[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 14 Sep 2016 14:36:40 +0000
From: David Laight <David.Laight@...LAB.COM>
To: 'Mickaël Salaün' <mic@...ikod.net>,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
CC: Alexei Starovoitov <ast@...nel.org>, Andy Lutomirski
<luto@...capital.net>, Arnd Bergmann <arnd@...db.de>, Casey Schaufler
<casey@...aufler-ca.com>, Daniel Borkmann <daniel@...earbox.net>, Daniel Mack
<daniel@...que.org>, David Drysdale <drysdale@...gle.com>, "David S . Miller"
<davem@...emloft.net>, Elena Reshetova <elena.reshetova@...el.com>, "Eric W
. Biederman" <ebiederm@...ssion.com>, James Morris
<james.l.morris@...cle.com>, Kees Cook <keescook@...omium.org>, Paul Moore
<pmoore@...hat.com>, Sargun Dhillon <sargun@...gun.me>, "Serge E . Hallyn"
<serge@...lyn.com>, Tejun Heo <tj@...nel.org>, Will Drewry
<wad@...omium.org>, "kernel-hardening@...ts.openwall.com"
<kernel-hardening@...ts.openwall.com>, "linux-api@...r.kernel.org"
<linux-api@...r.kernel.org>, "linux-security-module@...r.kernel.org"
<linux-security-module@...r.kernel.org>, "netdev@...r.kernel.org"
<netdev@...r.kernel.org>, "cgroups@...r.kernel.org" <cgroups@...r.kernel.org>
Subject: RE: [RFC v3 00/22] Landlock LSM: Unprivileged sandboxing
From: Mickaël Salaün
> Sent: 14 September 2016 08:24
...
> ## Why does seccomp-filter is not enough?
>
> A seccomp filter can access to raw syscall arguments which means that it is not
> possible to filter according to pointed data as a file path. As demonstrated
> the first version of this patch series, filtering at the syscall level is
> complicated (e.g. need to take care of race conditions). This is mainly because
> the access control checkpoints of the kernel are not at this high-level but
> more underneath, at LSM hooks level. The LSM hooks are designed to handle this
> kind of checks. This series use this approach to leverage the ability of
> unprivileged users to limit themselves.
You cannot validate file path parameters during syscall entry.
It can only be done after the user buffer has been read into kernel memory.
(ie you must only access the buffer once.)
This has nothing to do with where the kernel does any access checks,
and everything to do with the fact that another thread/process can
modify the buffer after you have validated it.
David
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
