Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security

Pull security subsystem updates from James Morris:
 "In this release:

   - PKCS#7 parser for the key management subsystem from David Howells
   - appoint Kees Cook as seccomp maintainer
   - bugfixes and general maintenance across the subsystem"

* 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: (94 commits)
  X.509: Need to export x509_request_asymmetric_key()
  netlabel: shorter names for the NetLabel catmap funcs/structs
  netlabel: fix the catmap walking functions
  netlabel: fix the horribly broken catmap functions
  netlabel: fix a problem when setting bits below the previously lowest bit
  PKCS#7: X.509 certificate issuer and subject are mandatory fields in the ASN.1
  tpm: simplify code by using %*phN specifier
  tpm: Provide a generic means to override the chip returned timeouts
  tpm: missing tpm_chip_put in tpm_get_random()
  tpm: Properly clean sysfs entries in error path
  tpm: Add missing tpm_do_selftest to ST33 I2C driver
  PKCS#7: Use x509_request_asymmetric_key()
  Revert "selinux: fix the default socket labeling in sock_graft()"
  X.509: x509_request_asymmetric_keys() doesn't need string length arguments
  PKCS#7: fix sparse non static symbol warning
  KEYS: revert encrypted key change
  ima: add support for measuring and appraising firmware
  firmware_class: perform new LSM checks
  security: introduce kernel_fw_from_file hook
  PKCS#7: Missing inclusion of linux/err.h
  ...

7 files changed, 412 insertions, 63 deletions

diff --git a/kernel/audit.c b/kernel/audit.c
index 3ef2e0e797e8..ba2ff5a5c600 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -1677,7 +1677,7 @@ void audit_log_cap(struct audit_buffer *ab, char *prefix, kernel_cap_t *cap)
         audit_log_format(ab, " %s=", prefix);
         CAP_FOR_EACH_U32(i) {
                 audit_log_format(ab, "%08x",
-                                 cap->cap[(_KERNEL_CAPABILITY_U32S-1) - i]);
+                                 cap->cap[CAP_LAST_U32 - i]);
         }
 }
 
diff --git a/kernel/capability.c b/kernel/capability.c
index a5cf13c018ce..989f5bfc57dc 100644
--- a/kernel/capability.c
+++ b/kernel/capability.c
@@ -258,6 +258,10 @@ SYSCALL_DEFINE2(capset, cap_user_header_t, header, const cap_user_data_t, data)
                 i++;
         }
 
+        effective.cap[CAP_LAST_U32] &= CAP_LAST_U32_VALID_MASK;
+        permitted.cap[CAP_LAST_U32] &= CAP_LAST_U32_VALID_MASK;
+        inheritable.cap[CAP_LAST_U32] &= CAP_LAST_U32_VALID_MASK;
+
         new = prepare_creds();
         if (!new)
                 return -ENOMEM;
diff --git a/kernel/fork.c b/kernel/fork.c
index 5f1bf3bebb4f..fbd3497b221f 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -315,6 +315,15 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
                 goto free_ti;
 
         tsk->stack = ti;
+#ifdef CONFIG_SECCOMP
+        /*
+         * We must handle setting up seccomp filters once we're under
+         * the sighand lock in case orig has changed between now and
+         * then. Until then, filter must be NULL to avoid messing up
+         * the usage counts on the error path calling free_task.
+         */
+        tsk->seccomp.filter = NULL;
+#endif
 
         setup_thread_stack(tsk, orig);
         clear_user_return_notifier(tsk);
@@ -1081,6 +1090,39 @@ static int copy_signal(unsigned long clone_flags, struct task_struct *tsk)
         return 0;
 }
 
