blob: 1285cb205d493112621cd2116ba7e6de8edbdc12 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * linux/kernel/seccomp.c
3 *
4 * Copyright 2004-2005 Andrea Arcangeli <andrea@cpushare.com>
5 *
Will Drewrye2cfabdf2012-04-12 16:47:57 -05006 * Copyright (C) 2012 Google, Inc.
7 * Will Drewry <wad@chromium.org>
8 *
9 * This defines a simple but solid secure-computing facility.
10 *
11 * Mode 1 uses a fixed list of allowed system calls.
12 * Mode 2 allows user-defined system call filters in the form
13 * of Berkeley Packet Filters/Linux Socket Filters.
Linus Torvalds1da177e2005-04-16 15:20:36 -070014 */
15
Will Drewrye2cfabdf2012-04-12 16:47:57 -050016#include <linux/atomic.h>
Eric Paris85e7bac32012-01-03 14:23:05 -050017#include <linux/audit.h>
Roland McGrath5b101742009-02-27 23:25:54 -080018#include <linux/compat.h>
Will Drewrye2cfabdf2012-04-12 16:47:57 -050019#include <linux/sched.h>
20#include <linux/seccomp.h>
Kees Cookc8bee432014-06-27 15:16:33 -070021#include <linux/slab.h>
Kees Cook48dc92b2014-06-25 16:08:24 -070022#include <linux/syscalls.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070023
Andy Lutomirskia4412fc2014-07-21 18:49:14 -070024#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
Will Drewrye2cfabdf2012-04-12 16:47:57 -050025#include <asm/syscall.h>
Andy Lutomirskia4412fc2014-07-21 18:49:14 -070026#endif
27
28#ifdef CONFIG_SECCOMP_FILTER
Will Drewrye2cfabdf2012-04-12 16:47:57 -050029#include <linux/filter.h>
Kees Cookc2e1f2e2014-06-05 00:23:17 -070030#include <linux/pid.h>
Will Drewryfb0fadf2012-04-12 16:48:02 -050031#include <linux/ptrace.h>
Will Drewrye2cfabdf2012-04-12 16:47:57 -050032#include <linux/security.h>
Will Drewrye2cfabdf2012-04-12 16:47:57 -050033#include <linux/tracehook.h>
34#include <linux/uaccess.h>
35
36/**
37 * struct seccomp_filter - container for seccomp BPF programs
38 *
39 * @usage: reference count to manage the object lifetime.
40 * get/put helpers should be used when accessing an instance
41 * outside of a lifetime-guarded section. In general, this
42 * is only needed for handling filters shared across tasks.
43 * @prev: points to a previously installed, or inherited, filter
44 * @len: the number of instructions in the program
Fabian Frederick119ce5c2014-06-06 14:37:53 -070045 * @insnsi: the BPF program instructions to evaluate
Will Drewrye2cfabdf2012-04-12 16:47:57 -050046 *
47 * seccomp_filter objects are organized in a tree linked via the @prev
48 * pointer. For any task, it appears to be a singly-linked list starting
49 * with current->seccomp.filter, the most recently attached or inherited filter.
50 * However, multiple filters may share a @prev node, by way of fork(), which
51 * results in a unidirectional tree existing in memory. This is similar to
52 * how namespaces work.
53 *
54 * seccomp_filter objects should never be modified after being attached
55 * to a task_struct (other than @usage).
56 */
57struct seccomp_filter {
58 atomic_t usage;
59 struct seccomp_filter *prev;
Alexei Starovoitov7ae457c2014-07-30 20:34:16 -070060 struct bpf_prog *prog;
Will Drewrye2cfabdf2012-04-12 16:47:57 -050061};
62
63/* Limit any path through the tree to 256KB worth of instructions. */
64#define MAX_INSNS_PER_PATH ((1 << 18) / sizeof(struct sock_filter))
65
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +010066/*
Will Drewrye2cfabdf2012-04-12 16:47:57 -050067 * Endianness is explicitly ignored and left for BPF program authors to manage
68 * as per the specific architecture.
69 */
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +010070static void populate_seccomp_data(struct seccomp_data *sd)
Will Drewrye2cfabdf2012-04-12 16:47:57 -050071{
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +010072 struct task_struct *task = current;
73 struct pt_regs *regs = task_pt_regs(task);
Daniel Borkmann2eac7642014-04-14 21:02:59 +020074 unsigned long args[6];
Will Drewrye2cfabdf2012-04-12 16:47:57 -050075
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +010076 sd->nr = syscall_get_nr(task, regs);
Linus Torvalds0b747172014-04-12 12:38:53 -070077 sd->arch = syscall_get_arch();
Daniel Borkmann2eac7642014-04-14 21:02:59 +020078 syscall_get_arguments(task, regs, 0, 6, args);
79 sd->args[0] = args[0];
80 sd->args[1] = args[1];
81 sd->args[2] = args[2];
82 sd->args[3] = args[3];
83 sd->args[4] = args[4];
84 sd->args[5] = args[5];
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +010085 sd->instruction_pointer = KSTK_EIP(task);
Will Drewrye2cfabdf2012-04-12 16:47:57 -050086}
87
88/**
89 * seccomp_check_filter - verify seccomp filter code
90 * @filter: filter to verify
91 * @flen: length of filter
92 *
Alexei Starovoitov4df95ff2014-07-30 20:34:14 -070093 * Takes a previously checked filter (by bpf_check_classic) and
Will Drewrye2cfabdf2012-04-12 16:47:57 -050094 * redirects all filter code that loads struct sk_buff data
95 * and related data through seccomp_bpf_load. It also
96 * enforces length and alignment checking of those loads.
97 *
98 * Returns 0 if the rule set is legal or -EINVAL if not.
