Hello,
this series adds support for seccomp filter on xtensa and updates selftests/seccomp.
Max Filippov (3): xtensa: expose syscall through user_pt_regs xtensa: add seccomp support selftests/seccomp: add xtensa support
.../seccomp/seccomp-filter/arch-support.txt | 2 +- arch/xtensa/Kconfig | 15 +++++++++++++++ arch/xtensa/include/asm/Kbuild | 1 + arch/xtensa/include/asm/thread_info.h | 5 ++++- arch/xtensa/include/uapi/asm/ptrace.h | 3 ++- arch/xtensa/kernel/ptrace.c | 8 +++++++- tools/testing/selftests/seccomp/seccomp_bpf.c | 16 +++++++++++++++- 7 files changed, 45 insertions(+), 5 deletions(-)
Use one of the reserved slots in struct user_pt_regs to return syscall number in the GPR regset. Update syscall number from the GPR regset only when it's non-zero.
Signed-off-by: Max Filippov jcmvbkbc@gmail.com --- arch/xtensa/include/uapi/asm/ptrace.h | 3 ++- arch/xtensa/kernel/ptrace.c | 4 ++++ 2 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/arch/xtensa/include/uapi/asm/ptrace.h b/arch/xtensa/include/uapi/asm/ptrace.h index 2ec0f9100a06..50db3e0a6341 100644 --- a/arch/xtensa/include/uapi/asm/ptrace.h +++ b/arch/xtensa/include/uapi/asm/ptrace.h @@ -50,7 +50,8 @@ struct user_pt_regs { __u32 windowstart; __u32 windowbase; __u32 threadptr; - __u32 reserved[7 + 48]; + __u32 syscall; + __u32 reserved[6 + 48]; __u32 a[64]; };
diff --git a/arch/xtensa/kernel/ptrace.c b/arch/xtensa/kernel/ptrace.c index 0278d7dfb4d6..437b4297948d 100644 --- a/arch/xtensa/kernel/ptrace.c +++ b/arch/xtensa/kernel/ptrace.c @@ -52,6 +52,7 @@ static int gpr_get(struct task_struct *target, .threadptr = regs->threadptr, .windowbase = regs->windowbase, .windowstart = regs->windowstart, + .syscall = regs->syscall, };
memcpy(newregs.a, @@ -91,6 +92,9 @@ static int gpr_set(struct task_struct *target, regs->sar = newregs.sar; regs->threadptr = newregs.threadptr;
+ if (newregs.syscall) + regs->syscall = newregs.syscall; + if (newregs.windowbase != regs->windowbase || newregs.windowstart != regs->windowstart) { u32 rotws, wmask;
Add SECCOMP to xtensa Kconfig, select HAVE_ARCH_SECCOMP_FILTER, add TIF_SECCOMP and call secure_computing from do_syscall_trace_enter.
Signed-off-by: Max Filippov jcmvbkbc@gmail.com --- .../seccomp/seccomp-filter/arch-support.txt | 2 +- arch/xtensa/Kconfig | 15 +++++++++++++++ arch/xtensa/include/asm/Kbuild | 1 + arch/xtensa/include/asm/thread_info.h | 5 ++++- arch/xtensa/kernel/ptrace.c | 4 +++- 5 files changed, 24 insertions(+), 3 deletions(-)
diff --git a/Documentation/features/seccomp/seccomp-filter/arch-support.txt b/Documentation/features/seccomp/seccomp-filter/arch-support.txt index c7b837f735b1..7b3ec8ea174a 100644 --- a/Documentation/features/seccomp/seccomp-filter/arch-support.txt +++ b/Documentation/features/seccomp/seccomp-filter/arch-support.txt @@ -30,5 +30,5 @@ | um: | ok | | unicore32: | TODO | | x86: | ok | - | xtensa: | TODO | + | xtensa: | ok | ----------------------- diff --git a/arch/xtensa/Kconfig b/arch/xtensa/Kconfig index a7def0991a01..a461ee051e73 100644 --- a/arch/xtensa/Kconfig +++ b/arch/xtensa/Kconfig @@ -24,6 +24,7 @@ config XTENSA select HAVE_ARCH_AUDITSYSCALL select HAVE_ARCH_JUMP_LABEL if !XIP_KERNEL select HAVE_ARCH_KASAN if MMU && !XIP_KERNEL + select HAVE_ARCH_SECCOMP_FILTER select HAVE_ARCH_TRACEHOOK select HAVE_COPY_THREAD_TLS select HAVE_DEBUG_KMEMLEAK @@ -217,6 +218,20 @@ config HOTPLUG_CPU
Say N if you want to disable CPU hotplug.
