Commit 5340627e authored by David Abdurachmanov's avatar David Abdurachmanov Committed by Paul Walmsley

riscv: add support for SECCOMP and SECCOMP_FILTER

This patch was extensively tested on Fedora/RISCV (applied by default on
top of 5.2-rc7 kernel for <2 months). The patch was also tested with 5.3-rc
on QEMU and SiFive Unleashed board.

libseccomp (userspace) was rebased:
https://github.com/seccomp/libseccomp/pull/134

Fully passes libseccomp regression testing (simulation and live).

There is one failing kernel selftest: global.user_notification_signal

v1 -> v2:
  - return immediately if secure_computing(NULL) returns -1
  - fixed whitespace issues
  - add missing seccomp.h
  - remove patch #2 (solved now)
  - add riscv to seccomp kernel selftest
Signed-off-by: default avatarDavid Abdurachmanov <david.abdurachmanov@sifive.com>
Cc: keescook@chromium.org
Cc: me@carlosedp.com
Tested-by: default avatarCarlos de Paula <me@carlosedp.com>
Reviewed-by: default avatarKees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/linux-riscv/CAEn-LTp=ss0Dfv6J00=rCAy+N78U2AmhqJNjfqjr2FDpPYjxEQ@mail.gmail.com/
Link: https://lore.kernel.org/linux-riscv/CAJr-aD=UnCN9E_mdVJ2H5nt=6juRSWikZnA5HxDLQxXLbsRz-w@mail.gmail.com/
[paul.walmsley@sifive.com: cleaned up Cc: lines; fixed spelling and
 checkpatch issues; updated to apply]
Signed-off-by: default avatarPaul Walmsley <paul.walmsley@sifive.com>
parent 00a5bf3a
...@@ -31,6 +31,7 @@ config RISCV ...@@ -31,6 +31,7 @@ config RISCV
select GENERIC_SMP_IDLE_THREAD select GENERIC_SMP_IDLE_THREAD
select GENERIC_ATOMIC64 if !64BIT select GENERIC_ATOMIC64 if !64BIT
select HAVE_ARCH_AUDITSYSCALL select HAVE_ARCH_AUDITSYSCALL
select HAVE_ARCH_SECCOMP_FILTER
select HAVE_ASM_MODVERSIONS select HAVE_ASM_MODVERSIONS
select HAVE_MEMBLOCK_NODE_MAP select HAVE_MEMBLOCK_NODE_MAP
select HAVE_DMA_CONTIGUOUS select HAVE_DMA_CONTIGUOUS
...@@ -272,6 +273,19 @@ menu "Kernel features" ...@@ -272,6 +273,19 @@ menu "Kernel features"
source "kernel/Kconfig.hz" source "kernel/Kconfig.hz"
config SECCOMP
bool "Enable seccomp to safely compute untrusted bytecode"
help
This kernel feature is useful for number crunching applications
that may need to compute untrusted bytecode during their
execution. By using pipes or other transports made available to
the process as file descriptors supporting the read/write
syscalls, it's possible to isolate those applications in
their own address space using seccomp. Once seccomp is
enabled via prctl(PR_SET_SECCOMP), it cannot be disabled
and the task is only allowed to execute a few safe syscalls
defined by each seccomp mode.
endmenu endmenu
menu "Boot options" menu "Boot options"
......
/* SPDX-License-Identifier: GPL-2.0 */
#ifndef _ASM_SECCOMP_H
#define _ASM_SECCOMP_H
#include <asm/unistd.h>
#include <asm-generic/seccomp.h>
#endif /* _ASM_SECCOMP_H */
...@@ -75,6 +75,7 @@ struct thread_info { ...@@ -75,6 +75,7 @@ struct thread_info {
