Re: [PATCH v6 4/5] seccomp: add support for passing fds via USER_NOTIF

2018-09-25 Thread Tycho Andersen
On Thu, Sep 20, 2018 at 07:18:45PM -0700, Andy Lutomirski wrote: > Hmm. This does mean that we need a test case for a user notifier > returning -ERESTARTSYS. It should Just Work (tm), but those are > famous last words. Just to confirm, I've got a test case that works like this: 1. fork and inst

Re: [PATCH v6 4/5] seccomp: add support for passing fds via USER_NOTIF

2018-09-21 Thread Tycho Andersen
On Fri, Sep 21, 2018 at 11:27:59AM -0700, Andy Lutomirski wrote: > On Fri, Sep 21, 2018 at 6:39 AM Tycho Andersen wrote: > > > > On Thu, Sep 20, 2018 at 07:18:45PM -0700, Andy Lutomirski wrote: > > > > > > I think we just want the operation to cover all the cases. Let PUT_FD > > > take a source f

Re: [PATCH v6 4/5] seccomp: add support for passing fds via USER_NOTIF

2018-09-21 Thread Jann Horn
On Fri, Sep 21, 2018 at 3:39 PM Tycho Andersen wrote: > On Thu, Sep 20, 2018 at 07:18:45PM -0700, Andy Lutomirski wrote: > > On Thu, Sep 20, 2018 at 4:42 PM Tycho Andersen wrote: > > > On Wed, Sep 19, 2018 at 12:58:20PM -0700, Andy Lutomirski wrote: > > > > On Wed, Sep 19, 2018 at 7:38 AM, Tycho

Re: [PATCH v6 4/5] seccomp: add support for passing fds via USER_NOTIF

2018-09-21 Thread Andy Lutomirski
On Fri, Sep 21, 2018 at 6:39 AM Tycho Andersen wrote: > > On Thu, Sep 20, 2018 at 07:18:45PM -0700, Andy Lutomirski wrote: > > > > I think we just want the operation to cover all the cases. Let PUT_FD > > take a source fd and a dest fd. If the source fd is -1, the dest is > > closed. If the sou

Re: [PATCH v6 4/5] seccomp: add support for passing fds via USER_NOTIF

2018-09-21 Thread Tycho Andersen
On Thu, Sep 20, 2018 at 07:18:45PM -0700, Andy Lutomirski wrote: > On Thu, Sep 20, 2018 at 4:42 PM Tycho Andersen wrote: > > > > On Wed, Sep 19, 2018 at 12:58:20PM -0700, Andy Lutomirski wrote: > > > On Wed, Sep 19, 2018 at 7:38 AM, Tycho Andersen wrote: > > > > On Wed, Sep 19, 2018 at 07:19:56AM

Re: [PATCH v6 4/5] seccomp: add support for passing fds via USER_NOTIF

2018-09-20 Thread Andy Lutomirski
On Thu, Sep 20, 2018 at 4:42 PM Tycho Andersen wrote: > > On Wed, Sep 19, 2018 at 12:58:20PM -0700, Andy Lutomirski wrote: > > On Wed, Sep 19, 2018 at 7:38 AM, Tycho Andersen wrote: > > > On Wed, Sep 19, 2018 at 07:19:56AM -0700, Andy Lutomirski wrote: > > >> > > >> > > >> > On Sep 19, 2018, at 2

Re: [PATCH v6 4/5] seccomp: add support for passing fds via USER_NOTIF

2018-09-20 Thread Tycho Andersen
On Wed, Sep 19, 2018 at 12:58:20PM -0700, Andy Lutomirski wrote: > On Wed, Sep 19, 2018 at 7:38 AM, Tycho Andersen wrote: > > On Wed, Sep 19, 2018 at 07:19:56AM -0700, Andy Lutomirski wrote: > >> > >> > >> > On Sep 19, 2018, at 2:55 AM, Tycho Andersen wrote: > >> > > >> >> On Wed, Sep 12, 2018 at

Re: [PATCH v6 4/5] seccomp: add support for passing fds via USER_NOTIF

2018-09-19 Thread Andy Lutomirski
On Wed, Sep 19, 2018 at 7:38 AM, Tycho Andersen wrote: > On Wed, Sep 19, 2018 at 07:19:56AM -0700, Andy Lutomirski wrote: >> >> >> > On Sep 19, 2018, at 2:55 AM, Tycho Andersen wrote: >> > >> >> On Wed, Sep 12, 2018 at 04:52:38PM -0700, Andy Lutomirski wrote: >> >>> On Thu, Sep 6, 2018 at 8:28 AM

Re: [PATCH v6 4/5] seccomp: add support for passing fds via USER_NOTIF

2018-09-19 Thread Tycho Andersen
On Wed, Sep 19, 2018 at 07:19:56AM -0700, Andy Lutomirski wrote: > > > > On Sep 19, 2018, at 2:55 AM, Tycho Andersen wrote: > > > >> On Wed, Sep 12, 2018 at 04:52:38PM -0700, Andy Lutomirski wrote: > >>> On Thu, Sep 6, 2018 at 8:28 AM, Tycho Andersen wrote: > >>> The idea here is that the user

