4 files changed, 136 insertions, 4 deletions

diff --git a/include/linux/init_task.h b/include/linux/init_task.h
index 580f70c0239..56deaf25371 100644
--- a/include/linux/init_task.h
+++ b/include/linux/init_task.h
@@ -126,6 +126,17 @@ extern struct cred init_cred;
 # define INIT_PERF_EVENTS(tsk)
 #endif
 
+#ifdef CONFIG_SECCOMP_FILTER
+# define INIT_SECCOMP_FILTER(tsk)                                       \
+        .seccomp = { \
+                .filters_guard = \
+                        __MUTEX_INITIALIZER(tsk.seccomp.filters_guard), \
+        },
+#else
+# define INIT_SECCOMP_FILTER(tsk)
+#endif
+
+
 /*
  *  INIT_TASK is used to set up the first task table, touch at
  * your own risk!. Base=0, limit=0x1fffff (=2MB)
@@ -188,6 +199,7 @@ extern struct cred init_cred;
         .dirties = INIT_PROP_LOCAL_SINGLE(dirties),                     \
         INIT_IDS                                                        \
         INIT_PERF_EVENTS(tsk)                                           \
+        INIT_SECCOMP_FILTER(tsk)                                        \
         INIT_TRACE_IRQFLAGS                                             \
         INIT_LOCKDEP                                                    \
         INIT_FTRACE_GRAPH                                               \
diff --git a/include/linux/prctl.h b/include/linux/prctl.h
index da7837bbd2c..74deeb717c6 100644
--- a/include/linux/prctl.h
+++ b/include/linux/prctl.h
@@ -64,6 +64,13 @@
 #define PR_GET_SECCOMP  21
 #define PR_SET_SECCOMP  22
 
+/* Get/set process seccomp filters */
+#define PR_GET_SECCOMP_FILTER   35
+#define PR_SET_SECCOMP_FILTER   36
+#define PR_CLEAR_SECCOMP_FILTER 37
+#  define PR_SECCOMP_FILTER_SYSCALL     0
+#  define PR_SECCOMP_FILTER_EVENT       1
+
 /* Get/set the capability bounding set (as per security/commoncap.c) */
 #define PR_CAPBSET_READ 23
 #define PR_CAPBSET_DROP 24
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 7badc5d9f07..9cdfbf4a97a 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1411,7 +1411,7 @@ struct task_struct {
         uid_t loginuid;
         unsigned int sessionid;
 #endif
-        seccomp_t seccomp;
+        struct seccomp_struct seccomp;
 
 /* Thread group tracking */
         u32 parent_exec_id;
diff --git a/include/linux/seccomp.h b/include/linux/seccomp.h
index 167c33361d9..f81a9827334 100644
--- a/include/linux/seccomp.h
+++ b/include/linux/seccomp.h
@@ -1,13 +1,35 @@
 #ifndef _LINUX_SECCOMP_H
 #define _LINUX_SECCOMP_H
 
+struct seq_file;
 
 #ifdef CONFIG_SECCOMP
 
+#include <linux/errno.h>
 #include <linux/thread_info.h>
+#include <linux/types.h>
+#include <linux/mutex.h>
 #include <asm/seccomp.h>
 
-typedef struct { int mode; } seccomp_t;
+struct seccomp_filters;
+/**
+ * struct seccomp_struct - the state of a seccomp'ed process
+ *
+ * @mode:
+ *     if this is 1, the process is under standard seccomp rules
+ *             is 13, the process is only allowed to make system calls where
+ *                    associated filters evaluate successfully.
+ * @filters: Metadata for filters if using CONFIG_SECCOMP_FILTER.
+ *           @filters assignment and use should always be guarded by
+ *           @filters_guard.
+ */
+struct seccomp_struct {
+        int mode;
+#ifdef CONFIG_SECCOMP_FILTER
+        struct mutex filters_guard;
+        struct seccomp_filters *filters;
+#endif
+};
 
 extern void __secure_computing(int);
 static inline void secure_computing(int this_syscall)
@@ -23,8 +45,7 @@ extern long prctl_set_seccomp(unsigned long);
 
