From patchwork Thu Mar 15 03:11:59 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Will Drewry X-Patchwork-Id: 146833 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 9836AB6F13 for ; Thu, 15 Mar 2012 14:18:19 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1759773Ab2CODOH (ORCPT ); Wed, 14 Mar 2012 23:14:07 -0400 Received: from mail-gx0-f174.google.com ([209.85.161.174]:61312 "EHLO mail-gx0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1759659Ab2CODNd (ORCPT ); Wed, 14 Mar 2012 23:13:33 -0400 Received: by mail-gx0-f174.google.com with SMTP id e5so2600629ggh.19 for ; Wed, 14 Mar 2012 20:13:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:x-mailer:in-reply-to:references; bh=vHo76rayRpAhC6Kv1TihLF3EWpNRczKA99U0cnPYhwg=; b=XURuaVrKMoRxFUSQZsyDjnpgLQriks2QmbUQE3SGVmitnZN9ACPffpWOnl9D38Hhqt JL36mxj9xIwmdrUfa40tl6YLC9a1EHr2iVOT8SIO4kL/+tHHspAtIoxfboaFCIAmdNyI z/2Pb16c63nD0+rZyowUK0OuouNWo4jABKTcY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=from:to:cc:subject:date:message-id:x-mailer:in-reply-to:references :x-gm-message-state; bh=vHo76rayRpAhC6Kv1TihLF3EWpNRczKA99U0cnPYhwg=; b=Z8DGV/+/lJXzdFtO61jxvp87iCww20Uy2kTmpTpyGYeJRMgtSb3d8wx10qSO4fx92Q coAdKPt5NVgTBaBbLpE/HKI+cjywCxYDHqXpAWKD5s4Mz0nD4PuYnTSbh1SlZsa2FAC5 /ufQKKktR0pbNNtjmaVkxIbdtxy5nzkYqCSKzUslmtQfMRw9hBGV+zojcfVn2Yqoj1vO cOV5igs2v1H0DRI549XoYAielBfzHa6mZsaDK31YllSZz/F7fiHUS2U3r8T+f1ZTaidg ndZsB83GUv0bT1MsHurU0OxAf7L6c+wKNR6BmmqRFY9h+I5x+XACEpEarZrnvXjPYQL/ Aydw== Received: by 10.236.175.162 with SMTP id z22mr6312910yhl.119.1331781213018; Wed, 14 Mar 2012 20:13:33 -0700 (PDT) Received: from localhost.localdomain (173-164-30-65-Nashville.hfc.comcastbusiness.net. [173.164.30.65]) by mx.google.com with ESMTPS id n35sm1522518yhh.19.2012.03.14.20.13.31 (version=TLSv1/SSLv3 cipher=OTHER); Wed, 14 Mar 2012 20:13:32 -0700 (PDT) From: Will Drewry To: linux-kernel@vger.kernel.org Cc: linux-arch@vger.kernel.org, linux-doc@vger.kernel.org, kernel-hardening@lists.openwall.com, netdev@vger.kernel.org, x86@kernel.org, arnd@arndb.de, davem@davemloft.net, hpa@zytor.com, mingo@redhat.com, oleg@redhat.com, peterz@infradead.org, rdunlap@xenotime.net, mcgrathr@chromium.org, tglx@linutronix.de, luto@mit.edu, eparis@redhat.com, serge.hallyn@canonical.com, djm@mindrot.org, scarybeasts@gmail.com, indan@nul.nu, pmoore@redhat.com, akpm@linux-foundation.org, corbet@lwn.net, eric.dumazet@gmail.com, markus@chromium.org, coreyb@linux.vnet.ibm.com, keescook@chromium.org, Will Drewry Subject: [PATCH v15 07/13] seccomp: remove duplicated failure logging Date: Wed, 14 Mar 2012 22:11:59 -0500 Message-Id: <1331781125-15658-8-git-send-email-wad@chromium.org> X-Mailer: git-send-email 1.7.5.4 In-Reply-To: <1331781125-15658-1-git-send-email-wad@chromium.org> References: <1331781125-15658-1-git-send-email-wad@chromium.org> X-Gm-Message-State: ALoCoQleflBIzIw40rSKsi2sWoipOZt7/uN0yWPajS86MNeBXlqqs3XwjQdFrdG9TCTKSFaGW6UW Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Kees Cook This consolidates the seccomp filter error logging path and adds more details to the audit log. Signed-off-by: Will Drewry Signed-off-by: Kees Cook v15: added a return code to the audit_seccomp path by wad@chromium.org (suggested by eparis@redhat.com) v*: original by keescook@chromium.org --- include/linux/audit.h | 8 ++++---- kernel/auditsc.c | 10 ++++++++-- kernel/seccomp.c | 15 +-------------- 3 files changed, 