Re: Permissions for eBPF objects

2017-08-29 Thread Mickaël Salaün
On 29/08/2017 03:44, Chenbo Feng wrote: > On Mon, Aug 28, 2017 at 6:15 PM, Alexei Starovoitov > wrote: >> On Mon, Aug 28, 2017 at 05:47:19PM -0700, Chenbo Feng wrote: >>> On Fri, Aug 25, 2017 at 6:03 PM, Alexei Starovoitov >>> wrote: On Fri, Aug 25, 2017 at 10:07:27PM +0200, Daniel Borkmann

Re: Permissions for eBPF objects

2017-08-28 Thread Chenbo Feng
On Mon, Aug 28, 2017 at 6:15 PM, Alexei Starovoitov wrote: > On Mon, Aug 28, 2017 at 05:47:19PM -0700, Chenbo Feng wrote: >> On Fri, Aug 25, 2017 at 6:03 PM, Alexei Starovoitov >> wrote: >> > On Fri, Aug 25, 2017 at 10:07:27PM +0200, Daniel Borkmann wrote: >> >> On 08/25/2017 09:52 PM, Chenbo Fen

Re: Permissions for eBPF objects

2017-08-28 Thread Alexei Starovoitov
On Mon, Aug 28, 2017 at 05:47:19PM -0700, Chenbo Feng wrote: > On Fri, Aug 25, 2017 at 6:03 PM, Alexei Starovoitov > wrote: > > On Fri, Aug 25, 2017 at 10:07:27PM +0200, Daniel Borkmann wrote: > >> On 08/25/2017 09:52 PM, Chenbo Feng wrote: > >> > On Fri, Aug 25, 2017 at 12:45 PM, Jeffrey Vander S

Re: Permissions for eBPF objects

2017-08-28 Thread Chenbo Feng
On Fri, Aug 25, 2017 at 6:03 PM, Alexei Starovoitov wrote: > On Fri, Aug 25, 2017 at 10:07:27PM +0200, Daniel Borkmann wrote: >> On 08/25/2017 09:52 PM, Chenbo Feng wrote: >> > On Fri, Aug 25, 2017 at 12:45 PM, Jeffrey Vander Stoep >> > wrote: >> > > On Fri, Aug 25, 2017 at 12:26 PM, Stephen Sma

Re: Permissions for eBPF objects

2017-08-25 Thread Alexei Starovoitov
On Fri, Aug 25, 2017 at 10:07:27PM +0200, Daniel Borkmann wrote: > On 08/25/2017 09:52 PM, Chenbo Feng wrote: > > On Fri, Aug 25, 2017 at 12:45 PM, Jeffrey Vander Stoep > > wrote: > > > On Fri, Aug 25, 2017 at 12:26 PM, Stephen Smalley > > > wrote: > > > > On Fri, 2017-08-25 at 11:01 -0700, Jef

Re: Permissions for eBPF objects

2017-08-25 Thread Chenbo Feng
On Fri, Aug 25, 2017 at 1:40 PM, Stephen Smalley wrote: > On Fri, 2017-08-25 at 12:52 -0700, Chenbo Feng via Selinux wrote: >> On Fri, Aug 25, 2017 at 12:45 PM, Jeffrey Vander Stoep > com> wrote: >> > On Fri, Aug 25, 2017 at 12:26 PM, Stephen Smalley > > v> wrote: >> > > On Fri, 2017-08-25 at 11:0

Re: Permissions for eBPF objects

2017-08-25 Thread Stephen Smalley
On Fri, 2017-08-25 at 12:52 -0700, Chenbo Feng via Selinux wrote: > On Fri, Aug 25, 2017 at 12:45 PM, Jeffrey Vander Stoep com> wrote: > > On Fri, Aug 25, 2017 at 12:26 PM, Stephen Smalley > v> wrote: > > > On Fri, 2017-08-25 at 11:01 -0700, Jeffrey Vander Stoep via > > > Selinux > > > wrote: > >

Re: Permissions for eBPF objects

2017-08-25 Thread Daniel Borkmann
On 08/25/2017 09:52 PM, Chenbo Feng wrote: On Fri, Aug 25, 2017 at 12:45 PM, Jeffrey Vander Stoep wrote: On Fri, Aug 25, 2017 at 12:26 PM, Stephen Smalley wrote: On Fri, 2017-08-25 at 11:01 -0700, Jeffrey Vander Stoep via Selinux wrote: I’d like to get your thoughts on adding LSM permission

Re: Permissions for eBPF objects

2017-08-25 Thread Casey Schaufler
Adding the LSM list to the thread. On 8/25/2017 11:01 AM, Jeffrey Vander Stoep via Selinux wrote: > I’d like to get your thoughts on adding LSM permission checks on BPF objects. Aside from the use of these objects requiring privilege, what sort of controls do you think might be reasonable? Who "o

Re: Permissions for eBPF objects

2017-08-25 Thread Chenbo Feng
On Fri, Aug 25, 2017 at 12:45 PM, Jeffrey Vander Stoep wrote: > On Fri, Aug 25, 2017 at 12:26 PM, Stephen Smalley wrote: >> On Fri, 2017-08-25 at 11:01 -0700, Jeffrey Vander Stoep via Selinux >> wrote: >>> I’d like to get your thoughts on adding LSM permission checks on BPF >>> objects. >>> >>> B

Re: Permissions for eBPF objects

2017-08-25 Thread Jeffrey Vander Stoep
On Fri, Aug 25, 2017 at 12:26 PM, Stephen Smalley wrote: > On Fri, 2017-08-25 at 11:01 -0700, Jeffrey Vander Stoep via Selinux > wrote: >> I’d like to get your thoughts on adding LSM permission checks on BPF >> objects. >> >> By default, the ability to create and use eBPF maps/programs requires >>

Re: Permissions for eBPF objects

2017-08-25 Thread Stephen Smalley
On Fri, 2017-08-25 at 11:01 -0700, Jeffrey Vander Stoep via Selinux wrote: > I’d like to get your thoughts on adding LSM permission checks on BPF > objects. > > By default, the ability to create and use eBPF maps/programs requires > CAP_SYS_ADMIN [1]. Alternatively, all processes can be granted ac

Permissions for eBPF objects

2017-08-25 Thread Jeffrey Vander Stoep
I’d like to get your thoughts on adding LSM permission checks on BPF objects. By default, the ability to create and use eBPF maps/programs requires CAP_SYS_ADMIN [1]. Alternatively, all processes can be granted access to bpf() functions. This seems like poor granularity. [2] Like files and socket