Re: [PATCH 1/3] fs: add O_BENEATH flag to openat(2)

On Mon, Nov 3, 2014 at 10:25 AM, Julien Tinnes [off-list ref] wrote:

On Mon, Nov 3, 2014 at 9:37 AM, David Drysdale [off-list ref] wrote:

quoted

On Mon, Nov 3, 2014 at 3:42 PM, Andy Lutomirski [off-list ref]
wrote:

quoted

On Mon, Nov 3, 2014 at 7:20 AM, Al Viro [off-list ref] wrote:

quoted

On Mon, Nov 03, 2014 at 11:48:23AM +0000, David Drysdale wrote:

quoted

Add a new O_BENEATH flag for openat(2) which restricts the
provided path, rejecting (with -EACCES) paths that are not beneath
the provided dfd.  In particular, reject:
 - paths that contain .. components
 - paths that begin with /
 - symlinks that have paths as above.

Yecch...  The degree of usefulness aside (and I'm not convinced that it
is non-zero),

This is extremely useful in conjunction with seccomp.

Yes, that was my understanding of how the Chrome[OS] folk wanted
to use it.

Yes, exactly. Without this, if we want to give a sandboxed process A access
to a directory, we need to:
1. Create a new 'broker" process B
2. Make sure to have an IPC channel between A and B.
3. SIGSYS open() and openat() in A via seccomp-bpf
4. Have an async-signal-safe handler that can IPC open / openat.

You can do this with user namespaces, too.  But this is way more
complicated than it should be, and it has a lot more overhead.

--Andy

There is a lot of hidden complexity in such a set-up. For instance, if you
need to prevent contention, the number of threads in the broker B should
scale automatically.

This is 'fine' (but undesirable) for a big beast such as Chromium which
needs such a complex set-ups anyways, but David's patch would make it a lot
easier to build a sandbox and whitelist directories for everyone, simply by
enforcing O_BENEATH in seccomp and whitelisting open directory file
descriptors in the sandboxed process.

Julien

-- 
Andy Lutomirski
AMA Capital Management, LLC