Re: [RFC PATCH bpf-next seccomp 10/12] seccomp-ebpf: Add ability to read user memory
From: YiFei Zhu <hidden>
Date: 2021-05-13 05:26:35
Also in:
bpf
On Wed, May 12, 2021 at 5:36 PM Alexei Starovoitov [off-list ref] wrote:
Typically the verifier does all the checks at load time to avoid run-time overhead during program execution. Then at attach time we check that attach parameters provided at load time match exactly to those at attach time. ifindex, attach_btf_id, etc fall into this category. Doing something similar it should be possible to avoid doing get_dumpable() at run-time.
Do you mean to move the check of dumpable to load time instead of runtime? I do not think that makes sense. A process may arbitrarily set its dumpable attribute during execution via prctl. A process could do set itself to non-dumpable, before interacting with sensitive information that would better not be possible to be dumped (eg. ssh-agent does this [1]). Therefore, being dumpable at one point in time does not indicate anything about whether it stays dumpable at a later point in time. Besides, seccomp filters are inherited across clone and exec, attaching to many tasks with no option to detach. What should the load-time check of task dump-ability be against? The current task may only be the tip of an iceburg. [1] https://github.com/openssh/openssh-portable/blob/2dc328023f60212cd29504fc05d849133ae47355/ssh-agent.c#L1398 YiFei Zhu