User: Password:
|
|
Subscribe / Log in / New account

Systemd gets seccomp filter support

Systemd gets seccomp filter support

Posted Jul 17, 2012 18:25 UTC (Tue) by iabervon (subscriber, #722)
In reply to: Systemd gets seccomp filter support by walters
Parent article: Systemd gets seccomp filter support

It seems to me like it wouldn't be too hard to assemble the filter from a combination of per-program information and per-library information. If systemd knows what your NSS configuration is, it should be able to paste in the appropriate filter. (It's generating the actual BPF from your description anyway, at least in the current implementation, so it could even say 'malloc isn't actually a system call, but I know what you need is brk mmap munmap open("/dev/zero").')

The nice thing about seccomp is that userspace is responsible for providing the policy, and the kernel just enforces it, and userspace can do a lot more analysis than is appropriate for the kernel to do.


(Log in to post comments)

Systemd gets seccomp filter support

Posted Jul 17, 2012 18:46 UTC (Tue) by walters (subscriber, #7396) [Link]

The nice thing about seccomp is that userspace is responsible for providing the policy, and the kernel just enforces it,
That's true of SELinux as well; I assume you're referring to AppArmor here or something. Or unless you're talking about the ability of a userspace program to *dynamically* adjust its filter in response to configuration files or environment, in which case yes it's definitely more flexible (although the proposed systemd syntax doesn't allow run-time mutation). What would be kind of interesting though is if shared libraries could come with lists of system calls they could possibly make. That way if e.g. your app upgrades from GLib 2.28 to 2.30 (in between a lot of things changed, but e.g. I switched the main loop to use eventfd instead of pipe()), your app wouldn't have to change. That'd require some integration work at the systemd side to introspect the binary before launching it and determine what shared libraries are used.

Systemd gets seccomp filter support

Posted Jul 17, 2012 19:24 UTC (Tue) by iabervon (subscriber, #722) [Link]

I'm talking about the parent of a process being able to dynamically adjust the policy for the process right before exec. In SELinux, the policy is written by userspace, but the kernel controls determining the security domain during exec(), and that selects the applicable policy, so there's no userspace involvement at the last minute. Userspace isn't necessarily given a chance to react to changes in NSS configuration between when the configuration last changed and starting new restricted processes.

AFAICT, the systemd syntax doesn't exclude the possibility of listing library functions in your syscall list, and having that trigger run-time mutation. And systemd is obviously constructing BFP based on a combination of your list and stuff it knows, if for no other reason than that it has to figure out syscall numbers from names.


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds