From: Florian Weimer <fweimer@redhat.com>
To: Jann Horn <jannh@google.com>
Cc: Christoph Hellwig <hch@infradead.org>,
Kees Cook <keescook@chromium.org>,
Andy Lutomirski <luto@amacapital.net>,
Will Drewry <wad@chromium.org>, Mark Wielaard <mark@klomp.org>,
Christian Brauner <christian.brauner@ubuntu.com>,
Linux API <linux-api@vger.kernel.org>,
"open list:DOCUMENTATION" <linux-doc@vger.kernel.org>,
kernel list <linux-kernel@vger.kernel.org>,
dev@opencontainers.org, Jonathan Corbet <corbet@lwn.net>,
"Carlos O'Donell" <carlos@redhat.com>
Subject: Re: [PATCH] syscalls: Document OCI seccomp filter interactions & workaround
Date: Tue, 24 Nov 2020 19:02:53 +0100 [thread overview]
Message-ID: <87pn42zl82.fsf@oldenburg2.str.redhat.com> (raw)
In-Reply-To: <CAG48ez2ZHPavVU3_2VnRADFQstOM1s+3GwfWsRaEjAA1jYcHDg@mail.gmail.com> (Jann Horn's message of "Tue, 24 Nov 2020 18:06:38 +0100")
* Jann Horn:
> +seccomp maintainers/reviewers
> [thread context is at
> https://lore.kernel.org/linux-api/87lfer2c0b.fsf@oldenburg2.str.redhat.com/
> ]
>
> On Tue, Nov 24, 2020 at 5:49 PM Christoph Hellwig <hch@infradead.org> wrote:
>> On Tue, Nov 24, 2020 at 03:08:05PM +0100, Mark Wielaard wrote:
>> > For valgrind the issue is statx which we try to use before falling back
>> > to stat64, fstatat or stat (depending on architecture, not all define
>> > all of these). The problem with these fallbacks is that under some
>> > containers (libseccomp versions) they might return EPERM instead of
>> > ENOSYS. This causes really obscure errors that are really hard to
>> > diagnose.
>>
>> So find a way to detect these completely broken container run times
>> and refuse to run under them at all. After all they've decided to
>> deliberately break the syscall ABI. (and yes, we gave the the rope
>> to do that with seccomp :().
>
> FWIW, if the consensus is that seccomp filters that return -EPERM by
> default are categorically wrong, I think it should be fairly easy to
> add a check to the seccomp core that detects whether the installed
> filter returns EPERM for some fixed unused syscall number and, if so,
> prints a warning to dmesg or something along those lines...
But that's playing Core Wars, right? Someone will write a seccomp
filter trying to game that kernel check. I don't really think it solves
anything until there is consensus what a system call filter should do
with system calls not on the permitted list.
Thanks,
Florian
--
Red Hat GmbH, https://de.redhat.com/ , Registered seat: Grasbrunn,
Commercial register: Amtsgericht Muenchen, HRB 153243,
Managing Directors: Charles Cachera, Brian Klemm, Laurie Krebs, Michael O'Neill
next prev parent reply other threads:[~2020-11-24 18:03 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-11-24 12:08 [PATCH] syscalls: Document OCI seccomp filter interactions & workaround Florian Weimer
2020-11-24 12:26 ` Christian Brauner
2020-11-24 12:54 ` Florian Weimer
2020-11-24 14:08 ` Mark Wielaard
2020-11-24 16:45 ` Christoph Hellwig
2020-11-24 17:06 ` Jann Horn
2020-11-24 17:15 ` Greg KH
2020-11-24 17:21 ` Christian Brauner
2020-11-24 17:30 ` Jann Horn
2020-11-24 17:44 ` Greg KH
2020-11-24 17:47 ` Jann Horn
2020-11-24 18:17 ` Florian Weimer
2020-11-24 18:02 ` Florian Weimer [this message]
2020-11-24 18:09 ` Florian Weimer
2020-11-24 12:58 ` Aleksa Sarai
2020-11-24 13:05 ` Florian Weimer
2020-11-24 13:37 ` Christoph Hellwig
2020-11-24 14:08 ` Florian Weimer
2020-11-24 16:46 ` Christoph Hellwig
2020-11-24 16:52 ` Florian Weimer
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87pn42zl82.fsf@oldenburg2.str.redhat.com \
--to=fweimer@redhat.com \
--cc=carlos@redhat.com \
--cc=christian.brauner@ubuntu.com \
--cc=corbet@lwn.net \
--cc=dev@opencontainers.org \
--cc=hch@infradead.org \
--cc=jannh@google.com \
--cc=keescook@chromium.org \
--cc=linux-api@vger.kernel.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@amacapital.net \
--cc=mark@klomp.org \
--cc=wad@chromium.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).