From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754929AbcH0SMD (ORCPT ); Sat, 27 Aug 2016 14:12:03 -0400 Received: from mail-pf0-f193.google.com ([209.85.192.193]:36033 "EHLO mail-pf0-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754628AbcH0SMB (ORCPT ); Sat, 27 Aug 2016 14:12:01 -0400 Date: Sat, 27 Aug 2016 11:11:55 -0700 From: Alexei Starovoitov To: Andy Lutomirski Cc: "kernel-hardening@lists.openwall.com" , Alexei Starovoitov , Tejun Heo , Sargun Dhillon , Network Development , Linux API , Kees Cook , LSM List , "linux-kernel@vger.kernel.org" , "open list:CONTROL GROUP (CGROUP)" , "David S . Miller" , =?iso-8859-1?Q?Micka=EBl_Sala=FCn?= , Daniel Mack , Daniel Borkmann Subject: Re: [RFC v2 09/10] landlock: Handle cgroups Message-ID: <20160827181153.GB38754@ast-mbp.thefacebook.com> References: <1472121165-29071-1-git-send-email-mic@digikod.net> <1472121165-29071-10-git-send-email-mic@digikod.net> <20160826021432.GA8291@ast-mbp.thefacebook.com> <57C05BF0.8000706@digikod.net> <20160826230539.GA26683@ast-mbp.thefacebook.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.24 (2015-08-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sat, Aug 27, 2016 at 12:30:36AM -0700, Andy Lutomirski wrote: > > cgroup is the common way to group multiple tasks. > > Without cgroup only parent<->child relationship will be possible, > > which will limit usability of such lsm to a master task that controls > > its children. Such api restriction would have been ok, if we could > > extend it in the future, but unfortunately task-centric won't allow it > > without creating a parallel lsm that is cgroup based. > > Therefore I think we have to go with cgroup-centric api and your > > application has to use cgroups from the start though only parent-child > > would have been enough. > > Also I don't think the kernel can afford two bpf based lsm. One task > > based and another cgroup based, so we have to find common ground > > that suits both use cases. > > Having unprivliged access is a subset. There is no strong reason why > > cgroup+lsm+bpf should be limited to root only always. > > When we can guarantee no pointer leaks, we can allow unpriv. > > I don't really understand what you mean. In the context of landlock, > which is a *sandbox*, can one of you explain a use case that > materially benefits from this type of cgroup usage? I haven't thought > of one. In case of seccomp-like sandbox where parent controls child processes cgroup is not needed. It's needed when container management software needs to control a set of applications. If we can have one bpf-based lsm that works via cgroup and without, I'd be fine with it. Right now I haven't seen a plausible proposal to do that. Therefore cgroup based api is a common api that works for sandbox as well, though requiring parent to create a cgroup just to control a single child is cumbersome.