This change adds support for a new ptrace option, PTRACE_O_TRACESECCOMP, and a new return value for seccomp BPF programs, SECCOMP_RET_TRACE. When a tracer specifies the PTRACE_O_TRACESECCOMP ptrace option, the tracer will be notified, via PTRACE_EVENT_SECCOMP, for any syscall that results in a BPF program returning SECCOMP_RET_TRACE. The 16-bit SECCOMP_RET_DATA mask of the BPF program return value will be passed as the ptrace_message and may be retrieved using PTRACE_GETEVENTMSG. If the subordinate process is not using seccomp filter, then no system call notifications will occur even if the option is specified. If there is no tracer with PTRACE_O_TRACESECCOMP when SECCOMP_RET_TRACE is returned, the system call will not be executed and an -ENOSYS errno will be returned to userspace. This change adds a dependency on the system call slow path. Any future efforts to use the system call fast path for seccomp filter will need to address this restriction. Signed-off-by: Will Drewry <wad@chromium.org> Acked-by: Eric Paris <eparis@redhat.com>
Showing the changes to kernel (1 of 4 files). Show all
Unified · Split
| @@ -24,6 +24,7 @@ · 23 unmodified lines | ||
| 24 | 24 | #ifdef CONFIG_SECCOMP_FILTER |
| 25 | 25 | #include <asm/syscall.h> |
| 26 | 26 | #include <linux/filter.h> |
| 27 | +#include <linux/ptrace.h> | |
| 27 | 28 | #include <linux/security.h> |
| 28 | 29 | #include <linux/slab.h> |
| 29 | 30 | #include <linux/tracehook.h> |
| @@ -408,6 +409,21 @@ int __secure_computing(int this_syscall) · 378 unmodified lines | ||
| 408 | 409 | /* Let the filter pass back 16 bits of data. */ |
| 409 | 410 | seccomp_send_sigsys(this_syscall, data); |
| 410 | 411 | goto skip; |
| 412 | + case SECCOMP_RET_TRACE: | |
| 413 | + /* Skip these calls if there is no tracer. */ | |
| 414 | + if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP)) | |
| 415 | + goto skip; | |
| 416 | + /* Allow the BPF to provide the event message */ | |
| 417 | + ptrace_event(PTRACE_EVENT_SECCOMP, data); | |
| 418 | + /* | |
| 419 | + * The delivery of a fatal signal during event | |
| 420 | + * notification may silently skip tracer notification. | |
| 421 | + * Terminating the task now avoids executing a system | |
| 422 | + * call that may not be intended. | |
| 423 | + */ | |
| 424 | + if (fatal_signal_pending(current)) | |
| 425 | + break; | |
| 426 | + return 0; | |
| 411 | 427 | case SECCOMP_RET_ALLOW: |
| 412 | 428 | return 0; |
| 413 | 429 | case SECCOMP_RET_KILL: |