From mboxrd@z Thu Jan 1 00:00:00 1970 From: Doug Goldstein Subject: Re: XSM permissive by default. Date: Thu, 10 Mar 2016 11:34:59 -0600 Message-ID: <56E1B043.2020508@cardoe.com> References: <20160309015100.GA5420@localhost.localdomain> <56E023FF.1020706@citrix.com> <20160309211735.GA28919@char.us.oracle.com> <56E09F20.7090601@tycho.nsa.gov> <56E0DE85.7000805@cardoe.com> <20160310171059.GA32334@char.us.oracle.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============6835658127045252413==" Return-path: Received: from mail6.bemta5.messagelabs.com ([195.245.231.135]) by lists.xen.org with esmtp (Exim 4.84) (envelope-from ) id 1ae4UN-0004TD-VP for xen-devel@lists.xenproject.org; Thu, 10 Mar 2016 17:35:08 +0000 Received: by mail-yw0-f180.google.com with SMTP id h129so73608414ywb.1 for ; Thu, 10 Mar 2016 09:35:06 -0800 (PST) In-Reply-To: <20160310171059.GA32334@char.us.oracle.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" To: Konrad Rzeszutek Wilk Cc: Andrew Cooper , Daniel De Graaf , xen-devel@lists.xenproject.org List-Id: xen-devel@lists.xenproject.org This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --===============6835658127045252413== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="8dSokJUfJCgfhm6FFSch48b84r0UeNoRr" This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --8dSokJUfJCgfhm6FFSch48b84r0UeNoRr Content-Type: multipart/mixed; boundary="0EMLHEivWSsiP6ds8vs9pbfEe2uueQKvg" From: Doug Goldstein To: Konrad Rzeszutek Wilk Cc: Daniel De Graaf , Andrew Cooper , xen-devel@lists.xenproject.org Message-ID: <56E1B043.2020508@cardoe.com> Subject: Re: [Xen-devel] XSM permissive by default. References: <20160309015100.GA5420@localhost.localdomain> <56E023FF.1020706@citrix.com> <20160309211735.GA28919@char.us.oracle.com> <56E09F20.7090601@tycho.nsa.gov> <56E0DE85.7000805@cardoe.com> <20160310171059.GA32334@char.us.oracle.com> In-Reply-To: <20160310171059.GA32334@char.us.oracle.com> --0EMLHEivWSsiP6ds8vs9pbfEe2uueQKvg Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable On 3/10/16 11:10 AM, Konrad Rzeszutek Wilk wrote: > On Wed, Mar 09, 2016 at 08:40:05PM -0600, Doug Goldstein wrote: >> On 3/9/16 4:09 PM, Daniel De Graaf wrote: >>> On 03/09/2016 04:17 PM, Konrad Rzeszutek Wilk wrote: >>>> On Wed, Mar 09, 2016 at 01:24:15PM +0000, Andrew Cooper wrote: >>>>> On 09/03/16 01:51, Konrad Rzeszutek Wilk wrote: >>>>>> Hey, >>>>>> >>>>>> I was wondering if it we should change the default flask_bootparam= >>>>>> option from permissive to disabled? >> >>>>> >>>>> By the looks of it, "permissive" shouldn't be an available option a= t >>>>> all. >>> >>> Permissive is meant for developing (or debugging) a disaggregated sys= tem, >>> where the restrictions on non-dom0 would also break the system. Howe= ver, >>> I agree that it needs to be harder to end up in this mode by accident= =2E >>> >>> The simplest solution in my opinion is to change the boot parameter t= o >>> default to "flask=3Denforcing", which will fail the boot if a policy = is >>> not available prior to dom0 creation. This would require any setup >>> where the policy is loaded from userspace to explicitly specify >>> "flask=3Dlate", whereas they can currently get away with no parameter= =2E >>> >>> Another solution would be to default to "flask=3Dlate" and either den= y the >>> creation of domains if a policy is not present, or automatically reve= rt >>> to the dummy module on domain creation with no loaded policy. The la= tter >>> probably deserves a different name ("flask=3Dauto"?). >>> >> >> Honestly I'm in favor of secure by default approach. Since Xen is not >> built with flask by default to me the sane approach would be to defaul= t >> the system to "flask=3Denforcing". >> >> "flask=3Dlate" not allowing the creation of domains sounds good but wh= at >> if you're using a disaggregated dom0 with some domDs and one of them >> needs to be up to fetch your policy? Just a hypothetical. >> >> XSMs like LSMs just aren't meant to be swapped around at runtime and >> like Daniel points out if go down the road of swapping to the dummy >> module there could be further dragons and whose to say someone won't >> look at that and put something in that allows you to switch