tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

xen/privcmd: add boot control for restricted usage in domU

When running in an unprivileged domU under Xen, the privcmd driver
is restricted to allow only hypercalls against a target domain, for
which the current domU is acting as a device model.

Add a boot parameter "unrestricted" to allow all hypercalls (the
hypervisor will still refuse destructive hypercalls affecting other
guests).

Make this new parameter effective only in case the domU wasn't started
using secure boot, as otherwise hypercalls targeting the domU itself
might result in violating the secure boot functionality.

This is achieved by adding another lockdown reason, which can be
tested to not being set when applying the "unrestricted" option.

This is part of XSA-482

Signed-off-by: Juergen Gross <jgross@suse.com>
---
V2:
- new patch

Juergen Gross 1613462b 453b8fb6

+15
+13
drivers/xen/privcmd.c
··· 32 32 #include <linux/miscdevice.h> 33 33 #include <linux/moduleparam.h> 34 34 #include <linux/notifier.h> 35 + #include <linux/security.h> 35 36 #include <linux/virtio_mmio.h> 36 37 #include <linux/wait.h> 37 38 ··· 72 71 0644); 73 72 MODULE_PARM_DESC(dm_op_buf_max_size, 74 73 "Maximum size of a dm_op hypercall buffer"); 74 + 75 + static bool unrestricted; 76 + module_param(unrestricted, bool, 0); 77 + MODULE_PARM_DESC(unrestricted, 78 + "Don't restrict hypercalls to target domain if running in a domU"); 75 79 76 80 struct privcmd_data { 77 81 domid_t domid; ··· 1714 1708 1715 1709 static void __init restrict_driver(void) 1716 1710 { 1711 + if (unrestricted) { 1712 + if (security_locked_down(LOCKDOWN_XEN_USER_ACTIONS)) 1713 + pr_warn("Kernel is locked down, parameter \"unrestricted\" ignored\n"); 1714 + else 1715 + return; 1716 + } 1717 + 1717 1718 restrict_wait = true; 1718 1719 1719 1720 register_xenstore_notifier(&xenstore_notifier);
+1
include/linux/security.h
··· 145 145 LOCKDOWN_BPF_WRITE_USER, 146 146 LOCKDOWN_DBG_WRITE_KERNEL, 147 147 LOCKDOWN_RTAS_ERROR_INJECTION, 148 + LOCKDOWN_XEN_USER_ACTIONS, 148 149 LOCKDOWN_INTEGRITY_MAX, 149 150 LOCKDOWN_KCORE, 150 151 LOCKDOWN_KPROBES,
+1
security/security.c
··· 61 61 [LOCKDOWN_BPF_WRITE_USER] = "use of bpf to write user RAM", 62 62 [LOCKDOWN_DBG_WRITE_KERNEL] = "use of kgdb/kdb to write kernel RAM", 63 63 [LOCKDOWN_RTAS_ERROR_INJECTION] = "RTAS error injection", 64 + [LOCKDOWN_XEN_USER_ACTIONS] = "Xen guest user action", 64 65 [LOCKDOWN_INTEGRITY_MAX] = "integrity", 65 66 [LOCKDOWN_KCORE] = "/proc/kcore access", 66 67 [LOCKDOWN_KPROBES] = "use of kprobes",