Received-SPF: pass (google.com: domain of linux-kernel+bounces-7399-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:40f1:3f00::1 as permitted sender) client-ip=2604:1380:40f1:3f00::1;
IronPort-PHdr: A9a23:cQ/nqBTxzF8vyOVXJqcbRlZ31Npsou2eAWYlg6HP9ppQJ/3wt523J
 lfWoO5thQWUA9aT4Kdehu7fo63sHnYN5Z+RvXxRFf4EW0oLk8wLmQwnDsOfT0r9Kf/hdSshG
 8peElRi+iLzKh1OFcLzbEHVuCf34yQbBxP/MgR4PKHyHIvThN6wzOe859jYZAAb4Vj1YeZcN
 hKz/ynYqsREupZoKKs61knsr2BTcutbgEJEd3mUmQrx4Nv1wI97/nZ1mtcMsvBNS777eKJqf
 fl9N3ELI2s17cvkuFz4QA2D62E1fk4WnxFLUG2npBv6C8vLriH9teNW/juZLYrGd+8kfS2ry
 q1Ccjq1jiIeNn1k70qI0f5JtItCsR309Hkdi4SBatywNup6PfrYWtgWalpMBZlyUiJ/BLrnY
 ahWVvc/bL5kj7bz5GEpjiWRKljyAdzD92Nx11Dkw/Bi1LUCERPk4yA+Dog1nCj1jY/3EIcgW
 86ty5LJihjpV+h19CnEz6jHKQ8liN6mVoNtLY2O8mUJEgL/rX6pstS/ZG3W3+IIjmyS9ch6Z
 NCtolAslwR9/wCXlsIvss7shL0J8nDe3AVjz5guJfnnSWhjRfSrRcgYp2SbLYxwWsQ4XyRyt
 T0nzqFToZegZ3tiIPUPwhfeb7mKf4eFzj65CKCfOz5lgnJidr+lwRq/ogCsyez5A9G9y00C7
 jFEnd/Fqm0X2lTN59KGRPpw8gbp2TuG2w3JrOARCU4unLfdK5kvz6R2kZwWsE/ZGTTxllmwh
 6iTHng=
IronPort-SDR: 6583443d_//X3gXTIWP94wo9DweydeKzdq8M0T1jagoax8oUNfXmaKSB
 o8XhgkYKleEwmJ3LQ6rPwX4oMoJJpT2Z30N0Pug==
IronPort-PHdr: A9a23:74AsVBHG03aaTyw4ZXA9cJ1Gf29NhN3EVzX9l7I53usdOq325Y/re
 Vff7K8w0gyBVtDB5vZNm+fa9LrtXWUQ7JrS1RJKfMlCTRYYj8URkQE6RsmDDEzwNvnxaCImW
 s9FUQwt5CSgPExYE9r5fQeXrGe78DgSHRvyL09yIOH0EZTVlMO5y6W5/JiABmcAhG+Te7R3f
 jm/sQiDjdQcg4ZpNvQUxwDSq3RFPsV6l0hvI06emQq52tao8cxG0gF9/sws7dVBVqOoT+Edd
 vl1HD8mOmY66YjQuB/PQBGmylAcX24VwX8qSwLFuU3AQp32sSLRkPh+yG6qB5Lmaak9fD6L1
 YI2ThrxiWRaKBVmq1PusuVpna0O83fD7xYqydPxYpGRd6N7WajRUuMXHjViW8hvURUaDKDlN
 pYxXrI9HdlW7LPahGUhgkrgADaAOb/WmxBamCKu2vwZ0/YDLi3YzVYbM44vkS7WiPXHPokKV
 tu0i4Ti9S7gQu1v/hfys5fMWz8LqsCRAfUvSub3zEgVNCj8lQ3K8tKmNjWQ6+AEqUqB3thif
 Nykt2sr9jlJ8j2s/oAJiLbVvqIP43De+jtiwKJqJPugbGR0NI3sAN5RrSacL4xsXoY4Tnp1v
 Dpv0rQdos3TlEkizZ0mw1vad/WkWtLWpBz5XfuXITB2iWgjdL/szxqx8E310uTnTYH0y1dFq
 CNZj8PB/m4AzR3d68WLC7N9806t1CzJ1lX75PtNPEY0kqTWMdgmxLsxnYAUqkPNAmn9n0Ces
 Q==
IronPort-Data: A9a23:MAnUK6lLT9uKshSFddHg8cTo5gzULURdPkR7XQ2eYbSJt1+Wr1Gzt
 xJJD2qDPKmIZmCjKt0iPd++9EpTuMKDx982TVY+qHw3QltH+JHPbTi7wugcHM8ywunrFh8PA
 xA2M4GYRCwMZiaB4E/rav649SUUOZigHtLUEPTDNj16WThqQSIgjQMLs+Mii+aEu/Dga++2k
 Y20+5G31GONgWYuaTtOsfrb83uDgdyr0N8mlgxmDRx0lAKG/5UlJMp3Db28KXL+Xr5VEoaSL
 woU5Ojklo9x105F5uKNyt4XQGVTKlLhFVTmZk5tZkSXqkMqShreckoMHKF0hU9/011llj3qo
