From: "H. Peter Anvin" <hpa@zytor.com> To: Solar Designer <solar@openwall.com> Cc: Andi Kleen <andi@firstfloor.org>, Vasiliy Kulikov <segoon@openwall.com>, Thomas Gleixner <tglx@linutronix.de>, Ingo Molnar <mingo@redhat.com>, James Morris <jmorris@namei.org>, kernel-hardening@lists.openwall.com, x86@kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org Subject: Re: [RFC] x86: restrict pid namespaces to 32 or 64 bit syscalls Date: Sun, 14 Aug 2011 07:48:51 -0700 [thread overview] Message-ID: <01ba0cce-d28e-473e-be3a-7d3c8f185681@email.android.com> (raw) In-Reply-To: <20110814092028.GB14293@openwall.com> Solar Designer <solar@openwall.com> wrote: >On Sat, Aug 13, 2011 at 10:08:57PM -0700, H. Peter Anvin wrote: >> Andi Kleen <andi@firstfloor.org> wrote: >> >> >Sounds to me a better alternative would be more aggressive, >pro-active >> >fuzzing of the compat calls. >[...] >> Agreed. Other than that, I can see a fine-grained permission filter, >but the compat vs noncompat axis is just spurious. > >In case anyone cares, I respectfully disagree. I am with Vasiliy on >this. I think that proactive fuzzing is great, but it is not an >alternative - we can also do both fuzzing and reduction of attack >surface at once. With Vasiliy reusing an existing check (in a future >revision of the patch), there's not going to be any performance impact. >Fine-grained restrictions would be great, but the 32- vs. 64-bit >restriction makes sense to me as well. I expect different systems to >use these different kinds of restrictions in different cases. > >We will definitely want to support x32 as well. We'd appreciate any >suggestions on how to do it best. > >Thanks, > >Alexander i386 vs x86-64 vs x32 is just one of many axes along which syscalls can be restricted (and for that matter, one axis if backward compatibility), and it does not make sense to burden the code with ad hoc filters. Designing a general filter facility which can be used to restrict any container to the subset of system calls it actually needs would make more sense, no? -- Sent from my mobile phone. Please excuse my brevity and lack of formatting.
WARNING: multiple messages have this Message-ID (diff)
From: "H. Peter Anvin" <hpa@zytor.com> To: Solar Designer <solar@openwall.com> Cc: Andi Kleen <andi@firstfloor.org>, Vasiliy Kulikov <segoon@openwall.com>, Thomas Gleixner <tglx@linutronix.de>, Ingo Molnar <mingo@redhat.com>, James Morris <jmorris@namei.org>, kernel-hardening@lists.openwall.com, x86@kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org Subject: [kernel-hardening] Re: [RFC] x86: restrict pid namespaces to 32 or 64 bit syscalls Date: Sun, 14 Aug 2011 07:48:51 -0700 [thread overview] Message-ID: <01ba0cce-d28e-473e-be3a-7d3c8f185681@email.android.com> (raw) In-Reply-To: <20110814092028.GB14293@openwall.com> Solar Designer <solar@openwall.com> wrote: >On Sat, Aug 13, 2011 at 10:08:57PM -0700, H. Peter Anvin wrote: >> Andi Kleen <andi@firstfloor.org> wrote: >> >> >Sounds to me a better alternative would be more aggressive, >pro-active >> >fuzzing of the compat calls. >[...] >> Agreed. Other than that, I can see a fine-grained permission filter, >but the compat vs noncompat axis is just spurious. > >In case anyone cares, I respectfully disagree. I am with Vasiliy on >this. I think that proactive fuzzing is great, but it is not an >alternative - we can also do both fuzzing and reduction of attack >surface at once. With Vasiliy reusing an existing check (in a future >revision of the patch), there's not going to be any performance impact. >Fine-grained restrictions would be great, but the 32- vs. 64-bit >restriction makes sense to me as well. I expect different systems to >use these different kinds of restrictions in different cases. > >We will definitely want to support x32 as well. We'd appreciate any >suggestions on how to do it best. > >Thanks, > >Alexander i386 vs x86-64 vs x32 is just one of many axes along which syscalls can be restricted (and for that matter, one axis if backward compatibility), and it does not make sense to burden the code with ad hoc filters. Designing a general filter facility which can be used to restrict any container to the subset of system calls it actually needs would make more sense, no? -- Sent from my mobile phone. Please excuse my brevity and lack of formatting.
