From: "H. Peter Anvin" <hpa@zytor.com> To: Solar Designer <solar@openwall.com> Cc: Andi Kleen <andi@firstfloor.org>, Vasiliy Kulikov <segoon@openwall.com>, Thomas Gleixner <tglx@linutronix.de>, Ingo Molnar <mingo@redhat.com>, James Morris <jmorris@namei.org>, kernel-hardening@lists.openwall.com, x86@kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, Will Drewry <wad@chromium.org> Subject: Re: [RFC] x86: restrict pid namespaces to 32 or 64 bit syscalls Date: Mon, 15 Aug 2011 11:59:56 -0700 [thread overview] Message-ID: <4E496CAC.3030103@zytor.com> (raw) In-Reply-To: <20110815185114.GA20115@openwall.com> On 08/15/2011 11:51 AM, Solar Designer wrote: > I agree with you that i386 vs x86-64 vs x32 is one axis and syscall > number is another axis. They are not. ABI is ONE SUBSET OF SYSCALL NUMBERS. > Per-syscall restrictions are also useful, but primarily at a different > level - I'd expect them to be used in specific programs, such as Chrome > and vsftpd. Those programs may also want to limit themselves to a > certain type of syscalls (that is, on the i386 vs x86-64 vs x32 axis), > thereby making use of both features at once. Or they might even have to > do that, depending on how we implement the syscall restrictions. > > Per your suggestion, if I understand correctly, any task that wants to > restrict itself on the i386 vs x86-64 vs x32 axis will have TIF_SECCOMP > set and will incur calls into __secure_computing(). This is unnecessary > overhead for the case when we have a restriction over this axis only, > without per-syscall restrictions. Vasiliy's patch avoids such overhead. There is really no bloody difference between i386 vs x86-64 and, say, sys_oldstat versus sys_stat, or anything else along those lines. Putting in a bunch of ad hoc facilities because of semi-plausible performance wins rather than building a sane filtering facility which can be optimized as a single path is ridiculous. -hpa
WARNING: multiple messages have this Message-ID (diff)
From: "H. Peter Anvin" <hpa@zytor.com> To: Solar Designer <solar@openwall.com> Cc: Andi Kleen <andi@firstfloor.org>, Vasiliy Kulikov <segoon@openwall.com>, Thomas Gleixner <tglx@linutronix.de>, Ingo Molnar <mingo@redhat.com>, James Morris <jmorris@namei.org>, kernel-hardening@lists.openwall.com, x86@kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, Will Drewry <wad@chromium.org> Subject: [kernel-hardening] Re: [RFC] x86: restrict pid namespaces to 32 or 64 bit syscalls Date: Mon, 15 Aug 2011 11:59:56 -0700 [thread overview] Message-ID: <4E496CAC.3030103@zytor.com> (raw) In-Reply-To: <20110815185114.GA20115@openwall.com> On 08/15/2011 11:51 AM, Solar Designer wrote: > I agree with you that i386 vs x86-64 vs x32 is one axis and syscall > number is another axis. They are not. ABI is ONE SUBSET OF SYSCALL NUMBERS. > Per-syscall restrictions are also useful, but primarily at a different > level - I'd expect them to be used in specific programs, such as Chrome > and vsftpd. Those programs may also want to limit themselves to a > certain type of syscalls (that is, on the i386 vs x86-64 vs x32 axis), > thereby making use of both features at once. Or they might even have to > do that, depending on how we implement the syscall restrictions. > > Per your suggestion, if I understand correctly, any task that wants to > restrict itself on the i386 vs x86-64 vs x32 axis will have TIF_SECCOMP > set and will incur calls into __secure_computing(). This is unnecessary > overhead for the case when we have a restriction over this axis only, > without per-syscall restrictions. Vasiliy's patch avoids such overhead. There is really no bloody difference between i386 vs x86-64 and, say, sys_oldstat versus sys_stat, or anything else along those lines. Putting in a bunch of ad hoc facilities because of semi-plausible performance wins rather than building a sane filtering facility which can be optimized as a single path is ridiculous. -hpa
next prev parent reply other threads:[~2011-08-15 19:00 UTC|newest] Thread overview: 48+ messages / expand[flat|nested] mbox.gz Atom feed top 2011-08-12 15:03 [RFC] x86: restrict pid namespaces to 32 or 64 bit syscalls Vasiliy Kulikov 2011-08-12 15:03 ` [kernel-hardening] " Vasiliy Kulikov 2011-08-12 20:08 ` H. Peter Anvin 2011-08-12 20:08 ` [kernel-hardening] " H. Peter Anvin 2011-08-13 6:22 ` Vasiliy Kulikov 2011-08-13 6:22 ` [kernel-hardening] " Vasiliy Kulikov 2011-08-13 15:41 ` H. Peter Anvin 2011-08-13 15:41 ` [kernel-hardening] " H. Peter Anvin 2011-08-13 16:32 ` Vasiliy Kulikov 2011-08-14 9:09 ` Solar Designer 2011-08-14 9:09 ` [kernel-hardening] " Solar Designer 2011-08-18 14:40 ` [RFC v2] " Vasiliy Kulikov 2011-08-18 14:40 ` [kernel-hardening] " Vasiliy Kulikov 2011-08-14 2:38 ` [RFC] " Andi Kleen 2011-08-14 2:38 ` [kernel-hardening] " Andi Kleen 2011-08-14 5:08 ` H. Peter Anvin 2011-08-14 5:08 ` [kernel-hardening] " H. Peter Anvin 2011-08-14 9:20 ` Solar Designer 2011-08-14 9:20 ` [kernel-hardening] " Solar Designer 2011-08-14 14:48 ` H. Peter Anvin 2011-08-14 14:48 ` [kernel-hardening] " H. Peter Anvin 2011-08-14 15:27 ` Andi Kleen 2011-08-14 15:27 ` [kernel-hardening] " Andi Kleen 2011-08-14 15:36 ` H. Peter Anvin 2011-08-14 15:36 ` [kernel-hardening] " H. Peter Anvin 2011-08-14 23:29 ` James Morris 2011-08-14 23:29 ` [kernel-hardening] " James Morris 2011-08-15 0:18 ` Andi Kleen 2011-08-15 0:18 ` [kernel-hardening] " Andi Kleen 2011-08-15 0:32 ` Will Drewry 2011-08-15 0:58 ` Andi Kleen [not found] ` <20110814152729.GU5782-qrUzlfsMFqo/4alezvVtWx2eb7JE58TQ@public.gmane.org> 2011-08-14 16:08 ` Vasiliy Kulikov 2011-08-14 16:08 ` [kernel-hardening] " Vasiliy Kulikov 2011-08-14 16:08 ` Vasiliy Kulikov 2011-08-15 18:51 ` Solar Designer 2011-08-15 18:51 ` [kernel-hardening] " Solar Designer 2011-08-15 18:59 ` H. Peter Anvin [this message] 2011-08-15 18:59 ` H. Peter Anvin 2011-08-15 20:14 ` Solar Designer 2011-08-15 20:14 ` [kernel-hardening] " Solar Designer 2011-08-15 20:27 ` Andi Kleen 2011-08-15 20:27 ` [kernel-hardening] " Andi Kleen 2011-08-15 20:48 ` H. Peter Anvin 2011-08-15 20:48 ` [kernel-hardening] " H. Peter Anvin 2011-08-15 22:13 ` Eric Paris 2011-08-15 22:13 ` [kernel-hardening] " Eric Paris 2011-08-16 1:18 ` Andi Kleen 2011-08-16 1:18 ` [kernel-hardening] " Andi Kleen
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=4E496CAC.3030103@zytor.com \ --to=hpa@zytor.com \ --cc=andi@firstfloor.org \ --cc=jmorris@namei.org \ --cc=kernel-hardening@lists.openwall.com \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-security-module@vger.kernel.org \ --cc=mingo@redhat.com \ --cc=segoon@openwall.com \ --cc=solar@openwall.com \ --cc=tglx@linutronix.de \ --cc=wad@chromium.org \ --cc=x86@kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.