Re: Using ftrace/perf as a basis for generic seccomp

[Eric Paris <eparis@redhat.com>]

On Fri, 2011-02-04 at 00:10 +0100, Frederic Weisbecker wrote:
> On Thu, Feb 03, 2011 at 11:06:33PM +0100, Stefan Fritsch wrote:
> > On Thursday 03 February 2011, Frederic Weisbecker wrote:

> Actually having seccomp as a user of filter expressions is a opportunity
> to improve it and bring new ideas.
> 
> > This would give something in the very near future that is way more 
> > usable than seccomp mode 1. I think only the following adjustments 
> > would need to be made to Adam Langley's patch:
> > 
> > - only allow syscalls in the mode (non-compat/compat) that the prctl 
> > call was made in
> > - deny exec of setuid/setgid binaries
> > - deny exec of binaries with filesystem capabilities
> > 
> > What do you think of this proposal? I have a patch lying around 
> > somewhere that already does the first two of these.
> 
> IMHO this is an unnecessary intermediate state. It will actually make
> things worse by bringing a new non-flexible ABI that we'll need to
> maintain forever.
> 
> I'm no expert in security but I think it's not flexible.

I'm not quite sure how I feel.  The only person who ask/semi-required
this flexibility is Ingo.  I agree it's a really great idea and maybe
one that people will someday use.  I'm going to try to work on it over
the next week or two.  I'm not certain if my use case really wants/needs
it or will even use the filter flexibility.  Now, there's no question
that what we have today is so inflexible it's basically useless.  It's
also obvious that we have at least 3 people who would use something like
the google solution.  (sounds like at least 3 of us have written a
google like solution by now)

So I'm going to take a stab at understanding everything you told me
today.  THANK YOU SO MUCH for the overview.  It was AMAZING and exactly
what I was hoping to hear.  But if I don't think I can come up with
something in a reasonable time frame I'm probably going to be back
pushing what we all wanted to start with    :)

-Eric