A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-05 19:31:57 -04:00
Code Issues Projects Releases Packages Wiki Activity

UPSTREAM: seccomp: Report number of loaded filters in /proc/$pid/status

Browse source 
A common question asked when debugging seccomp filters is "how many
filters are attached to your process?" Provide a way to easily answer
this question through /proc/$pid/status with a "Seccomp_filters" line.

Signed-off-by: Kees Cook <keescook@chromium.org>
(cherry picked from commit c818c03b661cd769e035e41673d5543ba2ebda64)
Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
Bug: 176068146
Change-Id: Ib189ea77511a6088d5d328706c77c88709d8d63e
This commit is contained in:
Kees Cook 2020-05-13 14:11:26 -07:00 • committed by Nolen Johnson
commit 9db11ce119
4 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
fs/proc/array.c
View file

@ -342,6 +342,8 @@ static inline void task_seccomp(struct seq_file *m, struct task_struct *p)
seq_put_decimal_ull(m, "NoNewPrivs:\t", task_no_new_privs(p));
#ifdef CONFIG_SECCOMP
seq_put_decimal_ull(m, "\nSeccomp:\t", p->seccomp.mode);
seq_put_decimal_ull(m, "\nSeccomp_filters:\t",
atomic_read(&p->seccomp.filter_count));
#endif
seq_puts(m, "\nSpeculation_Store_Bypass:\t");
switch (arch_prctl_spec_ctrl_get(p, PR_SPEC_STORE_BYPASS)) {

2
include/linux/seccomp.h
View file

@ -12,6 +12,7 @@
#ifdef CONFIG_SECCOMP
#include <linux/thread_info.h>
#include <linux/atomic.h>
#include <asm/seccomp.h>
struct seccomp_filter;
@ -28,6 +29,7 @@ struct seccomp_filter;
*/
struct seccomp {
int mode;
atomic_t filter_count;
struct seccomp_filter *filter;
};

3
init/init_task.c
View file

@ -193,6 +193,9 @@ struct task_struct init_task
#ifdef CONFIG_SECURITY
.security = NULL,
#endif
#ifdef CONFIG_SECCOMP
.seccomp = { .filter_count = ATOMIC_INIT(0) },
#endif
};
EXPORT_SYMBOL(init_task);

3
kernel/seccomp.c
View file

@ -410,6 +410,8 @@ static inline void seccomp_sync_threads(unsigned long flags)
put_seccomp_filter(thread);
smp_store_release(&thread->seccomp.filter,
caller->seccomp.filter);
atomic_set(&thread->seccomp.filter_count,
atomic_read(&thread->seccomp.filter_count));
/*
* Don't let an unprivileged task work around
@ -551,6 +553,7 @@ static long seccomp_attach_filter(unsigned int flags,
*/
filter->prev = current->seccomp.filter;
current->seccomp.filter = filter;
atomic_inc(&current->seccomp.filter_count);
/* Now that the new filter is in place, synchronize to all threads. */
if (flags & SECCOMP_FILTER_FLAG_TSYNC)