99 */
100static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen)
101{
102 int pc;
103 for (pc = 0; pc < flen; pc++) {
104 struct sock_filter *ftest = &filter[pc];
105 u16 code = ftest->code;
106 u32 k = ftest->k;
107
108 switch (code) {
Daniel Borkmann34805932014-05-29 10:22:50 +0200109 case BPF_LD | BPF_W | BPF_ABS:
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100110 ftest->code = BPF_LDX | BPF_W | BPF_ABS;
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500111 /* 32-bit aligned and not out of bounds. */
112 if (k >= sizeof(struct seccomp_data) || k & 3)
113 return -EINVAL;
114 continue;
Daniel Borkmann34805932014-05-29 10:22:50 +0200115 case BPF_LD | BPF_W | BPF_LEN:
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100116 ftest->code = BPF_LD | BPF_IMM;
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500117 ftest->k = sizeof(struct seccomp_data);
118 continue;
Daniel Borkmann34805932014-05-29 10:22:50 +0200119 case BPF_LDX | BPF_W | BPF_LEN:
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100120 ftest->code = BPF_LDX | BPF_IMM;
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500121 ftest->k = sizeof(struct seccomp_data);
122 continue;
123 /* Explicitly include allowed calls. */
Daniel Borkmann34805932014-05-29 10:22:50 +0200124 case BPF_RET | BPF_K:
125 case BPF_RET | BPF_A:
126 case BPF_ALU | BPF_ADD | BPF_K:
127 case BPF_ALU | BPF_ADD | BPF_X:
128 case BPF_ALU | BPF_SUB | BPF_K:
129 case BPF_ALU | BPF_SUB | BPF_X:
130 case BPF_ALU | BPF_MUL | BPF_K:
131 case BPF_ALU | BPF_MUL | BPF_X:
132 case BPF_ALU | BPF_DIV | BPF_K:
133 case BPF_ALU | BPF_DIV | BPF_X:
134 case BPF_ALU | BPF_AND | BPF_K:
135 case BPF_ALU | BPF_AND | BPF_X:
136 case BPF_ALU | BPF_OR | BPF_K:
137 case BPF_ALU | BPF_OR | BPF_X:
138 case BPF_ALU | BPF_XOR | BPF_K:
139 case BPF_ALU | BPF_XOR | BPF_X:
140 case BPF_ALU | BPF_LSH | BPF_K:
141 case BPF_ALU | BPF_LSH | BPF_X:
142 case BPF_ALU | BPF_RSH | BPF_K:
143 case BPF_ALU | BPF_RSH | BPF_X:
144 case BPF_ALU | BPF_NEG:
145 case BPF_LD | BPF_IMM:
146 case BPF_LDX | BPF_IMM:
147 case BPF_MISC | BPF_TAX:
148 case BPF_MISC | BPF_TXA:
149 case BPF_LD | BPF_MEM:
150 case BPF_LDX | BPF_MEM:
151 case BPF_ST:
152 case BPF_STX:
153 case BPF_JMP | BPF_JA:
154 case BPF_JMP | BPF_JEQ | BPF_K:
155 case BPF_JMP | BPF_JEQ | BPF_X:
156 case BPF_JMP | BPF_JGE | BPF_K:
157 case BPF_JMP | BPF_JGE | BPF_X:
158 case BPF_JMP | BPF_JGT | BPF_K:
159 case BPF_JMP | BPF_JGT | BPF_X:
160 case BPF_JMP | BPF_JSET | BPF_K:
161 case BPF_JMP | BPF_JSET | BPF_X:
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500162 continue;
163 default:
164 return -EINVAL;
165 }
166 }
167 return 0;
168}
169
170/**
171 * seccomp_run_filters - evaluates all seccomp filters against @syscall
172 * @syscall: number of the current system call
173 *
174 * Returns valid seccomp BPF response codes.
175 */
Andy Lutomirskid39bd002014-07-21 18:49:16 -0700176static u32 seccomp_run_filters(struct seccomp_data *sd)
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500177{
Kees Cook3ba25302014-06-27 15:01:35 -0700178 struct seccomp_filter *f = ACCESS_ONCE(current->seccomp.filter);
Andy Lutomirskid39bd002014-07-21 18:49:16 -0700179 struct seccomp_data sd_local;
Will Drewryacf3b2c2012-04-12 16:47:59 -0500180 u32 ret = SECCOMP_RET_ALLOW;
181
182 /* Ensure unexpected behavior doesn't result in failing open. */
Kees Cook3ba25302014-06-27 15:01:35 -0700183 if (unlikely(WARN_ON(f == NULL)))
Will Drewryacf3b2c2012-04-12 16:47:59 -0500184 return SECCOMP_RET_KILL;
185
Kees Cook3ba25302014-06-27 15:01:35 -0700186 /* Make sure cross-thread synced filter points somewhere sane. */
187 smp_read_barrier_depends();
188
Andy Lutomirskid39bd002014-07-21 18:49:16 -0700189 if (!sd) {
190 populate_seccomp_data(&sd_local);
191 sd = &sd_local;
192 }
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100193
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500194 /*
195 * All filters in the list are evaluated and the lowest BPF return
Will Drewryacf3b2c2012-04-12 16:47:59 -0500196 * value always takes priority (ignoring the DATA).
