Messages in this thread | | | Date | Fri, 16 Feb 2024 19:24:50 +0100 | Subject | Re: [RFC 0/8] PGP key parser using SandBox Mode | From | Roberto Sassu <> |
| |
On 2/16/2024 6:21 PM, Jonathan Corbet wrote: > Petr Tesařík <petr@tesarici.cz> writes: > >> On Fri, 16 Feb 2024 07:38:30 -0800 >> Dave Hansen <dave.hansen@intel.com> wrote: >>> I'm confused by this. The kernel doesn't (appear to) have a PGP parser >>> today. So are you saying that it *should* have one and it's only >>> feasible if its confined in a sandbox? >> >> I'm sorry if this is confusing. Yes, your understanding is correct. >> This patch series demonstrates that SBM (even in the initial version >> that was submitted) allows to write a PGP parser which can survive >> memory safety bugs withoug compromising the rest of the kernel. > > So I have a different question: some years ago we added the "usermode > blob" feature for just this kind of use case - parsing firewall rules at > the time. It has never been used for that, but it's still there in > kernel/usermode_driver.c. Is there a reason why this existing > functionality can't be used for tasks like PGP parsing as well?
Yes, it was an option I explored last year (briefly talked about it as a BoF at LSS NA 2023).
You are right, there is such feature that seemed to fit well.
User space blob embedded in a kernel module, so signed. User space process connected only to the kernel through a pipe.
I even went ahead, and created a framework:
https://lore.kernel.org/linux-kernel/20230317145240.363908-1-roberto.sassu@huaweicloud.com/
so that anyone can implement similar use cases.
The further step is: how can I ensure that the process launched by the kernel is not attacked by root (which I assumed to be less powerful than the kernel in a locked-down system).
I handled this in both directions:
- The process launched by the kernel is under a seccomp strict profile, and can only read/write through the pipe created by the kernel (and call few other system calls, such as exit()). Otherwise it is killed. Cannot create any new communication channel.
- I created an LSM that denies any attempt to ptrace/signal to the process launched by the kernel. Jann Horn also suggested to make the process non-swappable.
However, despite these attempts, security people don't feel confident on offloading a kernel workload outside the kernel.
This is why this work started.
Roberto
| |