From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.5 required=3.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED,DKIM_INVALID,DKIM_SIGNED,FREEMAIL_FORGED_FROMDOMAIN, FREEMAIL_FROM,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4C579C4363D for ; Thu, 24 Sep 2020 12:44:55 +0000 (UTC) Received: from fraxinus.osuosl.org (smtp4.osuosl.org [140.211.166.137]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id C4FDB221EB for ; Thu, 24 Sep 2020 12:44:54 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Q3T2Aejo" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org C4FDB221EB Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=containers-bounces@lists.linux-foundation.org Received: from localhost (localhost [127.0.0.1]) by fraxinus.osuosl.org (Postfix) with ESMTP id 71FE586AD0; Thu, 24 Sep 2020 12:44:54 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from fraxinus.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9sMzguDU4gqe; Thu, 24 Sep 2020 12:44:53 +0000 (UTC) Received: from lists.linuxfoundation.org (lf-lists.osuosl.org [140.211.9.56]) by fraxinus.osuosl.org (Postfix) with ESMTP id 26E3B86AC8; Thu, 24 Sep 2020 12:44:53 +0000 (UTC) Received: from lf-lists.osuosl.org (localhost [127.0.0.1]) by lists.linuxfoundation.org (Postfix) with ESMTP id 149DFC0890; Thu, 24 Sep 2020 12:44:53 +0000 (UTC) Received: from whitealder.osuosl.org (smtp1.osuosl.org [140.211.166.138]) by lists.linuxfoundation.org (Postfix) with ESMTP id 060E3C0859 for ; Thu, 24 Sep 2020 12:44:51 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by whitealder.osuosl.org (Postfix) with ESMTP id E3C5586B07 for ; Thu, 24 Sep 2020 12:44:50 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from whitealder.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EYRUa8CW0rs5 for ; Thu, 24 Sep 2020 12:44:49 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from mail-io1-f65.google.com (mail-io1-f65.google.com [209.85.166.65]) by whitealder.osuosl.org (Postfix) with ESMTPS id 5B97E86C2D for ; Thu, 24 Sep 2020 12:44:47 +0000 (UTC) Received: by mail-io1-f65.google.com with SMTP id z25so3073979iol.10 for ; Thu, 24 Sep 2020 05:44:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=a/USLdYHm6D95gd7gNJM0h++23w7RB4ijC+a8OVv2IY=; b=Q3T2AejocKcdiQgWLyH7AtdDOAw26oqxNCYfgXKgz/ucabcwAiAiNPsuDXpTAz0TvR FF1zN4xXop5zkI4fbdGS3m7cHVhuQT9iKp7UVeDdcN0eBEPdC/bNrfZtSY8N2qC+HbW3 g24tm1XZ05EB8br94vTrH3HSCc5tJ3dnEMJWN980xIGp2803vBTQVJbbJ9gBP9qgBLPd 7Jtsu52R7l2DKsS+1cP3DitdinNc/3rcXPQ/YRJhbu0zoiNxfKR+lti1tZFKgDNF+I+f YHEz2famdYx0qabOKsaeJCQ4ltAi/25JdC+P2oHW8lxhy2GQW7ocwXfdCTtlblIwON0N TRZA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=a/USLdYHm6D95gd7gNJM0h++23w7RB4ijC+a8OVv2IY=; b=svCrmB/fCIswxonyL4xRFzQ5DYC585UmtAuje/itimyNrt9hvJX7LAqYpG5pZvf0bo QDmnCIdJlV3A4MC+cbpcpxteafs6Llf/9eV5L5aGyE9g7I1Q5b0fDMMumRCw7c/p24lD 6x4YXD8FzP0lNTTJwlsiogHlrnewCwotwOwthWeHY3QETmr9/tnChgTEWR9bdpCFFOuX XAFc8UC0yb6G4rHXPSzgjyZBC04It77BETI04MXJpUlZYlpYBVH5j6U3dNzQsscAd+d0 wS/AaeHR1UP2VjuKgOEh4ysPAA/RnoZahKKABSk33m3M1hnA1PToCq0BI9y31Ygm8/Wh j/zQ== X-Gm-Message-State: AOAM533eBSbqSRUNz2mTtzHet8OFNKkRa+YleEq+44oENk1PUHARR0hC YU0JiOGKXmTWDxjRniDmhCfdrkpZDJQPzA== X-Google-Smtp-Source: ABdhPJx02j71v3xJKtuqCYqHk5i+Cg/qFJ3jCgEibAwl0YmV2MhmzsBLwTbmAmQTQPYVZ/4uCqRjJg== X-Received: by 2002:a05:6638:dd3:: with SMTP id m19mr3587948jaj.115.1600951486478; Thu, 24 Sep 2020 05:44:46 -0700 (PDT) Received: from localhost.localdomain (host-173-230-99-154.tnkngak.clients.pavlovmedia.com. [173.230.99.154]) by smtp.gmail.com with ESMTPSA id p5sm1575175ilg.32.2020.09.24.05.44.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 24 Sep 2020 05:44:45 -0700 (PDT) From: YiFei Zhu To: containers@lists.linux-foundation.org Subject: [PATCH v2 seccomp 6/6] seccomp/cache: Report cache data through /proc/pid/seccomp_cache Date: Thu, 24 Sep 2020 07:44:21 -0500 Message-Id: X-Mailer: git-send-email 2.28.0 In-Reply-To: References: MIME-Version: 1.0 Cc: Andrea Arcangeli , Giuseppe Scrivano , Valentin Rothberg , Kees Cook , Jann Horn , YiFei Zhu , Tobin Feldman-Fitzthum , linux-kernel@vger.kernel.org, Andy Lutomirski , Hubertus Franke , Jack Chen , Dimitrios Skarlatos , Josep Torrellas , Will Drewry , bpf@vger.kernel.org, Tianyin Xu X-BeenThere: containers@lists.linux-foundation.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Linux Containers List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: containers-bounces@lists.linux-foundation.org Sender: "Containers" From: YiFei Zhu Currently the kernel does not provide an infrastructure to translate architecture numbers to a human-readable name. Translating syscall numbers to syscall names is possible through FTRACE_SYSCALL infrastructure but it does not provide support for compat syscalls. This will create a file for each PID as /proc/pid/seccomp_cache. The file will be empty when no seccomp filters are loaded, or be in the format of: where ALLOW means the cache is guaranteed to allow the syscall, and filter means the cache will pass the syscall to the BPF filter. For the docker default profile on x86_64 it looks like: c000003e 0 ALLOW c000003e 1 ALLOW c000003e 2 ALLOW c000003e 3 ALLOW [...] c000003e 132 ALLOW c000003e 133 ALLOW c000003e 134 FILTER c000003e 135 FILTER c000003e 136 FILTER c000003e 137 ALLOW c000003e 138 ALLOW c000003e 139 FILTER c000003e 140 ALLOW c000003e 141 ALLOW [...] This file is guarded by CONFIG_PROC_SECCOMP_CACHE with a default of N because I think certain users of seecomp might not want the application to know which syscalls are definitely usable. I'm not sure if adding all the "human readable names" is worthwhile, considering it can be easily done in userspace. Suggested-by: Jann Horn Link: https://lore.kernel.org/lkml/CAG48ez3Ofqp4crXGksLmZY6=fGrF_tWyUCg7PBkAetvbbOPeOA@mail.gmail.com/ Signed-off-by: YiFei Zhu --- arch/Kconfig | 10 ++++++++++ fs/proc/base.c | 7 +++++-- include/linux/seccomp.h | 5 +++++ kernel/seccomp.c | 26 ++++++++++++++++++++++++++ 4 files changed, 46 insertions(+), 2 deletions(-) diff --git a/arch/Kconfig b/arch/Kconfig index 8cc3dc87f253..dbfd897e5dc0 100644 --- a/arch/Kconfig +++ b/arch/Kconfig @@ -514,6 +514,16 @@ config SECCOMP_CACHE_NR_ONLY endchoice +config PROC_SECCOMP_CACHE + bool "Show seccomp filter cache status in /proc/pid/seccomp_cache" + depends on SECCOMP_CACHE_NR_ONLY + depends on PROC_FS + help + This is enables /proc/pid/seccomp_cache interface to monitor + seccomp cache data. The file format is subject to change. + + If unsure, say N. + config HAVE_ARCH_STACKLEAK bool help diff --git a/fs/proc/base.c b/fs/proc/base.c index 617db4e0faa0..2af626f69fa1 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -2615,7 +2615,7 @@ static struct dentry *proc_pident_instantiate(struct dentry *dentry, return d_splice_alias(inode, dentry); } -static struct dentry *proc_pident_lookup(struct inode *dir, +static struct dentry *proc_pident_lookup(struct inode *dir, struct dentry *dentry, const struct pid_entry *p, const struct pid_entry *end) @@ -2815,7 +2815,7 @@ static const struct pid_entry attr_dir_stuff[] = { static int proc_attr_dir_readdir(struct file *file, struct dir_context *ctx) { - return proc_pident_readdir(file, ctx, + return proc_pident_readdir(file, ctx, attr_dir_stuff, ARRAY_SIZE(attr_dir_stuff)); } @@ -3258,6 +3258,9 @@ static const struct pid_entry tgid_base_stuff[] = { #ifdef CONFIG_PROC_PID_ARCH_STATUS ONE("arch_status", S_IRUGO, proc_pid_arch_status), #endif +#ifdef CONFIG_PROC_SECCOMP_CACHE + ONE("seccomp_cache", S_IRUSR, proc_pid_seccomp_cache), +#endif }; static int proc_tgid_base_readdir(struct file *file, struct dir_context *ctx) diff --git a/include/linux/seccomp.h b/include/linux/seccomp.h index 02aef2844c38..3cedec824365 100644 --- a/include/linux/seccomp.h +++ b/include/linux/seccomp.h @@ -121,4 +121,9 @@ static inline long seccomp_get_metadata(struct task_struct *task, return -EINVAL; } #endif /* CONFIG_SECCOMP_FILTER && CONFIG_CHECKPOINT_RESTORE */ + +#ifdef CONFIG_PROC_SECCOMP_CACHE +int proc_pid_seccomp_cache(struct seq_file *m, struct pid_namespace *ns, + struct pid *pid, struct task_struct *task); +#endif #endif /* _LINUX_SECCOMP_H */ diff --git a/kernel/seccomp.c b/kernel/seccomp.c index ac0266b6d18a..d97ec1876b4e 100644 --- a/kernel/seccomp.c +++ b/kernel/seccomp.c @@ -2293,3 +2293,29 @@ static int __init seccomp_sysctl_init(void) device_initcall(seccomp_sysctl_init) #endif /* CONFIG_SYSCTL */ + +#ifdef CONFIG_PROC_SECCOMP_CACHE +/* Currently CONFIG_PROC_SECCOMP_CACHE implies CONFIG_SECCOMP_CACHE_NR_ONLY */ +int proc_pid_seccomp_cache(struct seq_file *m, struct pid_namespace *ns, + struct pid *pid, struct task_struct *task) +{ + struct seccomp_filter *f = READ_ONCE(task->seccomp.filter); + int arch, nr; + + if (!f) + return 0; + + for (arch = 0; arch < ARRAY_SIZE(syscall_arches); arch++) { + for (nr = 0; nr < NR_syscalls; nr++) { + bool cached = test_bit(nr, f->cache.syscall_ok[arch]); + char *status = cached ? "ALLOW" : "FILTER"; + + seq_printf(m, "%08x %d %s\n", syscall_arches[arch], + nr, status + ); + } + } + + return 0; +} +#endif /* CONFIG_PROC_SECCOMP_CACHE */ -- 2.28.0 _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/containers