From: Kees Cook <keescook-F7+t8E8rja9g9hUCZPvPmw@public.gmane.org>
To: Sargun Dhillon <sargun-GaZTRHToo+CzQB+pC5nmwQ@public.gmane.org>
Cc: Will Drewry <wad-F7+t8E8rja9g9hUCZPvPmw@public.gmane.org>,
Daniel Borkmann <daniel-FeC+5ew28dpmcu3hnIyYJQ@public.gmane.org>,
Network Development
<netdev-u79uwXL29TY76Z2rM5mHXA@public.gmane.org>,
Linux Containers
<containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org>,
Alexei Starovoitov <ast-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>,
Andy Lutomirski <luto-kltTT9wpgjJwATOyAt5JVQ@public.gmane.org>
Subject: Re: [PATCH net-next 0/3] eBPF Seccomp filters
Date: Tue, 13 Feb 2018 07:47:33 -0800 [thread overview]
Message-ID: <CAGXu5jLiYh0rSRuJ_-2xLB03Wod5G07njpoESR4SnmsmiUnsEw__32633.4561490969$1518536904$gmane$org@mail.gmail.com> (raw)
In-Reply-To: <20180213154244.GA3292-du9IEJ8oIxHXYT48pCVpJ3c7ZZ+wIVaZYkHkVr5ML8kVGlcevz2xqA@public.gmane.org>
On Tue, Feb 13, 2018 at 7:42 AM, Sargun Dhillon <sargun-GaZTRHToo+CzQB+pC5nmwQ@public.gmane.org> wrote:
> This patchset enables seccomp filters to be written in eBPF. Although,
> this patchset doesn't introduce much of the functionality enabled by
> eBPF, it lays the ground work for it.
>
> It also introduces the capability to dump eBPF filters via the PTRACE
> API in order to make it so that CHECKPOINT_RESTORE will be satisifed.
> In the attached samples, there's an example of this. One can then use
> BPF_OBJ_GET_INFO_BY_FD in order to get the actual code of the program,
> and use that at reload time.
>
> The primary reason for not adding maps support in this patchset is
> to avoid introducing new complexities around PR_SET_NO_NEW_PRIVS.
> If we have a map that the BPF program can read, it can potentially
> "change" privileges after running. It seems like doing writes only
> is safe, because it can be pure, and side effect free, and therefore
> not negatively effect PR_SET_NO_NEW_PRIVS. Nonetheless, if we come
> to an agreement, this can be in a follow-up patchset.
What's the reason for adding eBPF support? seccomp shouldn't need it,
and it only makes the code more complex. I'd rather stick with cBPF
until we have an overwhelmingly good reason to use eBPF as a "native"
seccomp filter language.
-Kees
>
>
> Sargun Dhillon (3):
> bpf, seccomp: Add eBPF filter capabilities
> seccomp, ptrace: Add a mechanism to retrieve attached eBPF seccomp
> filters
> bpf: Add eBPF seccomp sample programs
>
> arch/Kconfig | 7 ++
> include/linux/bpf_types.h | 3 +
> include/linux/seccomp.h | 12 +++
> include/uapi/linux/bpf.h | 2 +
> include/uapi/linux/ptrace.h | 5 +-
> include/uapi/linux/seccomp.h | 15 ++--
> kernel/bpf/syscall.c | 1 +
> kernel/ptrace.c | 3 +
> kernel/seccomp.c | 185 ++++++++++++++++++++++++++++++++++++++-----
> samples/bpf/Makefile | 9 +++
> samples/bpf/bpf_load.c | 9 ++-
> samples/bpf/seccomp1_kern.c | 17 ++++
> samples/bpf/seccomp1_user.c | 34 ++++++++
> samples/bpf/seccomp2_kern.c | 24 ++++++
> samples/bpf/seccomp2_user.c | 66 +++++++++++++++
> 15 files changed, 362 insertions(+), 30 deletions(-)
> create mode 100644 samples/bpf/seccomp1_kern.c
> create mode 100644 samples/bpf/seccomp1_user.c
> create mode 100644 samples/bpf/seccomp2_kern.c
> create mode 100644 samples/bpf/seccomp2_user.c
>
> --
> 2.14.1
>
--
Kees Cook
Pixel Security
next parent reply other threads:[~2018-02-13 15:47 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20180213154244.GA3292@ircssh-2.c.rugged-nimbus-611.internal>
