aboutsummaryrefslogtreecommitdiff
path: root/fs
diff options
context:
space:
mode:
authorWill Drewry <wad@chromium.org>2011-06-27 11:10:16 -0500
committerJohn Rigby <john.rigby@linaro.org>2011-11-16 14:26:30 -0700
commit29646ce466b56f9c4fe02c2a023b73e842e8fcac (patch)
treeff1113734a122d32f6b2401e33b8d9ff0529d84b /fs
parentf962be6d9774de958c260cbc41a52ba04c5e2d61 (diff)
downloadlinux-linaro-precise-29646ce466b56f9c4fe02c2a023b73e842e8fcac.tar.gz
UBUNTU: SAUCE: seccomp_filter: add process state reporting
Adds seccomp and seccomp_filter status reporting to proc. /proc/<pid>/seccomp_filter provides the current seccomp mode and the list of allowed or dynamically filtered system calls. v9: rebase on to bccaeafd7c117acee36e90d37c7e05c19be9e7bf v8: - v7: emit seccomp mode directly v6: - v5: fix typos when mailing the wrong patch series v4: move from rcu guard to mutex guard v3: changed to using filters directly. v2: removed status entry, added seccomp file. (requested by kosaki.motohiro@jp.fujitsu.com) allowed S_IRUGO reading of entries (requested by viro@zeniv.linux.org.uk) added flags got rid of the seccomp_t type dropped seccomp file Signed-off-by: Will Drewry <wad@chromium.org> BUG=chromium-os:14496 TEST=see others in series Change-Id: I86515e56d2da3b3c22ac90856a6ffa71a045c253 Reviewed-on: http://gerrit.chromium.org/gerrit/3242 Reviewed-by: Sonny Rao <sonnyrao@chromium.org> Tested-by: Will Drewry <wad@chromium.org> Signed-off-by: Kees Cook <kees.cook@canonical.com> Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Diffstat (limited to 'fs')
-rw-r--r--fs/proc/base.c31
1 files changed, 31 insertions, 0 deletions
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 5eb02069e1b..43649dd1639 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -73,6 +73,7 @@
#include <linux/security.h>
#include <linux/ptrace.h>
#include <linux/tracehook.h>
+#include <linux/seccomp.h>
#include <linux/cgroup.h>
#include <linux/cpuset.h>
#include <linux/audit.h>
@@ -582,6 +583,30 @@ static int proc_pid_syscall(struct task_struct *task, char *buffer)
}
#endif /* CONFIG_HAVE_ARCH_TRACEHOOK */
+/*
+ * Print out the current seccomp filter set for the task.
+ */
+#ifdef CONFIG_SECCOMP_FILTER
+int proc_pid_seccomp_filter_show(struct seq_file *m, struct pid_namespace *ns,
+ struct pid *pid, struct task_struct *task)
+{
+ struct seccomp_filters *filters;
+
+ seq_printf(m, "Mode: %d\n", task->seccomp.mode);
+ /* Avoid allowing other processes to incur too much added contention by
+ * only acquiring a reference under the task-wide mutex.
+ */
+ if (mutex_lock_killable(&task->seccomp.filters_guard))
+ return -1;
+ filters = get_seccomp_filters(task->seccomp.filters);
+ mutex_unlock(&task->seccomp.filters_guard);
+
+ seccomp_show_filters(filters, m);
+ put_seccomp_filters(filters);
+ return 0;
+}
+#endif /* CONFIG_SECCOMP_FILTER */
+
/************************************************************************/
/* Here the fs part begins */
/************************************************************************/
@@ -2805,6 +2830,9 @@ static const struct pid_entry tgid_base_stuff[] = {
#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
INF("syscall", S_IRUGO, proc_pid_syscall),
#endif
+#ifdef CONFIG_SECCOMP_FILTER
+ ONE("seccomp_filter", S_IRUGO, proc_pid_seccomp_filter_show),
+#endif
INF("cmdline", S_IRUGO, proc_pid_cmdline),
ONE("stat", S_IRUGO, proc_tgid_stat),
ONE("statm", S_IRUGO, proc_pid_statm),
@@ -3151,6 +3179,9 @@ static const struct pid_entry tid_base_stuff[] = {
#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
INF("syscall", S_IRUGO, proc_pid_syscall),
#endif
+#ifdef CONFIG_SECCOMP_FILTER
+ ONE("seccomp_filter", S_IRUGO, proc_pid_seccomp_filter_show),
+#endif
INF("cmdline", S_IRUGO, proc_pid_cmdline),
ONE("stat", S_IRUGO, proc_tid_stat),
ONE("statm", S_IRUGO, proc_pid_statm),