL_GPL(bpf_prog_get);

+int bpf_prog_set(u32 ufd, struct bpf_prog *new)
+{
+       struct fd f;
+       struct bpf_prog *prog;
+
+       f = fdget(ufd);
+
+       prog = get_prog(f);
+       if (!IS_ERR(prog) && prog)
+               bpf_prog_put(prog);
+
+       atomic_inc(&new->aux->refcnt);
+       f.file->private_data = new;
+       fdput(f);
+       return 0;
+}
+EXPORT_SYMBOL_GPL(bpf_prog_set);
+
+int bpf_new_fd(struct bpf_prog *prog, int flags)
+{
+       return anon_inode_getfd("bpf-prog", &bpf_prog_fops, prog, flags);
+}
+EXPORT_SYMBOL_GPL(bpf_new_fd);
+
 /* last field in 'union bpf_attr' used by this command */
 #define        BPF_PROG_LOAD_LAST_FIELD kern_version

@@ -572,7 +596,7 @@ static int bpf_prog_load(union bpf_attr *attr)
        if (err < 0)
                goto free_used_maps;

-       err = anon_inode_getfd("bpf-prog", &bpf_prog_fops, prog, O_RDWR | O_CLOEXEC);
+       err = bpf_new_fd(prog, O_RDWR | O_CLOEXEC);
        if (err < 0)
                /* failed to allocate fd */
                goto free_used_maps;

diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index c8e0e05..a151c35 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c

@@ -1003,6 +1003,13 @@ int ptrace_request(struct task_struct *child, long request,
                break;
        }
 #endif
+
+       case PTRACE_SECCOMP_GET_FILTER_FD:
+               return seccomp_get_filter_fd(child);
+
+       case PTRACE_SECCOMP_NEXT_FILTER:
+               return seccomp_next_filter(child, data);
+
        default:
                break;
        }

diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index afaeddf..1856f69 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c

@@ -26,6 +26,8 @@
 #endif

 #ifdef CONFIG_SECCOMP_FILTER
+#include <linux/bpf.h>
+#include <uapi/linux/bpf.h>
 #include <linux/filter.h>
 #include <linux/pid.h>
 #include <linux/ptrace.h>

@@ -807,6 +809,61 @@ static inline long seccomp_set_mode_filter(unsigned int flags,
 }
 #endif

+#if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
+long seccomp_get_filter_fd(struct task_struct *child)
+{
+       long fd;
+       struct seccomp_filter *filter;
+
+       if (!capable(CAP_SYS_ADMIN))
+               return -EACCES;
+
+       if (child->seccomp.mode != SECCOMP_MODE_FILTER)
+               return -EINVAL;
+
+       filter = child->seccomp.filter;
+
+       fd = bpf_new_fd(filter->prog, O_RDONLY);
+       if (fd > 0)
+               atomic_inc(&filter->prog->aux->refcnt);
+
+       return fd;
+}
+
+long seccomp_next_filter(struct task_struct *child, u32 fd)
+{
+       struct seccomp_filter *cur;
+       struct bpf_prog *prog;
+       long ret = -ESRCH;
+
+       if (!capable(CAP_SYS_ADMIN))
+               return -EACCES;
+
+       if (child->seccomp.mode != SECCOMP_MODE_FILTER)
+               return -EINVAL;
+
+       prog = bpf_prog_get(fd);
+       if (IS_ERR(prog)) {
+               ret = PTR_ERR(prog);
+               goto out;
+       }
+
+       for (cur = child->seccomp.filter; cur; cur = cur->prev) {
+               if (cur->prog == prog) {
+                       if (!cur->prev)
+                               ret = -ENOENT;
+                       else
+                               ret = bpf_prog_set(fd, cur->prev->prog);
+                       break;
+               }
+       }
+
+out:
+       bpf_prog_put(prog);
+       return ret;
+}
+#endif
+
 /* Common entry point for both prctl and syscall. */
 static long do_seccomp(unsigned int op, unsigned int flags,
                       const char __user *uargs)
--

2.1.4

--
To unsubscribe from this list: send the line "unsubscribe linux-api" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

v2: * don't allow seccomp eBPF programs to call any functions
    * get rid of superfluous seccomp_convert_ctx_access

Signed-off-by: Tycho Andersen <redacted>
CC: Kees Cook <redacted>
CC: Will Drewry <wad@chromium.org>
CC: Oleg Nesterov <oleg@redhat.com>
CC: Andy Lutomirski <luto@amacapital.net>
CC: Pavel Emelyanov <redacted>
CC: Serge E. Hallyn <redacted>
CC: Alexei Starovoitov <ast@kernel.org>
CC: Daniel Borkmann <daniel@iogearbox.net>
---
 include/uapi/linux/bpf.h |  1 +
 net/core/filter.c        | 31 +++++++++++++++++++++++++++++++
 2 files changed, 32 insertions(+)

diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 92a48e2..631cdee 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h

@@ -123,6 +123,7 @@ enum bpf_prog_type {
        BPF_PROG_TYPE_KPROBE,
        BPF_PROG_TYPE_SCHED_CLS,
        BPF_PROG_TYPE_SCHED_ACT,
+       BPF_PROG_TYPE_SECCOMP,
 };

 #define BPF_PSEUDO_MAP_FD      1

diff --git a/net/core/filter.c b/net/core/filter.c
index 13079f0..faaae67 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c

@@ -1612,6 +1612,15 @@ tc_cls_act_func_proto(enum bpf_func_id func_id)
        }
 }

+static const struct bpf_func_proto *
+seccomp_func_proto(enum bpf_func_id func_id)
+{
+       /* At some point in the future seccomp filters may grow support for
+        * eBPF functions. For now, these are disabled.
+        */
+       return NULL;
+}
+
 static bool __is_valid_access(int off, int size, enum bpf_access_type type)
 {
        /* check bounds */

@@ -1662,6 +1671,17 @@ static bool tc_cls_act_is_valid_access(int off, int size,
        return __is_valid_access(off, size, type);
 }

+static bool seccomp_is_valid_access(int off, int size,
+                                   enum bpf_access_type type)
+{
+       if (type == BPF_WRITE)
+               return false;
+
+       if (off < 0 || off >= sizeof(struct seccomp_data) || off & 3)
+               return false;
+
+       return true;
+}
 static u32 bpf_net_convert_ctx_access(enum bpf_access_type type, int dst_reg,
                                      int src_reg, int ctx_off,
                                      struct bpf_insn *insn_buf)

@@ -1795,6 +1815,11 @@ static const struct bpf_verifier_ops tc_cls_act_ops = {
        .convert_ctx_access = bpf_net_convert_ctx_access,
 };

+static const struct bpf_verifier_ops seccomp_ops = {
+       .get_func_proto = seccomp_func_proto,
+       .is_valid_access = seccomp_is_valid_access,
+};
+
 static struct bpf_prog_type_list sk_filter_type __read_mostly = {
        .ops = &sk_filter_ops,
        .type = BPF_PROG_TYPE_SOCKET_FILTER,

@@ -1810,11 +1835,17 @@ static struct bpf_prog_type_list sched_act_type __read_mostly = {
        .type = BPF_PROG_TYPE_SCHED_ACT,
 };

+static struct bpf_prog_type_list seccomp_type __read_mostly = {
+       .ops = &seccomp_ops,
+       .type = BPF_PROG_TYPE_SECCOMP,
+};
+
 static int __init register_sk_filter_ops(void)
 {
        bpf_register_prog_type(&sk_filter_type);
        bpf_register_prog_type(&sched_cls_type);
        bpf_register_prog_type(&sched_act_type);
+       bpf_register_prog_type(&seccomp_type);

        return 0;
 }
--

2.1.4

--
To unsubscribe from this list: send the line "unsubscribe linux-api" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Signed-off-by: Tycho Andersen <redacted>
CC: Kees Cook <redacted>
CC: Will Drewry <wad@chromium.org>
CC: Oleg Nesterov <oleg@redhat.com>
CC: Andy Lutomirski <luto@amacapital.net>
CC: Pavel Emelyanov <redacted>
CC: Serge E. Hallyn <redacted>
CC: Alexei Starovoitov <ast@kernel.org>
CC: Daniel Borkmann <daniel@iogearbox.net>
---
 include/uapi/linux/seccomp.h |  16 +++++
 kernel/seccomp.c             | 135 ++++++++++++++++++++++++++++++++++++++-----
 2 files changed, 138 insertions(+), 13 deletions(-)

diff --git a/include/uapi/linux/seccomp.h b/include/uapi/linux/seccomp.h
index 0f238a4..a8694e2 100644
--- a/include/uapi/linux/seccomp.h
+++ b/include/uapi/linux/seccomp.h

