[PATCH] seccomp: do not reject initial filter using TSYNC

[Kees Cook]

There was an unneeded sanity check in the TSYNC code that was causing
the first filter applied to not allow the TSYNC flag. Additionally,
this optimizes the thread loops to skip "current". It was harmless, but
better to not cause problems in the future.

Reported-by: David Drysdale <drysdale@xxxxxxxxxx>
Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx>
---
This goes on top of the v11 seccomp-tsync series. If I should respin
as v12, please let me know.

Thanks!
---
 kernel/seccomp.c |   11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index 2125b83ccfd4..0e0c6905b81d 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -255,14 +255,15 @@ static inline pid_t seccomp_can_sync_threads(void)
 	BUG_ON(!mutex_is_locked(&current->signal->cred_guard_mutex));
 	BUG_ON(!spin_is_locked(&current->sighand->siglock));
 
-	if (current->seccomp.mode != SECCOMP_MODE_FILTER)
-		return -EACCES;
-
 	/* Validate all threads being eligible for synchronization. */
 	caller = current;
 	for_each_thread(caller, thread) {
 		pid_t failed;
 
+		/* Skip current, since it is initiating the sync. */
+		if (thread == current)
+			continue;
+
 		if (thread->seccomp.mode == SECCOMP_MODE_DISABLED ||
 		    (thread->seccomp.mode == SECCOMP_MODE_FILTER &&
 		     is_ancestor(thread->seccomp.filter,
@@ -298,6 +299,10 @@ static inline void seccomp_sync_threads(void)
 	/* Synchronize all threads. */
 	caller = current;
 	for_each_thread(caller, thread) {
+		/* Skip current, since it needs no changes. */
+		if (thread == current)
+			continue;
+
 		/* Get a task reference for the new leaf node. */
 		get_seccomp_filter(caller);
 		/*
-- 
1.7.9.5


-- 
Kees Cook
Chrome OS Security
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/