From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f178.google.com (mail-pf1-f178.google.com [209.85.210.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CD94F3C8737 for ; Wed, 15 Jul 2026 21:20:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.178 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784150450; cv=none; b=lFPTKov9prmIx3MPW+KGTf4L5KMmH5qeb8mJ5YfQQ9OsfXfGr4ebXL366dmRz7gixXCozvw4xI4Xrqb3sYFFAb2leRbTNXBouEVfEAEqG1evC34i4fxxp4LVlZfvz9ivAr6X/Xov1AS5NhmQIgNx2rV30ryZJ7m3cBx6ajGNG/0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784150450; c=relaxed/simple; bh=8jbU6AiMCXHqqDrEWNki+dzXKN6COUhEeQ7uRtMdsE8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=mohM3DwkcC7bCCnz2C/DtJiFVhEWbcFqy0kUr78zB9dLnqntkuDfBA9S8Nm/xF/OOQ/EzCKBiv6wYzn8sqT1wHlEdcbV4tzyJTis/d9V2RvAjt/BQOLc4HQOSj2zc+4Oy7qvBReqYRH8jiugXPjtzmbz1XX3cJ2otVTWWWzBQdk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=e7nOXNOe; arc=none smtp.client-ip=209.85.210.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="e7nOXNOe" Received: by mail-pf1-f178.google.com with SMTP id d2e1a72fcca58-84862b0d5f8so2370200b3a.3 for ; Wed, 15 Jul 2026 14:20:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784150444; x=1784755244; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=H5RNDvczIEN6AYv3qNfijJBXqL18H/yVs14ZVOrYovY=; b=e7nOXNOeq13FI/VTuaO28AGEJLEDehUE09QOQwm3Fj+gvrqt7iXZzU5BLTNf3fr2e1 P9rPok/CqvfiIaUQn5InIO/5ePzZVJPIsLqnjOkraywML4f71qPpTTn+EDOHAPfxWGFe Rf0fgWzMoLnXVDb60LX53MvX9QRoUI63Ku1LS0NNmiFGvMi7UeAO+FMPCfydNlT3Fz96 7s2cw87rwX9Mm6Y3hFNwMZ7EbxkTeVeR7w0VJctz9sMuOnOMKN4z3QNRzscvD2zPCEgh BHbQciPHHxpDGnPaL2KmNT47DhnSSgdS1h9EM0btHmkx92naruqXNb6Fgy0KXEAhkgDj pklQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784150444; x=1784755244; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=H5RNDvczIEN6AYv3qNfijJBXqL18H/yVs14ZVOrYovY=; b=fw+RDU5my/+u+1UlPBa+NPjSbJbQXWZICx1iLnzo7VF9O5pradLvgrcpyOvJClb8Fa LLhiG7KOadcd6lDTwRaO/V1ajMp1AoxqqJzyYhjttFcfaL9Q3gnWrkFx4qcOGFE1Qekx jpBLO4zMyfVp/J2PpgPXAyHf0tRLcDZRh4zktLOIYuaQRIQWHl7HzrZgl2wXUExPBL9f NuaN4dG9fi0SgQPGLTqGG5v2qx6x+xIYDOFcGmBu/y+NCd9O38YwnHEh34mt2bJw4QSn wyKE3ygCstulLwqy4KHoVtjxWxgvGe+V/C37yZyFq/wdsuh/65OorKdnLhcCAsVeHyx0 hSLg== X-Forwarded-Encrypted: i=1; AHgh+RqXH9DRMnd5vpoNpOGqSiceiPScxnfvpRxNgP/1A0Pb9hExm5w6fFbfQSWvDBTbH4FAaaW+R51fOs97X/c=@vger.kernel.org X-Gm-Message-State: AOJu0YxmHNGIFpZ+jaEqkiu8Oktdtt6q8xd/f5jnq0mz6RJhJAC4wyuX KQXPJ1F11uSxFOKJ59WI0mZZScn5qb5dJWvN9JGmTvrx+DbqHMV79ewl X-Gm-Gg: AfdE7cnkZbShrbVWksqVclI+e2eRFBjn4CIP6Ze8FF/TaoA+KlVpCod2aBzM9ndixDX BdycsoSayWvFaD2m9puVQWKGCmoPpNV77LwSht4hdiRhryF/AIk7Kmq5EKDjTz2QBsXlT1iauCT ARs6FnjaQwZD6H1rY8rNbh9IpXylWcy7LjUnDW+N0dSXXTWYt3u2gThmnAG2MlaZUadP4GA4OJT X6cHfKwzKl4VmoDajQF50Xw4aKkqz27y+O6I/YIEGlzIv9NNNh9WGYn2tEzFJpBkNbHdd8/ACgu nsxI7hhW2Ueo6HNOqiD51fucLGZHA70xPSfzpwvt5KONM7IXgCAyrrotSgJEOxTa4fKDF748FEf pYY2ejGjmZVlzArOI30WvZiUoeWFA4akO4TJMCFsUP9UQEilp4S0/4uc/+F20WhTHHnp1Kr4ibl t5BVKMOyNmjaLal6T7DwSA3Z4P717jXECe6xo68u7Ek+q+NkVsXPs2AoT280LV2Et/Om+o X-Received: by 2002:a05:6a20:d489:b0:3bf:c12c:2ecf with SMTP id adf61e73a8af0-3c110bafc02mr22625148637.59.1784150444192; Wed, 15 Jul 2026 14:20:44 -0700 (PDT) Received: from pop-os.tail4adac7.ts.net ([129.210.115.107]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-13cd403a7f7sm4126844c88.0.2026.07.15.14.20.