All of lore.kernel.org
 help / color / mirror / Atom feed
From: Vasiliy Kulikov <segoon-cxoSlKxDwOJWk0Htik3J/w@public.gmane.org>
To: Andi Kleen <andi-Vw/NltI1exuRpAAqCnN02g@public.gmane.org>
Cc: Will Drewry <wad-F7+t8E8rja9g9hUCZPvPmw@public.gmane.org>,
	kernel-hardening-ZwoEplunGu1jrUoiu81ncdBPR1lH4CV8@public.gmane.org,
	containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org,
	x86-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org,
	linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
	linux-security-module-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
	Ingo Molnar <mingo-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>,
	Solar Designer <solar-cxoSlKxDwOJWk0Htik3J/w@public.gmane.org>,
	"H. Peter Anvin" <hpa-YMNOUZJC4hwAvxtiuMwx3w@public.gmane.org>,
	Thomas Gleixner <tglx-hfZtesqFncYOwBW4kG4KsQ@public.gmane.org>
Subject: Re: [RFC] x86: restrict pid namespaces to 32 or 64 bit syscalls
Date: Sun, 14 Aug 2011 20:08:48 +0400	[thread overview]
Message-ID: <20110814160848.GA4333@albatros> (raw)
In-Reply-To: <20110814152729.GU5782-qrUzlfsMFqo/4alezvVtWx2eb7JE58TQ@public.gmane.org>

(CC'ed Will Drewry, the author of new seccomp version, and 
containers list)

On Sun, Aug 14, 2011 at 17:27 +0200, Andi Kleen wrote:
> > i386 vs x86-64 vs x32 is just one of many axes along which syscalls can be restricted (and for that matter, one axis if backward compatibility), and it does not make sense to burden the code with ad hoc filters.  Designing a general filter facility which can be used to restrict any container to the subset of system calls it actually needs would make more sense, no?
> 
> I believe this is already in the newer versions of seccomp.

The "newer versions of seccomp" are NAK'ed by Ingo.  AFAIU, Ingo wants
more generic filters to filter much more than syscalls.  But it
contradicts the security by simplicity, which we're trying to achieve
with this patch.

Compatibility syscalls are much more error prone than common syscalls
as they lack good testing or sometimes lack it at all, unfortunately.
The link I've posted is about a crazy bug - a completely uninitialized
structure was used in copy_from_user() function.  The function was not
tested _at all_.  I doubt any non-compatibility syscall (ioctl()
handler, etc.) can be completely untested.

Also we already have CONFIG_IA32_EMULATION, this patch only moves the
configuration mechanism from the compilation stage to the runtime stage,
it doesn't draw the new line.  It grants the permissions to use the
feature to some containers, but denies to other containers, which is an
rather expected property of containers separation.

Thanks,

-- 
Vasiliy Kulikov
http://www.openwall.com - bringing security into open computing environments

WARNING: multiple messages have this Message-ID (diff)
From: Vasiliy Kulikov <segoon@openwall.com>
To: Andi Kleen <andi@firstfloor.org>
Cc: "H. Peter Anvin" <hpa@zytor.com>,
	Solar Designer <solar@openwall.com>,
	Thomas Gleixner <tglx@linutronix.de>,
	Ingo Molnar <mingo@redhat.com>, James Morris <jmorris@namei.org>,
	kernel-hardening@lists.openwall.com, x86@kernel.org,
	linux-kernel@vger.kernel.org,
	linux-security-module@vger.kernel.org,
	Will Drewry <wad@chromium.org>,
	containers@lists.linux-foundation.org
Subject: Re: [RFC] x86: restrict pid namespaces to 32 or 64 bit syscalls
Date: Sun, 14 Aug 2011 20:08:48 +0400	[thread overview]
Message-ID: <20110814160848.GA4333@albatros> (raw)
In-Reply-To: <20110814152729.GU5782@one.firstfloor.org>

(CC'ed Will Drewry, the author of new seccomp version, and 
containers list)

On Sun, Aug 14, 2011 at 17:27 +0200, Andi Kleen wrote:
> > i386 vs x86-64 vs x32 is just one of many axes along which syscalls can be restricted (and for that matter, one axis if backward compatibility), and it does not make sense to burden the code with ad hoc filters.  Designing a general filter facility which can be used to restrict any container to the subset of system calls it actually needs would make more sense, no?
> 
> I believe this is already in the newer versions of seccomp.

