From mboxrd@z Thu Jan 1 00:00:00 1970 Received: with ECARTIS (v1.0.0; list linux-mips); Thu, 26 May 2011 08:28:05 +0200 (CEST) Received: from ksp.mff.cuni.cz ([195.113.26.206]:39172 "EHLO atrey.karlin.mff.cuni.cz" rhost-flags-OK-OK-OK-FAIL) by eddie.linux-mips.org with ESMTP id S1490955Ab1EZG2A (ORCPT ); Thu, 26 May 2011 08:28:00 +0200 Received: by atrey.karlin.mff.cuni.cz (Postfix, from userid 512) id 5F468F0A11; Thu, 26 May 2011 08:27:59 +0200 (CEST) Date: Thu, 26 May 2011 06:27:52 +0000 From: Pavel Machek To: James Morris Cc: Ingo Molnar , linux-mips@linux-mips.org, linux-sh@vger.kernel.org, Peter Zijlstra , Frederic Weisbecker , Heiko Carstens , Oleg Nesterov , David Howells , Paul Mackerras , Eric Paris , "H. Peter Anvin" , sparclinux@vger.kernel.org, Jiri Slaby , linux-s390@vger.kernel.org, Russell King , x86@kernel.org, Linus Torvalds , Ingo Molnar , Benjamin Herrenschmidt , kees.cook@canonical.com, "Serge E. Hallyn" , Peter Zijlstra , Steven Rostedt , Tejun Heo , Thomas Gleixner , linux-arm-kernel@lists.infradead.org, Michal Marek , Michal Simek , Will Drewry , linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, Ralf Baechle , Paul Mundt , Martin Schwidefsky , linux390@de.ibm.com, Andrew Morton , agl@chromium.org, "David S. Miller" Subject: Re: [PATCH 3/5] v2 seccomp_filters: Enable ftrace-based system call filtering Message-ID: <20110526062752.GA14622@localhost.ucw.cz> References: <1304017638.18763.205.camel@gandalf.stny.rr.com> <1305169376-2363-1-git-send-email-wad@chromium.org> <20110512074850.GA9937@elte.hu> <20110512130104.GA2912@elte.hu> <20110513121034.GG21022@elte.hu> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.18 (2008-05-17) Return-Path: X-Envelope-To: <"|/home/ecartis/ecartis -s linux-mips"> (uid 0) X-Orcpt: rfc822;linux-mips@linux-mips.org Original-Recipient: rfc822;linux-mips@linux-mips.org X-archive-position: 30151 X-ecartis-version: Ecartis v1.0.0 Sender: linux-mips-bounce@linux-mips.org Errors-to: linux-mips-bounce@linux-mips.org X-original-sender: pavel@ucw.cz Precedence: bulk X-list: linux-mips On Mon 2011-05-16 10:36:05, James Morris wrote: > On Fri, 13 May 2011, Ingo Molnar wrote: > How do you reason about the behavior of the system as a whole? > > > > I argue that this is the LSM and audit subsystems designed right: in the long > > run it could allow everything that LSM does at the moment - and so much more > > ... > > Now you're proposing a redesign of the security subsystem. That's a > significant undertaking. > > In the meantime, we have a simple, well-defined enhancement to seccomp > which will be very useful to current users in reducing their kernel attack > surface. Well, you can do the same with subterfugue, even without kernel changes. But that's ptrace -- slow. (And it already shows that syscall based filters are extremely tricky to configure). If yu want speed, seccomp+server for non-permitted operations seems like reasonable way. -- (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from atrey.karlin.mff.cuni.cz (ksp.mff.cuni.cz [195.113.26.206]) by ozlabs.org (Postfix) with ESMTP id 80BFBB6FA6 for ; Thu, 26 May 2011 16:33:52 +1000 (EST) Date: Thu, 26 May 2011 06:27:52 +0000 From: Pavel Machek To: James Morris Subject: Re: [PATCH 3/5] v2 seccomp_filters: Enable ftrace-based system call filtering Message-ID: <20110526062752.GA14622@localhost.ucw.cz> References: <1304017638.18763.205.camel@gandalf.stny.rr.com> <1305169376-2363-1-git-send-email-wad@chromium.org> <20110512074850.GA9937@elte.hu> <20110512130104.GA2912@elte.hu> <20110513121034.GG21022@elte.hu> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii In-Reply-To: Cc: linux-mips@linux-mips.org, linux-sh@vger.kernel.org, Peter Zijlstra , Frederic Weisbecker , Heiko Carstens , linux-kernel@vger.kernel.org, David Howells , Paul Mackerras , Ralf Baechle , "H. Peter Anvin" , sparclinux@vger.kernel.org, Jiri Slaby , linux-s390@vger.kernel.org, Russell King , x86@kernel.org, agl@chromium.org, Ingo Molnar , Ingo Molnar , "Serge E. Hallyn" , Peter Zijlstra , Steven Rostedt , Martin Schwidefsky , Thomas Gleixner , kees.cook@canonical.com, linux-arm-kernel@lists.infradead.org, Michal Marek , Michal Simek , Will Drewry , linuxppc-dev@lists.ozlabs.org, Oleg Nesterov , Eric Paris , Paul Mundt , Tejun Heo , linux390@de.ibm.com, Andrew Morton , Linus Torvalds , "David S. Miller" List-Id: Linux on PowerPC Developers Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , On Mon 2011-05-16 10:36:05, James Morris wrote: > On Fri, 13 May 2011, Ingo Molnar wrote: > How do you reason about the behavior of the system as a whole? > > > > I argue that this is the LSM and audit subsystems designed right: in the long > > run it could allow everything that LSM does at the moment - and so much more > > ... > > Now you're proposing a redesign of the security subsystem. That's a > significant undertaking. > > In the meantime, we have a simple, well-defined enhancement to seccomp > which will be very useful to current users in reducing their kernel attack > surface. Well, you can do the same with subterfugue, even without kernel changes. But that's ptrace -- slow. (And it already shows that syscall based filters are extremely tricky to configure). If yu want speed, seccomp+server for non-permitted operations seems like reasonable way. -- (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html From mboxrd@z Thu Jan 1 00:00:00 1970 From: pavel@ucw.cz (Pavel Machek) Date: Thu, 26 May 2011 06:27:52 +0000 Subject: [PATCH 3/5] v2 seccomp_filters: Enable ftrace-based system call filtering In-Reply-To: References: <1304017638.18763.205.camel@gandalf.stny.rr.com> <1305169376-2363-1-git-send-email-wad@chromium.org> <20110512074850.GA9937@elte.hu> <20110512130104.GA2912@elte.hu> <20110513121034.GG21022@elte.hu> Message-ID: <20110526062752.GA14622@localhost.ucw.cz> To: linux-arm-kernel@lists.infradead.org List-Id: linux-arm-kernel.lists.infradead.org On Mon 2011-05-16 10:36:05, James Morris wrote: > On Fri, 13 May 2011, Ingo Molnar wrote: > How do you reason about the behavior of the system as a whole? > > > > I argue that this is the LSM and audit subsystems designed right: in the long > > run it could allow everything that LSM does at the moment - and so much more > > ... > > Now you're proposing a redesign of the security subsystem. That's a > significant undertaking. > > In the meantime, we have a simple, well-defined enhancement to seccomp > which will be very useful to current users in reducing their kernel attack > surface. Well, you can do the same with subterfugue, even without kernel changes. But that's ptrace -- slow. (And it already shows that syscall based filters are extremely tricky to configure). If yu want speed, seccomp+server for non-permitted operations seems like reasonable way. -- (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html