[PATCH 0/4] Document new seccomp interfaces in Linux 4.14

[PATCH 0/4] Document new seccomp interfaces in Linux 4.14

[Tyler Hicks]

This patchset adds documentation for most of the new user-facing features
(/proc interfaces, SECCOMP_GET_ACTION_AVAIL operation, SECCOMP_FILTER_FLAG_LOG
flag, SECCOMP_RET_LOG action) merged into Linux 4.14 (commit
c0a3a64e723324ae6dda53214061a71de63808c3). All of these features have something
to do with providing more flexible seccomp logging configuration except for the
SECCOMP_GET_ACTION_AVAIL operation. 

The remaining undocumented changes in 4.14 involve SECCOMP_RET_KILL being
renamed to SECCOMP_RET_KILL_THREAD and the new SECCOMP_RET_KILL_PROCESS action.
As I understand it, Kees Cook will be documenting those changes.

Tyler

--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[PATCH 1/4] proc.5, seccomp.2: seccomp /proc interfaces

[Tyler Hicks]

Document the seccomp /proc interfaces added in Linux commits
v4.14-rc2~15^2~10 and v4.14-rc2~15^2~8.

Signed-off-by: Tyler Hicks <tyhicks-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>
---
 man2/seccomp.2 | 36 ++++++++++++++++++++++++++++++++++++
 man5/proc.5    |  7 +++++++
 2 files changed, 43 insertions(+)

diff --git a/man2/seccomp.2 b/man2/seccomp.2
index a99c262..5cd28b7 100644
--- a/man2/seccomp.2
+++ b/man2/seccomp.2
@@ -490,6 +490,42 @@ ptracers can use this mechanism to escape from the seccomp sandbox.)
 .TP
 .BR SECCOMP_RET_ALLOW
 This value results in the system call being executed.
+.SS /proc interfaces
+The files in the directory
+.IR /proc/sys/kernel/seccomp
+provide additional seccomp information and configuration:
+.TP
+.IR actions_avail " (since Linux 4.14)"
+.\" commit 8e5f1ad116df6b0de65eac458d5e7c318d1c05af
+A read-only ordered list of seccomp filter return actions in string form. The
+ordering, from left-to-right, is in decreasing order of precedence. The list
+represents the set of seccomp filter return actions supported by the kernel.
+.TP
+.IR actions_logged " (since Linux 4.14)"
+.\" commit 0ddec0fc8900201c0897b87b762b7c420436662f
+A read-write ordered list of seccomp filter return actions that are allowed to
+be logged. Writes to the file do not need to be in ordered form but reads from
+the file will be ordered in the same way as the
+.IR actions_avail
+file.
+.IP
+It is important to note that the value of
+.IR actions_logged
+does not prevent certain filter return actions from being logged when the audit
+subsystem is configured to audit a task. If the action is not found in the
+.IR actions_logged
+file, the final decision on whether to audit the action for that task is
+ultimately left up to the audit subsystem to decide for all filter return
+actions other than
+.BR SECCOMP_RET_ALLOW .
+.IP
+The "allow" string is not accepted in the
+.IR actions_logged
+file as it is not possible to log
+.BR SECCOMP_RET_ALLOW
+actions. Attempting to write "allow" to the file will result in
+.BR EINVAL
+being returned.
 .SH RETURN VALUE
 On success,
 .BR seccomp ()
diff --git a/man5/proc.5 b/man5/proc.5
index eeba1cf..215b3d9 100644
--- a/man5/proc.5
+++ b/man5/proc.5
@@ -4720,6 +4720,13 @@ See
 See
 .BR sched (7).
 .TP
+.IR /proc/sys/kernel/seccomp " (since Linux 4.14)"
+.\" commit 8e5f1ad116df6b0de65eac458d5e7c318d1c05af
+This directory provides additional seccomp information and
+configuration. See
+.BR seccomp (2)
+for further details.
+.TP
 .IR /proc/sys/kernel/sem " (since Linux 2.4)"
 This file contains 4 numbers defining limits for System V IPC semaphores.
 These fields are, in order:
-- 
2.7.4

--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[PATCH 2/4] seccomp.2: SECCOMP_GET_ACTION_AVAIL operation

[Tyler Hicks]

Document the SECCOMP_GET_ACTION_AVAIL seccomp(2) operation added in
Linux commit v4.14-rc2~15^2~9.

