From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934401AbcHYN6z (ORCPT ); Thu, 25 Aug 2016 09:58:55 -0400 Received: from smtp-sh.infomaniak.ch ([128.65.195.4]:37406 "EHLO smtp-sh.infomaniak.ch" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934202AbcHYN6w (ORCPT ); Thu, 25 Aug 2016 09:58:52 -0400 Subject: Re: [RFC v2 00/10] Landlock LSM: Unprivileged sandboxing To: Andy Lutomirski References: <1472121165-29071-1-git-send-email-mic@digikod.net> Cc: LKML , Alexei Starovoitov , Arnd Bergmann , Casey Schaufler , Daniel Borkmann , Daniel Mack , David Drysdale , "David S . Miller" , Elena Reshetova , James Morris , Kees Cook , Paul Moore , Sargun Dhillon , "Serge E . Hallyn" , Will Drewry , Kernel Hardening , Linux API , LSM List , Network Development From: =?UTF-8?Q?Micka=c3=abl_Sala=c3=bcn?= Message-ID: <57BEF949.6090808@digikod.net> Date: Thu, 25 Aug 2016 15:57:29 +0200 User-Agent: MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="Al6xw5FI9qr3UgJ4HsDw4rRlN4Qqoc78t" X-Antivirus: Dr.Web (R) for Unix mail servers drweb plugin ver.6.0.2.8 X-Antivirus-Code: 0x100000 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --Al6xw5FI9qr3UgJ4HsDw4rRlN4Qqoc78t Content-Type: multipart/mixed; boundary="2HflmeHHgbTbeHlc69LqQTKE1mnqnoMgi" From: =?UTF-8?Q?Micka=c3=abl_Sala=c3=bcn?= To: Andy Lutomirski Cc: LKML , Alexei Starovoitov , Arnd Bergmann , Casey Schaufler , Daniel Borkmann , Daniel Mack , David Drysdale , "David S . Miller" , Elena Reshetova , James Morris , Kees Cook , Paul Moore , Sargun Dhillon , "Serge E . Hallyn" , Will Drewry , Kernel Hardening , Linux API , LSM List , Network Development Message-ID: <57BEF949.6090808@digikod.net> Subject: Re: [RFC v2 00/10] Landlock LSM: Unprivileged sandboxing References: <1472121165-29071-1-git-send-email-mic@digikod.net> In-Reply-To: --2HflmeHHgbTbeHlc69LqQTKE1mnqnoMgi Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 25/08/2016 13:05, Andy Lutomirski wrote: > On Thu, Aug 25, 2016 at 3:32 AM, Micka=C3=ABl Sala=C3=BCn wrote: >> Hi, >> >> This series is a proof of concept to fill some missing part of seccomp= as the >> ability to check syscall argument pointers or creating more dynamic se= curity >> policies. The goal of this new stackable Linux Security Module (LSM) c= alled >> Landlock is to allow any process, including unprivileged ones, to crea= te >> powerful security sandboxes comparable to the Seatbelt/XNU Sandbox or = the >> OpenBSD Pledge. This kind of sandbox help to mitigate the security imp= act of >> bugs or unexpected/malicious behaviors in userland applications. >> >=20 > Maybe I'm missing an obvious description, but: do you have a > description of the eBPF API to landlock? What function do you > provide, when is it called, what functions can it call, what does the > fancy new arraymap do, etc? >=20 > --Andy >=20 The eBPF context is described in "[RFC v2 06/10] landlock: Add LSM hooks"= =2E The provided eBPF functions are described in "[RFC v2 08/10] landlock: Handle file system comparisons" (bpf_landlock_cmp_fs_prop_with_struct_file and bpf_landlock_cmp_fs_beneath_with_struct_file) and "[RFC v2 09/10] landlock: Handle cgroups" (bpf_landlock_cmp_cgroup_beneath). The function descriptions are summarized in include/uapi/linux/bpf.h . This functions can be called by an eBPF program of type BPF_PROG_TYPE_LANDLOCK_FILE_OPEN, BPF_PROG_TYPE_LANDLOCK_FILE_PERMISSION and BPF_PROG_TYPE_LANDLOCK_MMAP_FILE as described in "[RFC v2 06/10] landlock: Add LSM hooks". I tried to split the commits as much as possible to ease the review. The "[RFC v2 10/10] samples/landlock: Add sandbox example" may help to see the whole picture. Hope this helps, Micka=C3=ABl --2HflmeHHgbTbeHlc69LqQTKE1mnqnoMgi-- --Al6xw5FI9qr3UgJ4HsDw4rRlN4Qqoc78t Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJXvvlJAAoJECLe/t9zvWqV83YH+wYlHNVILLbD3w04O+3pZxln oyE29E0ZzxCPSsNIFhReeRhKh9p7vKQgjRj+J+0l17TB2hPGQ4l/vxEUeM816NQ0 3/1UoX80s+CVKfRObYygcegDA07Db3WUQ871xlfGm8+Q1eC+KfYvxGA/L0Yb/8pT E4WcII4ymy/pFcnPUo086nq+1lh9kdtfx3YZVgTRwgsILQ/K1wEbZ69EL1NmgZed L2El51io05Q2DxwWFbC0pxsFruBoveMkKZLo/YARKrPnxP5/couxIi7mJg5lvKCR qdzDeEIwUHzrriL7/1S2DtaU+jBdPfcoPLvHEdaPBeaQCQahbaZPl49tG9WyyuE= =UfDs -----END PGP SIGNATURE----- --Al6xw5FI9qr3UgJ4HsDw4rRlN4Qqoc78t-- From mboxrd@z Thu Jan 1 00:00:00 1970 Reply-To: kernel-hardening@lists.openwall.com References: <1472121165-29071-1-git-send-email-mic@digikod.net> From: =?UTF-8?Q?Micka=c3=abl_Sala=c3=bcn?