[lkml]   [2009]   [Dec]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[PATCH 3/3] Security: Document prctl(PR_{GET,SET}_NETWORK). (v3)
    Explain the purpose, interface, and semantics of the
    prctl(PR_{GET,SET}_network) facility and LSM.

    Also reference some example userland clients.

    Signed-off-by: Michael Stone <>
    Documentation/prctl/network.txt | 74 +++++++++++++++++++++++++++++++++++++++
    1 files changed, 74 insertions(+), 0 deletions(-)
    create mode 100644 Documentation/prctl/network.txt

    diff --git a/Documentation/prctl/network.txt b/Documentation/prctl/network.txt
    new file mode 100644
    index 0000000..8b45d23
    --- /dev/null
    +++ b/Documentation/prctl/network.txt
    @@ -0,0 +1,74 @@
    +Daniel Bernstein has observed [1] that security-conscious userland processes
    +may benefit from the ability to irrevocably remove their ability to create,
    +bind, connect to, or send messages except in the case of previously connected
    +sockets or AF_UNIX filesystem sockets.
    +This facility is particularly attractive to security platforms like OLPC
    +Bitfrost [2] and to isolation programs like Rainbow [3] and Plash [4] because:
    + * it integrates well with standard techniques for writing privilege-separated
    + Unix programs
    + * it integrates well with the need to perform limited socket I/O, e.g., when
    + running X clients
    + * it's available to unprivileged programs
    + * it's a discretionary feature available to all of distributors,
    + administrators, authors, and users
    + * its effect is entirely local, rather than global (like netfilter)
    + * it's simple enough to have some hope of being used correctly
    +After considering implementations based on the Linux Security Module (LSM)
    +framework, on SELinux, on network namespaces (CLONE_NEWNET), on direct
    +modification of the kernel syscall and task_struct APIs and after seeking
    +advice from members of LKML, we came to the conclusion that the best way to
    +implement this feature was to extend the prctl() framework with a new pair of
    +options named PR_{GET,SET}_NETWORK and to write an LSM to implement the
    +resulting PR_NETWORK_OFF semantics. These options cause prctl() to read or
    +modify "current->network".
    +current->network is a flags field which is preserved across all variants of
    +fork() and exec().
    +Writes which attempt to clear bits in current->network return -EPERM.
    +The default value for current->network is named PR_NETWORK_ON and is defined
    +to be 0.
    +Presently, only one flag is defined: PR_NETWORK_OFF.
    +More flags may be defined in the future if they become needed.
    +Attempts to set undefined flags result in -EINVAL.
    +When PR_NETWORK_OFF is set, implementations of syscalls which may be used by
    +the current process to perform autonomous networking will return -EPERM. For
    +example, calls to socket(), bind(), connect(), sendmsg(), and ptrace() will
    +return -EPERM except for cases we are manipulating an AF_UNIX socket or, in the
    +case of sendmsg(), unless we are manipulating a previously connected socket,
    +i.e. one with
    + msg.msg_name == NULL && msg.msg_namelen == 0
    +or, in the case of ptrace(), unless we are ptracing() a process which has all
    +of our own networking restriction flags set.

     \ /
      Last update: 2009-12-24 02:47    [W:0.023 / U:5.700 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site