Signed-off-by: Tyler Hicks <tyhicks-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>
---
 man2/seccomp.2 | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/man2/seccomp.2 b/man2/seccomp.2
index 5cd28b7..a356f22 100644
--- a/man2/seccomp.2
+++ b/man2/seccomp.2
@@ -206,6 +206,17 @@ Synchronization will fail if another thread in the same process is in
 or if it has attached new seccomp filters to itself,
 diverging from the calling thread's filter tree.
 .RE
+.TP
+.BR SECCOMP_GET_ACTION_AVAIL " (since Linux 4.14)"
+.\" commit d612b1fd8010d0d67b5287fe146b8b55bcbb8655
+Test to see if an action is supported by the kernel. This operation is helpful to confirm that the kernel knows of a more recently added filter return action since the kernel treats all unknown actions as
+.BR SECCOMP_RET_KILL .
+.IP
+The value of
+.IR flags
+must be 0, and
+.IR args
+must be a pointer to an unsigned 32-bit filter return action.
 .SS Filters
 When adding filters via
 .BR SECCOMP_SET_MODE_FILTER ,
@@ -610,6 +621,13 @@ Note that for the purposes of calculating this limit,
 each already existing filter program incurs an
 overhead penalty of 4 instructions.
 .TP
+.BR EOPNOTSUPP
+.I operation
+specified
+.BR SECCOMP_GET_ACTION_AVAIL ,
+but the kernel does not support the filter return action specified by
+.IR args .
+.TP
 .BR ESRCH
 Another thread caused a failure during thread sync, but its ID could not
 be determined.
-- 
2.7.4

--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[PATCH 3/4] seccomp.2: SECCOMP_FILTER_FLAG_LOG flag

[Tyler Hicks]

Document the SECCOMP_FILTER_FLAG_LOG seccomp(2) flag added in Linux
commit v4.14-rc2~15^2~6.

Signed-off-by: Tyler Hicks <tyhicks-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>
---
 man2/seccomp.2 | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/man2/seccomp.2 b/man2/seccomp.2
index a356f22..c85c289 100644
--- a/man2/seccomp.2
+++ b/man2/seccomp.2
@@ -205,6 +205,14 @@ Synchronization will fail if another thread in the same process is in
 .BR SECCOMP_MODE_STRICT
 or if it has attached new seccomp filters to itself,
 diverging from the calling thread's filter tree.
+.TP
+.BR SECCOMP_FILTER_FLAG_LOG " (since Linux 4.14)"
+.\" commit e66a39977985b1e69e17c4042cb290768eca9b02
+All filter return actions except
+.BR SECCOMP_RET_ALLOW
+should be logged. An administrator may override this filter flag by preventing specific actions from being logged via the
+.IR /proc/sys/kernel/seccomp/actions_logged
+file.
 .RE
 .TP
 .BR SECCOMP_GET_ACTION_AVAIL " (since Linux 4.14)"
-- 
2.7.4

--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[PATCH 4/4] seccomp.2: SECCOMP_RET_LOG action

[Tyler Hicks]

Document the SECCOMP_RET_LOG seccomp(2) action added in Linux commit
v4.14-rc2~15^2~5.

Signed-off-by: Tyler Hicks <tyhicks-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>
---
 man2/seccomp.2 | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/man2/seccomp.2 b/man2/seccomp.2
index c85c289..8c91a47 100644
--- a/man2/seccomp.2
+++ b/man2/seccomp.2
@@ -507,6 +507,14 @@ of other
 sandboxed processes\(emwithout extreme care;
 ptracers can use this mechanism to escape from the seccomp sandbox.)
 .TP
+.BR SECCOMP_RET_LOG " (since Linux 4.14)"
+.\" commit 59f5cf44a38284eb9e76270c786fb6cc62ef8ac4
+This value results in the system call being executed after the filter return
+action is logged. An administrator may override the logging of this action via
+the
+.IR /proc/sys/kernel/seccomp/actions_logged
+file.
+.TP
 .BR SECCOMP_RET_ALLOW
 This value results in the system call being executed.
 .SS /proc interfaces
-- 
2.7.4

--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH 0/4] Document new seccomp interfaces in Linux 4.14

[Michael Kerrisk (man-pages)]

Hello Tyler,

On 10/26/2017 06:11 AM, Tyler Hicks wrote:
> This patchset adds documentation for most of the new user-facing features
> (/proc interfaces, SECCOMP_GET_ACTION_AVAIL operation, SECCOMP_FILTER_FLAG_LOG
> flag, SECCOMP_RET_LOG action) merged into Linux 4.14 (commit
> c0a3a64e723324ae6dda53214061a71de63808c3). All of these features have something
> to do with providing more flexible seccomp logging configuration except for the
> SECCOMP_GET_ACTION_AVAIL operation. 

