From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1761928AbcINSoV (ORCPT ); Wed, 14 Sep 2016 14:44:21 -0400 Received: from mail-yw0-f170.google.com ([209.85.161.170]:36416 "EHLO mail-yw0-f170.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757554AbcINSoQ (ORCPT ); Wed, 14 Sep 2016 14:44:16 -0400 MIME-Version: 1.0 In-Reply-To: <20160914072415.26021-12-mic@digikod.net> References: <20160914072415.26021-1-mic@digikod.net> <20160914072415.26021-12-mic@digikod.net> From: Andy Lutomirski Date: Wed, 14 Sep 2016 11:43:54 -0700 Message-ID: Subject: Re: [RFC v3 11/22] seccomp,landlock: Handle Landlock hooks per process hierarchy To: =?UTF-8?B?TWlja2HDq2wgU2FsYcO8bg==?= Cc: "linux-kernel@vger.kernel.org" , Alexei Starovoitov , Arnd Bergmann , Casey Schaufler , Daniel Borkmann , Daniel Mack , David Drysdale , "David S . Miller" , Elena Reshetova , "Eric W . Biederman" , James Morris , Kees Cook , Paul Moore , Sargun Dhillon , "Serge E . Hallyn" , Tejun Heo , Will Drewry , "kernel-hardening@lists.openwall.com" , Linux API , LSM List , Network Development , "open list:CONTROL GROUP (CGROUP)" , Andrew Morton Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by mail.home.local id u8EIiQbZ032582 On Wed, Sep 14, 2016 at 12:24 AM, Mickaël Salaün wrote: > A Landlock program will be triggered according to its subtype/origin > bitfield. The LANDLOCK_FLAG_ORIGIN_SECCOMP value will trigger the > Landlock program when a seccomp filter will return RET_LANDLOCK. > Moreover, it is possible to return a 16-bit cookie which will be > readable by the Landlock programs in its context. Are you envisioning that the filters will return RET_LANDLOCK most of the time or rarely? If it's most of the time, then maybe this could be simplified a bit by unconditionally calling the landlock filter and letting the landlock filter access a struct seccomp_data if needed. > > Only seccomp filters loaded from the same thread and before a Landlock > program can trigger it through LANDLOCK_FLAG_ORIGIN_SECCOMP. Multiple > Landlock programs can be triggered by one or more seccomp filters. This > way, each RET_LANDLOCK (with specific cookie) will trigger all the > allowed Landlock programs once. This interface seems somewhat awkward. Should we not have a way to atomicaly install a whole pile of landlock filters and associated seccomp filter all at once? --Andy From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andy Lutomirski Subject: Re: [RFC v3 11/22] seccomp,landlock: Handle Landlock hooks per process hierarchy Date: Wed, 14 Sep 2016 11:43:54 -0700 Message-ID: References: <20160914072415.26021-1-mic@digikod.net> <20160914072415.26021-12-mic@digikod.net> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Cc: "linux-kernel@vger.kernel.org" , Alexei Starovoitov , Arnd Bergmann , Casey Schaufler , Daniel Borkmann , Daniel Mack , David Drysdale , "David S . Miller" , Elena Reshetova , "Eric W . Biederman" , James Morris , Kees Cook , Paul Moore , Sargun Dhillon , "Serge E . Hallyn" , Tejun Heo , Will Drewry , "kernel-hardening@lists.openwall.com" , Linux API Return-path: In-Reply-To: <20160914072415.26021-12-mic@digikod.net> Sender: linux-kernel-owner@vger.kernel.org List-Id: netdev.vger.kernel.org On Wed, Sep 14, 2016 at 12:24 AM, Micka=C3=ABl Sala=C3=BCn wrote: > A Landlock program will be triggered according to its subtype/origin > bitfield. The LANDLOCK_FLAG_ORIGIN_SECCOMP value will trigger the > Landlock program when a seccomp filter will return RET_LANDLOCK. > Moreover, it is possible to return a 16-bit cookie which will be > readable by the Landlock programs in its context. Are you envisioning that the filters will return RET_LANDLOCK most of the time or