lkml.org 
[lkml]   [2015]   [Sep]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: v2 of seccomp filter c/r patches
Hi Andy,

On Mon, Sep 14, 2015 at 10:52:46AM -0700, Andy Lutomirski wrote:
>
> I'm not sure I entirely like this solution...

Ok. Since we also aren't going to do all the eBPF stuff now, how about
something that looks like this:

struct seccomp_layer {
unsigned int size;
unsigned int type; /* SECCOMP_BPF_CLASSIC or SECCOMP_EBPF or ... */
bool inherited;
union {
unsigned int insn_cnt;
struct bpf_insn *insns;
};
};

with a ptrace command:

ptrace(PTRACE_SECCOMP_DUMP_LAYER, pid, i, &layer);

If we save a pointer to the current seccomp filter on fork (if there
is one), then I think the inherited flag is just,

inherited = is_ancestor(child->seccomp.filter, child->seccomp.inherited_filter)

In order to restore this (so it can be checkpointed again), we need a
command that looks like:

seccomp(SECCOMP_INHERIT_FILTER);

which sets the current and inherited filter to that of the parent
process. (Optionally we could have seccomp(SECCOMP_INHERIT_FILTER, i)
to inherit the ith filter from the parent, but we can coordinate this
via userpace so it's not strictly necessary.) So the whole c/r process
looks something like:

--- dump ---

for (i = 0; true; i++) {
ret = ptrace(PTRACE_SECCOMP_DUMP_FILTER, pid, i, &layer);
if (ret == -ESRCH)
break;
if (ret < 0)
/* real error */

/* save the filter if it's not inherited, if it is, mark the filter
* to be inherited from ppid; note that this index is walking up the
* tree following filter->prev, and the index we want to reason
* about on restore is walking down, so we should reverse the whole
* array.
*/
}

--- restore ---

if (have_inherited_filters) {
wait_for_ppid_seccomp_restore(n_inherited);
seccomp(SECCOMP_INHERIT_FILTER);
signal_done_inheriting();
}

for (i = 0; i < n_filters; i++) {
seccomp(SECCOMP_SET_MODE_FILTER, ...);
if (child_inherited_filter(i))
signal_children_filter(i);
}

I played around with an implementation of SECCOMP_INHERIT_FILTER last
night and I think I have one that might work. Thoughts?

Tycho


\
 
 \ /
  Last update: 2015-09-15 18:41    [W:0.091 / U:0.428 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site