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500197 */
Kees Cook3ba25302014-06-27 15:01:35 -0700198 for (; f; f = f->prev) {
Andy Lutomirskid39bd002014-07-21 18:49:16 -0700199 u32 cur_ret = BPF_PROG_RUN(f->prog, (void *)sd);
Alexei Starovoitov8f577ca2014-05-13 19:50:47 -0700200
Will Drewryacf3b2c2012-04-12 16:47:59 -0500201 if ((cur_ret & SECCOMP_RET_ACTION) < (ret & SECCOMP_RET_ACTION))
202 ret = cur_ret;
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500203 }
204 return ret;
205}
Kees Cook1f41b4502014-06-25 15:38:02 -0700206#endif /* CONFIG_SECCOMP_FILTER */
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500207
Kees Cook1f41b4502014-06-25 15:38:02 -0700208static inline bool seccomp_may_assign_mode(unsigned long seccomp_mode)
209{
Guenter Roeck69f6a342014-08-10 20:50:30 -0700210 assert_spin_locked(&current->sighand->siglock);
Kees Cookdbd952122014-06-27 15:18:48 -0700211
Kees Cook1f41b4502014-06-25 15:38:02 -0700212 if (current->seccomp.mode && current->seccomp.mode != seccomp_mode)
213 return false;
214
215 return true;
216}
217
Kees Cook3ba25302014-06-27 15:01:35 -0700218static inline void seccomp_assign_mode(struct task_struct *task,
219 unsigned long seccomp_mode)
Kees Cook1f41b4502014-06-25 15:38:02 -0700220{
Guenter Roeck69f6a342014-08-10 20:50:30 -0700221 assert_spin_locked(&task->sighand->siglock);
Kees Cookdbd952122014-06-27 15:18:48 -0700222
Kees Cook3ba25302014-06-27 15:01:35 -0700223 task->seccomp.mode = seccomp_mode;
224 /*
225 * Make sure TIF_SECCOMP cannot be set before the mode (and
226 * filter) is set.
227 */
228 smp_mb__before_atomic();
229 set_tsk_thread_flag(task, TIF_SECCOMP);
Kees Cook1f41b4502014-06-25 15:38:02 -0700230}
231
232#ifdef CONFIG_SECCOMP_FILTER
Kees Cookc2e1f2e2014-06-05 00:23:17 -0700233/* Returns 1 if the parent is an ancestor of the child. */
234static int is_ancestor(struct seccomp_filter *parent,
235 struct seccomp_filter *child)
236{
237 /* NULL is the root ancestor. */
238 if (parent == NULL)
239 return 1;
240 for (; child; child = child->prev)
241 if (child == parent)
242 return 1;
243 return 0;
244}
245
246/**
247 * seccomp_can_sync_threads: checks if all threads can be synchronized
248 *
249 * Expects sighand and cred_guard_mutex locks to be held.
250 *
251 * Returns 0 on success, -ve on error, or the pid of a thread which was
252 * either not in the correct seccomp mode or it did not have an ancestral
253 * seccomp filter.
254 */
255static inline pid_t seccomp_can_sync_threads(void)
256{
257 struct task_struct *thread, *caller;
258
259 BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
Guenter Roeck69f6a342014-08-10 20:50:30 -0700260 assert_spin_locked(&current->sighand->siglock);
Kees Cookc2e1f2e2014-06-05 00:23:17 -0700261
262 /* Validate all threads being eligible for synchronization. */
263 caller = current;
264 for_each_thread(caller, thread) {
265 pid_t failed;
266
267 /* Skip current, since it is initiating the sync. */
268 if (thread == caller)
269 continue;
270
271 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED ||
272 (thread->seccomp.mode == SECCOMP_MODE_FILTER &&
273 is_ancestor(thread->seccomp.filter,
274 caller->seccomp.filter)))
275 continue;
276
277 /* Return the first thread that cannot be synchronized. */
278 failed = task_pid_vnr(thread);
279 /* If the pid cannot be resolved, then return -ESRCH */
280 if (unlikely(WARN_ON(failed == 0)))
281 failed = -ESRCH;
282 return failed;
283 }
284
285 return 0;
286}
287
288/**
289 * seccomp_sync_threads: sets all threads to use current's filter
290 *
291 * Expects sighand and cred_guard_mutex locks to be held, and for
292 * seccomp_can_sync_threads() to have returned success already
293 * without dropping the locks.
294 *
295 */
296static inline void seccomp_sync_threads(void)
297{
298 struct task_struct *thread, *caller;
299
300 BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
Guenter Roeck69f6a342014-08-10 20:50:30 -0700301 assert_spin_locked(&current->sighand->siglock);
Kees Cookc2e1f2e2014-06-05 00:23:17 -0700302
303 /* Synchronize all threads. */
304 caller = current;
305 for_each_thread(caller, thread) {
306 /* Skip current, since it needs no changes. */
307 if (thread == caller)
308 continue;
309
310 /* Get a task reference for the new leaf node. */
311 get_seccomp_filter(caller);
312 /*
313 * Drop the task reference to the shared ancestor since
314 * current's path will hold a reference. (This also
315 * allows a put before the assignment.)
316 */
317 put_seccomp_filter(thread);
318 smp_store_release(&thread->seccomp.filter,
319 caller->seccomp.filter);
320 /*
321 * Opt the other thread into seccomp if needed.
322 * As threads are considered to be trust-realm
323 * equivalent (see ptrace_may_access), it is safe to
324 * allow one thread to transition the other.
325 */
326 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED) {
327 /*
328 * Don't let an unprivileged task work around
329 * the no_new_privs restriction by creating
330 * a thread that sets it up, enters seccomp,
331 * then dies.
332 */
333 if (task_no_new_privs(caller))
334 task_set_no_new_privs(thread);
335
336 seccomp_assign_mode(thread, SECCOMP_MODE_FILTER);
337 }
338 }
339}
340
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500341/**
Kees Cookc8bee432014-06-27 15:16:33 -0700342 * seccomp_prepare_filter: Prepares a seccomp filter for use.
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500343 * @fprog: BPF program to install
344 *
Kees Cookc8bee432014-06-27 15:16:33 -0700345 * Returns filter on success or an ERR_PTR on failure.
