linux-kernel - Re: General flags to turn things off (getrandom, pid lookup, etc)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87egx7dhpb.fsf@x220.int.ebiederm.org>
Date:	Sat, 26 Jul 2014 12:48:48 -0700
From:	ebiederm@...ssion.com (Eric W. Biederman)
To:	Andy Lutomirski <luto@...capital.net>
Cc:	One Thousand Gnomes <gnomes@...rguk.ukuu.org.uk>,
	Julien Tinnes <jln@...gle.com>,
	David Drysdale <drysdale@...gle.com>,
	Al Viro <viro@...iv.linux.org.uk>,
	Paolo Bonzini <pbonzini@...hat.com>,
	LSM List <linux-security-module@...r.kernel.org>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Paul Moore <paul@...l-moore.com>,
	James Morris <james.l.morris@...cle.com>,
	Linux API <linux-api@...r.kernel.org>,
	Meredydd Luff <meredydd@...atehouse.org>,
	Christoph Hellwig <hch@...radead.org>,
	"linux-kernel\@vger.kernel.org" <linux-kernel@...r.kernel.org>,
	Kees Cook <keescook@...omium.org>,
	"Theodore Ts'o" <tytso@....edu>,
	Henrique de Moraes Holschuh <hmh@....eng.br>,
	linux-crypto@...r.kernel.org
Subject: Re: General flags to turn things off (getrandom, pid lookup, etc)

Andy Lutomirski <luto@...capital.net> writes:

> On Fri, Jul 25, 2014 at 2:35 PM, One Thousand Gnomes
> <gnomes@...rguk.ukuu.org.uk> wrote:
>> On Fri, 25 Jul 2014 11:30:48 -0700
>> Andy Lutomirski <luto@...capital.net> wrote:
>>
>>> [new thread because this sort of combines two threads]
>>>
>>> There is recent interest in having a way to turn generally-available
>>> kernel features off.  Maybe we should add a good one so we can stop
>>> bikeshedding and avoid proliferating dumb interfaces.
>>
>> We sort of have one. It's called capable(). Just needs extending to cover
>> anything else you care about, and probably all the numeric constants
>> replacing with textual names.

The big difference is capable only subdivides roots powers (aka things
most applications should not have).  When we start talking about things
that things that are safe for most applications capable is probably not
the right tool for the job.

A much closer match is the personality system call.  Look at setarch
to see how it is used.  My biggest concern with personality is there
are only 32bits to play with.  Still I expect what you want may be a
sandbox personality, that disables everything that could possibly be
a problem (including access to the personality syscall).

Eric
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/