linux-kernel - [GIT PULL] seccomp updates for v5.10-rc1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <202010121512.015F57CC@keescook>
Date:   Mon, 12 Oct 2020 15:15:32 -0700
From:   Kees Cook <keescook@...omium.org>
To:     Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     linux-kernel@...r.kernel.org,
        Christian Brauner <christian.brauner@...ntu.com>,
        Denis Efremov <efremov@...ux.com>,
        Hulk Robot <hulkci@...wei.com>, Jann Horn <jannh@...gle.com>,
        Michael Ellerman <mpe@...erman.id.au>,
        Rich Felker <dalias@...c.org>,
        Shuah Khan <skhan@...uxfoundation.org>,
        Thadeu Lima de Souza Cascardo <cascardo@...onical.com>,
        Tycho Andersen <tycho@...ho.pizza>,
        YiFei Zhu <yifeifz2@...inois.edu>, Zou Wei <zou_wei@...wei.com>
Subject: [GIT PULL] seccomp updates for v5.10-rc1

Hi Linus,

Please pull these seccomp updates for v5.10-rc1. The bulk of the changes
are with the seccomp selftests to accommodate some powerpc-specific
behavioral characteristics. Additional cleanups, fixes, and improvements
are also included, noted in the tag description.

Thanks!

-Kees

The following changes since commit e839317900e9f13c83d8711d684de88c625b307a:

  seccomp: don't leave dangling ->notif if file allocation fails (2020-09-08 11:30:16 -0700)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git tags/seccomp-v5.10-rc1

for you to fetch changes up to dfe719fef03d752f1682fa8aeddf30ba501c8555:

  seccomp: Make duplicate listener detection non-racy (2020-10-08 13:17:47 -0700)

----------------------------------------------------------------
seccomp updates for v5.10-rc1

- heavily refactor seccomp selftests (and clone3 selftests dependency) to
  fix powerpc (Kees Cook, Thadeu Lima de Souza Cascardo)
- fix style issue in selftests (Zou Wei)
- upgrade "unknown action" from KILL_THREAD to KILL_PROCESS (Rich Felker)
- replace task_pt_regs(current) with current_pt_regs() (Denis Efremov)
- fix corner-case race in USER_NOTIF (Jann Horn)
- make CONFIG_SECCOMP no longer per-arch (YiFei Zhu)

----------------------------------------------------------------
Denis Efremov (1):
      seccomp: Use current_pt_regs() instead of task_pt_regs(current)

Jann Horn (1):
      seccomp: Make duplicate listener detection non-racy

Kees Cook (18):
      selftests/seccomp: Add test for unknown SECCOMP_RET kill behavior
      selftests/seccomp: Use __NR_mknodat instead of __NR_mknod
      selftests/seccomp: Refactor arch register macros to avoid xtensa special case
      selftests/seccomp: Provide generic syscall setting macro
      selftests/seccomp: mips: Define SYSCALL_NUM_SET macro
      selftests/seccomp: arm: Define SYSCALL_NUM_SET macro
      selftests/seccomp: arm64: Define SYSCALL_NUM_SET macro
      selftests/seccomp: mips: Remove O32-specific macro
      selftests/seccomp: Remove syscall setting #ifdefs
      selftests/seccomp: Convert HAVE_GETREG into ARCH_GETREG/ARCH_SETREG
      selftests/seccomp: Convert REGSET calls into ARCH_GETREG/ARCH_SETREG
      selftests/seccomp: Avoid redundant register flushes
      selftests/seccomp: Remove SYSCALL_NUM_RET_SHARE_REG in favor of SYSCALL_RET_SET
      selftests/seccomp: powerpc: Fix seccomp return value testing
      selftests/seccomp: Record syscall during ptrace entry
      selftests/seccomp: Allow syscall nr and ret value to be set separately
      selftests/seccomp: powerpc: Set syscall return during ptrace syscall exit
      selftests/clone3: Avoid OS-defined clone_args

Rich Felker (1):
      seccomp: kill process instead of thread for unknown actions

YiFei Zhu (1):
      seccomp: Move config option SECCOMP to arch/Kconfig

Zou Wei (1):
      selftests/seccomp: Use bitwise instead of arithmetic operator for flags

 arch/Kconfig                                       |  30 ++
 arch/arm/Kconfig                                   |  15 +-
 arch/arm64/Kconfig                                 |  13 -
 arch/csky/Kconfig                                  |  13 -
 arch/microblaze/Kconfig                            |  18 +-
 arch/mips/Kconfig                                  |  17 -
 arch/parisc/Kconfig                                |  16 -
 arch/powerpc/Kconfig                               |  17 -
 arch/riscv/Kconfig                                 |  13 -
 arch/s390/Kconfig                                  |  17 -
 arch/sh/Kconfig                                    |  16 -
 arch/sparc/Kconfig                                 |  18 +-
 arch/um/Kconfig                                    |  16 -
 arch/x86/Kconfig                                   |  16 -
 arch/xtensa/Kconfig                                |  14 -
 kernel/seccomp.c                                   |  64 ++-
 tools/testing/selftests/clone3/clone3.c            |  45 +--
 .../clone3/clone3_cap_checkpoint_restore.c         |   4 +-
 .../selftests/clone3/clone3_clear_sighand.c        |   2 +-
 tools/testing/selftests/clone3/clone3_selftests.h  |  24 +-
 tools/testing/selftests/clone3/clone3_set_tid.c    |   4 +-
 tools/testing/selftests/pidfd/pidfd_setns_test.c   |   2 +-
 tools/testing/selftests/seccomp/seccomp_bpf.c      | 440 +++++++++++++--------
 23 files changed, 397 insertions(+), 437 deletions(-)

-- 
Kees Cook