From: Peter Xu <peterx@redhat.com> To: linux-kernel@vger.kernel.org Cc: Paolo Bonzini <pbonzini@redhat.com>, Hugh Dickins <hughd@google.com>, Luis Chamberlain <mcgrof@kernel.org>, Maxime Coquelin <maxime.coquelin@redhat.com>, kvm@vger.kernel.org, Jerome Glisse <jglisse@redhat.com>, Pavel Emelyanov <xemul@virtuozzo.com>, Johannes Weiner <hannes@cmpxchg.org>, peterx@redhat.com, Martin Cracauer <cracauer@cons.org>, Denis Plotnikov <dplotnikov@virtuozzo.com>, linux-mm@kvack.org, Marty McFadden <mcfadden8@llnl.gov>, Maya Gokhale <gokhale2@llnl.gov>, Mike Kravetz <mike.kravetz@oracle.com>, Andrea Arcangeli <aarcange@redhat.com>, Mike Rapoport <rppt@linux.vnet.ibm.com>, Kees Cook <keescook@chromium.org>, Mel Gorman <mgorman@suse.de>, "Kirill A . Shutemov" <kirill@shutemov.name>, linux-fsdevel@vger.kernel.org, "Dr . David Alan Gilbert" <dgilbert@redhat.com>, Andrew Morton <akpm@linux-foundation.org> Subject: [PATCH 0/3] userfaultfd: allow to forbid unprivileged users Date: Mon, 11 Mar 2019 17:36:58 +0800 [thread overview] Message-ID: <20190311093701.15734-1-peterx@redhat.com> (raw) Hi, (The idea comes from Andrea, and following discussions with Mike and other people) This patchset introduces a new sysctl flag to allow the admin to forbid users from using userfaultfd: $ cat /proc/sys/vm/unprivileged_userfaultfd [disabled] enabled kvm - When set to "disabled", all unprivileged users are forbidden to use userfaultfd syscalls. - When set to "enabled", all users are allowed to use userfaultfd syscalls. - When set to "kvm", all unprivileged users are forbidden to use the userfaultfd syscalls, except the user who has permission to open /dev/kvm. This new flag can add one more layer of security to reduce the attack surface of the kernel by abusing userfaultfd. Here we grant the thread userfaultfd permission by checking against CAP_SYS_PTRACE capability. By default, the value is "disabled" which is the most strict policy. Distributions can have their own perferred value. The "kvm" entry is a bit special here only to make sure that existing users like QEMU/KVM won't break by this newly introduced flag. What we need to do is simply set the "unprivileged_userfaultfd" flag to "kvm" here to automatically grant userfaultfd permission for processes like QEMU/KVM without extra code to tweak these flags in the admin code. Patch 1: The interface patch to introduce the flag Patch 2: The KVM related changes to detect opening of /dev/kvm Patch 3: Apply the flag to userfaultfd syscalls All comments would be greatly welcomed. Thanks, Peter Xu (3): userfaultfd/sysctl: introduce unprivileged_userfaultfd kvm/mm: introduce MMF_USERFAULTFD_ALLOW flag userfaultfd: apply unprivileged_userfaultfd check fs/userfaultfd.c | 121 +++++++++++++++++++++++++++++++++ include/linux/sched/coredump.h | 1 + include/linux/userfaultfd_k.h | 5 ++ init/Kconfig | 11 +++ kernel/sysctl.c | 11 +++ virt/kvm/kvm_main.c | 7 ++ 6 files changed, 156 insertions(+) -- 2.17.1
WARNING: multiple messages have this Message-ID (diff)
