lkml.org 
[lkml]   [2014]   [Jul]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: General flags to turn things off (getrandom, pid lookup, etc)
On Fri, Jul 25, 2014 at 7:30 PM, Andy Lutomirski <luto@amacapital.net> wrote:
> [new thread because this sort of combines two threads]
>
> There is recent interest in having a way to turn generally-available
> kernel features off. Maybe we should add a good one so we can stop
> bikeshedding and avoid proliferating dumb interfaces.
>
> Things that might want to be turn-off-able include:
> - getrandom with GRND_RANDOM [from the getrandom threads]
> - Any lookup of a non-self pid [from the capsicum thread]
> - Any lookup of a pid outside the caller thread group [capsicum]
> - Various architectural things (personal wishlist), e.g.:
> - RDTSC and userspace HPET access
> - CPUID?
> - 32-bit GDT code segments [huge attack surface]
> - 64-bit GDT code segments [probably pointless]
>
> I would propose a new syscall for this:
>
> long restrict_userspace(int mode, int type, int value, int flags);
>
> mode is RESTRICT_SET, RESTRICT_GET, or RESTRICT_LOCK.
>
> type is RESTRICT_GRND_RANDOM, RESTRICT_PID_SCOPE, RESTRICT_X86_TIMING, etc.
>
> Value is zero if RESTRICT_GET. Otherwise value is the desired value,
> generally 0 or 1. For RESTRICT_PID_SCOPE, value would be
> RESTRICT_PID_SCOPE_ANY, RESTRICT_PID_SCOPE_THREADGROUP, or
> RESTRICT_PID_SCOPE_SELF.
>
> flags must be zero. Someday, someone will propose a thread-sync flag.

Today, me: proposed :-)

> restrict_userspace requires either no_new_privs or CAP_SYS_ADMIN in
> the current user namespace.
>
> Thoughts?
>
> --Andy
>
> --
> Andy Lutomirski
> AMA Capital Management, LLC


\
 
 \ /
  Last update: 2014-07-27 15:01    [W:0.095 / U:0.336 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site