Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Giuseppe Scrivano <gscrivan@redhat.com>
To:     Sargun Dhillon <sargun@sargun.me>
Cc:     keescook@chromium.org, rsesek@google.com, palmer@google.com,
        jannh@google.com, jeffv@google.com,
        containers@lists.linux-foundation.org,
        Kees Cook <keescook@google.com>, linux-kernel@vger.kernel.org,
        Matt Denton <mpdenton@google.com>, linux-api@vger.kernel.org,
        christian.brauner@ubuntu.com
Subject: Re: [PATCH v2 2/3] seccomp: Introduce addfd ioctl to seccomp user notifier
References: <20200528110858.3265-1-sargun@sargun.me>
        <20200528110858.3265-3-sargun@sargun.me>
Date:   Fri, 29 May 2020 11:24:33 +0200
In-Reply-To: <20200528110858.3265-3-sargun@sargun.me> (Sargun Dhillon's
        message of "Thu, 28 May 2020 04:08:57 -0700")
Message-ID: <87wo4vt7ou.fsf@redhat.com>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.3 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Sargun Dhillon <sargun@sargun.me> writes:

> This adds a seccomp notifier ioctl which allows for the listener to "add"
> file descriptors to a process which originated a seccomp user
> notification. This allows calls like mount, and mknod to be "implemented",
> as the return value, and the arguments are data in memory. On the other
> hand, calls like connect can be "implemented" using pidfd_getfd.
>
> Unfortunately, there are calls which return file descriptors, like
> open, which are vulnerable to TOC-TOU attacks, and require that the
> more privileged supervisor can inspect the argument, and perform the
> syscall on behalf of the process generating the notifiation. This
> allows the file descriptor generated from that open call to be
> returned to the calling process.
>
> In addition, there is funcitonality to allow for replacement of
> specific file descriptors, following dup2-like semantics.
>
> Signed-off-by: Sargun Dhillon <sargun@sargun.me>
> Suggested-by: Matt Denton <mpdenton@google.com>
> Cc: Kees Cook <keescook@google.com>,
> Cc: Jann Horn <jannh@google.com>,
> Cc: Robert Sesek <rsesek@google.com>,
> Cc: Chris Palmer <palmer@google.com>
> Cc: Christian Brauner <christian.brauner@ubuntu.com>
> Cc: Tycho Andersen <tycho@tycho.ws>
> ---

Thanks, this is a really useful feature.

Tested-by: Giuseppe Scrivano <gscrivan@redhat.com>