13 insertions(+), 20 deletions(-) diff --git a/include/linux/audit.h b/include/linux/audit.h index 9ff7a2c..1b95270 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -463,7 +463,7 @@ extern void audit_putname(const char *name); extern void __audit_inode(const char *name, const struct dentry *dentry); extern void __audit_inode_child(const struct dentry *dentry, const struct inode *parent); -extern void __audit_seccomp(unsigned long syscall); +extern void __audit_seccomp(unsigned long syscall, long signr, int code); extern void __audit_ptrace(struct task_struct *t); static inline int audit_dummy_context(void) @@ -508,10 +508,10 @@ static inline void audit_inode_child(const struct dentry *dentry, } void audit_core_dumps(long signr); -static inline void audit_seccomp(unsigned long syscall) +static inline void audit_seccomp(unsigned long syscall, long signr, int code) { if (unlikely(!audit_dummy_context())) - __audit_seccomp(syscall); + __audit_seccomp(syscall, signr, code); } static inline void audit_ptrace(struct task_struct *t) @@ -634,7 +634,7 @@ extern int audit_signals; #define audit_inode(n,d) do { (void)(d); } while (0) #define audit_inode_child(i,p) do { ; } while (0) #define audit_core_dumps(i) do { ; } while (0) -#define audit_seccomp(i) do { ; } while (0) +#define audit_seccomp(i,s,c) do { ; } while (0) #define auditsc_get_stamp(c,t,s) (0) #define audit_get_loginuid(t) (-1) #define audit_get_sessionid(t) (-1) diff --git a/kernel/auditsc.c b/kernel/auditsc.c index af1de0f..10dc528 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -67,6 +67,7 @@ #include #include #include +#include #include "audit.h" @@ -2710,13 +2711,18 @@ void audit_core_dumps(long signr) audit_log_end(ab); } -void __audit_seccomp(unsigned long syscall) +void __audit_seccomp(unsigned long syscall, long signr, int code) { struct audit_buffer *ab; ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_ANOM_ABEND); - audit_log_abend(ab, "seccomp", SIGKILL); + audit_log_abend(ab, "seccomp", signr); audit_log_format(ab, " syscall=%ld", syscall); +#ifdef CONFIG_COMPAT + audit_log_format(ab, " compat=%d", is_compat_task()); +#endif + audit_log_format(ab, " ip=0x%lx", KSTK_EIP(current)); + audit_log_format(ab, " code=0x%x", code); audit_log_end(ab); } diff --git a/kernel/seccomp.c b/kernel/seccomp.c index 9e50174..51c3462 100644 --- a/kernel/seccomp.c +++ b/kernel/seccomp.c @@ -60,18 +60,6 @@ struct seccomp_filter { /* Limit any path through the tree to 256KB worth of instructions. */ #define MAX_INSNS_PER_PATH ((1 << 18) / sizeof(struct sock_filter)) -static void seccomp_filter_log_failure(int syscall) -{ - int compat = 0; -#ifdef CONFIG_COMPAT - compat = is_compat_task(); -#endif - pr_info("%s[%d]: %ssystem call %d blocked at 0x%lx\n", - current->comm, task_pid_nr(current), - (compat ? "compat " : ""), - syscall, KSTK_EIP(current)); -} - /** * get_u32 - returns a u32 offset into data * @data: a unsigned 64 bit value @@ -376,7 +364,6 @@ void __secure_computing(int this_syscall) case SECCOMP_MODE_FILTER: if (seccomp_run_filters(this_syscall) == SECCOMP_RET_ALLOW) return; - seccomp_filter_log_failure(this_syscall); exit_sig = SIGSYS; break; #endif @@ -387,7 +374,7 @@ void __secure_computing(int this_syscall) #ifdef SECCOMP_DEBUG dump_stack(); #endif - audit_seccomp(this_syscall); + audit_seccomp(this_syscall, exit_code, SECCOMP_RET_KILL); do_exit(exit_sig); }