korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-12-04 01:24:12 +08:00
Code Issues Packages Projects Releases Wiki Activity

m68k: Add kernel seccomp support

Browse Source 
Add secure_computing() call to syscall_trace_enter to actually
filter system calls.

Add necessary arch Kconfig options, define TIF_SECCOMP trace
flag and provide basic seccomp filter support in asm/syscall.h

syscall_get_nr currently uses the syscall nr stored in orig_d0
because we change d0 to a default return code before starting a
syscall trace. This may be inconsistent with syscall_rollback
copying orig_d0 to d0 (which we never check upon return from
trace). We use d0 for the return code from syscall_trace_enter
in entry.S currently, and could perhaps expand that to store
a new syscall number returned by the seccomp filter before
executing the syscall. This clearly needs some discussion.

seccomp_bpf self test on ARAnyM passes 81 out of 94 tests.

Signed-off-by: Michael Schmitz <schmitzmic@gmail.com>
Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
Link: https://lore.kernel.org/r/20230112035529.13521-3-schmitzmic@gmail.com
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
This commit is contained in:
Michael Schmitz 2023-01-12 16:55:28 +13:00 committed by Geert Uytterhoeven
parent 2ca8a1de44
commit 6baaade155
7 changed files with 81 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Documentation/features/seccomp/seccomp-filter/arch-support.txt
View File

@ -14,7 +14,7 @@
| hexagon: | TODO |
| ia64: | TODO |
| loongarch: | ok |
| m68k: | TODO |
| m68k: | ok |
| microblaze: | TODO |
| mips: | ok |
| nios2: | TODO |

2
arch/m68k/Kconfig
View File

@ -18,6 +18,8 @@ config M68K
select GENERIC_CPU_DEVICES
select GENERIC_IOMAP
select GENERIC_IRQ_SHOW
select HAVE_ARCH_SECCOMP
select HAVE_ARCH_SECCOMP_FILTER
select HAVE_ASM_MODVERSIONS
select HAVE_DEBUG_BUGVERBOSE
select HAVE_EFFICIENT_UNALIGNED_ACCESS if !CPU_HAS_NO_UNALIGNED

11
arch/m68k/include/asm/seccomp.h Normal file
View File

@ -0,0 +1,11 @@
/* SPDX-License-Identifier: GPL-2.0-only */
#ifndef _ASM_SECCOMP_H
#define _ASM_SECCOMP_H
#include <asm-generic/seccomp.h>
#define SECCOMP_ARCH_NATIVE AUDIT_ARCH_M68K
#define SECCOMP_ARCH_NATIVE_NR NR_syscalls
#define SECCOMP_ARCH_NATIVE_NAME "m68k"
#endif /* _ASM_SECCOMP_H */

57
arch/m68k/include/asm/syscall.h
View File

@ -4,6 +4,63 @@
#include <uapi/linux/audit.h>
#include <asm/unistd.h>
extern const unsigned long sys_call_table[];
static inline int syscall_get_nr(struct task_struct *task,
struct pt_regs *regs)
{
return regs->orig_d0;
}
static inline void syscall_rollback(struct task_struct *task,
struct pt_regs *regs)
{
regs->d0 = regs->orig_d0;
}
static inline long syscall_get_error(struct task_struct *task,
struct pt_regs *regs)
{
unsigned long error = regs->d0;
return IS_ERR_VALUE(error) ? error : 0;
}
static inline long syscall_get_return_value(struct task_struct *task,
struct pt_regs *regs)
{
return regs->d0;
}
static inline void syscall_set_return_value(struct task_struct *task,
struct pt_regs *regs,
int error, long val)
{
regs->d0 = (long)error ?: val;
}
static inline void syscall_get_arguments(struct task_struct *task,
struct pt_regs *regs,
unsigned long *args)
{
args[0] = regs->orig_d0;
args++;
memcpy(args, &regs->d1, 5 * sizeof(args[0]));
}
static inline void syscall_set_arguments(struct task_struct *task,
struct pt_regs *regs,
unsigned long *args)
{
regs->orig_d0 = args[0];
args++;
memcpy(&regs->d1, args, 5 * sizeof(args[0]));
}
static inline int syscall_get_arch(struct task_struct *task)
{
return AUDIT_ARCH_M68K;

2
arch/m68k/include/asm/thread_info.h
View File

@ -61,6 +61,7 @@ static inline struct thread_info *current_thread_info(void)
#define TIF_NOTIFY_RESUME 5 /* callback before returning to user */
#define TIF_SIGPENDING 6 /* signal pending */
#define TIF_NEED_RESCHED 7 /* rescheduling necessary */
#define TIF_SECCOMP 13 /* seccomp syscall filtering active */
#define TIF_DELAYED_TRACE 14 /* single step a syscall */
#define TIF_SYSCALL_TRACE 15 /* syscall trace active */
#define TIF_MEMDIE 16 /* is terminating due to OOM killer */
@ -69,6 +70,7 @@ static inline struct thread_info *current_thread_info(void)
#define _TIF_NOTIFY_RESUME (1 << TIF_NOTIFY_RESUME)
#define _TIF_SIGPENDING (1 << TIF_SIGPENDING)
#define _TIF_NEED_RESCHED (1 << TIF_NEED_RESCHED)
#define _TIF_SECCOMP (1 << TIF_SECCOMP)
#define _TIF_DELAYED_TRACE (1 << TIF_DELAYED_TRACE)
#define _TIF_SYSCALL_TRACE (1 << TIF_SYSCALL_TRACE)
#define _TIF_MEMDIE (1 << TIF_MEMDIE)

3
arch/m68k/kernel/entry.S
View File

@ -214,6 +214,9 @@ ENTRY(system_call)
| syscall trace?
tstb %a1@(TINFO_FLAGS+2)
jmi do_trace_entry
| seccomp filter active?
btst #5,%a1@(TINFO_FLAGS+2)
bnes do_trace_entry
cmpl #NR_syscalls,%d0
jcc badsys
syscall:

6
arch/m68k/kernel/ptrace.c
View File

@ -21,7 +21,7 @@
#include <linux/signal.h>
#include <linux/regset.h>
#include <linux/elf.h>
#include <linux/seccomp.h>
#include <linux/uaccess.h>
#include <asm/page.h>
#include <asm/processor.h>
@ -278,6 +278,10 @@ asmlinkage int syscall_trace_enter(void)
if (test_thread_flag(TIF_SYSCALL_TRACE))
ret = ptrace_report_syscall_entry(task_pt_regs(current));
if (secure_computing() == -1)
return -1;
return ret;
}