Controlling Script Execution
summary
Proposal adds a kernel-managed execution check so interpreters can ask the kernel “is this file allowed to be executed” using a new faccessat mode XAV_OK that both verifies execute permission and sets an internal F_MOD_EXEC flag propagated to LSMs and notification. Past prototypes (O_MAYEXEC, trusted_for) exist and parts landed; a prototype is implemented and requires small changes to interpreters to use file descriptors instead of paths. Configuration is per-mount-namespace via cctl, works for many cases but still loses atomic exec guarantees and needs handling for stdin/pipes.
AI-written summary · about
chapters (17)
- 0:00Script execution control
- 1:08Kernel script execution
- 2:57Kernel access control misses
- 4:21Control like binaries
- 6:52Script types and risks
- 7:13Omega Exec design
- 13:16Access family proposal
- 14:44Trusted For Us CD
- 16:13Xav okay mode
- 20:50Practical requirements
- 23:46New flags proposal
- 26:54Pros and cons
- 30:30Lessons and future
- 32:22Q&A session part one
- 34:29Q&A session part two
- 38:02Q&A session part three
- 43:02Q&A session part four
related talks
23mScript Integrity
26mA Practical Approach to Control Unauthorized Execution of Interpreters
38mBringing Object Delegation To AppArmor
47mApplication Whitelisting
45mContainer Kernel Development
22mBPF_LSM + fsverity for Binary Authorization
34mTying EVM into LSM Policy
50mImproving Container Security with System Call Interception