[<prev] [day] [month] [year] [list]
Message-ID: <0787fe6f-3c23-454a-b277-9b1fa065d5b8@gmail.com>
Date: Fri, 22 Aug 2025 21:34:55 -0400
From: Demi Marie Obenour <demiobenour@...il.com>
To: musl@...ts.openwall.com, libc-alpha@...rceware.org
Subject: Running code on all other threads (for sandboxing)
There are cases where it is highly desirable for a process
to start out with full user rights (or at least close to them),
initialize, and then drop these privileges using Linux kernel
features like seccomp. Unfortunately, this breaks if the
process uses third-party libraries that create threads during
initialization. In particular, Mesa can do this, and there is
no realistic alternative to it as Mesa is ~2 million lines of
GPU compiler and driver code. Loading Mesa later is undesirable
as it prevents removing all filesystem access.
There are two ways to fix this problem:
1. Fix the problem in the Linux kernel.
2. Work around it in userspace, as is already done for setuid()
and friends.
For the second, it should be sufficient to provide a function
that runs a caller-provided function on each thread, while
ensuring that the process is atomic with respect to other
threads in the process. This function only needs to make
system calls and crashes the process if there is an error.
If the function uses anything that isn't a syscall or
compiler builtin, it gets to keep both pieces.
Is this something that would make sense to implement? I know
that this problem has been an issue for Chromium on Linux.
--
Sincerely,
Demi Marie Obenour (she/her/hers)
Download attachment "OpenPGP_0xB288B55FFF9C22C1.asc" of type "application/pgp-keys" (7141 bytes)
Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
