From mboxrd@z Thu Jan 1 00:00:00 1970 From: Tycho Andersen Subject: Re: [RFC 3/3] seccomp: add a way to get a listener fd from ptrace Date: Wed, 14 Feb 2018 08:33:59 -0700 Message-ID: <20180214153359.6wj6wclsqvgj4jlt__43392.8373422988$1518622361$gmane$org@smitten> References: <20180204104946.25559-1-tycho@tycho.ws> <20180204104946.25559-4-tycho@tycho.ws> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: Kees Cook Cc: Linux Containers , Akihiro Suda , Oleg Nesterov , LKML , "Eric W . Biederman" , Tyler Hicks , Christian Brauner , Andy Lutomirski List-Id: containers.vger.kernel.org On Tue, Feb 13, 2018 at 01:32:26PM -0800, Kees Cook wrote: > On Sun, Feb 4, 2018 at 2:49 AM, Tycho Andersen wrote: > > As an alternative to SECCOMP_FILTER_FLAG_GET_LISTENER, perhaps a ptrace() > > version which can acquire filters is useful. There are at least two reasons > > this is preferable, even though it uses ptrace: > > > > 1. You can control tasks that aren't cooperating with you > > 2. You can control tasks whose filters block sendmsg() and socket(); if the > > task installs a filter which blocks these calls, there's no way with > > SECCOMP_FILTER_FLAG_GET_LISTENER to get the fd out to the privileged task. > > I got worried for a second that this would get us into a many-to-many > state, but I see init_listener enforces a single listener per filter. > Whew. Seems legit. :) Yes, although if you sendmsg() the listener fd, you could still get into that state, so it's still maybe a concern? Tycho