Messages in this thread | | | Date | Mon, 3 Nov 2014 10:26:43 -0800 | Subject | Re: [PATCH 1/3] fs: add O_BENEATH flag to openat(2) | From | Julien Tinnes <> |
| |
On Mon, Nov 3, 2014 at 9:37 AM, David Drysdale <drysdale@google.com> wrote: > On Mon, Nov 3, 2014 at 3:42 PM, Andy Lutomirski <luto@amacapital.net> wrote: >> This is extremely useful in conjunction with seccomp. > > Yes, that was my understanding of how the Chrome[OS] folk wanted > to use it.
Yes, exactly. Without this, if we want to give a sandboxed process A access to a directory, we need to: 1. Create a new 'broker" process B 2. Make sure to have an IPC channel between A and B. 3. SIGSYS open() and openat() in A via seccomp-bpf 4. Have an async-signal-safe handler that can IPC open / openat.
There is a lot of hidden complexity in such a set-up. For instance, if you need to prevent contention, the number of threads in the broker B should scale automatically.
This is 'fine' (but undesirable) for a big beast such as Chromium which needs such a complex set-ups anyways, but David's patch would make it a lot easier to build a sandbox and whitelist directories for everyone, simply by enforcing O_BENEATH in seccomp and whitelisting open directory file descriptors in the sandboxed process.
Julien
| |