Rodrigo Campos 0ae71c7720
seccomp: Support atomic "addfd + send reply" ...
Alban Crequy reported a race condition userspace faces when we want to
add some fds and make the syscall return them[1] using seccomp notify.
The problem is that currently two different ioctl() calls are needed by
the process handling the syscalls (agent) for another userspace process
(target): SECCOMP_IOCTL_NOTIF_ADDFD to allocate the fd and
SECCOMP_IOCTL_NOTIF_SEND to return that value. Therefore, it is possible
for the agent to do the first ioctl to add a file descriptor but the
target is interrupted (EINTR) before the agent does the second ioctl()
call.
This patch adds a flag to the ADDFD ioctl() so it adds the fd and
returns that value atomically to the target program, as suggested by
Kees Cook[2]. This is done by simply allowing
seccomp_do_user_notification() to add the fd and return it in this case.
Therefore, in this case the target wakes up from the wait in
seccomp_do_user_notification() either to interrupt the syscall or to add
the fd and return it.
This "allocate an fd and return" functionality is useful for syscalls
that return a file descriptor only, like connect(2). Other syscalls that
return a file descriptor but not as return value (or return more than
one fd), like socketpair(), pipe(), recvmsg with SCM_RIGHTs, will not
work with this flag.
This effectively combines SECCOMP_IOCTL_NOTIF_ADDFD and
SECCOMP_IOCTL_NOTIF_SEND into an atomic opteration. The notification's
return value, nor error can be set by the user. Upon successful invocation
of the SECCOMP_IOCTL_NOTIF_ADDFD ioctl with the SECCOMP_ADDFD_FLAG_SEND
flag, the notifying process's errno will be 0, and the return value will
be the file descriptor number that was installed.
[1]: https://lore.kernel.org/lkml/CADZs7q4sw71iNHmV8EOOXhUKJMORPzF7thraxZYddTZsxta-KQ@mail.gmail.com/
[2]: https://lore.kernel.org/lkml/202012011322.26DCBC64F2@keescook/
Signed-off-by: Rodrigo Campos <rodrigo@kinvolk.io >
Signed-off-by: Sargun Dhillon <sargun@sargun.me >
Acked-by: Tycho Andersen <tycho@tycho.pizza >
Acked-by: Christian Brauner <christian.brauner@ubuntu.com >
Signed-off-by: Kees Cook <keescook@chromium.org >
Link: https://lore.kernel.org/r/20210517193908.3113-4-sargun@sargun.me
2021-06-28 12:49:52 -07:00
2021-04-10 10:52:04 +02:00
2020-07-15 20:34:11 -07:00
2020-12-10 09:31:40 +01:00
2020-12-14 09:16:22 -06:00
2020-01-21 11:41:36 +01:00
2021-03-11 20:47:05 +00:00
2019-09-07 17:44:25 +02:00
2021-01-25 18:44:44 +01:00
2020-05-28 11:22:14 +02:00
2021-05-03 23:02:44 +02:00
2019-10-04 14:25:17 -07:00
2020-05-04 11:30:15 -05:00
2019-10-04 14:25:17 -07:00
2019-10-04 14:25:17 -07:00
2021-03-31 15:59:14 -04:00
2020-07-21 22:05:32 -07:00
2020-11-19 11:25:47 +01:00
2020-12-28 14:21:31 +00:00
2021-03-17 18:39:38 +01:00
2020-10-03 17:28:45 -07:00
2021-03-18 09:02:27 +01:00
2019-12-18 18:07:31 +01:00
2021-02-09 10:58:19 +01:00
2020-07-13 17:01:44 -07:00
2020-07-21 11:21:44 -04:00
2020-08-12 10:58:00 -07:00
2021-02-06 09:22:10 +01:00
2021-02-06 09:22:10 +01:00
2021-01-09 09:21:03 -07:00
2021-02-15 18:28:30 +01:00
2021-04-02 11:18:30 -06:00
2020-10-09 12:47:02 -06:00
2021-04-19 15:27:36 -07:00
