updates for seccomp
- allow TSYNC and USER_NOTIF together (Tycho Andersen) - Add missing compat_ioctl for notify (Sven Schnelle) -----BEGIN PGP SIGNATURE----- iQJKBAABCgA0FiEEpcP2jyKd1g9yPm4TiXL039xtwCYFAl6BcbwWHGtlZXNjb29r QGNocm9taXVtLm9yZwAKCRCJcvTf3G3AJuhfD/9NjC6h+l9YNHW2O3bYPxDDjkJq 1aRInf+/UayTnfwhlZiJj2FFYyPR1gfZXB9CPcniYO/t6tsCdc+0kQdc3uUCPb0y ClPp5Pc/u/SwEFgrj5gv/NsEwAVaTPy1ioagefZMENQXj77XcfifF5Mrave+lR3K TiZsFItucIRTiEb8YY4xF/t5rn/lBvAqDiYNZwYYVcopnW3kgvOljz6ZRyOstV/B J9QrErFfDH9SzPfK/1bZ5GbCUsTRzbGXA281UBhZdkJQaA3yoqK+yv/xKtoaX0WK uxLPt2BG3qb21+8JZacJ2L6KQAwm5EdT+OyLyFzUYki23LsJNHEb+UpkoRnyJg5H sSSZRj14WH5aK1REGTDLr5tgx5lxkXx/iuxYc4tuM56ToWS4hXNiQFU2cUcdqjSO bSKVg1LO9FfTTMecYXUqljoOwAKMVra2nDNCpvkBr/1JMVFZjCfWpjy3ZvHHwpqt BpxgfJW250HfnMWpa7k5p6bIP+WMwetwP1yGZx6xNz8j3ZSshIPUqCvTU6zD89CN RXHMfnZOxNtq1biI41Ppc5/kCt2t4598BaGsWIWcjhhY8p5Ttq+HGs3tOPsuUXen ccGAa/1Co0u5CCxudG4nZ2a/ooeijMx7D5HfvoYvHDQbugR/x4aSZuiw7JiTKBHr EZCFZyxvFVqnqlzQ2Q== =Ejyd -----END PGP SIGNATURE----- Merge tag 'seccomp-v5.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull seccomp updates from Kees Cook: "A couple of seccomp updates. They're both mostly bug fixes that I wanted to have sit in linux-next for a while: - allow TSYNC and USER_NOTIF together (Tycho Andersen) - add missing compat_ioctl for notify (Sven Schnelle)" * tag 'seccomp-v5.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: seccomp: Add missing compat_ioctl for notify seccomp: allow TSYNC and USER_NOTIF together
This commit is contained in:
commit
78b0dedd52
|
@ -7,7 +7,8 @@
|
|||
#define SECCOMP_FILTER_FLAG_MASK (SECCOMP_FILTER_FLAG_TSYNC | \
|
||||
SECCOMP_FILTER_FLAG_LOG | \
|
||||
SECCOMP_FILTER_FLAG_SPEC_ALLOW | \
|
||||
SECCOMP_FILTER_FLAG_NEW_LISTENER)
|
||||
SECCOMP_FILTER_FLAG_NEW_LISTENER | \
|
||||
SECCOMP_FILTER_FLAG_TSYNC_ESRCH)
|
||||
|
||||
#ifdef CONFIG_SECCOMP
|
||||
|
||||
|
|
|
@ -22,6 +22,7 @@
|
|||
#define SECCOMP_FILTER_FLAG_LOG (1UL << 1)
|
||||
#define SECCOMP_FILTER_FLAG_SPEC_ALLOW (1UL << 2)
|
||||
#define SECCOMP_FILTER_FLAG_NEW_LISTENER (1UL << 3)
|
||||
#define SECCOMP_FILTER_FLAG_TSYNC_ESRCH (1UL << 4)
|
||||
|
||||
/*
|
||||
* All BPF programs must return a 32-bit value.
|
||||
|
|
|
@ -528,8 +528,12 @@ static long seccomp_attach_filter(unsigned int flags,
|
|||
int ret;
|
||||
|
||||
ret = seccomp_can_sync_threads();
|
||||
if (ret)
|
||||
return ret;
|
||||
if (ret) {
|
||||
if (flags & SECCOMP_FILTER_FLAG_TSYNC_ESRCH)
|
||||
return -ESRCH;
|
||||
else
|
||||
return ret;
|
||||
}
|
||||
}
|
||||
|
||||
/* Set log flag, if present. */
|
||||
|
@ -1221,6 +1225,7 @@ static const struct file_operations seccomp_notify_ops = {
|
|||
.poll = seccomp_notify_poll,
|
||||
.release = seccomp_notify_release,
|
||||
.unlocked_ioctl = seccomp_notify_ioctl,
|
||||
.compat_ioctl = seccomp_notify_ioctl,
|
||||
};
|
||||
|
||||
static struct file *init_listener(struct seccomp_filter *filter)
|
||||
|
@ -1288,10 +1293,12 @@ static long seccomp_set_mode_filter(unsigned int flags,
|
|||
* In the successful case, NEW_LISTENER returns the new listener fd.
|
||||
* But in the failure case, TSYNC returns the thread that died. If you
|
||||
* combine these two flags, there's no way to tell whether something
|
||||
* succeeded or failed. So, let's disallow this combination.
|
||||
* succeeded or failed. So, let's disallow this combination if the user
|
||||
* has not explicitly requested no errors from TSYNC.