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500346 */
Kees Cookc8bee432014-06-27 15:16:33 -0700347static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog)
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500348{
349 struct seccomp_filter *filter;
Kees Cookc8bee432014-06-27 15:16:33 -0700350 unsigned long fp_size;
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100351 struct sock_filter *fp;
352 int new_len;
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500353 long ret;
354
355 if (fprog->len == 0 || fprog->len > BPF_MAXINSNS)
Kees Cookc8bee432014-06-27 15:16:33 -0700356 return ERR_PTR(-EINVAL);
357 BUG_ON(INT_MAX / fprog->len < sizeof(struct sock_filter));
358 fp_size = fprog->len * sizeof(struct sock_filter);
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500359
360 /*
Fabian Frederick119ce5c2014-06-06 14:37:53 -0700361 * Installing a seccomp filter requires that the task has
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500362 * CAP_SYS_ADMIN in its namespace or be running with no_new_privs.
363 * This avoids scenarios where unprivileged tasks can affect the
364 * behavior of privileged children.
365 */
Kees Cook1d4457f2014-05-21 15:23:46 -0700366 if (!task_no_new_privs(current) &&
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500367 security_capable_noaudit(current_cred(), current_user_ns(),
368 CAP_SYS_ADMIN) != 0)
Kees Cookc8bee432014-06-27 15:16:33 -0700369 return ERR_PTR(-EACCES);
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500370
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100371 fp = kzalloc(fp_size, GFP_KERNEL|__GFP_NOWARN);
372 if (!fp)
Kees Cookc8bee432014-06-27 15:16:33 -0700373 return ERR_PTR(-ENOMEM);
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500374
375 /* Copy the instructions from fprog. */
376 ret = -EFAULT;
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100377 if (copy_from_user(fp, fprog->filter, fp_size))
378 goto free_prog;
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500379
380 /* Check and rewrite the fprog via the skb checker */
Alexei Starovoitov4df95ff2014-07-30 20:34:14 -0700381 ret = bpf_check_classic(fp, fprog->len);
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500382 if (ret)
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100383 goto free_prog;
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500384
385 /* Check and rewrite the fprog for seccomp use */
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100386 ret = seccomp_check_filter(fp, fprog->len);
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500387 if (ret)
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100388 goto free_prog;
389
Alexei Starovoitov2695fb52014-07-24 16:38:21 -0700390 /* Convert 'sock_filter' insns to 'bpf_insn' insns */
Alexei Starovoitov8fb575c2014-07-30 20:34:15 -0700391 ret = bpf_convert_filter(fp, fprog->len, NULL, &new_len);
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100392 if (ret)
393 goto free_prog;
394
395 /* Allocate a new seccomp_filter */
Kees Cook0acf07d2014-04-16 10:54:34 -0700396 ret = -ENOMEM;
Alexei Starovoitov8f577ca2014-05-13 19:50:47 -0700397 filter = kzalloc(sizeof(struct seccomp_filter),
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100398 GFP_KERNEL|__GFP_NOWARN);
399 if (!filter)
400 goto free_prog;
401
Alexei Starovoitov7ae457c2014-07-30 20:34:16 -0700402 filter->prog = kzalloc(bpf_prog_size(new_len),
Alexei Starovoitov8f577ca2014-05-13 19:50:47 -0700403 GFP_KERNEL|__GFP_NOWARN);
404 if (!filter->prog)
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100405 goto free_filter;
Alexei Starovoitov8f577ca2014-05-13 19:50:47 -0700406
Alexei Starovoitov8fb575c2014-07-30 20:34:15 -0700407 ret = bpf_convert_filter(fp, fprog->len, filter->prog->insnsi, &new_len);
Alexei Starovoitov8f577ca2014-05-13 19:50:47 -0700408 if (ret)
409 goto free_filter_prog;
Kees Cook0acf07d2014-04-16 10:54:34 -0700410 kfree(fp);
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100411
412 atomic_set(&filter->usage, 1);
Alexei Starovoitov8f577ca2014-05-13 19:50:47 -0700413 filter->prog->len = new_len;
Alexei Starovoitov8f577ca2014-05-13 19:50:47 -0700414
Alexei Starovoitov7ae457c2014-07-30 20:34:16 -0700415 bpf_prog_select_runtime(filter->prog);
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500416
Kees Cookc8bee432014-06-27 15:16:33 -0700417 return filter;
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100418
Alexei Starovoitov8f577ca2014-05-13 19:50:47 -0700419free_filter_prog:
420 kfree(filter->prog);
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100421free_filter:
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500422 kfree(filter);
Alexei Starovoitovbd4cf0e2014-03-28 18:58:25 +0100423free_prog:
424 kfree(fp);
Kees Cookc8bee432014-06-27 15:16:33 -0700425 return ERR_PTR(ret);
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500426}
427
428/**
Kees Cookc8bee432014-06-27 15:16:33 -0700429 * seccomp_prepare_user_filter - prepares a user-supplied sock_fprog
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500430 * @user_filter: pointer to the user data containing a sock_fprog.
431 *
432 * Returns 0 on success and non-zero otherwise.
433 */
Kees Cookc8bee432014-06-27 15:16:33 -0700434static struct seccomp_filter *
435seccomp_prepare_user_filter(const char __user *user_filter)
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500436{
437 struct sock_fprog fprog;
Kees Cookc8bee432014-06-27 15:16:33 -0700438 struct seccomp_filter *filter = ERR_PTR(-EFAULT);
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500439
440#ifdef CONFIG_COMPAT
441 if (is_compat_task()) {
442 struct compat_sock_fprog fprog32;
443 if (copy_from_user(&fprog32, user_filter, sizeof(fprog32)))
444 goto out;
445 fprog.len = fprog32.len;
446 fprog.filter = compat_ptr(fprog32.filter);
447 } else /* falls through to the if below. */
448#endif
449 if (copy_from_user(&fprog, user_filter, sizeof(fprog)))
450 goto out;
Kees Cookc8bee432014-06-27 15:16:33 -0700451 filter = seccomp_prepare_filter(&fprog);
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500452out:
Kees Cookc8bee432014-06-27 15:16:33 -0700453 return filter;
454}
455
456/**
457 * seccomp_attach_filter: validate and attach filter
458 * @flags: flags to change filter behavior
459 * @filter: seccomp filter to add to the current process
460 *
Kees Cookdbd952122014-06-27 15:18:48 -0700461 * Caller must be holding current->sighand->siglock lock.
