Re: Looking for users of userfaultfd(2) syscall in Fedora

Adrian Reber <[email protected]> Tue, 6 Apr 2021 19:07:18 +0200

Newsgroups	gmane.linux.redhat.fedora.devel,gmane.linux.redhat.fedora.selinux
Message-ID	<[email protected]>

On Tue, Apr 06, 2021 at 06:57:27PM +0200, Ondrej Mosnacek wrote:
> Hi all,
> 
> Kernel 5.12 added support to SELinux for controlling access to the
> userfaultfd interface [1][2] and we'd like to implement this in
> Fedora's selinux-policy. However, once we add the corresponding class
> to the policy, all SELinux domains for which we don't add the
> appropriate rules will have any usage of userfaultfd(2) denied.
> 
> Therefore, we would like to identify as many users of this syscall as
> possible before we make that change, so that we can add and test all
> the needed rules in one go, minimizing the amount of denials found
> after the fact. My understanding is that userfaultfd(2) doesn't have
> many users among system services, so it should be possible to catch
> most/all of them in advance.
> 
> So if you know that your (or any other) Fedora component uses
> userfaultfd(2), please let us know. AFAIK, at least QEMU most likely
> uses it, so we'll have that one on our radar, but we'd like to know if
> there are any other programs/services we need to cover.

CRIU can use userfaultfd to lazy migrate processes from one host to
another. It can be also triggered from runc when migrating containers.
As far as I know userfaultfd based container migration is not exposed in
any container engine above the level of runc.

		Adrian

_______________________________________________
devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

signature.asc (application/pgp-signature, 833 B)