From: Kees Cook <keescook@chromium.org>
To: Lennart Poettering <lennart@poettering.net>
Cc: "Alexei Starovoitov" <alexei.starovoitov@gmail.com>,
"zhujianwei (C)" <zhujianwei7@huawei.com>,
"bpf@vger.kernel.org" <bpf@vger.kernel.org>,
"linux-security-module@vger.kernel.org"
<linux-security-module@vger.kernel.org>,
Hehuazhen <hehuazhen@huawei.com>,
"Christian Ehrhardt" <christian.ehrhardt@canonical.com>,
"Zbigniew Jędrzejewski-Szmek" <zbyszek@in.waw.pl>
Subject: Re: new seccomp mode aims to improve performance
Date: Mon, 15 Jun 2020 23:00:55 -0700 [thread overview]
Message-ID: <202006152255.514C33D1@keescook> (raw)
In-Reply-To: <20200602124431.GA123838@gardel-login>
On Tue, Jun 02, 2020 at 02:44:31PM +0200, Lennart Poettering wrote:
> We have that actually, it's this line you pasted above:
>
> SystemCallArchitectures=native
>
> It means: block all syscall ABIs but the native one for all processes
> of this service.
Gotcha. And I see this now as I'm working on the code to generating
bitmaps automatically. After systemd-resolved applies the 26th filter,
the "compat" bitmap goes from effectively a duplicate of the native
syscall map to blocking everything.
after filter 25:
...
[ 5.405296] seccomp: syscall bitmap: compat 0-4: SECCOMP_RET_ALLOW
[ 5.405297] seccomp: syscall bitmap: compat 5: filter
...
[ 5.405326] seccomp: syscall bitmap: compat 380: filter
[ 5.405327] seccomp: syscall bitmap: compat 381-439: SECCOMP_RET_ALLOW
after filter 26:
...
[ 5.405498] seccomp: syscall bitmap: compat 0-439: SECCOMP_RET_KILL_THREAD
So that seems to be working as expected. :)
--
Kees Cook
prev parent reply other threads:[~2020-06-16 6:00 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-29 12:48 new seccomp mode aims to improve performance zhujianwei (C)
2020-05-29 15:43 ` Alexei Starovoitov
2020-05-29 16:09 ` Kees Cook
2020-05-29 17:31 ` Alexei Starovoitov
2020-05-29 19:27 ` Kees Cook
2020-05-31 17:19 ` Alexei Starovoitov
2020-06-01 18:16 ` Kees Cook
2020-06-01 2:08 ` 答复: " zhujianwei (C)
2020-06-01 3:30 ` Alexei Starovoitov
2020-06-02 2:42 ` 答复: " zhujianwei (C)
2020-06-02 3:24 ` Alexei Starovoitov
2020-06-02 11:13 ` 答复: " zhujianwei (C)
2020-06-02 11:34 ` zhujianwei (C)
2020-06-02 18:32 ` Kees Cook
2020-06-03 4:51 ` 答复: " zhujianwei (C)
2020-06-01 10:11 ` Lennart Poettering
2020-06-01 12:32 ` Paul Moore
2020-06-02 12:53 ` Lennart Poettering
2020-06-02 15:03 ` Paul Moore
2020-06-02 18:39 ` Kees Cook
2020-06-01 18:21 ` Kees Cook
2020-06-02 12:44 ` Lennart Poettering
2020-06-02 18:37 ` Kees Cook
2020-06-16 6:00 ` Kees Cook [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202006152255.514C33D1@keescook \
--to=keescook@chromium.org \
--cc=alexei.starovoitov@gmail.com \
--cc=bpf@vger.kernel.org \
--cc=christian.ehrhardt@canonical.com \
--cc=hehuazhen@huawei.com \
--cc=lennart@poettering.net \
--cc=linux-security-module@vger.kernel.org \
--cc=zbyszek@in.waw.pl \
--cc=zhujianwei7@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.