[PATCH RFC v3 70/90] seccomp: let a listener put no file into a cell

[Josef Bacik]

Seccomp filters are inherited by tasks that are spawned into a cell. That
is intentional. The listener of a filter that uses SECCOMP_RET_USER_NOTIF
stays outside of the cell, with the spawner or with whoever confined the
spawner.

SECCOMP_IOCTL_NOTIF_ADDFD lets the listener install any file that it holds
into the task that is waiting for an answer. But once a task of a cell has
started, no file should cross the boundary. The files that
pidfd_configure() refuses to place, such as a cellfd, a namespace file or
an io_uring of the host, could be installed this way a moment later.

Fail the ioctl with EPERM if the task is in a different cell than the
caller. The listener can still answer the system calls of the task.

Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
---
 kernel/seccomp.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index 3eecba5ccdef..b8ade37dfcae 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -17,6 +17,7 @@
 
 #include <linux/refcount.h>
 #include <linux/audit.h>
+#include <linux/cell.h>
 #include <linux/compat.h>
 #include <linux/coredump.h>
 #include <linux/kmemleak.h>
@@ -1764,6 +1765,17 @@ static long seccomp_notify_addfd(struct seccomp_filter *filter,
 		goto out_unlock;
 	}
 
+	/*
+	 * Filters are inherited by what is spawned into a cell, and the
+	 * listener stays behind. No file crosses the boundary of a cell.
+	 */
+	scoped_guard(rcu) {
+		if (!cell_same(current_cred(), __task_cred(knotif->task)))
+			ret = -EPERM;
+	}
+	if (ret)
+		goto out_unlock;
+
 	/*
 	 * We do not want to allow for FD injection to occur before the
 	 * notification has been picked up by a userspace handler, or after

-- 
2.55.0