linux-kernel - Re: [PATCH v1 0/8] x86_64 SandBox Mode arch hooks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240214193241.7447a082@meshulam.tesarici.cz>
Date: Wed, 14 Feb 2024 19:32:41 +0100
From: Petr Tesařík <petr@...arici.cz>
To: "Edgecombe, Rick P" <rick.p.edgecombe@...el.com>
Cc: "hpa@...or.com" <hpa@...or.com>, "Xu, Pengfei" <pengfei.xu@...el.com>,
 "tglx@...utronix.de" <tglx@...utronix.de>, "luto@...nel.org"
 <luto@...nel.org>, "kirill.shutemov@...ux.intel.com"
 <kirill.shutemov@...ux.intel.com>, "brgerst@...il.com" <brgerst@...il.com>,
 "dwmw@...zon.co.uk" <dwmw@...zon.co.uk>, "corbet@....net" <corbet@....net>,
 "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, "Li, Xin3"
 <xin3.li@...el.com>, "roberto.sassu@...weicloud.com"
 <roberto.sassu@...weicloud.com>, "petr.tesarik1@...wei-partners.com"
 <petr.tesarik1@...wei-partners.com>, "jgg@...pe.ca" <jgg@...pe.ca>,
 "x86@...nel.org" <x86@...nel.org>, "bp@...en8.de" <bp@...en8.de>,
 "peterz@...radead.org" <peterz@...radead.org>, "rppt@...nel.org"
 <rppt@...nel.org>, "arnd@...db.de" <arnd@...db.de>, "mhiramat@...nel.org"
 <mhiramat@...nel.org>, "oleg@...hat.com" <oleg@...hat.com>,
 "keescook@...omium.org" <keescook@...omium.org>, "Huang, Kai"
 <kai.huang@...el.com>, "jacob.jun.pan@...ux.intel.com"
 <jacob.jun.pan@...ux.intel.com>, "zegao2021@...il.com"
 <zegao2021@...il.com>, "Rodel, Jorg" <jroedel@...e.de>, "mingo@...hat.com"
 <mingo@...hat.com>, "jpoimboe@...nel.org" <jpoimboe@...nel.org>, "Zhang,
 Tina" <tina.zhang@...el.com>, "Hansen, Dave" <dave.hansen@...el.com>,
 "linux-doc@...r.kernel.org" <linux-doc@...r.kernel.org>,
 "akpm@...ux-foundation.org" <akpm@...ux-foundation.org>,
 "dave.hansen@...ux.intel.com" <dave.hansen@...ux.intel.com>,
 "petrtesarik@...weicloud.com" <petrtesarik@...weicloud.com>, Kees Cook
 <keescook@...omium.org>
Subject: Re: [PATCH v1 0/8] x86_64 SandBox Mode arch hooks

(+Cc Kees)

On Wed, 14 Feb 2024 18:14:49 +0000
"Edgecombe, Rick P" <rick.p.edgecombe@...el.com> wrote:

> On Wed, 2024-02-14 at 17:41 +0100, Petr Tesařík wrote:
> > Second, a sandbox can run unmodified kernel code and interact
> > directly
> > with other parts of the kernel. It's not really possible with this
> > initial patch series, but the plan is that sandbox mode can share
> > locks
> > with the kernel.
> > 
> > Third, sandbox code can be trusted for operations like parsing keys
> > for
> > the trusted keychain if the kernel is locked down, i.e. when even a
> > process with UID 0 is not on the same trust level as kernel mode.  
> 
> What use case needs to have the sandbox both protected from the kernel
> (trusted operations) and non-privileged (the kernel protected from it
> via CPL3)? It seems like opposite things.

I think I have mentioned one: parsing keys for the trusted keyring. The
parser is complex enough to be potentially buggy, but the security
folks have already dismissed the idea to run it as a user mode helper.

Petr T