lkml.org 
[lkml]   [2011]   [May]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 3/5] v2 seccomp_filters: Enable ftrace-based system call filtering
On Thu, May 26, 2011 at 12:38:36PM +0200, Ingo Molnar wrote:
>
> * Gleb Natapov <gleb@redhat.com> wrote:
>
> > On Thu, May 26, 2011 at 11:57:51AM +0300, Pekka Enberg wrote:
> > > Hi Avi,
> > >
> > > On Thu, May 26, 2011 at 11:49 AM, Avi Kivity <avi@redhat.com> wrote:
> > >
> > > > You mean each thread will have a different security context?  I
> > > > don't see the point.  All threads share all of memory so it
> > > > would be trivial for one thread to exploit another and gain all
> > > > of its privileges.
> > >
> > > So how would that happen? I'm assuming that once the security
> > > context has been set up for a thread, you're not able to change
> > > it after that. You'd be able to exploit other threads through
> > > shared memory but how would you gain privileges?
> >
> > By tricking other threads to execute code for you. Just replace
> > return address on the other's thread stack.
>
> That kind of exploit is not possible if the worker pool consists of
> processes - which would be rather easy to achieve with tools/kvm/.
>
Well, of course. There original question was about threads.

> In that model each process has its own stack, not accessible to other
> worker processes. They'd only share the guest RAM image and some
> (minimal) global state.
>
> This way the individual devices are (optionally) isolated from each
> other. In a way this is a microkernel done right ;-)
>
But doesn't this design suffer the same problem as microkernel? Namely
a lot of slow IPCs?

--
Gleb.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2011-05-26 12:49    [W:0.089 / U:1.484 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site