From: Jean-Philippe Brucker <jean-philippe@linaro.org>
To: Rajat Jain <rajatja@google.com>
Cc: Bjorn Helgaas <bhelgaas@google.com>,
Bjorn Helgaas <helgaas@kernel.org>,
linux-pci <linux-pci@vger.kernel.org>,
Mika Westerberg <mika.westerberg@linux.intel.com>,
Prashant Malani <pmalani@google.com>,
Benson Leung <bleung@google.com>, Todd Broch <tbroch@google.com>,
Alex Levin <levinale@google.com>,
Mattias Nissler <mnissler@google.com>,
Zubin Mithra <zsm@google.com>, Rajat Jain <rajatxjain@gmail.com>,
"Keany, Bernie" <bernie.keany@intel.com>,
Aaron Durbin <adurbin@google.com>,
Diego Rivas <diegorivas@google.com>,
Duncan Laurie <dlaurie@google.com>,
Furquan Shaikh <furquan@google.com>,
Jesse Barnes <jsbarnes@google.com>
Subject: Re: [RFC] Restrict the untrusted devices, to bind to only a set of "whitelisted" drivers
Date: Mon, 4 May 2020 13:59:42 +0200 [thread overview]
Message-ID: <20200504115942.GB64193@myrica> (raw)
In-Reply-To: <20200504114727.GA64193@myrica>
On Mon, May 04, 2020 at 01:47:27PM +0200, Jean-Philippe Brucker wrote:
> Hi,
>
> On Fri, May 01, 2020 at 04:07:10PM -0700, Rajat Jain wrote:
> > Hi,
> >
> > Currently, the PCI subsystem marks the PCI devices as "untrusted", if
> > the firmware asks it to:
> >
> > 617654aae50e ("PCI / ACPI: Identify untrusted PCI devices")
> > 9cb30a71acd4 ("PCI: OF: Support "external-facing" property")
> >
> > An "untrusted" device indicates a (likely external facing) device that
> > may be malicious, and can trigger DMA attacks on the system. It may
> > also try to exploit any vulnerabilities exposed by the driver, that
> > may allow it to read/write unintended addresses in the host (e.g. if
> > DMA buffers for the device, share memory pages with other driver data
> > structures or code etc).
> >
> > High Level proposal
> > ===============
> > Currently, the "untrusted" device property is used as a hint to enable
> > IOMMU restrictions (on Intel), disable ATS (on ARM) etc. We'd like to
> > go a step further, and allow the administrator to build a list of
> > whitelisted drivers for these "untrusted" devices.
>
> How about letting the administrator whitelist devices that are trusted,
> rather than whitelisting drivers?
Uh, I completely missed the point. Your proposal is about preventing from
binding any untrusted devices to non-whitelisted drivers. Please disregard
my reply :)
Thanks,
Jean
>
> The "thunderclap" attack [1] emulates an existing device using an FPGA in
> order to get probed by the device driver, and then bypasses a weakened
> IOMMU. By design the driver cannot differentiate a well-behaved device
> from a malicious one, so changing the trust level of the driver doesn't
> feel like the right way. What the admin wants to say is "I trust this
> port, no one is plugging any malicious device in here."
>
> Then you could also make the option 3-way: either keep the default trust
> fixed by FW, or manually set "trusted" or "untrusted".
>
> For reference there have been several discussions, recently, about letting
> admins change IOMMU configuration for a device. A PCI command-line option
> [2] was suggested, but I think the current proposal is a sysfs knob on
> IOMMU groups [3], that can be changed while devices are unbound from
> drivers. It's not completely relevant since the "untrusted" property isn't
> tied to the IOMMU subsystem, but seemed worth mentioning.
>
> [1] https://thunderclap.io/thunderclap-paper-ndss2019.pdf
> [2] https://lore.kernel.org/linux-iommu/20200101052648.14295-3-baolu.lu@linux.intel.com/
> [3] https://lore.kernel.org/linux-iommu/5aa5ef20ff81f706aafa9a6af68cef98fe60ad0f.1581619464.git.sai.praneeth.prakhya@intel.com/
>
> Thanks,
> Jean
>
> > This whitelist of
> > drivers are the ones that he trusts enough to have little or no
> > vulnerabilities. (He may have built this list of whitelisted drivers
> > by a combination of code analysis of drivers, or by extensive testing
> > using PCIe fuzzing etc). We propose that the administrator be allowed
> > to specify this list of whitelisted drivers to the kernel, and the PCI
> > subsystem to impose this behavior:
> >
> > 1) The "untrusted" devices can bind to only "whitelisted drivers".
> > 2) The other devices (i.e. dev->untrusted=0) can bind to any driver.
> >
> > Of course this behavior is to be imposed only if such a whitelist is
> > provided by the administrator.
> >
> > Details
> > ======
> >
> > 1) A kernel argument ("pci.impose_driver_whitelisting") to enable
> > imposing of whitelisting by PCI subsystem.
> >
> > 2) Add a flag ("whitelisted") in struct pci_driver to indicate whether
> > the driver is whitelisted.
