From: "Mickaël Salaün" <mic@digikod.net>
To: "Madhavan T. Venkataraman" <madvenka@linux.microsoft.com>,
Wei Liu <wei.liu@kernel.org>
Cc: "Borislav Petkov" <bp@alien8.de>,
"Dave Hansen" <dave.hansen@linux.intel.com>,
"H . Peter Anvin" <hpa@zytor.com>,
"Ingo Molnar" <mingo@redhat.com>,
"Kees Cook" <keescook@chromium.org>,
"Paolo Bonzini" <pbonzini@redhat.com>,
"Sean Christopherson" <seanjc@google.com>,
"Thomas Gleixner" <tglx@linutronix.de>,
"Vitaly Kuznetsov" <vkuznets@redhat.com>,
"Wanpeng Li" <wanpengli@tencent.com>,
"Alexander Graf" <graf@amazon.com>,
"Forrest Yuan Yu" <yuanyu@google.com>,
"James Morris" <jamorris@linux.microsoft.com>,
"John Andersen" <john.s.andersen@intel.com>,
"Marian Rotariu" <marian.c.rotariu@gmail.com>,
"Mihai Donțu" <mdontu@bitdefender.com>,
"Nicușor Cîțu" <nicu.citu@icloud.com>,
"Rick Edgecombe" <rick.p.edgecombe@intel.com>,
"Thara Gopinath" <tgopinath@microsoft.com>,
"Will Deacon" <will@kernel.org>,
"Zahra Tarkhani" <ztarkhani@microsoft.com>,
"Ștefan Șicleru" <ssicleru@bitdefender.com>,
dev@lists.cloudhypervisor.org, kvm@vger.kernel.org,
linux-hardening@vger.kernel.org, linux-hyperv@vger.kernel.org,
linux-kernel@vger.kernel.org,
linux-security-module@vger.kernel.org, qemu-devel@nongnu.org,
virtualization@lists.linux-foundation.org, x86@kernel.org,
xen-devel@lists.xenproject.org
Subject: Re: [PATCH v1 3/9] virt: Implement Heki common code
Date: Mon, 29 May 2023 18:03:28 +0200 [thread overview]
Message-ID: <90ca1173-4ec1-099f-5744-3d6dc29d919d@digikod.net> (raw)
In-Reply-To: <e8fcc1b8-6c0f-9556-a110-bd994d3fe3c6@linux.microsoft.com>
On 17/05/2023 14:47, Madhavan T. Venkataraman wrote:
> Sorry for the delay. See inline...
>
> On 5/8/23 12:29, Wei Liu wrote:
>> On Fri, May 05, 2023 at 05:20:40PM +0200, Mickaël Salaün wrote:
>>> From: Madhavan T. Venkataraman <madvenka@linux.microsoft.com>
>>>
>>> Hypervisor Enforced Kernel Integrity (Heki) is a feature that will use
>>> the hypervisor to enhance guest virtual machine security.
>>>
>>> Configuration
>>> =============
>>>
>>> Define the config variables for the feature. This feature depends on
>>> support from the architecture as well as the hypervisor.
>>>
>>> Enabling HEKI
>>> =============
>>>
>>> Define a kernel command line parameter "heki" to turn the feature on or
>>> off. By default, Heki is on.
>>
>> For such a newfangled feature can we have it off by default? Especially
>> when there are unsolved issues around dynamically loaded code.
>>
>
> Yes. We can certainly do that.
By default the Kconfig option should definitely be off. We also need to
change the Kconfig option to only be set if kernel module, JIT, kprobes
and other dynamic text change feature are disabled at build time (see
discussion with Sean).
With this new Kconfig option for the static case, I think the boot
option should be on by default because otherwise it would not really be
possible to switch back to on later without taking the risk to silently
breaking users' machines. However, we should rename this option to
something like "heki_static" to be in line with the new Kconfig option.
The goal of Heki is to improve and complement kernel self-protection
mechanisms (which don't have boot time options), and to make it
available to everyone, see
https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings
In practice, it would then be kind of useless to be required to set a
boot option to enable Heki (rather than to disable it).
>
>>>
>> [...]
>>> diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
>>> index 3604074a878b..5cf5a7a97811 100644
>>> --- a/arch/x86/Kconfig
>>> +++ b/arch/x86/Kconfig
>>> @@ -297,6 +297,7 @@ config X86
>>> select FUNCTION_ALIGNMENT_4B
>>> imply IMA_SECURE_AND_OR_TRUSTED_BOOT if EFI
>>> select HAVE_DYNAMIC_FTRACE_NO_PATCHABLE
>>> + select ARCH_SUPPORTS_HEKI if X86_64
>>
>> Why is there a restriction on X86_64?
>>
>
> We want to get the PoC working and reviewed on X64 first. We have tested this only on X64 so far.
X86_64 includes Intel CPUs, which can support EPT and MBEC, which are a
requirement for Heki. ARM might have similar features but we're focused
on x86 for now.
As a side note, I only have access to an Intel machine, which means that
I cannot work on AMD support. However, I'll be pleased to implement such
support if I get access to a machine with a recent AMD CPU.
>
>>>
>>> config INSTRUCTION_DECODER
>>> def_bool y
>>> diff --git a/arch/x86/include/asm/sections.h b/arch/x86/include/asm/sections.h
>>> index a6e8373a5170..42ef1e33b8a5 100644
>>> --- a/arch/x86/include/asm/sections.h
>>> +++ b/arch/x86/include/asm/sections.h
>> [...]
>>>
>>> +#ifdef CONFIG_HEKI
>>> +
>>> +/*
>>> + * Gather all of the statically defined sections so heki_late_init() can
>>> + * protect these sections in the host page table.