+static void copy_seccomp(struct task_struct *p)
+{
+#ifdef CONFIG_SECCOMP
+        /*
+         * Must be called with sighand->lock held, which is common to
+         * all threads in the group. Holding cred_guard_mutex is not
+         * needed because this new task is not yet running and cannot
+         * be racing exec.
+         */
+        BUG_ON(!spin_is_locked(&current->sighand->siglock));
+
+        /* Ref-count the new filter user, and assign it. */
+        get_seccomp_filter(current);
+        p->seccomp = current->seccomp;
+
+        /*
+         * Explicitly enable no_new_privs here in case it got set
+         * between the task_struct being duplicated and holding the
+         * sighand lock. The seccomp state and nnp must be in sync.
+         */
+        if (task_no_new_privs(current))
+                task_set_no_new_privs(p);
+
+        /*
+         * If the parent gained a seccomp mode after copying thread
+         * flags and between before we held the sighand lock, we have
+         * to manually enable the seccomp thread flag here.
+         */
+        if (p->seccomp.mode != SECCOMP_MODE_DISABLED)
+                set_tsk_thread_flag(p, TIF_SECCOMP);
+#endif
+}
+
 SYSCALL_DEFINE1(set_tid_address, int __user *, tidptr)
 {
         current->clear_child_tid = tidptr;
@@ -1195,7 +1237,6 @@ static struct task_struct *copy_process(unsigned long clone_flags,
                 goto fork_out;
 
         ftrace_graph_init_task(p);
-        get_seccomp_filter(p);
 
         rt_mutex_init_task(p);
 
@@ -1435,6 +1476,12 @@ static struct task_struct *copy_process(unsigned long clone_flags,
         spin_lock(&current->sighand->siglock);
 
         /*
+         * Copy seccomp details explicitly here, in case they were changed
+         * before holding sighand lock.
+         */
+        copy_seccomp(p);
+
+        /*
          * Process group and session signals need to be delivered to just the
          * parent before the fork or both the parent and the child after the
          * fork. Restart if a signal comes in before we add the new process to
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index 301bbc24739c..74f460179171 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -18,15 +18,17 @@
 #include <linux/compat.h>
 #include <linux/sched.h>
 #include <linux/seccomp.h>
+#include <linux/slab.h>
+#include <linux/syscalls.h>
 
 /* #define SECCOMP_DEBUG 1 */
 
 #ifdef CONFIG_SECCOMP_FILTER
 #include <asm/syscall.h>
 #include <linux/filter.h>
+#include <linux/pid.h>
 #include <linux/ptrace.h>
 #include <linux/security.h>
-#include <linux/slab.h>
 #include <linux/tracehook.h>
 #include <linux/uaccess.h>
 
@@ -172,21 +174,24 @@ static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen)
  */
 static u32 seccomp_run_filters(int syscall)
 {
-        struct seccomp_filter *f;
+        struct seccomp_filter *f = ACCESS_ONCE(current->seccomp.filter);
         struct seccomp_data sd;
         u32 ret = SECCOMP_RET_ALLOW;
 
         /* Ensure unexpected behavior doesn't result in failing open. */
-        if (WARN_ON(current->seccomp.filter == NULL))
+        if (unlikely(WARN_ON(f == NULL)))
                 return SECCOMP_RET_KILL;
 
+        /* Make sure cross-thread synced filter points somewhere sane. */
+        smp_read_barrier_depends();
+
         populate_seccomp_data(&sd);
 
         /*
          * All filters in the list are evaluated and the lowest BPF return
          * value always takes priority (ignoring the DATA).
          */
-        for (f = current->seccomp.filter; f; f = f->prev) {
+        for (; f; f = f->prev) {
                 u32 cur_ret = SK_RUN_FILTER(f->prog, (void *)&sd);
 
