History

seccomp: Report number of loaded filters in /proc/$pid/status

A common question asked when debugging seccomp filters is "how many filters are attached to your process?" Provide a way to easily answer this question through /proc/$pid/status with a "Seccomp_filters" line.

Kees Cook committed 6 years ago

Commit c818c031 parent e4d05024 files · +10 −0Browse files

Unified · Split

4 files
  1. fs/proc/array.c +2 −0
  2. include/linux/seccomp.h +2 −0
  3. init/init_task.c +3 −0
  4. kernel/seccomp.c +3 −0
fs/proc/array.c+2−0
@@ -341,6 +341,8 @@ static inline void task_seccomp(struct seq_file *m, struct task_struct *p) · 340 unmodified lines
341 seq_put_decimal_ull(m, "NoNewPrivs:\t", task_no_new_privs(p));341 seq_put_decimal_ull(m, "NoNewPrivs:\t", task_no_new_privs(p));
342#ifdef CONFIG_SECCOMP342#ifdef CONFIG_SECCOMP
343 seq_put_decimal_ull(m, "\nSeccomp:\t", p->seccomp.mode);343 seq_put_decimal_ull(m, "\nSeccomp:\t", p->seccomp.mode);
344 seq_put_decimal_ull(m, "\nSeccomp_filters:\t",
345 atomic_read(&p->seccomp.filter_count));
344#endif346#endif
345 seq_puts(m, "\nSpeculation_Store_Bypass:\t");347 seq_puts(m, "\nSpeculation_Store_Bypass:\t");
346 switch (arch_prctl_spec_ctrl_get(p, PR_SPEC_STORE_BYPASS)) {348 switch (arch_prctl_spec_ctrl_get(p, PR_SPEC_STORE_BYPASS)) {
include/linux/seccomp.h+2−0
@@ -13,6 +13,7 @@ · 12 unmodified lines
13#ifdef CONFIG_SECCOMP13#ifdef CONFIG_SECCOMP
14 14
15#include <linux/thread_info.h>15#include <linux/thread_info.h>
16#include <linux/atomic.h>
16#include <asm/seccomp.h>17#include <asm/seccomp.h>
17 18
18struct seccomp_filter;19struct seccomp_filter;
@@ -29,6 +30,7 @@ struct seccomp_filter; · 10 unmodified lines
29 */30 */
30struct seccomp {31struct seccomp {
31 int mode;32 int mode;
33 atomic_t filter_count;
32 struct seccomp_filter *filter;34 struct seccomp_filter *filter;
33};35};
34 36
init/init_task.c+3−0
@@ -204,6 +204,9 @@ struct task_struct init_task · 203 unmodified lines
204#ifdef CONFIG_SECURITY204#ifdef CONFIG_SECURITY
205 .security = NULL,205 .security = NULL,
206#endif206#endif
207#ifdef CONFIG_SECCOMP
208 .seccomp = { .filter_count = ATOMIC_INIT(0) },
209#endif
207};210};
208EXPORT_SYMBOL(init_task);211EXPORT_SYMBOL(init_task);
209 212
kernel/seccomp.c+3−0
@@ -398,6 +398,8 @@ static inline void seccomp_sync_threads(unsigned long flags) · 397 unmodified lines
398 put_seccomp_filter(thread);398 put_seccomp_filter(thread);
399 smp_store_release(&thread->seccomp.filter,399 smp_store_release(&thread->seccomp.filter,
400 caller->seccomp.filter);400 caller->seccomp.filter);
401 atomic_set(&thread->seccomp.filter_count,
402 atomic_read(&thread->seccomp.filter_count));
401 403
402 /*404 /*
403 * Don't let an unprivileged task work around405 * Don't let an unprivileged task work around
@@ -544,6 +546,7 @@ static long seccomp_attach_filter(unsigned int flags, · 140 unmodified lines
544 */546 */
545 filter->prev = current->seccomp.filter;547 filter->prev = current->seccomp.filter;
546 current->seccomp.filter = filter;548 current->seccomp.filter = filter;
549 atomic_inc(&current->seccomp.filter_count);
547 550
548 /* Now that the new filter is in place, synchronize to all threads. */551 /* Now that the new filter is in place, synchronize to all threads. */
549 if (flags & SECCOMP_FILTER_FLAG_TSYNC)552 if (flags & SECCOMP_FILTER_FLAG_TSYNC)