shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-08 20:07:46 +09:00
Code Issues Packages Projects Releases Wiki Activity

seccomp: allow mode setting across threads

Browse Source 
This changes the mode setting helper to allow threads to change the
seccomp mode from another thread. We must maintain barriers to keep
TIF_SECCOMP synchronized with the rest of the seccomp state.

Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: Andy Lutomirski <luto@amacapital.net>

Conflicts:
	kernel/seccomp.c

Change-Id: I091ffa55d8f4e83ff02558a55e2b4dc76ac26905
This commit is contained in:
Kees Cook
2014-06-27 15:01:35 -07:00
committed by JP Abgrall
parent 743266ae25
commit d924727911
1 changed files with 30 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
kernel/seccomp.c
View File

@@ -202,19 +202,26 @@ static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen)
*/ */
static u32 seccomp_run_filters(int syscall) static u32 seccomp_run_filters(int syscall)
{ {
struct seccomp_filter *f; struct seccomp_filter *f = ACCESS_ONCE(current->seccomp.filter);
struct seccomp_data sd;
u32 ret = SECCOMP_RET_ALLOW; u32 ret = SECCOMP_RET_ALLOW;
/* Ensure unexpected behavior doesn't result in failing open. */ /* Ensure unexpected behavior doesn't result in failing open. */
if (WARN_ON(current->seccomp.filter == NULL)) if (unlikely(WARN_ON(f == NULL)))
return SECCOMP_RET_KILL; return SECCOMP_RET_KILL;
/* Make sure cross-thread synced filter points somewhere sane. */
smp_read_barrier_depends();
populate_seccomp_data(&sd);
/* /*
* All filters in the list are evaluated and the lowest BPF return * All filters in the list are evaluated and the lowest BPF return
* value always takes priority (ignoring the DATA). * value always takes priority (ignoring the DATA).
*/ */
for (f = current->seccomp.filter; f; f = f->prev) { for (; f; f = f->prev) {
u32 cur_ret = sk_run_filter(NULL, f->insns); u32 cur_ret = SK_RUN_FILTER(f->prog, (void *)&sd);
if ((cur_ret & SECCOMP_RET_ACTION) < (ret & SECCOMP_RET_ACTION)) if ((cur_ret & SECCOMP_RET_ACTION) < (ret & SECCOMP_RET_ACTION))
ret = cur_ret; ret = cur_ret;
} }
@@ -232,12 +239,18 @@ static inline bool seccomp_may_assign_mode(unsigned long seccomp_mode)
return true; return true;
} }
static inline void seccomp_assign_mode(unsigned long seccomp_mode) static inline void seccomp_assign_mode(struct task_struct *task,
unsigned long seccomp_mode)
{ {
BUG_ON(!spin_is_locked(&current->sighand->siglock)); BUG_ON(!spin_is_locked(&task->sighand->siglock));
current->seccomp.mode = seccomp_mode; task->seccomp.mode = seccomp_mode;
set_tsk_thread_flag(current, TIF_SECCOMP); /*
* Make sure TIF_SECCOMP cannot be set before the mode (and
* filter) is set.
*/
smp_mb__before_atomic();
set_tsk_thread_flag(task, TIF_SECCOMP);
} }
#ifdef CONFIG_SECCOMP_FILTER #ifdef CONFIG_SECCOMP_FILTER
@@ -449,12 +462,17 @@ static int mode1_syscalls_32[] = {
int __secure_computing(int this_syscall) int __secure_computing(int this_syscall)
{ {
int mode = current->seccomp.mode;
int exit_sig = 0; int exit_sig = 0;
int *syscall; int *syscall;
u32 ret; u32 ret;
switch (mode) { /*
* Make sure that any changes to mode from another thread have
* been seen after TIF_SECCOMP was seen.
*/
rmb();
switch (current->seccomp.mode) {
case SECCOMP_MODE_STRICT: case SECCOMP_MODE_STRICT:
syscall = mode1_syscalls; syscall = mode1_syscalls;
#ifdef CONFIG_COMPAT #ifdef CONFIG_COMPAT
@@ -559,7 +577,7 @@ static long seccomp_set_mode_strict(void)
#ifdef TIF_NOTSC #ifdef TIF_NOTSC
disable_TSC(); disable_TSC();
#endif #endif
seccomp_assign_mode(seccomp_mode); seccomp_assign_mode(current, seccomp_mode);
ret = 0; ret = 0;
out: out:
@@ -609,7 +627,7 @@ static long seccomp_set_mode_filter(unsigned int flags,
/* Do not free the successfully attached filter. */ /* Do not free the successfully attached filter. */
prepared = NULL; prepared = NULL;
seccomp_assign_mode(seccomp_mode); seccomp_assign_mode(current, seccomp_mode);
out: out:
spin_unlock_irq(&current->sighand->siglock); spin_unlock_irq(&current->sighand->siglock);
seccomp_filter_free(prepared); seccomp_filter_free(prepared);