to another= >> later on (yes I know there's only really 1 but I'm speaking of the >> hypothetical). >=20 >=20 > I presume this patch would be to folks +1: >=20 > From 3373a50f386b41eea6ecede4b430e4fa09b2fe7e Mon Sep 17 00:00:00 2001 > From: Konrad Rzeszutek Wilk > Date: Thu, 10 Mar 2016 12:05:29 -0500 > Subject: [PATCH] flask: By default be in FLASK_BOOTPARAM_ENFORCING mode= =2E >=20 > By default the mode was 'permissive' which is "meant for > developing (or debugging) a disaggregated system, > where the restrictions on non-dom0 would also break the system." >=20 > However this default mode made it possible to boot an machine > in this state if a policy file during bootup was not provided. >=20 > The end was less secure than with XSM-enabled - any guest > could do any operation (including rebooting the machine). >=20 > Alternative solutions such as switching from flask to dummy. > However "The main issue with starting with dummy and then > switching to FLASK is that any domains created while using > the dummy policy won't have flask_domain_alloc_security called > to populate domain->ssid, and the rest of the flask code relies > on this being non-NULL. The same would be true for event channels, > but inlining the field to save space makes that a non-issue." >=20 > (both excerpts are from Daniel De Graaf emails). >=20 > This is a much easier fix. >=20 > Suggested-by: Daniel De Graaf > Signed-off-by: Konrad Rzeszutek Wilk > --- > docs/misc/xen-command-line.markdown | 2 +- > xen/xsm/flask/flask_op.c | 2 +- > 2 files changed, 2 insertions(+), 2 deletions(-) >=20 > diff --git a/docs/misc/xen-command-line.markdown b/docs/misc/xen-comman= d-line.markdown > index ca77e3b..9e77f8a 100644 > --- a/docs/misc/xen-command-line.markdown > +++ b/docs/misc/xen-command-line.markdown > @@ -662,7 +662,7 @@ to use the default. > ### flask > > `=3D permissive | enforcing | late | disabled` > =20 > -> Default: `permissive` > +> Default: `enforcing` > =20 > Specify how the FLASK security server should be configured. This opti= on is only > available if the hypervisor was compiled with XSM support (which can b= e enabled > diff --git a/xen/xsm/flask/flask_op.c b/xen/xsm/flask/flask_op.c > index f4f5dd1..aaed75d 100644 > --- a/xen/xsm/flask/flask_op.c > +++ b/xen/xsm/flask/flask_op.c > @@ -25,7 +25,7 @@ > #define _copy_to_guest copy_to_guest > #define _copy_from_guest copy_from_guest > =20 > -enum flask_bootparam_t __read_mostly flask_bootparam =3D FLASK_BOOTPAR= AM_PERMISSIVE; > +enum flask_bootparam_t __read_mostly flask_bootparam =3D FLASK_BOOTPAR= AM_ENFORCING; > static void parse_flask_param(char *s); > custom_param("flask", parse_flask_param); > =20 >=20 +1 You also found a spot that I didn't find when doing the Kconfig conversion of CONFIG_XSM / CONFIG_FLASK. My search didn't catch XSM\_ENABLE so follow on patch from me for that will be coming. Reviewed-by: Doug Goldstein --=20 Doug Goldstein --0EMLHEivWSsiP6ds8vs9pbfEe2uueQKvg-- --8dSokJUfJCgfhm6FFSch48b84r0UeNoRr Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0 iQJ8BAEBCgBmBQJW4bBGXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXRBNTM5MEQ2RTNFMTkyNzlCNzVDMzIwOTVB MkJDMDNEQzg3RUQxQkQ0AAoJEKK8A9yH7RvUyLMP/2a7P4zpZsZW65LtG/wHDDUk oYIz1m+UyHhUQDa6tLm/P3q8Zw5pptpv+bZ4B3nO0mm+GuwKPvXy6Qy5OVKnpPD0 F4hdZU1pCfgsqHkqs1CIc+Gikh04WYLnWHXq3dqbvPLGLkUWLcI6TYI89hd7e6zn mJzsDs6ZUj/rLORgKehvUFTtKc2LnTinbECRGdyql5LNB7m9FIBl9gwSqoEKJAA5 xb2rvylVSX3R2w872w59FLicgrCqiFGmFzmjagXCUsKj9Dmp7DNNJJqUykrNx0UX BJqhUz2HXlGab/R7v5Q2kPA35LUI3iRJ8IE/CE2lQAWH2U1kof1MQslDY/3lXMw2 ZOoYhpqsOhmQWZkqq9uGTvjBH9n6wIPeP6UcOAD03JlM3pWAX0tKJOnGPS4rcMOe bRhOARRQC+s62JtI2Y8B3y2B+Bi80+9DwFlZm+8fQK+zxAysBDjysjoZheI6rLy8 O6/ze9Fki9sLIozuxK2Mz2EVf3TQhYbPy/zH6yBk0CN4Tdk5pIA4AsciBQJHznBK QkDipOf+XmJCrAUbX74yCZgNLUcox3FFniizztnMt+GO2nzEyMQkmtlI31GDVg/1 mhVTQwgdaQYX1BAtkkHB7pAxD/1JHlr1W/oehyo4kX5rxOhtyrxQHSiw3jDSIJOF Sv41qmasT35qGywJhE/y =hkjW -----END PGP SIGNATURE----- --8dSokJUfJCgfhm6FFSch48b84r0UeNoRr-- --===============6835658127045252413== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KWGVuLWRldmVs IG1haWxpbmcgbGlzdApYZW4tZGV2ZWxAbGlzdHMueGVuLm9yZwpodHRwOi8vbGlzdHMueGVuLm9y Zy94ZW4tZGV2ZWwK --===============6835658127045252413==--