Kees Cook
c2e1f2e30d
seccomp: implement SECCOMP_FILTER_FLAG_TSYNC ...
Applying restrictive seccomp filter programs to large or diverse
codebases often requires handling threads which may be started early in
the process lifetime (e.g., by code that is linked in). While it is
possible to apply permissive programs prior to process start up, it is
difficult to further restrict the kernel ABI to those threads after that
point.
This change adds a new seccomp syscall flag to SECCOMP_SET_MODE_FILTER for
synchronizing thread group seccomp filters at filter installation time.
When calling seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
filter) an attempt will be made to synchronize all threads in current's
threadgroup to its new seccomp filter program. This is possible iff all
threads are using a filter that is an ancestor to the filter current is
attempting to synchronize to. NULL filters (where the task is running as
SECCOMP_MODE_NONE) are also treated as ancestors allowing threads to be
transitioned into SECCOMP_MODE_FILTER. If prctrl(PR_SET_NO_NEW_PRIVS,
...) has been set on the calling thread, no_new_privs will be set for
all synchronized threads too. On success, 0 is returned. On failure,
the pid of one of the failing threads will be returned and no filters
will have been applied.
The race conditions against another thread are:
- requesting TSYNC (already handled by sighand lock)
- performing a clone (already handled by sighand lock)
- changing its filter (already handled by sighand lock)
- calling exec (handled by cred_guard_mutex)
The clone case is assisted by the fact that new threads will have their
seccomp state duplicated from their parent before appearing on the tasklist.
Holding cred_guard_mutex means that seccomp filters cannot be assigned
while in the middle of another thread's exec (potentially bypassing
no_new_privs or similar). The call to de_thread() may kill threads waiting
for the mutex.
Changes across threads to the filter pointer includes a barrier.
Based on patches by Will Drewry.
Suggested-by: Julien Tinnes <jln@chromium.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: Andy Lutomirski <luto@amacapital.net>
2014-07-18 12:13:40 -07:00
Merge branch 'for-linus' of git://git.infradead.org/users/vkoul/slave-dma
2014-06-10 10:28:45 -07:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client
2014-06-12 23:06:23 -07:00
Merge branch 'for-v3.16/ti-clk-drv' of github.com:t-kristo/linux-pm into clk-next
2014-06-10 16:53:25 -07:00
fsl /bestcomm
This pull-request contains some misplaced patches from Tony
2014-06-12 12:42:32 -07:00
Input: add common DT binding for touchscreens
2014-05-29 00:05:59 -07:00
isdn/capi: move capi_info2str to capidrv.c
2014-06-04 23:13:41 -07:00
rtc: s5m: use shorter time of register update
2014-06-10 15:34:47 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
2014-06-12 14:27:40 -07:00
MTD updates for 3.16:
2014-06-11 08:35:34 -07:00
New driver for Sensirion SHTC1 humidity / temperature sensor
2014-06-14 14:43:23 -07:00
Merge remote-tracking branch 'regulator/fix/core' into regulator-linus
2014-06-16 16:05:56 +01:00
mm: update comment for DEFAULT_MAX_MAP_COUNT
2014-06-04 16:54:05 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
2014-06-12 14:27:40 -07:00
NFS client updates for Linux 3.16
2014-06-10 15:02:42 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
2014-06-12 14:27:40 -07:00
Merge branch 'acpi-enumeration'
2014-06-03 23:12:20 +02:00
block: add support for limiting gaps in SG lists
2014-06-24 16:22:24 -06:00
blk-mq: bitmap tag: fix races on shared ::wake_index fields
2014-06-17 22:12:35 -07:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2014-06-12 10:30:18 -07:00
block: add support for limiting gaps in SG lists
2014-06-24 16:22:24 -06:00
include/linux/bootmem.h: cleanup the comment for BOOTMEM_ flags
2014-06-04 16:54:04 -07:00
fs/buffer.c: remove block_write_full_page_endio()
2014-06-04 16:54:02 -07:00
fs,userns: Change inode_capable to capable_wrt_inode_uidgid