2021-03-04 17:58:15 -08:00
2020-12-09 19:16:10 +01:00
2020-12-08 15:54:16 +01:00
2021-03-29 09:51:49 +02:00
2021-04-20 14:28:33 -07:00
2021-01-12 17:31:14 +01:00
2020-10-02 17:58:52 -06:00
2019-10-07 07:55:17 -03:00
2021-03-22 10:22:22 +01:00
2020-10-29 18:39:43 -07:00
2019-10-09 22:31:14 -04:00
2020-12-04 12:06:15 +01:00
2019-09-25 17:51:39 -07:00
2020-12-15 12:13:36 -08:00
2020-09-17 18:46:04 +02:00
2021-02-16 20:36:39 -08:00
2019-10-28 13:41:01 -07:00
2021-01-22 11:32:08 -08:00
2020-05-04 11:30:15 -05:00
2021-03-26 14:53:41 -04:00
2020-04-27 16:29:41 +05:30
2019-12-17 21:37:40 +05:30
2021-03-18 17:03:54 +01:00
2021-04-13 17:31:44 +01:00
2020-07-19 19:20:22 -07:00
2021-04-16 16:59:20 -07:00
2021-04-16 16:59:20 -07:00
2020-12-03 00:12:08 -08:00
2020-07-27 23:24:00 +02:00
2020-06-24 21:34:11 +02:00
2020-05-14 16:44:25 +02:00
2021-04-20 08:59:03 -06:00
2020-05-12 19:34:52 +03:00
2020-06-05 16:19:28 -07:00
2021-02-26 09:41:03 -08:00
2020-07-06 21:37:08 -07:00
2021-05-10 09:26:18 -06:00
2020-11-16 11:41:12 -08:00
2021-01-27 15:13:52 +01:00
2021-02-07 14:51:19 -08:00
2021-04-14 10:40:57 +02:00
2019-11-05 18:20:55 -08:00
2020-10-03 14:18:29 -07:00
2021-02-08 13:01:24 +01:00
2021-02-15 11:43:33 +01:00
2019-09-04 12:43:54 +02:00
2021-02-04 09:29:57 -08:00
2020-11-27 15:48:31 +01:00
2020-07-27 12:20:40 -07:00
2020-07-23 17:55:20 +00:00
2021-01-22 09:58:57 +01:00
2021-01-22 09:59:00 +01:00
2021-04-28 13:42:23 -07:00
2021-03-30 13:29:39 -07:00
2021-04-12 13:26:03 +05:30
2020-11-06 14:29:11 +11:00
2020-05-04 11:30:15 -05:00
2021-05-07 00:26:34 -07:00
2020-10-30 17:49:19 -07:00
2020-10-29 18:39:43 -07:00
2021-03-10 12:45:16 -08:00
2021-04-25 18:35:01 -07:00
2020-03-16 01:42:31 -07:00
2020-11-09 16:41:40 -08:00
2020-08-22 12:44:37 -07:00
2021-02-04 09:29:57 -08:00
2020-05-01 12:24:40 -07:00
2020-07-13 15:32:56 -07:00
2020-04-20 12:43:24 -07:00
2020-07-24 17:12:41 -07:00
2020-08-27 07:55:59 -07:00
2020-09-03 15:17:28 -07:00
2020-09-08 16:31:14 -07:00
2021-02-26 09:41:03 -08:00
2021-04-25 10:14:04 -06:00
2021-03-18 11:42:46 +01:00
2020-09-15 09:57:45 -05:00
2021-01-26 18:39:45 -08:00
2020-07-27 16:34:12 +03:00
2020-01-04 13:55:09 -08:00
2020-11-16 16:27:03 +01:00
2020-12-15 12:13:36 -08:00
2021-04-26 08:25:20 -07:00
2020-11-04 16:43:38 +01:00
2020-05-19 15:19:06 +01:00
2021-03-23 23:40:55 -04:00
2021-04-23 07:41:17 -04:00
2021-03-03 16:55:02 -08:00
2021-04-22 12:22:11 -07:00
2021-04-13 09:16:12 -06:00
2020-11-26 14:19:10 +01:00
2020-05-21 08:20:35 -06:00
2020-03-29 22:30:57 -07:00
2020-05-27 11:10:05 +02:00
2021-03-10 09:34:06 +01:00
2021-03-24 08:26:29 +01:00
2021-04-08 13:15:33 -07:00
2020-12-14 11:47:37 -08:00
2021-01-12 17:05:37 +01:00
2020-08-18 15:44:44 +02:00
2020-09-25 14:23:27 +02:00
2021-05-05 11:27:23 -07:00
2020-05-06 17:45:45 -07:00
2020-09-15 22:13:31 +10:00
2021-01-24 14:43:45 +01:00
2021-04-02 14:21:50 -07:00
2020-12-15 12:13:36 -08:00
2020-09-10 12:25:51 -07:00
2021-01-23 12:38:42 -08:00
2019-11-15 14:38:29 +01:00
2020-07-25 19:34:47 -06:00
2020-06-24 14:36:33 -07:00
2020-05-04 11:30:15 -05:00
2020-03-29 22:32:36 -07:00
2020-10-14 20:28:05 -07:00
2020-12-15 12:13:36 -08:00
