Kees Cook
c2e1f2e30d
seccomp: implement SECCOMP_FILTER_FLAG_TSYNC ...
Applying restrictive seccomp filter programs to large or diverse
codebases often requires handling threads which may be started early in
the process lifetime (e.g., by code that is linked in). While it is
possible to apply permissive programs prior to process start up, it is
difficult to further restrict the kernel ABI to those threads after that
point.
This change adds a new seccomp syscall flag to SECCOMP_SET_MODE_FILTER for
synchronizing thread group seccomp filters at filter installation time.
When calling seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
filter) an attempt will be made to synchronize all threads in current's
threadgroup to its new seccomp filter program. This is possible iff all
threads are using a filter that is an ancestor to the filter current is
attempting to synchronize to. NULL filters (where the task is running as
SECCOMP_MODE_NONE) are also treated as ancestors allowing threads to be
transitioned into SECCOMP_MODE_FILTER. If prctrl(PR_SET_NO_NEW_PRIVS,
...) has been set on the calling thread, no_new_privs will be set for
all synchronized threads too. On success, 0 is returned. On failure,
the pid of one of the failing threads will be returned and no filters
will have been applied.
The race conditions against another thread are:
- requesting TSYNC (already handled by sighand lock)
- performing a clone (already handled by sighand lock)
- changing its filter (already handled by sighand lock)
- calling exec (handled by cred_guard_mutex)
The clone case is assisted by the fact that new threads will have their
seccomp state duplicated from their parent before appearing on the tasklist.
Holding cred_guard_mutex means that seccomp filters cannot be assigned
while in the middle of another thread's exec (potentially bypassing
no_new_privs or similar). The call to de_thread() may kill threads waiting
for the mutex.
Changes across threads to the filter pointer includes a barrier.
Based on patches by Will Drewry.
Suggested-by: Julien Tinnes <jln@chromium.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: Andy Lutomirski <luto@amacapital.net>
2014-07-18 12:13:40 -07:00
kernel/printk: use symbolic defines for console loglevels
2014-06-04 16:54:17 -07:00
Oleg Nesterov found and fixed a bug in the perf/ftrace/uprobes code where
2014-07-03 18:37:25 -07:00
gcov: add support for GCC 4.9
2014-06-10 15:34:46 -07:00
genirq: Fix memory leak when calling irq_free_hwirqs()
2014-07-05 21:42:08 +02:00
Merge branch 'locking-urgent-for-linus.patch' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2014-06-21 07:06:02 -10:00
x86, kaslr: boot-time selectable with hibernation
2014-06-16 23:30:44 +02:00
kernel/printk/printk.c: revert "printk: enable interrupts before calling console_trylock_for_printk()"
2014-07-03 09:21:54 -07:00
Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into next
2014-06-03 12:57:53 -07:00
Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2014-06-12 19:42:15 -07:00
Merge branch 'akpm' (patchbomb from Andrew) into next
2014-06-04 16:55:13 -07:00
tracing: Remove ftrace_stop/start() from reading the trace file
2014-07-01 12:45:54 -04:00
ipc, kernel: clear whitespace
2014-06-06 16:08:14 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
2014-06-12 14:27:40 -07:00
Merge git://git.infradead.org/users/eparis/audit
2014-04-12 12:38:53 -07:00
auditsc: audit_krule mask accesses need bounds checking
2014-06-10 08:44:40 -07:00
kernel/backtracetest.c: replace no level printk by pr_info()
2014-06-04 16:54:14 -07:00
fs,userns: Change inode_capable to capable_wrt_inode_uidgid
2014-06-10 13:57:22 -07:00
cgroup: fix a race between cgroup_mount() and cgroup_kill_sb()
2014-06-30 10:16:26 -04:00
cgroup: remove css_parent()
2014-05-16 13:22:48 -04:00
kernel/compat.c: use sizeof() instead of sizeof
2014-06-04 16:54:19 -07:00
x86/kprobes: Fix build errors and blacklist context_track_user
2014-06-14 09:07:44 +02:00
More ACPI and power management updates for 3.16-rc1
2014-06-12 13:14:19 -07:00
cpuset: break kernfs active protection in cpuset_write_resmask()
2014-07-01 16:42:28 -04:00
kernel/exec_domain.c: code clean-up
2014-06-04 16:54:15 -07:00
signals: mv {dis,}allow_signal() from sched.h/exit.c to signal.[ch]
2014-06-06 16:08:11 -07:00
seccomp: introduce writer locking
2014-07-18 12:13:39 -07:00
Merge branch 'next' (accumulated 3.16 merge window patches) into master
2014-06-08 11:31:16 -07:00
kernel/groups.c: remove return value of set_groups
2014-04-03 16:21:05 -07:00
Merge branch 'perf/urgent' into perf/core, to resolve conflict and to prepare for new patches
2014-06-06 07:55:06 +02:00
kernel/hung_task.c: convert simple_strtoul to kstrtouint
2014-06-04 16:54:15 -07:00
kernel: use macros from compiler.h instead of __attribute__((...))
