[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAG48ez251v19U60GYH4aWE6+C-3PYw5mr_Ax_kxnebqDOBn_+Q@mail.gmail.com>
Date: Thu, 24 Sep 2020 01:47:47 +0200
From: Jann Horn <jannh@...gle.com>
To: Kees Cook <keescook@...omium.org>
Cc: YiFei Zhu <yifeifz2@...inois.edu>,
Christian Brauner <christian.brauner@...ntu.com>,
Tycho Andersen <tycho@...ho.pizza>,
Andy Lutomirski <luto@...capital.net>,
Will Drewry <wad@...omium.org>,
Andrea Arcangeli <aarcange@...hat.com>,
Giuseppe Scrivano <gscrivan@...hat.com>,
Tobin Feldman-Fitzthum <tobin@....com>,
Dimitrios Skarlatos <dskarlat@...cmu.edu>,
Valentin Rothberg <vrothber@...hat.com>,
Hubertus Franke <frankeh@...ibm.com>,
Jack Chen <jianyan2@...inois.edu>,
Josep Torrellas <torrella@...inois.edu>,
Tianyin Xu <tyxu@...inois.edu>, bpf <bpf@...r.kernel.org>,
Linux Containers <containers@...ts.linux-foundation.org>,
Linux API <linux-api@...r.kernel.org>,
kernel list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 4/6] seccomp: Emulate basic filters for constant action results
On Thu, Sep 24, 2020 at 1:29 AM Kees Cook <keescook@...omium.org> wrote:
> This emulates absolutely the most basic seccomp filters to figure out
> if they will always give the same results for a given arch/nr combo.
>
> Nearly all seccomp filters are built from the following ops:
>
> BPF_LD | BPF_W | BPF_ABS
> BPF_JMP | BPF_JEQ | BPF_K
> BPF_JMP | BPF_JGE | BPF_K
> BPF_JMP | BPF_JGT | BPF_K
> BPF_JMP | BPF_JSET | BPF_K
> BPF_JMP | BPF_JA
> BPF_RET | BPF_K
>
> These are now emulated to check for accesses beyond seccomp_data::arch
> or unknown instructions.
>
> Not yet implemented are:
>
> BPF_ALU | BPF_AND (generated by libseccomp and Chrome)
BPF_AND is normally only used on syscall arguments, not on the syscall
number or the architecture, right? And when a syscall argument is
loaded, we abort execution anyway. So I think there is no need to
implement those?
> Suggested-by: Jann Horn <jannh@...gle.com>
> Link: https://lore.kernel.org/lkml/CAG48ez1p=dR_2ikKq=xVxkoGg0fYpTBpkhJSv1w-6BG=76PAvw@mail.gmail.com/
> Signed-off-by: Kees Cook <keescook@...omium.org>
> ---
> kernel/seccomp.c | 82 ++++++++++++++++++++++++++++++++++++++++++++---
> net/core/filter.c | 3 +-
> 2 files changed, 79 insertions(+), 6 deletions(-)
>
> diff --git a/kernel/seccomp.c b/kernel/seccomp.c
> index 111a238bc532..9921f6f39d12 100644
> --- a/kernel/seccomp.c
> +++ b/kernel/seccomp.c
> @@ -610,7 +610,12 @@ static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog)
> {
> struct seccomp_filter *sfilter;
> int ret;
> - const bool save_orig = IS_ENABLED(CONFIG_CHECKPOINT_RESTORE);
> + const bool save_orig =
> +#if defined(CONFIG_CHECKPOINT_RESTORE) || defined(SECCOMP_ARCH)
> + true;
> +#else
> + false;
> +#endif
You could probably write this as something like:
const bool save_orig = IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) ||
__is_defined(SECCOMP_ARCH);
[...]
> diff --git a/net/core/filter.c b/net/core/filter.c
[...]
> -static void bpf_release_orig_filter(struct bpf_prog *fp)
> +void bpf_release_orig_filter(struct bpf_prog *fp)
> {
> struct sock_fprog_kern *fprog = fp->orig_prog;
>
> @@ -1154,6 +1154,7 @@ static void bpf_release_orig_filter(struct bpf_prog *fp)
> kfree(fprog);
> }
> }
> +EXPORT_SYMBOL_GPL(bpf_release_orig_filter);
If this change really belongs into this patch (which I don't think it
does), please describe why in the commit message.
Powered by blists - more mailing lists