 TlHncTYpQwBZsUglAmBOvVVO3kWAEFIxFPICWTi6sWzykPJSWT96fRMHm8/Y9QF+ekiVAmi9
 dRAQNwMRguGm/rwzaKwSq9inM0+KsnsMo4F/H1tpd3bJa97GtaSHOOTuo4ehW1v7ixNNa62i
 84xbDtkbB3NZ1tQN1YME7o3nfyljT/xaTRFrlKSq6ctpWTepOB0+OexYIKFJoDRLSlTtny1l
 lLnvHqkOQgXNfOd6RCC9yKylNaayEsXX6pXTtVU7MVCiVmexXcaDhEME166ovmwjk+iQMNZA
 0cd/C0orKM78AqgSdyVdxeiqWOCswQ0WNdKFeA+rgaXxcL86gKUFmECQjNbQNkntMYyRDc70
 BmCmNaBLTV0rJWWRGib+7PSqim9UQANJHIGTTcNUA9A5t7kuox1hRXKJv5vGai0g9ndGDb/z
 jmQpi8uwbMekaYj3qO351HGqzGhvJ7ESkgy/Aq/dmes9B94YsihbpGA7Vnd8OYGIIuHJnGau
 34Ls8uT9uYDCdeKjiPlaPQNB5mn7bCONzi0qVxoH59n+T2253epcIZcyD57LUZtdM0DfFfBY
 1fIuAVe5LdQMWGsYKsxZJi+Y+wxwabIGtPiWfTZKNFJZ/BZdAaA+DxpTUGX2G/pnQ4nlqRXE
 ZWcdd2lJXUXE6JqyHyxXeh1+aY2yyYixGX7RIv80R2j3LyCInWSTN8tLlqUacgr4aWFvkPR8
 tBCJ42N0RoZTe6WSizW8ooUNngRP3UhCJz37cxKHsaKJwt8RzogD9fexLogf8pumKE9vvzF5
 H6wck9RzF7ugzvMLgDiQnp7ZpvxUptl63E2JyohORCvwXdLSYKu6roPMpg6Z78q8MR9wvNuC
 foIYcONBrJIUDuv0zAca4Tt6YJ5eBm1iAamISWoen48coRmSgiP/cXrFiPr9S8THm+suMAju
 by8x0beRpYeQwlKEsnbcrSswkm3sHxbn/h9N3YkOfEKJR6podcvcnOgy6ZtfIcSLFPIgDWA3
 huQARAWqPOLr4JdHMT1uJ1oZryBSoNWNkRAFnTd7bG4ODOc+WymwIRaV/2PcyybX2TxkJhOr
 80Mpx0lGKxWwAR5oMBnHqx1zKkzwdLqqvUIhk5nBXjHJRDjQL9pPnDMj4EFu7xv141pn1K8e
 nuO3d1GZpSPGsfuS2AKKCQfM++s6PAzmxvp18oTHnnU3iFM0YC8YR1gBCXU0C15B5lpAbwh2
 tYk6ZI36RTgqx8EMeSmryFz9kaMJ0wmV5Q265QRBaGygA8r1GNHX434DxXywZCQaudjNlshD
 S+UiZHj2ZVd5BvmWFgiGUfd2dFygcw1hylL61sZNnK1mtbhrd0m7i17qDgYYFxc8URa7rhVJ
 GNuCXxQGYyP2DVZ3O54QGGmHlB6Ni2zo0De5QMAqzzEchOOSGfIEWwaPNSN9mA/90Z3XGBS3
 JOc+VbffQfaRuPD9QpsZhc9sN3md8J7ySPaksP+H8ilIYgzUQC4voCQP1g3uznVKuJvonbYp
 Nta3vd6Moz6Ei8yn5cVKaen0ZYodRTVA1AaHN9A+vsSEHD+aQOC/2GEC3qMd/NnI93I9k6FC
 PJSGP9faiTm1Aiyg2AaIYUuP45LmOUY4YteW7Hzek8Dnbitjhtol5Py5CLOvnAPRusyoJwyN
 7HXVTKOLTGXjyFmn2TM8cp2AUujQNw+fAan9vuEwOYIMJMise9XbkA51IWvjUiVKAdK+xG1v
 hvJQq3rk9xZ1oVnmrXzHpV5BwmbLc35UMKK+luRt+tiQMzuM8CUkS8osXjiYhprOIUOV+RNl
 biitMD92GXHtu0UV0Hbg5ywKLlb1/6tXeZ4MtPFE1cCpHGsAPTT2hok/3y0Dbdrk9kHv8mue
 FaeWfuKLNUQX49Q+W1RZy1gCC0iMqXQbJr7hCaDvv+JWwk80wvGEYudzkXXT1pnLw0GB56vL
 TXPmaeKxstZp4FyFhM7F6lYI5tnEmTCB4oiVfPM7Ae9MEf5rG+GiLXYkTgY1QrqEViBScbz3
 oLETEPxdTO0o6D58+tauI1T4DwSIm5229cyWkcv6u9GtS2zIz8DH9Q8LKcpN5BwuQ7x3aHee
 zviQjYDCyL8fDIcajT6wo3pcTm+D9w0GOXSB2IW7WLNTAnuH6KGIr9q1hk40kdMYjG5kd2Wc
 4APyEP/Lj2a489PR99KwteZnO0+5PfR5kxQyHDHi8aoXiovW+Qb5kdAQjhIezfMSfzWtUPxI