The "newer versions of seccomp" are NAK'ed by Ingo.  AFAIU, Ingo wants
more generic filters to filter much more than syscalls.  But it
contradicts the security by simplicity, which we're trying to achieve
with this patch.

Compatibility syscalls are much more error prone than common syscalls
as they lack good testing or sometimes lack it at all, unfortunately.
The link I've posted is about a crazy bug - a completely uninitialized
structure was used in copy_from_user() function.  The function was not
tested _at all_.  I doubt any non-compatibility syscall (ioctl()
handler, etc.) can be completely untested.

Also we already have CONFIG_IA32_EMULATION, this patch only moves the
configuration mechanism from the compilation stage to the runtime stage,
it doesn't draw the new line.  It grants the permissions to use the
feature to some containers, but denies to other containers, which is an
rather expected property of containers separation.

Thanks,

-- 
Vasiliy Kulikov
http://www.openwall.com - bringing security into open computing environments

WARNING: multiple messages have this Message-ID (diff)
From: Vasiliy Kulikov <segoon@openwall.com>
To: Andi Kleen <andi@firstfloor.org>
Cc: "H. Peter Anvin" <hpa@zytor.com>,
	Solar Designer <solar@openwall.com>,
	Thomas Gleixner <tglx@linutronix.de>,
	Ingo Molnar <mingo@redhat.com>, James Morris <jmorris@namei.org>,
	kernel-hardening@lists.openwall.com, x86@kernel.org,
	linux-kernel@vger.kernel.org,
	linux-security-module@vger.kernel.org,
	Will Drewry <wad@chromium.org>,
	containers@lists.linux-foundation.org
Subject: [kernel-hardening] Re: [RFC] x86: restrict pid namespaces to 32 or 64 bit syscalls
Date: Sun, 14 Aug 2011 20:08:48 +0400	[thread overview]
Message-ID: <20110814160848.GA4333@albatros> (raw)
In-Reply-To: <20110814152729.GU5782@one.firstfloor.org>

(CC'ed Will Drewry, the author of new seccomp version, and 
containers list)

On Sun, Aug 14, 2011 at 17:27 +0200, Andi Kleen wrote:
> > i386 vs x86-64 vs x32 is just one of many axes along which syscalls can be restricted (and for that matter, one axis if backward compatibility), and it does not make sense to burden the code with ad hoc filters.  Designing a general filter facility which can be used to restrict any container to the subset of system calls it actually needs would make more sense, no?
> 
> I believe this is already in the newer versions of seccomp.

The "newer versions of seccomp" are NAK'ed by Ingo.  AFAIU, Ingo wants
more generic filters to filter much more than syscalls.  But it
contradicts the security by simplicity, which we're trying to achieve
with this patch.

Compatibility syscalls are much more error prone than common syscalls
as they lack good testing or sometimes lack it at all, unfortunately.
The link I've posted is about a crazy bug - a completely uninitialized
structure was used in copy_from_user() function.  The function was not
tested _at all_.  I doubt any non-compatibility syscall (ioctl()
handler, etc.) can be completely untested.

Also we already have CONFIG_IA32_EMULATION, this patch only moves the
configuration mechanism from the compilation stage to the runtime stage,
it doesn't draw the new line.  It grants the permissions to use the
feature to some containers, but denies to other containers, which is an
rather expected property of containers separation.

