From nobody Wed Mar 30 19:51:59 2022 X-Original-To: freebsd-hackers@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 0A9FF1A5989F for ; Wed, 30 Mar 2022 19:52:02 +0000 (UTC) (envelope-from shawn.webb@hardenedbsd.org) Received: from mail-qk1-x72a.google.com (mail-qk1-x72a.google.com [IPv6:2607:f8b0:4864:20::72a]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "smtp.gmail.com", Issuer "GTS CA 1D4" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4KTHBm75YQz3jRV for ; Wed, 30 Mar 2022 19:52:00 +0000 (UTC) (envelope-from shawn.webb@hardenedbsd.org) Received: by mail-qk1-x72a.google.com with SMTP id q200so4333097qke.7 for ; Wed, 30 Mar 2022 12:52:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hardenedbsd.org; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to; bh=sLDOwNoYtRf5aUmu1YLggt60bPtcAWn4RJkBxzBMAx4=; b=f6n/VELD7xElDNLwKHCGKBKE7t99PomSXiWusKwzuYlwnHAzLnaFxvV89i39a2dqb4 stRgPoFmtLBNi0fcDB9UZ/EJBVK1vmHFBoKLHSwQBX0VC+zKYost5skYEMLxmiEBTWoP HfTUGtpnbwDbIWIgKeupColUQY0DREEaJTLY+b42xCHz/rl9DaoHocP21r+NrRjKy5bj TtwMACuqFfs17WgDG8a4NJg0btZwt3NXdO3bnklra4TVfXMnzIfhZKLQVod/hJcopT74 Vz1Qvx1knfan/w+PNhiclbKrV2wJ/Wa1tddk0gxvVe27qY+8FT4siLdz8J9txTxnZwte Lq5A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=sLDOwNoYtRf5aUmu1YLggt60bPtcAWn4RJkBxzBMAx4=; b=WDGWK20oyFnyuiyRON1ky8Y7LaO9j0YyJbkJRHJkXsRES3v/Cnm/kUDtDjAy079Nir nsMILWeJFUW5TsAuucoXxig9sUzBXRKUfK+QbxsI/j5cGelfS2Q13hTdV2hbaCPy73vQ nEWoJjJNOLu++sGC80DVF7/NEIH4/PcYGm4uPX9A8GnGoo7zRgbjzRXOQKfFYyw7PZGS 7u4WY4/PjMNFDpyxDAooDCJATd2RosYdW35jUB8z9OhM5QdPFhadGNYjS9arQhRhmloK czDN3le/hXsnau2RKALDO1F9hza4PgvAsZyGJ6rIoQLAIcERwJpfJu6QIo0eIY/nsgSL Js0Q== X-Gm-Message-State: AOAM530cqVeiu3XzbyDHfluCOAxH/7dwSuA93PcaJKzuPMuf3meCtw7j 9yb7erJ7YPETlUr90I1/2J2Suw== X-Google-Smtp-Source: ABdhPJz8+tcpgKNDw/8mJe1Gde68LE8tcd4XPOANmBBdGneAogDBHH3iXGZSsi7N5rHnMzvphi3aew== X-Received: by 2002:a05:620a:125a:b0:67e:ce2e:f2bd with SMTP id a26-20020a05620a125a00b0067ece2ef2bdmr1012751qkl.336.1648669920409; Wed, 30 Mar 2022 12:52:00 -0700 (PDT) Received: from mutt-hbsd (pool-100-16-224-136.bltmmd.fios.verizon.net. [100.16.224.136]) by smtp.gmail.com with ESMTPSA id j11-20020a37a00b000000b0067b436faccesm11220171qke.122.2022.03.30.12.51.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 30 Mar 2022 12:51:59 -0700 (PDT) Date: Wed, 30 Mar 2022 15:51:59 -0400 From: Shawn Webb To: Mathieu Cc: Baptiste Daroussin , freebsd-hackers@FreeBSD.org Subject: Re: curtain: WIP sandboxing mechanism with pledge()/unveil() support Message-ID: <20220330195159.zraxrpgjcu6kcwae@mutt-hbsd> X-Operating-System: FreeBSD mutt-hbsd 14.0-CURRENT-HBSD FreeBSD 14.0-CURRENT-HBSD X-PGP-Key: https://git.hardenedbsd.org/hardenedbsd/pubkeys/-/blob/master/Shawn_Webb/03A4CBEBB82EA5A67D9F3853FF2E67A277F8E1FA.pub.asc References: <25b5c60f-b9cc-78af-86d7-1cc714232364@gmail.com> <20220330072210.icontj4n7hcqwtql@aniel.nours.eu> <8df2d609-0a0d-0a25-4918-a27c91c3790a@gmail.com> List-Id: Technical discussions relating to FreeBSD List-Archive: https://lists.freebsd.org/archives/freebsd-hackers List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-hackers@freebsd.org MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="z3regbayyxs4mrei" Content-Disposition: inline In-Reply-To: <8df2d609-0a0d-0a25-4918-a27c91c3790a@gmail.com> X-Rspamd-Queue-Id: 4KTHBm75YQz3jRV X-Spamd-Bar: --- Authentication-Results: mx1.freebsd.org; dkim=pass header.d=hardenedbsd.org header.s=google header.b="f6n/VELD"; dmarc=none; spf=pass (mx1.freebsd.org: domain of shawn.webb@hardenedbsd.org designates 2607:f8b0:4864:20::72a as permitted sender) smtp.mailfrom=shawn.webb@hardenedbsd.org X-Spamd-Result: default: False [-3.54 / 