4 ms·

> Currently, io_uring system calls are included in Firecracker’s seccomp filter. Because it redefines how system calls are executed, io_uring offers a seccomp b

> Currently, io_uring system calls are included in Firecracker’s seccomp filter. Because it redefines how system calls are executed, io_uring offers a seccomp bypass for the supported system calls. This is because seccomp filtering occurs on system call entry after a thread context switch, but system calls executed via io_uring do not go through the normal system call entry. Therefore, Firecracker’s seccomp policy should be treated as its union with all system calls supported by io_uring. ... > Because of the nature of system call filtering via seccomp, io_uring still presents a major security disruption in sandboxing. This is pretty interesting as io_uring has been seen a lot of press as the hot new thing.

wyager 4y ago
Can't the kernel executor just check the seccomp rules when it pulls tasks off the iou queue?
- staticassertion 4y ago
  Fundamentally, yeah sure, it can do whatever it wants. It just doesn't right now.
- dmw_ng 4y ago
  There has been quite a bit of LWN coverage of io_uring security aspects, most recently https://lwn.net/Articles/902466/ https://lwn.net/Articles/902466/ The basic gist seems to be that it's just not currently the upstream developer's focus
twunde 4y ago
The author of this also did a writeup of an io_uring exploit a while back that you might find interesting https://www.graplsecurity.com/post/iou-ring-exploiting-the-linux-kernel https://www.graplsecurity.com/post/iou-ring-exploiting-the-l... (the September 8 date is definitely wrong, probably an artifact from moving blogging platforms)
raggi 4y ago
I'd love to see a move away from bpf hooks for security and ossify more of the key things as formal userspace API.
jeffbee 4y ago
io_uring is seriously undercooked as an idea. It's had a ton of CVEs already, and the fact that you can tell the kernel to go off and do something for you later in a big red flag for secure system design. That kind of facility needs to be very carefully designed, but io_uring was just dashed off in a mad hack without really thinking it through.
- staticassertion 4y ago
  TBH none of the kernel really gets designed with security in mind. It's a couple of people constantly trying to play catch up to get shit right where they can.
- pstuart 4y ago
  pity -- it's quite shiny from a distance.

wyager 4y ago

Can't the kernel executor just check the seccomp rules when it pulls tasks off the iou queue?

staticassertion 4y ago
Fundamentally, yeah sure, it can do whatever it wants. It just doesn't right now.
dmw_ng 4y ago
There has been quite a bit of LWN coverage of io_uring security aspects, most recently https://lwn.net/Articles/902466/ https://lwn.net/Articles/902466/ The basic gist seems to be that it's just not currently the upstream developer's focus

twunde 4y ago

The author of this also did a writeup of an io_uring exploit a while back that you might find interesting https://www.graplsecurity.com/post/iou-ring-exploiting-the-linux-kernel https://www.graplsecurity.com/post/iou-ring-exploiting-the-l... (the September 8 date is definitely wrong, probably an artifact from moving blogging platforms)

raggi 4y ago

I'd love to see a move away from bpf hooks for security and ossify more of the key things as formal userspace API.

jeffbee 4y ago

io_uring is seriously undercooked as an idea. It's had a ton of CVEs already, and the fact that you can tell the kernel to go off and do something for you later in a big red flag for secure system design. That kind of facility needs to be very carefully designed, but io_uring was just dashed off in a mad hack without really thinking it through.

staticassertion 4y ago
TBH none of the kernel really gets designed with security in mind. It's a couple of people constantly trying to play catch up to get shit right where they can.
pstuart 4y ago
pity -- it's quite shiny from a distance.