Re: [PATCH v7 12/12] xen: clarify the security-support status of Kconfig options on ARM

From: Stefano Stabellini <sstabellini@kernel.org>
To: Julien Grall <julien.grall@arm.com>
Cc: Stefano Stabellini <sstabellini@kernel.org>,
	andrii_anisov@epam.com, George.Dunlap@eu.citrix.com,
	andrew.cooper3@citrix.com, Ian.Jackson@eu.citrix.com,
	George.Dunlap@citrix.com, dfaggioli@suse.com, jbeulich@suse.com,
	xen-devel@lists.xen.org
Subject: Re: [PATCH v7 12/12] xen: clarify the security-support status of Kconfig options on ARM
Date: Tue, 24 Jul 2018 15:31:08 -0700 (PDT)	[thread overview]
Message-ID: <alpine.DEB.2.10.1807241509020.20701@sstabellini-ThinkPad-X260> (raw)
In-Reply-To: <4ee54631-55cd-da09-f7d5-6bf7e8de9198@arm.com>

On Mon, 23 Jul 2018, Julien Grall wrote:
> Hi,
> 
> On 07/07/18 00:14, Stefano Stabellini wrote:
> > Signed-off-by: Stefano Stabellini <sstabellini@kernel.org>
> > CC: George.Dunlap@eu.citrix.com
> > CC: Ian.Jackson@eu.citrix.com
> > CC: jbeulich@suse.com
> > CC: andrew.cooper3@citrix.com
> > ---
> >   SUPPORT.md | 10 ++++++++++
> >   1 file changed, 10 insertions(+)
> > 
> > diff --git a/SUPPORT.md b/SUPPORT.md
> > index e3e49e2..151a63d 100644
> > --- a/SUPPORT.md
> > +++ b/SUPPORT.md
> > @@ -22,6 +22,16 @@ EXPERT and DEBUG Kconfig options are not security
> > supported. Other
> >   Kconfig options are supported, if the related features are marked as
> >   supported in this document.
> >   +On ARM, a wider range of Kconfig configurations is available to enable
> > +very small lines of code counts in the hypervisor. Not all possible
> > +combinations of kconfig options are security supported. Instead, a few
> 
> NIT: s/kconfig/Kconfig/
> 
> > +pre-canned configurations have been added to xen/arch/arm/configs: they
> > +are security suppored. Configurations derived from the pre-canned files
> 
> s/suppored/supported/

I'll fix

> > +by adding non-listed options with their default values, or by enabling
> > +any of the platform options under "Platform Support" (and their
> > +dependent options) are security supported, unless stated
> > +otherwise.
> 
> I am not entirely sure to understand the implications the paragraph.

It is meant to say:

1) xen/arch/arm/configs config files are security supported
2) default values of any kconfig options are security supported
3) if an option is marked as not security supported in SUPPORT.md, then
   it is not security supported, no matter the default value
4) everything else is not security supported

Should I try to clarify it? I guess I should make clear that a .config
with an unsupported option is unsupported as a whole. I can add:

 "A configuration with one or more unsupported options, is not
 unsupported."

> For instance, if I choose arm64_defconfig, memaccess will be enabled by
> default but any use of it is not security supported. What will be the state of
> the security support for that .config?

Yes, memaccess will default to enable. However, SUPPORT.md says it is
not security supported, hence, the result is that the .config is not
security supported, according to (3).

There is a catch though. In the specific case of memaccess, SUPPORT.md
only states the following:

### Virtual Machine Introspection

    Status, x86: Supported, not security supported

Which doesn't say anything about ARM. It would be a good idea to do the
same that x86 is doing (Supported, not security supported)?

> I also think an Ack from the security team will probably more meaningful than
> mine here. After all they are the one dealing with the security issues :).

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel