History

ptrace,seccomp: Add PTRACE_SECCOMP support

This change adds support for a new ptrace option, PTRACE_O_TRACESECCOMP, and a new return value for seccomp BPF programs, SECCOMP_RET_TRACE. When a tracer specifies the PTRACE_O_TRACESECCOMP ptrace option, the tracer will be notified, via PTRACE_EVENT_SECCOMP, for any syscall that results in a BPF program returning SECCOMP_RET_TRACE. The 16-bit SECCOMP_RET_DATA mask of the BPF program return value will be passed as the ptrace_message and may be retrieved using PTRACE_GETEVENTMSG. If the subordinate process is not using seccomp filter, then no system call notifications will occur even if the option is specified. If there is no tracer with PTRACE_O_TRACESECCOMP when SECCOMP_RET_TRACE is returned, the system call will not be executed and an -ENOSYS errno will be returned to userspace. This change adds a dependency on the system call slow path. Any future efforts to use the system call fast path for seccomp filter will need to address this restriction. Signed-off-by: Will Drewry <wad@chromium.org> Acked-by: Eric Paris <eparis@redhat.com>

Will Drewry committed 14 years ago

Commit fb0fadf1 parent bb6ea434 files · +26 −6Browse files

Unified · Split

4 files
  1. arch/Kconfig +5 −5
  2. include/linux/ptrace.h +4 −1
  3. include/linux/seccomp.h +1 −0
  4. kernel/seccomp.c +16 −0
arch/Kconfig+5−5
@@ -219,15 +219,15 @@ config ARCH_WANT_OLD_COMPAT_IPC · 218 unmodified lines
219config HAVE_ARCH_SECCOMP_FILTER219config HAVE_ARCH_SECCOMP_FILTER
220 bool220 bool
221 help221 help
222 This symbol should be selected by an architecure if it provides:222 An arch should select this symbol if it provides all of these things:
223 asm/syscall.h:
224 - syscall_get_arch()223 - syscall_get_arch()
225 - syscall_get_arguments()224 - syscall_get_arguments()
226 - syscall_rollback()225 - syscall_rollback()
227 - syscall_set_return_value()226 - syscall_set_return_value()
228 SIGSYS siginfo_t support must be implemented.227 - SIGSYS siginfo_t support
229 __secure_computing()/secure_computing()'s return value must be228 - secure_computing is called from a ptrace_event()-safe context
230 checked, with -1 resulting in the syscall being skipped.229 - secure_computing return value is checked and a return value of -1
230 results in the system call being skipped immediately.
231 231
232config SECCOMP_FILTER232config SECCOMP_FILTER
233 def_bool y233 def_bool y
include/linux/ptrace.h+4−1
@@ -58,6 +58,7 @@ · 57 unmodified lines
58#define PTRACE_EVENT_EXEC 458#define PTRACE_EVENT_EXEC 4
59#define PTRACE_EVENT_VFORK_DONE 559#define PTRACE_EVENT_VFORK_DONE 5
60#define PTRACE_EVENT_EXIT 660#define PTRACE_EVENT_EXIT 6
61#define PTRACE_EVENT_SECCOMP 7
61/* Extended result codes which enabled by means other than options. */62/* Extended result codes which enabled by means other than options. */
62#define PTRACE_EVENT_STOP 12863#define PTRACE_EVENT_STOP 128
63 64
@@ -69,8 +70,9 @@ · 5 unmodified lines
69#define PTRACE_O_TRACEEXEC (1 << PTRACE_EVENT_EXEC)70#define PTRACE_O_TRACEEXEC (1 << PTRACE_EVENT_EXEC)
70#define PTRACE_O_TRACEVFORKDONE (1 << PTRACE_EVENT_VFORK_DONE)71#define PTRACE_O_TRACEVFORKDONE (1 << PTRACE_EVENT_VFORK_DONE)
