File paths? [LWN.net]

File paths?

Posted Jun 3, 2018 0:47 UTC (Sun) by Cyberax (✭ supporter ✭, #52523)
Parent article: Deferring seccomp decisions to user space

How does it access the file paths? I guess the filter can just ptrace the requesting process, but that's already piling up overhead on top of the overhead.

Perhaps a special case for strings could be added?

to post comments

File paths?

Posted Jun 3, 2018 1:49 UTC (Sun) by dezgeg (guest, #92243) [Link] (3 responses)

Presumably with process_vm_readv(). Still a user/kernel context switch per string but still much, much better than ptrace()...

File paths?

Posted Jun 3, 2018 3:11 UTC (Sun) by roc (subscriber, #30627) [Link]

rr uses /proc/<pid>/mem to read tracee memory instead of PTRACE_PEEKUSER, even though it's already ptracing, because the former is so much faster. I assume gdb does too.

File paths?

Posted Jun 3, 2018 5:16 UTC (Sun) by Cyberax (✭ supporter ✭, #52523) [Link] (1 responses)

Still, a special case for automatic transmission of string arguments might make sense. open/stat calls are probably 90% of security-related calls and special-casing their arguments might give a sizable performance benefit.

File paths?

Posted Jun 3, 2018 13:21 UTC (Sun) by jhoblitt (subscriber, #77733) [Link]

I wonder if anyone has gathered statics on syscall distribution for various types of workload?

I suspect that `statfs()` and `access()` are also frequent syscalls with string params. File distribution programs, such as HTTP servers, can produce a fairly extreme number of `access()` calls.

File paths?

Posted Jun 4, 2018 21:37 UTC (Mon) by wahern (subscriber, #37304) [Link] (3 responses)

Isn't that susceptible to a race condition? systrace (https://en.wikipedia.org/wiki/Systrace) never saw widespread adoption exactly because of the race condition, both on Linux and on OpenBSD (with an in-kernel implementation). The TOCTTOU race is that a signal handler or thread changes the path between the check and the actual open.

The solution is to copy the path or otherwise make it immutable. That's costly and it's why the the seccomp BPF filter originally didn't support processing the file path string. Has that changed?

File paths?

Posted Jun 4, 2018 21:41 UTC (Mon) by Cyberax (✭ supporter ✭, #52523) [Link] (2 responses)

No, there's no race condition. The kernel code would have to copy strings into the message sent to the userspace helper.

The helper code then can do all the required open/access/stat stuff and return the results as a file descriptor (open) or a static block of data (stat/access).

Obviously, copying the parameters will add some overhead, but it should be way less than doing additional ptrace/read_mem calls from the userspace helper.

File paths?

Posted Jun 5, 2018 19:26 UTC (Tue) by wahern (subscriber, #37304) [Link] (1 responses)

Is that how it works _now_? Is any of that work already in place?

File paths?

Posted Jun 5, 2018 21:34 UTC (Tue) by Cyberax (✭ supporter ✭, #52523) [Link]

Right now BPF syscall filter programs can't access the string arguments at all, so there's no problem.