Tycho Andersen
6a21cc50f0
seccomp: add a return code to trap to userspace ...
This patch introduces a means for syscalls matched in seccomp to notify
some other task that a particular filter has been triggered.
The motivation for this is primarily for use with containers. For example,
if a container does an init_module(), we obviously don't want to load this
untrusted code, which may be compiled for the wrong version of the kernel
anyway. Instead, we could parse the module image, figure out which module
the container is trying to load and load it on the host.
As another example, containers cannot mount() in general since various
filesystems assume a trusted image. However, if an orchestrator knows that
e.g. a particular block device has not been exposed to a container for
writing, it want to allow the container to mount that block device (that
is, handle the mount for it).
This patch adds functionality that is already possible via at least two
other means that I know about, both of which involve ptrace(): first, one
could ptrace attach, and then iterate through syscalls via PTRACE_SYSCALL.
Unfortunately this is slow, so a faster version would be to install a
filter that does SECCOMP_RET_TRACE, which triggers a PTRACE_EVENT_SECCOMP.
Since ptrace allows only one tracer, if the container runtime is that
tracer, users inside the container (or outside) trying to debug it will not
be able to use ptrace, which is annoying. It also means that older
distributions based on Upstart cannot boot inside containers using ptrace,
since upstart itself uses ptrace to monitor services while starting.
The actual implementation of this is fairly small, although getting the
synchronization right was/is slightly complex.
Finally, it's worth noting that the classic seccomp TOCTOU of reading
memory data from the task still applies here, but can be avoided with
careful design of the userspace handler: if the userspace handler reads all
of the task memory that is necessary before applying its security policy,
the tracee's subsequent memory edits will not be read by the tracer.
Signed-off-by: Tycho Andersen <tycho@tycho.ws>
CC: Kees Cook <keescook@chromium.org>
CC: Andy Lutomirski <luto@amacapital.net>
CC: Oleg Nesterov <oleg@redhat.com>
CC: Eric W. Biederman <ebiederm@xmission.com>
CC: "Serge E. Hallyn" <serge@hallyn.com>
Acked-by: Serge Hallyn <serge@hallyn.com>
CC: Christian Brauner <christian@brauner.io>
CC: Tyler Hicks <tyhicks@canonical.com>
CC: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>
Signed-off-by: Kees Cook <keescook@chromium.org>
2018-12-11 16:28:41 -08:00
bpf: fix bpf_prog_get_info_by_fd to return 0 func_lens for unpriv
2018-11-02 13:51:15 -07:00
for-linus-20181102
2018-11-02 11:25:48 -07:00
kvm_config: add CONFIG_VIRTIO_MENU
2018-10-24 20:55:56 -04:00
sched: loadavg: consolidate LOAD_INT, LOAD_FRAC, CALC_LOAD
2018-10-26 16:26:32 -07:00
mm: remove include/linux/bootmem.h
2018-10-31 08:54:16 -07:00
Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2018-11-03 18:13:43 -07:00
gcov: remove CONFIG_GCOV_FORMAT_AUTODETECT
2018-06-08 18:56:02 +09:00
irq/matrix: Fix memory overallocation
2018-11-01 10:00:38 +01:00
Merge branch 'for-4.19/upstream' into for-linus
2018-08-20 18:33:50 +02:00
mm: remove include/linux/bootmem.h
2018-10-31 08:54:16 -07:00
memblock: stop using implicit alignment to SMP_CACHE_BYTES
2018-10-31 08:54:16 -07:00
mm: remove include/linux/bootmem.h
2018-10-31 08:54:16 -07:00
Merge branches 'doc.2018.08.30a', 'dynticks.2018.08.30b', 'srcu.2018.08.30b' and 'torture.2018.08.29a' into HEAD
2018-08-30 16:12:53 -07:00
Merge branch 'sched/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2018-11-11 16:33:00 -06:00
posix-cpu-timers: Remove useless call to check_dl_overrun()
2018-11-08 07:43:35 +01:00
tracing/kprobes: Fix strpbrk() argument order
2018-11-05 09:47:14 -05:00
audit: use ktime_get_coarse_real_ts64() for timestamps
2018-07-17 14:45:08 -04:00
\n
2018-08-17 09:41:28 -07:00
audit: fix use-after-free in audit_add_watch
2018-07-18 11:43:36 -04:00
audit: rename FILTER_TYPE to FILTER_EXCLUDE
2018-06-19 10:39:54 -04:00
audit/stable-4.18 PR 20180814
2018-08-15 10:46:54 -07:00
kbuild: fix kernel/bounds.c 'W=1' warning
2018-10-31 08:54:14 -07:00
y2038: globally rename compat_time to old_time32
2018-08-27 14:48:48 +02:00
