From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from atrey.karlin.mff.cuni.cz (ksp.mff.cuni.cz [195.113.26.206]) by ozlabs.org (Postfix) with ESMTP id 80BFBB6FA6 for ; Thu, 26 May 2011 16:33:52 +1000 (EST) Date: Thu, 26 May 2011 06:27:52 +0000 From: Pavel Machek To: James Morris Subject: Re: [PATCH 3/5] v2 seccomp_filters: Enable ftrace-based system call filtering Message-ID: <20110526062752.GA14622@localhost.ucw.cz> References: <1304017638.18763.205.camel@gandalf.stny.rr.com> <1305169376-2363-1-git-send-email-wad@chromium.org> <20110512074850.GA9937@elte.hu> <20110512130104.GA2912@elte.hu> <20110513121034.GG21022@elte.hu> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii In-Reply-To: Cc: linux-mips@linux-mips.org, linux-sh@vger.kernel.org, Peter Zijlstra , Frederic Weisbecker , Heiko Carstens , linux-kernel@vger.kernel.org, David Howells , Paul Mackerras , Ralf Baechle , "H. Peter Anvin" , sparclinux@vger.kernel.org, Jiri Slaby , linux-s390@vger.kernel.org, Russell King , x86@kernel.org, agl@chromium.org, Ingo Molnar , Ingo Molnar , "Serge E. Hallyn" , Peter Zijlstra , Steven Rostedt , Martin Schwidefsky , Thomas Gleixner , kees.cook@canonical.com, linux-arm-kernel@lists.infradead.org, Michal Marek , Michal Simek , Will Drewry , linuxppc-dev@lists.ozlabs.org, Oleg Nesterov , Eric Paris , Paul Mundt , Tejun Heo , linux390@de.ibm.com, Andrew Morton , Linus Torvalds , "David S. Miller" List-Id: Linux on PowerPC Developers Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , On Mon 2011-05-16 10:36:05, James Morris wrote: > On Fri, 13 May 2011, Ingo Molnar wrote: > How do you reason about the behavior of the system as a whole? > > > > I argue that this is the LSM and audit subsystems designed right: in the long > > run it could allow everything that LSM does at the moment - and so much more > > ... > > Now you're proposing a redesign of the security subsystem. That's a > significant undertaking. > > In the meantime, we have a simple, well-defined enhancement to seccomp > which will be very useful to current users in reducing their kernel attack > surface. Well, you can do the same with subterfugue, even without kernel changes. But that's ptrace -- slow. (And it already shows that syscall based filters are extremely tricky to configure). If yu want speed, seccomp+server for non-permitted operations seems like reasonable way. -- (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html