From: Peter Xu <peterx@redhat.com> To: linux-kernel@vger.kernel.org Cc: Paolo Bonzini <pbonzini@redhat.com>, Hugh Dickins <hughd@google.com>, Luis Chamberlain <mcgrof@kernel.org>, Maxime Coquelin <maxime.coquelin@redhat.com>, kvm@vger.kernel.org, Jerome Glisse <jglisse@redhat.com>, Pavel Emelyanov <xemul@virtuozzo.com>, Johannes Weiner <hannes@cmpxchg.org>, peterx@redhat.com, Martin Cracauer <cracauer@cons.org>, Denis Plotnikov <dplotnikov@virtuozzo.com>, linux-mm@kvack.org, Marty McFadden <mcfadden8@llnl.gov>, Maya Gokhale <gokhale2@llnl.gov>, Mike Kravetz <mike.kravetz@oracle.com>, Andrea Arcangeli <aarcange@redhat.com>, Mike Rapoport <rppt@linux.vnet.ibm.com>, Kees Cook <keescook@chromium.org>, Mel Gorman <mgorman@suse.de>, "Kirill A . Shutemov" <kirill@shutemov.name>, linux-fsdevel@vger.kernel.org, "Dr . Davi Subject: [PATCH 0/3] userfaultfd: allow to forbid unprivileged users Date: Mon, 11 Mar 2019 17:36:58 +0800 [thread overview] Message-ID: <20190311093701.15734-1-peterx@redhat.com> (raw) Hi, (The idea comes from Andrea, and following discussions with Mike and other people) This patchset introduces a new sysctl flag to allow the admin to forbid users from using userfaultfd: $ cat /proc/sys/vm/unprivileged_userfaultfd [disabled] enabled kvm - When set to "disabled", all unprivileged users are forbidden to use userfaultfd syscalls. - When set to "enabled", all users are allowed to use userfaultfd syscalls. - When set to "kvm", all unprivileged users are forbidden to use the userfaultfd syscalls, except the user who has permission to open /dev/kvm. This new flag can add one more layer of security to reduce the attack surface of the kernel by abusing userfaultfd. Here we grant the thread userfaultfd permission by checking against CAP_SYS_PTRACE capability. By default, the value is "disabled" which is the most strict policy. Distributions can have their own perferred value. The "kvm" entry is a bit special here only to make sure that existing users like QEMU/KVM won't break by this newly introduced flag. What we need to do is simply set the "unprivileged_userfaultfd" flag to "kvm" here to automatically grant userfaultfd permission for processes like QEMU/KVM without extra code to tweak these flags in the admin code. Patch 1: The interface patch to introduce the flag Patch 2: The KVM related changes to detect opening of /dev/kvm Patch 3: Apply the flag to userfaultfd syscalls All comments would be greatly welcomed. Thanks, Peter Xu (3): userfaultfd/sysctl: introduce unprivileged_userfaultfd kvm/mm: introduce MMF_USERFAULTFD_ALLOW flag userfaultfd: apply unprivileged_userfaultfd check fs/userfaultfd.c | 121 +++++++++++++++++++++++++++++++++ include/linux/sched/coredump.h | 1 + include/linux/userfaultfd_k.h | 5 ++ init/Kconfig | 11 +++ kernel/sysctl.c | 11 +++ virt/kvm/kvm_main.c | 7 ++ 6 files changed, 156 insertions(+) -- 2.17.1
