PoC: convert AppArmor parser to SandBox Mode
| From: | Petr Tesarik <petrtesarik-AT-huaweicloud.com> | |
| To: | Dave Hansen <dave.hansen-AT-intel.com> | |
| Subject: | [RFC 0/5] PoC: convert AppArmor parser to SandBox Mode | |
| Date: | Thu, 22 Feb 2024 14:12:25 +0100 | |
| Message-ID: | <20240222131230.635-1-petrtesarik@huaweicloud.com> | |
| Cc: | Petr Tesařík <petr-AT-tesarici.cz>, Petr Tesarik <petrtesarik-AT-huaweicloud.com>, Jonathan Corbet <corbet-AT-lwn.net>, Thomas Gleixner <tglx-AT-linutronix.de>, Ingo Molnar <mingo-AT-redhat.com>, Borislav Petkov <bp-AT-alien8.de>, Dave Hansen <dave.hansen-AT-linux.intel.com>, "maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT)" <x86-AT-kernel.org>, "H. Peter Anvin" <hpa-AT-zytor.com>, Andy Lutomirski <luto-AT-kernel.org>, Oleg Nesterov <oleg-AT-redhat.com>, Peter Zijlstra <peterz-AT-infradead.org>, Xin Li <xin3.li-AT-intel.com>, Arnd Bergmann <arnd-AT-arndb.de>, Andrew Morton <akpm-AT-linux-foundation.org>, Rick Edgecombe <rick.p.edgecombe-AT-intel.com>, Kees Cook <keescook-AT-chromium.org>, "Masami Hiramatsu (Google)" <mhiramat-AT-kernel.org>, Pengfei Xu <pengfei.xu-AT-intel.com>, Josh Poimboeuf <jpoimboe-AT-kernel.org>, Ze Gao <zegao2021-AT-gmail.com>, "Kirill A. Shutemov" <kirill.shutemov-AT-linux.intel.com>, Kai Huang <kai.huang-AT-intel.com>, David Woodhouse <dwmw-AT-amazon.co.uk>, Brian Gerst <brgerst-AT-gmail.com>, Jason Gunthorpe <jgg-AT-ziepe.ca>, Joerg Roedel <jroedel-AT-suse.de>, "Mike Rapoport (IBM)" <rppt-AT-kernel.org>, Tina Zhang <tina.zhang-AT-intel.com>, Jacob Pan <jacob.jun.pan-AT-linux.intel.com>, "open list:DOCUMENTATION" <linux-doc-AT-vger.kernel.org>, open list <linux-kernel-AT-vger.kernel.org>, Roberto Sassu <roberto.sassu-AT-huaweicloud.com>, John Johansen <john.johansen-AT-canonical.com>, Paul Moore <paul-AT-paul-moore.com>, James Morris <jmorris-AT-namei.org>, "Serge E. Hallyn" <serge-AT-hallyn.com>, apparmor-AT-lists.ubuntu.com, linux-security-module-AT-vger.kernel.org, Petr Tesarik <petr.tesarik1-AT-huawei-partners.com> | |
| Archive-link: | Article |
From: Petr Tesarik <petr.tesarik1@huawei-partners.com> [ For people newly added to Cc, this RFC is a reply to subsystem maintainers who asked for a real-world demonstration of how SandBox Mode could be used in practice. SandBox Mode itself was proposed in these two series (generic and x86): * https://lore.kernel.org/lkml/20240214113516.2307-1-petrte... * https://lore.kernel.org/lkml/20240214113035.2117-1-petrte... ] This patch series provides an example of running existing kernel code in a sandbox. It also adds some fixes and infrastructure to the base series. If you only want to see how the conversion itself might look like, skip straight to patch 5/5. Patches 1 and 2 amend the base patch series. Patches 3 and 4 are ported from my earlier proof of concept and adapted to work without adding too much other code. I am sending a complete WIP patch series so you can actually build and run the code. Disclaimer: This code is not ready for submission. It is incomplete and may contain bugs. It is provided here for the sole purpose of demonstrating how existing kernel code would be modified to run in a sandbox. PATCH 1/5 is a bug fix discovered after sending patch series v1. PATCH 2/5 allows to map a buffer into the sandbox at its kernel address. PATCH 3/5 is required to intercept calls to pre-selected kernel functions. PATCH 4/5 implements dynamic allocation in sandbox mode. PATCH 5/5 demonstrates how to convert existing kernel code to use SBM. Petr Tesarik (5): sbm: x86: fix SBM error entry path sbm: enhance buffer mapping API sbm: x86: infrastructure to fix up sandbox faults sbm: fix up calls to dynamic memory allocators apparmor: parse profiles in sandbox mode arch/x86/entry/entry_64.S | 10 ++- arch/x86/kernel/sbm/call_64.S | 20 +++++ arch/x86/kernel/sbm/core.c | 161 +++++++++++++++++++++++++++++++++- arch/x86/kernel/vmlinux.lds.S | 9 ++ include/linux/sbm.h | 77 ++++++++++++++++ kernel/sbm.c | 34 +++++++ mm/slab_common.c | 3 +- mm/slub.c | 17 ++-- mm/vmalloc.c | 11 +-- security/apparmor/crypto.c | 7 +- security/apparmor/policy.c | 29 ++++-- security/apparmor/secid.c | 3 +- 12 files changed, 352 insertions(+), 29 deletions(-) -- 2.34.1