                 if ((cur_ret & SECCOMP_RET_ACTION) < (ret & SECCOMP_RET_ACTION))
@@ -194,29 +199,159 @@ static u32 seccomp_run_filters(int syscall)
         }
         return ret;
 }
+#endif /* CONFIG_SECCOMP_FILTER */
+
+static inline bool seccomp_may_assign_mode(unsigned long seccomp_mode)
+{
+        BUG_ON(!spin_is_locked(&current->sighand->siglock));
+
+        if (current->seccomp.mode && current->seccomp.mode != seccomp_mode)
+                return false;
+
+        return true;
+}
+
+static inline void seccomp_assign_mode(struct task_struct *task,
+                                       unsigned long seccomp_mode)
+{
+        BUG_ON(!spin_is_locked(&task->sighand->siglock));
+
+        task->seccomp.mode = seccomp_mode;
+        /*
+         * Make sure TIF_SECCOMP cannot be set before the mode (and
+         * filter) is set.
+         */
+        smp_mb__before_atomic();
+        set_tsk_thread_flag(task, TIF_SECCOMP);
+}
+
+#ifdef CONFIG_SECCOMP_FILTER
+/* Returns 1 if the parent is an ancestor of the child. */
+static int is_ancestor(struct seccomp_filter *parent,
+                       struct seccomp_filter *child)
+{
+        /* NULL is the root ancestor. */
+        if (parent == NULL)
+                return 1;
+        for (; child; child = child->prev)
+                if (child == parent)
+                        return 1;
+        return 0;
+}
 
 /**
- * seccomp_attach_filter: Attaches a seccomp filter to current.
+ * seccomp_can_sync_threads: checks if all threads can be synchronized
+ *
+ * Expects sighand and cred_guard_mutex locks to be held.
+ *
+ * Returns 0 on success, -ve on error, or the pid of a thread which was
+ * either not in the correct seccomp mode or it did not have an ancestral
+ * seccomp filter.
+ */
+static inline pid_t seccomp_can_sync_threads(void)
+{
+        struct task_struct *thread, *caller;
+
+        BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
+        BUG_ON(!spin_is_locked(&current->sighand->siglock));
+
+        /* Validate all threads being eligible for synchronization. */
+        caller = current;
+        for_each_thread(caller, thread) {
+                pid_t failed;
+
+                /* Skip current, since it is initiating the sync. */
+                if (thread == caller)
+                        continue;
+
+                if (thread->seccomp.mode == SECCOMP_MODE_DISABLED ||
+                    (thread->seccomp.mode == SECCOMP_MODE_FILTER &&
+                     is_ancestor(thread->seccomp.filter,
+                                 caller->seccomp.filter)))
+                        continue;
+
+                /* Return the first thread that cannot be synchronized. */
+                failed = task_pid_vnr(thread);
+                /* If the pid cannot be resolved, then return -ESRCH */
+                if (unlikely(WARN_ON(failed == 0)))
+                        failed = -ESRCH;
+                return failed;
+        }
+
+        return 0;
+}
+
+/**
+ * seccomp_sync_threads: sets all threads to use current's filter
+ *
+ * Expects sighand and cred_guard_mutex locks to be held, and for
+ * seccomp_can_sync_threads() to have returned success already
+ * without dropping the locks.
+ *
+ */
+static inline void seccomp_sync_threads(void)
+{
+        struct task_struct *thread, *caller;
+
+        BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
+        BUG_ON(!spin_is_locked(&current->sighand->siglock));
+
+        /* Synchronize all threads. */
+        caller = current;
+        for_each_thread(caller, thread) {
+                /* Skip current, since it needs no changes. */
+                if (thread == caller)
+                        continue;
+
+                /* Get a task reference for the new leaf node. */
+                get_seccomp_filter(caller);
+                /*
+                 * Drop the task reference to the shared ancestor since
+                 * current's path will hold a reference.  (This also
+                 * allows a put before the assignment.)
+                 */
+                put_seccomp_filter(thread);
+                smp_store_release(&thread->seccomp.filter,
+                                  caller->seccomp.filter);
+                /*
+                 * Opt the other thread into seccomp if needed.
+                 * As threads are considered to be trust-realm
+                 * equivalent (see ptrace_may_access), it is safe to
+                 * allow one thread to transition the other.
+                 */
+                if (thread->seccomp.mode == SECCOMP_MODE_DISABLED) {
+                        /*
+                         * Don't let an unprivileged task work around
+                         * the no_new_privs restriction by creating
+                         * a thread that sets it up, enters seccomp,
+                         * then dies.
+                         */
+                        if (task_no_new_privs(caller))
+                                task_set_no_new_privs(thread);
+
+                        seccomp_assign_mode(thread, SECCOMP_MODE_FILTER);
+                }
+        }
+}
+
+/**
+ * seccomp_prepare_filter: Prepares a seccomp filter for use.
  * @fprog: BPF program to install
  *
- * Returns 0 on success or an errno on failure.
+ * Returns filter on success or an ERR_PTR on failure.
  */
-static long seccomp_attach_filter(struct sock_fprog *fprog)
+static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog)
 {
         struct seccomp_filter *filter;
-        unsigned long fp_size = fprog->len * sizeof(struct sock_filter);
-        unsigned long total_insns = fprog->len;
+        unsigned long fp_size;
         struct sock_filter *fp;
         int new_len;
         long ret;
 
