From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758423AbcHYOr4 (ORCPT ); Thu, 25 Aug 2016 10:47:56 -0400 Received: from smtp-sh.infomaniak.ch ([128.65.195.4]:47526 "EHLO smtp-sh.infomaniak.ch" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752629AbcHYOrv (ORCPT ); Thu, 25 Aug 2016 10:47:51 -0400 Subject: Re: [RFC v2 09/10] landlock: Handle cgroups To: Andy Lutomirski References: <1472121165-29071-1-git-send-email-mic@digikod.net> <1472121165-29071-10-git-send-email-mic@digikod.net> Cc: LKML , Alexei Starovoitov , Arnd Bergmann , Casey Schaufler , Daniel Borkmann , Daniel Mack , David Drysdale , "David S . Miller" , Elena Reshetova , James Morris , Kees Cook , Paul Moore , Sargun Dhillon , "Serge E . Hallyn" , Will Drewry , Kernel Hardening , Linux API , LSM List , Network Development , cgroups@vger.kernel.org From: =?UTF-8?Q?Micka=c3=abl_Sala=c3=bcn?= Message-ID: <57BF043D.4000300@digikod.net> Date: Thu, 25 Aug 2016 16:44:13 +0200 User-Agent: MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="fem93Duixaa7Puv1lVjAwOLiiCPLhog68" X-Antivirus: Dr.Web (R) for Unix mail servers drweb plugin ver.6.0.2.8 X-Antivirus-Code: 0x100000 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --fem93Duixaa7Puv1lVjAwOLiiCPLhog68 Content-Type: multipart/mixed; boundary="k0jrAKmG3iFl0mLHQhvH5VcJm2i7BKQmS" From: =?UTF-8?Q?Micka=c3=abl_Sala=c3=bcn?= To: Andy Lutomirski Cc: LKML , Alexei Starovoitov , Arnd Bergmann , Casey Schaufler , Daniel Borkmann , Daniel Mack , David Drysdale , "David S . Miller" , Elena Reshetova , James Morris , Kees Cook , Paul Moore , Sargun Dhillon , "Serge E . Hallyn" , Will Drewry , Kernel Hardening , Linux API , LSM List , Network Development , cgroups@vger.kernel.org Message-ID: <57BF043D.4000300@digikod.net> Subject: Re: [RFC v2 09/10] landlock: Handle cgroups References: <1472121165-29071-1-git-send-email-mic@digikod.net> <1472121165-29071-10-git-send-email-mic@digikod.net> In-Reply-To: --k0jrAKmG3iFl0mLHQhvH5VcJm2i7BKQmS Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 25/08/2016 13:09, Andy Lutomirski wrote: > On Thu, Aug 25, 2016 at 3:32 AM, Micka=C3=ABl Sala=C3=BCn wrote: >> Add an eBPF function bpf_landlock_cmp_cgroup_beneath(opt, map, map_op)= >> to compare the current process cgroup with a cgroup handle, The handle= >> can match the current cgroup if it is the same or a child. This allows= >> to make conditional rules according to the current cgroup. >> >> A cgroup handle is a map entry created from a file descriptor referrin= g >> a cgroup directory (e.g. by opening /sys/fs/cgroup/X). In this case, t= he >> map entry is of type BPF_MAP_HANDLE_TYPE_LANDLOCK_CGROUP_FD and the >> inferred array map is of type BPF_MAP_ARRAY_TYPE_LANDLOCK_CGROUP. >=20 > Can you elaborate on why this is useful? I.e. why not just supply > different policies to different subtrees. The main use case I see is to load the security policies at the start of a user session for all processes but not enforce them right away. The user can then keep a shell for Landlock administration tasks and lock the other processes with a dedicated cgroup on the fly. This allows the user to make unremovable Landlock security policies but only activate them when needed for specific processes. >=20 > Also, how does this interact with the current cgroup v1 vs v2 mess? > As far as I can tell, no one can even really agree on what "what > cgroup am I in" means right now. I tested with cgroup-v2 but indeed, it seems a bit different with cgroup-v1 :) Does anyone know how to handle both cases? >=20 >> >> An unprivileged process can create and manipulate cgroups thanks to >> cgroup delegation. >=20 > What is cgroup delegation? This is simply the action of changing the owner of cgroup sysfs files to allow an unprivileged user to handle them (cf. Documentation/cgroup-v2.tx= t) Micka=C3=ABl --k0jrAKmG3iFl0mLHQhvH5VcJm2i7BKQmS-- --fem93Duixaa7Puv1lVjAwOLiiCPLhog68 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJXvwQ9AAoJECLe/t9zvWqVV9YH/2GeL+bwWnpzafOOxl7lEld5 zQKWjoYZ56f4+eGjV7hteNfRt7ZaubLQ7brmPDtX+p4z7/PentK+HcsXRI/5gyK0 FjtsATTSiH+xJiBDhH31FvYEsonHmH0CZsjWQGBiIUeJXVtUracGmJNsZf4WWiyF IHGBZZ6Gdzir+DyZmcMjNLXmCXi1tLLdoV/51gdBxt9hUg/Tf+fkd1ILxdimo3Rc oH5iyvJH65VycWFFm52nWZjBGvoy7rKZ8oxhiU2kt08P6TkYD3ENULho6b59BixL iK801B96L/HbPckcTOgbWXBNYXI8LWbSLsoiilv9P5CYm5sPYHu7vJBg/IJdvCI= =A8Yu -----END PGP SIGNATURE----- --fem93Duixaa7Puv1lVjAwOLiiCPLhog68--