This change adds support for a new ptrace option, PTRACE_O_TRACESECCOMP, and a new return value for seccomp BPF programs, SECCOMP_RET_TRACE. When a tracer specifies the PTRACE_O_TRACESECCOMP ptrace option, the tracer will be notified, via PTRACE_EVENT_SECCOMP, for any syscall that results in a BPF program returning SECCOMP_RET_TRACE. The 16-bit SECCOMP_RET_DATA mask of the BPF program return value will be passed as the ptrace_message and may be retrieved using PTRACE_GETEVENTMSG. If the subordinate process is not using seccomp filter, then no system call notifications will occur even if the option is specified. If there is no tracer with PTRACE_O_TRACESECCOMP when SECCOMP_RET_TRACE is returned, the system call will not be executed and an -ENOSYS errno will be returned to userspace. This change adds a dependency on the system call slow path. Any future efforts to use the system call fast path for seccomp filter will need to address this restriction. Signed-off-by: Will Drewry <wad@chromium.org> Acked-by: Eric Paris <eparis@redhat.com>
Showing the changes to kernel (1 of 4 files). Show all
Unified · Split
| @@ -24,6 +24,7 @@ · 23 unmodified lines | |||
| 24 | #ifdef CONFIG_SECCOMP_FILTER | 24 | #ifdef CONFIG_SECCOMP_FILTER |
| 25 | #include <asm/syscall.h> | 25 | #include <asm/syscall.h> |
| 26 | #include <linux/filter.h> | 26 | #include <linux/filter.h> |
| 27 | #include <linux/ptrace.h> | ||
| 27 | #include <linux/security.h> | 28 | #include <linux/security.h> |
| 28 | #include <linux/slab.h> | 29 | #include <linux/slab.h> |
| 29 | #include <linux/tracehook.h> | 30 | #include <linux/tracehook.h> |
| @@ -408,6 +409,21 @@ int __secure_computing(int this_syscall) · 378 unmodified lines | |||
| 408 | /* Let the filter pass back 16 bits of data. */ | 409 | /* Let the filter pass back 16 bits of data. */ |
| 409 | seccomp_send_sigsys(this_syscall, data); | 410 | seccomp_send_sigsys(this_syscall, data); |
| 410 | goto skip; | 411 | goto skip; |
| 412 | case SECCOMP_RET_TRACE: | ||
| 413 | /* Skip these calls if there is no tracer. */ | ||
| 414 | if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP)) | ||
| 415 | goto skip; | ||
| 416 | /* Allow the BPF to provide the event message */ | ||
| 417 | ptrace_event(PTRACE_EVENT_SECCOMP, data); | ||
| 418 | /* | ||
| 419 | * The delivery of a fatal signal during event | ||
| 420 | * notification may silently skip tracer notification. | ||
| 421 | * Terminating the task now avoids executing a system | ||
| 422 | * call that may not be intended. | ||
| 423 | */ | ||
| 424 | if (fatal_signal_pending(current)) | ||
| 425 | break; | ||
| 426 | return 0; | ||
| 411 | case SECCOMP_RET_ALLOW: | 427 | case SECCOMP_RET_ALLOW: |
| 412 | return 0; | 428 | return 0; |
| 413 | case SECCOMP_RET_KILL: | 429 | case SECCOMP_RET_KILL: |