Thanks,

-- 
Vasiliy Kulikov
http://www.openwall.com - bringing security into open computing environments

  parent reply	other threads:[~2011-08-14 16:08 UTC|newest]

Thread overview: 48+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2011-08-12 15:03 [RFC] x86: restrict pid namespaces to 32 or 64 bit syscalls Vasiliy Kulikov
2011-08-12 15:03 ` [kernel-hardening] " Vasiliy Kulikov
2011-08-12 20:08 ` H. Peter Anvin
2011-08-12 20:08   ` [kernel-hardening] " H. Peter Anvin
2011-08-13  6:22   ` Vasiliy Kulikov
2011-08-13  6:22     ` [kernel-hardening] " Vasiliy Kulikov
2011-08-13 15:41     ` H. Peter Anvin
2011-08-13 15:41       ` [kernel-hardening] " H. Peter Anvin
2011-08-13 16:32       ` Vasiliy Kulikov
2011-08-14  9:09         ` Solar Designer
2011-08-14  9:09           ` [kernel-hardening] " Solar Designer
2011-08-18 14:40         ` [RFC v2] " Vasiliy Kulikov
2011-08-18 14:40           ` [kernel-hardening] " Vasiliy Kulikov
2011-08-14  2:38       ` [RFC] " Andi Kleen
2011-08-14  2:38         ` [kernel-hardening] " Andi Kleen
2011-08-14  5:08         ` H. Peter Anvin
2011-08-14  5:08           ` [kernel-hardening] " H. Peter Anvin
2011-08-14  9:20           ` Solar Designer
2011-08-14  9:20             ` [kernel-hardening] " Solar Designer
2011-08-14 14:48             ` H. Peter Anvin
2011-08-14 14:48               ` [kernel-hardening] " H. Peter Anvin
2011-08-14 15:27               ` Andi Kleen
2011-08-14 15:27                 ` [kernel-hardening] " Andi Kleen
2011-08-14 15:36                 ` H. Peter Anvin
2011-08-14 15:36                   ` [kernel-hardening] " H. Peter Anvin
2011-08-14 23:29                   ` James Morris
2011-08-14 23:29                     ` [kernel-hardening] " James Morris
2011-08-15  0:18                   ` Andi Kleen
2011-08-15  0:18                     ` [kernel-hardening] " Andi Kleen
2011-08-15  0:32                     ` Will Drewry
2011-08-15  0:58                       ` Andi Kleen
     [not found]                 ` <20110814152729.GU5782-qrUzlfsMFqo/4alezvVtWx2eb7JE58TQ@public.gmane.org>
2011-08-14 16:08                   ` Vasiliy Kulikov [this message]
2011-08-14 16:08                     ` Vasiliy Kulikov
2011-08-14 16:08                     ` Vasiliy Kulikov
2011-08-15 18:51               ` Solar Designer
2011-08-15 18:51                 ` [kernel-hardening] " Solar Designer
2011-08-15 18:59                 ` H. Peter Anvin
2011-08-15 18:59                   ` [kernel-hardening] " H. Peter Anvin
2011-08-15 20:14                   ` Solar Designer
2011-08-15 20:14                     ` [kernel-hardening] " Solar Designer
2011-08-15 20:27                     ` Andi Kleen
2011-08-15 20:27                       ` [kernel-hardening] " Andi Kleen
2011-08-15 20:48                     ` H. Peter Anvin
2011-08-15 20:48                       ` [kernel-hardening] " H. Peter Anvin
2011-08-15 22:13                     ` Eric Paris
2011-08-15 22:13                       ` [kernel-hardening] " Eric Paris
2011-08-16  1:18                       ` Andi Kleen
2011-08-16  1:18                         ` [kernel-hardening] " Andi Kleen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20110814160848.GA4333@albatros \
    --to=segoon-cxoslkxdwojwk0htik3j/w@public.gmane.org \
    --cc=andi-Vw/NltI1exuRpAAqCnN02g@public.gmane.org \
    --cc=containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org \
    --cc=hpa-YMNOUZJC4hwAvxtiuMwx3w@public.gmane.org \
    --cc=kernel-hardening-ZwoEplunGu1jrUoiu81ncdBPR1lH4CV8@public.gmane.org \
    --cc=linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
    --cc=linux-security-module-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
    --cc=mingo-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org \
    --cc=solar-cxoSlKxDwOJWk0Htik3J/w@public.gmane.org \
    --cc=tglx-hfZtesqFncYOwBW4kG4KsQ@public.gmane.org \
    --cc=wad-F7+t8E8rja9g9hUCZPvPmw@public.gmane.org \
    --cc=x86-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.