From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758627AbdJMPod (ORCPT ); Fri, 13 Oct 2017 11:44:33 -0400 Received: from esa3.dell-outbound.iphmx.com ([68.232.153.94]:51495 "EHLO esa3.dell-outbound.iphmx.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753366AbdJMPob (ORCPT ); Fri, 13 Oct 2017 11:44:31 -0400 From: X-LoopCount0: from 10.166.132.169 X-IronPort-AV: E=Sophos;i="5.43,371,1503378000"; d="scan'208";a="73198240" X-DLP: DLP_GlobalPCIDSS To: CC: , , , , , , , , , , Subject: RE: [PATCH v7 10/15] platform/x86: dell-smbios: add filtering capability for requests Thread-Topic: [PATCH v7 10/15] platform/x86: dell-smbios: add filtering capability for requests Thread-Index: AQHTQ7y+iRM7rrgYDka8Ai0Uoa3NM6Lh27kA///18iCAAGgIAP//sNMQ Date: Fri, 13 Oct 2017 15:44:18 +0000 Message-ID: References: <83dc225624f1cde5ee1797aebc945732444ded91.1507733291.git.mario.limonciello@dell.com> <20171012110903.3ab4ed5e@alans-desktop> <20171013004645.GB1470@fury> <20171013094314.GB29864@kroah.com> <62ce0707d58b42618128e68f3bb9a45f@ausx13mpc124.AMER.DELL.COM> <20171013161936.430f7a02@alans-desktop> In-Reply-To: <20171013161936.430f7a02@alans-desktop> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.143.242.75] Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by nfs id v9DFibAv011810 > -----Original Message----- > From: Alan Cox [mailto:gnomes@lxorguk.ukuu.org.uk] > Sent: Friday, October 13, 2017 10:20 AM > To: Limonciello, Mario > Cc: greg@kroah.com; dvhart@infradead.org; andy.shevchenko@gmail.com; > linux-kernel@vger.kernel.org; platform-driver-x86@vger.kernel.org; > luto@kernel.org; quasisec@google.com; pali.rohar@gmail.com; > rjw@rjwysocki.net; mjg59@google.com; hch@lst.de > Subject: Re: [PATCH v7 10/15] platform/x86: dell-smbios: add filtering capability > for requests > > On Fri, 13 Oct 2017 15:03:10 +0000 > > Take off your "kernel" hat and put on a "customer" hat for a few moments > > while I try to put this in practical terms why the whitelist approach doesn't > > scale for what I'm trying to do. > > As a customer I'm more worried about someone trashing my system or > breaking my security. > > > So considering the above isn't offering stuff like this a decision better made by > the OEM? > > If the OEM doen't want customers to be able to modify something we don't > offer it in the > > manageability interface. If the kernel community doesn't want people to be > > modifying something the OEM does offer, it can just as well be blacklisted in > the > > kernel driver like the current filtering approach offers. > > So you implement the rule > > if (whitelisted & (capabilities && whitelist->capability_need) == > whitelist->capability_need)) > return ALLOWED; > > if (capable(CAP_SYS_RAWIO)) > return ALLOWED; > > return NO > > This puts you in the position where - known tools work and can sometimes > be unprivileged. Privileged tools with enough priv to screw the machien > can work anyway. Which is better than the starting point > > > You could further enhance this by having a CAP_SYS_RAWIO interface to add > whitelist entries, or to add an eBPF filter that can also make decisions > for you. > > Now you've got the ability to push a policy update. > > Alan Thanks for this idea, I think it's productive in working towards a solution. I'll give it some more thought on what items I feel should be whitelisted to unprivileged processes. I feel like the number of entries that match this will be fairly low. I think I'd actually like to meld this with your other ideas and what I've currently got. What do you think of this approach: /* kernel community doesn't feel userspace should have access at all * or other kernel drivers use this */ if (blacklisted) return NO; /* unprivileged access allowed */ if (whitelisted & (capabilities && whitelist->capability_need) == whitelist->capability_need)) return ALLOWED; /* not yet in whitelist, or need privs to do */ if (capable(CAP_SYS_RAWIO)) return ALLOWED; return NO