Messages in this thread |  | | Date | Wed, 25 May 2011 12:11:52 -0700 | From | Kees Cook <> | Subject | Re: [PATCH 3/5] v2 seccomp_filters: Enable ftrace-based system call filtering |
| |
Hi Linus,
On Wed, May 25, 2011 at 11:42:44AM -0700, Linus Torvalds wrote: > And who would *use* this thing in real life? Nobody. In order to sell > me on a new security interface, give me a real actual use case that is > security-conscious and relevant to real users. > [...] > And per-system-call permissions are very dubious. What system calls > don't you want to succeed? That ioctl? You just made it impossible to > do a modern graphical application. Yet the kind of thing where we > would _want_ to help users is in making it easier to sandbox something > like the adobe flash player. But without accelerated direct rendering, > that's not going to fly, is it?
Uhm, what? Chrome would use it. And LXC would. Those were stated very early on as projects extremely interested in syscall filtering. And that's just the start, I can easily imagine Apache modules enforcing a very narrow band of syscalls, or just about anything else that could be in a position of running potentially malicious code. This could be very far-reaching, IMO.
-Kees
-- Kees Cook Ubuntu Security Team
|  |