While we wait for Al's answer, it seems to me that filtering CDBs with cgroups is a pretty natural extension of filtering devices with cgroups. So here is a possible specification for such a cgroup. [CCing the libvirt mailing list since they could be one of the first clients] Paolo SG_IO Filter Controller ("cdb") 1. Description The cdb cgroup implement a way to filter allowed SCSI commands according to one or more Berkeley Packet Filter programs associated to the cgroup and its parents. BPF programs have access to the CDB and various ancillary data about the device. To be allowed, a command must be allowed by at least one program for each cgroup from the current task's to the root. In addition, as a general rule it must pass the regular check on privileged commands that is done even without cgroups. Groups with no programs are handled specially so that the default configuration is the same as without cgroups. Privileged tasks may install programs that bypass the usual check on "dangerous" SCSI commands. Non-privileged tasks in the same cgroup will also be able to bypass the check, but they may not widen their privileged abilities beyond what the cgroup already has. Administrators can replace the current entries, or add new ones. Replacing the entries in a cgroup will never affect those that are inherited from the parent. However when a parent cgroup is changed, the new filters will also apply to the children. 2. Operation The BPF program can return one of the following values: * 0: the CDB is denied. Another program in the cgroup will be tried, or the SG_IO ioctl will return with EPERM if there are none. * 1: the CDB is allowed; it should be subject to the bitmap that is used in the absence of cgroups. * 2: the CDB is allowed, and the generic filter may be bypassed. Programs that return 2 or the value of the accumulator are called privileged in the remainder of this document. BPF programs used with the cdb cgroup have access to the following ancillary values: * ANC_MAJOR (45): the major number of the device * ANC_MINOR (46): the minor number of the device * ANC_BLOCK (47): 1 if the device is a block device, 0 if it is a character device * ANC_PART (48): the partition number of the device; 0 if it is a character device * ANC_MODE (49): one of O_RDONLY/O_WRONLY/O_RDWR depending on how the file was opened. * ANC_RAWIO (50): 1 if the current process has CAP_SYS_RAWIO, 0 otherwise. Evaluation goes through all filters in each cgroup and picks the most permissive (largest) value. It also goes through all cgroups from the current task's up to the root, and executes filters in there; but here it picks the most restrictive value. In other words the result from multiple filters is "ORed", while the result from multiple cgroups is "ANDed". Cgroups with no filters are skipped, with one exception: if the current task is in a cgroup with no filters, it will behave as if it had this special filter: pseudocode: | BPF: if capable(CAP_SYS_RAWIO) | ANC RAWIO return 2 | ADD #1 else | RET A return 1 | This has two effects: 1) when a non-privileged task is moved from a privileged cgroup to a new cgroup, it will be subject to the generic filter; 2) when a task is in the root cgroup, and the root cgroup has no filters, it behaves as if the cdb cgroup did not exist at all. This maps to the following algorithm: privileged = YES allowed = YES for each cgroup C from the current task cdb cgroup to the root if no filters in C if C is the current task cdb cgroup privileged &= capable(CAP_SYS_RAWIO) continue privileged_this_cgroup = NO allowed_this_cgroup = NO for each filter F in C ret = run_filter(F, cdb) if ret != 0 then allowed_this_cgroup = YES if ret == 2 then privileged_this_cgroup = YES privileged &= privileged_this_cgroup allowed &= allowed_this_cgroup if !allowed then return EPERM if !privileged then test CDB against bitmap execute CDB (Of course some short-circuiting is possible). 3. User Interface The cgroup provides three files: * cdb.filter: entries are modified using this file. Entries are added if the file was opened with O_APPEND, otherwise they are replaced. Opening the file with O_TRUNC immediately removes all filters. These rules are chosen so that shell redirections (including ":>cdb.filter") will do the right thing. Adding or replacing programs requires CAP_SYS_ADMIN. Adding privileged programs *in addition* requires CAP_SYS_RAWIO. An entry is represented by multiple occurrences of the following structure, which must all be written with a single system call: struct bpf_insn { u16 code; u8 jt; u8 jf; u32 k; }; in the native endianness of the running architecture. A zero-length write will do nothing if the file was opened with O_APPEND, and remove all entries if it wasn't. * cdb.list: entries are retrieved using this file. All filters are preceded by a 32-bit value counting the number of bpf_insn structs in the program, and concatenated. * cdb.priv: returns 1 if the cgroup is privileged (has at least one privileged filter). This is true if at least one filter includes a "RET #2" or "RET A" instruction. 4. Security Filters that include the "RET A" or "RET #2" instructions can only be added by a task that has CAP_SYS_RAWIO; thus only tasks with CAP_SYS_RAWIO, who could bypass the bitmap themselves, can also let other processes do so. Such cgroups are marked as privileged; CAP_SYS_RAWIO is required to attach a process to a privileged cgroup. The privileged status is visible in the "cdb.priv" file. While such filters let non-privileged processes and their children bypass the bitmap, this only holds as long as the non-privileged process does none of the following operations (which by themselves require CAP_SYS_ADMIN): * replace all filters from the cgroup * create a new sub-cgroup and move itself to it Because in either case, the empty cgroup will behave as if it had "RET #1". In addition, new filters added to the cgroup will never widen the privileged abilities of the process, because filters with "RET #2" or "RET A" will not be allowed. 5. Examples of filters 5.1. Persistent reservations This filter lets a program use persistent reservations, plus any other command that is allowed without CAP_SYS_RAWIO: LD_B 0 ; A = cdb[0] JGT #0x5f, Lpass, 1f ; pass if > PR OUT 1: JGE #0x5e, Lpr, Lpass ; pass if < PR IN Lpass: RET #1 ; go to bitmap check Lpr: RET #2 ; bypass bitmap check A program could put itself in a new cgroup, add this filter and then drop CAP_SYS_RAWIO/CAP_SYS_ADMIN. 5.2. Arbitrary bitmap This filter could be used as a template to convert a 256-bit bitmap to a BPF program. LD_B 0 AND #31 TAX ; X = cdb[0] & 31 LD #1 LSH X TAX ; X = 1 << (cdb[0] & 31) LD_B 0 ; A = cdb[0] JSET #128, L1xx, L0xx ; Decode bit 7 of the opcode L0xx: JSET #64, L01x, L00x ; Decode bit 6 L1xx: JSET #64, L11x, L10x L00x: JSET #32, L001, L000 ; Decode bit 5 L01x: JSET #32, L011, L010 L10x: JSET #32, L101, L100 L11x: JSET #32, L111, L110 L000: TXA; JSET #..., Lpass, Lfail ; fill in bitmap values here L001: TXA; JSET #..., Lpass, Lfail L010: TXA; JSET #..., Lpass, Lfail L011: TXA; JSET #..., Lpass, Lfail L100: TXA; JSET #..., Lpass, Lfail L101: TXA; JSET #..., Lpass, Lfail L110: TXA; JSET #..., Lpass, Lfail L111: TXA; JSET #..., Lpass, Lfail Lpass: RET #1 ; could also be RET #2 Lfail: RET #0