2014-06-10 13:57:22 -07:00
Merge branch 'for-3.16' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu
2014-06-09 14:56:07 -07:00
The clock framework changes for 3.16 are pretty typical: mostly clock
2014-06-07 20:27:30 -07:00
mm, compaction: embed migration mode in compact_control
2014-06-04 16:54:06 -07:00
Merge branch 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2014-06-12 19:18:49 -07:00
connector: allow multiple messages to be sent in one packet
2014-05-27 13:56:21 -07:00
console: Use explicit pointer type for vc_uni_pagedir* fields
2014-05-28 13:37:21 -07:00
idle: remove cpu_idle() forward declarations
2014-06-06 16:08:18 -07:00
cpufreq: add support for intermediate (stable) frequencies
2014-06-05 23:32:29 +02:00
Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus
2014-06-09 18:10:34 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
2014-06-12 14:27:40 -07:00
mm: page_alloc: use jump labels to avoid checking number_of_cpusets
2014-06-04 16:54:08 -07:00
dm: remove symbol export for dm_set_device_limits
2014-06-04 09:46:34 -04:00
Merge branch 'for-linus' of git://ftp.arm.linux.org.uk/~rmk/linux-arm into next
2014-06-05 15:57:04 -07:00
cma: add placement specifier for "cma=" kernel parameter
2014-06-04 16:53:57 -07:00
Merge branch 'for-linus' of git://ftp.arm.linux.org.uk/~rmk/linux-arm into next
2014-06-05 15:57:04 -07:00
Merge branch 'for-linus' of git://git.infradead.org/users/vkoul/slave-dma
2014-06-10 10:28:45 -07:00
Revert "block: add __init to elv_register"
2014-06-22 16:34:11 -06:00
ethtool: Replace ethtool_ops::{get,set}_rxfh_indir() with {get,set}_rxfh()
2014-06-03 02:42:44 +01:00
f2fs: large volume support
2014-06-04 13:34:30 +09:00
net: filter: cleanup A/X name usage
2014-06-11 00:13:16 -07:00
File locking related bugfixes for v3.16 (pile #2 )
2014-06-21 16:40:30 -10:00
Lots of tweaks, small fixes, optimizations, and some helper functions
2014-06-09 16:39:15 -07:00
include/linux/gfp.h: exclude duplicate header
2014-06-04 16:54:10 -07:00
Merge branches 'for-3.16/i2c-hid', 'for-3.16/rmi4', 'for-3.16/sony' and 'for-3.16/thingm' into for-linus
2014-06-04 13:09:43 +02:00
hugetlb: rename hugepage_migration_support() to ..._supported()
2014-06-04 16:54:12 -07:00
idr: reorder the fields
2014-06-06 16:08:13 -07:00
wireless: add missing WLAN_EID_BSS_INTOLERANT_CHL_REPORT
2014-05-28 16:22:47 +02:00
bridge: memorize and export selected IGMP/MLD querier port
2014-06-10 23:50:47 -07:00
macvlan: add netpoll support
2014-06-02 16:05:24 -07:00
team: fix mtu setting
2014-06-02 14:56:01 -07:00
init.h: Update initcall_sync variants to fix build errors
2014-05-27 14:26:31 -07:00
Merge commit ' 3cf2f34' into sched/core, to fix build error
2014-06-12 13:46:37 +02:00
include/linux/jump_label.h: expose the reference count
2014-06-04 16:54:08 -07:00
Merge branch 'for-3.16-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
2014-07-10 11:38:23 -07:00
Merge branch 'serge-next-1' of git://git.kernel.org/pub/scm/linux/kernel/git/sergeh/linux-security
2014-06-10 10:05:36 -07:00
mm: introduce kmemleak_update_trace()
2014-06-06 16:08:17 -07:00
Merge branch 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2014-06-12 19:18:49 -07:00
ktime: add ktime_after and ktime_before helper
2014-06-11 12:23:17 -07:00
Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2014-06-12 19:42:15 -07:00
drivers/rtc/rtc-cmos.c: drivers/char/rtc.c features for DECstation support
2014-06-06 16:08:07 -07:00
mcb: Add support for shared PCI IRQs
2014-05-27 17:38:11 -07:00
memblock: introduce memblock_alloc_range()
2014-06-04 16:53:57 -07:00
memcg: cleanup kmem cache creation/destruction functions naming
2014-06-04 16:54:08 -07:00
mem-hotplug: implement get/put_online_mems
2014-06-04 16:53:59 -07:00
hugetlb: restrict hugepage_migration_support() to x86_64
2014-06-04 16:53:51 -07:00
mm, migration: add destination page freeing callback
2014-06-04 16:54:06 -07:00
miscdevice.h: Simple syntax fix to make pointers consistent.