 mMwe2BIbWe7RWP1EudiY3RlIw4Yjhy+0wQXaTqz//iHt7W51OFgzNjNC9P32JAHb+UII+cqb
 lHzTG2v/WuX+yIyvY0EhtEXupJ3WMm7RpWCEKzeRAMsxvD6rixtOs4ZhiMAQf0z4AMVQRuXi
 jCo5GN4H0ifblxY3LqN0wgS5pZtSTQ2AirUiBLk7yrz+fDjIwM1pzDxpO4jFazNlg==
IronPort-HdrOrdr: A9a23:eA5B16HCi2woHb9ypLqFcJHXdLJyesId70hD6qkvc3Nom52j+/
 xGws536faVslcssHFJo6H4BEDyewKmyXcT2/hvAV7CZnibhILMFu9fBOTZsljd8kHFh5RgPO
 JbAtVD4b7LfChHZKTBkWuF+r8bqbHtmsDY5ts2jU0dNT2CA5sQnjuRYTzrdXGeKjM2Y6bRWK
 Dsgvau8FGbCAoqh4mAdzI4t6+pnay+qLvWJTo9QzI34giHij2lrJb8Dhijxx8bFxdC260r/2
 TpmxHwovzLiYD39jbsk0voq7hGktrozdVOQOSKl8guMz3pziKlfp5oVbGutC085Muv9FEput
 /RpApIBbU411rhOkWO5Tf90Qjp1zgjr1fk1F+jmHPm5ff0QTorYvAx875xQ1/80Q4Nrdt82K
 VE0yayrJxMFy7Nmyz7+pzhSwxqvlDcmwttrccjy1hkFacOYr5YqoISuGlPFo0bIS784Ic7VM
 FzEcDn4upMe1/yVQGXgoBW+q3tYp0PJGbEfqBb0fblkQS+3UoJg3fw/fZv30vpr/kGOtx5D+
 etCNUeqFgBdL5TUUtHPpZ1fSKGMB2/ffvyChPhHb3GLtBPB5ufke++3Fxy3pDsRKA1
Message-ID: <69c5a3b0-750f-4305-b09b-715d8f472e67@aisec.fraunhofer.de>
Date: Wed, 20 Dec 2023 20:44:55 +0100
User-Agent: Mozilla Thunderbird
Subject: Re: [RFC PATCH v3 3/3] devguard: added device guard for mknod in
 non-initial userns
To: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>
CC: Christian Brauner <brauner@kernel.org>, Alexander Mikhalitsyn
	<alexander@mihalicyn.com>, Alexei Starovoitov <ast@kernel.org>, Paul Moore
	<paul@paul-moore.com>, Daniel Borkmann <daniel@iogearbox.net>, Andrii
 Nakryiko <andrii@kernel.org>, Martin KaFai Lau <martin.lau@linux.dev>, Song
 Liu <song@kernel.org>, Yonghong Song <yhs@fb.com>, John Fastabend
	<john.fastabend@gmail.com>, KP Singh <kpsingh@kernel.org>, Stanislav Fomichev
	<sdf@google.com>, Hao Luo <haoluo@google.com>, Jiri Olsa <jolsa@kernel.org>,
	Quentin Monnet <quentin@isovalent.com>, Alexander Viro
	<viro@zeniv.linux.org.uk>, Miklos Szeredi <miklos@szeredi.hu>, Amir Goldstein
	<amir73il@gmail.com>, "Serge E. Hallyn" <serge@hallyn.com>,
	<bpf@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
	<linux-fsdevel@vger.kernel.org>, <linux-security-module@vger.kernel.org>,
	<gyroidos@aisec.fraunhofer.de>
References: <20231213143813.6818-1-michael.weiss@aisec.fraunhofer.de>
 <20231213143813.6818-4-michael.weiss@aisec.fraunhofer.de>
 <20231215-golfanlage-beirren-f304f9dafaca@brauner>
 <61b39199-022d-4fd8-a7bf-158ee37b3c08@aisec.fraunhofer.de>
 <20231218171800.474cc21166642d49120ba4e4@canonical.com>