462 *
Kees Cookc8bee432014-06-27 15:16:33 -0700463 * Returns 0 on success, -ve on error.
464 */
465static long seccomp_attach_filter(unsigned int flags,
466 struct seccomp_filter *filter)
467{
468 unsigned long total_insns;
469 struct seccomp_filter *walker;
470
Guenter Roeck69f6a342014-08-10 20:50:30 -0700471 assert_spin_locked(&current->sighand->siglock);
Kees Cookdbd952122014-06-27 15:18:48 -0700472
Kees Cookc8bee432014-06-27 15:16:33 -0700473 /* Validate resulting filter length. */
474 total_insns = filter->prog->len;
475 for (walker = current->seccomp.filter; walker; walker = walker->prev)
476 total_insns += walker->prog->len + 4; /* 4 instr penalty */
477 if (total_insns > MAX_INSNS_PER_PATH)
478 return -ENOMEM;
479
Kees Cookc2e1f2e2014-06-05 00:23:17 -0700480 /* If thread sync has been requested, check that it is possible. */
481 if (flags & SECCOMP_FILTER_FLAG_TSYNC) {
482 int ret;
483
484 ret = seccomp_can_sync_threads();
485 if (ret)
486 return ret;
487 }
488
Kees Cookc8bee432014-06-27 15:16:33 -0700489 /*
490 * If there is an existing filter, make it the prev and don't drop its
491 * task reference.
492 */
493 filter->prev = current->seccomp.filter;
494 current->seccomp.filter = filter;
495
Kees Cookc2e1f2e2014-06-05 00:23:17 -0700496 /* Now that the new filter is in place, synchronize to all threads. */
497 if (flags & SECCOMP_FILTER_FLAG_TSYNC)
498 seccomp_sync_threads();
499
Kees Cookc8bee432014-06-27 15:16:33 -0700500 return 0;
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500501}
502
503/* get_seccomp_filter - increments the reference count of the filter on @tsk */
504void get_seccomp_filter(struct task_struct *tsk)
505{
506 struct seccomp_filter *orig = tsk->seccomp.filter;
507 if (!orig)
508 return;
509 /* Reference count is bounded by the number of total processes. */
510 atomic_inc(&orig->usage);
511}
512
Kees Cookc8bee432014-06-27 15:16:33 -0700513static inline void seccomp_filter_free(struct seccomp_filter *filter)
514{
515 if (filter) {
Linus Torvaldsae045e22014-08-06 09:38:14 -0700516 bpf_prog_free(filter->prog);
Kees Cookc8bee432014-06-27 15:16:33 -0700517 kfree(filter);
518 }
519}
520
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500521/* put_seccomp_filter - decrements the ref count of tsk->seccomp.filter */
522void put_seccomp_filter(struct task_struct *tsk)
523{
524 struct seccomp_filter *orig = tsk->seccomp.filter;
525 /* Clean up single-reference branches iteratively. */
526 while (orig && atomic_dec_and_test(&orig->usage)) {
527 struct seccomp_filter *freeme = orig;
528 orig = orig->prev;
Kees Cookc8bee432014-06-27 15:16:33 -0700529 seccomp_filter_free(freeme);
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500530 }
531}
Will Drewrybb6ea432012-04-12 16:48:01 -0500532
533/**
534 * seccomp_send_sigsys - signals the task to allow in-process syscall emulation
535 * @syscall: syscall number to send to userland
536 * @reason: filter-supplied reason code to send to userland (via si_errno)
537 *
538 * Forces a SIGSYS with a code of SYS_SECCOMP and related sigsys info.
539 */
540static void seccomp_send_sigsys(int syscall, int reason)
541{
542 struct siginfo info;
543 memset(&info, 0, sizeof(info));
544 info.si_signo = SIGSYS;
545 info.si_code = SYS_SECCOMP;
546 info.si_call_addr = (void __user *)KSTK_EIP(current);
547 info.si_errno = reason;
Eric Paris5e937a92014-03-11 12:48:43 -0400548 info.si_arch = syscall_get_arch();
Will Drewrybb6ea432012-04-12 16:48:01 -0500549 info.si_syscall = syscall;
550 force_sig_info(SIGSYS, &info, current);
551}
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500552#endif /* CONFIG_SECCOMP_FILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700553
554/*
555 * Secure computing mode 1 allows only read/write/exit/sigreturn.
556 * To be fully secure this must be combined with rlimit
557 * to limit the stack allocations too.
