Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a4412fc9 authored by Andy Lutomirski's avatar Andy Lutomirski Committed by Kees Cook
Browse files

seccomp,x86,arm,mips,s390: Remove nr parameter from secure_computing 



The secure_computing function took a syscall number parameter, but
it only paid any attention to that parameter if seccomp mode 1 was
enabled.  Rather than coming up with a kludge to get the parameter
to work in mode 2, just remove the parameter.

To avoid churn in arches that don't have seccomp filters (and may
not even support syscall_get_nr right now), this leaves the
parameter in secure_computing_strict, which is now a real function.

For ARM, this is a bit ugly due to the fact that ARM conditionally
supports seccomp filters.  Fixing that would probably only be a
couple of lines of code, but it should be coordinated with the audit
maintainers.

This will be a slight slowdown on some arches.  The right fix is to
pass in all of seccomp_data instead of trying to make just the
syscall nr part be fast.

This is a prerequisite for making two-phase seccomp work cleanly.

Cc: Russell King <linux@arm.linux.org.uk>
Cc: linux-arm-kernel@lists.infradead.org
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: linux-mips@linux-mips.org
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: linux-s390@vger.kernel.org
Cc: x86@kernel.org
Cc: Kees Cook <keescook@chromium.org>
Signed-off-by: default avatarAndy Lutomirski <luto@amacapital.net>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
parent 70c8038d

arch/arm/kernel/ptrace.c

+6 −1
Original line number Diff line number Diff line
@@ -933,8 +933,13 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs, int scno) 
	current_thread_info()->syscall = scno;



	/* Do the secure computing check first; failures should be fast. */

	if (secure_computing(scno) == -1)

#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER

	if (secure_computing() == -1)

		return -1;

#else

	/* XXX: remove this once OABI gets fixed */

	secure_computing_strict(scno);

#endif



	if (test_thread_flag(TIF_SYSCALL_TRACE))

		tracehook_report_syscall(regs, PTRACE_SYSCALL_ENTER);

arch/mips/kernel/ptrace.c

+1 −1
Original line number Diff line number Diff line
@@ -770,7 +770,7 @@ asmlinkage long syscall_trace_enter(struct pt_regs *regs, long syscall) 
	long ret = 0;

	user_exit();



	if (secure_computing(syscall) == -1)

	if (secure_computing() == -1)

		return -1;



	if (test_thread_flag(TIF_SYSCALL_TRACE) &&

arch/s390/kernel/ptrace.c

+1 −1
Original line number Diff line number Diff line
@@ -803,7 +803,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs) 
	long ret = 0;



	/* Do the secure computing check first. */

	if (secure_computing(regs->gprs[2])) {

	if (secure_computing()) {

		/* seccomp failures shouldn't expose any additional code. */

		ret = -1;

		goto out;

arch/x86/kernel/ptrace.c

+1 −1
Original line number Diff line number Diff line
@@ -1471,7 +1471,7 @@ long syscall_trace_enter(struct pt_regs *regs) 
		regs->flags |= X86_EFLAGS_TF;



	/* do the secure computing check first */

	if (secure_computing(regs->orig_ax)) {

	if (secure_computing()) {

		/* seccomp failures shouldn't expose any additional code. */

		ret = -1L;

		goto out;

arch/x86/kernel/vsyscall_64.c

+1 −1
Original line number Diff line number Diff line
@@ -216,7 +216,7 @@ bool emulate_vsyscall(struct pt_regs *regs, unsigned long address) 
	 */

	regs->orig_ax = syscall_nr;

	regs->ax = -ENOSYS;

	tmp = secure_computing(syscall_nr);

	tmp = secure_computing();

	if ((!tmp && regs->orig_ax != syscall_nr) || regs->ip != address) {

		warn_bad_vsyscall(KERN_DEBUG, regs,

				  "seccomp tried to change syscall nr or ip");