commit c818c03b661cd769e035e41673d5543ba2ebda64
author Kees Cook <keescook@chromium.org> Wed May 13 14:11:26 2020 -0700
committer Kees Cook <keescook@chromium.org> Fri Jul 10 16:01:51 2020 -0700
tree ceb9cf9666ce0e0e3964c1ff1a0a5949de471cf6
parent e4d05028a07f505a08802a6d1b11674c149df2b3

seccomp: Report number of loaded filters in /proc/$pid/status

A common question asked when debugging seccomp filters is "how many
filters are attached to your process?" Provide a way to easily answer
this question through /proc/$pid/status with a "Seccomp_filters" line.

Signed-off-by: Kees Cook <keescook@chromium.org>

kernel/seccomp.c

diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index d653d842..f387e50 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -398,6 +398,8 @@ static inline void seccomp_sync_threads(unsigned long flags)
 		put_seccomp_filter(thread);
 		smp_store_release(&thread->seccomp.filter,
 				  caller->seccomp.filter);
+		atomic_set(&thread->seccomp.filter_count,
+			   atomic_read(&thread->seccomp.filter_count));
 
 		/*
 		 * Don't let an unprivileged task work around
@@ -544,6 +546,7 @@ static long seccomp_attach_filter(unsigned int flags,
 	 */
 	filter->prev = current->seccomp.filter;
 	current->seccomp.filter = filter;
+	atomic_inc(&current->seccomp.filter_count);
 
 	/* Now that the new filter is in place, synchronize to all threads. */
 	if (flags & SECCOMP_FILTER_FLAG_TSYNC)