netdev - Re: [PATCH 0/5] Return fds from privileged sockhash/sockmap lookup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAADnVQKigRAAhhfTwT+QZ0P_TJKTLSiVGpnr_Su8mcyEcvM19Q@mail.gmail.com>
Date:   Mon, 6 Apr 2020 20:08:26 -0700
From:   Alexei Starovoitov <alexei.starovoitov@...il.com>
To:     Lorenz Bauer <lmb@...udflare.com>
Cc:     John Fastabend <john.fastabend@...il.com>,
        Daniel Borkmann <daniel@...earbox.net>,
        kernel-team <kernel-team@...udflare.com>,
        Networking <netdev@...r.kernel.org>, bpf <bpf@...r.kernel.org>,
        Jakub Sitnicki <jakub@...udflare.com>
Subject: Re: [PATCH 0/5] Return fds from privileged sockhash/sockmap lookup

On Fri, Mar 20, 2020 at 8:12 AM Lorenz Bauer <lmb@...udflare.com> wrote:
> Another way around this might be to add a way to go from socket cookie to
> socket, and not touch sockmap. I suspect that is an even steeper hill to climb,
> especially if it means adding a new syscall.

I think receiving socket FD from socket cookie would be much better approach.
It's clean layering and security folks will enforce that bit of api
individually.
New syscall is not hard to add.
man pages, docs are needed regardless.