Messages in this thread | | | From | (Eric W. Biederman) | Date | Tue, 08 Sep 2015 17:35:38 -0500 | Subject | RFC: fsyscall |
| |
I was thinking a bit about the problem of allowing another process to perform a subset of what your process can perform, and it occured to me there might be something conceptually simple we can do.
Have a system call fsyscall that takes a file descriptor the system call number and the parameters to that system call as arguments. AKA long fsyscall(int fd, long number, ...); AKA syscall with a file desciptor argument.
The fd would hold a struct cred, and a filter that limits what system calls and which parameters may be passed.
The implementation of fsyscall would be something like: old = override_creds(f->f_cred); /* Perform filtered syscallf */ revert_creds(old);
Then we have another system call call it fsyscall_create(...) that takes a bpf filter and returns a file descriptor, that can be used with fsyscall.
I'm not certain that bpf is the best way to create such a filter but it seems plausible, and we already have the infrastructure in place, so if nothing else there would be synergy in syscall filtering.
My two concerns with bpf are (a) it seems a little complex for the simplest use cases. (b) I think there cases like inspecting the data passed into write, or send, or the structure passed into ioctl that it doesn't handle well yet.
Andy does a fsyscall system call sound like something that would be not be too bad to implement? (You have just been through all of the x86 system call paths recently).
Eric
| |