2021-03-11 16:12:59 -08:00
2021-01-25 09:36:25 -05:00
2021-05-07 00:26:34 -07:00
2020-07-13 17:52:46 -04:00
2020-10-02 09:37:41 -04:00
2020-09-22 13:58:40 +02:00
2021-04-19 12:04:37 +02:00
2019-11-06 06:17:38 +09:00
2021-01-04 11:42:26 -05:00
2020-11-27 11:03:06 -08:00
2020-12-15 16:49:59 -08:00
2020-04-02 17:57:10 +01:00
2021-05-01 10:14:08 -07:00
2019-10-02 20:32:27 -06:00
2020-09-04 12:34:50 +02:00
2021-03-13 14:18:09 -08:00
2021-01-22 20:41:29 -08:00
2019-12-01 14:00:59 -08:00
2020-12-21 17:36:48 -08:00
2021-04-13 17:31:44 +01:00
2021-03-25 15:31:22 -07:00
2020-04-30 15:19:33 +10:00
2020-07-19 19:22:56 -07:00
2021-03-17 16:15:39 +01:00
2020-01-07 16:07:01 -05:00
2020-07-10 14:50:51 +02:00
2020-06-25 16:26:25 -07:00
2020-08-04 20:16:37 -07:00
2019-11-15 14:38:29 +01:00
2021-04-08 10:14:45 +02:00
2021-04-06 10:29:56 +02:00
2020-03-29 22:30:57 -07:00
2021-01-25 15:14:16 -08:00
2020-11-24 10:10:59 -06:00
2021-03-17 14:16:26 -05:00
2021-01-16 23:19:26 +01:00
2021-03-24 16:31:23 -07:00
2020-10-05 16:35:57 +01:00
2019-12-04 19:44:12 -08:00
2020-02-12 17:57:51 -05:00
2020-10-30 15:24:11 -07:00
2021-06-28 12:49:52 -07:00
2019-11-04 07:11:31 -07:00
2020-08-03 17:57:40 -07:00
2021-04-29 15:26:57 -07:00
2019-11-15 14:38:29 +01:00
2021-01-15 17:14:49 +01:00
2021-03-10 09:34:06 +01:00
2020-03-24 15:59:34 -07:00
2019-11-15 14:38:29 +01:00
2021-04-16 16:32:41 +02:00
2020-12-01 17:56:13 -08:00
2020-11-09 15:34:44 -08:00
2020-02-27 18:50:19 -08:00
2020-12-03 10:03:14 -08:00
2020-02-21 11:22:15 -08:00
2020-01-15 11:00:39 -06:00
2021-01-26 18:39:45 -08:00
2020-07-28 22:25:30 -04:00
2019-12-18 18:07:31 +01:00
2021-02-11 18:25:05 -08:00
2021-02-02 14:50:15 +01:00
2021-01-07 16:17:32 +01:00
2021-03-11 12:13:08 +01:00
2019-12-18 18:07:33 +01:00
2020-02-21 11:22:15 -08:00
2019-12-18 18:07:33 +01:00
2019-10-04 14:25:17 -07:00
2020-09-18 13:58:37 -07:00
2020-09-18 13:58:37 -07:00
2020-11-27 14:32:37 -08:00
2021-04-10 10:36:34 +02:00
2020-08-12 10:57:59 -07:00
2019-12-09 09:59:07 +01:00
2020-03-29 23:29:08 +02:00
2021-05-05 11:27:22 -07:00
2019-11-15 14:38:29 +01:00
2021-03-22 10:24:07 +01:00
2021-04-06 14:56:00 +02:00
2020-09-26 10:22:29 +02:00
2021-03-22 10:22:22 +01:00
2020-07-10 13:45:32 +02:00
2020-07-10 13:45:32 +02:00
2021-02-23 07:52:56 -05:00
2020-06-03 11:27:43 +02:00
2020-10-07 14:23:44 -06:00
2021-05-05 10:19:41 -06:00
2020-10-23 11:55:28 -04:00
2020-10-23 11:55:28 -04:00
2021-04-06 14:56:00 +02:00
2020-08-05 09:30:19 -04:00
2020-08-05 09:30:20 -04:00
2020-08-05 11:08:39 -04:00
2021-04-08 12:26:34 +02:00
2020-08-03 16:11:42 -04:00
2020-08-05 11:08:39 -04:00
2020-08-05 11:08:39 -04:00
2020-09-10 11:39:22 +02:00
2020-11-20 10:44:41 +01:00
2021-04-30 12:48:14 -07:00
2020-08-05 11:08:40 -04:00
2020-08-05 11:08:40 -04:00
2020-08-05 11:08:40 -04:00
2020-09-10 10:05:58 +02:00
2020-08-05 11:08:41 -04:00
2020-09-10 10:05:58 +02:00
2020-08-05 11:08:40 -04:00
2020-06-02 02:45:13 -04:00
2020-08-05 11:08:40 -04:00
2021-03-07 09:07:16 +01:00
2020-12-14 19:33:39 -08:00
2020-05-19 15:19:06 +01:00
2019-12-16 19:22:22 -08:00
2020-07-31 09:24:23 +02:00
2020-06-12 13:23:34 -04:00
2020-07-13 15:32:56 -07:00
2020-06-24 07:51:01 +02:00
0ae71c7720