[knem-devel] knem security

Brice Goglin Brice.Goglin at inria.fr
Fri Jul 12 10:55:31 CEST 2013


Le 12/07/2013 10:41, Mark Dixon a écrit :
> Hi,
>
> I'm taking a look at using knem, to see if it speeds up some
> applications using OpenMPI; however, the knem documentation doesn't
> mention anything about its security layer, e.g. preventing memory
> belonging to one user or application being read by another. This is
> important in our environment.
>
> Can someone describe what the thinking is behind this, please? Is it
> entirely down to the predictability of the 64bit cookie described in
> the interface documentation?
>
> Thanks,
>
> Mark


Hello Mark,

Three things to know:
* If your application doesn't open /dev/knem, no problem (pass (--mca
btl_sm_use_knem 0" to OpenMPI to do so)
* If your application opens /dev/knem, only the memory that is declared
as a region is accessible. All other memory segments are not accessible.
Contrary to Limic, a malicious user cannot create "fake KNEM cookies"
pointing to memory regions that have not been explicitly declared to
KNEM by another process.
* Once these checks are passed, the predictability of the 64bits cookie
is what remains. Although the way I compute the cookie value isn't
basic, it's not very complex either. I think a malicious user may find
out the next cookies if he knows a first valid cookie value (he reads
the KNEM driver code).

There has been some talk about restricting cross-application KNEM access
to same user only. Right now, you would have to restrict accesses to
/dev/knem to a single user or group to do so.

KNEM was somehow designed with the idea that it's only used in HPC
environment, and the idea that people that care about such risks would
not let multiple users/jobs use the same nodes simultaneously.

Does that help?

Brice




More information about the knem-devel mailing list