+config SECCOMP + bool + prompt "Enable seccomp to safely compute untrusted bytecode" + help + This kernel feature is useful for number crunching applications + that may need to compute untrusted bytecode during their + execution. By using pipes or other transports made available to + the process as file descriptors supporting the read/write + syscalls, it's possible to isolate those applications in + their own address space using seccomp. Once seccomp is + enabled via prctl(PR_SET_SECCOMP), it cannot be disabled + and the task is only allowed to execute a few safe syscalls + defined by each seccomp mode. + config FAST_SYSCALL_XTENSA bool "Enable fast atomic syscalls" default n diff --git a/arch/xtensa/include/asm/Kbuild b/arch/xtensa/include/asm/Kbuild index 9718e9593564..c59c42a1221a 100644 --- a/arch/xtensa/include/asm/Kbuild +++ b/arch/xtensa/include/asm/Kbuild @@ -7,4 +7,5 @@ generic-y += mcs_spinlock.h generic-y += param.h generic-y += qrwlock.h generic-y += qspinlock.h +generic-y += seccomp.h generic-y += user.h diff --git a/arch/xtensa/include/asm/thread_info.h b/arch/xtensa/include/asm/thread_info.h index c49cc4a1f39a..8918f0f20c53 100644 --- a/arch/xtensa/include/asm/thread_info.h +++ b/arch/xtensa/include/asm/thread_info.h @@ -112,6 +112,7 @@ static inline struct thread_info *current_thread_info(void) #define TIF_NOTIFY_RESUME 7 /* callback before returning to user */ #define TIF_DB_DISABLED 8 /* debug trap disabled for syscall */ #define TIF_SYSCALL_AUDIT 9 /* syscall auditing active */ +#define TIF_SECCOMP 10 /* secure computing */
#define _TIF_SYSCALL_TRACE (1<<TIF_SYSCALL_TRACE) #define _TIF_SIGPENDING (1<<TIF_SIGPENDING) @@ -119,9 +120,11 @@ static inline struct thread_info *current_thread_info(void) #define _TIF_SINGLESTEP (1<<TIF_SINGLESTEP) #define _TIF_SYSCALL_TRACEPOINT (1<<TIF_SYSCALL_TRACEPOINT) #define _TIF_SYSCALL_AUDIT (1<<TIF_SYSCALL_AUDIT) +#define _TIF_SECCOMP (1<<TIF_SECCOMP)
#define _TIF_WORK_MASK (_TIF_SYSCALL_TRACE | _TIF_SINGLESTEP | \ - _TIF_SYSCALL_TRACEPOINT | _TIF_SYSCALL_AUDIT) + _TIF_SYSCALL_TRACEPOINT | \ + _TIF_SYSCALL_AUDIT | _TIF_SECCOMP)
#define THREAD_SIZE KERNEL_STACK_SIZE #define THREAD_SIZE_ORDER (KERNEL_STACK_SHIFT - PAGE_SHIFT) diff --git a/arch/xtensa/kernel/ptrace.c b/arch/xtensa/kernel/ptrace.c index 437b4297948d..ce4a32bd2294 100644 --- a/arch/xtensa/kernel/ptrace.c +++ b/arch/xtensa/kernel/ptrace.c @@ -22,6 +22,7 @@ #include <linux/regset.h> #include <linux/sched.h> #include <linux/sched/task_stack.h> +#include <linux/seccomp.h> #include <linux/security.h> #include <linux/signal.h> #include <linux/smp.h> @@ -559,7 +560,8 @@ int do_syscall_trace_enter(struct pt_regs *regs) return 0; }
- if (regs->syscall == NO_SYSCALL) { + if (regs->syscall == NO_SYSCALL || + secure_computing() == -1) { do_syscall_trace_leave(regs); return 0; }
Xtensa returns syscall number can be obtained and changed through the struct user_pt_regs. Syscall return value register is fixed relatively to the current register window in the user_pt_regs, so it needs a bit of special treatment.
