Linux-Security-Module Archive on lore.kernel.org
 help / color / Atom feed
From: Alexei Starovoitov <alexei.starovoitov@gmail.com>
To: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Cc: Linus Torvalds <torvalds@linux-foundation.org>,
	David Miller <davem@davemloft.net>,
	Greg Kroah-Hartman <greg@kroah.com>,
	"Eric W. Biederman" <ebiederm@xmission.com>,
	Kees Cook <keescook@chromium.org>,
	Andrew Morton <akpm@linux-foundation.org>,
	Alexei Starovoitov <ast@kernel.org>,
	Al Viro <viro@zeniv.linux.org.uk>, bpf <bpf@vger.kernel.org>,
	linux-fsdevel <linux-fsdevel@vger.kernel.org>,
	Daniel Borkmann <daniel@iogearbox.net>,
	Jakub Kicinski <kuba@kernel.org>,
	Masahiro Yamada <yamada.masahiro@socionext.com>,
	Gary Lin <GLin@suse.com>, Bruno Meneguele <bmeneg@redhat.com>,
	LSM List <linux-security-module@vger.kernel.org>,
	Casey Schaufler <casey@schaufler-ca.com>
Subject: Re: [RFC][PATCH] net/bpfilter: Remove this broken and apparently unmantained
Date: Thu, 25 Jun 2020 22:41:37 -0700
Message-ID: <20200626054137.m44jpsvlapuyslzw@ast-mbp.dhcp.thefacebook.com> (raw)
In-Reply-To: <eb3bec08-9de4-c708-fb8e-b6a47145eb5e@i-love.sakura.ne.jp>

On Fri, Jun 26, 2020 at 01:58:35PM +0900, Tetsuo Handa wrote:
> On 2020/06/26 10:51, Alexei Starovoitov wrote:
> > On Thu, Jun 25, 2020 at 06:36:34PM -0700, Linus Torvalds wrote:
> >> On Thu, Jun 25, 2020 at 12:34 PM David Miller <davem@davemloft.net> wrote:
> >>>
> >>> It's kernel code executing in userspace.  If you don't trust the
> >>> signed code you don't trust the signed code.
> >>>
> >>> Nothing is magic about a piece of code executing in userspace.
> >>
> >> Well, there's one real issue: the most likely thing that code is going
> >> to do is execute llvm to generate more code.
> 
> Wow! Are we going to allow execution of such complicated programs?

No. llvm was _never_ intended to be run from the blob.
bpfilter was envisioned as self contained binary. If it needed to do
optimizations on generated bpf code it would have to do them internally.

> I was hoping that fork_usermode_blob() accepts only simple program
> like the content of "hello64" generated by

pretty much. statically compiled elf that is self contained.

> For example, a usermode process started by fork_usermode_blob() which was initially
> containing
> 
> ----------
> while (read(0, &uid, sizeof(uid)) == sizeof(uid)) {
>     if (uid == 0)
>         write(1, "OK\n", 3);
>     else
>         write(1, "NG\n", 3);
> }
> ----------
> 
> can be somehow tampered like
> 
> ----------
> while (read(0, &uid, sizeof(uid)) == sizeof(uid)) {
>     if (uid != 0)
>         write(1, "OK\n", 3);
>     else
>         write(1, "NG\n", 3);
> }
> ----------
> 
> due to interference from the rest of the system, how can we say "we trust kernel
> code executing in userspace" ?

I answered this already in the previous email.
Use security_ptrace_access_check() LSM hook to make sure that no other process
can tamper with blob's memory when it's running as user process.
In the future it would be trivial to add a new ptrace flag to
make sure that blob's memory is not ptraceable from the start.

> My question is: how is the byte array (which was copied from kernel space) kept secure/intact
> under "root can poke into kernel or any process memory." environment? It is obvious that
> we can't say "we trust kernel code executing in userspace" without some mechanism.

Already answered.

> Currently fork_usermode_blob() is not providing security context for the byte array to be
> executed. We could modify fork_usermode_blob() to provide security context for LSMs, but
> I'll be more happy if we can implement that mechanism without counting on in-tree LSMs, for
> SELinux is too complicated to support.