15.00]; RCVD_VIA_SMTP_AUTH(0.00)[]; TO_DN_SOME(0.00)[]; R_SPF_ALLOW(-0.20)[+ip6:2607:f8b0:4000::/36]; RCVD_COUNT_THREE(0.00)[3]; DKIM_TRACE(0.00)[hardenedbsd.org:+]; NEURAL_HAM_SHORT(-0.99)[-0.989]; SIGNED_PGP(-2.00)[]; FREEMAIL_TO(0.00)[gmail.com]; FROM_EQ_ENVFROM(0.00)[]; MIME_TRACE(0.00)[0:+,1:+,2:~]; ASN(0.00)[asn:15169, ipnet:2607:f8b0::/32, country:US]; RECEIVED_SPAMHAUS_PBL(0.00)[100.16.224.136:received]; ARC_NA(0.00)[]; R_DKIM_ALLOW(-0.20)[hardenedbsd.org:s=google]; FROM_HAS_DN(0.00)[]; RCPT_COUNT_THREE(0.00)[3]; NEURAL_HAM_LONG(-1.00)[-1.000]; MIME_GOOD(-0.20)[multipart/signed,text/plain]; PREVIOUSLY_DELIVERED(0.00)[freebsd-hackers@freebsd.org]; DMARC_NA(0.00)[hardenedbsd.org]; NEURAL_SPAM_MEDIUM(0.55)[0.553]; TO_MATCH_ENVRCPT_SOME(0.00)[]; RCVD_IN_DNSWL_NONE(0.00)[2607:f8b0:4864:20::72a:from]; MLMMJ_DEST(0.00)[freebsd-hackers]; MID_RHS_NOT_FQDN(0.50)[]; RCVD_TLS_ALL(0.00)[] X-ThisMailContainsUnwantedMimeParts: N --z3regbayyxs4mrei Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Mar 30, 2022 at 01:52:09PM -0400, Mathieu wrote: > On 3/30/22 03:22, Baptiste Daroussin wrote: > > Hello Mathieu, > > First of all, thank you for this amazing work, leveraging the mac frame= work to > > build curtain is imho an excellent idea, I personnally see a curtain li= ke > > approach as complementary to a capsicum approach rather than an antagon= ist > > feature, I can see many possible usage of curtains in freebsd in partic= ular in > > the port framework! >=20 >=20 > Alright! >=20 > One nice thing with the MAC approach is that many of the checks were alre= ady > carefully placed to not deviate too much from expected behavior for > applications.=A0 At first I tried to do all of the checks in namei() and = this > often made syscalls fail too early with the wrong errnos and this confuses > some programs.=A0 When I figured out the right place to add the checks it= was > almost always right next to a MAC check. >=20 > Also, if I hadn't used a MAC module and added a new layer instead, you co= uld > say that it would have been the fifth (!!!) general access control mechan= ism > in the kernel (after traditional UNIX, Capsicum, jails and MAC).=A0 This = was > starting to feel like a bit much.=A0 So the MAC framework, it's not a per= fect > fit for some of what this module wants to do but it could be worse. While I think using the MAC framework here was definitely the right choice, I also think it's important to note the one major downside of the MAC framework: function pointers. A kernel exploit could nullify one or more MAC calls by overwriting a function pointer. Additionally, in certain circumstances, a function pointer could be overwritten to point to another spot in memory. The next time the fptr is called, the originally intended code isn't executed--rather, a new code path. Again, I think using MAC here is the right way to go. Thanks, --=20 Shawn Webb Cofounder / Security Engineer HardenedBSD https://git.hardenedbsd.org/hardenedbsd/pubkeys/-/raw/master/Shawn_Webb/03A= 4CBEBB82EA5A67D9F3853FF2E67A277F8E1FA.pub.asc --z3regbayyxs4mrei Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEA6TL67gupaZ9nzhT/y5nonf44foFAmJEtNwACgkQ/y5nonf4 4fpjAg//bFb4nturw6rSY/MpDj3mVps0OeYncRynpc+apbKI5qHIINN1fxf3mPJ5 F0Eklg1F0IJdxzTSFVy94iEPDrDi39zJyp5LW8GM4tEdtPcdVw3tHhdOUhZ/DWdh NhvSNNQ5yRANzXr8YsXIMyiHrgO+D48mcXiKD8fhrM/iXc0dPW8coNJkHiU9etQV vnxhMmch5iN6g7IS4rZOsp9mbstKD2YZVat3ETJTnwGxdD3X23WVF4tu5K9+cfvb rA4XD/ve5IcVDsZKzxt5EoSBJm3dz9KkdczP1JeiLNTK6EWm8cFLfK26weDTGM5l /YuprWGmChW0TthPZSA7jLPpdYAj2JcwM5Lo7IMGpVsxmZKqAo4ftNCkR1WzKbt+ zeycvXFsKaRL0+DxtyYzPILAg+RAHI1c/XDFewpR6uKweM5IJjsVZYQWg59GiJOP /WxdPMqLxT9Q2Df9rSZFpYa6yUt3ms4f5nuDtBdAQP3b9VE6N6t6yw17UwuCTyuC BHAPxOpoIgdkdcrx0xx0fGkASnwqBDLmKPyiSKqtmI+DBMpXbURSxhNMMVv6gNGu NvsOiJZi2JLrJJY0O/L4Z+Lvdl3gr4DtjxaAQB6/sfnNne93ASQ8NyeedLgMoowu guDbHD4PeGrTuGYx9TxY3gEY4iQr69QPRQi2Gm9aQ48s/Ixx+ps= =QZsf -----END PGP SIGNATURE----- --z3regbayyxs4mrei--