2014-04-07 16:36:11 -07:00
locking/rwlocks: Introduce 'qrwlocks' - fair, queued rwlocks
2014-06-06 07:58:28 +02:00
kexec: save PG_head_mask in VMCOREINFO
2014-06-23 16:47:43 -07:00
signals: change wait_for_helper() to use kernel_sigaction()
2014-06-06 16:08:12 -07:00
kprobes: Show blacklist entries via debugfs
2014-04-24 10:26:41 +02:00
kobject: Make support for uevent_helper optional.
2014-04-25 12:00:49 -07:00
kthread: fix return value of kthread_create() upon SIGKILL.
2014-06-04 16:53:51 -07:00
kernel/latencytop.c: convert seq_printf to seq_puts
2014-06-04 16:54:15 -07:00
Merge branch 'x86-asmlinkage-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2014-03-31 14:13:25 -07:00
Most of this is cleaning up various driver sysfs permissions so we can
2014-06-11 16:09:14 -07:00
kprobes, notifier: Use NOKPROBE_SYMBOL macro in notifier
2014-04-24 10:26:39 +02:00
kernel/panic.c: add "crash_kexec_post_notifiers" option for kdump after panic_notifers
2014-06-06 16:08:12 -07:00
param: hand arguments after -- straight to init
2014-04-28 11:48:34 +09:30
pid_namespace: pidns_get() should check task_active_pid_ns() != NULL
2014-04-02 16:20:21 -07:00
kernel/profile.c: use static const char instead of static char
2014-06-06 16:08:13 -07:00
kernel/reboot.c: convert simple_strtoul to kstrtoint
2014-06-04 16:54:15 -07:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2014-04-12 14:49:50 -07:00
kernel/res_counter.c: replace simple_strtoull by kstrtoull
2014-06-04 16:54:15 -07:00
resources: Clarify sanity check message
2014-05-23 10:47:21 -06:00
seccomp: implement SECCOMP_FILTER_FLAG_TSYNC
2014-07-18 12:13:40 -07:00
signals: introduce kernel_sigaction()
2014-06-06 16:08:12 -07:00
CPU hotplug, smp: flush any pending IPI callbacks before CPU offline
2014-06-23 16:47:43 -07:00
Merge branch 'rcu/next' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu into core/rcu
2014-05-22 11:36:10 +02:00
kernel/stop_machine.c: kernel-doc warning fix
2014-06-04 16:54:15 -07:00
sched: move no_new_privs into new atomic flags
2014-07-18 12:13:38 -07:00
seccomp: add "seccomp" syscall
2014-07-18 12:13:37 -07:00
kernel/watchdog.c: print traces for all cpus on lockup detection
2014-06-23 16:47:44 -07:00
timer: Prevent overflow in apply_slack
2014-04-30 13:46:17 +02:00
torture: Remove __init from torture_init_begin/end
2014-05-14 09:46:30 -07:00
tracing: syscall_regfunc() should not skip kernel threads
2014-06-21 00:15:26 -04:00
kernel/user.c: drop unused field 'files' from user_struct
2014-06-04 16:54:16 -07:00
kernel/user_namespace.c: kernel-doc/checkpatch fixes
2014-06-06 16:08:13 -07:00
sysctl: convert use of typedef ctl_table to struct ctl_table
2014-06-06 16:08:16 -07:00
kernel/watchdog.c: print traces for all cpus on lockup detection
2014-06-23 16:47:44 -07:00
workqueue: zero cpumask of wq_numa_possible_cpumask on init
2014-07-07 09:56:48 -04:00
workqueue: rename manager_mutex to attach_mutex
2014-05-20 10:59:32 -04:00
c2e1f2e30d