2014-05-27 17:43:11 -07:00
Merge branch 'x86/vdso' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into next
2014-06-05 08:05:29 -07:00
Merge branch 'x86/vdso' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into next
2014-06-05 08:05:29 -07:00
mm: pass VM_BUG_ON() reason to dump_page()
2014-06-04 16:53:58 -07:00
mm: page_alloc: use unsigned int for order in more places
2014-06-04 16:54:09 -07:00
net: Fix GSO constants to match NETIF flags
2014-06-15 01:00:49 -07:00
net: Fix GSO constants to match NETIF flags
2014-06-15 01:00:49 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2014-06-03 23:32:12 -07:00
pnfs: support multiple verfs per direct req
2014-05-29 11:11:48 -04:00
nfs4: remove unused CHANGE_SECURITY_LABEL
2014-06-06 19:22:49 -04:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2014-06-12 10:30:18 -07:00
nfs: page group syncing in write path
2014-05-29 11:11:45 -04:00
pnfs: support multiple verfs per direct req
2014-05-29 11:11:48 -04:00
kernel/watchdog.c: print traces for all cpus on lockup detection
2014-06-23 16:47:44 -07:00
NVMe: Fix hot cpu notification dead lock
2014-06-13 10:43:34 -04:00
DeviceTree for 3.16:
2014-06-04 10:02:38 -07:00
Merge branch 'for-linus' of git://ftp.arm.linux.org.uk/~rmk/linux-arm into next
2014-06-05 15:57:04 -07:00
net: of_mdio: add of_mdiobus_link_phydev()
2014-05-29 15:23:29 -07:00
of/irq: provide more wrappers for !CONFIG_OF
2014-06-04 04:45:46 -05:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial into next
2014-06-04 08:50:34 -07:00
MMC highlights for 3.16:
2014-06-10 14:35:22 -07:00
MMC highlights for 3.16:
2014-06-10 14:35:22 -07:00
kexec: save PG_head_mask in VMCOREINFO
2014-06-23 16:47:43 -07:00
mm: page_alloc: reduce number of times page_to_pfn is called
2014-06-04 16:54:09 -07:00
mm: non-atomically mark page accessed during page cache allocation where possible
2014-06-04 16:54:10 -07:00
Merge branch 'pci/iommu' into next
2014-06-02 16:18:48 -06:00
core: fix typo in percpu read_mostly section
2014-07-01 16:45:22 -04:00
Merge branch 'for-3.15-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu.git into for-3.16
2014-06-04 12:50:47 -04:00
Merge branch 'for-3.16' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu
2014-06-09 14:56:07 -07:00
perf: Differentiate exec() and non-exec() comm events
2014-06-06 07:56:22 +02:00
net: phylib: add link_change_notify callback to phy device
2014-06-21 15:50:00 -07:00
net: phy: fix sparse warning in fixed.c
2014-06-05 15:38:57 -07:00
lib/plist: add plist_requeue
2014-06-04 16:54:07 -07:00
power_supply: allow power supply devices registered w/o wakeup source
2014-05-30 13:45:25 +02:00
kernel/printk: use symbolic defines for console loglevels
2014-06-04 16:54:17 -07:00
init/main.c: remove an ifdef
2014-06-04 16:54:21 -07:00
ptrace,x86: force IRET path after a ptrace_stop()
2014-07-03 17:27:23 -07:00
ring-buffer: Check if buffer exists before polling
2014-06-10 09:46:00 -04:00
mm/rmap.c: cleanup ttu_flags
2014-06-04 16:54:12 -07:00
locking/rwsem: Fix warnings for CONFIG_RWSEM_GENERIC_SPINLOCK
2014-06-05 10:38:45 +02:00
sched: move no_new_privs into new atomic flags
2014-07-18 12:13:38 -07:00
seccomp: implement SECCOMP_FILTER_FLAG_TSYNC
2014-07-18 12:13:40 -07:00
Merge branch 'stable-3.16' of git://git.infradead.org/users/pcmoore/selinux into next
2014-07-17 03:05:51 +10:00
ipc/shm.c: increase the defaults for SHMALL, SHMMAX
2014-06-06 16:08:14 -07:00
signals: introduce kernel_sigaction()
2014-06-06 16:08:12 -07:00
net: add skb_pop_rcv_encapsulation
2014-06-15 01:00:50 -07:00
memcg: cleanup kmem cache creation/destruction functions naming
2014-06-04 16:54:08 -07:00
idle: remove cpu_idle() forward declarations
2014-06-06 16:08:18 -07:00
iovec: move memcpy_from/toiovecend to lib/iovec.c
2014-06-27 11:47:58 -07:00
fs/splice.c: remove unneeded exports
2014-06-12 00:21:11 -04:00
PM / hibernate: introduce "nohibernate" boot parameter
2014-06-16 23:29:39 +02:00
mm/vmscan.c: use DIV_ROUND_UP for calculation of zone's balance_gap and correct comments.
2014-06-04 16:54:11 -07:00
swap: change swap_list_head to plist, add swap_avail_head
2014-06-04 16:54:07 -07:00
x86: define _PAGE_NUMA by reusing software bits on the PMD and PTE levels
2014-06-04 16:53:55 -07:00
x86: enable DMA CMA with swiotlb
2014-06-04 16:53:57 -07:00
seccomp: add "seccomp" syscall
2014-07-18 12:13:37 -07:00
sysfs.h: don't return a void-valued expression in sysfs_remove_file
2014-05-27 14:29:56 -07:00
mm: get rid of __GFP_KMEMCG
2014-06-04 16:53:56 -07:00
mm: disable zone_reclaim_mode by default
2014-06-04 16:53:59 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending
2014-06-28 09:43:58 -07:00
Merge branch 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2014-06-12 19:18:49 -07:00
USB: separate usb_address0 mutexes for each bus
2014-05-27 16:11:49 -07:00
usb-storage/SCSI: Add broken_fua blacklist flag
2014-06-30 22:47:18 -07:00
drivers/vfio: Rework offsetofend()
2014-05-30 11:35:54 -06:00
virtio-scsi.h: Add virtio_scsi_cmd_req_pi + VIRTIO_SCSI_F_T10_PI bits
2014-06-02 12:41:33 -07:00
mm,vmacache: add debug data
2014-06-04 16:53:57 -07:00
mm,vmacache: add debug data
2014-06-04 16:53:57 -07:00
mm/zbud.c: make size unsigned like unique callsite
2014-06-04 16:54:13 -07:00
