seccomp: Check that seccomp_notif is zeroed out by the user
This patch is a small change in enforcement of the uapi for SECCOMP_IOCTL_NOTIF_RECV ioctl. Specifically, the datastructure which is passed (seccomp_notif) must be zeroed out. Previously any of its members could be set to nonsense values, and we would ignore it. This ensures all fields are set to their zero value. Signed-off-by:Sargun Dhillon <sargun@sargun.me> Reviewed-by:
Christian Brauner <christian.brauner@ubuntu.com> Reviewed-by:
Aleksa Sarai <cyphar@cyphar.com> Acked-by:
Tycho Andersen <tycho@tycho.ws> Link: https://lore.kernel.org/r/20191229062451.9467-2-sargun@sargun.me Fixes: 6a21cc50 ("seccomp: add a return code to trap to userspace") Cc: stable@vger.kernel.org Signed-off-by:
Kees Cook <keescook@chromium.org>
parent
88c13f8b
Please register or sign in to comment