kernel: handle spinlock from escape_to_root
* Likely fix the freeze in a few kernel version. Signed-off-by: rsuntk <rsuntk@yukiprjkt.my.id>
This commit is contained in:
@@ -122,11 +122,8 @@ static void setup_groups(struct root_profile *profile, struct cred *cred)
|
|||||||
put_group_info(group_info);
|
put_group_info(group_info);
|
||||||
}
|
}
|
||||||
|
|
||||||
static void disable_seccomp(void)
|
static void disable_seccomp(struct task_struct *tsk)
|
||||||
{
|
{
|
||||||
struct task_struct *tsk = get_current();
|
|
||||||
|
|
||||||
spin_lock_irq(&tsk->sighand->siglock);
|
|
||||||
assert_spin_locked(&tsk->sighand->siglock);
|
assert_spin_locked(&tsk->sighand->siglock);
|
||||||
|
|
||||||
// disable seccomp
|
// disable seccomp
|
||||||
@@ -139,24 +136,18 @@ static void disable_seccomp(void)
|
|||||||
|
|
||||||
#ifdef CONFIG_SECCOMP
|
#ifdef CONFIG_SECCOMP
|
||||||
tsk->seccomp.mode = 0;
|
tsk->seccomp.mode = 0;
|
||||||
if (tsk->seccomp.filter == NULL) {
|
if (tsk->seccomp.filter) {
|
||||||
pr_warn("tsk->seccomp.filter is NULL already!\n");
|
|
||||||
goto out;
|
|
||||||
}
|
|
||||||
|
|
||||||
// TODO: Add kernel 6.11+ support
|
// TODO: Add kernel 6.11+ support
|
||||||
// 5.9+ have filter_count and use seccomp_filter_release
|
// 5.9+ have filter_count and use seccomp_filter_release
|
||||||
#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 9, 0)
|
#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 9, 0)
|
||||||
seccomp_filter_release(tsk);
|
seccomp_filter_release(tsk);
|
||||||
atomic_set(&tsk->seccomp.filter_count, 0);
|
atomic_set(&tsk->seccomp.filter_count, 0);
|
||||||
#else
|
#else
|
||||||
put_seccomp_filter(tsk);
|
put_seccomp_filter(tsk);
|
||||||
tsk->seccomp.filter = NULL;
|
tsk->seccomp.filter = NULL;
|
||||||
#endif
|
#endif
|
||||||
|
}
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
out:
|
|
||||||
spin_unlock_irq(&tsk->sighand->siglock);
|
|
||||||
}
|
}
|
||||||
|
|
||||||
void escape_to_root(void)
|
void escape_to_root(void)
|
||||||
@@ -207,7 +198,9 @@ void escape_to_root(void)
|
|||||||
setup_groups(profile, newcreds);
|
setup_groups(profile, newcreds);
|
||||||
commit_creds(newcreds);
|
commit_creds(newcreds);
|
||||||
|
|
||||||
disable_seccomp();
|
spin_lock_irq(¤t->sighand->siglock);
|
||||||
|
disable_seccomp(current);
|
||||||
|
spin_unlock_irq(¤t->sighand->siglock);
|
||||||
setup_selinux(profile->selinux_domain);
|
setup_selinux(profile->selinux_domain);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user