[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 25 Sep 2020 17:34:29 -0700
From: Andy Lutomirski <luto@...capital.net>
To: Kees Cook <keescook@...omium.org>
Cc: YiFei Zhu <zhuyifei1999@...il.com>,
Linux Containers <containers@...ts.linux-foundation.org>,
YiFei Zhu <yifeifz2@...inois.edu>, bpf <bpf@...r.kernel.org>,
kernel list <linux-kernel@...r.kernel.org>,
Aleksa Sarai <cyphar@...har.com>,
Andrea Arcangeli <aarcange@...hat.com>,
Dimitrios Skarlatos <dskarlat@...cmu.edu>,
Giuseppe Scrivano <gscrivan@...hat.com>,
Hubertus Franke <frankeh@...ibm.com>,
Jack Chen <jianyan2@...inois.edu>,
Jann Horn <jannh@...gle.com>,
Josep Torrellas <torrella@...inois.edu>,
Tianyin Xu <tyxu@...inois.edu>,
Tobin Feldman-Fitzthum <tobin@....com>,
Tycho Andersen <tycho@...ho.pizza>,
Valentin Rothberg <vrothber@...hat.com>,
Will Drewry <wad@...omium.org>
Subject: Re: [PATCH v2 seccomp 3/6] seccomp/cache: Add "emulator" to check if filter is arg-dependent
> On Sep 25, 2020, at 4:49 PM, Kees Cook <keescook@...omium.org> wrote:
>
> On Fri, Sep 25, 2020 at 02:07:46PM -0700, Andy Lutomirski wrote:
>>> On Fri, Sep 25, 2020 at 1:37 PM Kees Cook <keescook@...omium.org> wrote:
>>>
>>> On Fri, Sep 25, 2020 at 12:51:20PM -0700, Andy Lutomirski wrote:
>>>>
>>>>
>>>>> On Sep 25, 2020, at 12:42 PM, Kees Cook <keescook@...omium.org> wrote:
>>>>>
>>>>> On Fri, Sep 25, 2020 at 11:45:05AM -0500, YiFei Zhu wrote:
>>>>>> On Thu, Sep 24, 2020 at 10:04 PM YiFei Zhu <zhuyifei1999@...il.com> wrote:
>>>>>>>> Why do the prepare here instead of during attach? (And note that it
>>>>>>>> should not be written to fail.)
>>>>>>>
>>>>>>> Right.
>>>>>>
>>>>>> During attach a spinlock (current->sighand->siglock) is held. Do we
>>>>>> really want to put the emulator in the "atomic section"?
>>>>>
>>>>> It's a good point, but I had some other ideas around it that lead to me
>>>>> a different conclusion. Here's what I've got in my head:
>>>>>
>>>>> I don't view filter attach (nor the siglock) as fastpath: the lock is
>>>>> rarely contested and the "long time" will only be during filter attach.
>>>>>
>>>>> When performing filter emulation, all the syscalls that are already
>>>>> marked as "must run filter" on the previous filter can be skipped for
>>>>> the new filter, since it cannot change the outcome, which makes the
>>>>> emulation step faster.
>>>>>
>>>>> The previous filter's bitmap isn't "stable" until siglock is held.
>>>>>
>>>>> If we do the emulation step before siglock, we have to always do full
>>>>> evaluation of all syscalls, and then merge the bitmap during attach.
>>>>> That means all filters ever attached will take maximal time to perform
>>>>> emulation.
>>>>>
>>>>> I prefer the idea of the emulation step taking advantage of the bitmap
>>>>> optimization, since the kernel spends less time doing work over the life
>>>>> of the process tree. It's certainly marginal, but it also lets all the
>>>>> bitmap manipulation stay in one place (as opposed to being split between
>>>>> "prepare" and "attach").
>>>>>
>>>>> What do you think?
>>>>>
>>>>>
>>>>
>>>> I’m wondering if we should be much much lazier. We could potentially wait until someone actually tries to do a given syscall before we try to evaluate whether the result is fixed.
>>>
>>> That seems like we'd need to track yet another bitmap of "did we emulate
>>> this yet?" And it means the filter isn't really "done" until you run
>>> another syscall? eeh, I'm not a fan: it scratches at my desire for
>>> determinism. ;) Or maybe my implementation imagination is missing
>>> something?
>>>
>>
>> We'd need at least three states per syscall: unknown, always-allow,
>> and need-to-run-filter.
>>
>> The downsides are less determinism and a bit of an uglier
>> implementation. The upside is that we don't need to loop over all
>> syscalls at load -- instead the time that each operation takes is
>> independent of the total number of syscalls on the system. And we can
>> entirely avoid, say, evaluating the x32 case until the task tries an
>> x32 syscall.
>>
>> I think it's at least worth considering.
>
> Yeah, worth considering. I do still think the time spent in emulation is
> SO small that it doesn't matter running all of the syscalls at attach
> time. The filters are tiny and fail quickly if anything "interesting"
> start to happen. ;)
>
There’s a middle ground, too: do it lazily per arch. So we would allocate and populate the compat bitmap the first time a compat syscall is attempted and do the same for x32. This may help avoid the annoying extra memory usage and 3x startup overhead while retaining full functionality.
Powered by blists - more mailing lists