From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.4 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A2F98C433E9 for ; Thu, 4 Feb 2021 11:35:16 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 6414364F46 for ; Thu, 4 Feb 2021 11:35:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236004AbhBDLex (ORCPT ); Thu, 4 Feb 2021 06:34:53 -0500 Received: from mail.kernel.org ([198.145.29.99]:40704 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235851AbhBDLcn (ORCPT ); Thu, 4 Feb 2021 06:32:43 -0500 Received: by mail.kernel.org (Postfix) with ESMTPSA id B8D5A64F43; Thu, 4 Feb 2021 11:31:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1612438323; bh=2YjywL5SDoEOedQJhLkpDYn35JOZkPUsSSTuGmTvbGc=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=kfyPb2gRQK0VJ0bG96IqzhK4wj3EQuLqLz846zpApxcBwm6WX5CtQsTqXRtAiettV Besll6N47ziUztkxZ9uvbAsAManAgkDNtO1dfWhHGfCVtc763gwDqZuV/PJHM4amXe NzZHR6+dZdeHxPTLxYHYjwbMQNb3w6QbyNiepEAxlD0e9d57gxLWScwoHeMOz0zzxT Vme4kodJtOqIlDuUlby8EOucFxgZASr9qI2lvWzc7i6T1yxSrrhOjO19hjpFL65gQr YqgO9vVlRT1CTjfaXTK0DGlZqxa/k2Qn7Vs36jPxV0PXtDTyFjDcxi+38fcdf2VRVr ganUhejqO/Vig== Date: Thu, 4 Feb 2021 13:31:45 +0200 From: Mike Rapoport To: Michal Hocko Cc: James Bottomley , David Hildenbrand , Andrew Morton , Alexander Viro , Andy Lutomirski , Arnd Bergmann , Borislav Petkov , Catalin Marinas , Christopher Lameter , Dan Williams , Dave Hansen , Elena Reshetova , "H. Peter Anvin" , Ingo Molnar , "Kirill A. Shutemov" , Matthew Wilcox , Mark Rutland , Mike Rapoport , Michael Kerrisk , Palmer Dabbelt , Paul Walmsley , Peter Zijlstra , Rick Edgecombe , Roman Gushchin , Shakeel Butt , Shuah Khan , Thomas Gleixner , Tycho Andersen , Will Deacon , linux-api@vger.kernel.org, linux-arch@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-nvdimm@lists.01.org, linux-riscv@lists.infradead.org, x86@kernel.org, Hagen Paul Pfeifer , Palmer Dabbelt Subject: Re: [PATCH v16 07/11] secretmem: use PMD-size pages to amortize direct map fragmentation Message-ID: <20210204113145.GR242749@kernel.org> References: <6653288a-dd02-f9de-ef6a-e8d567d71d53@redhat.com> <211f0214-1868-a5be-9428-7acfc3b73993@redhat.com> <95625b83-f7e2-b27a-2b99-d231338047fb@redhat.com> <20210202181546.GO242749@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Feb 03, 2021 at 01:09:30PM +0100, Michal Hocko wrote: > On Tue 02-02-21 10:55:40, James Bottomley wrote: > > On Tue, 2021-02-02 at 20:15 +0200, Mike Rapoport wrote: > > > On Tue, Feb 02, 2021 at 03:34:29PM +0100, David Hildenbrand wrote: > > > > On 02.02.21 15:32, Michal Hocko wrote: > > > > Well the safest security statement is that we never expose the data to > > the kernel because it's a very clean security statement and easy to > > enforce. It's also the easiest threat model to analyse. Once we do > > start exposing the secret to the kernel it alters the threat profile > > and the analysis and obviously potentially provides the ROP gadget to > > an attacker to do the same. Instinct tells me that the loss of > > security doesn't really make up for the ability to swap or migrate but > > if there were a case for doing the latter, it would have to be a > > security policy of the user (i.e. a user should be able to decide their > > data is too sensitive to expose to the kernel). > > The security/threat model should be documented in the changelog as > well. I am not a security expert but I would tend to agree that not > allowing even temporal mapping for data copying (in the kernel) is the > most robust approach. Whether that is generally necessary for users I do > not know. > > From the API POV I think it makes sense to have two > modes. NEVER_MAP_IN_KERNEL which would imply no migrateability, no > copy_{from,to}_user, no gup or any other way for the kernel to access > content of the memory. Maybe even zero the content on the last unmap to > never allow any data leak. ALLOW_TEMPORARY would unmap the page from > the direct mapping but it would still allow temporary mappings for > data copying inside the kernel (thus allow CoW, copy*user, migration). > Which one should be default and which an opt-in I do not know. A less > restrictive mode to be default and the more restrictive an opt-in via > flags makes a lot of sense to me though. The default is already NEVER_MAP_IN_KERNEL, so there is no explicit flag for this. ALLOW_TEMPORARY should be opt-in, IMHO, and we can add it on top later on. -- Sincerely yours, Mike.