Re: [RFC PATCH v1 0/9] Hypervisor-Enforced Kernel Integrity

From: "Edgecombe, Rick P" <rick.p.edgecombe@intel.com>
To: "Christopherson,, Sean" <seanjc@google.com>
Cc: "ssicleru@bitdefender.com" <ssicleru@bitdefender.com>,
	"tglx@linutronix.de" <tglx@linutronix.de>,
	"mic@digikod.net" <mic@digikod.net>,
	"marian.c.rotariu@gmail.com" <marian.c.rotariu@gmail.com>,
	"kvm@vger.kernel.org" <kvm@vger.kernel.org>,
	"virtualization@lists.linux-foundation.org" 
	<virtualization@lists.linux-foundation.org>,
	"pbonzini@redhat.com" <pbonzini@redhat.com>,
	"qemu-devel@nongnu.org" <qemu-devel@nongnu.org>,
	"tgopinath@microsoft.com" <tgopinath@microsoft.com>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	"liran.alon@oracle.com" <liran.alon@oracle.com>,
	"ztarkhani@microsoft.com" <ztarkhani@microsoft.com>,
	"mdontu@bitdefender.com" <mdontu@bitdefender.com>,
	"x86@kernel.org" <x86@kernel.org>, "bp@alien8.de" <bp@alien8.de>,
	"xen-devel@lists.xenproject.org" <xen-devel@lists.xenproject.org>,
	"jamorris@linux.microsoft.com" <jamorris@linux.microsoft.com>,
	"vkuznets@redhat.com" <vkuznets@redhat.com>,
	"Andersen, John S" <john.s.andersen@intel.com>,
	"nicu.citu@icloud.com" <nicu.citu@icloud.com>,
	"keescook@chromium.org" <keescook@chromium.org>,
	"Graf, Alexander" <graf@amazon.com>,
	"wanpengli@tencent.com" <wanpengli@tencent.com>,
	"dev@lists.cloudhypervisor.org" <dev@lists.cloudhypervisor.org>,
	"madvenka@linux.microsoft.com" <madvenka@linux.microsoft.com>,
	"mingo@redhat.com" <mingo@redhat.com>,
	"will@kernel.org" <will@kernel.org>,
	"linux-security-module@vger.kernel.org" 
	<linux-security-module@vger.kernel.org>,
	"hpa@zytor.com" <hpa@zytor.com>,
	"yuanyu@google.com" <yuanyu@google.com>,
	"linux-hyperv@vger.kernel.org" <linux-hyperv@vger.kernel.org>,
	"linux-hardening@vger.kernel.org"
	<linux-hardening@vger.kernel.org>,
	"dave.hansen@linux.intel.com" <dave.hansen@linux.intel.com>
Subject: Re: [RFC PATCH v1 0/9] Hypervisor-Enforced Kernel Integrity
Date: Thu, 25 May 2023 19:16:43 +0000	[thread overview]
Message-ID: <99bea6ec8b3091986008a3a9f2e7c74f0abaea92.camel@intel.com> (raw)
In-Reply-To: <ZG+HpFjIuSWvyo+B@google.com>

On Thu, 2023-05-25 at 09:07 -0700, Sean Christopherson wrote:
> On Thu, May 25, 2023, Rick P Edgecombe wrote:
> > I wonder if it might be a good idea to POC the guest side before
> > settling on the KVM interface. Then you can also look at the whole
> > thing and judge how much usage it would get for the different
> > options
> > of restrictions.
> 
> As I said earlier[*], IMO the control plane logic needs to live in
> host userspace.
> I think any attempt to have KVM providen anything but the low level
> plumbing will
> suffer the same fate as CR4 pinning and XO memory.  Iterating on an
> imperfect
> solution to incremently improve security is far, far easier to do in
> userspace,
> and far more likely to get merged.
> 
> [*] https://lore.kernel.org/all/ZFUyhPuhtMbYdJ76@google.com

Sure, I should have put it more generally. I just meant people are not
going to want to maintain host-based features that guests can't
effectively use.

My takeaway from the CR pinning was that the guest kernel integration
was surprisingly tricky due to the one-way nature of the interface. XO
was more flexible than CR pinning in that respect, because the guest
could turn it off (and indeed, in the XO kernel text patches it had to
do this a lot).