next reply other threads:[~2019-03-11 9:37 UTC|newest] Thread overview: 60+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-03-11 9:36 Peter Xu [this message] 2019-03-11 9:36 ` [PATCH 0/3] userfaultfd: allow to forbid unprivileged users Peter Xu 2019-03-11 9:36 ` [PATCH 1/3] userfaultfd/sysctl: introduce unprivileged_userfaultfd Peter Xu 2019-03-11 9:36 ` Peter Xu 2019-03-12 6:58 ` Mike Rapoport 2019-03-12 6:58 ` Mike Rapoport 2019-03-12 12:26 ` Peter Xu 2019-03-12 12:26 ` Peter Xu 2019-03-12 13:53 ` Mike Rapoport 2019-03-12 13:53 ` Mike Rapoport 2019-03-11 9:37 ` [PATCH 2/3] kvm/mm: introduce MMF_USERFAULTFD_ALLOW flag Peter Xu 2019-03-11 9:37 ` Peter Xu 2019-03-11 9:37 ` [PATCH 3/3] userfaultfd: apply unprivileged_userfaultfd check Peter Xu 2019-03-11 9:37 ` Peter Xu 2019-03-11 9:58 ` Peter Xu 2019-03-11 9:58 ` Peter Xu 2019-03-12 7:01 ` [PATCH 0/3] userfaultfd: allow to forbid unprivileged users Mike Rapoport 2019-03-12 7:01 ` Mike Rapoport 2019-03-12 12:29 ` Peter Xu 2019-03-12 12:29 ` Peter Xu 2019-03-12 7:49 ` Kirill A. Shutemov 2019-03-12 7:49 ` Kirill A. Shutemov 2019-03-12 7:49 ` Kirill A. Shutemov 2019-03-12 12:43 ` Peter Xu 2019-03-12 12:43 ` Peter Xu 2019-03-12 12:43 ` Peter Xu 2019-03-12 19:59 ` Mike Kravetz 2019-03-12 19:59 ` Mike Kravetz 2019-03-13 6:00 ` Peter Xu 2019-03-13 6:00 ` Peter Xu 2019-03-13 8:22 ` Paolo Bonzini 2019-03-13 8:22 ` Paolo Bonzini 2019-03-13 18:52 ` Andrea Arcangeli 2019-03-13 18:52 ` Andrea Arcangeli 2019-03-13 19:12 ` Paolo Bonzini 2019-03-13 19:12 ` Paolo Bonzini 2019-03-13 19:12 ` Paolo Bonzini 2019-03-13 23:44 ` Andrea Arcangeli 2019-03-13 23:44 ` Andrea Arcangeli 2019-03-14 10:58 ` Paolo Bonzini 2019-03-14 10:58 ` Paolo Bonzini 2019-03-14 15:23 ` Alexei Starovoitov 2019-03-14 15:23 ` Alexei Starovoitov 2019-03-14 15:23 ` Alexei Starovoitov 2019-03-14 16:00 ` Paolo Bonzini 2019-03-14 16:00 ` Paolo Bonzini 2019-03-14 16:16 ` Andrea Arcangeli 2019-03-14 16:16 ` Andrea Arcangeli 2019-03-15 16:09 ` Kees Cook 2019-03-15 16:09 ` Kees Cook 2019-03-15 16:09 ` Kees Cook 2019-03-13 20:01 ` Mike Kravetz 2019-03-13 23:55 ` Andrea Arcangeli 2019-03-13 23:55 ` Andrea Arcangeli 2019-03-14 3:32 ` Mike Kravetz 2019-03-14 3:32 ` Mike Kravetz 2019-03-13 17:50 ` Mike Kravetz 2019-03-13 17:50 ` Mike Kravetz 2019-03-15 8:26 ` Peter Xu 2019-03-15 8:26 ` Peter Xu
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20190311093701.15734-1-peterx@redhat.com \ --to=peterx@redhat.com \ --cc=aarcange@redhat.com \ --cc=akpm@linux-foundation.org \ --cc=cracauer@cons.org \ --cc=dgilbert@redhat.com \ --cc=dplotnikov@virtuozzo.com \ --cc=gokhale2@llnl.gov \ --cc=hannes@cmpxchg.org \ --cc=hughd@google.com \ --cc=jglisse@redhat.com \ --cc=keescook@chromium.org \ --cc=kirill@shutemov.name \ --cc=kvm@vger.kernel.org \ --cc=linux-fsdevel@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-mm@kvack.org \ --cc=maxime.coquelin@redhat.com \ --cc=mcfadden8@llnl.gov \ --cc=mcgrof@kernel.org \ --cc=mgorman@suse.de \ --cc=mike.kravetz@oracle.com \ --cc=pbonzini@redhat.com \ --cc=rppt@linux.vnet.ibm.com \ --cc=xemul@virtuozzo.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.