@@ -13,10 +13,14 @@
 /* Valid operations for seccomp syscall. */
 #define SECCOMP_SET_MODE_STRICT        0
 #define SECCOMP_SET_MODE_FILTER        1
+#define SECCOMP_MODE_FILTER_EBPF       2

 /* Valid flags for SECCOMP_SET_MODE_FILTER */
 #define SECCOMP_FILTER_FLAG_TSYNC      1

+/* Valid cmds for SECCOMP_MODE_FILTER_EBPF */
+#define SECCOMP_EBPF_ADD_FD    0
+
 /*
  * All BPF programs must return a 32-bit value.
  * The bottom 16-bits are for optional return data.

@@ -51,4 +55,16 @@ struct seccomp_data {
        __u64 args[6];
 };

+struct seccomp_ebpf {
+       unsigned int size;
+
+       union {
+               /* SECCOMP_EBPF_ADD_FD */
+               struct {
+                       unsigned int    add_flags;
+                       __u32           add_fd;
+               };
+       };
+};
+
 #endif /* _UAPI_LINUX_SECCOMP_H */

diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index 1856f69..e78175a 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c

@@ -65,6 +65,9 @@ struct seccomp_filter {
 /* Limit any path through the tree to 256KB worth of instructions. */
 #define MAX_INSNS_PER_PATH ((1 << 18) / sizeof(struct sock_filter))

+static long seccomp_install_filter(unsigned int flags,
+                                  struct seccomp_filter *prepared);
+
 /*
  * Endianness is explicitly ignored and left for BPF program authors to manage
  * as per the specific architecture.

@@ -356,17 +359,6 @@ static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog)

        BUG_ON(INT_MAX / fprog->len < sizeof(struct sock_filter));

-       /*
-        * Installing a seccomp filter requires that the task has
-        * CAP_SYS_ADMIN in its namespace or be running with no_new_privs.
-        * This avoids scenarios where unprivileged tasks can affect the
-        * behavior of privileged children.
-        */
-       if (!task_no_new_privs(current) &&
-           security_capable_noaudit(current_cred(), current_user_ns(),
-                                    CAP_SYS_ADMIN) != 0)
-               return ERR_PTR(-EACCES);
-
        /* Allocate a new seccomp_filter */
        sfilter = kzalloc(sizeof(*sfilter), GFP_KERNEL | __GFP_NOWARN);
        if (!sfilter)

@@ -510,8 +502,105 @@ static void seccomp_send_sigsys(int syscall, int reason)
        info.si_syscall = syscall;
        force_sig_info(SIGSYS, &info, current);
 }
+
 #endif /* CONFIG_SECCOMP_FILTER */

