From: Dave Jones Subject: Re: General flags to turn things off (getrandom, pid lookup, etc) Date: Fri, 25 Jul 2014 16:15:07 -0400 Message-ID: <20140725201507.GA23410@redhat.com> References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: "Eric W. Biederman" , Julien Tinnes , David Drysdale , Al Viro , Paolo Bonzini , LSM List , Greg Kroah-Hartman , Paul Moore , James Morris , Linux API , Meredydd Luff , Christoph Hellwig , "linux-kernel@vger.kernel.org" , Kees Cook , "Theodore Ts'o" , Henrique de Moraes Holschuh , linux-crypto@vger.kernel.org To: Andy Lutomirski Return-path: Received: from mx1.redhat.com ([209.132.183.28]:16166 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932508AbaGYUPw (ORCPT ); Fri, 25 Jul 2014 16:15:52 -0400 Content-Disposition: inline In-Reply-To: Sender: linux-crypto-owner@vger.kernel.org List-ID: On Fri, Jul 25, 2014 at 11:30:48AM -0700, Andy Lutomirski wrote: > There is recent interest in having a way to turn generally-available > kernel features off. Maybe we should add a good one so we can stop > bikeshedding and avoid proliferating dumb interfaces. > > Things that might want to be turn-off-able include: > - getrandom with GRND_RANDOM [from the getrandom threads] > - Any lookup of a non-self pid [from the capsicum thread] > - Any lookup of a pid outside the caller thread group [capsicum] > - Various architectural things (personal wishlist), e.g.: > - RDTSC and userspace HPET access > - CPUID? > - 32-bit GDT code segments [huge attack surface] > - 64-bit GDT code segments [probably pointless] I'm not sure there's value in disabling cpuid dev interface, when the instruction is unprivileged. > I would propose a new syscall for this: > > long restrict_userspace(int mode, int type, int value, int flags); do the restrictions happen system-wide like in say SELinux, or only within the calling process, like seccomp ? Dave