#define TIF_MEMDIE 5 /* is terminating due to OOM killer */ #define TIF_MEMDIE 5 /* is terminating due to OOM killer */
#define TIF_SYSCALL_TRACEPOINT 6 /* syscall tracepoint instrumentation */ #define TIF_SYSCALL_TRACEPOINT 6 /* syscall tracepoint instrumentation */
#define TIF_SYSCALL_AUDIT 7 /* syscall auditing */ #define TIF_SYSCALL_AUDIT 7 /* syscall auditing */
#define TIF_SECCOMP 8 /* syscall secure computing */
#define _TIF_SYSCALL_TRACE (1 << TIF_SYSCALL_TRACE) #define _TIF_SYSCALL_TRACE (1 << TIF_SYSCALL_TRACE)
#define _TIF_NOTIFY_RESUME (1 << TIF_NOTIFY_RESUME) #define _TIF_NOTIFY_RESUME (1 << TIF_NOTIFY_RESUME)
...@@ -82,11 +83,13 @@ struct thread_info { ...@@ -82,11 +83,13 @@ struct thread_info {
#define _TIF_NEED_RESCHED (1 << TIF_NEED_RESCHED) #define _TIF_NEED_RESCHED (1 << TIF_NEED_RESCHED)
#define _TIF_SYSCALL_TRACEPOINT (1 << TIF_SYSCALL_TRACEPOINT) #define _TIF_SYSCALL_TRACEPOINT (1 << TIF_SYSCALL_TRACEPOINT)
#define _TIF_SYSCALL_AUDIT (1 << TIF_SYSCALL_AUDIT) #define _TIF_SYSCALL_AUDIT (1 << TIF_SYSCALL_AUDIT)
#define _TIF_SECCOMP (1 << TIF_SECCOMP)
#define _TIF_WORK_MASK \ #define _TIF_WORK_MASK \
(_TIF_NOTIFY_RESUME | _TIF_SIGPENDING | _TIF_NEED_RESCHED) (_TIF_NOTIFY_RESUME | _TIF_SIGPENDING | _TIF_NEED_RESCHED)
#define _TIF_SYSCALL_WORK \ #define _TIF_SYSCALL_WORK \
(_TIF_SYSCALL_TRACE | _TIF_SYSCALL_TRACEPOINT | _TIF_SYSCALL_AUDIT) (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_TRACEPOINT | _TIF_SYSCALL_AUDIT | \
_TIF_SECCOMP)
#endif /* _ASM_RISCV_THREAD_INFO_H */ #endif /* _ASM_RISCV_THREAD_INFO_H */
...@@ -226,8 +226,25 @@ check_syscall_nr: ...@@ -226,8 +226,25 @@ check_syscall_nr:
/* Check to make sure we don't jump to a bogus syscall number. */ /* Check to make sure we don't jump to a bogus syscall number. */
li t0, __NR_syscalls li t0, __NR_syscalls
la s0, sys_ni_syscall la s0, sys_ni_syscall
/* Syscall number held in a7 */ /*
bgeu a7, t0, 1f * The tracer can change syscall number to valid/invalid value.
* We use syscall_set_nr helper in syscall_trace_enter thus we
* cannot trust the current value in a7 and have to reload from
* the current task pt_regs.
*/
REG_L a7, PT_A7(sp)
/*
* Syscall number held in a7.
* If syscall number is above allowed value, redirect to ni_syscall.
*/
bge a7, t0, 1f
/*
* Check if syscall is rejected by tracer or seccomp, i.e., a7 == -1.
* If yes, we pretend it was executed.
*/
li t1, -1
beq a7, t1, ret_from_syscall_rejected
/* Call syscall */
la s0, sys_call_table la s0, sys_call_table
slli t0, a7, RISCV_LGPTR slli t0, a7, RISCV_LGPTR
add s0, s0, t0 add s0, s0, t0
...@@ -238,6 +255,12 @@ check_syscall_nr: ...@@ -238,6 +255,12 @@ check_syscall_nr:
ret_from_syscall: ret_from_syscall:
/* Set user a0 to kernel a0 */ /* Set user a0 to kernel a0 */
REG_S a0, PT_A0(sp) REG_S a0, PT_A0(sp)
/*
* We didn't execute the actual syscall.