558 */
559static int mode1_syscalls[] = {
560 __NR_seccomp_read, __NR_seccomp_write, __NR_seccomp_exit, __NR_seccomp_sigreturn,
561 0, /* null terminated */
562};
563
Roland McGrath5b101742009-02-27 23:25:54 -0800564#ifdef CONFIG_COMPAT
Linus Torvalds1da177e2005-04-16 15:20:36 -0700565static int mode1_syscalls_32[] = {
566 __NR_seccomp_read_32, __NR_seccomp_write_32, __NR_seccomp_exit_32, __NR_seccomp_sigreturn_32,
567 0, /* null terminated */
568};
569#endif
570
Andy Lutomirskia4412fc2014-07-21 18:49:14 -0700571static void __secure_computing_strict(int this_syscall)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700572{
Andy Lutomirskia4412fc2014-07-21 18:49:14 -0700573 int *syscall_whitelist = mode1_syscalls;
574#ifdef CONFIG_COMPAT
575 if (is_compat_task())
576 syscall_whitelist = mode1_syscalls_32;
577#endif
578 do {
579 if (*syscall_whitelist == this_syscall)
580 return;
581 } while (*++syscall_whitelist);
582
583#ifdef SECCOMP_DEBUG
584 dump_stack();
585#endif
586 audit_seccomp(this_syscall, SIGKILL, SECCOMP_RET_KILL);
587 do_exit(SIGKILL);
588}
589
590#ifndef CONFIG_HAVE_ARCH_SECCOMP_FILTER
591void secure_computing_strict(int this_syscall)
592{
593 int mode = current->seccomp.mode;
594
595 if (mode == 0)
596 return;
597 else if (mode == SECCOMP_MODE_STRICT)
598 __secure_computing_strict(this_syscall);
599 else
600 BUG();
601}
602#else
603int __secure_computing(void)
604{
Andy Lutomirskid39bd002014-07-21 18:49:16 -0700605 u32 phase1_result = seccomp_phase1(NULL);
Andy Lutomirski13aa72f2014-07-21 18:49:15 -0700606
607 if (likely(phase1_result == SECCOMP_PHASE1_OK))
608 return 0;
609 else if (likely(phase1_result == SECCOMP_PHASE1_SKIP))
610 return -1;
611 else
612 return seccomp_phase2(phase1_result);
613}
614
615#ifdef CONFIG_SECCOMP_FILTER
Andy Lutomirskid39bd002014-07-21 18:49:16 -0700616static u32 __seccomp_phase1_filter(int this_syscall, struct seccomp_data *sd)
Andy Lutomirski13aa72f2014-07-21 18:49:15 -0700617{
618 u32 filter_ret, action;
619 int data;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700620
Kees Cook3ba25302014-06-27 15:01:35 -0700621 /*
622 * Make sure that any changes to mode from another thread have
623 * been seen after TIF_SECCOMP was seen.
624 */
625 rmb();
626
Andy Lutomirskid39bd002014-07-21 18:49:16 -0700627 filter_ret = seccomp_run_filters(sd);
Andy Lutomirski13aa72f2014-07-21 18:49:15 -0700628 data = filter_ret & SECCOMP_RET_DATA;
629 action = filter_ret & SECCOMP_RET_ACTION;
Andy Lutomirski87b526d2012-10-01 11:40:45 -0700630
Andy Lutomirski13aa72f2014-07-21 18:49:15 -0700631 switch (action) {
632 case SECCOMP_RET_ERRNO:
633 /* Set the low-order 16-bits as a errno. */
Andy Lutomirskid39bd002014-07-21 18:49:16 -0700634 syscall_set_return_value(current, task_pt_regs(current),
Andy Lutomirski13aa72f2014-07-21 18:49:15 -0700635 -data, 0);
636 goto skip;
637
638 case SECCOMP_RET_TRAP:
639 /* Show the handler the original registers. */
Andy Lutomirskid39bd002014-07-21 18:49:16 -0700640 syscall_rollback(current, task_pt_regs(current));
Andy Lutomirski13aa72f2014-07-21 18:49:15 -0700641 /* Let the filter pass back 16 bits of data. */
642 seccomp_send_sigsys(this_syscall, data);
643 goto skip;
644
645 case SECCOMP_RET_TRACE:
646 return filter_ret; /* Save the rest for phase 2. */
647
648 case SECCOMP_RET_ALLOW:
649 return SECCOMP_PHASE1_OK;
650
651 case SECCOMP_RET_KILL:
652 default:
653 audit_seccomp(this_syscall, SIGSYS, action);
654 do_exit(SIGSYS);
Will Drewry8156b452012-04-17 14:48:58 -0500655 }
Andy Lutomirski13aa72f2014-07-21 18:49:15 -0700656
657 unreachable();
658
659skip:
660 audit_seccomp(this_syscall, 0, action);
661 return SECCOMP_PHASE1_SKIP;
662}
663#endif
664
665/**
666 * seccomp_phase1() - run fast path seccomp checks on the current syscall
Andy Lutomirskid39bd002014-07-21 18:49:16 -0700667 * @arg sd: The seccomp_data or NULL
Andy Lutomirski13aa72f2014-07-21 18:49:15 -0700668 *
669 * This only reads pt_regs via the syscall_xyz helpers. The only change
670 * it will make to pt_regs is via syscall_set_return_value, and it will
671 * only do that if it returns SECCOMP_PHASE1_SKIP.
672 *
Andy Lutomirskid39bd002014-07-21 18:49:16 -0700673 * If sd is provided, it will not read pt_regs at all.
674 *
Andy Lutomirski13aa72f2014-07-21 18:49:15 -0700675 * It may also call do_exit or force a signal; these actions must be
676 * safe.
677 *
678 * If it returns SECCOMP_PHASE1_OK, the syscall passes checks and should
679 * be processed normally.
680 *
681 * If it returns SECCOMP_PHASE1_SKIP, then the syscall should not be
682 * invoked. In this case, seccomp_phase1 will have set the return value
683 * using syscall_set_return_value.
684 *
685 * If it returns anything else, then the return value should be passed
686 * to seccomp_phase2 from a context in which ptrace hooks are safe.