Content-Language: en-US
From: =?UTF-8?Q?Michael_Wei=C3=9F?= <michael.weiss@aisec.fraunhofer.de>
In-Reply-To: <20231218171800.474cc21166642d49120ba4e4@canonical.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?WHFaSjJsSFh2N1dwSTdUaDJoVmplQncyazdNeXdFU1dmTm0wUkV3OWhRTkt2?=
 =?utf-8?B?RkdiUjFQeWo1eEd1QnRScVpUdHdaREtVczZzTmk2a2dNMWtOK1ZsZFNpd2ND?=
 =?utf-8?B?V3lDeEpsdkFaSkhXQVlyeU1FcTVIMUpFd0hDQzZ2dkF0SmFBQnZxa1VwaERS?=
 =?utf-8?B?NjkwMjAzYllMck94WVUwVWNrMjNoNnpHK1BpM2d5UkNSdEV5cFplT1ZWVmxQ?=
 =?utf-8?B?cDdwcVhEeUlPK1FkOU0zdUdkSVJ4SGlJK0diMFBuNDVvTGZkOW50bm9NNkQ4?=
 =?utf-8?B?SHZzcEJCN0ltOHI2WGRUNkJOQ1VMWlltNTF0Tk9XbXF1NlhBQlFudnpjdDJZ?=
 =?utf-8?B?eS9ibXlSOGhqMzQyNDhGYU0wT3UyZW1mWWJ5ajdFVExxWUs3MVEvYmREZi9F?=
 =?utf-8?B?ZWNyZy9wL1Z5bTNkUm9KU3VqQ3dtejcvR0s3ZnhtNllrQmkwbzFNdmFiT21D?=
 =?utf-8?B?dUJMdzlQTHkwMmxwb3l2MFhPS1JKT3UyWXloVXdla3g2N1BrN0lRZVhLY0cz?=
 =?utf-8?B?SGw5TzBhdW55ZDF5THlHaktZcUdrVFZKQUVjUGNqRkFpK3RzWDM5VkdxdEhp?=
 =?utf-8?B?MmNZb1NkRGRUem16RnV2WXk5cDcya3VGdFNKVGRDVVY0dU9wOTJZTTJObXp3?=
 =?utf-8?B?OU9RbmJxVDJmVERIbVJkaERCY3QraGFsaWFGMGNLWUdGcnBtSlJSV3VNNDdW?=
 =?utf-8?B?UnR3aWRjcXFLeUtkVWwyOUxnUHRYdU5jNkUvUzNFNFRvN3hZTEtvU1VkWSt3?=
 =?utf-8?B?Z0tpN0xLM0hKZFIwQm91N2FGM3kxSFRveU5HYlh3WkQ1R01oQUJIY1RvRE1S?=
 =?utf-8?B?TkNicFRpcjRGWDIyWityT21hcHlDVk9XNDFHcmhEYUhlMm9keG9Gek92RmVy?=
 =?utf-8?B?S2ZyRGEwU2dTRC94VFl6ZXFLSEtJYnJoQlUyanVpR05kdEtzaE5RWTlaNnB5?=
 =?utf-8?B?cjlRQTd6R0RISkpCSTlqa3JPM2JEVzZ2TldxVzdELzRaaitySTVsdU1HbFMy?=
 =?utf-8?B?dk9IRWV3MEpBS2MzbHMwWXAzUGI2ZkVlN2dpbXVBcDBSa2JEMFFlVWN4OGxE?=
 =?utf-8?B?ZVBLbEZjSmFqUmtsbUFYaHlPMk5jMktZdTQ4L3Vrc2d4eDNOOGwxWlJwV0NY?=
 =?utf-8?B?TEkvWmU1SVhDNlhyR21Bdi81Tit5bndCak9BakdaMWtyRVByalhPd1BjNWtB?=
 =?utf-8?B?SkNiVnR6akRxb291V0FBdXZwTVNHdUptaVNqTzVKZHB4YXhpZmxtSjFCRTY3?=
 =?utf-8?B?QVpaSndoV05ydHNUMWFVR2tNaFN2QzV5b0pnOHdsY2sxUmNHMzRKWi9EdlE2?=
 =?utf-8?B?VDZvbWx3ZUpqUE1wZnJmMzB5K1BFRDJGTk5SVng3ZTFYN1ZJNXJsaTNQTFQ0?=
 =?utf-8?B?TzFjTDdHcm9hVXVHZUJISk1hR0RaQUJPbVBrc1VPZVBFZzFwaGZXRFY3bVVX?=
 =?utf-8?B?ckdxQlEweGlNWWhvSnNFQ2FBcVFNWk4xZ2o0MExsYlFmYmhWb0Zvd0ZEUmo1?=
 =?utf-8?B?M3JwaU1YUDltK251VjZrZ2dRYmNka01iaWNSMUZGWnV3S1ExZE5wNHVaSk8w?=
 =?utf-8?B?SHVSZHAzU3ZiQnFKdXEreHhPUWR5WXdZMGVMcENTclJDcUVmZE02T0NnaVFY?=
 =?utf-8?B?VGlPMXhPTjNTS0dGbjNlUy90MGEycTRodjBnY1BnNnJ0amhKM2xOTS9VeTRT?=
 =?utf-8?B?MG9MektnQVZORHlKK05FTE96ZUNlQzU0NGs0TjlTS3JhR2RJOVRUaW8wTi9k?=