* Seccomp already set return value for the current task pt_regs.
* (If it was configured with SECCOMP_RET_ERRNO/TRACE)
*/
ret_from_syscall_rejected:
/* Trace syscalls, but only if requested by the user. */ /* Trace syscalls, but only if requested by the user. */
REG_L t0, TASK_TI_FLAGS(tp) REG_L t0, TASK_TI_FLAGS(tp)
andi t0, t0, _TIF_SYSCALL_WORK andi t0, t0, _TIF_SYSCALL_WORK
......
...@@ -154,6 +154,16 @@ __visible void do_syscall_trace_enter(struct pt_regs *regs) ...@@ -154,6 +154,16 @@ __visible void do_syscall_trace_enter(struct pt_regs *regs)
if (tracehook_report_syscall_entry(regs)) if (tracehook_report_syscall_entry(regs))
syscall_set_nr(current, regs, -1); syscall_set_nr(current, regs, -1);
/*
* Do the secure computing after ptrace; failures should be fast.
* If this fails we might have return value in a0 from seccomp
* (via SECCOMP_RET_ERRNO/TRACE).
*/
if (secure_computing(NULL) == -1) {
syscall_set_nr(current, regs, -1);
return;
}
#ifdef CONFIG_HAVE_SYSCALL_TRACEPOINTS #ifdef CONFIG_HAVE_SYSCALL_TRACEPOINTS
if (test_thread_flag(TIF_SYSCALL_TRACEPOINT)) if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
trace_sys_enter(regs, syscall_get_nr(current, regs)); trace_sys_enter(regs, syscall_get_nr(current, regs));
......
...@@ -112,6 +112,8 @@ struct seccomp_data { ...@@ -112,6 +112,8 @@ struct seccomp_data {
# define __NR_seccomp 383 # define __NR_seccomp 383
# elif defined(__aarch64__) # elif defined(__aarch64__)
# define __NR_seccomp 277 # define __NR_seccomp 277
# elif defined(__riscv)
# define __NR_seccomp 277
# elif defined(__hppa__) # elif defined(__hppa__)
# define __NR_seccomp 338 # define __NR_seccomp 338
# elif defined(__powerpc__) # elif defined(__powerpc__)
...@@ -1587,6 +1589,10 @@ TEST_F(TRACE_poke, getpid_runs_normally) ...@@ -1587,6 +1589,10 @@ TEST_F(TRACE_poke, getpid_runs_normally)
# define ARCH_REGS struct user_pt_regs # define ARCH_REGS struct user_pt_regs
# define SYSCALL_NUM regs[8] # define SYSCALL_NUM regs[8]
# define SYSCALL_RET regs[0] # define SYSCALL_RET regs[0]
#elif defined(__riscv) && __riscv_xlen == 64
# define ARCH_REGS struct user_regs_struct
# define SYSCALL_NUM a7
# define SYSCALL_RET a0
#elif defined(__hppa__) #elif defined(__hppa__)
# define ARCH_REGS struct user_regs_struct # define ARCH_REGS struct user_regs_struct
# define SYSCALL_NUM gr[20] # define SYSCALL_NUM gr[20]
...@@ -1676,7 +1682,7 @@ void change_syscall(struct __test_metadata *_metadata, ...@@ -1676,7 +1682,7 @@ void change_syscall(struct __test_metadata *_metadata,
EXPECT_EQ(0, ret) {} EXPECT_EQ(0, ret) {}
#if defined(__x86_64__) || defined(__i386__) || defined(__powerpc__) || \ #if defined(__x86_64__) || defined(__i386__) || defined(__powerpc__) || \
defined(__s390__) || defined(__hppa__) defined(__s390__) || defined(__hppa__) || defined(__riscv)
{ {
regs.SYSCALL_NUM = syscall; regs.SYSCALL_NUM = syscall;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment