lkml.org 
[lkml]   [2004]   [Aug]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: secure computing for 2.6.7
From
Date
On Sun, 2004-08-01 at 11:01, Andrea Arcangeli wrote:
> Seems like a few people is interested in what you suggest above. it'd be
> very trivial to add a seccomp-mode = 2 that adds more syscalls like the
> socket syscalls like accept/sendfile/send/recv and also the open syscall
> (which means you want to use chroot still). In the code you can see I
> wrote it so that more modes can be added freely. I mean it has some
> flexibility already. vsftpd could enable the seccomp mode 2 on itself
> after it has initialized.

As you begin moving toward increasingly general modes of operation, and
get to the point of having to filter actual system call parameters, I
think you would be better served by using an LSM and mediating access to
the actual kernel objects.

For your own particular mode of operation, have you considered running
the untrusted code in a virtual machine, using something like Xen,
rather than trying to create a "safe" subset of kernel calls for a
single kernel instance?

--
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 14:04    [W:0.116 / U:8.076 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site