From: Casey Schaufler <email@example.com> To: KP Singh <firstname.lastname@example.org> Cc: LKML <email@example.com>, Linux Security Module list <firstname.lastname@example.org>, email@example.com, Casey Schaufler <firstname.lastname@example.org> Subject: Re: [PATCH bpf-next v4 3/8] bpf: lsm: provide attachment points for BPF LSM programs Date: Fri, 21 Feb 2020 10:23:50 -0800 Message-ID: <email@example.com> (raw) In-Reply-To: <20200221114458.GA56944@google.com> On 2/21/2020 3:44 AM, KP Singh wrote: > On 20-Feb 15:49, Casey Schaufler wrote: >> On 2/20/2020 9:52 AM, KP Singh wrote: >>> From: KP Singh <firstname.lastname@example.org> >> Sorry about the heavy list pruning - the original set >> blows thunderbird up. >> >>> The BPF LSM programs are implemented as fexit trampolines to avoid the >>> overhead of retpolines. These programs cannot be attached to security_* >>> wrappers as there are quite a few security_* functions that do more than >>> just calling the LSM callbacks. >>> >>> This was discussed on the lists in: >>> >>> https://email@example.com/T/#m068becce588a0cdf01913f368a97aea4c62d8266 >>> >>> Adding a NOP callback after all the static LSM callbacks are called has >>> the following benefits: >>> >>> - The BPF programs run at the right stage of the security_* wrappers. >>> - They run after all the static LSM hooks allowed the operation, >>> therefore cannot allow an action that was already denied. >> I still say that the special call-out to BPF is unnecessary. >> I remain unconvinced by the arguments. You aren't doing anything >> so special that the general mechanism won't work. > The existing mechanism would work functionally, but the cost of an > indirect call for all the hooks, even those that are completely unused > is not really acceptable for KRSI’s use cases. Are you at all familiar with the way LSMs where installed before the current list infrastructure? Every interface had a hook that got called, even if the installed module did not provide one. That was deemed acceptable for a good long time. Way back in the early days of the stacking effort I seriously considered implementing a new security module that would do the stacking, and leave the infrastructure alone. Very much like what you're proposing for BPF modules. It would have worked, but the list model works better. > It’s easy to avoid and > I do think that what we’re doing here (with hooks being defined at > runtime) has significant functional differences from existing LSMs. KRSI isn't all that different from the other modules. The way you specify where system policy is restricted and under which circumstances is different. You're trying to be extremely general, beyond the Mandatory Access Control claims of the existing modules. But really, there's nothing all that special. I know that you don't want to be making a lot of checks on empty BPF program lists. You've come up with clever hacks to avoid doing so. But the cleverer the hack, the more likely it is to haunt someone else later. It probably won't cause KRSI any grief, but you can bet someone will take it in the chin.
next prev parent reply index Thread overview: 41+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-02-20 17:52 [PATCH bpf-next v4 0/8] MAC and Audit policy using eBPF (KRSI) KP Singh 2020-02-20 17:52 ` [PATCH bpf-next v4 1/8] bpf: Introduce BPF_PROG_TYPE_LSM KP Singh 2020-02-20 17:52 ` [PATCH bpf-next v4 2/8] security: Refactor declaration of LSM hooks KP Singh 2020-02-20 17:52 ` [PATCH bpf-next v4 3/8] bpf: lsm: provide attachment points for BPF LSM programs KP Singh 2020-02-21 2:25 ` Alexei Starovoitov 2020-02-21 11:47 ` KP Singh [not found] ` <firstname.lastname@example.org> 2020-02-21 11:44 ` KP Singh 2020-02-21 18:23 ` Casey Schaufler [this message] [not found] ` <202002211946.A23A987@keescook> 2020-02-23 22:08 ` Alexei Starovoitov 2020-02-24 16:32 ` Casey Schaufler 2020-02-24 17:13 ` KP Singh 2020-02-24 18:45 ` Casey Schaufler 2020-02-24 21:41 ` Kees Cook 2020-02-24 22:29 ` Casey Schaufler 2020-02-25 5:41 ` Alexei Starovoitov 2020-02-25 15:31 ` Kees Cook 2020-02-25 19:31 ` KP Singh 2020-02-26 0:30 ` Casey Schaufler 2020-02-26 5:15 ` KP Singh 2020-02-26 15:35 ` Casey Schaufler 2020-02-25 19:29 ` KP Singh 2020-02-20 17:52 ` [PATCH bpf-next v4 4/8] bpf: lsm: Add support for enabling/disabling BPF hooks KP Singh 2020-02-21 18:57 ` Casey Schaufler 2020-02-21 19:11 ` James Morris 2020-02-22 4:26 ` Kees Cook 2020-02-20 17:52 ` [PATCH bpf-next v4 5/8] bpf: lsm: Implement attach, detach and execution KP Singh 2020-02-21 2:17 ` Alexei Starovoitov 2020-02-21 12:02 ` KP Singh 2020-02-20 17:52 ` [PATCH bpf-next v4 6/8] tools/libbpf: Add support for BPF_PROG_TYPE_LSM KP Singh 2020-02-25 6:45 ` Andrii Nakryiko 2020-02-20 17:52 ` [PATCH bpf-next v4 7/8] bpf: lsm: Add selftests " KP Singh 2020-02-20 17:52 ` [PATCH bpf-next v4 8/8] bpf: lsm: Add Documentation KP Singh 2020-02-21 19:19 ` [PATCH bpf-next v4 0/8] MAC and Audit policy using eBPF (KRSI) Casey Schaufler 2020-02-21 19:41 ` KP Singh 2020-02-21 22:31 ` Casey Schaufler 2020-02-21 23:09 ` KP Singh 2020-02-21 23:49 ` Casey Schaufler 2020-02-22 0:22 ` Kees Cook 2020-02-22 1:04 ` Casey Schaufler 2020-02-22 3:36 ` Kees Cook 2020-02-27 18:40 ` Dr. Greg
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
BPF Archive on lore.kernel.org Archives are clonable: git clone --mirror https://lore.kernel.org/bpf/0 bpf/git/0.git # If you have public-inbox 1.1+ installed, you may # initialize and index your mirror using the following commands: public-inbox-init -V2 bpf bpf/ https://lore.kernel.org/bpf \ email@example.com public-inbox-index bpf Example config snippet for mirrors Newsgroup available over NNTP: nntp://nntp.lore.kernel.org/org.kernel.vger.bpf AGPL code for this site: git clone https://public-inbox.org/public-inbox.git