linux-security-module.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Stephen Smalley <stephen.smalley.work@gmail.com>
To: KP Singh <kpsingh@chromium.org>
Cc: Casey Schaufler <casey@schaufler-ca.com>,
	linux-kernel@vger.kernel.org, bpf@vger.kernel.org,
	LSM List <linux-security-module@vger.kernel.org>,
	Brendan Jackman <jackmanb@google.com>,
	Florent Revest <revest@google.com>,
	Alexei Starovoitov <ast@kernel.org>,
	Daniel Borkmann <daniel@iogearbox.net>,
	James Morris <jmorris@namei.org>,
	Kees Cook <keescook@chromium.org>, Paul Turner <pjt@google.com>,
	Jann Horn <jannh@google.com>,
	Florent Revest <revest@chromium.org>,
	Brendan Jackman <jackmanb@chromium.org>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Subject: Re: [PATCH bpf-next v5 5/7] bpf: lsm: Initialize the BPF LSM hooks
Date: Tue, 24 Mar 2020 10:51:32 -0400	[thread overview]
Message-ID: <CAEjxPJ7GDA2PvYkoFhnE7gjr_n=ADCjy3XOwacfELY7evVJtJw@mail.gmail.com> (raw)
In-Reply-To: <20200324144214.GA1040@chromium.org>

On Tue, Mar 24, 2020 at 10:42 AM KP Singh <kpsingh@chromium.org> wrote:
>
> On 24-Mär 10:37, Stephen Smalley wrote:
> > On Mon, Mar 23, 2020 at 9:52 PM KP Singh <kpsingh@chromium.org> wrote:
> > >
> > > On 23-Mär 18:13, Casey Schaufler wrote:
> > > > Have you given up on the "BPF must be last" requirement?
> > >
> > > Yes, we dropped it for as the BPF programs require CAP_SYS_ADMIN
> > > anwyays so the position ~shouldn't~ matter. (based on some of the
> > > discussions we had on the BPF_MODIFY_RETURN patches).
> > >
> > > However, This can be added later (in a separate patch) if really
> > > deemed necessary.
> >
> > It matters for SELinux, as I previously explained.  A process that has
> > CAP_SYS_ADMIN is not assumed to be able to circumvent MAC policy.
> > And executing prior to SELinux allows the bpf program to access and
> > potentially leak to userspace information that wouldn't be visible to
> > the
> > process itself. However, I thought you were handling the order issue
> > by putting it last in the list of lsms?
>
> We can still do that if it does not work for SELinux.
>
> Would it be okay to add bpf as LSM_ORDER_LAST?
>
> LSMs like Landlock can then add LSM_ORDER_UNPRIVILEGED to even end up
> after bpf?

I guess the question is whether we need an explicit LSM_ORDER_LAST or
can just handle it via the default
values for the lsm= parameter, where you are already placing bpf last
IIUC?  If someone can mess with the kernel boot
parameters, they already have options to mess with SELinux, so it is no worse...

  reply	other threads:[~2020-03-24 14:50 UTC|newest]

Thread overview: 59+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-03-23 16:44 [PATCH bpf-next v5 0/8] MAC and Audit policy using eBPF (KRSI) KP Singh
2020-03-23 16:44 ` [PATCH bpf-next v5 1/7] bpf: Introduce BPF_PROG_TYPE_LSM KP Singh
2020-03-23 19:02   ` Yonghong Song
2020-03-23 16:44 ` [PATCH bpf-next v5 2/7] security: Refactor declaration of LSM hooks KP Singh
2020-03-23 19:33   ` Kees Cook
2020-03-23 19:56   ` Andrii Nakryiko
2020-03-24 16:06     ` KP Singh
2020-03-23 16:44 ` [PATCH bpf-next v5 3/7] bpf: lsm: provide attachment points for BPF LSM programs KP Singh
2020-03-23 19:04   ` Yonghong Song
2020-03-23 19:33   ` Kees Cook
2020-03-23 19:59   ` Andrii Nakryiko
2020-03-24 10:39     ` KP Singh
2020-03-24 16:12       ` KP Singh
2020-03-24 21:26         ` Andrii Nakryiko
2020-03-24 22:39           ` KP Singh
2020-03-23 16:44 ` [PATCH bpf-next v5 4/7] bpf: lsm: Implement attach, detach and execution KP Singh
2020-03-23 19:16   ` Yonghong Song
2020-03-23 19:44     ` KP Singh
2020-03-23 20:18   ` Andrii Nakryiko
2020-03-24 19:00     ` KP Singh
2020-03-24 14:35   ` Stephen Smalley
2020-03-24 14:50     ` KP Singh
2020-03-24 14:58       ` Stephen Smalley
2020-03-24 16:25         ` Casey Schaufler
2020-03-24 17:49           ` Stephen Smalley
2020-03-24 18:01             ` Kees Cook
2020-03-24 18:06               ` KP Singh
2020-03-24 18:21                 ` Stephen Smalley
2020-03-24 18:27                   ` KP Singh
2020-03-24 18:31                     ` KP Singh
2020-03-24 18:34                       ` Kees Cook
2020-03-24 18:33                   ` Kees Cook
2020-03-23 16:44 ` [PATCH bpf-next v5 5/7] bpf: lsm: Initialize the BPF LSM hooks KP Singh
2020-03-23 19:44   ` Kees Cook
2020-03-23 19:47     ` KP Singh
2020-03-23 20:21       ` Andrii Nakryiko
2020-03-23 20:47     ` Casey Schaufler
2020-03-23 21:44       ` Kees Cook
2020-03-23 21:58         ` Casey Schaufler
2020-03-23 22:12           ` Kees Cook
2020-03-23 23:39             ` Casey Schaufler
2020-03-24  1:53             ` KP Singh
2020-03-25 14:35             ` KP Singh
2020-03-24  1:13   ` Casey Schaufler
2020-03-24  1:52     ` KP Singh
2020-03-24 14:37       ` Stephen Smalley
2020-03-24 14:42         ` KP Singh
2020-03-24 14:51           ` Stephen Smalley [this message]
2020-03-24 14:51             ` KP Singh
2020-03-24 17:57               ` Kees Cook
2020-03-23 16:44 ` [PATCH bpf-next v5 6/7] tools/libbpf: Add support for BPF_PROG_TYPE_LSM KP Singh
2020-03-23 19:21   ` Yonghong Song
2020-03-23 20:25   ` Andrii Nakryiko
2020-03-24  1:57     ` KP Singh
2020-03-23 16:44 ` [PATCH bpf-next v5 7/7] bpf: lsm: Add selftests " KP Singh
2020-03-23 20:04   ` Yonghong Song
2020-03-24 20:04     ` KP Singh
2020-03-24 23:54   ` Andrii Nakryiko
2020-03-25  0:36     ` KP Singh

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='CAEjxPJ7GDA2PvYkoFhnE7gjr_n=ADCjy3XOwacfELY7evVJtJw@mail.gmail.com' \
    --to=stephen.smalley.work@gmail.com \
    --cc=ast@kernel.org \
    --cc=bpf@vger.kernel.org \
    --cc=casey@schaufler-ca.com \
    --cc=daniel@iogearbox.net \
    --cc=gregkh@linuxfoundation.org \
    --cc=jackmanb@chromium.org \
    --cc=jackmanb@google.com \
    --cc=jannh@google.com \
    --cc=jmorris@namei.org \
    --cc=keescook@chromium.org \
    --cc=kpsingh@chromium.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=pjt@google.com \
    --cc=revest@chromium.org \
    --cc=revest@google.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).