687 */
Andy Lutomirskid39bd002014-07-21 18:49:16 -0700688u32 seccomp_phase1(struct seccomp_data *sd)
Andy Lutomirski13aa72f2014-07-21 18:49:15 -0700689{
690 int mode = current->seccomp.mode;
Andy Lutomirskid39bd002014-07-21 18:49:16 -0700691 int this_syscall = sd ? sd->nr :
692 syscall_get_nr(current, task_pt_regs(current));
Andy Lutomirski13aa72f2014-07-21 18:49:15 -0700693
694 switch (mode) {
695 case SECCOMP_MODE_STRICT:
696 __secure_computing_strict(this_syscall); /* may call do_exit */
697 return SECCOMP_PHASE1_OK;
698#ifdef CONFIG_SECCOMP_FILTER
699 case SECCOMP_MODE_FILTER:
Andy Lutomirskid39bd002014-07-21 18:49:16 -0700700 return __seccomp_phase1_filter(this_syscall, sd);
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500701#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -0700702 default:
703 BUG();
704 }
Andy Lutomirski13aa72f2014-07-21 18:49:15 -0700705}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700706
Andy Lutomirski13aa72f2014-07-21 18:49:15 -0700707/**
708 * seccomp_phase2() - finish slow path seccomp work for the current syscall
709 * @phase1_result: The return value from seccomp_phase1()
710 *
711 * This must be called from a context in which ptrace hooks can be used.
712 *
713 * Returns 0 if the syscall should be processed or -1 to skip the syscall.
714 */
715int seccomp_phase2(u32 phase1_result)
716{
717 struct pt_regs *regs = task_pt_regs(current);
718 u32 action = phase1_result & SECCOMP_RET_ACTION;
719 int data = phase1_result & SECCOMP_RET_DATA;
720
721 BUG_ON(action != SECCOMP_RET_TRACE);
722
723 audit_seccomp(syscall_get_nr(current, regs), 0, action);
724
725 /* Skip these calls if there is no tracer. */
726 if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP)) {
727 syscall_set_return_value(current, regs,
728 -ENOSYS, 0);
729 return -1;
730 }
731
732 /* Allow the BPF to provide the event message */
733 ptrace_event(PTRACE_EVENT_SECCOMP, data);
734 /*
735 * The delivery of a fatal signal during event
736 * notification may silently skip tracer notification.
737 * Terminating the task now avoids executing a system
738 * call that may not be intended.
739 */
740 if (fatal_signal_pending(current))
741 do_exit(SIGSYS);
742 if (syscall_get_nr(current, regs) < 0)
743 return -1; /* Explicit request to skip. */
744
745 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700746}
Andy Lutomirskia4412fc2014-07-21 18:49:14 -0700747#endif /* CONFIG_HAVE_ARCH_SECCOMP_FILTER */
Andrea Arcangeli1d9d02f2007-07-15 23:41:32 -0700748
749long prctl_get_seccomp(void)
750{
751 return current->seccomp.mode;
752}
753
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500754/**
Kees Cook3b23dd12014-06-25 15:55:25 -0700755 * seccomp_set_mode_strict: internal function for setting strict seccomp
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500756 *
757 * Once current->seccomp.mode is non-zero, it may not be changed.
758 *
759 * Returns 0 on success or -EINVAL on failure.
760 */
Kees Cook3b23dd12014-06-25 15:55:25 -0700761static long seccomp_set_mode_strict(void)
Andrea Arcangeli1d9d02f2007-07-15 23:41:32 -0700762{
Kees Cook3b23dd12014-06-25 15:55:25 -0700763 const unsigned long seccomp_mode = SECCOMP_MODE_STRICT;
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500764 long ret = -EINVAL;
Andrea Arcangeli1d9d02f2007-07-15 23:41:32 -0700765
Kees Cookdbd952122014-06-27 15:18:48 -0700766 spin_lock_irq(&current->sighand->siglock);
767
Kees Cook1f41b4502014-06-25 15:38:02 -0700768 if (!seccomp_may_assign_mode(seccomp_mode))
Andrea Arcangeli1d9d02f2007-07-15 23:41:32 -0700769 goto out;
770
Andrea Arcangelicf99aba2007-07-15 23:41:33 -0700771#ifdef TIF_NOTSC
Kees Cook3b23dd12014-06-25 15:55:25 -0700772 disable_TSC();
Andrea Arcangelicf99aba2007-07-15 23:41:33 -0700773#endif
Kees Cook3ba25302014-06-27 15:01:35 -0700774 seccomp_assign_mode(current, seccomp_mode);
Kees Cook3b23dd12014-06-25 15:55:25 -0700775 ret = 0;
776
777out:
Kees Cookdbd952122014-06-27 15:18:48 -0700778 spin_unlock_irq(&current->sighand->siglock);
Kees Cook3b23dd12014-06-25 15:55:25 -0700779
780 return ret;
781}
782
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500783#ifdef CONFIG_SECCOMP_FILTER
Kees Cook3b23dd12014-06-25 15:55:25 -0700784/**
785 * seccomp_set_mode_filter: internal function for setting seccomp filter
Kees Cook48dc92b2014-06-25 16:08:24 -0700786 * @flags: flags to change filter behavior
Kees Cook3b23dd12014-06-25 15:55:25 -0700787 * @filter: struct sock_fprog containing filter
788 *
789 * This function may be called repeatedly to install additional filters.
790 * Every filter successfully installed will be evaluated (in reverse order)
791 * for each system call the task makes.
792 *
793 * Once current->seccomp.mode is non-zero, it may not be changed.
794 *
795 * Returns 0 on success or -EINVAL on failure.
