> On Sep 25, 2020, at 12:42 PM, Kees Cook <keescook@xxxxxxxxxxxx> wrote: > > On Fri, Sep 25, 2020 at 11:45:05AM -0500, YiFei Zhu wrote: >> On Thu, Sep 24, 2020 at 10:04 PM YiFei Zhu <zhuyifei1999@xxxxxxxxx> wrote: >>>> Why do the prepare here instead of during attach? (And note that it >>>> should not be written to fail.) >>> >>> Right. >> >> During attach a spinlock (current->sighand->siglock) is held. Do we >> really want to put the emulator in the "atomic section"? > > It's a good point, but I had some other ideas around it that lead to me > a different conclusion. Here's what I've got in my head: > > I don't view filter attach (nor the siglock) as fastpath: the lock is > rarely contested and the "long time" will only be during filter attach. > > When performing filter emulation, all the syscalls that are already > marked as "must run filter" on the previous filter can be skipped for > the new filter, since it cannot change the outcome, which makes the > emulation step faster. > > The previous filter's bitmap isn't "stable" until siglock is held. > > If we do the emulation step before siglock, we have to always do full > evaluation of all syscalls, and then merge the bitmap during attach. > That means all filters ever attached will take maximal time to perform > emulation. > > I prefer the idea of the emulation step taking advantage of the bitmap > optimization, since the kernel spends less time doing work over the life > of the process tree. It's certainly marginal, but it also lets all the > bitmap manipulation stay in one place (as opposed to being split between > "prepare" and "attach"). > > What do you think? > > I’m wondering if we should be much much lazier. We could potentially wait until someone actually tries to do a given syscall before we try to evaluate whether the result is fixed.