 #include <linux/errno.h>
 
-typedef struct { } seccomp_t;
-
+struct seccomp_struct { };
 #define secure_computing(x) do { } while (0)
 
 static inline long prctl_get_seccomp(void)
@@ -39,4 +60,96 @@ static inline long prctl_set_seccomp(unsigned long arg2)
 
 #endif /* CONFIG_SECCOMP */
 
+#ifdef CONFIG_SECCOMP_FILTER
+
+#define seccomp_filter_init_task(_tsk) do { \
+        mutex_init(&(_tsk)->seccomp.filters_guard); \
+        (_tsk)->seccomp.filters = NULL; \
+} while (0);
+
+/* Do nothing unless seccomp filtering is active. If not, the execve boundary
+ * can not be cleanly enforced and preset filters may leak across execve calls.
+ */
+#define seccomp_filter_fork(_tsk, _orig) do { \
+        if ((_tsk)->seccomp.mode) { \
+                (_tsk)->seccomp.mode = (_orig)->seccomp.mode; \
+                mutex_lock(&(_orig)->seccomp.filters_guard); \
+                (_tsk)->seccomp.filters = \
+                        get_seccomp_filters((_orig)->seccomp.filters); \
+                mutex_unlock(&(_orig)->seccomp.filters_guard); \
+        } \
+} while (0);
+
+/* No locking is needed here because the task_struct will
+ * have no parallel consumers.
+ */
+#define seccomp_filter_free_task(_tsk) do { \
+        put_seccomp_filters((_tsk)->seccomp.filters); \
+} while (0);
+
+extern int seccomp_show_filters(struct seccomp_filters *filters,
+                                struct seq_file *);
+extern long seccomp_set_filter(int, char *);
+extern long seccomp_clear_filter(int);
+extern long seccomp_get_filter(int, char *, unsigned long);
+
+extern long prctl_set_seccomp_filter(unsigned long, unsigned long,
+                                     char __user *);
+extern long prctl_get_seccomp_filter(unsigned long, unsigned long,
+                                     char __user *, unsigned long);
+extern long prctl_clear_seccomp_filter(unsigned long, unsigned long);
+
+extern struct seccomp_filters *get_seccomp_filters(struct seccomp_filters *);
+extern void put_seccomp_filters(struct seccomp_filters *);
+
+extern int seccomp_test_filters(int);
+extern void seccomp_filter_log_failure(int);
+
+#else  /* CONFIG_SECCOMP_FILTER */
+
+struct seccomp_filters { };
+#define seccomp_filter_init_task(_tsk) do { } while (0);
+#define seccomp_filter_fork(_tsk, _orig) do { } while (0);
+#define seccomp_filter_free_task(_tsk) do { } while (0);
+
+static inline int seccomp_show_filters(struct seccomp_filters *filters,
+                                       struct seq_file *m)
+{
+        return -ENOSYS;
+}
+
+static inline long seccomp_set_filter(int syscall_nr, char *filter)
+{
+        return -ENOSYS;
+}
+
+static inline long seccomp_clear_filter(int syscall_nr)
+{
+        return -ENOSYS;
+}
+
+static inline long seccomp_get_filter(int syscall_nr,
+                                      char *buf, unsigned long available)
+{
+        return -ENOSYS;
+}
+
+static inline long prctl_set_seccomp_filter(unsigned long a2, unsigned long a3,
+                                            char __user *a4)
+{
+        return -ENOSYS;
+}
+
+static inline long prctl_clear_seccomp_filter(unsigned long a2,
+                                              unsigned long a3)
+{
+        return -ENOSYS;
+}
+
+static inline long prctl_get_seccomp_filter(unsigned long a2, unsigned long a3,
+                                            char __user *a4, unsigned long a5)
+{
+        return -ENOSYS;
+}
+#endif  /* CONFIG_SECCOMP_FILTER */
 #endif /* _LINUX_SECCOMP_H */