Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1e30073c authored by Kees Cook's avatar Kees Cook Committed by Greg Kroah-Hartman
Browse files

seccomp: Invalidate seccomp mode to catch death failures 



commit 495ac3069a6235bfdf516812a2a9b256671bbdf9 upstream.

If seccomp tries to kill a process, it should never see that process
again. To enforce this proactively, switch the mode to something
impossible. If encountered: WARN, reject all syscalls, and attempt to
kill the process again even harder.

Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Will Drewry <wad@chromium.org>
Fixes: 8112c4f1 ("seccomp: remove 2-phase API")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent a3769078

kernel/seccomp.c

+10 −0
Original line number Diff line number Diff line
@@ -28,6 +28,9 @@ 
#include <linux/syscalls.h>

#include <linux/sysctl.h>



/* Not exposed in headers: strictly internal use only. */

#define SECCOMP_MODE_DEAD	(SECCOMP_MODE_FILTER + 1)



#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER

#include <asm/syscall.h>

#endif
@@ -706,6 +709,7 @@ static void __secure_computing_strict(int this_syscall) 
#ifdef SECCOMP_DEBUG

	dump_stack();

#endif

	current->seccomp.mode = SECCOMP_MODE_DEAD;

	seccomp_log(this_syscall, SIGKILL, SECCOMP_RET_KILL_THREAD, true);

	do_exit(SIGKILL);

}
@@ -892,6 +896,7 @@ static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd, 
	case SECCOMP_RET_KILL_THREAD:

	case SECCOMP_RET_KILL_PROCESS:

	default:

		current->seccomp.mode = SECCOMP_MODE_DEAD;

		seccomp_log(this_syscall, SIGSYS, action, true);

		/* Dump core only if this is the last remaining thread. */

		if (action == SECCOMP_RET_KILL_PROCESS ||
@@ -944,6 +949,11 @@ int __secure_computing(const struct seccomp_data *sd) 
		return 0;

	case SECCOMP_MODE_FILTER:

		return __seccomp_filter(this_syscall, sd, false);

	/* Surviving SECCOMP_RET_KILL_* must be proactively impossible. */

	case SECCOMP_MODE_DEAD:

		WARN_ON_ONCE(1);

		do_exit(SIGKILL);

		return -1;

	default:

		BUG();

	}