From: jmorris@namei.org (James Morris)
To: linux-security-module@vger.kernel.org
Subject: [PATCH v5 5/5] sidechannel: Linux Security Module for sidechannel
Date: Sat, 29 Sep 2018 02:33:20 +1000 (AEST) [thread overview]
Message-ID: <alpine.LRH.2.21.1809290233130.15725@namei.org> (raw)
In-Reply-To: <CAG48ez3Jnao-5z3O8s=RdoAx8=b68C_1pfKNKJSm+6R_HyU_fg@mail.gmail.com>
On Fri, 28 Sep 2018, Jann Horn wrote:
> > so with this hard-coded logic, you are saying this case is
> > 'safe' in a sidechannel context.
> >
> > Which hints at the deeper issue that containers are a userland
> > abstraction. Protection of containers needs to be defined by userland
> > policy.
>
> Or just compare mount namespaces additionally/instead. I think that
> containers will always use those, because AFAIK nobody uses chroot()
> for containers, given that the kernel makes absolutely no security
> guarantees about chroot().
We can't define this in the kernel. It has no concept of containers.
People utilize some combination of namespaces and cgroups and call them
containers, but we can't make assumptions from the kernel on what any of
this means from a security point of view, and hard-code kernel policy
based on those assumptions.
This is violating the principal of separating mechanism and policy, and
also imposing semantics across the kernel/user boundary. The latter
creates an ABI which we can then never break.
--
James Morris
<jmorris@namei.org>
next prev parent reply other threads:[~2018-09-28 16:33 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-09-26 20:34 [PATCH v5 0/5] LSM: Support ptrace sidechannel access checks Casey Schaufler
2018-09-26 20:34 ` [PATCH v5 1/5] AppArmor: Prepare for PTRACE_MODE_SCHED Casey Schaufler
2018-09-26 21:16 ` Jann Horn
2018-09-26 21:18 ` Jann Horn
2018-09-26 22:47 ` Schaufler, Casey
2018-09-26 20:34 ` [PATCH v5 2/5] Smack: " Casey Schaufler
2018-09-26 21:30 ` Jann Horn
2018-09-26 22:53 ` Schaufler, Casey
2018-09-26 22:58 ` Jann Horn
2018-10-04 7:47 ` Jiri Kosina
2018-10-04 11:36 ` Jann Horn
2018-10-16 11:44 ` Jiri Kosina
2018-09-26 20:34 ` [PATCH v5 3/5] SELinux: " Casey Schaufler
2018-09-27 15:50 ` Stephen Smalley
2018-09-27 16:23 ` Schaufler, Casey
2018-09-26 20:34 ` [PATCH v5 4/5] Capability: Complete PTRACE_MODE_SCHED Casey Schaufler
2018-09-26 21:26 ` Jann Horn
2018-09-26 22:24 ` Schaufler, Casey
2018-09-26 20:34 ` [PATCH v5 5/5] sidechannel: Linux Security Module for sidechannel Casey Schaufler
2018-09-27 21:45 ` James Morris
2018-09-27 22:39 ` Casey Schaufler
2018-09-27 22:47 ` James Morris
2018-09-27 23:19 ` Schaufler, Casey
2018-09-27 23:43 ` James Morris
2018-09-27 23:47 ` Jann Horn
2018-09-28 16:33 ` James Morris [this message]
2018-09-28 17:40 ` Schaufler, Casey
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=alpine.LRH.2.21.1809290233130.15725@namei.org \
--to=jmorris@namei.org \
--cc=linux-security-module@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).