         if (fprog->len == 0 || fprog->len > BPF_MAXINSNS)
-                return -EINVAL;
-
-        for (filter = current->seccomp.filter; filter; filter = filter->prev)
-                total_insns += filter->prog->len + 4;  /* include a 4 instr penalty */
-        if (total_insns > MAX_INSNS_PER_PATH)
-                return -ENOMEM;
+                return ERR_PTR(-EINVAL);
+        BUG_ON(INT_MAX / fprog->len < sizeof(struct sock_filter));
+        fp_size = fprog->len * sizeof(struct sock_filter);
 
         /*
          * Installing a seccomp filter requires that the task has
@@ -224,14 +359,14 @@ static long seccomp_attach_filter(struct sock_fprog *fprog)
          * This avoids scenarios where unprivileged tasks can affect the
          * behavior of privileged children.
          */
-        if (!current->no_new_privs &&
+        if (!task_no_new_privs(current) &&
             security_capable_noaudit(current_cred(), current_user_ns(),
                                      CAP_SYS_ADMIN) != 0)
-                return -EACCES;
+                return ERR_PTR(-EACCES);
 
         fp = kzalloc(fp_size, GFP_KERNEL|__GFP_NOWARN);
         if (!fp)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         /* Copy the instructions from fprog. */
         ret = -EFAULT;
@@ -275,13 +410,7 @@ static long seccomp_attach_filter(struct sock_fprog *fprog)
 
         sk_filter_select_runtime(filter->prog);
 
-        /*
-         * If there is an existing filter, make it the prev and don't drop its
-         * task reference.
-         */
-        filter->prev = current->seccomp.filter;
-        current->seccomp.filter = filter;
-        return 0;
+        return filter;
 
 free_filter_prog:
         kfree(filter->prog);
@@ -289,19 +418,20 @@ free_filter:
         kfree(filter);
 free_prog:
         kfree(fp);
-        return ret;
+        return ERR_PTR(ret);
 }
 
 /**
- * seccomp_attach_user_filter - attaches a user-supplied sock_fprog
+ * seccomp_prepare_user_filter - prepares a user-supplied sock_fprog
  * @user_filter: pointer to the user data containing a sock_fprog.
  *
  * Returns 0 on success and non-zero otherwise.
  */
-static long seccomp_attach_user_filter(char __user *user_filter)
+static struct seccomp_filter *
+seccomp_prepare_user_filter(const char __user *user_filter)
 {
         struct sock_fprog fprog;
-        long ret = -EFAULT;
+        struct seccomp_filter *filter = ERR_PTR(-EFAULT);
 