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 15 Jul 2026 14:20:43 -0700 (PDT) From: Cong Wang To: Andy Lutomirski Cc: Kees Cook , linux-kernel@vger.kernel.org, Will Drewry , Christian Brauner , Andrew Morton , linux-mm@kvack.org, Cong Wang Subject: [PATCH v6 6/8] seccomp: re-validate a redirected syscall against outer filters Date: Wed, 15 Jul 2026 14:20:05 -0700 Message-ID: <20260715212007.2382846-7-xiyou.wangcong@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260715212007.2382846-1-xiyou.wangcong@gmail.com> References: <20260715212007.2382846-1-xiyou.wangcong@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Cong Wang Stacked filters compose by taking the most restrictive verdict over one evaluation of a single seccomp_data, assuming the syscall they voted on is the syscall that runs. SECCOMP_IOCTL_NOTIF_SEND_REDIRECT breaks that: the supervisor rewrites the argument registers and the syscall resumes without the stack being re-consulted, so an inner, container-installed filter can redirect a syscall into a form an outer filter would have blocked. Close the hole with seccomp_redirect_revalidate(): after a redirect it walks from the notifier outward, judging the substituted syscall one filter at a time; the innermost filter that does not allow it decides. ALLOW and LOG fall through; ERRNO, TRAP and KILL are terminal; USER_NOTIF consults the outer supervisor, whose plain FLAG_CONTINUE keeps the walk going; TRACE fails closed with -ENOSYS, since a tracer rewrite cannot be soundly re-composed mid-walk. The walk is strictly outward, so the notifier is never reconsulted and no re-notify loop exists, so a deep chain cannot exhaust the kernel stack. A redirect never changes the syscall number, only the argument registers differ. Assisted-by: Claude:claude-opus-4.8 Signed-off-by: Cong Wang --- kernel/seccomp.c | 141 ++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 126 insertions(+), 15 deletions(-) diff --git a/kernel/seccomp.c b/kernel/seccomp.c index 17fe4c360839..b1fd2ec44324 100644 --- a/kernel/seccomp.c +++ b/kernel/seccomp.c @@ -93,6 +93,13 @@ struct seccomp_knotif { long val; u32 flags; + /* + * Set by SEND_REDIRECT: the reply rewrote the syscall's registers, + * so on resume the syscall must be re-evaluated against the filters + * outer to the one that notified (see __seccomp_filter()). + */ + bool redirect; + /* * Signals when this has changed states, such as the listener * dying, a new seccomp addfd message, or changing to REPLIED @@ -1183,10 +1190,12 @@ static bool should_sleep_killable(struct seccomp_filter *match, static int seccomp_do_user_notification(int this_syscall, struct seccomp_filter *match, - const struct seccomp_data *sd) + const struct seccomp_data *sd, + bool *redirected) { int err; u32 flags = 0; + bool redirect = false; long ret = 0; struct seccomp_knotif n = {}; struct seccomp_kaddfd *addfd, *tmp; @@ -1243,6 +1252,7 @@ static int seccomp_do_user_notification(int this_syscall, ret = n.val; err = n.error; flags = n.flags; + redirect = n.redirect; interrupted: /* If there were any pending addfd calls, clear them out */ @@ -1269,19 +1279,120 @@ static int seccomp_do_user_notification(int this_syscall, mutex_unlock(&match->notify_lock); /* Userspace requests to continue the syscall. */ - if (flags & SECCOMP_USER_NOTIF_FLAG_CONTINUE) + if (flags & SECCOMP_USER_NOTIF_FLAG_CONTINUE) { + *redirected = redirect; return 0; + } syscall_set_return_value(current, current_pt_regs(), err, ret); return -1; } +static void seccomp_kill_task(int this_syscall, u32 action, int data) +{ + current->seccomp.mode = SECCOMP_MODE_DEAD; + seccomp_log(this_syscall, SIGSYS, action, true); + /* Dump core only if this is the last remaining thread. */ + if (action != SECCOMP_RET_KILL_THREAD || + (atomic_read(¤t->signal->live) == 1)) { + /* Show the original registers in the dump. */ + syscall_rollback(current, current_pt_regs()); + /* Trigger a coredump with SIGSYS */ + force_sig_seccomp(this_syscall, data, true); + } else { + do_exit(SIGSYS); + } +} + +static int seccomp_redirect_revalidate(struct seccomp_filter *notifier) +{ + struct seccomp_filter *f; + struct seccomp_data sd; + bool