| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Fri, 15 May 2020 16:40:05 -0700
From: Sargun Dhillon <sargun@...gun.me>
To: linux-kernel@...r.kernel.org,
containers@...ts.linux-foundation.org, linux-api@...r.kernel.org
Cc: Sargun Dhillon <sargun@...gun.me>, christian.brauner@...ntu.com,
tycho@...ho.ws, keescook@...omium.org, cyphar@...har.com
Subject: [PATCH] seccomp: Add group_leader pid to seccomp_notif
This includes the thread group leader ID in the seccomp_notif. This is
immediately useful for opening up a pidfd for the group leader, as
pidfds only work on group leaders.
Previously, it was considered to include an actual pidfd in the
seccomp_notif structure[1], but it was suggested to avoid proliferating
mechanisms to create pidfds[2].
[1]: https://lkml.org/lkml/2020/1/24/133
[2]: https://lkml.org/lkml/2020/5/15/481
Suggested-by: Christian Brauner <christian.brauner@...ntu.com>
Signed-off-by: Sargun Dhillon <sargun@...gun.me>
---
include/uapi/linux/seccomp.h | 2 +
kernel/seccomp.c | 1 +
tools/testing/selftests/seccomp/seccomp_bpf.c | 50 +++++++++++++++++++
3 files changed, 53 insertions(+)
diff --git a/include/uapi/linux/seccomp.h b/include/uapi/linux/seccomp.h
index c1735455bc53..f0c272ef0f1e 100644
--- a/include/uapi/linux/seccomp.h
+++ b/include/uapi/linux/seccomp.h
@@ -75,6 +75,8 @@ struct seccomp_notif {
__u32 pid;
__u32 flags;
struct seccomp_data data;
+ __u32 tgid;
+ __u8 pad0[4];
};
/*
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index 55a6184f5990..538bcbbcf4da 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -1061,6 +1061,7 @@ static long seccomp_notify_recv(struct seccomp_filter *filter,
unotif.id = knotif->id;
unotif.pid = task_pid_vnr(knotif->task);
+ unotif.tgid = task_tgid_vnr(knotif->task);
unotif.data = *(knotif->data);
knotif->state = SECCOMP_NOTIFY_SENT;
diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c
index c0aa46ce14f6..5658c6e95461 100644
--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
+++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
@@ -187,6 +187,8 @@ struct seccomp_notif {
__u32 pid;
__u32 flags;
struct seccomp_data data;
+ __u32 tgid;
+ __u8 pad0[4];
};
struct seccomp_notif_resp {
@@ -3226,6 +3228,8 @@ TEST(user_notification_basic)
req.pid = 0;
EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
}
+ EXPECT_EQ(pid, req.pid);
+ EXPECT_EQ(pid, req.tgid);
pollfd.fd = listener;
pollfd.events = POLLIN | POLLOUT;
@@ -3453,6 +3457,7 @@ TEST(user_notification_child_pid_ns)
EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
EXPECT_EQ(req.pid, pid);
+ EXPECT_EQ(req.tgid, pid);
resp.id = req.id;
resp.error = 0;
@@ -3686,6 +3691,51 @@ TEST(user_notification_continue)
}
}
+void *getppid_thread(void *arg)
+{
+ int *tid = arg;
+
+ *tid = syscall(__NR_gettid);
+ if (*tid <= 0)
+ return (void *)(long)errno;
+ return NULL;
+}
+
+TEST(user_notification_groupleader)
+{
+ struct seccomp_notif_resp resp = {};
+ struct seccomp_notif req = {};
+ int ret, listener, tid, pid;
+ pthread_t thread;
+ void *status;
+
+ pid = getpid();
+ ASSERT_GT(pid, 0);
+
+ ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
+ ASSERT_EQ(0, ret) {
+ TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
+ }
+
+ listener = user_trap_syscall(__NR_gettid,
+ SECCOMP_FILTER_FLAG_NEW_LISTENER);
+ ASSERT_GE(listener, 0);
+
+ ASSERT_EQ(0, pthread_create(&thread, NULL, getppid_thread, &tid));
+
+ ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
+ resp.id = req.id;
+ resp.flags = SECCOMP_USER_NOTIF_FLAG_CONTINUE;
+ ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
+
+ ASSERT_EQ(0, pthread_join(thread, &status));
+ ASSERT_EQ(0, status);
+
+ EXPECT_EQ(tid, req.pid);
+ EXPECT_EQ(pid, req.tgid);
+}
+
+
/*
* TODO:
* - add microbenchmarks
--
2.20.1
Powered by blists - more mailing lists