= Message-ID: <57BEF949.6090808@digikod.net> Date: Thu, 25 Aug 2016 15:57:29 +0200 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="Al6xw5FI9qr3UgJ4HsDw4rRlN4Qqoc78t" Subject: [kernel-hardening] Re: [RFC v2 00/10] Landlock LSM: Unprivileged sandboxing To: Andy Lutomirski Cc: LKML , Alexei Starovoitov , Arnd Bergmann , Casey Schaufler , Daniel Borkmann , Daniel Mack , David Drysdale , "David S . Miller" , Elena Reshetova , James Morris , Kees Cook , Paul Moore , Sargun Dhillon , "Serge E . Hallyn" , Will Drewry , Kernel Hardening , Linux API , LSM List , Network Development List-ID: This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --Al6xw5FI9qr3UgJ4HsDw4rRlN4Qqoc78t Content-Type: multipart/mixed; boundary="2HflmeHHgbTbeHlc69LqQTKE1mnqnoMgi" From: =?UTF-8?Q?Micka=c3=abl_Sala=c3=bcn?= To: Andy Lutomirski Cc: LKML , Alexei Starovoitov , Arnd Bergmann , Casey Schaufler , Daniel Borkmann , Daniel Mack , David Drysdale , "David S . Miller" , Elena Reshetova , James Morris , Kees Cook , Paul Moore , Sargun Dhillon , "Serge E . Hallyn" , Will Drewry , Kernel Hardening , Linux API , LSM List , Network Development Message-ID: <57BEF949.6090808@digikod.net> Subject: Re: [RFC v2 00/10] Landlock LSM: Unprivileged sandboxing References: <1472121165-29071-1-git-send-email-mic@digikod.net> In-Reply-To: --2HflmeHHgbTbeHlc69LqQTKE1mnqnoMgi Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 25/08/2016 13:05, Andy Lutomirski wrote: > On Thu, Aug 25, 2016 at 3:32 AM, Micka=C3=ABl Sala=C3=BCn wrote: >> Hi, >> >> This series is a proof of concept to fill some missing part of seccomp= as the >> ability to check syscall argument pointers or creating more dynamic se= curity >> policies. The goal of this new stackable Linux Security Module (LSM) c= alled >> Landlock is to allow any process, including unprivileged ones, to crea= te >> powerful security sandboxes comparable to the Seatbelt/XNU Sandbox or = the >> OpenBSD Pledge. This kind of sandbox help to mitigate the security imp= act of >> bugs or unexpected/malicious behaviors in userland applications. >> >=20 > Maybe I'm missing an obvious description, but: do you have a > description of the eBPF API to landlock? What function do you > provide, when is it called, what functions can it call, what does the > fancy new arraymap do, etc? >=20 > --Andy >=20 The eBPF context is described in "[RFC v2 06/10] landlock: Add LSM hooks"= =2E The provided eBPF functions are described in "[RFC v2 08/10] landlock: Handle file system comparisons" (bpf_landlock_cmp_fs_prop_with_struct_file and bpf_landlock_cmp_fs_beneath_with_struct_file) and "[RFC v2 09/10] landlock: Handle cgroups" (bpf_landlock_cmp_cgroup_beneath). The function descriptions are summarized in include/uapi/linux/bpf.h . This functions can be called by an eBPF program of type BPF_PROG_TYPE_LANDLOCK_FILE_OPEN, BPF_PROG_TYPE_LANDLOCK_FILE_PERMISSION and BPF_PROG_TYPE_LANDLOCK_MMAP_FILE as described in "[RFC v2 06/10] landlock: Add LSM hooks". I tried to split the commits as much as possible to ease the review. The "[RFC v2 10/10] samples/landlock: Add sandbox example" may help to see the whole picture. Hope this helps, Micka=C3=ABl --2HflmeHHgbTbeHlc69LqQTKE1mnqnoMgi-- --Al6xw5FI9qr3UgJ4HsDw4rRlN4Qqoc78t Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJXvvlJAAoJECLe/t9zvWqV83YH+wYlHNVILLbD3w04O+3pZxln oyE29E0ZzxCPSsNIFhReeRhKh9p7vKQgjRj+J+0l17TB2hPGQ4l/vxEUeM816NQ0 3/1UoX80s+CVKfRObYygcegDA07Db3WUQ871xlfGm8+Q1eC+KfYvxGA/L0Yb/8pT E4WcII4ymy/pFcnPUo086nq+1lh9kdtfx3YZVgTRwgsILQ/K1wEbZ69EL1NmgZed L2El51io05Q2DxwWFbC0pxsFruBoveMkKZLo/YARKrPnxP5/couxIi7mJg5lvKCR qdzDeEIwUHzrriL7/1S2DtaU+jBdPfcoPLvHEdaPBeaQCQahbaZPl49tG9WyyuE= =UfDs -----END PGP SIGNATURE----- --Al6xw5FI9qr3UgJ4HsDw4rRlN4Qqoc78t--