summaryrefslogtreecommitdiff
path: root/include/linux/seccomp.h
diff options
context:
space:
mode:
authorKees Cook <keescook@chromium.org>2014-06-28 02:18:48 +0400
committerKees Cook <keescook@chromium.org>2014-07-18 23:13:39 +0400
commitdbd952127d11bb44a4ea30b08cc60531b6a23d71 (patch)
tree3e6bbec7041ed70dc0d015b0e7d01f1dcfed9a37 /include/linux/seccomp.h
parentc8bee430dc52cfca6c1aab27752a89275d78d50f (diff)
downloadlinux-dbd952127d11bb44a4ea30b08cc60531b6a23d71.tar.xz
seccomp: introduce writer locking
Normally, task_struct.seccomp.filter is only ever read or modified by the task that owns it (current). This property aids in fast access during system call filtering as read access is lockless. Updating the pointer from another task, however, opens up race conditions. To allow cross-thread filter pointer updates, writes to the seccomp fields are now protected by the sighand spinlock (which is shared by all threads in the thread group). Read access remains lockless because pointer updates themselves are atomic. However, writes (or cloning) often entail additional checking (like maximum instruction counts) which require locking to perform safely. In the case of cloning threads, the child is invisible to the system until it enters the task list. To make sure a child can't be cloned from a thread and left in a prior state, seccomp duplication is additionally moved under the sighand lock. Then parent and child are certain have the same seccomp state when they exit the lock. Based on patches by Will Drewry and David Drysdale. Signed-off-by: Kees Cook <keescook@chromium.org> Reviewed-by: Oleg Nesterov <oleg@redhat.com> Reviewed-by: Andy Lutomirski <luto@amacapital.net>
Diffstat (limited to 'include/linux/seccomp.h')
-rw-r--r--include/linux/seccomp.h6
1 files changed, 3 insertions, 3 deletions
diff --git a/include/linux/seccomp.h b/include/linux/seccomp.h
index 4054b0994071..9ff98b4bfe2e 100644
--- a/include/linux/seccomp.h
+++ b/include/linux/seccomp.h
@@ -14,11 +14,11 @@ struct seccomp_filter;
*
* @mode: indicates one of the valid values above for controlled
* system calls available to a process.
- * @filter: The metadata and ruleset for determining what system calls
- * are allowed for a task.
+ * @filter: must always point to a valid seccomp-filter or NULL as it is
+ * accessed without locking during system call entry.
*
* @filter must only be accessed from the context of current as there
- * is no locking.
+ * is no read locking.
*/
struct seccomp {
int mode;