From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S944742AbcJSPTN (ORCPT ); Wed, 19 Oct 2016 11:19:13 -0400 Received: from mail-lf0-f48.google.com ([209.85.215.48]:36843 "EHLO mail-lf0-f48.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S944722AbcJSPTK (ORCPT ); Wed, 19 Oct 2016 11:19:10 -0400 Date: Wed, 19 Oct 2016 17:19:06 +0200 From: Thomas Graf To: =?iso-8859-1?Q?Micka=EBl_Sala=FCn?= Cc: linux-kernel@vger.kernel.org, Alexei Starovoitov , Andy Lutomirski , Arnd Bergmann , Casey Schaufler , Daniel Borkmann , Daniel Mack , David Drysdale , "David S . Miller" , Elena Reshetova , "Eric W . Biederman" , James Morris , Kees Cook , Paul Moore , Sargun Dhillon , "Serge E . Hallyn" , Tejun Heo , Will Drewry , kernel-hardening@lists.openwall.com, linux-api@vger.kernel.org, linux-security-module@vger.kernel.org, netdev@vger.kernel.org, cgroups@vger.kernel.org Subject: Re: [RFC v3 06/22] landlock: Add LSM hooks Message-ID: <20161019151906.GC22003@pox.localdomain> References: <20160914072415.26021-1-mic@digikod.net> <20160914072415.26021-7-mic@digikod.net> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20160914072415.26021-7-mic@digikod.net> User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 09/14/16 at 09:23am, Mickaël Salaün wrote: > diff --git a/include/linux/bpf.h b/include/linux/bpf.h > index 9aa01d9d3d80..36c3e482239c 100644 > --- a/include/linux/bpf.h > +++ b/include/linux/bpf.h > @@ -85,6 +85,8 @@ enum bpf_arg_type { > > ARG_PTR_TO_CTX, /* pointer to context */ > ARG_ANYTHING, /* any (initialized) argument is ok */ > + > + ARG_PTR_TO_STRUCT_FILE, /* pointer to struct file */ This should go into patch 7 I guess? > +void __init landlock_add_hooks(void) > +{ > + pr_info("landlock: Becoming ready for sandboxing\n"); > + security_add_hooks(landlock_hooks, ARRAY_SIZE(landlock_hooks)); > +} Can we add the hooks when we load the first BPF program for a hook? That would also allow to not make this conditional on a new config option which all all distros have to enable anyway. I would really like to see this patch split into the LSM part which allows running BPF progs at LSM and your specific sandboxing use case which requires the new BPF helpers, new reg type, etc. From mboxrd@z Thu Jan 1 00:00:00 1970 Reply-To: kernel-hardening@lists.openwall.com Date: Wed, 19 Oct 2016 17:19:06 +0200 From: Thomas Graf Message-ID: <20161019151906.GC22003@pox.localdomain> References: <20160914072415.26021-1-mic@digikod.net> <20160914072415.26021-7-mic@digikod.net> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20160914072415.26021-7-mic@digikod.net> Subject: [kernel-hardening] Re: [RFC v3 06/22] landlock: Add LSM hooks To: =?iso-8859-1?Q?Micka=EBl_Sala=FCn?= Cc: linux-kernel@vger.kernel.org, Alexei Starovoitov , Andy Lutomirski , Arnd Bergmann , Casey Schaufler , Daniel Borkmann , Daniel Mack , David Drysdale , "David S . Miller" , Elena Reshetova , "Eric W . Biederman" , James Morris , Kees Cook , Paul Moore , Sargun Dhillon , "Serge E . Hallyn" , Tejun Heo , Will Drewry , kernel-hardening@lists.openwall.com, linux-api@vger.kernel.org, linux-security-module@vger.kernel.org, netdev@vger.kernel.org, cgroups@vger.kernel.org List-ID: On 09/14/16 at 09:23am, Mickaël Salaün wrote: > diff --git a/include/linux/bpf.h b/include/linux/bpf.h > index 9aa01d9d3d80..36c3e482239c 100644 > --- a/include/linux/bpf.h > +++ b/include/linux/bpf.h > @@ -85,6 +85,8 @@ enum bpf_arg_type { > > ARG_PTR_TO_CTX, /* pointer to context */ > ARG_ANYTHING, /* any (initialized) argument is ok */ > + > + ARG_PTR_TO_STRUCT_FILE, /* pointer to struct file */ This should go into patch 7 I guess? > +void __init landlock_add_hooks(void) > +{ > + pr_info("landlock: Becoming ready for sandboxing\n"); > + security_add_hooks(landlock_hooks, ARRAY_SIZE(landlock_hooks)); > +} Can we add the hooks when we load the first BPF program for a hook? That would also allow to not make this conditional on a new config option which all all distros have to enable anyway. I would really like to see this patch split into the LSM part which allows running BPF progs at LSM and your specific sandboxing use case which requires the new BPF helpers, new reg type, etc.