Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
IronPort-PHdr: =?us-ascii?q?9a23=3At7fe9hYTzFzWu8AFvTC/vdT/LSx+4OfEezUN45?=
 =?us-ascii?q?9isYplN5qZps65bR7h7PlgxGXEQZ/co6odzbaP6Oa5AjFLvs/JmUtBWaQEbw?=
 =?us-ascii?q?UCh8QSkl5oK+++Imq/EsTXaTcnFt9JTl5v8iLzG0FUHMHjew+a+SXqvnYdFR?=
 =?us-ascii?q?rlKAV6OPn+FJLMgMSrzeCy/IDYbxlViDanbr5+MRu7oR/MusQYgYZuJaQ8xg?=
 =?us-ascii?q?bUqXZUZupawn9lK0iOlBjm/Mew+5Bj8yVUu/0/8sNLTLv3caclQ7FGFToqK2?=
 =?us-ascii?q?866tHluhnFVguP+2ATUn4KnRpSAgjK9w/1U5HsuSbnrOV92S2aPcrrTbAoXD?=
 =?us-ascii?q?mp8qlmRAP0hCoBKjU063/chNBug61HoRKhvx1/zJDSYIGJL/p1Y6fRccoHSW?=
 =?us-ascii?q?ZdQspdUipMDY2mb4sLEuEPI+BWoYfgrFcKtBezCw2hCObpxzRVhHH5wLc63v?=
 =?us-ascii?q?w8Hw/Y0gwuH9EAvnrao9r6NqgdTe+7wbLUzTjBdf5axSvx5YbKfx0nvPqCXa?=
 =?us-ascii?q?hwcc3UyUQ3Cg3FkkufqZTlPzyL0OQGrnWV7+96WuKrj24otQFwqSWoy8c3l4?=
 =?us-ascii?q?bJnZkYykzE9CplwIY1Ise0SEhgYdG+CpdQuCaaN5VvT84kXmpmuz46x6UbtZ?=
 =?us-ascii?q?O0cyUG0pQqywPFZ/CZfIWE/AjvWPuXLDxlnnxqYqi/iAy38UW4z+38UdS730?=
 =?us-ascii?q?hSoypel9nMqmgN1xvO6sibUvd9/lmu2TKI1w3L9uFLO1o0lavGK5462LIwip?=
 =?us-ascii?q?oSvljDHi/xgkn2irOZdl449eSy7uTnY7HmqoedN49ylA7+LrwjltGwDOk3KA?=
 =?us-ascii?q?QDX3WX9f6i2LDs40H1WqhGguUzkqbDsZDaIcobprS+Aw9Qyosj8AuwDyy93d?=
 =?us-ascii?q?QEnXgIMFJFeBWdg4jvIFHBOur0Dfi4g1SyiDtr3ezJPqX9ApXRKXjOiKrucq?=
 =?us-ascii?q?x760FAzwozyctS551TCrEGL/LzXlH+uMbEAR8+Ngy+2/znB8ll1oMCRWKPBb?=
 =?us-ascii?q?eUMKfTsV+O++IuLPCAa5UNuDb8MPUl+fHugmEjmVMHfqmmw4EXaHamEfRiOU?=
 =?us-ascii?q?mZZmDsgtgZG2cQogU+VPDqiEGFUTNLY3ayXqQ85iw0CY6/DofMWJqtgLqf0y?=
 =?us-ascii?q?e/BZBWeG9GBU6WEXvydIWLRe0MaCSMLc9liDAEUqKhS4A53xG0qAD606ZnLv?=
 =?us-ascii?q?bT+iAAsZLj09t16PPIlREy+jx0DtmS03uXQGxvkWMIQDg23K97oUNj0FuMza?=
 =?us-ascii?q?94g/lAH9xJ+/xJShs6NYLbz+FiDdDyXAHBc8yGSFahRdWmDjUxQcwrz9ASZE?=
 =?us-ascii?q?Z9Hs2ojgrf0CqyH78Vi7uLCYQy8qLbxHjxJ91wy3nB1KkmgFkmRtVAOXe6ia?=
 =?us-ascii?q?548gjZH5TJnFmBl6a2aaQc2zbA9HuCzWqLuUFYTRRwUb/fUnEffUbWotP55k?=
 =?us-ascii?q?TNT7+qF7srKBdOycmHKvgCVtq8oVxARfrncP/ZZ2uqkGa3AxvAkr+FaoHtf0?=
 =?us-ascii?q?0S2yLSDEVCmAcWqzLOMQk4GzfkqnrfJCJhGEipYE729+R67nShQQt8ywCMcl?=
 =?us-ascii?q?0k1Lev/BMRreKTRulV3b8eviol7TJuExL129XVBsGAqAttZqx0btQ671NKk2?=
 =?us-ascii?q?neskg1OJqjB69lgVEafkJ8uEa9+Q9wD9B7jcUyrH4shDF3IKac3UIJIyiUxr?=
 =?us-ascii?q?jsK7bXLS/05xnpZKnIjAKNmO2K87sCvaxr427ouxukQw97qCRq?=
Subject: Re: [PATCH 0/7] Harden userfaultfd
To:     Daniel Colascione <dancol@google.com>, linux-api@vger.kernel.org,
        linux-kernel@vger.kernel.org, lokeshgidra@google.com,
        nnk@google.com
Cc:     nosh@google.com, timmurray@google.com
