On Mon, Feb 26, 2018 at 07:46:19PM -0800, Sargun Dhillon wrote: > On Mon, Feb 26, 2018 at 5:01 PM, Tycho Andersen <ty...@tycho.ws> wrote: > > On Mon, Feb 26, 2018 at 03:20:15PM -0800, Kees Cook wrote: > >> On Mon, Feb 26, 2018 at 3:04 PM, Alexei Starovoitov > >> <alexei.starovoi...@gmail.com> wrote: > >> > On Mon, Feb 26, 2018 at 07:26:54AM +0000, Sargun Dhillon wrote: > >> >> This patchset enables seccomp filters to be written in eBPF. Although, > >> >> this > >> >> [...] > >> > The main statement I want to hear from seccomp maintainers before > >> > proceeding any further on this that enabling eBPF in seccomp won't lead > >> > to seccomp folks arguing against changes in bpf core (like verifier) > >> > just because it's used by seccomp. > >> > It must be spelled out in the commit log with explicit Ack. > >> > >> The primary thing I'm concerned about with eBPF and seccomp is > >> side-effects from eBPF programs running at syscall time. This is an > >> extremely sensitive area, and I want to be sure there won't be > >> feature-creep here that leads to seccomp getting into a bad state. > >> > >> As long as seccomp can continue have its own verifier, > > > > I guess these patches should introduce some additional restrictions in > > kernel/seccomp.c then? Based on my reading now, it's whatever the eBPF > > verifier allows. > > > Like what? The helpers allowed are listed in seccomp.c. You have the > same restrictions as the traditional eBPF verifier (no unsafe memory > access, jumps backwards, etc..). I'm not sure which built-in eBPF > functionality presents risk.
I think that's the $64,000 question that Kees is trying to answer r.e. maps, etc. There's also the possibility that eBPF grows something new that's unsafe for seccomp. Cheers, Tycho
