Commit eef8cffc authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'seccomp-v5.17-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux 

Pull seccomp fixes from Kees Cook:
 "This fixes a corner case of fatal SIGSYS being ignored since v5.15.
  Along with the signal fix is a change to seccomp so that seeing
  another syscall after a fatal filter result will cause seccomp to kill
  the process harder.

  Summary:

   - Force HANDLER_EXIT even for SIGNAL_UNKILLABLE

   - Make seccomp self-destruct after fatal filter results

   - Update seccomp samples for easier behavioral demonstration"

* tag 'seccomp-v5.17-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  samples/seccomp: Adjust sample to also provide kill option
  seccomp: Invalidate seccomp mode to catch death failures
  signal: HANDLER_EXIT should clear SIGNAL_UNKILLABLE
parents 9917ff5f eed09ad2

kernel/seccomp.c

+10 −0
Original line number Diff line number Diff line
@@ -29,6 +29,9 @@ 
#include <linux/syscalls.h>

#include <linux/sysctl.h>



/* Not exposed in headers: strictly internal use only. */

#define SECCOMP_MODE_DEAD	(SECCOMP_MODE_FILTER + 1)



#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER

#include <asm/syscall.h>

#endif
@@ -1010,6 +1013,7 @@ static void __secure_computing_strict(int this_syscall) 
#ifdef SECCOMP_DEBUG

	dump_stack();

#endif

	current->seccomp.mode = SECCOMP_MODE_DEAD;

	seccomp_log(this_syscall, SIGKILL, SECCOMP_RET_KILL_THREAD, true);

	do_exit(SIGKILL);

}
@@ -1261,6 +1265,7 @@ static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd, 
	case SECCOMP_RET_KILL_THREAD:

	case SECCOMP_RET_KILL_PROCESS:

	default:

		current->seccomp.mode = SECCOMP_MODE_DEAD;

		seccomp_log(this_syscall, SIGSYS, action, true);

		/* Dump core only if this is the last remaining thread. */

		if (action != SECCOMP_RET_KILL_THREAD ||
@@ -1309,6 +1314,11 @@ int __secure_computing(const struct seccomp_data *sd) 
		return 0;

	case SECCOMP_MODE_FILTER:

		return __seccomp_filter(this_syscall, sd, false);

	/* Surviving SECCOMP_RET_KILL_* must be proactively impossible. */

	case SECCOMP_MODE_DEAD:

		WARN_ON_ONCE(1);

		do_exit(SIGKILL);

		return -1;

	default:

		BUG();

	}

kernel/signal.c

+3 −2
Original line number Diff line number Diff line
@@ -1342,9 +1342,10 @@ force_sig_info_to_task(struct kernel_siginfo *info, struct task_struct *t, 
	}

	/*

	 * Don't clear SIGNAL_UNKILLABLE for traced tasks, users won't expect

	 * debugging to leave init killable.

	 * debugging to leave init killable. But HANDLER_EXIT is always fatal.

	 */

	if (action->sa.sa_handler == SIG_DFL && !t->ptrace)

	if (action->sa.sa_handler == SIG_DFL &&

	    (!t->ptrace || (handler == HANDLER_EXIT)))

		t->signal->flags &= ~SIGNAL_UNKILLABLE;

	ret = send_signal(sig, info, t, PIDTYPE_PID);

	spin_unlock_irqrestore(&t->sighand->siglock, flags);

samples/seccomp/dropper.c

+7 −2
Original line number Diff line number Diff line
@@ -25,7 +25,7 @@ 
#include <sys/prctl.h>

#include <unistd.h>



static int install_filter(int nr, int arch, int error)

static int install_filter(int arch, int nr, int error)

{

	struct sock_filter filter[] = {

		BPF_STMT(BPF_LD+BPF_W+BPF_ABS,
@@ -42,6 +42,10 @@ static int install_filter(int nr, int arch, int error) 
		.len = (unsigned short)(sizeof(filter)/sizeof(filter[0])),

		.filter = filter,

	};

	if (error == -1) {

		struct sock_filter kill = BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL);

		filter[4] = kill;

	}

	if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {

		perror("prctl(NO_NEW_PRIVS)");

		return 1;
@@ -57,9 +61,10 @@ int main(int argc, char **argv) 
{

	if (argc < 5) {

		fprintf(stderr, "Usage:\n"

			"dropper <syscall_nr> <arch> <errno> <prog> [<args>]\n"

			"dropper <arch> <syscall_nr> <errno> <prog> [<args>]\n"

			"Hint:	AUDIT_ARCH_I386: 0x%X\n"

			"	AUDIT_ARCH_X86_64: 0x%X\n"

			"	errno == -1 means SECCOMP_RET_KILL\n"

			"\n", AUDIT_ARCH_I386, AUDIT_ARCH_X86_64);

		return 1;

	}