From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-17.4 required=3.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_IN_DEF_DKIM_WL autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8D561C4363D for ; Wed, 23 Sep 2020 23:48:38 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 4523A212CC for ; Wed, 23 Sep 2020 23:48:38 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="HDDz0mvq" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726650AbgIWXsQ (ORCPT ); Wed, 23 Sep 2020 19:48:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34980 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726265AbgIWXsQ (ORCPT ); Wed, 23 Sep 2020 19:48:16 -0400 Received: from mail-ej1-x642.google.com (mail-ej1-x642.google.com [IPv6:2a00:1450:4864:20::642]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A740EC0613D1 for ; Wed, 23 Sep 2020 16:48:15 -0700 (PDT) Received: by mail-ej1-x642.google.com with SMTP id p9so1960782ejf.6 for ; Wed, 23 Sep 2020 16:48:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=39UUQGQGuW0pJ99c+3XIOwje30cjhE1B1JoOVCrOppE=; b=HDDz0mvq7a3RG21pW1YeQt8LuyT+FQycHVtfHpuOxU6Biqeaq27Gw7cP0U+Spr7uTp Nfq1GselwDFRfr9FK3059LriMRW5TYJYcX4A3//RneCtrNUpPDWnkxJMQiwtFIpc+xw1 TrsSkUpUgbQzzNtMrHzq4TS+NTY69w1m+cz1jSf5lzvMoJsoiRFI4xUrHsuNE58iigSY dsycOzIWKTJ/5jb7J3PeM5sJ+YXGWe5SKxbRup2+kxQQThT5O52j2q8aOVj3NI/LcdsV 4K4MJstPwqmiwhW2iAm2V8jx4jj4lNPMoabpg7l5YPdv92Pf0rDC2GeoWWIt7WxkjGvU abwg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=39UUQGQGuW0pJ99c+3XIOwje30cjhE1B1JoOVCrOppE=; b=hNguDGW8H+Hn7B/YGz4GhBDH8vMfL50BPYDV+h5q9wxQZISw2pAwFJTYGzgrlTHjo0 6vH6WeKymf3GP0MYoiiXnxAcGT05b3RxJRx+dR9lRvoh0S6vNDY9WwByrTpl2oRkBmga +yjnmnhitsdxQC/wV1Wy5Dd6Y1PUj1CfWvWkQSwjIXOTwpAovu0LUy4lMDVAMRyhuxz+ 5NFIVxO/s5qJ7ID6gaOxaIHSldy6myJbihKKfxdOxVq8RFp//ROXdHpsmzrpIL04Fjfk EhAHHQxlY6ZsuPcEaqzyjOY8/WYykTN2DC7geSqnONg+JrVyZlSAAg6TQbNvi/C/RRpG hrqQ== X-Gm-Message-State: AOAM531Ql5sm+rtGZi30qYLDBW1NTmpKX46HGz0iFVGWDO/dSEMCnpAl IE0dXtovjcRWSkHj8HuJ25vKSrCpHpU13y2/Df/BFA== X-Google-Smtp-Source: ABdhPJztAHF67qXzKrzzYSP3nT64vv5jq7HwOELGrmAfvL52R7Pr4wN/V46V4Apb43rLzuJU3SZ/sIdez/zch09EI8g= X-Received: by 2002:a17:907:64d:: with SMTP id wq13mr1931271ejb.513.1600904893980; Wed, 23 Sep 2020 16:48:13 -0700 (PDT) MIME-Version: 1.0 References: <20200923232923.3142503-1-keescook@chromium.org> <20200923232923.3142503-5-keescook@chromium.org> In-Reply-To: <20200923232923.3142503-5-keescook@chromium.org> From: Jann Horn Date: Thu, 24 Sep 2020 01:47:47 +0200 Message-ID: Subject: Re: [PATCH 4/6] seccomp: Emulate basic filters for constant action results To: Kees Cook Cc: YiFei Zhu , Christian Brauner , Tycho Andersen , Andy Lutomirski , Will Drewry , Andrea Arcangeli , Giuseppe Scrivano , Tobin Feldman-Fitzthum , Dimitrios Skarlatos , Valentin Rothberg , Hubertus Franke , Jack Chen , Josep Torrellas , Tianyin Xu , bpf , Linux Containers , Linux API , kernel list Content-Type: text/plain; charset="UTF-8" Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Sep 24, 2020 at 1:29 AM Kees Cook wrote: > This emulates absolutely the most basic seccomp filters to figure out > if they will always give the same results for a given arch/nr combo. > > Nearly all seccomp filters are built from the following ops: > > BPF_LD | BPF_W | BPF_ABS > BPF_JMP | BPF_JEQ | BPF_K > BPF_JMP | BPF_JGE | BPF_K > BPF_JMP | BPF_JGT | BPF_K > BPF_JMP | BPF_JSET | BPF_K > BPF_JMP | BPF_JA > BPF_RET | BPF_K > > These are now emulated to check for accesses beyond seccomp_data::arch > or unknown instructions. > > Not yet implemented are: > > BPF_ALU | BPF_AND (generated by libseccomp and Chrome) BPF_AND is normally only used on syscall arguments, not on the syscall number or the architecture, right? And when a syscall argument is loaded, we abort execution anyway. So I think there is no need to implement those? > Suggested-by: Jann Horn > Link: https://lore.kernel.org/lkml/CAG48ez1p=dR_2ikKq=xVxkoGg0fYpTBpkhJSv1w-6BG=76PAvw@mail.gmail.com/ > Signed-off-by: Kees Cook > --- > kernel/seccomp.c | 82 ++++++++++++++++++++++++++++++++++++++++++++--- > net/core/filter.c | 3 +- > 2 files changed, 79 insertions(+), 6 deletions(-) > > diff --git a/kernel/seccomp.c b/kernel/seccomp.c > index 111a238bc532..9921f6f39d12 100644 > --- a/kernel/seccomp.c > +++ b/kernel/seccomp.c > @@ -610,7 +610,12 @@ static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog) > { > struct seccomp_filter *sfilter; > int ret; > - const bool save_orig = IS_ENABLED(CONFIG_CHECKPOINT_RESTORE); > + const bool save_orig = > +#if defined(CONFIG_CHECKPOINT_RESTORE) || defined(SECCOMP_ARCH) > + true; > +#else > + false; > +#endif You could probably write this as something like: const bool save_orig = IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) || __is_defined(SECCOMP_ARCH); [...] > diff --git a/net/core/filter.c b/net/core/filter.c [...] > -static void bpf_release_orig_filter(struct bpf_prog *fp) > +void bpf_release_orig_filter(struct bpf_prog *fp) > { > struct sock_fprog_kern *fprog = fp->orig_prog; > > @@ -1154,6 +1154,7 @@ static void bpf_release_orig_filter(struct bpf_prog *fp) > kfree(fprog); > } > } > +EXPORT_SYMBOL_GPL(bpf_release_orig_filter); If this change really belongs into this patch (which I don't think it does), please describe why in the commit message.