Re: [RFCv2 00/15] RFCv2: Consolidated userspace RDMA library repo

[Doug Ledford <dledford-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>]

[-- Attachment #1.1: Type: text/plain, Size: 2066 bytes --]

On 9/1/2016 1:09 PM, Jason Gunthorpe wrote:

> I'll write a patch to enable 'run from build' in a way which should
> make this even more straight forward.
> 
> However, things are already fine today, you just drop your driver in
> /opt/intel-opa/lib/libhfi1.so and customize
> /etc/libverbs/hfi1verbs.driver with an absolute path to the .so (I
> wrote the absolute path patch for this years ago for exactly this
> reason)

We do have to be a little bit careful here.

1)  The override directory needs to be a fixed place.
2)  The driver files need to only allow names.  The absolute path patch
sounds like an immediate security issue.
3)  libibverbs needs to be modified to search the overrides directory
for <name>.so first, then the normal directory.  No other searches
should be performed.
4)  The overrides directory and the normal directory need to be system
paths so that both file system permissions and SELinux context (if
enabled) prevent random files from being dropped there.

Basically, with the idea you outline above, you would have to change the
file type of the /etc/libibverbs.d/hfi1verbs.driver file (and all the
other driver files) to be a changeable config file, which prevents rpm
(and other) security scanners from being able to detect that it's been
modified (and the modification might be nefarious) and it also means
that on package upgrade, the file is not automatically re-written to the
official form (meaning a nefarious modification would survive a package
update).  And with the full path patch, the driver could be pointed to
anywhere.  And then you have something like opensm being run as root and
loading up this nefarious driver from wherever.  It's a big security issue.

If you instead have just one official override directory, and search it
before the regular directory, then an updated driver can be distributed
as a simple rpm (or deb) that just installs the .so in the right location.


-- 
Doug Ledford <dledford-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
    GPG Key ID: 0E572FDD


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 884 bytes --]