I'm pretty sure it was answered in the upthread by selinux folks.
Quick recap: we can add security labels, sha, strings, you_name_it to the blob that
lsm hooks can track.
We can also add another LSM hook to fork_usermode_blob(), so if tomoyo is so worried
about blobs it would be able to reject all of them without too much work.

> 
> > I think that's Tetsuo's point about lack of LSM hooks is kernel_sock_shutdown().
> > Obviously, kernel_sock_shutdown() can be called by kernel only.
> 
> I can't catch what you mean. The kernel code executing in userspace uses syscall
> interface (e.g. SYSCALL_DEFINE2(shutdown, int, fd, int, how) path), doesn't it?

yes.

> > I suspect he's imaging a hypothetical situation where kernel bits of kernel module
> > interact with userblob bits of kernel module.
> > Then another root process tampers with memory of userblob.
> 
> Yes, how to protect the memory of userblob is a concern. The memory of userblob can
> interfere (or can be interfered by) the rest of the system is a problem.

answered.

> > I think this is trivially enforceable without creating new features.
> > Existing security_ptrace_access_check() LSM hook can prevent tampering with
> > memory of userblob.
> 
> There is security_ptrace_access_check() LSM hook, but no zero-configuration
> method is available.

huh?
tomoyo is not using that hook, but selinux and many other LSMs do.
please learn from others.

> > security label can carry that execution context.
> 
> If files get a chance to be associated with appropriate pathname and
> security label.

I can easily add a fake pathname to the blob, but it won't help tomoyo.
That's what I was saying all along.
pathname based security provides false sense of security.

I'm pretty sure this old blog has been read by many folks who
are following this thread, but it's worth reminding again:
https://securityblog.org/2006/04/19/security-anti-pattern-path-based-access-control/
I cannot agree more with Joshua.
Here is a quote:
"The most obvious problem with this is that not all objects are files and thus do not have paths."

> >> My personally strongest argument for remoiving this kernel code is
> >> that it's been there for a couple of years now, and it has never
> >> actually done anything useful, and there's no actual sign that it ever
> >> will, or that there is a solid plan in place for it.
> > 
> > you probably missed the detailed plan:
> > https://lore.kernel.org/bpf/20200609235631.ukpm3xngbehfqthz@ast-mbp.dhcp.thefacebook.com/
> > 
> > The project #3 is the above is the one we're working on right now.
> > It should be ready to post in a week.
> 
> I got a question on project #3. Given that "cat /sys/fs/bpf/my_ipv6_route"
> produces the same human output as "cat /proc/net/ipv6_route", how security
> checks which are done for "cat /proc/net/ipv6_route" can be enforced for
> "cat /sys/fs/bpf/my_ipv6_route" ? Unless same security checks (e.g. permission
> to read /proc/net/ipv6_route ) is enforced, such bpf usage sounds like a method
> for bypassing existing security mechanisms.

Standard file permissions. Nothing to do with bpf.

