http://bugzilla.opensuse.org/show_bug.cgi?id=921289
--- Comment #1 from Andreas Stieger ---
Based on
https://lists.ubuntu.com/archives/kernel-team/2014-October/049110.html
and https://github.com/kees/linux/
the upstream commits are:
commit 69f6a34bdeea4fec50bb90619bc9602973119572
Author: Guenter Roeck
Date: Sun Aug 10 20:50:30 2014 -0700
seccomp: Replace BUG(!spin_is_locked()) with assert_spin_lock
Current upstream kernel hangs with mips and powerpc targets in
uniprocessor mode if SECCOMP is configured.
Bisect points to commit dbd952127d11 ("seccomp: introduce writer
locking").
Turns out that code such as
BUG_ON(!spin_is_locked(&list_lock));
can not be used in uniprocessor mode because spin_is_locked() always
returns false in this configuration, and that assert_spin_locked()
exists for that very purpose and must be used instead.
Fixes: dbd952127d11 ("seccomp: introduce writer locking")
Cc: Kees Cook
Signed-off-by: Guenter Roeck
Signed-off-by: Kees Cook
commit c2e1f2e30daa551db3c670c0ccfeab20a540b9e1
Author: Kees Cook
Date: Thu Jun 5 00:23:17 2014 -0700
seccomp: implement SECCOMP_FILTER_FLAG_TSYNC
Applying restrictive seccomp filter programs to large or diverse
codebases often requires handling threads which may be started early in
the process lifetime (e.g., by code that is linked in). While it is
possible to apply permissive programs prior to process start up, it is
difficult to further restrict the kernel ABI to those threads after that
point.
This change adds a new seccomp syscall flag to
SECCOMP_SET_MODE_FILTER for
synchronizing thread group seccomp filters at filter installation time.
When calling seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
filter) an attempt will be made to synchronize all threads in current's
threadgroup to its new seccomp filter program. This is possible iff all
threads are using a filter that is an ancestor to the filter current is
attempting to synchronize to. NULL filters (where the task is running as
SECCOMP_MODE_NONE) are also treated as ancestors allowing threads to be
transitioned into SECCOMP_MODE_FILTER. If prctrl(PR_SET_NO_NEW_PRIVS,
...) has been set on the calling thread, no_new_privs will be set for
all synchronized threads too. On success, 0 is returned. On failure,
the pid of one of the failing threads will be returned and no filters
will have been applied.
The race conditions against another thread are:
- requesting TSYNC (already handled by sighand lock)
- performing a clone (already handled by sighand lock)
- changing its filter (already handled by sighand lock)
- calling exec (handled by cred_guard_mutex)
The clone case is assisted by the fact that new threads will have their
seccomp state duplicated from their parent before appearing on the
tasklist.
Holding cred_guard_mutex means that seccomp filters cannot be assigned
while in the middle of another thread's exec (potentially bypassing
no_new_privs or similar). The call to de_thread() may kill threads
waiting
for the mutex.
Changes across threads to the filter pointer includes a barrier.
Based on patches by Will Drewry.
Suggested-by: Julien Tinnes
Signed-off-by: Kees Cook
Reviewed-by: Oleg Nesterov
Reviewed-by: Andy Lutomirski
commit 3ba2530cc06eb4aee4f1f754f43d781e8a12ee09
Author: Kees Cook
Date: Fri Jun 27 15:01:35 2014 -0700
seccomp: allow mode setting across threads
This changes the mode setting helper to allow threads to change the
seccomp mode from another thread. We must maintain barriers to keep
TIF_SECCOMP synchronized with the rest of the seccomp state.
Signed-off-by: Kees Cook
Reviewed-by: Oleg Nesterov
Reviewed-by: Andy Lutomirski
commit dbd952127d11bb44a4ea30b08cc60531b6a23d71
Author: Kees Cook
Date: Fri Jun 27 15:18:48 2014 -0700
seccomp: introduce writer locking
Normally, task_struct.seccomp.filter is only ever read or modified by
the task that owns it (current). This property aids in fast access
during system call filtering as read access is lockless.
Updating the pointer from another task, however, opens up race
conditions. To allow cross-thread filter pointer updates, writes to the
seccomp fields are now protected by the sighand spinlock (which is
shared
by all threads in the thread group). Read access remains lockless
because
pointer updates themselves are atomic. However, writes (or cloning)
often entail additional checking (like maximum instruction counts)
which require locking to perform safely.
In the case of cloning threads, the child is invisible to the system
until it enters the task list. To make sure a child can't be cloned from
a thread and left in a prior state, seccomp duplication is additionally
moved under the sighand lock. Then parent and child are certain have
the same seccomp state when they exit the lock.
Based on patches by Will Drewry and David Drysdale.
Signed-off-by: Kees Cook
Reviewed-by: Oleg Nesterov
Reviewed-by: Andy Lutomirski
commit c8bee430dc52cfca6c1aab27752a89275d78d50f
Author: Kees Cook
Date: Fri Jun 27 15:16:33 2014 -0700
seccomp: split filter prep from check and apply
In preparation for adding seccomp locking, move filter creation away
from where it is checked and applied. This will allow for locking where
no memory allocation is happening. The validation, filter attachment,
and seccomp mode setting can all happen under the future locks.