Merge branch 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2018-10-23 18:43:04 +01:00
kernel/crash_core.c: print timestamp using time64_t
2018-08-22 10:52:47 -07:00
delayacct: track delays from thrashing cache pages
2018-10-26 16:26:32 -07:00
signal: Pass pid type into group_send_sig_info
2018-07-21 12:57:35 -05:00
kernel/fail_function.c: remove meaningless null pointer check before debugfs_remove_recursive
2018-10-31 08:54:12 -07:00
New gcc plugin: stackleak
2018-11-01 11:46:27 -07:00
PM / reboot: Eliminate race between reboot and suspend
2018-08-06 12:35:20 +02:00
mm: remove include/linux/bootmem.h
2018-10-31 08:54:16 -07:00
y2038: globally rename compat_time to old_time32
2018-08-27 14:48:48 +02:00
kernel: hung_task.c: disable on suspend
2018-10-25 18:45:08 +02:00
Merge branch 'x86/build' into locking/core, to pick up dependent patches and unify jump-label work
2018-10-16 17:30:11 +02:00
kallsyms: reduce size a little on 64-bit
2018-09-10 22:54:33 +09:00
kconfig: include kernel/Kconfig.preempt from init/Kconfig
2018-08-02 08:06:54 +09:00
sched/core / kcov: avoid kcov_area during task switch
2018-06-15 07:55:24 +09:00
kexec: add call to LSM hook in original kexec_load syscall
2018-07-16 12:31:57 -07:00
kexec: Allocate decrypted control pages for kdump if SME is enabled
2018-10-06 12:01:51 +02:00
kernel/kexec_file.c: remove some duplicated includes
2018-11-03 10:09:37 -07:00
kprobes: Don't call BUG_ON() if there is a kprobe in use on free list
2018-09-12 08:01:16 +02:00
Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2018-08-13 11:25:07 -07:00
x86/entry: Add STACKLEAK erasing the kernel stack at the end of syscalls
2018-09-04 10:35:47 -07:00
Merge branch 'xarray' of git://git.infradead.org/users/willy/linux-dax
2018-10-28 11:35:40 -07:00
modsign: log module name in the event of an error
2018-07-02 11:36:17 +02:00
jump_table: Move entries into ro_after_init region
2018-09-27 17:56:49 +02:00
modsign: log module name in the event of an error
2018-07-02 11:36:17 +02:00
kernel/panic.c: filter out a potential trailing newline
2018-10-31 08:54:14 -07:00
mm: remove include/linux/bootmem.h
2018-10-31 08:54:16 -07:00
signal: Use group_send_sig_info to kill all processes in a pid namespace
2018-09-16 16:08:25 +02:00
mm: remove include/linux/bootmem.h
2018-10-31 08:54:16 -07:00
Merge branch 'siginfo-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace
2018-10-24 11:22:39 +01:00
kernel/reboot.c: export pm_power_off_prepare
2018-09-11 16:13:24 +01:00
kernel/relay.c: change return type to vm_fault_t
2018-06-15 07:55:24 +09:00
resource/docs: Complete kernel-doc style function documentation
2018-11-07 16:47:47 +01:00
rseq: uapi: Declare rseq_cs field as union, update includes
2018-07-10 22:18:52 +02:00
seccomp: add a return code to trap to userspace
2018-12-11 16:28:41 -08:00
kernel/signal.c: fix a comment error
2018-10-31 08:54:14 -07:00
smp,cpumask: introduce on_each_cpu_cond_mask
2018-10-09 16:51:11 +02:00
smpboot: Remove cpumask from the API
2018-07-03 09:20:44 +02:00
Merge branch 'irq-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2018-10-25 11:43:47 -07:00
stackleak: Allow runtime disabling of kernel stack erasing
2018-09-04 10:35:48 -07:00
Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2018-08-13 11:25:07 -07:00
kernel/sys.c: remove duplicated include
2018-09-20 22:01:11 +02:00
Merge branch 'core-rseq-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2018-06-10 10:17:09 -07:00
kernel/sysctl.c: remove duplicated include
2018-11-03 10:09:37 -07:00
kprobes: Remove jprobe API implementation
2018-06-21 12:33:05 +02:00
rcutorture: Check GP completion at stutter end
2018-08-29 09:20:48 -07:00
tracepoint: Fix tracepoint array element size mismatch
2018-10-17 15:35:29 -04:00
umh: Add command line to user mode helpers
2018-10-22 19:37:36 -07:00
smp,cpumask: introduce on_each_cpu_cond_mask
2018-10-09 16:51:11 +02:00
userns: use irqsave variant of refcount_dec_and_lock()
2018-08-22 10:52:47 -07:00
userns: also map extents in the reverse map to kernel IDs
2018-11-07 23:51:16 -06:00
sys: don't hold uts_sem while accessing userspace memory
2018-08-11 02:05:53 -05:00
watchdog: Mark watchdog touch functions as notrace
2018-08-30 12:56:40 +02:00
watchdog: Mark watchdog touch functions as notrace
2018-08-30 12:56:40 +02:00
watchdog: Mark watchdog touch functions as notrace
2018-08-30 12:56:40 +02:00
6a21cc50f0