|
||||
*/
|
||||
if ((flags & SECCOMP_FILTER_FLAG_TSYNC) &&
|
||||
(flags & SECCOMP_FILTER_FLAG_NEW_LISTENER))
|
||||
(flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) &&
|
||||
((flags & SECCOMP_FILTER_FLAG_TSYNC_ESRCH) == 0))
|
||||
return -EINVAL;
|
||||
|
||||
/* Prepare the new filter before holding any locks. */
|
||||
|
|
|
@ -212,6 +212,10 @@ struct seccomp_notif_sizes {
|
|||
#define SECCOMP_USER_NOTIF_FLAG_CONTINUE 0x00000001
|
||||
#endif
|
||||
|
||||
#ifndef SECCOMP_FILTER_FLAG_TSYNC_ESRCH
|
||||
#define SECCOMP_FILTER_FLAG_TSYNC_ESRCH (1UL << 4)
|
||||
#endif
|
||||
|
||||
#ifndef seccomp
|
||||
int seccomp(unsigned int op, unsigned int flags, void *args)
|
||||
{
|
||||
|
@ -2187,7 +2191,8 @@ TEST(detect_seccomp_filter_flags)
|
|||
unsigned int flags[] = { SECCOMP_FILTER_FLAG_TSYNC,
|
||||
SECCOMP_FILTER_FLAG_LOG,
|
||||
SECCOMP_FILTER_FLAG_SPEC_ALLOW,
|
||||
SECCOMP_FILTER_FLAG_NEW_LISTENER };
|
||||
SECCOMP_FILTER_FLAG_NEW_LISTENER,
|
||||
SECCOMP_FILTER_FLAG_TSYNC_ESRCH };
|
||||
unsigned int exclusive[] = {
|
||||
SECCOMP_FILTER_FLAG_TSYNC,
|
||||
SECCOMP_FILTER_FLAG_NEW_LISTENER };
|
||||
|
@ -2645,6 +2650,55 @@ TEST_F(TSYNC, two_siblings_with_one_divergence)
|
|||
EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status);
|
||||
}
|
||||
|
||||
TEST_F(TSYNC, two_siblings_with_one_divergence_no_tid_in_err)
|
||||
{
|
||||
long ret, flags;
|
||||
void *status;
|
||||
|
||||
ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
|
||||
TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
|
||||
}
|
||||
|
||||
ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog);
|
||||
ASSERT_NE(ENOSYS, errno) {
|
||||
TH_LOG("Kernel does not support seccomp syscall!");
|
||||
}
|
||||
ASSERT_EQ(0, ret) {
|
||||
TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER!");
|
||||
}
|
||||
self->sibling[0].diverge = 1;
|
||||
tsync_start_sibling(&self->sibling[0]);
|
||||
tsync_start_sibling(&self->sibling[1]);
|
||||
|
||||
while (self->sibling_count < TSYNC_SIBLINGS) {
|
||||
sem_wait(&self->started);
|
||||
self->sibling_count++;
|
||||
}
|
||||
|
||||
flags = SECCOMP_FILTER_FLAG_TSYNC | \
|
||||
SECCOMP_FILTER_FLAG_TSYNC_ESRCH;
|
||||
ret = seccomp(SECCOMP_SET_MODE_FILTER, flags, &self->apply_prog);
|
||||
ASSERT_EQ(ESRCH, errno) {
|
||||
TH_LOG("Did not return ESRCH for diverged sibling.");
|
||||
}
|
||||
ASSERT_EQ(-1, ret) {
|
||||
TH_LOG("Did not fail on diverged sibling.");
|
||||
}
|
||||
|
||||
/* Wake the threads */
|
||||
pthread_mutex_lock(&self->mutex);
|
||||
ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
|
||||
TH_LOG("cond broadcast non-zero");
|
||||
}
|
||||
pthread_mutex_unlock(&self->mutex);
|
||||
|
||||
/* Ensure they are both unkilled. */
|
||||
PTHREAD_JOIN(self->sibling[0].tid, &status);
|
||||
EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status);
|
||||
PTHREAD_JOIN(self->sibling[1].tid, &status);
|
||||
EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status);
|
||||
}
|
||||
|
||||
TEST_F(TSYNC, two_siblings_not_under_filter)
|
||||
{
|
||||
long ret, sib;
|
||||
|
@ -3196,6 +3250,24 @@ TEST(user_notification_basic)
|
|||
EXPECT_EQ(0, WEXITSTATUS(status));
|
||||
}
|
||||
|
||||
TEST(user_notification_with_tsync)
|
||||
{
|
||||
int ret;
|
||||
unsigned int flags;
|
||||
|
||||
/* these were exclusive */
|
||||
flags = SECCOMP_FILTER_FLAG_NEW_LISTENER |
|
||||
SECCOMP_FILTER_FLAG_TSYNC;
|
||||
ASSERT_EQ(-1, user_trap_syscall(__NR_getppid, flags));
|
||||
ASSERT_EQ(EINVAL, errno);
|
||||
|
||||
/* but now they're not */
|
||||
flags |= SECCOMP_FILTER_FLAG_TSYNC_ESRCH;
|
||||
ret = user_trap_syscall(__NR_getppid, flags);
|
||||
close(ret);
|
||||
ASSERT_LE(0, ret);
|
||||
}
|
||||
|
||||
TEST(user_notification_kill_in_middle)
|
||||
{
|
||||
pid_t pid;
|
||||
|
|
Loading…
Reference in a new issue