For extreme defensiveness, I've added a BUG_ON check for the calculated
size of the buffer allocation in case BPF_MAXINSN ever changes, which
shouldn't ever happen. The compiler should actually optimize out this
check since the test above it makes it impossible.
Signed-off-by: Kees Cook
Reviewed-by: Oleg Nesterov
Reviewed-by: Andy Lutomirski
commit 1d4457f99928a968767f6405b4a1f50845aa15fd
Author: Kees Cook
Date: Wed May 21 15:23:46 2014 -0700
sched: move no_new_privs into new atomic flags
Since seccomp transitions between threads requires updates to the
no_new_privs flag to be atomic, the flag must be part of an atomic flag
set. This moves the nnp flag into a separate task field, and introduces
accessors.
Signed-off-by: Kees Cook
Reviewed-by: Oleg Nesterov
Reviewed-by: Andy Lutomirski
commit 8855d608c145c1ca0e26f4da00741080bb49d80d
Author: Kees Cook
Date: Tue Jun 10 15:45:09 2014 -0700
MIPS: add seccomp syscall
Wires up the new seccomp syscall.
Signed-off-by: Kees Cook
Reviewed-by: Oleg Nesterov
commit 839669714f0a85d677283690e6e164fb698ce206
Author: Kees Cook
Date: Tue Jun 10 15:40:23 2014 -0700
ARM: add seccomp syscall
Wires up the new seccomp syscall.
Signed-off-by: Kees Cook
Reviewed-by: Oleg Nesterov
commit 48dc92b9fc3926844257316e75ba11eb5c742b2c
Author: Kees Cook
Date: Wed Jun 25 16:08:24 2014 -0700
seccomp: add "seccomp" syscall
This adds the new "seccomp" syscall with both an "operation" and "flags"
parameter for future expansion. The third argument is a pointer value,
used with the SECCOMP_SET_MODE_FILTER operation. Currently, flags must
be 0. This is functionally equivalent to prctl(PR_SET_SECCOMP, ...).
In addition to the TSYNC flag later in this patch series, there is a
non-zero chance that this syscall could be used for configuring a fixed
argument area for seccomp-tracer-aware processes to pass syscall
arguments
in the future. Hence, the use of "seccomp" not simply
"seccomp_add_filter"
for this syscall. Additionally, this syscall uses operation, flags,
and user pointer for arguments because strictly passing arguments via
a user pointer would mean seccomp itself would be unable to trivially
filter the seccomp syscall itself.
Signed-off-by: Kees Cook
Reviewed-by: Oleg Nesterov
Reviewed-by: Andy Lutomirski
commit 3b23dd12846215eff4afb073366b80c0c4d7543e
Author: Kees Cook
Date: Wed Jun 25 15:55:25 2014 -0700
seccomp: split mode setting routines
Separates the two mode setting paths to make things more readable with
fewer #ifdefs within function bodies.
Signed-off-by: Kees Cook
Reviewed-by: Oleg Nesterov
Reviewed-by: Andy Lutomirski
commit 1f41b450416e689b9b7c8bfb750a98604f687a9b
Author: Kees Cook
Date: Wed Jun 25 15:38:02 2014 -0700
seccomp: extract check/assign mode helpers
To support splitting mode 1 from mode 2, extract the mode checking and
assignment logic into common functions.
Signed-off-by: Kees Cook
Reviewed-by: Oleg Nesterov
Reviewed-by: Andy Lutomirski
commit d78ab02c2c194257a03355fbb79eb721b381d105
Author: Kees Cook
Date: Wed May 21 15:02:11 2014 -0700
seccomp: create internal mode-setting function
In preparation for having other callers of the seccomp mode setting
logic, split the prctl entry point away from the core logic that
performs
seccomp mode setting.
Signed-off-by: Kees Cook
Reviewed-by: Oleg Nesterov
Reviewed-by: Andy Lutomirski
commit 42309ab450b608ddcfafa90e4cfa93a5001ecfba
Author: Will Deacon
Date: Fri Jun 27 17:01:47 2014 +0100
ARM: 8087/1: ptrace: reload syscall number after secure_computing()
check
On the syscall tracing path, we call out to secure_computing() to allow
seccomp to check the syscall number being attempted. As part of this, a
SIGTRAP may be sent to the tracer and the syscall could be re-written by
a subsequent SET_SYSCALL ptrace request. Unfortunately, this new syscall
is ignored by the current code unless TIF_SYSCALL_TRACE is also set on
the current thread.
This patch slightly reworks the enter path of the syscall tracing code
so that we always reload the syscall number from
current_thread_info()->syscall after the potential ptrace traps.
Acked-by: Kees Cook
Tested-by: Kees Cook
Signed-off-by: Will Deacon
Signed-off-by: Russell King
--
You are receiving this mail because:
You are on the CC list for the bug.