Message-ID: <20110203231051.GA1840@nowhere>
Date:	Fri, 4 Feb 2011 00:10:54 +0100
From:	Frederic Weisbecker <fweisbec@...il.com>
To:	Stefan Fritsch <sf@...itsch.de>
Cc:	Eric Paris <eparis@...hat.com>, Ingo Molnar <mingo@...e.hu>,
	Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>,
	Eric Paris <eparis@...isplace.org>,
	linux-kernel@...r.kernel.org, agl@...gle.com, tzanussi@...il.com,
	Jason Baron <jbaron@...hat.com>,
	Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
	2nddept-manager@....hitachi.co.jp,
	Steven Rostedt <rostedt@...dmis.org>,
	Arnaldo Carvalho de Melo <acme@...hat.com>,
	Peter Zijlstra <a.p.zijlstra@...llo.nl>,
	Thomas Gleixner <tglx@...utronix.de>
Subject: Re: Using ftrace/perf as a basis for generic seccomp

On Thu, Feb 03, 2011 at 11:06:33PM +0100, Stefan Fritsch wrote:
> Hi,
> 
> On Thursday 03 February 2011, Frederic Weisbecker wrote:
> > I think you won't work with trace events, so you need to make the
> > filtering code more tracing-agnostic.
> > 
> > But I think it's quite workable and shouldn't be too hard to split
> > that into a filtering backend. Many parts are already pretty
> > standalone.
> > 
> > Also I suspect the tracepoints are not what you need. Or may be
> > they are. But as Masami said, the syscall tracepoint is called
> > late. It's workable though. The other problem is that preemption
> > is disabled when tracepoints are called, which is probably not
> > what you want. One day I think we'll need to unify the tracepoints
> > and notifier code but until then, better keep tracepoints for
> > tracing.
> > 
> > Now once you have the filtering code more generic, you still
> > need an arch backend to map register contents and layout into
> > syscall arguments name and type. On top of which you can finally
> > use the filtering code. For that you can use, again, some code we
> > use for tracing, which are syscalls metadata: informations
> > generated on build time that have syscalls fields and type.
> > And that also needs to be split up, but it's more trivial
> > than the filtering part.
> 
> AFAICS the infrastructure for tracing and metadata of compat syscalls 
> is also still missing. That would need to be added, too. Jason Baron 
> and Ian Munsie have worked on this in mid 2010, but I don't know about 
> the current status.

Oh we have these features for a while now. Jason and others have
made a great work on it.
For example you can accept only read() calls when fd = 7 with perf:

./perf record -a -e syscalls:sys_enter_read --filter "fd==7"
./perf script

	    perf-2956  [000]  6427.757791: sys_enter_read: fd: 0x00000007, buf: 0x7fdd2c095000, count: 0x00000400
            perf-2956  [000]  6427.757858: sys_enter_read: fd: 0x00000007, buf: 0x7fdd2c095000, count: 0x00000400
            perf-2956  [000]  6427.757877: sys_enter_read: fd: 0x00000007, buf: 0x7fdd2c095000, count: 0x00000400
            perf-2956  [000]  6427.757949: sys_enter_read: fd: 0x00000007, buf: 0x7fdd2c095000, count: 0x00000400
            perf-2956  [000]  6427.757968: sys_enter_read: fd: 0x00000007, buf: 0x7fdd2c095000, count: 0x00000400

Or you can do it with ftrace.

Now what Jason and Ian have worked on lately was rather about compat syscalls support and power pc
support amongst other things.
 
> Considering that all this is still quite a bit of work and that the 
> initial suggestion by Adam Langley happened nearly two years ago, 
> maybe a two step approach would be better:
> 
> Integrate a seccomp mode 2 now, which only supports a bitmask of 
> bitmaps and no filtering.
> 
> Then, when the infrastructure for the filtering is finished, add a 
> seccomp mode 3 with support for filtering.

Infrastructure for filtering will never be finished. IMO there will
always be many ways to make it better, simply because using such
conditional expressions offer tons of possibilities and is extendable
by nature.

Actually having seccomp as a user of filter expressions is a opportunity
to improve it and bring new ideas.

> This would give something in the very near future that is way more 
> usable than seccomp mode 1. I think only the following adjustments 
> would need to be made to Adam Langley's patch:
> 
> - only allow syscalls in the mode (non-compat/compat) that the prctl 
> call was made in
> - deny exec of setuid/setgid binaries
> - deny exec of binaries with filesystem capabilities
> 
> What do you think of this proposal? I have a patch lying around 
> somewhere that already does the first two of these.

IMHO this is an unnecessary intermediate state. It will actually make
things worse by bringing a new non-flexible ABI that we'll need to
maintain forever.

I'm no expert in security but I think it's not flexible.

> > of raw arguments value. Syscalls metadata don't know much
> > about type semantics and won't help you to dereference
> > syscall argument pointers. Only raw syscall parameter values.
> > Similarly, the filtering code can't evaluate pointer dereferencing
> > expression evaluation, only direct values comprehension.
> 
> Pointer dereferencing at syscall entry must be avoided for seccomp 
> anyway, or there would be race conditions. Of course if the filtering 
> points could be put after the final copy_form_user, it would be ok.

Makes sense yeah.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Powered by blists - more mailing lists