Commit ea0ab643 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'seccomp-v5.10-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux 

Pull seccomp fixes from Kees Cook:
 "This gets the seccomp selftests running again on powerpc and sh, and
  fixes an audit reporting oversight noticed in both seccomp and ptrace.

   - Fix typos in seccomp selftests on powerpc and sh (Kees Cook)

   - Fix PF_SUPERPRIV audit marking in seccomp and ptrace (Mickaël
     Salaün)"

* tag 'seccomp-v5.10-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  selftests/seccomp: sh: Fix register names
  selftests/seccomp: powerpc: Fix typo in macro variable name
  seccomp: Set PF_SUPERPRIV when checking capability
  ptrace: Set PF_SUPERPRIV when checking capability
parents 27bba9c5 4c222f31

kernel/ptrace.c

+5 −11
Original line number Diff line number Diff line
@@ -264,17 +264,11 @@ static int ptrace_check_attach(struct task_struct *child, bool ignore_state) 
	return ret;

}



static bool ptrace_has_cap(const struct cred *cred, struct user_namespace *ns,

			   unsigned int mode)

static bool ptrace_has_cap(struct user_namespace *ns, unsigned int mode)

{

	int ret;



	if (mode & PTRACE_MODE_NOAUDIT)

		ret = security_capable(cred, ns, CAP_SYS_PTRACE, CAP_OPT_NOAUDIT);

	else

		ret = security_capable(cred, ns, CAP_SYS_PTRACE, CAP_OPT_NONE);



	return ret == 0;

		return ns_capable_noaudit(ns, CAP_SYS_PTRACE);

	return ns_capable(ns, CAP_SYS_PTRACE);

}



/* Returns 0 on success, -errno on denial. */
@@ -326,7 +320,7 @@ static int __ptrace_may_access(struct task_struct *task, unsigned int mode) 
	    gid_eq(caller_gid, tcred->sgid) &&

	    gid_eq(caller_gid, tcred->gid))

		goto ok;

	if (ptrace_has_cap(cred, tcred->user_ns, mode))

	if (ptrace_has_cap(tcred->user_ns, mode))

		goto ok;

	rcu_read_unlock();

	return -EPERM;
@@ -345,7 +339,7 @@ ok: 
	mm = task->mm;

	if (mm &&

	    ((get_dumpable(mm) != SUID_DUMP_USER) &&

	     !ptrace_has_cap(cred, mm->user_ns, mode)))

	     !ptrace_has_cap(mm->user_ns, mode)))

	    return -EPERM;



	return security_ptrace_access_check(task, mode);

kernel/seccomp.c

+2 −3
Original line number Diff line number Diff line
@@ -38,7 +38,7 @@ 
#include <linux/filter.h>

#include <linux/pid.h>

#include <linux/ptrace.h>

#include <linux/security.h>

#include <linux/capability.h>

#include <linux/tracehook.h>

#include <linux/uaccess.h>

#include <linux/anon_inodes.h>
@@ -558,8 +558,7 @@ static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog) 
	 * behavior of privileged children.

	 */

	if (!task_no_new_privs(current) &&

	    security_capable(current_cred(), current_user_ns(),

				     CAP_SYS_ADMIN, CAP_OPT_NOAUDIT) != 0)

			!ns_capable_noaudit(current_user_ns(), CAP_SYS_ADMIN))

		return ERR_PTR(-EACCES);



	/* Allocate a new seccomp_filter */

tools/testing/selftests/seccomp/seccomp_bpf.c

+4 −4
Original line number Diff line number Diff line
@@ -1758,10 +1758,10 @@ TEST_F(TRACE_poke, getpid_runs_normally) 
		 * and the code is stored as a positive value.	\

		 */						\

		if (_result < 0) {				\

			SYSCALL_RET(_regs) = -result;		\

			SYSCALL_RET(_regs) = -_result;		\

			(_regs).ccr |= 0x10000000;		\

		} else {					\

			SYSCALL_RET(_regs) = result;		\

			SYSCALL_RET(_regs) = _result;		\

			(_regs).ccr &= ~0x10000000;		\

		}						\

	} while (0)
@@ -1804,8 +1804,8 @@ TEST_F(TRACE_poke, getpid_runs_normally) 
#define SYSCALL_RET(_regs)	(_regs).a[(_regs).windowbase * 4 + 2]

#elif defined(__sh__)

# define ARCH_REGS		struct pt_regs

# define SYSCALL_NUM(_regs)	(_regs).gpr[3]

# define SYSCALL_RET(_regs)	(_regs).gpr[0]

# define SYSCALL_NUM(_regs)	(_regs).regs[3]

# define SYSCALL_RET(_regs)	(_regs).regs[0]

#else

# error "Do not know how to find your architecture's registers and syscalls"

#endif

CRA Git | Maintained and supported by SUSTech CRA and CCSE