lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 06 Sep 2010 20:50:55 +0300 From: Avi Kivity <avi@...hat.com> To: Alan Cox <alan@...rguk.ukuu.org.uk> CC: Ingo Molnar <mingo@...e.hu>, Pekka Enberg <penberg@...helsinki.fi>, Tom Zanussi <tzanussi@...il.com>, Frédéric Weisbecker <fweisbec@...il.com>, Steven Rostedt <rostedt@...dmis.org>, Arnaldo Carvalho de Melo <acme@...hat.com>, Peter Zijlstra <peterz@...radead.org>, linux-perf-users@...r.kernel.org, linux-kernel <linux-kernel@...r.kernel.org> Subject: Re: disabling group leader perf_event On 09/06/2010 06:48 PM, Alan Cox wrote: >> No, I want the ability to terminate the code at any time and clean up >> any resources used. We have exactly the same requirements for ordinary >> userspace. > So you intend to prevent its use at any point where we have a kernel only > resource held in any way manner or form ? Remember we don't hold locks or > many kinds of kernel resource across syscalls. I don't think we can allow the downloaded code to hold any kernel locks. If the locks are necessary for correct operation, then the untrusted code can "forget" to take them. If they aren't necessary, don't expose them in the first place. All APIs exposed to the code have to be thread safe. We can allow locks that only protect user data structures (and so we can just wipe them out if we need to kill the code, just like with futexes[1]). Other resources are easy, we do this everywhere, including for userspace. > Likewise I'm interested > how you will keep it compatible with real time ? It's just like other executing any user code. Whatever thread executes that code is impacted by its real time characteristics. If a non-realtime thread executes it, who cares. If a real time thread executes it, then it's up to the user to guarantee real time behaviour. The kernel need only ensure that user code given by a low-priority task is not executed in a high priority task. >> So you do want to jit? > Depends what you mean by jit. JIT normally implies compiling/recompiling > as you go. Do we want to compile it once at load time - probably, > assuming the tool is present. That's jit enough for me. These would usually be small code snippets, not megabytes of junk, though that would no doubt follow if we do a good job. We could probably s/netfilter/call to user code/ and remove tons of potentially vulnerable kernel code, and gain lots of flexibility into the bargain. I'd like to use this for kvm as well. [1] Ignoring robust futexes, IIUC -- I have a truly marvellous patch that fixes the bug which this signature is too narrow to contain. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists