On Thu, May 13, 2021 at 9:53 AM Andy Lutomirski <luto@xxxxxxxxxxxxxx> wrote: > > On May 12, 2021, at 10:26 PM, YiFei Zhu <zhuyifei1999@xxxxxxxxx> wrote: > > > > On Wed, May 12, 2021 at 5:36 PM Alexei Starovoitov > > <alexei.starovoitov@xxxxxxxxx> wrote: > >> Typically the verifier does all the checks at load time to avoid > >> run-time overhead during program execution. Then at attach time we > >> check that attach parameters provided at load time match exactly > >> to those at attach time. ifindex, attach_btf_id, etc fall into this category. > >> Doing something similar it should be possible to avoid > >> doing get_dumpable() at run-time. > > > > Do you mean to move the check of dumpable to load time instead of > > runtime? I do not think that makes sense. A process may arbitrarily > > set its dumpable attribute during execution via prctl. A process could > > do set itself to non-dumpable, before interacting with sensitive > > information that would better not be possible to be dumped (eg. > > ssh-agent does this [1]). Therefore, being dumpable at one point in > > time does not indicate anything about whether it stays dumpable at a > > later point in time. Besides, seccomp filters are inherited across > > clone and exec, attaching to many tasks with no option to detach. What > > should the load-time check of task dump-ability be against? The > > current task may only be the tip of an iceburg. > > > > [1] https://github.com/openssh/openssh-portable/blob/2dc328023f60212cd29504fc05d849133ae47355/ssh-agent.c#L1398 > > > > > > First things first: why are you checking dumpable at all? Once you figure out why and whether it’s needed, you may learn something about what task to check. > > I don’t think checking dumpable makes any sense. ptrace. We don't want to extend one's ability to read another process's memory if they could not read it via ptrace (process_vm_readv or ptrace(PTRACE_PEEK{TEXT,DATA})). The constraints for ptrace to access a target's memory I've written down earlier [1], but tl;dr: to be at least as restrictive as ptrace, a tracer without CAP_PTRACE cannot trace a non-dumpable process. What's the target process (i.e. the process whose memory is being read) in the context of a seccomp filter? The current task. Does that answer your questions? [1] https://lore.kernel.org/bpf/CABqSeAT8iz-VhWjWqABqGbF7ydkoT7LmzJ5Do8K1ANQvQK=FJQ@xxxxxxxxxxxxxx/ YiFei Zhu
