[PULL] seccomp update (next)

From: Kees Cook
Date: Tue Jun 14 2016 - 13:57:37 EST


Hi,

Please pull these seccomp changes for next. These have been tested by
myself and Andy, and close a long-standing issue with seccomp where tracers
could change the syscall out from under seccomp.

Thanks!

-Kees

The following changes since commit 40d273782ff16fe1a7445cc05c66a447dfea3433:

security: tomoyo: simplify the gc kthread creation (2016-06-06 20:23:55 +1000)

are available in the git repository at:

git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git tags/seccomp-next

for you to fetch changes up to 26703c636c1f3272b39bd0f6d04d2e970984f1b6:

um/ptrace: run seccomp after ptrace (2016-06-14 10:54:47 -0700)

----------------------------------------------------------------
Fix seccomp vs ptrace ordering to plug syscall filter bypass issue.

----------------------------------------------------------------
Andy Lutomirski (2):
seccomp: Add a seccomp_data parameter secure_computing()
x86/entry: Get rid of two-phase syscall entry work

Kees Cook (12):
seccomp: add tests for ptrace hole
seccomp: remove 2-phase API
seccomp: recheck the syscall after RET_TRACE
x86/ptrace: run seccomp after ptrace
arm/ptrace: run seccomp after ptrace
arm64/ptrace: run seccomp after ptrace
MIPS/ptrace: run seccomp after ptrace
parisc/ptrace: run seccomp after ptrace
s390/ptrace: run seccomp after ptrace
powerpc/ptrace: run seccomp after ptrace
tile/ptrace: run seccomp after ptrace
um/ptrace: run seccomp after ptrace

arch/arm/kernel/ptrace.c | 13 +-
arch/arm64/kernel/ptrace.c | 8 +-
arch/mips/kernel/ptrace.c | 9 +-
arch/parisc/kernel/ptrace.c | 9 +-
arch/powerpc/kernel/ptrace.c | 46 +++----
arch/s390/kernel/ptrace.c | 21 ++-
arch/tile/kernel/ptrace.c | 11 +-
arch/um/kernel/skas/syscall.c | 9 +-
arch/x86/entry/common.c | 106 +++-------------
arch/x86/entry/vsyscall/vsyscall_64.c | 2 +-
arch/x86/include/asm/ptrace.h | 6 -
include/linux/seccomp.h | 14 +-
kernel/seccomp.c | 144 ++++++++-------------
tools/testing/selftests/seccomp/seccomp_bpf.c | 176 ++++++++++++++++++++++++--
14 files changed, 309 insertions(+), 265 deletions(-)

--
Kees Cook
Chrome OS & Brillo Security