rarely? If it's most of the time, then maybe this could be simplified a bit by unconditionally calling the landlock filter and letting the landlock filter access a struct seccomp_data if needed. > > Only seccomp filters loaded from the same thread and before a Landlock > program can trigger it through LANDLOCK_FLAG_ORIGIN_SECCOMP. Multiple > Landlock programs can be triggered by one or more seccomp filters. This > way, each RET_LANDLOCK (with specific cookie) will trigger all the > allowed Landlock programs once. This interface seems somewhat awkward. Should we not have a way to atomicaly install a whole pile of landlock filters and associated seccomp filter all at once? --Andy From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andy Lutomirski Subject: Re: [RFC v3 11/22] seccomp,landlock: Handle Landlock hooks per process hierarchy Date: Wed, 14 Sep 2016 11:43:54 -0700 Message-ID: References: <20160914072415.26021-1-mic@digikod.net> <20160914072415.26021-12-mic@digikod.net> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <20160914072415.26021-12-mic@digikod.net> Sender: linux-kernel-owner@vger.kernel.org To: =?UTF-8?B?TWlja2HDq2wgU2FsYcO8bg==?= Cc: "linux-kernel@vger.kernel.org" , Alexei Starovoitov , Arnd Bergmann , Casey Schaufler , Daniel Borkmann , Daniel Mack , David Drysdale , "David S . Miller" , Elena Reshetova , "Eric W . Biederman" , James Morris , Kees Cook , Paul Moore , Sargun Dhillon , "Serge E . Hallyn" , Tejun Heo , Will Drewry , "kernel-hardening@lists.openwall.com" Linux API List-Id: linux-api@vger.kernel.org On Wed, Sep 14, 2016 at 12:24 AM, Micka=C3=ABl Sala=C3=BCn wrote: > A Landlock program will be triggered according to its subtype/origin > bitfield. The LANDLOCK_FLAG_ORIGIN_SECCOMP value will trigger the > Landlock program when a seccomp filter will return RET_LANDLOCK. > Moreover, it is possible to return a 16-bit cookie which will be > readable by the Landlock programs in its context. Are you envisioning that the filters will return RET_LANDLOCK most of the time or rarely? If it's most of the time, then maybe this could be simplified a bit by unconditionally calling the landlock filter and letting the landlock filter access a struct seccomp_data if needed. > > Only seccomp filters loaded from the same thread and before a Landlock > program can trigger it through LANDLOCK_FLAG_ORIGIN_SECCOMP. Multiple > Landlock programs can be triggered by one or more seccomp filters. This > way, each RET_LANDLOCK (with specific cookie) will trigger all the > allowed Landlock programs once. This interface seems somewhat awkward. Should we not have a way to atomicaly install a whole pile of landlock filters and associated seccomp filter all at once? --Andy From mboxrd@z Thu Jan 1 00:00:00 1970 Reply-To: kernel-hardening@lists.openwall.com MIME-Version: 1.0 In-Reply-To: <20160914072415.26021-12-mic@digikod.net> References: <20160914072415.26021-1-mic@digikod.net> <20160914072415.26021-12-mic@digikod.net> From: Andy Lutomirski Date: Wed, 14 Sep 2016 11:43:54 -0700 Message-ID: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Subject: [kernel-hardening] Re: [RFC v3 11/22] seccomp,landlock: Handle Landlock hooks per process hierarchy To: =?UTF-8?B?TWlja2HDq2wgU2FsYcO8bg==?