Re: [PATCH 3/6] seccomp: Implement constant action bitmaps

In order to build this mapping at filter attach time, each filter is
executed for every syscall (under each possible architecture), and
checked for any accesses of struct seccomp_data that are not the "arch"
nor "nr" (syscall) members. If only "arch" and "nr" are examined, then
there is a constant mapping for that syscall, and bitmaps can be updated
accordingly. If any accesses happen outside of those struct members,
seccomp must not bypass filter execution for that syscall, since program
state will be used to determine filter action result. (This logic comes
in the next patch.)

[1] https://lore.kernel.org/bpf/20200531171915.wsxvdjeetmhpsdv2@ast-mbp.dhcp.thefacebook.com/ (local)
[2] https://lore.kernel.org/bpf/20200601101137.GA121847@gardel-login/ (local)
[3] https://lore.kernel.org/bpf/717a06e7f35740ccb4c70470ec70fb2f@huawei.com/ (local)

Signed-off-by: Kees Cook <redacted>
---
 include/linux/seccomp.h |  18 ++++
 kernel/seccomp.c        | 207 +++++++++++++++++++++++++++++++++++++++-
 2 files changed, 221 insertions(+), 4 deletions(-)

diff --git a/include/linux/seccomp.h b/include/linux/seccomp.h
index 0be20bc81ea9..96df2f899e3d 100644
--- a/include/linux/seccomp.h
+++ b/include/linux/seccomp.h

@@ -25,6 +25,17 @@
 #define SECCOMP_ARCH_IS_MULTIPLEX      3
 #define SECCOMP_ARCH_IS_UNKNOWN                0xff

+/* When no bits are set for a syscall, filters are run. */
+struct seccomp_bitmaps {
+#ifdef SECCOMP_ARCH
+       /* "allow" are initialized to set and only ever get cleared. */
+       DECLARE_BITMAP(allow, NR_syscalls);

+#endif
+};
+
 struct seccomp_filter;
 /**
  * struct seccomp - the state of a seccomp'ed process

@@ -45,6 +56,13 @@ struct seccomp {
 #endif
        atomic_t filter_count;
        struct seccomp_filter *filter;
+       struct seccomp_bitmaps native;
+#ifdef CONFIG_COMPAT
+       struct seccomp_bitmaps compat;
+#endif
+#ifdef SECCOMP_MULTIPLEXED_SYSCALL_TABLE_ARCH
+       struct seccomp_bitmaps multiplex;
+#endif

 };

 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER

diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index 0a3ff8eb8aea..111a238bc532 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c

@@ -318,7 +318,7 @@ static inline u8 seccomp_get_arch(u32 syscall_arch, u32 syscall_nr)

 #ifdef SECCOMP_MULTIPLEXED_SYSCALL_TABLE_ARCH
        if (syscall_arch == SECCOMP_MULTIPLEXED_SYSCALL_TABLE_ARCH) {
-               seccomp_arch |= (sd->nr & SECCOMP_MULTIPLEXED_SYSCALL_TABLE_MASK) >>
+               seccomp_arch |= (syscall_nr & SECCOMP_MULTIPLEXED_SYSCALL_TABLE_MASK) >>
                                SECCOMP_MULTIPLEXED_SYSCALL_TABLE_SHIFT;

        }
 #endif

@@ -559,6 +559,21 @@ static inline void seccomp_sync_threads(unsigned long flags)
                atomic_set(&thread->seccomp.filter_count,
                           atomic_read(&thread->seccomp.filter_count));

+               /* Copy syscall filter bitmaps. */
+               memcpy(&thread->seccomp.native,
+                      &caller->seccomp.native,
+                      sizeof(caller->seccomp.native));
+#ifdef CONFIG_COMPAT
+               memcpy(&thread->seccomp.compat,
+                      &caller->seccomp.compat,
+                      sizeof(caller->seccomp.compat));
+#endif
+#ifdef SECCOMP_MULTIPLEXED_SYSCALL_TABLE_ARCH
+               memcpy(&thread->seccomp.multiplex,
+                      &caller->seccomp.multiplex,
+                      sizeof(caller->seccomp.multiplex));
+#endif

                /*
                 * Don't let an unprivileged task work around
                 * the no_new_privs restriction by creating

@@ -661,6 +676,114 @@ seccomp_prepare_user_filter(const char __user *user_filter)
        return filter;
 }

+static inline bool sd_touched(pte_t *ptep)
+{
+       return !!pte_young(*(READ_ONCE(ptep)));
+}

@@ -970,6 +1097,65 @@ static int seccomp_do_user_notification(int this_syscall,
        return -1;
 }

+#ifdef SECCOMP_ARCH
+static inline bool __bypass_filter(struct seccomp_bitmaps *bitmaps,
+                                  u32 nr, u32 *filter_ret)
+{
+       if (nr < NR_syscalls) {
+               if (test_bit(nr, bitmaps->allow)) {
+                       *filter_ret = SECCOMP_RET_ALLOW;
+                       return true;
+               }
+               if (test_bit(nr, bitmaps->kill_process)) {
+                       *filter_ret = SECCOMP_RET_KILL_PROCESS;
+                       return true;
+               }
+               if (test_bit(nr, bitmaps->kill_thread)) {
+                       *filter_ret = SECCOMP_RET_KILL_THREAD;
+                       return true;
+               }

@@ -1625,12 +1812,24 @@ static long seccomp_set_mode_filter(unsigned int flags,
            mutex_lock_killable(&current->signal->cred_guard_mutex))
                goto out_put_fd;

+       /*
+        * This memory will be needed for bitmap testing, but we'll
+        * be holding a spinlock at that point. Do the allocation
+        * (and free) outside of the lock.
+        *
+        * Alternative: we could do the bitmap update before attach
+        * to avoid spending too much time under lock.
+        */
+       pagepair = vzalloc(PAGE_SIZE * 2);
+       if (!pagepair)
+               goto out_put_fd;
+