lkml.org 
[lkml]   [2011]   [Jun]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH v9 03/13] seccomp_filter: new mode with configurable syscall filters
    On Thu, 23 Jun 2011, Will Drewry wrote:

    > This change adds a new seccomp mode which specifies the allowed system
    > calls dynamically. When in the new mode (2), all system calls are
    > checked against process-defined filters - first by system call number,
    > then by a filter string. If an entry exists for a given system call and
    > all filter predicates evaluate to true, then the task may proceed.
    > Otherwise, the task is killed.

    This would be a great help for OpenSSH to improve pre-authentication
    privilege separation. We use a separate process that is chroot()ed and
    switched to a dedicated UID to limit the effects of compromise in the
    complex network-facing code, but a vulnerability in this process
    still allows an attacker to open new network sockets (e.g. to proxy
    attacks through your firewall) or attempt to exploit local kernel bugs.

    If we are able to restrict the syscalls the unprivileged process can make
    then it becomes very difficult for an attacker to do anything useful -
    they won't be able to open new sockets and a narrow set of available
    syscalls makes exploitable kernel bugs much harder to find or reach.

    The current SECCOMP sandbox is too restrictive, because we need to
    poll/select() on sockets and mmap() to allocate new memory. Allowing
    application developers to specify which syscalls are allowed is a
    good, low-cost way to make the SECCOMP sandbox much more useful.

    -d


    \
     
     \ /
      Last update: 2011-06-24 09:41    [W:3.689 / U:0.088 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site