> >
> > 3) Use the driver's "whitelisted" flag and the device's "untrusted"
> > flag, to make a decision about whether to bind or not in
> > pci_bus_match() or similar.
> >
> > 4) A mechanism to allow the administrator to specify the whitelist of
> > drivers. I think this needs more thought as there are multiple
> > options.
> >
> > a) Expose individual driver's "whitelisted" flag to userspace so a
> > boot script can whitelist that driver. There are questions that still
> > need answered though e.g. what to do about the devices that may have
> > already been enumerated and rejected by then? What to do with the
> > already bound devices, if the user changes a driver to remove it from
> > the whitelist. etc.
> >
> > b) Provide a way to specify the whitelist via the kernel command
> > line. Accept a ("pci.whitelist") kernel parameter which is a comma
> > separated list of driver names (just like "module_blacklist"), and
> > then use it to initialize each driver's "whitelisted" flag as the
> > drivers are registered. Essentially this would mean that the whitelist
> > of devices cannot be changed after boot.
> >
> > To me (b) looks a better option but I think a future requirement would
> > be the ability to remove the drivers from the whitelist after boot
> > (adding drivers to whitelist at runtime may not be that critical IMO)
> >
> > WDYT?
> >
> > Thanks,
> >
> > Rajat
next prev parent reply other threads:[~2020-05-04 11:59 UTC|newest]
Thread overview: 51+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-01 23:07 [RFC] Restrict the untrusted devices, to bind to only a set of "whitelisted" drivers Rajat Jain
2020-05-04 11:47 ` Jean-Philippe Brucker
2020-05-04 11:59 ` Jean-Philippe Brucker [this message]
2020-05-04 19:17 ` Rajat Jain
2020-05-05 12:33 ` Mika Westerberg
2020-05-06 18:51 ` Rajat Jain
2020-05-11 20:31 ` Rajat Jain
2020-05-13 15:19 ` Bjorn Helgaas
2020-05-13 21:26 ` Rajat Jain
2020-05-14 13:42 ` Mika Westerberg
2020-05-14 19:12 ` Raj, Ashok
2020-05-15 2:18 ` Rajat Jain
2020-05-26 16:30 ` Rajat Jain
2020-06-01 23:25 ` Bjorn Helgaas
2020-06-02 5:06 ` Greg Kroah-Hartman
2020-06-03 2:27 ` Rajat Jain
2020-06-03 6:07 ` Greg Kroah-Hartman
2020-06-03 11:51 ` Rajat Jain
2020-06-03 12:16 ` Greg Kroah-Hartman
2020-06-03 12:57 ` Rajat Jain
2020-06-03 13:29 ` Greg Kroah-Hartman
2020-06-04 19:38 ` Rajat Jain
2020-06-05 8:02 ` Greg Kroah-Hartman
2020-06-06 1:08 ` Rajat Jain
2020-06-07 11:36 ` Greg Kroah-Hartman
2020-06-08 17:03 ` Jesse Barnes
2020-06-08 17:50 ` Greg Kroah-Hartman
2020-06-08 18:29 ` Jesse Barnes
2020-06-08 18:41 ` Rajat Jain
2020-06-09 9:54 ` Greg Kroah-Hartman
2020-06-30 21:46 ` Pavel Machek
2020-06-09 5:57 ` Greg Kroah-Hartman
2020-06-30 21:45 ` Pavel Machek
2020-07-01 6:54 ` Greg Kroah-Hartman
2020-07-01 8:47 ` Pavel Machek
2020-07-01 10:57 ` Greg Kroah-Hartman
2020-07-01 11:08 ` Pavel Machek
2020-06-09 21:04 ` Bjorn Helgaas
2020-06-09 23:23 ` Rajat Jain
2020-06-10 0:04 ` Bjorn Helgaas
2020-06-10 0:30 ` Rajat Jain
2020-06-10 20:17 ` Rajat Jain
2020-06-10 23:09 ` Bjorn Helgaas
2020-06-10 23:01 ` Bjorn Helgaas
2020-06-10 23:46 ` Rajat Jain
2020-06-10 7:13 ` Greg Kroah-Hartman
2020-06-10 1:34 ` Oliver O'Halloran
2020-06-10 19:57 ` Rajat Jain
2020-06-16 1:24 ` Rajat Jain
2020-06-10 7:12 ` Greg Kroah-Hartman
2020-05-15 12:44 ` Joerg Roedel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200504115942.GB64193@myrica \
--to=jean-philippe@linaro.org \
--cc=adurbin@google.com \
--cc=bernie.keany@intel.com \
--cc=bhelgaas@google.com \
--cc=bleung@google.com \
--cc=diegorivas@google.com \
--cc=dlaurie@google.com \
--cc=furquan@google.com \
--cc=helgaas@kernel.org \
--cc=jsbarnes@google.com \
--cc=levinale@google.com \
--cc=linux-pci@vger.kernel.org \
--cc=mika.westerberg@linux.intel.com \
--cc=mnissler@google.com \
--cc=pmalani@google.com \
--cc=rajatja@google.com \
--cc=rajatxjain@gmail.com \
--cc=tbroch@google.com \
--cc=zsm@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).