Messages in this thread | | | Date | Sun, 27 Dec 2009 09:03:00 -0600 | From | "Serge E. Hallyn" <> | Subject | Re: RFC: disablenetwork facility. (v4) |
| |
Quoting Tetsuo Handa (penguin-kernel@I-love.SAKURA.ne.jp): > Pavel Machek wrote: > > Syscalls are very wrong granularity for security system. But easy to > > implement, see seccomp. > > Quoting from http://en.wikipedia.org/wiki/Seccomp > > It allows a process to make a one-way transition into a "secure" state where > > it cannot make any system calls except exit(), read() and write() to > > already-open file descriptors. > > I think seccomp() is too much restricted to apply for general applications. > Most applications will need some other syscalls in addition to exit(), read() > and write(). Most applications cannot use seccomp(). > > What I want to do is similar to seccomp(), but allows userland process to > forbid some syscalls like execve(), mount(), chroot(), link(), unlink(), > socket(), bind(), listen() etc. selectively.
The nice thing about the disablenetwork module is that (AFAICS so far) it actually is safe for an unprivileged user to do. I can't think of any setuid-root software which, if started with restricted-network by an unprivileged user, would become unsafe rather than simply failing (*1).
Adding syscalls becomes much scarier.
-serge
*1 - Michael Stone, without looking back over the patches, do you also restrict opening netlink sockets? Should we worry about preventing an error message from being sent to the audit daemon?
| |