Thanks for this set! I've applied all of the patches, made a few very minor
tweaks, and pushed to Git.

But, I realize there's some pieces missing about audit logging.
Would you be able/willing to write a patch for the seccomp(2)
page describing the audit details?

> The remaining undocumented changes in 4.14 involve SECCOMP_RET_KILL being
> renamed to SECCOMP_RET_KILL_THREAD and the new SECCOMP_RET_KILL_PROCESS action.
> As I understand it, Kees Cook will be documenting those changes.

Kees, are you there ? ;-)

Cheers,

Michael


-- 
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/
--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH 0/4] Document new seccomp interfaces in Linux 4.14

[Kees Cook]

On Thu, Nov 9, 2017 at 6:25 AM, Michael Kerrisk (man-pages)
<mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> wrote:
> Hello Tyler,
>
> On 10/26/2017 06:11 AM, Tyler Hicks wrote:
>> This patchset adds documentation for most of the new user-facing features
>> (/proc interfaces, SECCOMP_GET_ACTION_AVAIL operation, SECCOMP_FILTER_FLAG_LOG
>> flag, SECCOMP_RET_LOG action) merged into Linux 4.14 (commit
>> c0a3a64e723324ae6dda53214061a71de63808c3). All of these features have something
>> to do with providing more flexible seccomp logging configuration except for the
>> SECCOMP_GET_ACTION_AVAIL operation.
>
> Thanks for this set! I've applied all of the patches, made a few very minor
> tweaks, and pushed to Git.
>
> But, I realize there's some pieces missing about audit logging.
> Would you be able/willing to write a patch for the seccomp(2)
> page describing the audit details?
>
>> The remaining undocumented changes in 4.14 involve SECCOMP_RET_KILL being
>> renamed to SECCOMP_RET_KILL_THREAD and the new SECCOMP_RET_KILL_PROCESS action.
>> As I understand it, Kees Cook will be documenting those changes.
>
> Kees, are you there ? ;-)

I am, I am. :) I'm drowning in other work, but this is still on my
list. Do you have a set schedule for the next man-pages release?

-Kees

>
> Cheers,
>
> Michael
>
>
> --
> Michael Kerrisk
> Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
> Linux/UNIX System Programming Training: http://man7.org/training/



-- 
Kees Cook
Pixel Security
--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH 0/4] Document new seccomp interfaces in Linux 4.14

[Michael Kerrisk (man-pages)]

Hi Kees,

On 11/09/2017 07:10 PM, Kees Cook wrote:
> On Thu, Nov 9, 2017 at 6:25 AM, Michael Kerrisk (man-pages)
> <mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> wrote:
>> Hello Tyler,
>>
>> On 10/26/2017 06:11 AM, Tyler Hicks wrote:
>>> This patchset adds documentation for most of the new user-facing features
>>> (/proc interfaces, SECCOMP_GET_ACTION_AVAIL operation, SECCOMP_FILTER_FLAG_LOG
>>> flag, SECCOMP_RET_LOG action) merged into Linux 4.14 (commit
>>> c0a3a64e723324ae6dda53214061a71de63808c3). All of these features have something
>>> to do with providing more flexible seccomp logging configuration except for the
>>> SECCOMP_GET_ACTION_AVAIL operation.
>>
>> Thanks for this set! I've applied all of the patches, made a few very minor
>> tweaks, and pushed to Git.
>>
>> But, I realize there's some pieces missing about audit logging.
>> Would you be able/willing to write a patch for the seccomp(2)
>> page describing the audit details?
>>
>>> The remaining undocumented changes in 4.14 involve SECCOMP_RET_KILL being
>>> renamed to SECCOMP_RET_KILL_THREAD and the new SECCOMP_RET_KILL_PROCESS action.
>>> As I understand it, Kees Cook will be documenting those changes.
>>
>> Kees, are you there ? ;-)
> 
> I am, I am. :) I'm drowning in other work, but this is still on my
> list. Do you have a set schedule for the next man-pages release?

It'll probably happen in 10-14 days or so. But, I understand
if you won't have time before then. In that case, it'll go into
the next release.

Cheers,

Michael

-- 
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/
--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html