Messages in this thread | | | From | Linus Torvalds <> | Date | Thu, 26 May 2011 10:17:09 -0700 | Subject | Re: [PATCH 3/5] v2 seccomp_filters: Enable ftrace-based system call filtering |
| |
On Thu, May 26, 2011 at 10:02 AM, Will Drewry <wad@chromium.org> wrote: > > Absolutely - that was what I meant :/ The patches do not currently > check creds at creation or again at use, which would lead to > unprivileged filters being used in a privileged context. Right now, > though, if setuid() is not allowed by the seccomp-filter, the process > will be immediately killed with do_exit(SIGKILL) on call -- thus > avoiding a silent failure.
Umm.
You do realize that there is a reason we don't allow random kill() system calls to succeed without privileges either?
So no, "we kill it with sigkill" is not safe *either*. It now is potentially a way to kill privileged processes that you didn't have permission to kill.
My point is that it all sounds designed for well-behaved processes. "kill it if it does something bad" sounds like a *wonderful* idea if you're doing a sandbox.
But it is suddenly potentially deadly if that capability is used by a malicious user for a process that isn't ready for it.
One option is to just not ever allow execve() from inside a restricted environment.
Linus -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |