Received-SPF: pass (google.com: domain of linux-kernel+bounces-75984-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
Date: Thu, 22 Feb 2024 13:41:57 +0700
From: Bagas Sanjaya <bagasdotme@gmail.com>
To: Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
	Linux Security Module Subsystem <linux-security-module@vger.kernel.org>
Cc: Kees Cook <keescook@chromium.org>,
	Andy Lutomirski <luto@amacapital.net>,
	Will Drewry <wad@chromium.org>,
	=?utf-8?Q?Micka=C3=ABl_Sala=C3=BCn?= <mic@digikod.net>,
	Theodore Ts'o <tytso@mit.edu>,
	Alan Stern <stern@rowland.harvard.edu>,
	Ali Polatel <alip@chesswob.org>
Subject: TOCTOU-free exec(), chdir(), open() with O_PATH sandbox emulation
 support?
Message-ID: <ZdbstX5p4M_-RjXC@archie.me>
Precedence: bulk
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="MO7InTU0UHS36JK5"
Content-Disposition: inline


--MO7InTU0UHS36JK5
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Hi,

Ali Polatel <alip@chesswob.org> opened feature request bug on Bugzilla
regarding TOCTOU-free sandbox emulation support [1]. He wrote:

> Thanks to the addition of seccomp_addfd, now it is possible to emulate a =
vast number of system calls to achieve a TOCTOU-free sandbox in userspace. =
There're however three exceptions to this:
> 1. exec family calls cannot be emulated so a sandbox disallowing exec cal=
ls has no choice but to continue the exec call in sandbox process allowing =
TOCTOU.
> 2. chdir family calls cannot be emulated so a sandbox disallowing chdir c=
alls to hide paths has no choice but to continue the chdir call in sandbox =
process allowing TOCTOU.
> 3. open calls with the O_PATH flag cannot be emulated (addfd returns EBAD=
F on o_path fds) again a sandbox disallowing open calls with O_PATH flag to=
 hide paths has no choice but to continue the open call in sandbox process =
allowing TOCTOU.
>=20
> It'd be awesome for the kernel to provide TOCTOU-free ways to sandbox the=
se three cases.
>=20
> For a bit of context, I am the author of syd, a seccomp and landlock base=
d application sandbox with support for namespaces, you can read here about =
why this feature request is relevant and more: http://man.exherbolinux.org/=
syd.7.html
>=20
> To quote the relevant bit from the manual page:
>> BUGS
>>=20
>> In the operation of syd, certain system calls are not fully emulated due=
 to seccomp(2) limitations, resulting in the sandbox process continuing the=
se calls directly. These include execve(2), execveat(2) for execution, chdi=
r(2), fchdir(2) for directory changes, and open(2) operations with O_PATH f=
lag. Consequently, this behavior exposes vulnerabilities to time-of-check t=
o time-of-use attacks, allowing for the circumvention of Exec Sandboxing to=
 execute denylisted paths, the bypass of Stat Sandboxing for unauthorized d=
irectory access without disclosing directory contents (owing to getdents(2)=
 call emulation), and the detection of hidden files without revealing file =
metadata, as stat(2) calls are emulated.

Is the feature request viable/realistic?

Thanks.

[1]: https://bugzilla.kernel.org/show_bug.cgi?id=3D218501

--=20
An old man doll... just what I always wanted! - Clara

--MO7InTU0UHS36JK5
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iHUEABYKAB0WIQSSYQ6Cy7oyFNCHrUH2uYlJVVFOowUCZdbstAAKCRD2uYlJVVFO
o6t8AQD79KsszDwGub+XNmsGyw95WsE0YmAkVahpYrYhSOwgFQEAqPBzxT+wpYN+
0UuCHIC627WdHRuS7KLGWSiFT5IG/Qs=
=lS1J
-----END PGP SIGNATURE-----

--MO7InTU0UHS36JK5--