 #ifdef CONFIG_COMPAT
         if (is_compat_task()) {
@@ -314,9 +444,56 @@ static long seccomp_attach_user_filter(char __user *user_filter)
 #endif
         if (copy_from_user(&fprog, user_filter, sizeof(fprog)))
                 goto out;
-        ret = seccomp_attach_filter(&fprog);
+        filter = seccomp_prepare_filter(&fprog);
 out:
-        return ret;
+        return filter;
+}
+
+/**
+ * seccomp_attach_filter: validate and attach filter
+ * @flags:  flags to change filter behavior
+ * @filter: seccomp filter to add to the current process
+ *
+ * Caller must be holding current->sighand->siglock lock.
+ *
+ * Returns 0 on success, -ve on error.
+ */
+static long seccomp_attach_filter(unsigned int flags,
+                                  struct seccomp_filter *filter)
+{
+        unsigned long total_insns;
+        struct seccomp_filter *walker;
+
+        BUG_ON(!spin_is_locked(&current->sighand->siglock));
+
+        /* Validate resulting filter length. */
+        total_insns = filter->prog->len;
+        for (walker = current->seccomp.filter; walker; walker = walker->prev)
+                total_insns += walker->prog->len + 4;  /* 4 instr penalty */
+        if (total_insns > MAX_INSNS_PER_PATH)
+                return -ENOMEM;
+
+        /* If thread sync has been requested, check that it is possible. */
+        if (flags & SECCOMP_FILTER_FLAG_TSYNC) {
+                int ret;
+
+                ret = seccomp_can_sync_threads();
+                if (ret)
+                        return ret;
+        }
+
+        /*
+         * If there is an existing filter, make it the prev and don't drop its
+         * task reference.
+         */
+        filter->prev = current->seccomp.filter;
+        current->seccomp.filter = filter;
+
+        /* Now that the new filter is in place, synchronize to all threads. */
+        if (flags & SECCOMP_FILTER_FLAG_TSYNC)
+                seccomp_sync_threads();
+
+        return 0;
 }
 
 /* get_seccomp_filter - increments the reference count of the filter on @tsk */
@@ -329,6 +506,14 @@ void get_seccomp_filter(struct task_struct *tsk)
         atomic_inc(&orig->usage);
 }
 
+static inline void seccomp_filter_free(struct seccomp_filter *filter)
+{
+        if (filter) {
+                sk_filter_free(filter->prog);
+                kfree(filter);
+        }
+}
+
 /* put_seccomp_filter - decrements the ref count of tsk->seccomp.filter */
 void put_seccomp_filter(struct task_struct *tsk)
 {
@@ -337,8 +522,7 @@ void put_seccomp_filter(struct task_struct *tsk)
         while (orig && atomic_dec_and_test(&orig->usage)) {
                 struct seccomp_filter *freeme = orig;
                 orig = orig->prev;
-                sk_filter_free(freeme->prog);
-                kfree(freeme);
+                seccomp_filter_free(freeme);
         }
 }
 
@@ -382,12 +566,17 @@ static int mode1_syscalls_32[] = {
 
 int __secure_computing(int this_syscall)
 {
-        int mode = current->seccomp.mode;
         int exit_sig = 0;
         int *syscall;
         u32 ret;
 
-        switch (mode) {
+        /*
+         * Make sure that any changes to mode from another thread have
+         * been seen after TIF_SECCOMP was seen.
+         */
+        rmb();
+
+        switch (current->seccomp.mode) {
         case SECCOMP_MODE_STRICT:
                 syscall = mode1_syscalls;
 #ifdef CONFIG_COMPAT
@@ -473,47 +662,152 @@ long prctl_get_seccomp(void)
 }
 
