From: "Xing, Cedric" <cedric.xing@intel.com>
To: Andy Lutomirski <luto@kernel.org>,
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Cc: "Christopherson, Sean J" <sean.j.christopherson@intel.com>,
"Stephen Smalley" <sds@tycho.nsa.gov>,
James Morris <jmorris@namei.org>,
"Serge E . Hallyn" <serge@hallyn.com>,
LSM List <linux-security-module@vger.kernel.org>,
Paul Moore <paul@paul-moore.com>,
Eric Paris <eparis@parisplace.org>,
"selinux@vger.kernel.org" <selinux@vger.kernel.org>,
Jethro Beekman <jethro@fortanix.com>,
"Hansen, Dave" <dave.hansen@intel.com>,
"Thomas Gleixner" <tglx@linutronix.de>,
Linus Torvalds <torvalds@linux-foundation.org>,
LKML <linux-kernel@vger.kernel.org>, X86 ML <x86@kernel.org>,
"linux-sgx@vger.kernel.org" <linux-sgx@vger.kernel.org>,
Andrew Morton <akpm@linux-foundation.org>,
"nhorman@redhat.com" <nhorman@redhat.com>,
"npmccallum@redhat.com" <npmccallum@redhat.com>,
"Ayoun, Serge" <serge.ayoun@intel.com>,
"Katz-zamir, Shay" <shay.katz-zamir@intel.com>,
"Huang, Haitao" <haitao.huang@intel.com>,
"Andy Shevchenko" <andriy.shevchenko@linux.intel.com>,
"Svahn, Kai" <kai.svahn@intel.com>,
Borislav Petkov <bp@alien8.de>,
Josh Triplett <josh@joshtriplett.org>,
"Huang, Kai" <kai.huang@intel.com>,
David Rientjes <rientjes@google.com>,
"Roberts, William C" <william.c.roberts@intel.com>,
"Tricca, Philip B" <philip.b.tricca@intel.com>
Subject: RE: [RFC PATCH 7/9] x86/sgx: Enforce noexec filesystem restriction for enclaves
Date: Tue, 4 Jun 2019 21:54:21 +0000 [thread overview]
Message-ID: <960B34DE67B9E140824F1DCDEC400C0F654EDBA2@ORSMSX116.amr.corp.intel.com> (raw)
In-Reply-To: <CALCETrUqcQNbRvBe2UqQih8RHnuwn3KaC=xJU1cRsaEVsCQUgw@mail.gmail.com>
> From: Andy Lutomirski [mailto:luto@kernel.org]
> Sent: Tuesday, June 04, 2019 1:25 PM
> To: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
>
> On Tue, Jun 4, 2019 at 9:26 AM Jarkko Sakkinen
> <jarkko.sakkinen@linux.intel.com> wrote:
> >
> > On Fri, May 31, 2019 at 04:31:57PM -0700, Sean Christopherson wrote:
> > > Do not allow an enclave page to be mapped with PROT_EXEC if the
> > > source page is backed by a file on a noexec file system.
> > >
> > > Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
> >
> > Why don't you just check in sgx_encl_add_page() that whether the path
> > comes from noexec and deny if SECINFO contains X?
> >
>
> SECINFO seems almost entirely useless for this kind of thing because of
> SGX2. I'm thinking that SECINFO should be completely ignored for
> anything other than its required architectural purpose.
For the purpose of allowing/denying EADD/EAUG, SECINFO is useless.
But SECINFO contains also the page type. What's coming as new feature of SGX2 is CONFIGID, which is a 512-bit value inside SECS, provided by untrusted code at ECREATE. Usually CONFIGID is a hash of something that would affect the behavior of the enclave. For example, the "main" enclave could be a JVM with the actual applet being loaded hashed into SECS.CONFIGID. In that case the enclave's measurements (MRENCLAVE) will stay the same for all applets yet individual applet will have distinct CONFIGID and receive distinct keys. When it comes to LSM, a policy may want to whitelist/blacklist applets for a JVM so a hook at ECREATE may be desirable. We could either define a new hook, or overload security_enclave_load() by providing SECINFO as one of its parameters.