71#define PTRACE_O_TRACEEXIT (1 << PTRACE_EVENT_EXIT)72#define PTRACE_O_TRACEEXIT (1 << PTRACE_EVENT_EXIT)
73#define PTRACE_O_TRACESECCOMP (1 << PTRACE_EVENT_SECCOMP)
72 74
73#define PTRACE_O_MASK 0x0000007f75#define PTRACE_O_MASK 0x000000ff
74 76
75#include <asm/ptrace.h>77#include <asm/ptrace.h>
76 78
@@ -98,6 +100,7 @@ · 21 unmodified lines
98#define PT_TRACE_EXEC PT_EVENT_FLAG(PTRACE_EVENT_EXEC)100#define PT_TRACE_EXEC PT_EVENT_FLAG(PTRACE_EVENT_EXEC)
99#define PT_TRACE_VFORK_DONE PT_EVENT_FLAG(PTRACE_EVENT_VFORK_DONE)101#define PT_TRACE_VFORK_DONE PT_EVENT_FLAG(PTRACE_EVENT_VFORK_DONE)
100#define PT_TRACE_EXIT PT_EVENT_FLAG(PTRACE_EVENT_EXIT)102#define PT_TRACE_EXIT PT_EVENT_FLAG(PTRACE_EVENT_EXIT)
103#define PT_TRACE_SECCOMP PT_EVENT_FLAG(PTRACE_EVENT_SECCOMP)
101 104
102/* single stepping state bits (used on ARM and PA-RISC) */105/* single stepping state bits (used on ARM and PA-RISC) */
103#define PT_SINGLESTEP_BIT 31106#define PT_SINGLESTEP_BIT 31
include/linux/seccomp.h+1−0
@@ -21,6 +21,7 @@ · 20 unmodified lines
21#define SECCOMP_RET_KILL 0x00000000U /* kill the task immediately */21#define SECCOMP_RET_KILL 0x00000000U /* kill the task immediately */
22#define SECCOMP_RET_TRAP 0x00030000U /* disallow and force a SIGSYS */22#define SECCOMP_RET_TRAP 0x00030000U /* disallow and force a SIGSYS */
23#define SECCOMP_RET_ERRNO 0x00050000U /* returns an errno */23#define SECCOMP_RET_ERRNO 0x00050000U /* returns an errno */
24#define SECCOMP_RET_TRACE 0x7ff00000U /* pass to a tracer or disallow */
24#define SECCOMP_RET_ALLOW 0x7fff0000U /* allow */25#define SECCOMP_RET_ALLOW 0x7fff0000U /* allow */
25 26
26/* Masks for the return value sections. */27/* Masks for the return value sections. */
kernel/seccomp.c+16−0
@@ -24,6 +24,7 @@ · 23 unmodified lines
24#ifdef CONFIG_SECCOMP_FILTER24#ifdef CONFIG_SECCOMP_FILTER
25#include <asm/syscall.h>25#include <asm/syscall.h>
26#include <linux/filter.h>26#include <linux/filter.h>
27#include <linux/ptrace.h>
27#include <linux/security.h>28#include <linux/security.h>
28#include <linux/slab.h>29#include <linux/slab.h>
29#include <linux/tracehook.h>30#include <linux/tracehook.h>
@@ -408,6 +409,21 @@ int __secure_computing(int this_syscall) · 378 unmodified lines
408 /* Let the filter pass back 16 bits of data. */409 /* Let the filter pass back 16 bits of data. */
409 seccomp_send_sigsys(this_syscall, data);410 seccomp_send_sigsys(this_syscall, data);
410 goto skip;411 goto skip;
412 case SECCOMP_RET_TRACE:
413 /* Skip these calls if there is no tracer. */
414 if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP))
415 goto skip;
416 /* Allow the BPF to provide the event message */
417 ptrace_event(PTRACE_EVENT_SECCOMP, data);
418 /*
419 * The delivery of a fatal signal during event
420 * notification may silently skip tracer notification.
421 * Terminating the task now avoids executing a system
422 * call that may not be intended.
423 */
424 if (fatal_signal_pending(current))
425 break;
426 return 0;
411 case SECCOMP_RET_ALLOW:427 case SECCOMP_RET_ALLOW:
412 return 0;428 return 0;
413 case SECCOMP_RET_KILL:429 case SECCOMP_RET_KILL: