Re: [PATCH v2 1/3] seccomp: Store death as a separate field

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The newly added defense `if (unlikely(current->seccomp.dead))` was omitted from the non-BPF fallback implementation of `secure_computing_strict()`.
--

commit 17b53379696e6ea38281041129401658643c996d
Author: Jamie Hill-Daniel <clubby789@gmail.com>

seccomp: Store death as a separate field

This patch removes SECCOMP_MODE_DEAD and stores the death state in a new
bitfield within struct seccomp. This allows the mode field to strictly store
the current seccomp mode while exposing it to userspace.

> diff --git a/kernel/seccomp.c b/kernel/seccomp.c
> index 066909393c38f..2d21cb6bbd94d 100644
> --- a/kernel/seccomp.c
> +++ b/kernel/seccomp.c

[ ... ]

> @@ -1396,17 +1393,19 @@ int __secure_computing(void)
>  
>  	this_syscall = syscall_get_nr(current, current_pt_regs());
>  
> +	/* Surviving SECCOMP_RET_KILL_* must be proactively impossible. */
> +	if (unlikely(current->seccomp.dead)) {
> +		WARN_ON_ONCE(1);
> +		do_exit(SIGKILL);
> +		return -1;
> +	}
> +

[Severity: High]
Is it possible we need this same check in the non-BPF fallback version of
secure_computing_strict()?

When CONFIG_HAVE_ARCH_SECCOMP_FILTER is disabled, secure_computing_strict()
evaluates current->seccomp.mode. Previously, if a killed process miraculously
survived do_exit() and issued another syscall, the mode would be
SECCOMP_MODE_DEAD and trigger a BUG() instead of executing
__secure_computing_strict():

kernel/seccomp.c:secure_computing_strict() {
    ...
    if (mode == SECCOMP_MODE_DISABLED)
        return;
    else if (mode == SECCOMP_MODE_STRICT)
        __secure_computing_strict(this_syscall);
    else
        BUG();
}

With the new dead bitfield, if the process survives and issues a valid
strict-mode syscall (e.g. exit), the mode remains SECCOMP_MODE_STRICT.
It appears we'll simply execute __secure_computing_strict() again and
return successfully without killing the process, neutralizing the fail-safe.

>  	switch (mode) {
>  	case SECCOMP_MODE_STRICT:
>  		__secure_computing_strict(this_syscall);  /* may call do_exit */
>  		return 0;
>  	case SECCOMP_MODE_FILTER:
>  		return __seccomp_filter(this_syscall, false);
> -	/* Surviving SECCOMP_RET_KILL_* must be proactively impossible. */
> -	case SECCOMP_MODE_DEAD:
> -		WARN_ON_ONCE(1);
> -		do_exit(SIGKILL);
> -		return -1;
>  	default:
>  		BUG();
>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260615-seccomp-combined-v2-0-41687a943ae0@hill-daniel.co.uk?part=1