  reply index

Thread overview: 138+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <87d066vd4y.fsf@x220.int.ebiederm.org>
     [not found] ` <20200611233134.5vofl53dj5wpwp5j@ast-mbp.dhcp.thefacebook.com>
     [not found]   ` <87bllngirv.fsf@x220.int.ebiederm.org>
     [not found]     ` <CAADnVQ+qNxFjTYBpYW9ZhStMh_oJBS5C_FsxSS=0Mzy=u54MSg@mail.gmail.com>
     [not found]       ` <CAADnVQLuGYX=LamARhrZcze1ej4ELj-y99fLzOCgz60XLPw_cQ@mail.gmail.com>
     [not found]         ` <87ftaxd7ky.fsf@x220.int.ebiederm.org>
     [not found]           ` <20200616015552.isi6j5x732okiky4@ast-mbp.dhcp.thefacebook.com>
     [not found]             ` <87h7v1pskt.fsf@x220.int.ebiederm.org>
     [not found]               ` <20200623183520.5e7fmlt3omwa2lof@ast-mbp.dhcp.thefacebook.com>
     [not found]                 ` <87h7v1mx4z.fsf@x220.int.ebiederm.org>
     [not found]                   ` <20200623194023.lzl34qt2wndhcehk@ast-mbp.dhcp.thefacebook.com>
     [not found]                     ` <b4a805e7-e009-dfdf-d011-be636ce5c4f5@i-love.sakura.ne.jp>
     [not found]                       ` <20200624040054.x5xzkuhiw67cywzl@ast-mbp.dhcp.thefacebook.com>
     [not found]                         ` <5254444e-465e-6dee-287b-bef58526b724@i-love.sakura.ne.jp>
     [not found]                           ` <20200624063940.ctzhf4nnh3cjyxqi@ast-mbp.dhcp.thefacebook.com>
2020-06-24  7:05                             ` Tetsuo Handa
2020-06-24 15:41                               ` Casey Schaufler
2020-06-24 17:54                                 ` Alexei Starovoitov
2020-06-24 19:48                                   ` Casey Schaufler
     [not found]                     ` <878sgck6g0.fsf@x220.int.ebiederm.org>
     [not found]                       ` <CAADnVQL8WrfV74v1ChvCKE=pQ_zo+A5EtEBB3CbD=P5ote8_MA@mail.gmail.com>
2020-06-24 23:14                         ` Tetsuo Handa
2020-06-25  1:35                           ` Alexei Starovoitov
2020-06-25  6:38                             ` Tetsuo Handa
2020-06-25  9:57                               ` Greg KH
2020-06-25 11:03                                 ` Tetsuo Handa
2020-06-25 12:07                                   ` Greg KH
2020-06-25 14:21                                     ` Tetsuo Handa
2020-06-25 19:34                                     ` David Miller
2020-06-26  1:36                                       ` Linus Torvalds
2020-06-26  1:51                                         ` Alexei Starovoitov
2020-06-26  4:58                                           ` Tetsuo Handa
2020-06-26  5:41                                             ` Alexei Starovoitov [this message]
2020-06-26  6:20                                               ` Tetsuo Handa
2020-06-26  6:39                                                 ` Alexei Starovoitov
2020-06-26 12:51                                         ` [PATCH 00/14] Make the user mode driver code a better citizen Eric W. Biederman
2020-06-26 12:53                                           ` [PATCH 01/14] umh: Capture the pid in umh_pipe_setup Eric W. Biederman
2020-06-26 12:53                                           ` [PATCH 02/14] umh: Move setting PF_UMH into umh_pipe_setup Eric W. Biederman
2020-06-26 12:54                                           ` [PATCH 03/14] umh: Rename the user mode driver helpers for clarity Eric W. Biederman
2020-06-26 12:54                                           ` [PATCH 04/14] umh: Remove call_usermodehelper_setup_file Eric W. Biederman
2020-06-26 12:55                                           ` [PATCH 05/14] umh: Separate the user mode driver and the user mode helper support Eric W. Biederman
2020-06-26 16:22                                             ` Tetsuo Handa
2020-06-26 16:45                                               ` Eric W. Biederman
2020-06-27  1:26                                                 ` Tetsuo Handa
2020-06-27  4:21                                                   ` Eric W. Biederman
2020-06-27  4:36                                                     ` Tetsuo Handa
2020-06-26 12:55                                           ` [PATCH 06/14] umd: For clarity rename umh_info umd_info Eric W. Biederman
2020-06-26 15:37                                             ` Kees Cook
2020-06-26 16:31                                               ` Eric W. Biederman
2020-06-26 12:56                                           ` [PATCH 07/14] umd: Rename umd_info.cmdline umd_info.driver_name Eric W. Biederman