Re: [PATCH v6 4/5] seccomp: add support for passing fds via USER_NOTIF

2018-09-19 Thread Andy Lutomirski
> On Sep 19, 2018, at 2:55 AM, Tycho Andersen wrote: > >> On Wed, Sep 12, 2018 at 04:52:38PM -0700, Andy Lutomirski wrote: >>> On Thu, Sep 6, 2018 at 8:28 AM, Tycho Andersen wrote: >>> The idea here is that the userspace handler should be able to pass an fd >>> back to the trapped task, for e

Re: [PATCH v6 4/5] seccomp: add support for passing fds via USER_NOTIF

2018-09-19 Thread Tycho Andersen
On Wed, Sep 12, 2018 at 04:52:38PM -0700, Andy Lutomirski wrote: > On Thu, Sep 6, 2018 at 8:28 AM, Tycho Andersen wrote: > > The idea here is that the userspace handler should be able to pass an fd > > back to the trapped task, for example so it can be returned from socket(). > > > > I've proposed

Re: [PATCH v6 4/5] seccomp: add support for passing fds via USER_NOTIF

2018-09-13 Thread Aleksa Sarai
On 2018-09-12, Andy Lutomirski wrote: > > The idea here is that the userspace handler should be able to pass an fd > > back to the trapped task, for example so it can be returned from socket(). > > > > I've proposed one API here, but I'm open to other options. In particular, > > this only lets you

Re: [PATCH v6 4/5] seccomp: add support for passing fds via USER_NOTIF

2018-09-13 Thread Tycho Andersen
On Wed, Sep 12, 2018 at 04:52:38PM -0700, Andy Lutomirski wrote: > On Thu, Sep 6, 2018 at 8:28 AM, Tycho Andersen wrote: > > The idea here is that the userspace handler should be able to pass an fd > > back to the trapped task, for example so it can be returned from socket(). > > > > I've proposed

Re: [PATCH v6 4/5] seccomp: add support for passing fds via USER_NOTIF

2018-09-12 Thread Andy Lutomirski
On Thu, Sep 6, 2018 at 8:28 AM, Tycho Andersen wrote: > The idea here is that the userspace handler should be able to pass an fd > back to the trapped task, for example so it can be returned from socket(). > > I've proposed one API here, but I'm open to other options. In particular, > this only le

Re: [PATCH v6 4/5] seccomp: add support for passing fds via USER_NOTIF

2018-09-11 Thread Tycho Andersen
On Mon, Sep 10, 2018 at 07:00:43PM +0200, Jann Horn wrote: > On Thu, Sep 6, 2018 at 8:30 PM Tycho Andersen wrote: > > On Thu, Sep 06, 2018 at 10:22:46AM -0600, Tycho Andersen wrote: > > > On Thu, Sep 06, 2018 at 06:15:18PM +0200, Jann Horn wrote: > > > > On Thu, Sep 6, 2018 at 5:29 PM Tycho Anders

Re: [PATCH v6 4/5] seccomp: add support for passing fds via USER_NOTIF

2018-09-10 Thread Jann Horn
On Thu, Sep 6, 2018 at 8:30 PM Tycho Andersen wrote: > On Thu, Sep 06, 2018 at 10:22:46AM -0600, Tycho Andersen wrote: > > On Thu, Sep 06, 2018 at 06:15:18PM +0200, Jann Horn wrote: > > > On Thu, Sep 6, 2018 at 5:29 PM Tycho Andersen wrote: > > > > The idea here is that the userspace handler shou

Re: [PATCH v6 4/5] seccomp: add support for passing fds via USER_NOTIF

2018-09-06 Thread Tycho Andersen
On Thu, Sep 06, 2018 at 10:22:46AM -0600, Tycho Andersen wrote: > On Thu, Sep 06, 2018 at 06:15:18PM +0200, Jann Horn wrote: > > On Thu, Sep 6, 2018 at 5:29 PM Tycho Andersen wrote: > > > The idea here is that the userspace handler should be able to pass an fd > > > back to the trapped task, for e

Re: [PATCH v6 4/5] seccomp: add support for passing fds via USER_NOTIF

2018-09-06 Thread Tycho Andersen
On Thu, Sep 06, 2018 at 06:15:18PM +0200, Jann Horn wrote: > On Thu, Sep 6, 2018 at 5:29 PM Tycho Andersen wrote: > > The idea here is that the userspace handler should be able to pass an fd > > back to the trapped task, for example so it can be returned from socket(). > [...] > > diff --git a/Doc

Re: [PATCH v6 4/5] seccomp: add support for passing fds via USER_NOTIF

2018-09-06 Thread Jann Horn
On Thu, Sep 6, 2018 at 5:29 PM Tycho Andersen wrote: > The idea here is that the userspace handler should be able to pass an fd > back to the trapped task, for example so it can be returned from socket(). [...] > diff --git a/Documentation/userspace-api/seccomp_filter.rst > b/Documentation/usersp

[PATCH v6 4/5] seccomp: add support for passing fds via USER_NOTIF

2018-09-06 Thread Tycho Andersen
The idea here is that the userspace handler should be able to pass an fd back to the trapped task, for example so it can be returned from socket(). I've proposed one API here, but I'm open to other options. In particular, this only lets you return an fd from a syscall, which may not be enough in a