linux-stable.git/kernel/seccomp.c, branch v4.17.2

seccomp: Move speculation migitation control to arch code

2018-05-04T22:51:44+00:00

The migitation control is simpler to implement in architecture code as it
avoids the extra function call to check the mode. Aside of that having an
explicit seccomp enabled mode in the architecture mitigations would require
even more workarounds.

Move it into architecture code and provide a weak function in the seccomp
code. Remove the 'which' argument as this allows the architecture to decide
which mitigations are relevant for seccomp.

Signed-off-by: Thomas Gleixner

seccomp: Add filter flag to opt-out of SSB mitigation

2018-05-04T22:51:44+00:00

If a seccomp user is not interested in Speculative Store Bypass mitigation
by default, it can set the new SECCOMP_FILTER_FLAG_SPEC_ALLOW flag when
adding filters.

Signed-off-by: Kees Cook 
Signed-off-by: Thomas Gleixner

seccomp: Use PR_SPEC_FORCE_DISABLE

2018-05-04T22:51:43+00:00

Use PR_SPEC_FORCE_DISABLE in seccomp() because seccomp does not allow to
widen restrictions.

Signed-off-by: Thomas Gleixner

seccomp: Enable speculation flaw mitigations

2018-05-03T11:55:52+00:00

When speculation flaw mitigations are opt-in (via prctl), using seccomp
will automatically opt-in to these protections, since using seccomp
indicates at least some level of sandboxing is desired.

Signed-off-by: Kees Cook 
Signed-off-by: Thomas Gleixner

Merge tag 'seccomp-v4.16-rc3' of https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux into fixes-v4.16-rc3

2018-02-22T18:50:24+00:00

- Fix seccomp GET_METADATA to deal with field sizes correctly (Tycho Andersen)
- Add selftest to make sure GET_METADATA doesn't regress (Tycho Andersen)

ptrace, seccomp: tweak get_metadata behavior slightly

2018-02-22T00:56:03+00:00

Previously if users passed a small size for the input structure size, they
would get get odd behavior. It doesn't make sense to pass a structure
smaller than at least filter_off size, so let's just give -EINVAL in this
case.

This changes userspace visible behavior, but was only introduced in commit
26500475ac1b ("ptrace, seccomp: add support for retrieving seccomp
metadata") in 4.16-rc2, so should be safe to change if merged before then.

Reported-by: Eugene Syromiatnikov 
Signed-off-by: Tycho Andersen 
CC: Kees Cook 
CC: Oleg Nesterov 
Signed-off-by: Kees Cook

Merge branch 'next-seccomp' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security

2018-01-31T21:44:45+00:00

Pull seccomp updates from James Morris:
 "Add support for retrieving seccomp metadata"

* 'next-seccomp' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  ptrace, seccomp: add support for retrieving seccomp metadata
  seccomp: hoist out filter resolving logic

signal: Replace memset(info,...) with clear_siginfo for clarity

2018-01-23T01:07:08+00:00

The function clear_siginfo is just a nice wrapper around memset so
this results in no functional change.  This change makes mistakes
a little more difficult and it makes it clearer what is going on.

Signed-off-by: "Eric W. Biederman"

ptrace, seccomp: add support for retrieving seccomp metadata

2017-11-28T23:41:01+00:00

With the new SECCOMP_FILTER_FLAG_LOG, we need to be able to extract these
flags for checkpoint restore, since they describe the state of a filter.

So, let's add PTRACE_SECCOMP_GET_METADATA, similar to ..._GET_FILTER, which
returns the metadata of the nth filter (right now, just the flags).
Hopefully this will be future proof, and new per-filter metadata can be
added to this struct.

Signed-off-by: Tycho Andersen 
CC: Kees Cook 
CC: Andy Lutomirski 
CC: Oleg Nesterov 
Signed-off-by: Kees Cook

seccomp: hoist out filter resolving logic

2017-11-28T23:36:01+00:00

Hoist out the nth filter resolving logic that ptrace uses into a new
function. We'll use this in the next patch to implement the new
PTRACE_SECCOMP_GET_FILTER_FLAGS command.

Signed-off-by: Tycho Andersen 
CC: Kees Cook 
CC: Andy Lutomirski 
CC: Oleg Nesterov 
Signed-off-by: Kees Cook