2020-06-26 12:56                                           ` [PATCH 08/14] umd: Transform fork_usermode_blob into fork_usermode_driver Eric W. Biederman
2020-06-26 12:57                                           ` [PATCH 09/14] umh: Stop calling do_execve_file Eric W. Biederman
2020-06-26 12:57                                           ` [PATCH 10/14] exec: Remove do_execve_file Eric W. Biederman
2020-06-26 12:58                                           ` [PATCH 11/14] bpfilter: Move bpfilter_umh back into init data Eric W. Biederman
2020-06-26 12:58                                           ` [PATCH 12/14] umd: Track user space drivers with struct pid Eric W. Biederman
2020-06-26 12:59                                           ` [PATCH 13/14] bpfilter: Take advantage of the facilities of " Eric W. Biederman
2020-06-26 12:59                                           ` [PATCH 14/14] umd: Remove exit_umh Eric W. Biederman
2020-06-26 13:48                                           ` [PATCH 00/14] Make the user mode driver code a better citizen Eric W. Biederman
2020-06-29 19:55                                             ` [PATCH v2 00/15] " Eric W. Biederman
2020-06-29 19:56                                               ` [PATCH v2 01/15] umh: Capture the pid in umh_pipe_setup Eric W. Biederman
2020-06-29 19:57                                               ` [PATCH v2 02/15] umh: Move setting PF_UMH into umh_pipe_setup Eric W. Biederman
2020-06-29 19:57                                               ` [PATCH v2 03/15] umh: Rename the user mode driver helpers for clarity Eric W. Biederman
2020-06-29 19:59                                               ` [PATCH v2 04/15] umh: Remove call_usermodehelper_setup_file Eric W. Biederman
2020-06-29 20:00                                               ` [PATCH v2 05/15] umh: Separate the user mode driver and the user mode helper support Eric W. Biederman
2020-06-30 16:58                                                 ` Linus Torvalds
2020-07-01 17:18                                                   ` Eric W. Biederman
2020-07-01 17:42                                                     ` Alexei Starovoitov
2020-06-29 20:01                                               ` [PATCH v2 06/15] umd: For clarity rename umh_info umd_info Eric W. Biederman
2020-06-29 20:02                                               ` [PATCH v2 07/15] umd: Rename umd_info.cmdline umd_info.driver_name Eric W. Biederman
2020-06-29 20:03                                               ` [PATCH v2 08/15] umd: Transform fork_usermode_blob into fork_usermode_driver Eric W. Biederman
2020-06-29 20:03                                               ` [PATCH v2 09/15] umh: Stop calling do_execve_file Eric W. Biederman
2020-06-29 20:04                                               ` [PATCH v2 10/15] exec: Remove do_execve_file Eric W. Biederman
2020-06-30  5:43                                                 ` Christoph Hellwig
2020-06-30 12:14                                                   ` Eric W. Biederman
2020-06-30 13:38                                                     ` Christoph Hellwig
2020-06-30 14:28                                                       ` Eric W. Biederman
2020-06-30 16:55                                                         ` Alexei Starovoitov
2020-06-29 20:05                                               ` [PATCH v2 11/15] bpfilter: Move bpfilter_umh back into init data Eric W. Biederman
2020-06-29 20:06                                               ` [PATCH v2 12/15] umd: Track user space drivers with struct pid Eric W. Biederman
2020-06-29 20:06                                               ` [PATCH v2 13/15] bpfilter: Take advantage of the facilities of " Eric W. Biederman
2020-06-29 20:07                                               ` [PATCH v2 14/15] umd: Remove exit_umh Eric W. Biederman
2020-06-29 20:08                                               ` [PATCH v2 15/15] umd: Stop using split_argv Eric W. Biederman
2020-06-29 22:12                                               ` [PATCH v2 00/15] Make the user mode driver code a better citizen Alexei Starovoitov
2020-06-30  1:13                                                 ` Eric W. Biederman
2020-06-30  6:16                                                   ` Tetsuo Handa
2020-06-30 12:29                                                 ` Eric W. Biederman
2020-06-30 13:21                                                   ` Tetsuo Handa
