Re: [PATCH v1 0/8] x86_64 SandBox Mode arch hooks

[Petr Tesařík]

(+Cc Kees)

On Wed, 14 Feb 2024 18:14:49 +0000
"Edgecombe, Rick P" <rick.p.edgecombe@xxxxxxxxx> wrote:

> On Wed, 2024-02-14 at 17:41 +0100, Petr Tesařík wrote:
> > Second, a sandbox can run unmodified kernel code and interact
> > directly
> > with other parts of the kernel. It's not really possible with this
> > initial patch series, but the plan is that sandbox mode can share
> > locks
> > with the kernel.
> > 
> > Third, sandbox code can be trusted for operations like parsing keys
> > for
> > the trusted keychain if the kernel is locked down, i.e. when even a
> > process with UID 0 is not on the same trust level as kernel mode.  
> 
> What use case needs to have the sandbox both protected from the kernel
> (trusted operations) and non-privileged (the kernel protected from it
> via CPL3)? It seems like opposite things.

I think I have mentioned one: parsing keys for the trusted keyring. The
parser is complex enough to be potentially buggy, but the security
folks have already dismissed the idea to run it as a user mode helper.

Petr T