796 */
Kees Cook48dc92b2014-06-25 16:08:24 -0700797static long seccomp_set_mode_filter(unsigned int flags,
798 const char __user *filter)
Kees Cook3b23dd12014-06-25 15:55:25 -0700799{
800 const unsigned long seccomp_mode = SECCOMP_MODE_FILTER;
Kees Cookc8bee432014-06-27 15:16:33 -0700801 struct seccomp_filter *prepared = NULL;
Kees Cook3b23dd12014-06-25 15:55:25 -0700802 long ret = -EINVAL;
803
Kees Cook48dc92b2014-06-25 16:08:24 -0700804 /* Validate flags. */
Kees Cookc2e1f2e2014-06-05 00:23:17 -0700805 if (flags & ~SECCOMP_FILTER_FLAG_MASK)
Kees Cookdbd952122014-06-27 15:18:48 -0700806 return -EINVAL;
Kees Cook48dc92b2014-06-25 16:08:24 -0700807
Kees Cookc8bee432014-06-27 15:16:33 -0700808 /* Prepare the new filter before holding any locks. */
809 prepared = seccomp_prepare_user_filter(filter);
810 if (IS_ERR(prepared))
811 return PTR_ERR(prepared);
812
Kees Cookc2e1f2e2014-06-05 00:23:17 -0700813 /*
814 * Make sure we cannot change seccomp or nnp state via TSYNC
815 * while another thread is in the middle of calling exec.
816 */
817 if (flags & SECCOMP_FILTER_FLAG_TSYNC &&
818 mutex_lock_killable(&current->signal->cred_guard_mutex))
819 goto out_free;
820
Kees Cookdbd952122014-06-27 15:18:48 -0700821 spin_lock_irq(&current->sighand->siglock);
822
Kees Cook3b23dd12014-06-25 15:55:25 -0700823 if (!seccomp_may_assign_mode(seccomp_mode))
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500824 goto out;
Kees Cook3b23dd12014-06-25 15:55:25 -0700825
Kees Cookc8bee432014-06-27 15:16:33 -0700826 ret = seccomp_attach_filter(flags, prepared);
Kees Cook3b23dd12014-06-25 15:55:25 -0700827 if (ret)
828 goto out;
Kees Cookc8bee432014-06-27 15:16:33 -0700829 /* Do not free the successfully attached filter. */
830 prepared = NULL;
Andrea Arcangeli1d9d02f2007-07-15 23:41:32 -0700831
Kees Cook3ba25302014-06-27 15:01:35 -0700832 seccomp_assign_mode(current, seccomp_mode);
Will Drewrye2cfabdf2012-04-12 16:47:57 -0500833out:
Kees Cookdbd952122014-06-27 15:18:48 -0700834 spin_unlock_irq(&current->sighand->siglock);
Kees Cookc2e1f2e2014-06-05 00:23:17 -0700835 if (flags & SECCOMP_FILTER_FLAG_TSYNC)
836 mutex_unlock(&current->signal->cred_guard_mutex);
837out_free:
Kees Cookc8bee432014-06-27 15:16:33 -0700838 seccomp_filter_free(prepared);
Andrea Arcangeli1d9d02f2007-07-15 23:41:32 -0700839 return ret;
840}
Kees Cook3b23dd12014-06-25 15:55:25 -0700841#else
Kees Cook48dc92b2014-06-25 16:08:24 -0700842static inline long seccomp_set_mode_filter(unsigned int flags,
843 const char __user *filter)
Kees Cook3b23dd12014-06-25 15:55:25 -0700844{
845 return -EINVAL;
846}
847#endif
Kees Cookd78ab022014-05-21 15:02:11 -0700848
Kees Cook48dc92b2014-06-25 16:08:24 -0700849/* Common entry point for both prctl and syscall. */
850static long do_seccomp(unsigned int op, unsigned int flags,
851 const char __user *uargs)
852{
853 switch (op) {
854 case SECCOMP_SET_MODE_STRICT:
855 if (flags != 0 || uargs != NULL)
856 return -EINVAL;
857 return seccomp_set_mode_strict();
858 case SECCOMP_SET_MODE_FILTER:
859 return seccomp_set_mode_filter(flags, uargs);
860 default:
861 return -EINVAL;
862 }
863}
864
865SYSCALL_DEFINE3(seccomp, unsigned int, op, unsigned int, flags,
866 const char __user *, uargs)
867{
868 return do_seccomp(op, flags, uargs);
869}
870
Kees Cookd78ab022014-05-21 15:02:11 -0700871/**
872 * prctl_set_seccomp: configures current->seccomp.mode
873 * @seccomp_mode: requested mode to use
874 * @filter: optional struct sock_fprog for use with SECCOMP_MODE_FILTER
875 *
876 * Returns 0 on success or -EINVAL on failure.
877 */
878long prctl_set_seccomp(unsigned long seccomp_mode, char __user *filter)
879{
Kees Cook48dc92b2014-06-25 16:08:24 -0700880 unsigned int op;
881 char __user *uargs;
882
Kees Cook3b23dd12014-06-25 15:55:25 -0700883 switch (seccomp_mode) {
884 case SECCOMP_MODE_STRICT:
Kees Cook48dc92b2014-06-25 16:08:24 -0700885 op = SECCOMP_SET_MODE_STRICT;
886 /*
887 * Setting strict mode through prctl always ignored filter,
888 * so make sure it is always NULL here to pass the internal
889 * check in do_seccomp().
890 */
891 uargs = NULL;
892 break;
Kees Cook3b23dd12014-06-25 15:55:25 -0700893 case SECCOMP_MODE_FILTER:
Kees Cook48dc92b2014-06-25 16:08:24 -0700894 op = SECCOMP_SET_MODE_FILTER;
895 uargs = filter;
896 break;
Kees Cook3b23dd12014-06-25 15:55:25 -0700897 default:
898 return -EINVAL;
899 }
Kees Cook48dc92b2014-06-25 16:08:24 -0700900
901 /* prctl interface doesn't have flags, so they are always zero. */
902 return do_seccomp(op, 0, uargs);
Kees Cookd78ab022014-05-21 15:02:11 -0700903}