2020-07-02 13:08                                                     ` Eric W. Biederman
2020-07-02 13:40                                                       ` Tetsuo Handa
2020-07-02 16:02                                                         ` Eric W. Biederman
2020-07-03 13:19                                                           ` Tetsuo Handa
2020-07-03 22:25                                                             ` Eric W. Biederman
2020-07-04  6:57                                                               ` Tetsuo Handa
2020-07-08  4:46                                                                 ` Eric W. Biederman
2020-06-30 16:52                                                   ` Alexei Starovoitov
2020-07-01 17:12                                                     ` Eric W. Biederman
2020-07-02 16:40                                               ` [PATCH v3 00/16] " Eric W. Biederman
2020-07-02 16:41                                                 ` [PATCH v3 01/16] umh: Capture the pid in umh_pipe_setup Eric W. Biederman
2020-07-02 16:41                                                 ` [PATCH v3 02/16] umh: Move setting PF_UMH into umh_pipe_setup Eric W. Biederman
2020-07-02 16:41                                                 ` [PATCH v3 03/16] umh: Rename the user mode driver helpers for clarity Eric W. Biederman
2020-07-02 16:41                                                 ` [PATCH v3 04/16] umh: Remove call_usermodehelper_setup_file Eric W. Biederman
2020-07-02 16:41                                                 ` [PATCH v3 05/16] umh: Separate the user mode driver and the user mode helper support Eric W. Biederman
2020-07-02 16:41                                                 ` [PATCH v3 06/16] umd: For clarity rename umh_info umd_info Eric W. Biederman
2020-07-02 16:41                                                 ` [PATCH v3 07/16] umd: Rename umd_info.cmdline umd_info.driver_name Eric W. Biederman
2020-07-02 16:41                                                 ` [PATCH v3 08/16] umd: Transform fork_usermode_blob into fork_usermode_driver Eric W. Biederman
2020-07-02 16:41                                                 ` [PATCH v3 09/16] umh: Stop calling do_execve_file Eric W. Biederman
2020-07-02 16:41                                                 ` [PATCH v3 10/16] exec: Remove do_execve_file Eric W. Biederman
2020-07-08  6:35                                                   ` Luis Chamberlain
2020-07-08 12:41                                                     ` Luis Chamberlain
2020-07-08 13:08                                                       ` Eric W. Biederman
2020-07-08 13:32                                                         ` Luis Chamberlain
2020-07-12 21:02                                                   ` Pavel Machek
2020-07-02 16:41                                                 ` [PATCH v3 11/16] bpfilter: Move bpfilter_umh back into init data Eric W. Biederman
2020-07-02 16:41                                                 ` [PATCH v3 12/16] umd: Track user space drivers with struct pid Eric W. Biederman
2020-07-02 16:41                                                 ` [PATCH v3 13/16] exit: Factor thread_group_exited out of pidfd_poll Eric W. Biederman
2020-07-03 20:30                                                   ` Alexei Starovoitov
2020-07-03 21:37                                                     ` Eric W. Biederman
2020-07-04  0:03                                                       ` Alexei Starovoitov
2020-07-04 15:50                                                       ` Christian Brauner
2020-07-07 17:09                                                         ` Eric W. Biederman
2020-07-08  0:05                                                           ` Daniel Borkmann
2020-07-08  3:50                                                             ` Eric W. Biederman
2020-07-04 16:00                                                   ` Christian Brauner
2020-07-02 16:41                                                 ` [PATCH v3 14/16] bpfilter: Take advantage of the facilities of struct pid Eric W. Biederman
2020-07-02 16:41                                                 ` [PATCH v3 15/16] umd: Remove exit_umh Eric W. Biederman
2020-07-02 16:41                                                 ` [PATCH v3 16/16] umd: Stop using split_argv Eric W. Biederman
2020-07-02 23:51                                                 ` [PATCH v3 00/16] Make the user mode driver code a better citizen Tetsuo Handa