 =?utf-8?B?Y2pBZnVHVDlFbkhjMWk1NGliNEo5MjVxeGc0YkZsbTJ0Vjk0bmZqMFBUWFZK?=
 =?utf-8?B?ZFhxcmh1a0RlcWg1R09jRGw3bXk4RzZsWkoyb3l1TDQzNElzNW15dDgvWkpa?=
 =?utf-8?B?VXJNMDJSMXR1WHQ3K1RYNGRaSG1rMW1aQ1ZYWmNVV29EMHZDbzRsMmdPNXZs?=
 =?utf-8?B?MjVtWUcwWTh3L0RnQ3lHb0ljamVEd3hMSzJyY0dDSkRFenNpaHZsYlU1eDVp?=
 =?utf-8?B?WmNDWHpzOFpXd1NLQUV2VTMvME9BSDgvdDBkMG4yMS8wWEhOZ0VZRC9hUW1T?=
 =?utf-8?B?T2N2V1hGLzJwTlBJNVJrMkdtWHJEQjZKbmdOTERYcnFzUStFTHFJdlRTR05G?=
 =?utf-8?B?QmhIQWRTWmRSNjVWR1FZc2hIbE9XNzdibWU3UWo1cWZmOWdaTERiMHZJK251?=
 =?utf-8?B?eWQ2YVhyNGhKK0VxbzJHTXphWUJZVVBHMHR2aDhxNUZ4bXo3bGNRbFZLdFhD?=
 =?utf-8?Q?w/0djMTRDtBzuR8Ts3Bm01tbNH0k6zIZACOsBbfaxM=3D?=
X-MS-Exchange-CrossTenant-Network-Message-Id: bf6e1c0b-845a-4573-ee62-08dc01942628
X-MS-Exchange-CrossTenant-AuthSource: BEZP281MB2791.DEUP281.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Dec 2023 19:44:58.8865
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: f930300c-c97d-4019-be03-add650a171c4
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: AOsfOhX2TLn0p0UHkuKuJ14NEgvLMh2NfX69sBcRV+D2hXzQE3Pe+UTsj30P111CllOiUVbTLskj4NiIiPY9MaO2fbggYcXZNhpUkdR9YJ0w//CVrGoJ0yOKS/UftHdm
X-MS-Exchange-Transport-CrossTenantHeadersStamped: FR6P281MB3438
X-OriginatorOrg: aisec.fraunhofer.de

On 18.12.23 17:18, Alexander Mikhalitsyn wrote:
> On Fri, 15 Dec 2023 14:26:53 +0100
> Michael Weiß <michael.weiss@aisec.fraunhofer.de> wrote:
> 
>> On 15.12.23 13:31, Christian Brauner wrote:
>>> On Wed, Dec 13, 2023 at 03:38:13PM +0100, Michael Weiß wrote:
>>>> devguard is a simple LSM to allow CAP_MKNOD in non-initial user
>>>> namespace in cooperation of an attached cgroup device program. We
>>>> just need to implement the security_inode_mknod() hook for this.
>>>> In the hook, we check if the current task is guarded by a device
>>>> cgroup using the lately introduced cgroup_bpf_current_enabled()
>>>> helper. If so, we strip out SB_I_NODEV from the super block.
>>>>
>>>> Access decisions to those device nodes are then guarded by existing
>>>> device cgroups mechanism.
>>>>
>>>> Signed-off-by: Michael Weiß <michael.weiss@aisec.fraunhofer.de>
>>>> ---
>>>
>>> I think you misunderstood me... My point was that I believe you don't
>>> need an additional LSM at all and no additional LSM hook. But I might be
>>> wrong. Only a POC would show.
>>
>> Yeah sorry, I got your point now.
>>
>>>
>>> Just write a bpf lsm program that strips SB_I_NODEV in the existing
>>> security_sb_set_mnt_opts() call which is guranteed to be called when a
>>> new superblock is created.
>>
>> This does not work since SB_I_NODEV is a required_iflag in
>> mount_too_revealing(). This I have already tested when writing the
>> simple LSM here. So maybe we need to drop SB_I_NODEV from required_flags
>> there, too. Would that be safe?
>>
>>>
>>> Store your device access rules in a bpf map or in the sb->s_security
>>> blob (This is where I'm fuzzy and could use a bpf LSM expert's input.).
>>>
>>> Then make that bpf lsm program kick in everytime a
>>> security_inode_mknod() and security_file_open() is called and do device
>>> access management in there. Actually, you might need to add one hook
>>> when the actual device that's about to be opened is know. 
>>> This should be where today the device access hooks are called.
>>>
>>> And then you should already be done with this. The only thing that you
>>> need is the capable check patch.
>>>
>>> You don't need that cgroup_bpf_current_enabled() per se. Device
>>> management could now be done per superblock, and not per task. IOW, you
>>> allowlist a bunch of devices that can be created and opened. Any task
>>> that passes basic permission checks and that passes the bpf lsm program
>>> may create device nodes.
>>>
>>> That's a way more natural device management model than making this a per
>>> cgroup thing. Though that could be implemented as well with this.
>>>
>>> I would try to write a bpf lsm program that does device access
>>> management with your capable() sysctl patch applied and see how far I
>>> get.
>>>
>>> I don't have the time otherwise I'd do it.
>> I'll give it a try but no promises how fast this will go.
> 
> Hi Michael,
> 
> thanks for your work on this!
> 
> If you don't mind I'm ready to help you with writing the PoC for this bpf-based approach,
> as I have touched eBPF earlier I guess I can save some your time. (I'll post it here and you will incude it
> in your patch series.)

Yeah for sure. This would be very helpful thanks.
I'll start to sort Christians patches of this thread and get the missing security
hook for the remaining checks lined up from v2 then.

> 
> Kind regards,
> Alex
> 
>>
> 
>