redirected = false; + int this_syscall; + u32 action; + int data; + + populate_seccomp_data(&sd); + this_syscall = sd.nr; + + for (f = notifier->prev; f; f = f->prev) { + u32 cur_ret = bpf_prog_run_pin_on_cpu(f->prog, &sd); + + data = cur_ret & SECCOMP_RET_DATA; + action = cur_ret & SECCOMP_RET_ACTION_FULL; + + switch (action) { + case SECCOMP_RET_ALLOW: + continue; + + case SECCOMP_RET_LOG: + seccomp_log(this_syscall, 0, action, true); + continue; + + case SECCOMP_RET_ERRNO: + /* Set low-order bits as an errno, capped at MAX_ERRNO. */ + if (data > MAX_ERRNO) + data = MAX_ERRNO; + syscall_set_return_value(current, current_pt_regs(), + -data, 0); + goto skip; + + case SECCOMP_RET_TRAP: + /* Show the handler the original registers. */ + syscall_rollback(current, current_pt_regs()); + /* Let the filter pass back 16 bits of data. */ + force_sig_seccomp(this_syscall, data, false); + goto skip; + + case SECCOMP_RET_USER_NOTIF: + /* + * The outer supervisor judges the substituted call: + * an error reply skips it, a plain FLAG_CONTINUE + * keeps the walk going, or this reply would slip the + * call past a stricter filter further out. It cannot + * redirect again: at most one redirect-capable + * listener exists in a chain, and the walk starts + * outside it. + */ + if (seccomp_do_user_notification(this_syscall, f, &sd, + &redirected)) + goto skip; + continue; + + case SECCOMP_RET_TRACE: + /* + * A tracer may rewrite the syscall, and there is no + * defensible way to restart composition mid-walk. + * Fail closed exactly like TRACE with no tracer + * attached: skip with -ENOSYS. + */ + syscall_set_return_value(current, current_pt_regs(), + -ENOSYS, 0); + goto skip; + + case SECCOMP_RET_KILL_THREAD: + case SECCOMP_RET_KILL_PROCESS: + default: + seccomp_kill_task(this_syscall, action, data); + return -1; + } + } + + return 0; + +skip: + seccomp_log(this_syscall, 0, action, f->log); + return -1; +} + static int __seccomp_filter(int this_syscall, const bool recheck_after_trace) { u32 filter_ret, action; struct seccomp_data sd; struct seccomp_filter *match = NULL; + bool redirected = false; int data; /* @@ -1356,9 +1467,19 @@ static int __seccomp_filter(int this_syscall, const bool recheck_after_trace) return 0; case SECCOMP_RET_USER_NOTIF: - if (seccomp_do_user_notification(this_syscall, match, &sd)) + if (seccomp_do_user_notification(this_syscall, match, &sd, + &redirected)) goto skip; + /* + * A redirect rewrote the argument registers; every filter + * outer to the notifier must judge the substituted syscall + * before it runs. A redirect from the outermost filter has + * no outer filter left to judge it. + */ + if (redirected && match->prev) + return seccomp_redirect_revalidate(match); + return 0; case SECCOMP_RET_LOG: @@ -1376,18 +1497,7 @@ static int __seccomp_filter(int this_syscall, const bool recheck_after_trace) case SECCOMP_RET_KILL_THREAD: case SECCOMP_RET_KILL_PROCESS: default: - current->seccomp.mode = SECCOMP_MODE_DEAD; - seccomp_log(this_syscall, SIGSYS, action, true); - /* Dump core only if this is the last remaining thread. */ - if (action != SECCOMP_RET_KILL_THREAD || - (atomic_read(¤t->signal->live) == 1)) { - /* Show the original registers in the dump. */ - syscall_rollback(current, current_pt_regs()); - /* Trigger a coredump with SIGSYS */ - force_sig_seccomp(this_syscall, data, true); - } else { - do_exit(SIGSYS); - } + seccomp_kill_task(this_syscall, action, data); return -1; /* skip the syscall go directly to signal handling */ } @@ -2207,6 +2317,7 @@ static long seccomp_notify_send_redirect(struct seccomp_filter *filter, goto out_unlock_free; } + knotif->redirect = true; knotif->state = SECCOMP_NOTIFY_REPLIED; knotif->error = 0; knotif->val = 0; -- 2.43.0