[lkml]   [2003]   [Sep]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectSyscall security

    I'm wondering if there is any way to provide per process bitmasks of
    available/illegal syscalls. Obviously this should most likely be
    inherited through exec/fork.

    For example specyfying that pid N should return -ENOSYS on all syscalls
    except read/write/exit.

    The reason I'm asking is because I want to run totally untrusted
    statically linked binary code (automatically compiled from user
    submitted untrusted sources) which only needs read/write access to stdio
    which means it only requires syscalls read/write/exit + a few more for
    memory alloc/free (like brk) + a few more generated before main is called
    (execve and uname I believe).

    Currently I'm running the code in a chroot'ed environment (to an empty
    dir) under a 'nobody' uid/gid with no open fd's except for std in/out/err
    with limits for mem, processor usage, open files, processes (to 1), etc.
    Obviously this still allows calling code like 'time', 'getuid', etc and
    the like.
    Modifying the compiler (or removing the headers) won't help since at worst
    I can code it in asm in the source or even in a plain byte table.

    I have a working (very much a hack) patch which turns of all but 7 (or
    so) of the syscalls (via pseudo-bitmaps).

    Basically my question is: has this been done before (if so where/when?),
    what would be considered 'the right' way to do this, would this be a
    feature to include in the main kernel source?



    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 13:48    [W:0.019 / U:25.176 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site