Signed-off-by: Max Filippov jcmvbkbc@gmail.com --- tools/testing/selftests/seccomp/seccomp_bpf.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c index 252140a52553..1b445c2e7fbe 100644 --- a/tools/testing/selftests/seccomp/seccomp_bpf.c +++ b/tools/testing/selftests/seccomp/seccomp_bpf.c @@ -122,6 +122,8 @@ struct seccomp_data { # define __NR_seccomp 358 # elif defined(__s390__) # define __NR_seccomp 348 +# elif defined(__xtensa__) +# define __NR_seccomp 337 # else # warning "seccomp syscall number unknown for this architecture" # define __NR_seccomp 0xffff @@ -1622,6 +1624,14 @@ TEST_F(TRACE_poke, getpid_runs_normally) # define SYSCALL_SYSCALL_NUM regs[4] # define SYSCALL_RET regs[2] # define SYSCALL_NUM_RET_SHARE_REG +#elif defined(__xtensa__) +# define ARCH_REGS struct user_pt_regs +# define SYSCALL_NUM syscall +/* + * On xtensa syscall return value is in the register + * a2 of the current window which is not fixed. + */ +#define SYSCALL_RET(reg) a[(reg).windowbase * 4 + 2] #else # error "Do not know how to find your architecture's registers and syscalls" #endif @@ -1693,7 +1703,8 @@ void change_syscall(struct __test_metadata *_metadata, EXPECT_EQ(0, ret) {}
#if defined(__x86_64__) || defined(__i386__) || defined(__powerpc__) || \ - defined(__s390__) || defined(__hppa__) || defined(__riscv) + defined(__s390__) || defined(__hppa__) || defined(__riscv) || \ + defined(__xtensa__) { regs.SYSCALL_NUM = syscall; } @@ -1736,6 +1747,9 @@ void change_syscall(struct __test_metadata *_metadata, if (syscall == -1) #ifdef SYSCALL_NUM_RET_SHARE_REG TH_LOG("Can't modify syscall return on this architecture"); + +#elif defined(__xtensa__) + regs.SYSCALL_RET(regs) = result; #else regs.SYSCALL_RET = result; #endif
On Sat, Jul 18, 2020 at 07:16:51PM -0700, Max Filippov wrote:
Hello,
this series adds support for seccomp filter on xtensa and updates selftests/seccomp.
Hi!
Firstly, thanks for adding seccomp support! :) I would, however, ask that you CC maintainers on these kinds of changes for feedback. I was surprised to find the changes in the seccomp selftests today in Linus's tree. I didn't seem to get CCed on this series, even though get_maintainers shows this:
$ ./scripts/get_maintainer.pl 0001-selftests-seccomp-add-xtensa-support.mbox Kees Cook keescook@chromium.org (supporter:SECURE COMPUTING) Andy Lutomirski luto@amacapital.net (reviewer:SECURE COMPUTING) Will Drewry wad@chromium.org (reviewer:SECURE COMPUTING) Shuah Khan shuah@kernel.org (maintainer:KERNEL SELFTEST FRAMEWORK) ...
Regardless, I'm still glad to have more arch support! :) I'll send a follow-up patch to refactor a bit of the selftest.
Thanks,
On Fri, Sep 11, 2020 at 12:38 PM Kees Cook keescook@chromium.org wrote:
On Sat, Jul 18, 2020 at 07:16:51PM -0700, Max Filippov wrote:
Hello,
this series adds support for seccomp filter on xtensa and updates selftests/seccomp.
Hi!
Firstly, thanks for adding seccomp support! :) I would, however, ask that you CC maintainers on these kinds of changes for feedback. I was surprised to find the changes in the seccomp selftests today in Linus's tree. I didn't seem to get CCed on this series, even though get_maintainers shows this:
$ ./scripts/get_maintainer.pl 0001-selftests-seccomp-add-xtensa-support.mbox Kees Cook keescook@chromium.org (supporter:SECURE COMPUTING) Andy Lutomirski luto@amacapital.net (reviewer:SECURE COMPUTING) Will Drewry wad@chromium.org (reviewer:SECURE COMPUTING) Shuah Khan shuah@kernel.org (maintainer:KERNEL SELFTEST FRAMEWORK) ...
Sorry about that. Looks like I've filtered out too much of the cc: list. I'll fix my workflow.
Regardless, I'm still glad to have more arch support! :) I'll send a follow-up patch to refactor a bit of the selftest.
linux-kselftest-mirror@lists.linaro.org
-
Kees Cook -
Max Filippov