Commit c818c03b authored by Kees Cook's avatar Kees Cook

seccomp: Report number of loaded filters in /proc/$pid/status

A common question asked when debugging seccomp filters is "how many
filters are attached to your process?" Provide a way to easily answer
this question through /proc/$pid/status with a "Seccomp_filters" line.
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
parent e4d05028
...@@ -341,6 +341,8 @@ static inline void task_seccomp(struct seq_file *m, struct task_struct *p) ...@@ -341,6 +341,8 @@ static inline void task_seccomp(struct seq_file *m, struct task_struct *p)
seq_put_decimal_ull(m, "NoNewPrivs:\t", task_no_new_privs(p)); seq_put_decimal_ull(m, "NoNewPrivs:\t", task_no_new_privs(p));
#ifdef CONFIG_SECCOMP #ifdef CONFIG_SECCOMP
seq_put_decimal_ull(m, "\nSeccomp:\t", p->seccomp.mode); seq_put_decimal_ull(m, "\nSeccomp:\t", p->seccomp.mode);
seq_put_decimal_ull(m, "\nSeccomp_filters:\t",
atomic_read(&p->seccomp.filter_count));
#endif #endif
seq_puts(m, "\nSpeculation_Store_Bypass:\t"); seq_puts(m, "\nSpeculation_Store_Bypass:\t");
switch (arch_prctl_spec_ctrl_get(p, PR_SPEC_STORE_BYPASS)) { switch (arch_prctl_spec_ctrl_get(p, PR_SPEC_STORE_BYPASS)) {
......
...@@ -13,6 +13,7 @@ ...@@ -13,6 +13,7 @@
#ifdef CONFIG_SECCOMP #ifdef CONFIG_SECCOMP
#include <linux/thread_info.h> #include <linux/thread_info.h>
#include <linux/atomic.h>
#include <asm/seccomp.h> #include <asm/seccomp.h>
struct seccomp_filter; struct seccomp_filter;
...@@ -29,6 +30,7 @@ struct seccomp_filter; ...@@ -29,6 +30,7 @@ struct seccomp_filter;
*/ */
struct seccomp { struct seccomp {
int mode; int mode;
atomic_t filter_count;
struct seccomp_filter *filter; struct seccomp_filter *filter;
}; };
......
...@@ -204,6 +204,9 @@ struct task_struct init_task ...@@ -204,6 +204,9 @@ struct task_struct init_task
#ifdef CONFIG_SECURITY #ifdef CONFIG_SECURITY
.security = NULL, .security = NULL,
#endif #endif
#ifdef CONFIG_SECCOMP
.seccomp = { .filter_count = ATOMIC_INIT(0) },
#endif
}; };
EXPORT_SYMBOL(init_task); EXPORT_SYMBOL(init_task);
......
...@@ -398,6 +398,8 @@ static inline void seccomp_sync_threads(unsigned long flags) ...@@ -398,6 +398,8 @@ static inline void seccomp_sync_threads(unsigned long flags)
put_seccomp_filter(thread); put_seccomp_filter(thread);
smp_store_release(&thread->seccomp.filter, smp_store_release(&thread->seccomp.filter,
caller->seccomp.filter); caller->seccomp.filter);
atomic_set(&thread->seccomp.filter_count,
atomic_read(&thread->seccomp.filter_count));
/* /*
* Don't let an unprivileged task work around * Don't let an unprivileged task work around
...@@ -544,6 +546,7 @@ static long seccomp_attach_filter(unsigned int flags, ...@@ -544,6 +546,7 @@ static long seccomp_attach_filter(unsigned int flags,
*/ */
filter->prev = current->seccomp.filter; filter->prev = current->seccomp.filter;
current->seccomp.filter = filter; current->seccomp.filter = filter;
atomic_inc(&current->seccomp.filter_count);
/* Now that the new filter is in place, synchronize to all threads. */ /* Now that the new filter is in place, synchronize to all threads. */
if (flags & SECCOMP_FILTER_FLAG_TSYNC) if (flags & SECCOMP_FILTER_FLAG_TSYNC)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment