linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Nathaniel McCallum <nathaniel@profian.com>
To: Jarkko Sakkinen <jarkko@kernel.org>
Cc: Reinette Chatre <reinette.chatre@intel.com>,
	Haitao Huang <haitao.huang@linux.intel.com>,
	Andy Lutomirski <luto@kernel.org>,
	dave.hansen@linux.intel.com, tglx@linutronix.de, bp@alien8.de,
	mingo@redhat.com, linux-sgx@vger.kernel.org, x86@kernel.org,
	seanjc@google.com, kai.huang@intel.com, cathy.zhang@intel.com,
	cedric.xing@intel.com, haitao.huang@intel.com,
	mark.shanahan@intel.com, hpa@zytor.com,
	linux-kernel@vger.kernel.org
Subject: Re: [PATCH 05/25] x86/sgx: Introduce runtime protection bits
Date: Mon, 17 Jan 2022 08:13:32 -0500	[thread overview]
Message-ID: <CAHAy0tT7+AwgQUtzndj1E99hVcHNmyk2xJ6wUSxa4oPYytAMzA@mail.gmail.com> (raw)
In-Reply-To: <YeK2hFcy72tYL61S@iki.fi>

On Sat, Jan 15, 2022 at 6:57 AM Jarkko Sakkinen <jarkko@kernel.org> wrote:
>
> On Sat, Jan 15, 2022 at 03:18:04AM +0200, Jarkko Sakkinen wrote:
> > On Fri, Jan 14, 2022 at 04:41:59PM -0800, Reinette Chatre wrote:
> > > Hi Jarkko,
> > >
> > > On 1/14/2022 4:27 PM, Jarkko Sakkinen wrote:
> > > > On Fri, Jan 14, 2022 at 04:01:33PM -0800, Reinette Chatre wrote:
> > > >> Hi Jarkko,
> > > >>
> > > >> On 1/14/2022 3:15 PM, Jarkko Sakkinen wrote:
> > > >>> On Fri, Jan 14, 2022 at 03:05:21PM -0800, Reinette Chatre wrote:
> > > >>>> Hi Jarkko,
> > > >>>
> > > >>> How enclave can check a page range that EPCM has the expected permissions?
> > > >>
> > > >> Only way to change EPCM permissions from outside enclave is to run ENCLS[EMODPR]
> > > >> that needs to be accepted from within the enclave via ENCLU[EACCEPT]. At that
> > > >> time the enclave provides the expected permissions and that will fail
> > > >> if there is a mismatch with the EPCM permissions (SGX_PAGE_ATTRIBUTES_MISMATCH).
> > > >
> > > > This is a very valid point but that does make the introspection possible
> > > > only at the time of EACCEPT.
> > > >
> > > > It does not give tools for enclave to make sure that EMODPR-ETRACK dance
> > > > was ever exercised.
> > >
> > > Could you please elaborate? EACCEPT is available to the enclave as a tool
> > > and it would fail if ETRACK was not completed (error SGX_NOT_TRACKED).
> > >
> > > Here is the relevant snippet from the SDM from the section where it
> > > describes EACCEPT:
> > >
> > > IF (Tracking not correct)
> > >     THEN
> > >         RFLAGS.ZF := 1;
> > >         RAX := SGX_NOT_TRACKED;
> > >         GOTO DONE;
> > > FI;
> > >
> > > Reinette
> >
> > Yes, if enclave calls EACCEPT it does the necessary introspection and makes
> > sure that ETRACK is completed. I have trouble understanding how enclave
> > makes sure that EACCEPT was called.
>
> I'm not concerned of anything going wrong once EMODPR has been started.
>
> The problem nails down to that the whole EMODPR process is spawned by
> the entity that is not trusted so maybe that should further broke down
> to three roles:
>
> 1. Build process B
> 2. Runner process R.
> 3. Enclave E.
>
> And to the costraint that we trust B *more* than R. Once B has done all the
> needed EMODPR calls it would send the file descriptor to R. Even if R would
> have full access to /dev/sgx_enclave, it would not matter, since B has done
> EMODPR-EACCEPT dance with E.
>
> So what you can achieve with EMODPR is not protection against mistrusted
> *OS*. There's absolutely no chance you could use it for that purpose
> because mistrusted OS controls the whole process.
>
> EMODPR is to help to protect enclave against mistrusted *process*, i.e.
> in the above scenario R.