2020-07-09 22:05                                                 ` [merged][PATCH " Eric W. Biederman
2020-07-14 19:42                                                   ` Alexei Starovoitov
2020-07-08  5:20                                               ` [PATCH v2 00/15] " Luis Chamberlain
2020-06-26 14:10                                           ` [PATCH 00/14] " Greg Kroah-Hartman
2020-06-26 16:40                                           ` Alexei Starovoitov
2020-06-26 17:17                                             ` Eric W. Biederman
2020-06-26 18:22                                               ` Alexei Starovoitov
2020-06-27 11:38                                           ` Tetsuo Handa
2020-06-27 12:59                                             ` Eric W. Biederman
2020-06-27 13:57                                               ` Tetsuo Handa
2020-06-28 19:44                                                 ` Alexei Starovoitov
2020-06-29  2:20                                                   ` Tetsuo Handa
2020-06-29 20:19                                                     ` Eric W. Biederman
2020-06-30  6:28                                                       ` Tetsuo Handa
2020-06-30 12:32                                                         ` Eric W. Biederman
2020-06-30 16:48                                                         ` Alexei Starovoitov
2020-06-30 21:54                                                           ` Tetsuo Handa
2020-06-30 21:57                                                             ` Alexei Starovoitov
2020-06-30 22:58                                                               ` Tetsuo Handa
2020-06-25 12:56                           ` [RFC][PATCH] net/bpfilter: Remove this broken and apparently unmantained Stephen Smalley
2020-06-25 13:25                             ` Greg Kroah-Hartman
2020-06-25 14:26                               ` Stephen Smalley
2020-06-25 14:36                                 ` Stephen Smalley
2020-06-25 15:21                                 ` Tetsuo Handa
2020-06-25 16:03                                   ` Stephen Smalley
2020-06-25 16:06                                   ` Casey Schaufler
     [not found] <20200607014935.vhd3scr4qmawq7no@ast-mbp>
     [not found] ` <33cf7a57-0afa-9bb9-f831-61cca6c19eba@i-love.sakura.ne.jp>
     [not found]   ` <20200608162306.iu35p4xoa2kcp3bu@ast-mbp.dhcp.thefacebook.com>
     [not found]     ` <af00d341-6046-e187-f5c8-5f57b40f017c@i-love.sakura.ne.jp>
     [not found]       ` <20200609012826.dssh2lbfr6tlhwwa@ast-mbp.dhcp.thefacebook.com>
     [not found]         ` <ddabab93-4660-3a46-8b05-89385e292b75@i-love.sakura.ne.jp>
     [not found]           ` <20200609223214.43db3orsyjczb2dd@ast-mbp.dhcp.thefacebook.com>
     [not found]             ` <6a8b284f-461e-11b5-9985-6dc70012f774@i-love.sakura.ne.jp>
     [not found]               ` <20200610000546.4hh4n53vaxc4hypi@ast-mbp.dhcp.thefacebook.com>
     [not found]                 ` <1be571d2-c517-d7a7-788e-3bcc07afa858@i-love.sakura.ne.jp>
     [not found]                   ` <20200610033256.xkv5a7l6vtb2jiox@ast-mbp.dhcp.thefacebook.com>
2020-06-10  7:30                     ` Tetsuo Handa
2020-06-10 16:24                       ` Casey Schaufler

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200626054137.m44jpsvlapuyslzw@ast-mbp.dhcp.thefacebook.com \
    --to=alexei.starovoitov@gmail.com \
    --cc=GLin@suse.com \
    --cc=akpm@linux-foundation.org \
    --cc=ast@kernel.org \
    --cc=bmeneg@redhat.com \
    --cc=bpf@vger.kernel.org \
    --cc=casey@schaufler-ca.com \
    --cc=daniel@iogearbox.net \
    --cc=davem@davemloft.net \
    --cc=ebiederm@xmission.com \
    --cc=greg@kroah.com \
    --cc=keescook@chromium.org \
    --cc=kuba@kernel.org \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=penguin-kernel@i-love.sakura.ne.jp \
    --cc=torvalds@linux-foundation.org \
    --cc=viro@zeniv.linux.org.uk \
    --cc=yamada.masahiro@socionext.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-Security-Module Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-security-module/0 linux-security-module/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-security-module linux-security-module/ https://lore.kernel.org/linux-security-module \
		linux-security-module@vger.kernel.org
	public-inbox-index linux-security-module

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-security-module


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git