On Wed, 14 Feb 2024 19:19:27 +0000 "Edgecombe, Rick P" <rick.p.edgecombe@xxxxxxxxx> wrote: > On Wed, 2024-02-14 at 19:32 +0100, Petr Tesařík wrote: > > > What use case needs to have the sandbox both protected from the > > > kernel > > > (trusted operations) and non-privileged (the kernel protected from > > > it > > > via CPL3)? It seems like opposite things. > > > > I think I have mentioned one: parsing keys for the trusted keyring. > > The > > parser is complex enough to be potentially buggy, but the security > > folks have already dismissed the idea to run it as a user mode > > helper. > > Ah, I didn't realize the kernel needed to be protected from the key > parsing part because you called it out as a trusted operation. So on > the protect-the-kernel-side it's similar to the microkernel security > reasoning. > > Did I get the other part wrong - that you want to protect the sandbox > from the rest of kernel as well? Protecting the sandbox from the rest of the kernel is out of scope. However, different sandboxes should be protected from each other. Petr T