next prev parent reply other threads:[~2019-06-04 21:54 UTC|newest]
Thread overview: 77+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-05-31 23:31 [RFC PATCH 0/9] security: x86/sgx: SGX vs. LSM Sean Christopherson
2019-05-31 23:31 ` [RFC PATCH 1/9] x86/sgx: Remove unused local variable in sgx_encl_release() Sean Christopherson
2019-06-04 11:41 ` Jarkko Sakkinen
2019-05-31 23:31 ` [RFC PATCH 2/9] x86/sgx: Do not naturally align MAP_FIXED address Sean Christopherson
2019-06-04 11:49 ` Jarkko Sakkinen
2019-06-04 20:16 ` Andy Lutomirski
2019-06-04 22:10 ` Xing, Cedric
2019-06-05 14:08 ` Sean Christopherson
2019-06-05 15:17 ` Jarkko Sakkinen
2019-06-05 20:14 ` Andy Lutomirski
2019-06-06 15:37 ` Jarkko Sakkinen
2019-06-13 13:48 ` Jarkko Sakkinen
2019-06-13 16:47 ` Xing, Cedric
2019-06-13 17:14 ` Sean Christopherson
2019-06-14 15:18 ` Jarkko Sakkinen
2019-06-05 15:15 ` Jarkko Sakkinen
2019-05-31 23:31 ` [RFC PATCH 3/9] x86/sgx: Allow userspace to add multiple pages in single ioctl() Sean Christopherson
2019-06-03 6:26 ` Xing, Cedric
2019-06-03 20:08 ` Sean Christopherson
2019-06-03 20:39 ` Sean Christopherson
2019-06-03 23:45 ` Xing, Cedric
2019-06-04 0:54 ` Sean Christopherson
2019-06-04 20:18 ` Andy Lutomirski
2019-06-04 22:02 ` Xing, Cedric
2019-06-03 20:14 ` Dave Hansen
2019-06-03 20:37 ` Sean Christopherson
2019-06-03 20:39 ` Dave Hansen
2019-06-03 23:48 ` Xing, Cedric
2019-06-04 0:55 ` Sean Christopherson
2019-06-04 11:55 ` Jarkko Sakkinen
2019-05-31 23:31 ` [RFC PATCH 4/9] mm: Introduce vm_ops->mprotect() Sean Christopherson
2019-06-03 6:27 ` Xing, Cedric
2019-06-04 12:24 ` Jarkko Sakkinen
2019-06-04 14:51 ` Andy Lutomirski
2019-05-31 23:31 ` [RFC PATCH 5/9] x86/sgx: Restrict mapping without an enclave page to PROT_NONE Sean Christopherson
2019-06-03 6:28 ` Xing, Cedric
2019-06-04 15:32 ` Jarkko Sakkinen
2019-05-31 23:31 ` [RFC PATCH 6/9] x86/sgx: Require userspace to provide allowed prots to ADD_PAGES Sean Christopherson
2019-06-03 6:28 ` Xing, Cedric
2019-06-04 16:23 ` Jarkko Sakkinen
2019-06-04 16:45 ` Sean Christopherson
2019-06-05 15:06 ` Jarkko Sakkinen
2019-06-04 20:23 ` Andy Lutomirski
2019-06-05 11:10 ` Ayoun, Serge
2019-06-05 23:58 ` Sean Christopherson
2019-05-31 23:31 ` [RFC PATCH 7/9] x86/sgx: Enforce noexec filesystem restriction for enclaves Sean Christopherson
2019-06-03 6:29 ` Xing, Cedric
2019-06-04 20:26 ` Andy Lutomirski
2019-06-04 16:25 ` Jarkko Sakkinen
2019-06-04 20:25 ` Andy Lutomirski
2019-06-04 20:34 ` Sean Christopherson
2019-06-04 21:54 ` Xing, Cedric [this message]
2019-06-05 15:10 ` Jarkko Sakkinen
2019-06-06 1:01 ` Sean Christopherson
2019-05-31 23:31 ` [RFC PATCH 8/9] LSM: x86/sgx: Introduce ->enclave_load() hook for Intel SGX Sean Christopherson
2019-06-03 6:28 ` Xing, Cedric
2019-06-03 14:19 ` Stephen Smalley
2019-06-03 14:42 ` Sean Christopherson
2019-06-03 18:38 ` Stephen Smalley
2019-06-03 18:45 ` Dave Hansen
2019-06-04 20:29 ` Andy Lutomirski
2019-06-04 20:36 ` Sean Christopherson
2019-06-04 21:43 ` Xing, Cedric
2019-06-06 2:04 ` Sean Christopherson
2019-05-31 23:31 ` [RFC PATCH 9/9] security/selinux: Add enclave_load() implementation Sean Christopherson
2019-06-03 15:01 ` Stephen Smalley
2019-06-03 15:50 ` Sean Christopherson
2019-06-02 7:29 ` [RFC PATCH 0/9] security: x86/sgx: SGX vs. LSM Xing, Cedric
2019-06-03 17:15 ` Sean Christopherson
2019-06-03 18:30 ` Xing, Cedric
2019-06-04 1:36 ` Sean Christopherson
2019-06-04 15:33 ` Stephen Smalley
2019-06-04 16:30 ` Sean Christopherson
2019-06-04 21:38 ` Xing, Cedric
2019-06-03 17:47 ` Stephen Smalley
2019-06-03 18:02 ` Xing, Cedric
2019-06-04 11:15 ` Jarkko Sakkinen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=960B34DE67B9E140824F1DCDEC400C0F654EDBA2@ORSMSX116.amr.corp.intel.com \
--to=cedric.xing@intel.com \
--cc=akpm@linux-foundation.org \
--cc=andriy.shevchenko@linux.intel.com \
--cc=bp@alien8.de \
--cc=dave.hansen@intel.com \
--cc=eparis@parisplace.org \
--cc=haitao.huang@intel.com \
--cc=jarkko.sakkinen@linux.intel.com \
--cc=jethro@fortanix.com \
--cc=jmorris@namei.org \
--cc=josh@joshtriplett.org \
--cc=kai.huang@intel.com \
--cc=kai.svahn@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=linux-sgx@vger.kernel.org \
--cc=luto@kernel.org \
--cc=nhorman@redhat.com \
--cc=npmccallum@redhat.com \
--cc=paul@paul-moore.com \
--cc=philip.b.tricca@intel.com \
--cc=rientjes@google.com \
--cc=sds@tycho.nsa.gov \
--cc=sean.j.christopherson@intel.com \
--cc=selinux@vger.kernel.org \
--cc=serge.ayoun@intel.com \
--cc=serge@hallyn.com \
--cc=shay.katz-zamir@intel.com \
--cc=tglx@linutronix.de \
--cc=torvalds@linux-foundation.org \
--cc=william.c.roberts@intel.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).