+#if defined(CONFIG_BPF_SYSCALL) && defined(CONFIG_SECCOMP_FILTER)
+static struct seccomp_filter *seccomp_prepare_ebpf(int fd)
+{
+       struct seccomp_filter *ret;
+       struct bpf_prog *prog;
+
+       prog = bpf_prog_get(fd);
+       if (IS_ERR(prog))
+               return (struct seccomp_filter *) prog;
+
+       if (prog->type != BPF_PROG_TYPE_SECCOMP) {
+               bpf_prog_put(prog);
+               return ERR_PTR(-EINVAL);
+       }
+
+       ret = kzalloc(sizeof(*ret), GFP_KERNEL | __GFP_NOWARN);
+       if (!ret) {
+               bpf_prog_put(prog);
+               return ERR_PTR(-ENOMEM);
+       }
+
+       ret->prog = prog;
+       atomic_set(&ret->usage, 1);
+
+       /* Intentionally don't bpf_prog_put() here, because the underlying prog
+        * is refcounted too and we're holding a reference from the struct
+        * seccomp_filter object.
+        */
+       return ret;
+}
+
+static long seccomp_ebpf_add_fd(struct seccomp_ebpf *ebpf)
+{
+       struct seccomp_filter *prepared;
+
+       prepared = seccomp_prepare_ebpf(ebpf->add_fd);
+       if (IS_ERR(prepared))
+               return PTR_ERR(prepared);
+
+       return seccomp_install_filter(ebpf->add_flags, prepared);
+}
+
+static long seccomp_mode_filter_ebpf(unsigned int cmd, const char __user *uargs)
+{
+       const struct seccomp_ebpf __user *uebpf;
+       struct seccomp_ebpf ebpf;
+       unsigned int size;
+       long ret = -EFAULT;
+
+       uebpf = (const struct seccomp_ebpf __user *) uargs;
+
+       if (get_user(size, &uebpf->size) != 0)
+               return -EFAULT;
+
+       /* If we're handed a bigger struct than we know of,
+        * ensure all the unknown bits are 0 - i.e. new
+        * user-space does not rely on any kernel feature
+        * extensions we dont know about yet.
+        */
+       if (size > sizeof(ebpf)) {
+               unsigned char __user *addr;
+               unsigned char __user *end;
+               unsigned char val;
+
+               addr = (void __user *)uebpf + sizeof(ebpf);
+               end  = (void __user *)uebpf + size;
+
+               for (; addr < end; addr++) {
+                       int err = get_user(val, addr);
+
+                       if (err)
+                               return err;
+                       if (val)
+                               return -E2BIG;
+               }
+               size = sizeof(ebpf);
+       }
+
+       if (copy_from_user(&ebpf, uebpf, size) != 0)
+               return -EFAULT;
+
+       switch (cmd) {
+       case SECCOMP_EBPF_ADD_FD:
+               ret = seccomp_ebpf_add_fd(&ebpf);
+               break;
+       }
+
+       return ret;
+}
+#else
+static long seccomp_mode_filter_ebpf(unsigned int cmd, const char __user *uargs)
+{
+       return -EINVAL;
+}
+#endif
+
 /*
  * Secure computing mode 1 allows only read/write/exit/sigreturn.
  * To be fully secure this must be combined with rlimit

@@ -760,9 +849,7 @@ out:
 static long seccomp_set_mode_filter(unsigned int flags,
                                    const char __user *filter)
 {
-       const unsigned long seccomp_mode = SECCOMP_MODE_FILTER;
        struct seccomp_filter *prepared = NULL;
-       long ret = -EINVAL;

        /* Validate flags. */
        if (flags & ~SECCOMP_FILTER_FLAG_MASK)

@@ -773,6 +860,26 @@ static long seccomp_set_mode_filter(unsigned int flags,
        if (IS_ERR(prepared))
                return PTR_ERR(prepared);

+       return seccomp_install_filter(flags, prepared);
+}
+
+static long seccomp_install_filter(unsigned int flags,
+                                  struct seccomp_filter *prepared)
+{
+       const unsigned long seccomp_mode = SECCOMP_MODE_FILTER;
+       long ret = -EINVAL;
+
+       /*
+        * Installing a seccomp filter requires that the task has
+        * CAP_SYS_ADMIN in its namespace or be running with no_new_privs.
+        * This avoids scenarios where unprivileged tasks can affect the
+        * behavior of privileged children.
+        */
+       if (!task_no_new_privs(current) &&
+           security_capable_noaudit(current_cred(), current_user_ns(),
+                                    CAP_SYS_ADMIN) != 0)
+               return -EACCES;
+
        /*
         * Make sure we cannot change seccomp or nnp state via TSYNC
         * while another thread is in the middle of calling exec.

@@ -875,6 +982,8 @@ static long do_seccomp(unsigned int op, unsigned int flags,
                return seccomp_set_mode_strict();
        case SECCOMP_SET_MODE_FILTER:
                return seccomp_set_mode_filter(flags, uargs);
+       case SECCOMP_MODE_FILTER_EBPF:
+               return seccomp_mode_filter_ebpf(flags, uargs);
        default:
                return -EINVAL;
        }
--

2.1.4

--
To unsubscribe from this list: send the line "unsubscribe linux-api" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html