[not found] ` <20180213154244.GA3292-du9IEJ8oIxHXYT48pCVpJ3c7ZZ+wIVaZYkHkVr5ML8kVGlcevz2xqA@public.gmane.org>
2018-02-13 15:47 ` Kees Cook [this message]
2018-02-14 0:47 ` [PATCH net-next 0/3] eBPF Seccomp filters Mickaël Salaün
[not found] ` <CAGXu5jLiYh0rSRuJ_-2xLB03Wod5G07njpoESR4SnmsmiUnsEw@mail.gmail.com>
[not found] ` <CAGXu5jLiYh0rSRuJ_-2xLB03Wod5G07njpoESR4SnmsmiUnsEw-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2018-02-13 16:29 ` Sargun Dhillon
2018-02-14 17:25 ` Andy Lutomirski
[not found] ` <CAMp4zn8VNurTjmrUtHnaK21A4hUQQz5tnarj15vmTU+TjY79XA@mail.gmail.com>
[not found] ` <CAMp4zn8VNurTjmrUtHnaK21A4hUQQz5tnarj15vmTU+TjY79XA-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2018-02-13 17:02 ` Jessie Frazelle
[not found] ` <CAEk6tEw3ty0kBH+06TYt4=Ywt-4_cHBa9f8p3ajMghtjRkHmMg@mail.gmail.com>
[not found] ` <CAEk6tEw3ty0kBH+06TYt4=Ywt-4_cHBa9f8p3ajMghtjRkHmMg-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2018-02-13 17:07 ` Brian Goff
2018-02-13 17:31 ` Sargun Dhillon
[not found] ` <CAMp4zn-Lw0grNrCyjHJZUje1Aznaj03iAUWZ86ki68MZMN1-zA@mail.gmail.com>
[not found] ` <CAMp4zn-Lw0grNrCyjHJZUje1Aznaj03iAUWZ86ki68MZMN1-zA-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2018-02-13 20:16 ` Kees Cook
[not found] ` <CAGXu5jKv3QFVKLhok1JWiPamE0b4CqLTO-hx8sP0KWED921=6w@mail.gmail.com>
[not found] ` <CAGXu5jKv3QFVKLhok1JWiPamE0b4CqLTO-hx8sP0KWED921=6w-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2018-02-13 20:50 ` Tycho Andersen
2018-02-13 21:08 ` Paul Moore
[not found] ` <CALCETrV9xUd3XRgobTDgVNRFY_+o=pEDkfjvuxQ7w_UyH324zA@mail.gmail.com>
[not found] ` <CALCETrV9xUd3XRgobTDgVNRFY_+o=pEDkfjvuxQ7w_UyH324zA-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2018-02-14 17:32 ` Tycho Andersen
[not found] ` <20180214173222.kvos6izqcywkuyi5@cisco>
2018-02-15 4:30 ` Alexei Starovoitov
[not found] ` <20180215043027.zssmhvfdn7iz3rlz@ast-mbp.dhcp.thefacebook.com>
[not found] ` <20180215043027.zssmhvfdn7iz3rlz-+o4/htvd0TCa6kscz5V53/3mLCh9rsb+VpNB7YpNyf8@public.gmane.org>
2018-02-15 8:35 ` Lorenzo Colitti via Containers
2018-02-15 16:05 ` Andy Lutomirski
2018-02-16 18:39 ` Sargun Dhillon
2018-02-13 20:33 Tom Hromatka
[not found] ` <7eb1497e-e5f3-c5ba-e255-7f510795b51d-QHcLZuEGTsvQT0dZR+AlfA@public.gmane.org>
2018-02-13 20:35 ` Kees Cook
[not found] ` <CAGXu5jJZgrgLrhkZO33RNdOds8zwnnOZh+rqwguxJM+zm=EJ7g@mail.gmail.com>
[not found] ` <CAGXu5jJZgrgLrhkZO33RNdOds8zwnnOZh+rqwguxJM+zm=EJ7g-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2018-02-13 20:38 ` Tom Hromatka
-- strict thread matches above, loose matches on Subject: below --
2018-02-13 15:42 Sargun Dhillon
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAGXu5jLiYh0rSRuJ_-2xLB03Wod5G07njpoESR4SnmsmiUnsEw__32633.4561490969$1518536904$gmane$org@mail.gmail.com' \
--to=keescook-f7+t8e8rja9g9huczpvpmw@public.gmane.org \
--cc=ast-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org \
--cc=containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org \
--cc=daniel-FeC+5ew28dpmcu3hnIyYJQ@public.gmane.org \
--cc=luto-kltTT9wpgjJwATOyAt5JVQ@public.gmane.org \
--cc=netdev-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=sargun-GaZTRHToo+CzQB+pC5nmwQ@public.gmane.org \
--cc=wad-F7+t8E8rja9g9hUCZPvPmw@public.gmane.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).