Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1578879

Re: [PATCH v2 2/4] seccomp: Add sysctl to configure actions that should be logged

Show all headers | View raw

On Fri, Feb 10, 2017 at 3:56 PM, Tyler Hicks <tyhicks@canonical.com> wrote:
> On 02/07/2017 06:24 PM, Kees Cook wrote:
>> case SECCOMP_RET_ALLOW:
>>     /* Open-coded seccomp_log(), optimized for RET_ALLOW. */
>>     if (unlikely(seccomp_max_action_to_log == 0))
>>         __audit_seccomp(syscall, signr, action);
>>     return 0;
>
> That makes sense.

And, heh, reading it again now, my example should be ==
SECCOMP_RET_ALLOW (which is 0, yes, but eek raw number, bad me).

>>> +/* Largest strlen() of all action names */
>>> +#define SECCOMP_RET_MAX_NAME_LEN       5
>>
>> This feels fragile... though I don't have a good suggestion yet. :P
>
> I agree and I also don't have a good solution. I didn't like having to
> hard code it.

Yeah. Hrmpf. I mean, it could be sizeof(seccomp_actions_avail) ...
that'll always be long enough. :) But it's a bit of stack over-kill,
but ... is that so bad? I dunno.

>> In the hopes of some day making the sysctl table entirely read-only,
>> can you add some fancy crap here for me? :) See
>> security/yama/yama_lsm.c's yama_dointvec_minmax(), which uses a copy
>> of the sysctl table on the stack.
>
> Will do. I'll deviate slightly from yama_dointvec_minmax(). To make it
> clear that the ctl_table param shouldn't be modified, I'm going to name
> it ro_table and then the stack variable will be named table.

Sounds great, thanks!

-Kees

-- 
Kees Cook
Pixel Security

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH v2 0/4] Improved seccomp logging Tyler Hicks <tyhicks@canonical.com> - 2017-02-03 06:40 +0100
  [PATCH v2 3/4] seccomp: Create an action to log before allowing Tyler Hicks <tyhicks@canonical.com> - 2017-02-03 06:40 +0100
    Re: [PATCH v2 3/4] seccomp: Create an action to log before allowing Kees Cook <keescook@chromium.org> - 2017-02-08 01:40 +0100
      Re: [PATCH v2 3/4] seccomp: Create an action to log before allowing Kees Cook <keescook@chromium.org> - 2017-02-09 23:00 +0100
      Re: [PATCH v2 3/4] seccomp: Create an action to log before allowing Kees Cook <keescook@chromium.org> - 2017-02-11 01:20 +0100
        Re: [PATCH v2 3/4] seccomp: Create an action to log before allowing Tyler Hicks <tyhicks@canonical.com> - 2017-02-11 01:20 +0100
      Re: [PATCH v2 3/4] seccomp: Create an action to log before allowing Tyler Hicks <tyhicks@canonical.com> - 2017-02-11 01:20 +0100
  [PATCH v2 2/4] seccomp: Add sysctl to configure actions that should be logged Tyler Hicks <tyhicks@canonical.com> - 2017-02-03 06:40 +0100
    Re: [PATCH v2 2/4] seccomp: Add sysctl to configure actions that  should be logged Kees Cook <keescook@chromium.org> - 2017-02-08 01:40 +0100
      Re: [PATCH v2 2/4] seccomp: Add sysctl to configure actions that  should be logged Tyler Hicks <tyhicks@canonical.com> - 2017-02-11 01:00 +0100
        Re: [PATCH v2 2/4] seccomp: Add sysctl to configure actions that  should be logged Kees Cook <keescook@chromium.org> - 2017-02-11 01:10 +0100
  [PATCH v2 1/4] seccomp: Add sysctl to display available actions Tyler Hicks <tyhicks@canonical.com> - 2017-02-03 06:40 +0100
    Re: [PATCH v2 1/4] seccomp: Add sysctl to display available actions Kees Cook <keescook@chromium.org> - 2017-02-08 01:10 +0100
      Re: [PATCH v2 1/4] seccomp: Add sysctl to display available actions Tyler Hicks <tyhicks@canonical.com> - 2017-02-08 01:50 +0100
        Re: [PATCH v2 1/4] seccomp: Add sysctl to display available actions Kees Cook <keescook@chromium.org> - 2017-02-08 01:50 +0100
  [PATCH v2 4/4] seccomp: Add tests for SECCOMP_RET_LOG Tyler Hicks <tyhicks@canonical.com> - 2017-02-03 06:40 +0100
    Re: [PATCH v2 4/4] seccomp: Add tests for SECCOMP_RET_LOG Kees Cook <keescook@chromium.org> - 2017-02-08 01:50 +0100
  Re: [PATCH v2 0/4] Improved seccomp logging Kees Cook <keescook@chromium.org> - 2017-02-08 01:00 +0100

csiph-web