There are two general cases that I can see. Both are valid.

1. The OS moves from a trusted to an untrusted state. This could be
the multi-process system you've described. But it could also be that
the kernel becomes compromised after the enclave is fully initialized.

2. The OS is untrustworthy from the start.

The second case is the stronger one and if you can solve it, the first
one is solved implicitly. And our end goal is that if the OS does
anything malicious we will crash in a controlled way.

A defensive enclave will always want to have the least number of
privileges for the maximum protection. Therefore, the enclave will
want the OS to call EMODPR. If that were it, the host could just lie.
But the enclave also verifies that the EMODPR operation was, in fact,
executed by doing EACCEPT. When the enclave calls EACCEPT, if the
kernel hasn't restricted permissions then we get a controlled crash.
Therefore, we have solved the second case.

  parent reply	other threads:[~2022-01-17 13:13 UTC|newest]

Thread overview: 155+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-12-01 19:22 [PATCH 00/25] x86/sgx and selftests/sgx: Support SGX2 Reinette Chatre
2021-12-01 19:22 ` [PATCH 01/25] x86/sgx: Add shortlog descriptions to ENCLS wrappers Reinette Chatre
2021-12-04 18:30   ` Jarkko Sakkinen
2021-12-06 21:13     ` Reinette Chatre
2021-12-11  5:28       ` Jarkko Sakkinen
2021-12-13 22:06         ` Reinette Chatre
2021-12-01 19:23 ` [PATCH 02/25] x86/sgx: Add wrappers for SGX2 functions Reinette Chatre
2021-12-04 22:04   ` Jarkko Sakkinen
2021-12-06 21:15     ` Reinette Chatre
2021-12-01 19:23 ` [PATCH 03/25] x86/sgx: Support VMA permissions exceeding enclave permissions Reinette Chatre
2021-12-04 22:25   ` Jarkko Sakkinen
2021-12-04 22:27     ` Jarkko Sakkinen
2021-12-06 21:16       ` Reinette Chatre
2021-12-11  5:39         ` Jarkko Sakkinen
2021-12-13 22:08           ` Reinette Chatre
2021-12-01 19:23 ` [PATCH 04/25] x86/sgx: Add pfn_mkwrite() handler for present PTEs Reinette Chatre
2021-12-04 22:43   ` Jarkko Sakkinen
2021-12-06 21:18     ` Reinette Chatre
2021-12-11  7:37       ` Jarkko Sakkinen
2021-12-13 22:09         ` Reinette Chatre
2021-12-28 14:51           ` Jarkko Sakkinen
2021-12-01 19:23 ` [PATCH 05/25] x86/sgx: Introduce runtime protection bits Reinette Chatre
2021-12-03 19:28   ` Andy Lutomirski
2021-12-03 22:12     ` Reinette Chatre
2021-12-04  0:38       ` Andy Lutomirski
2021-12-04  1:14         ` Reinette Chatre
2021-12-04 17:56           ` Andy Lutomirski
2021-12-04 23:55             ` Reinette Chatre
2021-12-13 22:34               ` Reinette Chatre
2021-12-04 23:57     ` Jarkko Sakkinen
2021-12-06 21:20       ` Reinette Chatre
2021-12-11  7:42         ` Jarkko Sakkinen
2021-12-13 22:10           ` Reinette Chatre
2021-12-28 14:52             ` Jarkko Sakkinen
2022-01-06 17:46               ` Reinette Chatre
2022-01-07 12:16                 ` Jarkko Sakkinen
2022-01-07 16:14                   ` Haitao Huang
2022-01-08 15:45                     ` Jarkko Sakkinen
2022-01-08 15:51                       ` Jarkko Sakkinen
2022-01-08 16:22                         ` Jarkko Sakkinen
2022-01-10 22:05                           ` Haitao Huang
2022-01-11  1:53                             ` Jarkko Sakkinen
2022-01-11  1:55                               ` Jarkko Sakkinen
2022-01-11  2:03                                 ` Jarkko Sakkinen
2022-01-11  2:15                                   ` Jarkko Sakkinen
2022-01-11  3:48                                     ` Haitao Huang
2022-01-12 23:48                                       ` Jarkko Sakkinen
2022-01-13  2:41                                         ` Haitao Huang
2022-01-14 21:36                                           ` Jarkko Sakkinen
