From: Sergey Dyasli <sergey.dyasli@citrix.com>
To: <xen-devel@lists.xen.org>
Cc: Sergey Dyasli <sergey.dyasli@citrix.com>,
Stefano Stabellini <sstabellini@kernel.org>,
Julien Grall <julien@xen.org>, Wei Liu <wl@xen.org>,
Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>,
George Dunlap <George.Dunlap@eu.citrix.com>,
Andrew Cooper <andrew.cooper3@citrix.com>,
Ian Jackson <ian.jackson@eu.citrix.com>,
Jan Beulich <jbeulich@suse.com>,
Daniel De Graaf <dgdegra@tycho.nsa.gov>,
Doug Goldstein <cardoe@cardoe.com>
Subject: [Xen-devel] [PATCH v4 2/2] xsm: hide detailed Xen version from unprivileged guests
Date: Tue, 11 Feb 2020 13:42:20 +0000 [thread overview]
Message-ID: <20200211134220.9194-3-sergey.dyasli@citrix.com> (raw)
In-Reply-To: <20200211134220.9194-1-sergey.dyasli@citrix.com>
Hide the following information that can help identify the running Xen
binary version: XENVER_[extraversion|compile_info|changeset]
This makes harder for malicious guests to fingerprint Xen to identify
exploitable systems.
Introduce xsm_filter_denied() to hvmloader to remove "<denied>" string
from guest's DMI tables that otherwise would be shown in tools like
dmidecode.
While at it, add explicit cases for XENVER_[commandline|build_id]
for better code readability. Add a default case with an ASSERT to make
sure that every case is explicitly listed as well.
Signed-off-by: Sergey Dyasli <sergey.dyasli@citrix.com>
---
v3 --> v4:
- Updated commit message
- Re-add hvmloader filtering
v2 --> v3:
- Remove hvmloader filtering
- Add ASSERT_UNREACHABLE
v1 --> v2:
- Added xsm_filter_denied() to hvmloader instead of modifying xen_deny()
- Made behaviour the same for both Release and Debug builds
- XENVER_capabilities is no longer hided
---
tools/firmware/hvmloader/hvmloader.c | 1 +
tools/firmware/hvmloader/smbios.c | 1 +
tools/firmware/hvmloader/util.c | 11 +++++++++++
tools/firmware/hvmloader/util.h | 2 ++
xen/include/xsm/dummy.h | 15 +++++++++++----
5 files changed, 26 insertions(+), 4 deletions(-)
diff --git a/tools/firmware/hvmloader/hvmloader.c b/tools/firmware/hvmloader/hvmloader.c
index 598a226278..b35899f2fb 100644
--- a/tools/firmware/hvmloader/hvmloader.c
+++ b/tools/firmware/hvmloader/hvmloader.c
@@ -147,6 +147,7 @@ static void init_hypercalls(void)
/* Print version information. */
cpuid(base + 1, &eax, &ebx, &ecx, &edx);
hypercall_xen_version(XENVER_extraversion, extraversion);
+ xsm_filter_denied(extraversion);
printf("Detected Xen v%u.%u%s\n", eax >> 16, eax & 0xffff, extraversion);
}
diff --git a/tools/firmware/hvmloader/smbios.c b/tools/firmware/hvmloader/smbios.c
index 97a054e9e3..a71bfe8392 100644
--- a/tools/firmware/hvmloader/smbios.c
+++ b/tools/firmware/hvmloader/smbios.c
@@ -275,6 +275,7 @@ hvm_write_smbios_tables(
xen_minor_version = (uint16_t) xen_version;
hypercall_xen_version(XENVER_extraversion, xen_extra_version);
+ xsm_filter_denied(xen_extra_version);
/* build up human-readable Xen version string */
p = xen_version_str;
diff --git a/tools/firmware/hvmloader/util.c b/tools/firmware/hvmloader/util.c
index 0c3f2d24cd..49b4b321e3 100644
--- a/tools/firmware/hvmloader/util.c
+++ b/tools/firmware/hvmloader/util.c
@@ -28,6 +28,7 @@
#include <xen/xen.h>
#include <xen/memory.h>
#include <xen/sched.h>
+#include <xen/version.h>
#include <xen/hvm/hvm_xs_strings.h>
#include <xen/hvm/params.h>
@@ -995,6 +996,16 @@ void hvmloader_acpi_build_tables(struct acpi_config *config,
hvm_param_set(HVM_PARAM_VM_GENERATION_ID_ADDR, config->vm_gid_addr);
}
+void xsm_filter_denied(char *str)
+{
+ xen_denied_string_t deny_str = "";
+
+ hypercall_xen_version(XENVER_denied_string, deny_str);
+
+ if ( strcmp(str, deny_str) == 0 )
+ *str = '\0';
+}
+
/*
* Local variables:
* mode: C
diff --git a/tools/firmware/hvmloader/util.h b/tools/firmware/hvmloader/util.h
index 7bca6418d2..e4fd26de9d 100644
--- a/tools/firmware/hvmloader/util.h
+++ b/tools/firmware/hvmloader/util.h
@@ -286,6 +286,8 @@ struct acpi_config;
void hvmloader_acpi_build_tables(struct acpi_config *config,
unsigned int physical);
+void xsm_filter_denied(char *str);
+
#endif /* __HVMLOADER_UTIL_H__ */
/*
diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h
index 72a101b106..2567ccaa0a 100644
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -751,16 +751,23 @@ static XSM_INLINE int xsm_xen_version (XSM_DEFAULT_ARG uint32_t op)
case XENVER_denied_string:
/* These sub-ops ignore the permission checks and return data. */
return 0;
- case XENVER_extraversion:
- case XENVER_compile_info:
+
case XENVER_capabilities:
- case XENVER_changeset:
case XENVER_pagesize:
case XENVER_guest_handle:
/* These MUST always be accessible to any guest by default. */
return xsm_default_action(XSM_HOOK, current->domain, NULL);
- default:
+
+ case XENVER_extraversion:
+ case XENVER_compile_info:
+ case XENVER_changeset:
+ case XENVER_commandline:
+ case XENVER_build_id:
return xsm_default_action(XSM_PRIV, current->domain, NULL);
+
+ default:
+ ASSERT_UNREACHABLE();
+ return -EPERM;
}
}
--
2.17.1
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
next prev parent reply other threads:[~2020-02-11 13:42 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-02-11 13:42 [Xen-devel] [PATCH v4 0/2] xsm: hide detailed Xen version Sergey Dyasli
2020-02-11 13:42 ` [Xen-devel] [PATCH v4 1/2] xsm: add Kconfig option for denied string Sergey Dyasli
2020-02-11 13:56 ` Andrew Cooper
2020-02-12 9:36 ` Jan Beulich
2020-02-12 9:32 ` Jan Beulich
2020-02-12 15:55 ` Sergey Dyasli
2020-02-11 13:42 ` Sergey Dyasli [this message]
2020-09-04 9:25 ` [PATCH v4 0/2] xsm: hide detailed Xen version Jan Beulich
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200211134220.9194-3-sergey.dyasli@citrix.com \
--to=sergey.dyasli@citrix.com \
--cc=George.Dunlap@eu.citrix.com \
--cc=andrew.cooper3@citrix.com \
--cc=cardoe@cardoe.com \
--cc=dgdegra@tycho.nsa.gov \
--cc=ian.jackson@eu.citrix.com \
--cc=jbeulich@suse.com \
--cc=julien@xen.org \
--cc=konrad.wilk@oracle.com \
--cc=sstabellini@kernel.org \
--cc=wl@xen.org \
--cc=xen-devel@lists.xen.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).