From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x227F8e5ObM7ubgLbu9llEF7ttxs4ER4dPZpOk0U1faVPCx2adpQF1apNI831Tr2dRmcbQ3t1 ARC-Seal: i=1; a=rsa-sha256; t=1517231687; cv=none; d=google.com; s=arc-20160816; b=bD4f8OO3bZi9PfRGUUiFd3kgnIO9wGJq1/GP/9dyxoAztYsK2oRyjCTRvbRFHKOnny XbBgJsIAlZ0P1gt0J/BFpg+J8oItZlYalgswzjC2yN+RbbzlumtZ5+oKT6978BiBh0XX 1Ncq275/DuUimTiLQv4F94iu7g7cQXmikjctrtKssgfIEhPe4sf9K19YicnpNkOPjd/2 yU64kcQD9VN8ZQtZilnFntRvhlMGb9efj1C/Ab0UCrpwrfR5oL3FbwlSPstkPct67fCn kArPi4e0Y/yzR/lNNdy5HQAq8NeTgwcT1t9U2zgSpl6+HIlPQoJsZiTeOM+v29OjE2nd MyrQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=user-agent:in-reply-to:content-disposition:mime-version:references :message-id:subject:cc:to:from:date:arc-authentication-results; bh=aRX+xve1p4hKPG3g92dHKolJmc7CX66WEnSLgDiY42A=; b=huYb+Vb2wkFzFRWXUlxDWK9wL55rFB5+Jyf/QLhKgbe6C923fzMWFTBjPY6/jMet3z 4qBFv1EbMqF4TK9HszNFyzhLUdq0Hqwbz1RHM07/J6Tp/zvdzI86T9YDduo1vwNjKzHu CxtsZQ0QCmFhvjuAeE3flEM3qCu+t6gGTyyvl1olhFU6DImDlYQ3f3XZvA+Rb5PD+uTv 72GsduY/g6RSm6QcTBTZ7pCPShbgPayyNthwwBFWvGqszQhPjj0S0pgkkZQN7aKVQp8I E9B0coYQ2F55+Dcy3lV2agVS/7lWwLhlYJgOsdHVFkB7cixpPtQ3/vt/RmoHbMDLgab1 Mwig== ARC-Authentication-Results: i=1; mx.google.com; spf=neutral (google.com: 195.113.26.193 is neither permitted nor denied by best guess record for domain of pavel@ucw.cz) smtp.mailfrom=pavel@ucw.cz Authentication-Results: mx.google.com; spf=neutral (google.com: 195.113.26.193 is neither permitted nor denied by best guess record for domain of pavel@ucw.cz) smtp.mailfrom=pavel@ucw.cz Date: Mon, 29 Jan 2018 14:14:46 +0100 From: Pavel Machek To: Alan Cox Cc: Martin Schwidefsky , Dominik Brodowski , linux-kernel@vger.kernel.org, linux-s390@vger.kernel.org, kvm@vger.kernel.org, Heiko Carstens , Christian Borntraeger , Paolo Bonzini , Cornelia Huck , David Hildenbrand , Greg Kroah-Hartman , Jon Masters , Marcus Meissner , Jiri Kosina , w@1wt.eu, keescook@chromium.org, thomas.lendacky@amd.com, dwmw@amazon.co.uk, ak@linux.intel.com Subject: Re: Avoiding information leaks between users and between processes by default? [Was: : [PATCH 1/5] prctl: add PR_ISOLATE_BP process control] Message-ID: <20180129131446.GB4669@amd> References: <1516712825-2917-1-git-send-email-schwidefsky@de.ibm.com> <1516712825-2917-2-git-send-email-schwidefsky@de.ibm.com> <20180123170719.GA4154@isilmar-4.linta.de> <20180124072953.50851fec@mschwideX1> <20180124083705.GA14868@light.dominikbrodowski.net> <20180124111552.GA24675@amd> <20180124134803.3e11c6d6@mschwideX1> <20180124190105.GA30107@amd> <20180124204622.1f7b0de2@alans-desktop> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="KFztAG8eRSV9hGtP" Content-Disposition: inline In-Reply-To: <20180124204622.1f7b0de2@alans-desktop> User-Agent: Mutt/1.5.23 (2014-03-12) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: =?utf-8?q?1590462291652474475?= X-GMAIL-MSGID: =?utf-8?q?1590932734640764979?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: --KFztAG8eRSV9hGtP Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed 2018-01-24 20:46:22, Alan Cox wrote: > > Anyway, no need to add prctl(), if A can ptrace B and B can ptrace A, > > leaking info between them should not be a big deal. You can probably > > find existing macros doing neccessary checks. >=20 > Until one of them is security managed so it shouldn't be able to ptrace > the other, or (and this is the nasty one) when a process is executing > code it wants to protect from the rest of the same process (eg an > untrusted jvm, javascript or probably nastiest of all webassembly) >=20 > We don't need a prctl for trusted/untrusted IMHO but we do eventually > need to think about API's for "this lot is me but I don't trust > it" (flatpack, docker, etc) and for what JIT engines need to do. Agreed. And yes, JITs are interesting, and given the latest rowhammer/sidechannel attacks, something we may want to limit in future... It sounds nice on paper but is just risky. Pavel --=20 (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blo= g.html --KFztAG8eRSV9hGtP Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlpvHkYACgkQMOfwapXb+vLk/ACaAsmlr9eMLJNIIMjJLuk8PxK+ 1b4An3U1pEZ+etPY3/qYfQid40In7a59 =Cosk -----END PGP SIGNATURE----- --KFztAG8eRSV9hGtP--