Messages in this thread | | | From | Andy Lutomirski <> | Date | Fri, 25 Jul 2014 11:30:48 -0700 | Subject | General flags to turn things off (getrandom, pid lookup, etc) |
| |
[new thread because this sort of combines two threads]
There is recent interest in having a way to turn generally-available kernel features off. Maybe we should add a good one so we can stop bikeshedding and avoid proliferating dumb interfaces.
Things that might want to be turn-off-able include: - getrandom with GRND_RANDOM [from the getrandom threads] - Any lookup of a non-self pid [from the capsicum thread] - Any lookup of a pid outside the caller thread group [capsicum] - Various architectural things (personal wishlist), e.g.: - RDTSC and userspace HPET access - CPUID? - 32-bit GDT code segments [huge attack surface] - 64-bit GDT code segments [probably pointless]
I would propose a new syscall for this:
long restrict_userspace(int mode, int type, int value, int flags);
mode is RESTRICT_SET, RESTRICT_GET, or RESTRICT_LOCK.
type is RESTRICT_GRND_RANDOM, RESTRICT_PID_SCOPE, RESTRICT_X86_TIMING, etc.
Value is zero if RESTRICT_GET. Otherwise value is the desired value, generally 0 or 1. For RESTRICT_PID_SCOPE, value would be RESTRICT_PID_SCOPE_ANY, RESTRICT_PID_SCOPE_THREADGROUP, or RESTRICT_PID_SCOPE_SELF.
flags must be zero. Someday, someone will propose a thread-sync flag.
restrict_userspace requires either no_new_privs or CAP_SYS_ADMIN in the current user namespace.
Thoughts?
--Andy
-- Andy Lutomirski AMA Capital Management, LLC
| |