On Mon, Nov 3, 2014 at 10:25 AM, Julien Tinnes <jln@xxxxxxxxxxxx> wrote: > On Mon, Nov 3, 2014 at 9:37 AM, David Drysdale <drysdale@xxxxxxxxxx> wrote: >> >> On Mon, Nov 3, 2014 at 3:42 PM, Andy Lutomirski <luto@xxxxxxxxxxxxxx> >> wrote: >> > On Mon, Nov 3, 2014 at 7:20 AM, Al Viro <viro@xxxxxxxxxxxxxxxxxx> wrote: >> >> On Mon, Nov 03, 2014 at 11:48:23AM +0000, David Drysdale wrote: >> >>> Add a new O_BENEATH flag for openat(2) which restricts the >> >>> provided path, rejecting (with -EACCES) paths that are not beneath >> >>> the provided dfd. In particular, reject: >> >>> - paths that contain .. components >> >>> - paths that begin with / >> >>> - symlinks that have paths as above. >> >> >> >> Yecch... The degree of usefulness aside (and I'm not convinced that it >> >> is non-zero), >> > >> > This is extremely useful in conjunction with seccomp. >> >> Yes, that was my understanding of how the Chrome[OS] folk wanted >> to use it. > > > Yes, exactly. Without this, if we want to give a sandboxed process A access > to a directory, we need to: > 1. Create a new 'broker" process B > 2. Make sure to have an IPC channel between A and B. > 3. SIGSYS open() and openat() in A via seccomp-bpf > 4. Have an async-signal-safe handler that can IPC open / openat. You can do this with user namespaces, too. But this is way more complicated than it should be, and it has a lot more overhead. --Andy > > There is a lot of hidden complexity in such a set-up. For instance, if you > need to prevent contention, the number of threads in the broker B should > scale automatically. > > This is 'fine' (but undesirable) for a big beast such as Chromium which > needs such a complex set-ups anyways, but David's patch would make it a lot > easier to build a sandbox and whitelist directories for everyone, simply by > enforcing O_BENEATH in seccomp and whitelisting open directory file > descriptors in the sandboxed process. > > Julien -- Andy Lutomirski AMA Capital Management, LLC -- To unsubscribe from this list: send the line "unsubscribe linux-api" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
