linux-kernel - Re: [PATCH] syscalls: Document OCI seccomp filter interactions & workaround

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <X70/uPNt2BA/vUSo@kroah.com>
Date:   Tue, 24 Nov 2020 18:15:36 +0100
From:   Greg KH <gregkh@...uxfoundation.org>
To:     Jann Horn <jannh@...gle.com>
Cc:     Christoph Hellwig <hch@...radead.org>,
        Kees Cook <keescook@...omium.org>,
        Andy Lutomirski <luto@...capital.net>,
        Will Drewry <wad@...omium.org>, Mark Wielaard <mark@...mp.org>,
        Florian Weimer <fweimer@...hat.com>,
        Christian Brauner <christian.brauner@...ntu.com>,
        Linux API <linux-api@...r.kernel.org>,
        "open list:DOCUMENTATION" <linux-doc@...r.kernel.org>,
        kernel list <linux-kernel@...r.kernel.org>,
        dev@...ncontainers.org, Jonathan Corbet <corbet@....net>,
        Carlos O'Donell <carlos@...hat.com>
Subject: Re: [PATCH] syscalls: Document OCI seccomp filter interactions &
 workaround

On Tue, Nov 24, 2020 at 06:06:38PM +0100, Jann Horn wrote:
> +seccomp maintainers/reviewers
> [thread context is at
> https://lore.kernel.org/linux-api/87lfer2c0b.fsf@oldenburg2.str.redhat.com/
> ]
> 
> On Tue, Nov 24, 2020 at 5:49 PM Christoph Hellwig <hch@...radead.org> wrote:
> > On Tue, Nov 24, 2020 at 03:08:05PM +0100, Mark Wielaard wrote:
> > > For valgrind the issue is statx which we try to use before falling back
> > > to stat64, fstatat or stat (depending on architecture, not all define
> > > all of these). The problem with these fallbacks is that under some
> > > containers (libseccomp versions) they might return EPERM instead of
> > > ENOSYS. This causes really obscure errors that are really hard to
> > > diagnose.
> >
> > So find a way to detect these completely broken container run times
> > and refuse to run under them at all.  After all they've decided to
> > deliberately break the syscall ABI.  (and yes, we gave the the rope
> > to do that with seccomp :().
> 
> FWIW, if the consensus is that seccomp filters that return -EPERM by
> default are categorically wrong, I think it should be fairly easy to
> add a check to the seccomp core that detects whether the installed
> filter returns EPERM for some fixed unused syscall number and, if so,
> prints a warning to dmesg or something along those lines...

Why?  seccomp is saying "this syscall is not permitted", so -EPERM seems
like the correct error to provide here.  It's not -ENOSYS as the syscall
is present.

As everyone knows, there are other ways to have -EPERM be returned from
a syscall if you don't have the correct permissions to do something.
Why is seccomp being singled out here?  It's doing the correct thing.

thanks,

greg k-h