seccomp: add a return code to trap to userspace

This patch introduces a means for syscalls matched in seccomp to notify
some other task that a particular filter has been triggered.

The motivation for this is primarily for use with containers. For example,
if a container does an init_module(), we obviously don't want to load this
untrusted code, which may be compiled for the wrong version of the kernel
anyway. Instead, we could parse the module image, figure out which module
the container is trying to load and load it on the host.

As another example, containers cannot mount() in general since various
filesystems assume a trusted image. However, if an orchestrator knows that
e.g. a particular block device has not been exposed to a container for
writing, it want to allow the container to mount that block device (that
is, handle the mount for it).

This patch adds functionality that is already possible via at least two
other means that I know about, both of which involve ptrace(): first, one
could ptrace attach, and then iterate through syscalls via PTRACE_SYSCALL.
Unfortunately this is slow, so a faster version would be to install a
filter that does SECCOMP_RET_TRACE, which triggers a PTRACE_EVENT_SECCOMP.
Since ptrace allows only one tracer, if the container runtime is that
tracer, users inside the container (or outside) trying to debug it will not
be able to use ptrace, which is annoying. It also means that older
distributions based on Upstart cannot boot inside containers using ptrace,
since upstart itself uses ptrace to monitor services while starting.

The actual implementation of this is fairly small, although getting the
synchronization right was/is slightly complex.

Finally, it's worth noting that the classic seccomp TOCTOU of reading
memory data from the task still applies here, but can be avoided with
careful design of the userspace handler: if the userspace handler reads all
of the task memory that is necessary before applying its security policy,
the tracee's subsequent memory edits will not be read by the tracer.

Signed-off-by: Tycho Andersen <tycho@tycho.ws>
CC: Kees Cook <keescook@chromium.org>
CC: Andy Lutomirski <luto@amacapital.net>
CC: Oleg Nesterov <oleg@redhat.com>
CC: Eric W. Biederman <ebiederm@xmission.com>
CC: "Serge E. Hallyn" <serge@hallyn.com>
Acked-by: Serge Hallyn <serge@hallyn.com>
CC: Christian Brauner <christian@brauner.io>
CC: Tyler Hicks <tyhicks@canonical.com>
CC: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>
Signed-off-by: Kees Cook <keescook@chromium.org>

1 files changed, 445 insertions, 2 deletions

diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c
index e1473234968d..5c9768a1b8cd 100644
--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
+++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
@@ -5,6 +5,7 @@
  * Test code for seccomp bpf.
  */
 
+#define _GNU_SOURCE
 #include <sys/types.h>
 
 /*
@@ -40,10 +41,12 @@
 #include <sys/fcntl.h>
 #include <sys/mman.h>
 #include <sys/times.h>
+#include <sys/socket.h>
+#include <sys/ioctl.h>
 
-#define _GNU_SOURCE
 #include <unistd.h>
 #include <sys/syscall.h>
+#include <poll.h>
 
 #include "../kselftest_harness.h"
 
@@ -133,6 +136,10 @@ struct seccomp_data {
 #define SECCOMP_GET_ACTION_AVAIL 2
 #endif
 
+#ifndef SECCOMP_GET_NOTIF_SIZES
+#define SECCOMP_GET_NOTIF_SIZES 3
+#endif
+
 #ifndef SECCOMP_FILTER_FLAG_TSYNC
 #define SECCOMP_FILTER_FLAG_TSYNC (1UL << 0)
 #endif
@@ -154,6 +161,44 @@ struct seccomp_metadata {
 };
 #endif
 
