From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.3 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,USER_AGENT_MUTT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id F3E33C31E40 for ; Mon, 10 Jun 2019 16:15:34 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id D74EE2085A for ; Mon, 10 Jun 2019 16:15:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2390997AbfFJQPe (ORCPT ); Mon, 10 Jun 2019 12:15:34 -0400 Received: from mga11.intel.com ([192.55.52.93]:43609 "EHLO mga11.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2390990AbfFJQPe (ORCPT ); Mon, 10 Jun 2019 12:15:34 -0400 X-Amp-Result: UNKNOWN X-Amp-Original-Verdict: FILE UNKNOWN X-Amp-File-Uploaded: False Received: from orsmga006.jf.intel.com ([10.7.209.51]) by fmsmga102.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 10 Jun 2019 09:15:33 -0700 X-ExtLoop1: 1 Received: from sjchrist-coffee.jf.intel.com (HELO linux.intel.com) ([10.54.74.36]) by orsmga006.jf.intel.com with ESMTP; 10 Jun 2019 09:15:32 -0700 Date: Mon, 10 Jun 2019 09:15:33 -0700 From: Sean Christopherson To: Jarkko Sakkinen Cc: Andy Lutomirski , Cedric Xing , Stephen Smalley , James Morris , "Serge E . Hallyn" , LSM List , Paul Moore , Eric Paris , selinux@vger.kernel.org, Jethro Beekman , Dave Hansen , Thomas Gleixner , Linus Torvalds , LKML , X86 ML , linux-sgx@vger.kernel.org, Andrew Morton , nhorman@redhat.com, npmccallum@redhat.com, Serge Ayoun , Shay Katz-zamir , Haitao Huang , Andy Shevchenko , Kai Svahn , Borislav Petkov , Josh Triplett , Kai Huang , David Rientjes , William Roberts , Philip Tricca Subject: Re: [RFC PATCH v2 2/5] x86/sgx: Require userspace to define enclave pages' protection bits Message-ID: <20190610161532.GC15995@linux.intel.com> References: <20190606021145.12604-1-sean.j.christopherson@intel.com> <20190606021145.12604-3-sean.j.christopherson@intel.com> <20190610152717.GB3752@linux.intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20190610152717.GB3752@linux.intel.com> User-Agent: Mutt/1.5.24 (2015-08-30) Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: On Mon, Jun 10, 2019 at 06:27:17PM +0300, Jarkko Sakkinen wrote: > On Wed, Jun 05, 2019 at 07:11:42PM -0700, Sean Christopherson wrote: > > [SNAP] > > Same general criticism as for the previous patch: try to say things as > they are without anything extra. > > > A third alternative would be to pull the protection bits from the page's > > SECINFO, i.e. make decisions based on the protections enforced by > > hardware. However, with SGX2, userspace can extend the hardware- > > enforced protections via ENCLU[EMODPE], e.g. can add a page as RW and > > later convert it to RX. With SGX2, making a decision based on the > > initial protections would either create a security hole or force SGX to > > dynamically track "dirty" pages (see first alternative above). > > > > Signed-off-by: Sean Christopherson > > 'flags' should would renamed as 'secinfo_flags_mask' even if the name is > longish. It would use the same values as the SECINFO flags. The field in > struct sgx_encl_page should have the same name. That would express > exactly relation between SECINFO and the new field. I would have never > asked on last iteration why SECINFO is not enough with a better naming. No, these flags do not impact the EPCM protections in any way. Userspace can extend the EPCM protections without going through the kernel. The protection flags for an enclave page impact VMA/PTE protection bits. IMO, it is best to treat the EPCM as being completely separate from the kernel's EPC management. > The same field can be also used to cage page type to a subset of values. > > /Jarkko