Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1472835

Re: [RFC v2 06/10] landlock: Add LSM hooks

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On 30/08/2016 20:56, Andy Lutomirski wrote:
> On Aug 25, 2016 12:34 PM, "Mickaël Salaün" <mic@digikod.net> wrote:
>>
>> Add LSM hooks which can be used by userland through Landlock (eBPF)
>> programs. This programs are limited to a whitelist of functions (cf.
>> next commit). The eBPF program context is depicted by the struct
>> landlock_data (cf. include/uapi/linux/bpf.h):
>> * hook: LSM hook ID (useful when using the same program for multiple LSM
>>   hooks);
>> * cookie: the 16-bit value from the seccomp filter that triggered this
>>   Landlock program;
>> * args[6]: array of LSM hook arguments.
>>
>> The LSM hook arguments can contain raw values as integers or
>> (unleakable) pointers. The only way to use the pointers are to pass them
>> to an eBPF function according to their types (e.g. the
>> bpf_landlock_cmp_fs_beneath_with_struct_file function can use a struct
>> file pointer).
>>
>> For now, there is three hooks for file system access control:
>> * file_open;
>> * file_permission;
>> * mmap_file.
>>
> 
> What's the purpose of exposing struct cred * to userspace?  It's
> primarily just an optimization to save a bit of RAM, and it's a
> dubious optimization at that.  What are you using it for?  Would it
> make more sense to use struct task_struct * or struct pid * instead?
> 
> Also, exposing struct cred * has a really weird side-effect: it allows
> (maybe even encourages) checking for pointer equality between two
> struct cred * objects.  Doing so will have erratic results.
> 

The pointers exposed in the ePBF context are not directly readable by an
unprivileged eBPF program thanks to the strong typing of the Landlock
context and the static eBPF verification. There is no way to leak a
kernel pointer to userspace from an unprivileged eBPF program: pointer
arithmetic and comparison are prohibited. Pointers can only be pass as
argument to dedicated eBPF functions.

For now, struct cred * is simply not used by any eBPF function and then
not usable at all. It only exist here because I map the LSM hook
arguments in a generic/automatic way to the eBPF context.

I'm planning to extend the Landlock context with extra pointers,
whatever the LSM hook. We could then use task_struct, skb or any other
kernel objects, in a safe way, with dedicated functions.

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[RFC v2 00/10] Landlock LSM: Unprivileged sandboxing Mickaël Salaün <mic@digikod.net> - 2016-08-25 12:50 +0200
  [RFC v2 10/10] samples/landlock: Add sandbox example Mickaël Salaün <mic@digikod.net> - 2016-08-25 12:50 +0200
  [RFC v2 05/10] seccomp: Handle Landlock Mickaël Salaün <mic@digikod.net> - 2016-08-25 12:50 +0200
  [RFC v2 02/10] bpf: Move u64_to_ptr() to BPF headers and inline it Mickaël Salaün <mic@digikod.net> - 2016-08-25 12:50 +0200
  [RFC v2 08/10] landlock: Handle file system comparisons Mickaël Salaün <mic@digikod.net> - 2016-08-25 12:50 +0200
    Re: [RFC v2 08/10] landlock: Handle file system comparisons Andy Lutomirski <luto@amacapital.net> - 2016-08-25 13:20 +0200
      Re: [RFC v2 08/10] landlock: Handle file system comparisons Mickaël Salaün <mic@digikod.net> - 2016-08-25 16:20 +0200
        Re: [RFC v2 08/10] landlock: Handle file system comparisons Andy Lutomirski <luto@amacapital.net> - 2016-08-26 17:00 +0200
          Re: [RFC v2 08/10] landlock: Handle file system comparisons Mickaël Salaün <mic@digikod.net> - 2016-08-27 15:50 +0200
  [RFC v2 01/10] landlock: Add Kconfig Mickaël Salaün <mic@digikod.net> - 2016-08-25 12:50 +0200
  [RFC v2 07/10] landlock: Add errno check Mickaël Salaün <mic@digikod.net> - 2016-08-25 12:50 +0200
    Re: [RFC v2 07/10] landlock: Add errno check Andy Lutomirski <luto@amacapital.net> - 2016-08-25 13:20 +0200
  [RFC v2 06/10] landlock: Add LSM hooks Mickaël Salaün <mic@digikod.net> - 2016-08-25 12:50 +0200
    Re: [RFC v2 06/10] landlock: Add LSM hooks Andy Lutomirski <luto@amacapital.net> - 2016-08-30 21:00 +0200
      Re: [RFC v2 06/10] landlock: Add LSM hooks Mickaël Salaün <mic@digikod.net> - 2016-08-30 22:20 +0200
        Re: [RFC v2 06/10] landlock: Add LSM hooks Andy Lutomirski <luto@amacapital.net> - 2016-08-30 22:20 +0200
          Re: [RFC v2 06/10] landlock: Add LSM hooks Mickaël Salaün <mic@digikod.net> - 2016-08-30 22:30 +0200
  Re: [RFC v2 00/10] Landlock LSM: Unprivileged sandboxing Andy Lutomirski <luto@amacapital.net> - 2016-08-25 13:30 +0200
    Re: [RFC v2 00/10] Landlock LSM: Unprivileged sandboxing Mickaël Salaün <mic@digikod.net> - 2016-08-25 16:00 +0200
  Re: [RFC v2 00/10] Landlock LSM: Unprivileged sandboxing Andy Lutomirski <luto@amacapital.net> - 2016-08-27 09:50 +0200
    Re: [RFC v2 00/10] Landlock LSM: Unprivileged sandboxing Mickaël Salaün <mic@digikod.net> - 2016-08-27 17:20 +0200
      Re: [RFC v2 00/10] Landlock LSM: Unprivileged sandboxing (cgroup  delegation) Mickaël Salaün <mic@digikod.net> - 2016-08-27 17:30 +0200
  Re: [RFC v2 00/10] Landlock LSM: Unprivileged sandboxing Andy Lutomirski <luto@amacapital.net> - 2016-08-30 18:10 +0200
    Re: [RFC v2 00/10] Landlock LSM: Unprivileged sandboxing Andy Lutomirski <luto@amacapital.net> - 2016-08-30 22:00 +0200
    Re: [RFC v2 00/10] Landlock LSM: Unprivileged sandboxing Mickaël Salaün <mic@digikod.net> - 2016-08-30 22:00 +0200

csiph-web