> On Sep 25, 2020, at 4:49 PM, Kees Cook <keescook@xxxxxxxxxxxx> wrote: > > On Fri, Sep 25, 2020 at 02:07:46PM -0700, Andy Lutomirski wrote: >>> On Fri, Sep 25, 2020 at 1:37 PM Kees Cook <keescook@xxxxxxxxxxxx> wrote: >>> >>> On Fri, Sep 25, 2020 at 12:51:20PM -0700, Andy Lutomirski wrote: >>>> >>>> >>>>> On Sep 25, 2020, at 12:42 PM, Kees Cook <keescook@xxxxxxxxxxxx> wrote: >>>>> >>>>> On Fri, Sep 25, 2020 at 11:45:05AM -0500, YiFei Zhu wrote: >>>>>> On Thu, Sep 24, 2020 at 10:04 PM YiFei Zhu <zhuyifei1999@xxxxxxxxx> wrote: >>>>>>>> Why do the prepare here instead of during attach? (And note that it >>>>>>>> should not be written to fail.) >>>>>>> >>>>>>> Right. >>>>>> >>>>>> During attach a spinlock (current->sighand->siglock) is held. Do we >>>>>> really want to put the emulator in the "atomic section"? >>>>> >>>>> It's a good point, but I had some other ideas around it that lead to me >>>>> a different conclusion. Here's what I've got in my head: >>>>> >>>>> I don't view filter attach (nor the siglock) as fastpath: the lock is >>>>> rarely contested and the "long time" will only be during filter attach. >>>>> >>>>> When performing filter emulation, all the syscalls that are already >>>>> marked as "must run filter" on the previous filter can be skipped for >>>>> the new filter, since it cannot change the outcome, which makes the >>>>> emulation step faster. >>>>> >>>>> The previous filter's bitmap isn't "stable" until siglock is held. >>>>> >>>>> If we do the emulation step before siglock, we have to always do full >>>>> evaluation of all syscalls, and then merge the bitmap during attach. >>>>> That means all filters ever attached will take maximal time to perform >>>>> emulation. >>>>> >>>>> I prefer the idea of the emulation step taking advantage of the bitmap >>>>> optimization, since the kernel spends less time doing work over the life >>>>> of the process tree. It's certainly marginal, but it also lets all the >>>>> bitmap manipulation stay in one place (as opposed to being split between >>>>> "prepare" and "attach"). >>>>> >>>>> What do you think? >>>>> >>>>> >>>> >>>> I’m wondering if we should be much much lazier. We could potentially wait until someone actually tries to do a given syscall before we try to evaluate whether the result is fixed. >>> >>> That seems like we'd need to track yet another bitmap of "did we emulate >>> this yet?" And it means the filter isn't really "done" until you run >>> another syscall? eeh, I'm not a fan: it scratches at my desire for >>> determinism. ;) Or maybe my implementation imagination is missing >>> something? >>> >> >> We'd need at least three states per syscall: unknown, always-allow, >> and need-to-run-filter. >> >> The downsides are less determinism and a bit of an uglier >> implementation. The upside is that we don't need to loop over all >> syscalls at load -- instead the time that each operation takes is >> independent of the total number of syscalls on the system. And we can >> entirely avoid, say, evaluating the x32 case until the task tries an >> x32 syscall. >> >> I think it's at least worth considering. > > Yeah, worth considering. I do still think the time spent in emulation is > SO small that it doesn't matter running all of the syscalls at attach > time. The filters are tiny and fail quickly if anything "interesting" > start to happen. ;) > There’s a middle ground, too: do it lazily per arch. So we would allocate and populate the compat bitmap the first time a compat syscall is attempted and do the same for x32. This may help avoid the annoying extra memory usage and 3x startup overhead while retaining full functionality.