= Cc: "linux-kernel@vger.kernel.org" , Alexei Starovoitov , Arnd Bergmann , Casey Schaufler , Daniel Borkmann , Daniel Mack , David Drysdale , "David S . Miller" , Elena Reshetova , "Eric W . Biederman" , James Morris , Kees Cook , Paul Moore , Sargun Dhillon , "Serge E . Hallyn" , Tejun Heo , Will Drewry , "kernel-hardening@lists.openwall.com" , Linux API , LSM List , Network Development , "open list:CONTROL GROUP (CGROUP)" , Andrew Morton List-ID: On Wed, Sep 14, 2016 at 12:24 AM, Micka=C3=ABl Sala=C3=BCn wrote: > A Landlock program will be triggered according to its subtype/origin > bitfield. The LANDLOCK_FLAG_ORIGIN_SECCOMP value will trigger the > Landlock program when a seccomp filter will return RET_LANDLOCK. > Moreover, it is possible to return a 16-bit cookie which will be > readable by the Landlock programs in its context. Are you envisioning that the filters will return RET_LANDLOCK most of the time or rarely? If it's most of the time, then maybe this could be simplified a bit by unconditionally calling the landlock filter and letting the landlock filter access a struct seccomp_data if needed. > > Only seccomp filters loaded from the same thread and before a Landlock > program can trigger it through LANDLOCK_FLAG_ORIGIN_SECCOMP. Multiple > Landlock programs can be triggered by one or more seccomp filters. This > way, each RET_LANDLOCK (with specific cookie) will trigger all the > allowed Landlock programs once. This interface seems somewhat awkward. Should we not have a way to atomicaly install a whole pile of landlock filters and associated seccomp filter all at once? --Andy From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andy Lutomirski Subject: Re: [RFC v3 11/22] seccomp,landlock: Handle Landlock hooks per process hierarchy Date: Wed, 14 Sep 2016 11:43:54 -0700 Message-ID: References: <20160914072415.26021-1-mic@digikod.net> <20160914072415.26021-12-mic@digikod.net> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amacapital-net.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=LvPp+meEVBlMtfmya2kmzpv/ptKvK5e7jUD0cTPyTu8=; b=GxHUMly8xTDNXNFv9femKJix/RhY1ai8DoPrLEW13TdJM15LQ+0M/Rl7Fr7Py/6f/d NebpfWBLymeq4OlOY3SnYzqC9+o8gno5Dr7QdJtPozsZ+hIGkscJY1/FhFi5rb7vRIO1 OTh9bbQtce1KFCKHSnkfPy/Vl11xjlinxRVSa2N7RqSokSfICFFj+c4SDk3kn/cb/A+y AzDXT2BWV47rdccSRUgzz6oceYasFGEWoK0M6SNBnal0qGtyFtqQB73SfrqpfnE/IcIF CdYBfjyKsvXfzX/vXsJpsDeJEE4nOBDdhAqeXa/evKho1hYyQH2MqCeHMQd2bnKiDQpx lMUA== In-Reply-To: <20160914072415.26021-12-mic@digikod.net> Sender: linux-kernel-owner@vger.kernel.org List-ID: Content-Type: text/plain; charset="utf-8" To: =?UTF-8?B?TWlja2HDq2wgU2FsYcO8bg==?= Cc: "linux-kernel@vger.kernel.org" , Alexei Starovoitov , Arnd Bergmann , Casey Schaufler , Daniel Borkmann , Daniel Mack , David Drysdale , "David S . Miller" , Elena Reshetova , "Eric W . Biederman" , James Morris , Kees Cook , Paul Moore , Sargun Dhillon , "Serge E . Hallyn" , Tejun Heo , Will Drewry , "kernel-hardening@lists.openwall.com" , Linux API On Wed, Sep 14, 2016 at 12:24 AM, Micka=C3=ABl Sala=C3=BCn wrote: > A Landlock program will be triggered according to its subtype/origin > bitfield. The LANDLOCK_FLAG_ORIGIN_SECCOMP value will trigger the > Landlock program when a seccomp filter will return RET_LANDLOCK. > Moreover, it is possible to return a 16-bit cookie which will be > readable by the Landlock programs in its context. Are you envisioning that the filters will return RET_LANDLOCK most of the time or rarely? If it's most of the time, then maybe this could be simplified a bit by unconditionally calling the landlock filter and letting the landlock filter access a struct seccomp_data if needed. > > Only seccomp filters loaded from the same thread and before a Landlock > program can trigger it through LANDLOCK_FLAG_ORIGIN_SECCOMP. Multiple > Landlock programs can be triggered by one or more seccomp filters. This > way, each RET_LANDLOCK (with specific cookie) will trigger all the > allowed Landlock programs once. This interface seems somewhat awkward. Should we not have a way to atomicaly install a whole pile of landlock filters and associated seccomp filter all at once? --Andy