 /**
- * prctl_set_seccomp: configures current->seccomp.mode
- * @seccomp_mode: requested mode to use
- * @filter: optional struct sock_fprog for use with SECCOMP_MODE_FILTER
+ * seccomp_set_mode_strict: internal function for setting strict seccomp
  *
- * This function may be called repeatedly with a @seccomp_mode of
- * SECCOMP_MODE_FILTER to install additional filters.  Every filter
- * successfully installed will be evaluated (in reverse order) for each system
- * call the task makes.
+ * Once current->seccomp.mode is non-zero, it may not be changed.
+ *
+ * Returns 0 on success or -EINVAL on failure.
+ */
+static long seccomp_set_mode_strict(void)
+{
+        const unsigned long seccomp_mode = SECCOMP_MODE_STRICT;
+        long ret = -EINVAL;
+
+        spin_lock_irq(&current->sighand->siglock);
+
+        if (!seccomp_may_assign_mode(seccomp_mode))
+                goto out;
+
+#ifdef TIF_NOTSC
+        disable_TSC();
+#endif
+        seccomp_assign_mode(current, seccomp_mode);
+        ret = 0;
+
+out:
+        spin_unlock_irq(&current->sighand->siglock);
+
+        return ret;
+}
+
+#ifdef CONFIG_SECCOMP_FILTER
+/**
+ * seccomp_set_mode_filter: internal function for setting seccomp filter
+ * @flags:  flags to change filter behavior
+ * @filter: struct sock_fprog containing filter
+ *
+ * This function may be called repeatedly to install additional filters.
+ * Every filter successfully installed will be evaluated (in reverse order)
+ * for each system call the task makes.
  *
  * Once current->seccomp.mode is non-zero, it may not be changed.
  *
  * Returns 0 on success or -EINVAL on failure.
  */
-long prctl_set_seccomp(unsigned long seccomp_mode, char __user *filter)
+static long seccomp_set_mode_filter(unsigned int flags,
+                                    const char __user *filter)
 {
+        const unsigned long seccomp_mode = SECCOMP_MODE_FILTER;
+        struct seccomp_filter *prepared = NULL;
         long ret = -EINVAL;
 
-        if (current->seccomp.mode &&
-            current->seccomp.mode != seccomp_mode)
+        /* Validate flags. */
+        if (flags & ~SECCOMP_FILTER_FLAG_MASK)
+                return -EINVAL;
+
+        /* Prepare the new filter before holding any locks. */
+        prepared = seccomp_prepare_user_filter(filter);
+        if (IS_ERR(prepared))
+                return PTR_ERR(prepared);
+
+        /*
+         * Make sure we cannot change seccomp or nnp state via TSYNC
+         * while another thread is in the middle of calling exec.
+         */
+        if (flags & SECCOMP_FILTER_FLAG_TSYNC &&
+            mutex_lock_killable(&current->signal->cred_guard_mutex))
+                goto out_free;
+
+        spin_lock_irq(&current->sighand->siglock);
+
+        if (!seccomp_may_assign_mode(seccomp_mode))
+                goto out;
+
+        ret = seccomp_attach_filter(flags, prepared);
+        if (ret)
                 goto out;
+        /* Do not free the successfully attached filter. */
+        prepared = NULL;
+
+        seccomp_assign_mode(current, seccomp_mode);
+out:
+        spin_unlock_irq(&current->sighand->siglock);
+        if (flags & SECCOMP_FILTER_FLAG_TSYNC)
+                mutex_unlock(&current->signal->cred_guard_mutex);
+out_free:
+        seccomp_filter_free(prepared);
+        return ret;
+}
+#else
+static inline long seccomp_set_mode_filter(unsigned int flags,
+                                           const char __user *filter)
+{
+        return -EINVAL;
+}
+#endif
+
+/* Common entry point for both prctl and syscall. */
+static long do_seccomp(unsigned int op, unsigned int flags,
+                       const char __user *uargs)
+{
+        switch (op) {
+        case SECCOMP_SET_MODE_STRICT:
+                if (flags != 0 || uargs != NULL)
+                        return -EINVAL;
+                return seccomp_set_mode_strict();
+        case SECCOMP_SET_MODE_FILTER:
+                return seccomp_set_mode_filter(flags, uargs);
+        default:
+                return -EINVAL;
+        }
+}
+
+SYSCALL_DEFINE3(seccomp, unsigned int, op, unsigned int, flags,
+                         const char __user *, uargs)
+{
+        return do_seccomp(op, flags, uargs);
+}
+
+/**
+ * prctl_set_seccomp: configures current->seccomp.mode
+ * @seccomp_mode: requested mode to use
+ * @filter: optional struct sock_fprog for use with SECCOMP_MODE_FILTER
+ *
+ * Returns 0 on success or -EINVAL on failure.
+ */
+long prctl_set_seccomp(unsigned long seccomp_mode, char __user *filter)
+{
+        unsigned int op;
+        char __user *uargs;
 
