Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S935160AbaGYUP6 (ORCPT ); Fri, 25 Jul 2014 16:15:58 -0400 Received: from mx1.redhat.com ([209.132.183.28]:16166 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932508AbaGYUPw (ORCPT ); Fri, 25 Jul 2014 16:15:52 -0400 Date: Fri, 25 Jul 2014 16:15:07 -0400 From: Dave Jones To: Andy Lutomirski Cc: "Eric W. Biederman" , Julien Tinnes , David Drysdale , Al Viro , Paolo Bonzini , LSM List , Greg Kroah-Hartman , Paul Moore , James Morris , Linux API , Meredydd Luff , Christoph Hellwig , "linux-kernel@vger.kernel.org" , Kees Cook , "Theodore Ts'o" , Henrique de Moraes Holschuh , linux-crypto@vger.kernel.org Subject: Re: General flags to turn things off (getrandom, pid lookup, etc) Message-ID: <20140725201507.GA23410@redhat.com> Mail-Followup-To: Dave Jones , Andy Lutomirski , "Eric W. Biederman" , Julien Tinnes , David Drysdale , Al Viro , Paolo Bonzini , LSM List , Greg Kroah-Hartman , Paul Moore , James Morris , Linux API , Meredydd Luff , Christoph Hellwig , "linux-kernel@vger.kernel.org" , Kees Cook , Theodore Ts'o , Henrique de Moraes Holschuh , linux-crypto@vger.kernel.org References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Jul 25, 2014 at 11:30:48AM -0700, Andy Lutomirski wrote: > There is recent interest in having a way to turn generally-available > kernel features off. Maybe we should add a good one so we can stop > bikeshedding and avoid proliferating dumb interfaces. > > Things that might want to be turn-off-able include: > - getrandom with GRND_RANDOM [from the getrandom threads] > - Any lookup of a non-self pid [from the capsicum thread] > - Any lookup of a pid outside the caller thread group [capsicum] > - Various architectural things (personal wishlist), e.g.: > - RDTSC and userspace HPET access > - CPUID? > - 32-bit GDT code segments [huge attack surface] > - 64-bit GDT code segments [probably pointless] I'm not sure there's value in disabling cpuid dev interface, when the instruction is unprivileged. > I would propose a new syscall for this: > > long restrict_userspace(int mode, int type, int value, int flags); do the restrictions happen system-wide like in say SELinux, or only within the calling process, like seccomp ? Dave -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/