Re: Chromium sandbox on LoongArch and statx -- seccomp deep argument inspection again?

From: Xi Ruoyao <xry111@xry111.site>
To: WANG Xuerui <kernel@xen0n.name>, linux-api@vger.kernel.org
Cc: Arnd Bergmann <arnd@arndb.de>,
	Christian Brauner <brauner@kernel.org>,
	 Kees Cook <keescook@chromium.org>,
	Huacai Chen <chenhuacai@kernel.org>,
	Xuefeng Li <lixuefeng@loongson.cn>,
	Jianmin Lv <lvjianmin@loongson.cn>,
	Xiaotian Wu <wuxiaotian@loongson.cn>,
	WANG Rui <wangrui@loongson.cn>,
	Miao Wang <shankerwangmiao@gmail.com>,
	Icenowy Zheng <uwu@icenowy.me>,
	 "loongarch@lists.linux.dev" <loongarch@lists.linux.dev>,
	linux-arch <linux-arch@vger.kernel.org>,
	Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
Subject: Re: Chromium sandbox on LoongArch and statx -- seccomp deep argument inspection again?
Date: Wed, 21 Feb 2024 14:31:02 +0800	[thread overview]
Message-ID: <f1a1bc708be543eb647df57b5eb0c0ef035baf8b.camel@xry111.site> (raw)
In-Reply-To: <599df4a3-47a4-49be-9c81-8e21ea1f988a@xen0n.name>

On Wed, 2024-02-21 at 14:09 +0800, WANG Xuerui wrote:

> - just restore fstat and be done with it;
> - add a flag to statx so we can do the equivalent of just fstat(fd, 
> &out) with statx, and ensuring an error happens if path is not empty in 
> that case;

It's worse than "just restore fstat" considering the performance.  Read
this thread:
https://sourceware.org/pipermail/libc-alpha/2023-September/151320.html

> - tackle the long-standing problem of seccomp deep argument inspection (!).

Frankly I'm never a fan of syscall blocklisting.  When I develop the
Online Judge system for the programming contest training in Xidian
University I deliberately avoid using seccomp.  This thing is very
likely to break innocent programs with some system change innocent as
well (for example Glibc or libstdc++ update).

-- 
Xi Ruoyao <xry111@xry111.site>
School of Aerospace Science and Technology, Xidian University