Re: RFC: Network privilege separation.

["Rémi Denis-Courmont" <rdenis@simphalempin.com>]

Le lundi 12 janvier 2009 21:43:33 Andi Kleen, vous avez écrit :
> > Yes, the network access part *is* something that should be part of a more
> > general interface.  Having said that, we currently are lacking a way for
> > a *general user* program to say "I'm all set up, and would like to
> > disavow any other further resource access (except maybe r/o access as
> > "other" to file systems)".
>
> seccomp does exactly that. It's quite obscure, but available in most
> linux kernels. Basically it blocks everything except
> read/write on already open file descriptors.
>
> I always thought it would be nice if codecs (which tend
> to be full of security holes) ran in such jails by default

Yeah, and there are not going to do that because there are lots of useful 
stuff codecs like to do that represents no security issue but is nevertheless 
impossible with SECCOMP (according to the documentation).

Expanding the heap, mapping memory. Getting timestamps. Waiting on futexes, 
catching signals, polling file descriptors. Seeking, doing vectorized I/O. 
Cloning.


Codecs don't like to read/write raw video through a pipe...

-- 
Rémi Denis-Courmont
http://www.remlab.net/