References: <20191012191602.45649-1-dancol@google.com>
From:   Stephen Smalley <sds@tycho.nsa.gov>
Message-ID: <77f984c6-0da2-8e6f-e3f4-9dab2bfb6c79@tycho.nsa.gov>
Date:   Fri, 15 Nov 2019 10:09:20 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
 Thunderbird/68.2.0
MIME-Version: 1.0
In-Reply-To: <20191012191602.45649-1-dancol@google.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On 10/12/19 3:15 PM, Daniel Colascione wrote:
> Userfaultfd in unprivileged contexts could be potentially very
> useful. We'd like to harden userfaultfd to make such unprivileged use
> less risky. This patch series allows SELinux to manage userfaultfd
> file descriptors (via a new flag, for compatibility with existing
> code) and allows administrators to limit userfaultfd to servicing
> user-mode faults, increasing the difficulty of using userfaultfd in
> exploit chains invoking delaying kernel faults.
> 
> A new anon_inodes interface allows callers to opt into SELinux
> management of anonymous file objects. In this mode, anon_inodes
> creates new ephemeral inodes for anonymous file objects instead of
> reusing a singleton dummy inode. A new LSM hook gives security modules
> an opportunity to configure and veto these ephemeral inodes.
> 
> Existing anon_inodes users must opt into the new functionality.
> 
> Daniel Colascione (7):
>    Add a new flags-accepting interface for anonymous inodes
>    Add a concept of a "secure" anonymous file
>    Add a UFFD_SECURE flag to the userfaultfd API.
>    Teach SELinux about a new userfaultfd class
>    Let userfaultfd opt out of handling kernel-mode faults
>    Allow users to require UFFD_SECURE
>    Add a new sysctl for limiting userfaultfd to user mode faults
> 
>   Documentation/admin-guide/sysctl/vm.rst | 19 +++++-
>   fs/anon_inodes.c                        | 89 +++++++++++++++++--------
>   fs/userfaultfd.c                        | 47 +++++++++++--
>   include/linux/anon_inodes.h             | 27 ++++++--
>   include/linux/lsm_hooks.h               |  8 +++
>   include/linux/security.h                |  2 +
>   include/linux/userfaultfd_k.h           |  3 +
>   include/uapi/linux/userfaultfd.h        | 14 ++++
>   kernel/sysctl.c                         |  9 +++
>   security/security.c                     |  8 +++
>   security/selinux/hooks.c                | 68 +++++++++++++++++++
>   security/selinux/include/classmap.h     |  2 +
>   12 files changed, 256 insertions(+), 40 deletions(-)

Please, in the future, cc selinux@vger.kernel.org for patches that 
modify SELinux.