netdev - Re: [PATCH 1/6] ebpf: add a seccomp program type

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 9 Sep 2015 09:52:26 -0700
From:	Alexei Starovoitov <alexei.starovoitov@...il.com>
To:	Kees Cook <keescook@...omium.org>
Cc:	Daniel Borkmann <daniel@...earbox.net>,
	Tycho Andersen <tycho.andersen@...onical.com>,
	Alexei Starovoitov <ast@...nel.org>,
	Will Drewry <wad@...omium.org>,
	Oleg Nesterov <oleg@...hat.com>,
	Andy Lutomirski <luto@...capital.net>,
	Pavel Emelyanov <xemul@...allels.com>,
	"Serge E. Hallyn" <serge.hallyn@...ntu.com>,
	LKML <linux-kernel@...r.kernel.org>,
	Network Development <netdev@...r.kernel.org>
Subject: Re: [PATCH 1/6] ebpf: add a seccomp program type

On Wed, Sep 09, 2015 at 09:37:51AM -0700, Kees Cook wrote:
> On Wed, Sep 9, 2015 at 9:09 AM, Daniel Borkmann <daniel@...earbox.net> wrote:
> > On 09/09/2015 06:07 PM, Alexei Starovoitov wrote:
> >>
> >> On Wed, Sep 09, 2015 at 09:50:35AM -0600, Tycho Andersen wrote:
> >
> > [...]
> >>>
> >>> Thoughts?
> >>
> >>
> >> Please do not add any per-instruction hacks. None of them are
> >> necessary. Classic had to do extra ugly checks in seccomp only
> >> because verifier wasn't flexible enough.
> >> If you don't want to see any BPF_CALL in seccomp, just have
> >> empty get_func_proto() callback for BPF_PROG_TYPE_SECCOMP
> >> and verifier will reject all calls.
> >> Currently we have only two non-generic instrucitons
> >> LD_ABS and LD_IND that are avaialable for sockets/TC only,
> >> because these are legacy instructions and we had to make
> >> exceptions for them.
> >
> > Yep, +1.
> 
> Hrmpf. This adds to the cognitive load for accepting this patch
> series. :P Now I have to convince myself that there is no additional
> exposure to seccomp by using the entire set of eBPF instructions.
> While I'm pretty sure it'll be fine, I really don't want to risk being
> wrong and opening a hole here. I will spend some time looking at the
> new eBPF instructions...

note, as was discussed many times before, there is no pointer leak
prevention pass yet, so eBPF is root only.
Once the pass is complete it will prevent passing addresses to
functions, storing them in maps and returning from the program.

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html