         switch (seccomp_mode) {
         case SECCOMP_MODE_STRICT:
-                ret = 0;
-#ifdef TIF_NOTSC
-                disable_TSC();
-#endif
+                op = SECCOMP_SET_MODE_STRICT;
+                /*
+                 * Setting strict mode through prctl always ignored filter,
+                 * so make sure it is always NULL here to pass the internal
+                 * check in do_seccomp().
+                 */
+                uargs = NULL;
                 break;
-#ifdef CONFIG_SECCOMP_FILTER
         case SECCOMP_MODE_FILTER:
-                ret = seccomp_attach_user_filter(filter);
-                if (ret)
-                        goto out;
+                op = SECCOMP_SET_MODE_FILTER;
+                uargs = filter;
                 break;
-#endif
         default:
-                goto out;
+                return -EINVAL;
         }
 
-        current->seccomp.mode = seccomp_mode;
-        set_thread_flag(TIF_SECCOMP);
-out:
-        return ret;
+        /* prctl interface doesn't have flags, so they are always zero. */
+        return do_seccomp(op, 0, uargs);
 }
diff --git a/kernel/sys.c b/kernel/sys.c
index 66a751ebf9d9..ce8129192a26 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1990,12 +1990,12 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
                 if (arg2 != 1 || arg3 || arg4 || arg5)
                         return -EINVAL;
 
-                current->no_new_privs = 1;
+                task_set_no_new_privs(current);
                 break;
         case PR_GET_NO_NEW_PRIVS:
                 if (arg2 || arg3 || arg4 || arg5)
                         return -EINVAL;
-                return current->no_new_privs ? 1 : 0;
+                return task_no_new_privs(current) ? 1 : 0;
         case PR_GET_THP_DISABLE:
                 if (arg2 || arg3 || arg4 || arg5)
                         return -EINVAL;
diff --git a/kernel/sys_ni.c b/kernel/sys_ni.c
index 36441b51b5df..2904a2105914 100644
--- a/kernel/sys_ni.c
+++ b/kernel/sys_ni.c
@@ -213,3 +213,6 @@ cond_syscall(compat_sys_open_by_handle_at);
 
 /* compare kernel pointers */
 cond_syscall(sys_kcmp);
+
+/* operate on Secure Computing state */
+cond_syscall(sys_seccomp);
diff --git a/kernel/system_keyring.c b/kernel/system_keyring.c
index 52ebc70263f4..875f64e8935b 100644
--- a/kernel/system_keyring.c
+++ b/kernel/system_keyring.c
@@ -89,6 +89,7 @@ static __init int load_system_certificate_list(void)
                         pr_err("Problem loading in-kernel X.509 certificate (%ld)\n",
                                PTR_ERR(key));
                 } else {
+                        set_bit(KEY_FLAG_BUILTIN, &key_ref_to_ptr(key)->flags);
                         pr_notice("Loaded X.509 cert '%s'\n",
                                   key_ref_to_ptr(key)->description);
                         key_ref_put(key);