Message-ID: <874mj4o7yd.fsf@x220.int.ebiederm.org>
Date:	Tue, 08 Sep 2015 17:35:38 -0500
From:	ebiederm@...ssion.com (Eric W. Biederman)
To:	Andy Lutomirski <luto@...capital.net>
Cc:	<linux-kernel@...r.kernel.org>,
	"Serge E. Hallyn" <serge@...lyn.com>
Subject: RFC: fsyscall


I was thinking a bit about the problem of allowing another process to
perform a subset of what your process can perform, and it occured to me
there might be something conceptually simple we can do.

Have a system call fsyscall that takes a file descriptor the system call
number and the parameters to that system call as arguments.  AKA
long fsyscall(int fd, long number, ...); AKA syscall with a file
desciptor argument.

The fd would hold a struct cred, and a filter that limits what system
calls and which parameters may be passed.

The implementation of fsyscall would be something like:
	old = override_creds(f->f_cred);
        /* Perform filtered syscallf */
        revert_creds(old);

Then we have another system call call it fsyscall_create(...) that takes
a bpf filter and returns a file descriptor, that can be used with
fsyscall.

I'm not certain that bpf is the best way to create such a filter but it
seems plausible, and we already have the infrastructure in place, so if
nothing else there would be synergy in syscall filtering.

My two concerns with bpf are (a) it seems a little complex for the
simplest use cases.  (b) I think there cases like inspecting the data
passed into write, or send, or the structure passed into ioctl that it
doesn't handle well yet.

Andy does a fsyscall system call sound like something that would be not
be too bad to implement?  (You have just been through all of the x86
system call paths recently).

Eric


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Powered by blists - more mailing lists