next prev parent reply other threads:[~2011-08-14 14:49 UTC|newest] Thread overview: 48+ messages / expand[flat|nested] mbox.gz Atom feed top 2011-08-12 15:03 [RFC] x86: restrict pid namespaces to 32 or 64 bit syscalls Vasiliy Kulikov 2011-08-12 15:03 ` [kernel-hardening] " Vasiliy Kulikov 2011-08-12 20:08 ` H. Peter Anvin 2011-08-12 20:08 ` [kernel-hardening] " H. Peter Anvin 2011-08-13 6:22 ` Vasiliy Kulikov 2011-08-13 6:22 ` [kernel-hardening] " Vasiliy Kulikov 2011-08-13 15:41 ` H. Peter Anvin 2011-08-13 15:41 ` [kernel-hardening] " H. Peter Anvin 2011-08-13 16:32 ` Vasiliy Kulikov 2011-08-14 9:09 ` Solar Designer 2011-08-14 9:09 ` [kernel-hardening] " Solar Designer 2011-08-18 14:40 ` [RFC v2] " Vasiliy Kulikov 2011-08-18 14:40 ` [kernel-hardening] " Vasiliy Kulikov 2011-08-14 2:38 ` [RFC] " Andi Kleen 2011-08-14 2:38 ` [kernel-hardening] " Andi Kleen 2011-08-14 5:08 ` H. Peter Anvin 2011-08-14 5:08 ` [kernel-hardening] " H. Peter Anvin 2011-08-14 9:20 ` Solar Designer 2011-08-14 9:20 ` [kernel-hardening] " Solar Designer 2011-08-14 14:48 ` H. Peter Anvin [this message] 2011-08-14 14:48 ` H. Peter Anvin 2011-08-14 15:27 ` Andi Kleen 2011-08-14 15:27 ` [kernel-hardening] " Andi Kleen 2011-08-14 15:36 ` H. Peter Anvin 2011-08-14 15:36 ` [kernel-hardening] " H. Peter Anvin 2011-08-14 23:29 ` James Morris 2011-08-14 23:29 ` [kernel-hardening] " James Morris 2011-08-15 0:18 ` Andi Kleen 2011-08-15 0:18 ` [kernel-hardening] " Andi Kleen 2011-08-15 0:32 ` Will Drewry 2011-08-15 0:58 ` Andi Kleen [not found] ` <20110814152729.GU5782-qrUzlfsMFqo/4alezvVtWx2eb7JE58TQ@public.gmane.org> 2011-08-14 16:08 ` Vasiliy Kulikov 2011-08-14 16:08 ` [kernel-hardening] " Vasiliy Kulikov 2011-08-14 16:08 ` Vasiliy Kulikov 2011-08-15 18:51 ` Solar Designer 2011-08-15 18:51 ` [kernel-hardening] " Solar Designer 2011-08-15 18:59 ` H. Peter Anvin 2011-08-15 18:59 ` [kernel-hardening] " H. Peter Anvin 2011-08-15 20:14 ` Solar Designer 2011-08-15 20:14 ` [kernel-hardening] " Solar Designer 2011-08-15 20:27 ` Andi Kleen 2011-08-15 20:27 ` [kernel-hardening] " Andi Kleen 2011-08-15 20:48 ` H. Peter Anvin 2011-08-15 20:48 ` [kernel-hardening] " H. Peter Anvin 2011-08-15 22:13 ` Eric Paris 2011-08-15 22:13 ` [kernel-hardening] " Eric Paris 2011-08-16 1:18 ` Andi Kleen 2011-08-16 1:18 ` [kernel-hardening] " Andi Kleen
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=01ba0cce-d28e-473e-be3a-7d3c8f185681@email.android.com \ --to=hpa@zytor.com \ --cc=andi@firstfloor.org \ --cc=jmorris@namei.org \ --cc=kernel-hardening@lists.openwall.com \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-security-module@vger.kernel.org \ --cc=mingo@redhat.com \ --cc=segoon@openwall.com \ --cc=solar@openwall.com \ --cc=tglx@linutronix.de \ --cc=x86@kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.