>>> + *
>>> + * The sections are defined under "SECTIONS" in vmlinux.lds.S
>>> + * Keep this array in sync with SECTIONS.
>>> + */
>>
>> This seems a bit fragile, because it requires constant attention from
>> people who care about this functionality. Can this table be
>> automatically generated?
>>
>
> We realize that. But I don't know of a way this can be automatically generated. Also, the permissions for
> each section is specific to the use of that section. The developer who introduces a new section is the
> one who will know what the permissions should be.
>
> If any one has any ideas of how we can generate this table automatically or even just add a build time check
> of some sort, please let us know.
One clean solution might be to parse the vmlinux.lds.S file, extract
section and their permission, and fill that into an automatically
generated header file.
Another way to do it would be to extract sections and associated
permissions with objdump, but that could be an issue because of longer
build time.
A better solution would be to extract such sections and associated
permissions at boot time. I guess the kernel already has such helpers
used in early boot.
next prev parent reply other threads:[~2023-05-29 16:03 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-05-05 15:20 [RFC PATCH v1 0/9] Hypervisor-Enforced Kernel Integrity Mickaël Salaün
2023-05-05 15:20 ` [PATCH v1 1/9] KVM: x86: Add kvm_x86_ops.fault_gva() Mickaël Salaün
2023-05-05 15:20 ` [PATCH v1 2/9] KVM: x86/mmu: Add support for prewrite page tracking Mickaël Salaün
2023-05-05 16:28 ` Sean Christopherson
2023-05-05 16:49 ` Mickaël Salaün
2023-05-05 17:31 ` Sean Christopherson
2023-05-24 20:53 ` Madhavan T. Venkataraman
2023-05-05 15:20 ` [PATCH v1 3/9] virt: Implement Heki common code Mickaël Salaün
2023-05-08 17:29 ` Wei Liu
2023-05-17 12:47 ` Madhavan T. Venkataraman
2023-05-29 16:03 ` Mickaël Salaün [this message]
2023-05-05 15:20 ` [PATCH v1 4/9] KVM: x86: Add new hypercall to set EPT permissions Mickaël Salaün
2023-05-05 16:44 ` Sean Christopherson
2023-05-05 17:01 ` Mickaël Salaün
2023-05-05 17:17 ` Sean Christopherson
2023-05-05 15:20 ` [PATCH v1 5/9] KVM: x86: Add new hypercall to lock control registers Mickaël Salaün
2023-05-08 21:11 ` Wei Liu
2023-05-29 16:48 ` Mickaël Salaün
2023-05-30 23:16 ` Kees Cook
2023-05-05 15:20 ` [PATCH v1 6/9] KVM: x86: Add Heki hypervisor support Mickaël Salaün
2023-05-08 21:18 ` Wei Liu
2023-05-26 16:49 ` Mickaël Salaün
2023-05-05 15:20 ` [PATCH v1 7/9] KVM: VMX: Add MBEC support Mickaël Salaün
2023-05-05 15:20 ` [PATCH v1 8/9] KVM: x86/mmu: Enable guests to lock themselves thanks to MBEC Mickaël Salaün
2023-05-05 15:20 ` [PATCH v1 9/9] virt: Add Heki KUnit tests Mickaël Salaün
2023-05-24 21:04 ` [RFC PATCH v1 0/9] Hypervisor-Enforced Kernel Integrity Trilok Soni
2023-05-25 13:25 ` Mickaël Salaün
2023-05-25 18:34 ` Trilok Soni
2023-05-30 9:54 ` Mickaël Salaün
2023-05-24 22:20 ` Edgecombe, Rick P
2023-05-25 0:37 ` Trilok Soni
2023-05-25 13:59 ` Mickaël Salaün
2023-05-25 15:52 ` Edgecombe, Rick P
2023-05-25 16:07 ` Sean Christopherson
2023-05-25 19:16 ` Edgecombe, Rick P
2023-05-26 15:35 ` Mickaël Salaün
2023-05-26 15:22 ` Mickaël Salaün
2023-05-30 16:23 ` Edgecombe, Rick P
[not found] ` <ZHes4a73Zg+6JuFB@google.com>
2023-06-02 15:07 ` Mickaël Salaün
2023-05-26 2:36 ` James Morris
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=90ca1173-4ec1-099f-5744-3d6dc29d919d@digikod.net \
--to=mic@digikod.net \
--cc=bp@alien8.de \
--cc=dave.hansen@linux.intel.com \
--cc=dev@lists.cloudhypervisor.org \
--cc=graf@amazon.com \
--cc=hpa@zytor.com \
--cc=jamorris@linux.microsoft.com \
--cc=john.s.andersen@intel.com \
--cc=keescook@chromium.org \
--cc=kvm@vger.kernel.org \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-hyperv@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=madvenka@linux.microsoft.com \
--cc=marian.c.rotariu@gmail.com \
--cc=mdontu@bitdefender.com \
--cc=mingo@redhat.com \
--cc=nicu.citu@icloud.com \
--cc=pbonzini@redhat.com \
--cc=qemu-devel@nongnu.org \
--cc=rick.p.edgecombe@intel.com \
--cc=seanjc@google.com \
--cc=ssicleru@bitdefender.com \
--cc=tglx@linutronix.de \
--cc=tgopinath@microsoft.com \
--cc=virtualization@lists.linux-foundation.org \
--cc=vkuznets@redhat.com \
--cc=wanpengli@tencent.com \
--cc=wei.liu@kernel.org \
--cc=will@kernel.org \
--cc=x86@kernel.org \
--cc=xen-devel@lists.xenproject.org \
--cc=yuanyu@google.com \
--cc=ztarkhani@microsoft.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).