2022-01-11 17:13                               ` Reinette Chatre
2022-01-12 23:50                                 ` Jarkko Sakkinen
2022-01-12 23:56                                   ` Jarkko Sakkinen
2022-01-13 20:09                                     ` Nathaniel McCallum
2022-01-13 21:42                                       ` Reinette Chatre
2022-01-14 21:53                                         ` Jarkko Sakkinen
2022-01-14 21:57                                           ` Jarkko Sakkinen
2022-01-14 22:00                                             ` Jarkko Sakkinen
2022-01-14 22:17                                           ` Jarkko Sakkinen
2022-01-14 22:23                                             ` Jarkko Sakkinen
2022-01-14 22:34                                               ` Jarkko Sakkinen
2022-01-14 23:05                                           ` Reinette Chatre
2022-01-14 23:15                                             ` Jarkko Sakkinen
2022-01-15  0:01                                               ` Reinette Chatre
2022-01-15  0:27                                                 ` Jarkko Sakkinen
2022-01-15  0:41                                                   ` Reinette Chatre
2022-01-15  1:18                                                     ` Jarkko Sakkinen
2022-01-15 11:56                                                       ` Jarkko Sakkinen
2022-01-15 11:59                                                         ` Jarkko Sakkinen
2022-01-17 13:13                                                         ` Nathaniel McCallum [this message]
2022-01-18  1:59                                                           ` Jarkko Sakkinen
2022-01-18  2:22                                                             ` Jarkko Sakkinen
2022-01-18  3:31                                                               ` Jarkko Sakkinen
2022-01-18 20:59                                                               ` Reinette Chatre
2022-01-20 12:53                                                                 ` Jarkko Sakkinen
2022-01-20 16:52                                                                   ` Reinette Chatre
2022-01-26 14:41                                                                     ` Jarkko Sakkinen
2022-01-15 16:49                                               ` Jarkko Sakkinen
2022-01-18 21:18                                                 ` Reinette Chatre
2022-01-17 13:27                                         ` Nathaniel McCallum
2022-01-18 21:11                                           ` Reinette Chatre
2021-12-04 22:50   ` Jarkko Sakkinen
2021-12-06 21:28     ` Reinette Chatre
2021-12-01 19:23 ` [PATCH 06/25] x86/sgx: Use more generic name for enclave cpumask function Reinette Chatre
2021-12-04 22:56   ` Jarkko Sakkinen
2021-12-06 21:29     ` Reinette Chatre
2021-12-01 19:23 ` [PATCH 07/25] x86/sgx: Move PTE zap code to separate function Reinette Chatre
2021-12-04 22:59   ` Jarkko Sakkinen
2021-12-06 21:30     ` Reinette Chatre
2021-12-11  7:52       ` Jarkko Sakkinen
2021-12-13 22:11         ` Reinette Chatre
2021-12-28 14:55           ` Jarkko Sakkinen
2022-01-06 17:46             ` Reinette Chatre
2022-01-07 12:26               ` Jarkko Sakkinen
2021-12-01 19:23 ` [PATCH 08/25] x86/sgx: Make SGX IPI callback available internally Reinette Chatre
2021-12-04 23:00   ` Jarkko Sakkinen
2021-12-06 21:36     ` Reinette Chatre
2021-12-11  7:53       ` Jarkko Sakkinen
2021-12-01 19:23 ` [PATCH 09/25] x86/sgx: Keep record of SGX page type Reinette Chatre
2021-12-04 23:03   ` Jarkko Sakkinen
2021-12-01 19:23 ` [PATCH 10/25] x86/sgx: Support enclave page permission changes Reinette Chatre
2021-12-02 23:48   ` Dave Hansen
2021-12-03 18:18     ` Reinette Chatre
