Re: [PATCH] Kernel Lockdown: Add an option to allow raw MSR access even, in confidentiality mode.

From: Jordan Glover <Golden_Miller83@protonmail.ch>
To: Matt Parnell <mparnell@gmail.com>
Cc: Kees Cook <keescook@chromium.org>,
	"linux-security-module@vger.kernel.org" 
	<linux-security-module@vger.kernel.org>,
	"dhowells@redhat.com" <dhowells@redhat.com>,
	"matthew.garrett@nebula.com" <matthew.garrett@nebula.com>
Subject: Re: [PATCH] Kernel Lockdown: Add an option to allow raw MSR access even, in confidentiality mode.
Date: Mon, 02 Dec 2019 22:55:37 +0000	[thread overview]
Message-ID: <-uRGQFmc8hMANlmvOpPXEib39VyGsx15MXwgVf-vripxhDcjILDfe5O17fyf5MXoZflmIE4avp7SqW4ijO1kHPqgHJMCqg1fWtXeGylu2uc=@protonmail.ch> (raw)
In-Reply-To: <96625b06-3bba-6831-7127-22b690fccf1b@gmail.com>

On Monday, December 2, 2019 6:29 PM, Matt Parnell <mparnell@gmail.com> wrote:

> After doing some research it appears that for Intel chips, only a single
> register needs to be writeable. I'm not sure about AMD etc.
>
> intel-undervolt/blob/master/config.h:
>
>     #define MSR_ADDR_TEMPERATURE 0x1a2
>     #define MSR_ADDR_UNITS 0x606
>     #define MSR_ADDR_VOLTAGE 0x150
>
> Perhaps add an MSR whitelist to allow writing, if
> LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY=Y and
> CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=Y?
>
> CONFIG_SECURITY_LOCKDOWN_LSM_EARLY is likely what prevents Apparmor or
> some other LSM policy manager allow this behavior...
>
> as an option at build time would be more sensible?
>
> On 12/1/19 2:53 PM, Matt Parnell wrote:
>
> > That is, I was intending to use lockdown from boot, which isn't
> > changeable after the fact if I'm not mistaken. How possible is granular
> > control of what is and is not locked down?
> > On 11/30/19 1:09 PM, Matt Parnell wrote:
> >
> > > I can see how using a policy would be beneficial; I only did this
> > > because as I understood it, policy wouldn't be able to change these
> > > particular settings since anything attempting to do so would be from
> > > userspace.
> > > On 11/30/19 12:36 PM, Kees Cook wrote:
> > >
> > > > On Sat, Nov 30, 2019 at 12:49:48AM -0600, Matt Parnell wrote:
> > > >
> > > > > From 452b8460e464422d268659a8abb93353a182f8c8 Mon Sep 17 00:00:00 2001
> > > > > From: Matt Parnell mparnell@gmail.com
> > > > > Date: Sat, 30 Nov 2019 00:44:09 -0600
> > > > > Subject: [PATCH] Kernel Lockdown: Add an option to allow raw MSR access even
> > > > >  in confidentiality mode.
> > > > > For Intel CPUs, some of the MDS mitigations utilize the new "flush" MSR, and
> > > > > while this isn't something normally used in userspace, it does cause false
> > > > > positives for the "Forshadow" vulnerability.
> > > > > Additionally, Intel CPUs use MSRs for voltage and frequency controls,
> > > > > which in
> > > > > many cases is useful for undervolting to avoid excess heat.

Could you clarify if blocking msr breaks internal power management of intel
cpu or it only prevents manual tinkering with it by user? If the latter then
I think it's ok to keep it as is.

Jordan