From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757084AbcIOEJW (ORCPT ); Thu, 15 Sep 2016 00:09:22 -0400 Received: from mail-vk0-f43.google.com ([209.85.213.43]:36542 "EHLO mail-vk0-f43.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755693AbcIOEJT (ORCPT ); Thu, 15 Sep 2016 00:09:19 -0400 MIME-Version: 1.0 In-Reply-To: <20160915040054.GA65308@ast-mbp.thefacebook.com> References: <20160914072415.26021-1-mic@digikod.net> <20160914072415.26021-19-mic@digikod.net> <57D9CB25.1010103@digikod.net> <20160915021940.GA65119@ast-mbp.thefacebook.com> <20160915040054.GA65308@ast-mbp.thefacebook.com> From: Andy Lutomirski Date: Wed, 14 Sep 2016 21:08:57 -0700 Message-ID: Subject: Re: [RFC v3 18/22] cgroup,landlock: Add CGRP_NO_NEW_PRIVS to handle unprivileged hooks To: Alexei Starovoitov Cc: =?UTF-8?B?TWlja2HDq2wgU2FsYcO8bg==?= , "linux-kernel@vger.kernel.org" , Alexei Starovoitov , Arnd Bergmann , Casey Schaufler , Daniel Borkmann , Daniel Mack , David Drysdale , "David S . Miller" , Elena Reshetova , "Eric W . Biederman" , James Morris , Kees Cook , Paul Moore , Sargun Dhillon , "Serge E . Hallyn" , Tejun Heo , Will Drewry , "kernel-hardening@lists.openwall.com" , Linux API , LSM List , Network Development , "open list:CONTROL GROUP (CGROUP)" Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Sep 14, 2016 at 9:00 PM, Alexei Starovoitov wrote: > On Wed, Sep 14, 2016 at 07:27:08PM -0700, Andy Lutomirski wrote: >> >> > >> >> > This RFC handle both cgroup and seccomp approaches in a similar way. I >> >> > don't see why building on top of cgroup v2 is a problem. Is there >> >> > security issues with delegation? >> >> >> >> What I mean is: cgroup v2 delegation has a functionality problem. >> >> Tejun says [1]: >> >> >> >> We haven't had to face this decision because cgroup has never properly >> >> supported delegating to applications and the in-use setups where this >> >> happens are custom configurations where there is no boundary between >> >> system and applications and adhoc trial-and-error is good enough a way >> >> to find a working solution. That wiggle room goes away once we >> >> officially open this up to individual applications. >> >> >> >> Unless and until that changes, I think that landlock should stay away >> >> from cgroups. Others could reasonably disagree with me. >> > >> > Ours and Sargun's use cases for cgroup+lsm+bpf is not for security >> > and not for sandboxing. So the above doesn't matter in such contexts. >> > lsm hooks + cgroups provide convenient scope and existing entry points. >> > Please see checmate examples how it's used. >> > >> >> To be clear: I'm not arguing at all that there shouldn't be >> bpf+lsm+cgroup integration. I'm arguing that the unprivileged >> landlock interface shouldn't expose any cgroup integration, at least >> until the cgroup situation settles down a lot. > > ahh. yes. we're perfectly in agreement here. > I'm suggesting that the next RFC shouldn't include unpriv > and seccomp at all. Once bpf+lsm+cgroup is merged, we can > argue about unpriv with cgroups and even unpriv as a whole, > since it's not a given. Seccomp integration is also questionable. > I'd rather not have seccomp as a gate keeper for this lsm. > lsm and seccomp are orthogonal hook points. Syscalls and lsm hooks > don't have one to one relationship, so mixing them up is only > asking for trouble further down the road. > If we really need to carry some information from seccomp to lsm+bpf, > it's easier to add eBPF support to seccomp and let bpf side deal > with passing whatever information. > As an argument for keeping seccomp (or an extended seccomp) as the interface for an unprivileged bpf+lsm: seccomp already checks off most of the boxes for safely letting unprivileged programs sandbox themselves. Furthermore, to the extent that there are use cases for unprivileged bpf+lsm that *aren't* expressible within the seccomp hierarchy, I suspect that syscall filters have exactly the same problem and that we should fix seccomp to cover it. If I ever add a "seccomp monitor", which is something I want to do eventually, I think it should work for lsm+bpf as well, which is another argument for keeping it in seccomp. --Andy