Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753747AbbFIVqA (ORCPT ); Tue, 9 Jun 2015 17:46:00 -0400 Received: from mail-vn0-f54.google.com ([209.85.216.54]:44299 "EHLO mail-vn0-f54.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753223AbbFIVpu (ORCPT ); Tue, 9 Jun 2015 17:45:50 -0400 MIME-Version: 1.0 In-Reply-To: <20150609212222.GE2045@hopstrocity> References: <1433369396-13360-1-git-send-email-tycho.andersen@canonical.com> <20150604183149.GA560@redhat.com> <20150604210529.GJ3160@smitten> <20150605211650.GA25718@redhat.com> <20150609212222.GE2045@hopstrocity> Date: Tue, 9 Jun 2015 14:45:49 -0700 X-Google-Sender-Auth: 2YbKhXZ5Z1AiMk-6MgrBj2nodk4 Message-ID: Subject: Re: [PATCH v2] seccomp: add ptrace options for suspend/resume From: Kees Cook To: Tycho Andersen Cc: Oleg Nesterov , Andy Lutomirski , LKML , Linux API , Will Drewry , Roland McGrath , Pavel Emelyanov , "Serge E. Hallyn" Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1591 Lines: 49 On Tue, Jun 9, 2015 at 2:22 PM, Tycho Andersen wrote: > Hi Kees, Andy, > > On Fri, Jun 05, 2015 at 11:16:50PM +0200, Oleg Nesterov wrote: >> Hi Tycho, >> >> On 06/04, Tycho Andersen wrote: >> > > > +#ifdef CONFIG_CHECKPOINT_RESTORE >> > > > +bool may_suspend_seccomp(void) >> > > > +{ >> > > > + if (!capable(CAP_SYS_ADMIN)) >> > > > + return false; >> > > > + >> > > > + if (current->seccomp.mode != SECCOMP_MODE_DISABLED) >> > > > + return false; >> > > >> > > Heh. OK, I won't argue with the new check too ;) >> > >> > Actually now that I think about it I agree with you, these checks >> > don't seem necessary. Even inside a user namespace, if you can ptrace >> > a process you can make it do whatever you want irrespective of >> > seccomp, as long as it has the necessary capabilities. Once the >> > seccomp checks are run after ptrace, they'll be enforced so you >> > couldn't have it call whatever you want in the first place. >> >> Good ;) >> >> > Still, perhaps I'm missing something... >> >> Kees, Andy? > > Any thoughts on removing may_suspend_seccomp() all together? As in, just open-code the check? That would be fine by me. > I sent v3 with this still in it, but I can send v4 without it if we > are all in agreement. -Kees -- Kees Cook Chrome OS Security -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/