+#ifndef SECCOMP_FILTER_FLAG_NEW_LISTENER
+#define SECCOMP_FILTER_FLAG_NEW_LISTENER        (1UL << 3)
+
+#define SECCOMP_RET_USER_NOTIF 0x7fc00000U
+
+#define SECCOMP_IOC_MAGIC               '!'
+#define SECCOMP_IO(nr)                  _IO(SECCOMP_IOC_MAGIC, nr)
+#define SECCOMP_IOR(nr, type)           _IOR(SECCOMP_IOC_MAGIC, nr, type)
+#define SECCOMP_IOW(nr, type)           _IOW(SECCOMP_IOC_MAGIC, nr, type)
+#define SECCOMP_IOWR(nr, type)          _IOWR(SECCOMP_IOC_MAGIC, nr, type)
+
+/* Flags for seccomp notification fd ioctl. */
+#define SECCOMP_IOCTL_NOTIF_RECV        SECCOMP_IOWR(0, struct seccomp_notif)
+#define SECCOMP_IOCTL_NOTIF_SEND        SECCOMP_IOWR(1, \
+                                                struct seccomp_notif_resp)
+#define SECCOMP_IOCTL_NOTIF_ID_VALID    SECCOMP_IOR(2, __u64)
+
+struct seccomp_notif {
+        __u64 id;
+        __u32 pid;
+        __u32 flags;
+        struct seccomp_data data;
+};
+
+struct seccomp_notif_resp {
+        __u64 id;
+        __s64 val;
+        __s32 error;
+        __u32 flags;
+};
+
+struct seccomp_notif_sizes {
+        __u16 seccomp_notif;
+        __u16 seccomp_notif_resp;
+        __u16 seccomp_data;
+};
+#endif
+
 #ifndef seccomp
 int seccomp(unsigned int op, unsigned int flags, void *args)
 {
@@ -2077,7 +2122,8 @@ TEST(detect_seccomp_filter_flags)
 {
         unsigned int flags[] = { SECCOMP_FILTER_FLAG_TSYNC,
                                  SECCOMP_FILTER_FLAG_LOG,
-                                 SECCOMP_FILTER_FLAG_SPEC_ALLOW };
+                                 SECCOMP_FILTER_FLAG_SPEC_ALLOW,
+                                 SECCOMP_FILTER_FLAG_NEW_LISTENER };
         unsigned int flag, all_flags;
         int i;
         long ret;
@@ -2933,6 +2979,403 @@ skip:
         ASSERT_EQ(0, kill(pid, SIGKILL));
 }
 
+static int user_trap_syscall(int nr, unsigned int flags)
+{
+        struct sock_filter filter[] = {
+                BPF_STMT(BPF_LD+BPF_W+BPF_ABS,
+                        offsetof(struct seccomp_data, nr)),
+                BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, nr, 0, 1),
+                BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_USER_NOTIF),
+                BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
+        };
+
+        struct sock_fprog prog = {
+                .len = (unsigned short)ARRAY_SIZE(filter),
+                .filter = filter,
+        };
+
+        return seccomp(SECCOMP_SET_MODE_FILTER, flags, &prog);
+}
+
+#define USER_NOTIF_MAGIC 116983961184613L
+TEST(user_notification_basic)
+{
+        pid_t pid;
+        long ret;
+        int status, listener;
+        struct seccomp_notif req = {};
+        struct seccomp_notif_resp resp = {};
+        struct pollfd pollfd;
+
+        struct sock_filter filter[] = {
+                BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
+        };
+        struct sock_fprog prog = {
+                .len = (unsigned short)ARRAY_SIZE(filter),
+                .filter = filter,
+        };
+
+        pid = fork();
+        ASSERT_GE(pid, 0);
+
+        /* Check that we get -ENOSYS with no listener attached */
+        if (pid == 0) {
+                if (user_trap_syscall(__NR_getpid, 0) < 0)
+                        exit(1);
+                ret = syscall(__NR_getpid);
+                exit(ret >= 0 || errno != ENOSYS);
+        }
+
+        EXPECT_EQ(waitpid(pid, &status, 0), pid);
+        EXPECT_EQ(true, WIFEXITED(status));
+        EXPECT_EQ(0, WEXITSTATUS(status));
+
+        /* Add some no-op filters so for grins. */
+        EXPECT_EQ(seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog), 0);
+        EXPECT_EQ(seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog), 0);
+        EXPECT_EQ(seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog), 0);
+        EXPECT_EQ(seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog), 0);
+
+        /* Check that the basic notification machinery works */
+        listener = user_trap_syscall(__NR_getpid,
+                                     SECCOMP_FILTER_FLAG_NEW_LISTENER);
+        EXPECT_GE(listener, 0);
+
+        /* Installing a second listener in the chain should EBUSY */
+        EXPECT_EQ(user_trap_syscall(__NR_getpid,
+                                    SECCOMP_FILTER_FLAG_NEW_LISTENER),
+                  -1);
+        EXPECT_EQ(errno, EBUSY);
+
+        pid = fork();
+        ASSERT_GE(pid, 0);
+
+        if (pid == 0) {
+                ret = syscall(__NR_getpid);
+                exit(ret != USER_NOTIF_MAGIC);
+        }
+
+        pollfd.fd = listener;
+        pollfd.events = POLLIN | POLLOUT;
+
+        EXPECT_GT(poll(&pollfd, 1, -1), 0);
+        EXPECT_EQ(pollfd.revents, POLLIN);