2021-12-03  0:32   ` Dave Hansen
2021-12-03 18:18     ` Reinette Chatre
2021-12-03 18:14   ` Dave Hansen
2021-12-03 18:49     ` Reinette Chatre
2021-12-03 19:38   ` Andy Lutomirski
2021-12-03 22:34     ` Reinette Chatre
2021-12-04  0:42       ` Andy Lutomirski
2021-12-04  1:35         ` Reinette Chatre
2021-12-04 23:08   ` Jarkko Sakkinen
2021-12-06 20:19     ` Dave Hansen
2021-12-11  5:17       ` Jarkko Sakkinen
2021-12-06 21:42     ` Reinette Chatre
2021-12-11  7:57       ` Jarkko Sakkinen
2021-12-13 22:12         ` Reinette Chatre
2021-12-28 14:56           ` Jarkko Sakkinen
2021-12-01 19:23 ` [PATCH 11/25] selftests/sgx: Add test for EPCM " Reinette Chatre
2021-12-01 19:23 ` [PATCH 12/25] selftests/sgx: Add test for TCS page " Reinette Chatre
2021-12-01 19:23 ` [PATCH 13/25] x86/sgx: Support adding of pages to initialized enclave Reinette Chatre
2021-12-03  0:38   ` Dave Hansen
2021-12-03 18:47     ` Reinette Chatre
2021-12-04 23:13   ` Jarkko Sakkinen
2021-12-06 21:44     ` Reinette Chatre
2021-12-11  8:00       ` Jarkko Sakkinen
2021-12-13 22:12         ` Reinette Chatre
2021-12-28 14:57           ` Jarkko Sakkinen
2022-03-01 15:13   ` Jarkko Sakkinen
2022-03-01 17:08     ` Reinette Chatre
2021-12-01 19:23 ` [PATCH 14/25] x86/sgx: Tighten accessible memory range after enclave initialization Reinette Chatre
2021-12-04 23:14   ` Jarkko Sakkinen
2021-12-06 21:45     ` Reinette Chatre
2021-12-11  8:01       ` Jarkko Sakkinen
2021-12-01 19:23 ` [PATCH 15/25] selftests/sgx: Test two different SGX2 EAUG flows Reinette Chatre
2021-12-01 19:23 ` [PATCH 16/25] x86/sgx: Support modifying SGX page type Reinette Chatre
2021-12-04 23:45   ` Jarkko Sakkinen
2021-12-06 21:48     ` Reinette Chatre
2021-12-11  8:02       ` Jarkko Sakkinen
2021-12-13 17:43         ` Dave Hansen
2021-12-21  8:52           ` Jarkko Sakkinen
2021-12-01 19:23 ` [PATCH 17/25] x86/sgx: Support complete page removal Reinette Chatre
2021-12-04 23:45   ` Jarkko Sakkinen
2021-12-06 21:49     ` Reinette Chatre
2021-12-01 19:23 ` [PATCH 18/25] selftests/sgx: Introduce dynamic entry point Reinette Chatre
2021-12-01 19:23 ` [PATCH 19/25] selftests/sgx: Introduce TCS initialization enclave operation Reinette Chatre
2021-12-01 19:23 ` [PATCH 20/25] selftests/sgx: Test complete changing of page type flow Reinette Chatre
2021-12-01 19:23 ` [PATCH 21/25] selftests/sgx: Test faulty enclave behavior Reinette Chatre
2021-12-01 19:23 ` [PATCH 22/25] selftests/sgx: Test invalid access to removed enclave page Reinette Chatre
2021-12-01 19:23 ` [PATCH 23/25] selftests/sgx: Test reclaiming of untouched page Reinette Chatre
2021-12-01 19:23 ` [PATCH 24/25] x86/sgx: Free up EPC pages directly to support large page ranges Reinette Chatre
2021-12-04 23:47   ` Jarkko Sakkinen
2021-12-06 22:07     ` Reinette Chatre
2021-12-01 19:23 ` [PATCH 25/25] selftests/sgx: Page removal stress test Reinette Chatre
2021-12-02 18:30 ` [PATCH 00/25] x86/sgx and selftests/sgx: Support SGX2 Dave Hansen
2021-12-02 20:38   ` Nathaniel McCallum

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=CAHAy0tT7+AwgQUtzndj1E99hVcHNmyk2xJ6wUSxa4oPYytAMzA@mail.gmail.com \
    --to=nathaniel@profian.com \
    --cc=bp@alien8.de \
    --cc=cathy.zhang@intel.com \
    --cc=cedric.xing@intel.com \
    --cc=dave.hansen@linux.intel.com \
    --cc=haitao.huang@intel.com \
    --cc=haitao.huang@linux.intel.com \
    --cc=hpa@zytor.com \
    --cc=jarkko@kernel.org \
    --cc=kai.huang@intel.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-sgx@vger.kernel.org \
    --cc=luto@kernel.org \
    --cc=mark.shanahan@intel.com \
    --cc=mingo@redhat.com \
    --cc=reinette.chatre@intel.com \
    --cc=seanjc@google.com \
    --cc=tglx@linutronix.de \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).