* [RFC PATCHv1] xen/privcmd: add IOCTL_PRIVCMD_RESTRICT_DOMID
@ 2016-07-28 16:13 David Vrabel
2016-07-28 19:17 ` Boris Ostrovsky
0 siblings, 1 reply; 2+ messages in thread
From: David Vrabel @ 2016-07-28 16:13 UTC (permalink / raw)
To: xen-devel; +Cc: Juergen Gross, Boris Ostrovsky, David Vrabel
This restricts the file descriptor to only being able map foreign
memory belonging to a specific domain. Once a file descriptor has
been restricted its restriction cannot be removed or changed.
A device model (e.g., QEMU) or similar can make use of this before
dropping privileges to prevent the file descriptor being used to
escalate privleges if the process is compromised.
FIXME: This is not good enough (yet) as it does not restrict what
hypercalls may be performed. Fixing this requires a hypervisor ABI
change.
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
---
drivers/xen/privcmd.c | 75 ++++++++++++++++++++++++++++++++++++++++++----
include/uapi/xen/privcmd.h | 26 ++++++++++++++++
2 files changed, 96 insertions(+), 5 deletions(-)
diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
index df2e6f7..513d1c5 100644
--- a/drivers/xen/privcmd.c
+++ b/drivers/xen/privcmd.c
@@ -43,6 +43,18 @@ MODULE_LICENSE("GPL");
#define PRIV_VMA_LOCKED ((void *)1)
+#define UNRESTRICTED_DOMID ((domid_t)-1)
+
+struct privcmd_data {
+ domid_t restrict_domid;
+};
+
+static bool privcmd_is_allowed(struct privcmd_data *priv, domid_t domid)
+{
+ return priv->restrict_domid == UNRESTRICTED_DOMID
+ || priv->restrict_domid == domid;
+}
+
static int privcmd_vma_range_is_mapped(
struct vm_area_struct *vma,
unsigned long addr,
@@ -229,7 +241,7 @@ static int mmap_gfn_range(void *data, void *state)
return 0;
}
-static long privcmd_ioctl_mmap(void __user *udata)
+static long privcmd_ioctl_mmap(struct privcmd_data *priv, void __user *udata)
{
struct privcmd_mmap mmapcmd;
struct mm_struct *mm = current->mm;
@@ -245,6 +257,9 @@ static long privcmd_ioctl_mmap(void __user *udata)
if (copy_from_user(&mmapcmd, udata, sizeof(mmapcmd)))
return -EFAULT;
+ if (!privcmd_is_allowed(priv, mmapcmd.dom))
+ return -EACCES;
+
rc = gather_array(&pagelist,
mmapcmd.num, sizeof(struct privcmd_mmap_entry),
mmapcmd.entry);
@@ -416,7 +431,8 @@ static int alloc_empty_pages(struct vm_area_struct *vma, int numpgs)
static const struct vm_operations_struct privcmd_vm_ops;
-static long privcmd_ioctl_mmap_batch(void __user *udata, int version)
+static long privcmd_ioctl_mmap_batch(struct privcmd_data *priv, void __user *udata,
+ int version)
{
int ret;
struct privcmd_mmapbatch_v2 m;
@@ -446,6 +462,9 @@ static long privcmd_ioctl_mmap_batch(void __user *udata, int version)
return -EINVAL;
}
+ if (!privcmd_is_allowed(priv, m.dom))
+ return -EACCES;
+
nr_pages = DIV_ROUND_UP(m.num, XEN_PFN_PER_PAGE);
if ((m.num <= 0) || (nr_pages > (LONG_MAX >> PAGE_SHIFT)))
return -EINVAL;
@@ -548,9 +567,28 @@ out_unlock:
goto out;
}
+static int privcmd_ioctl_restrict_domid(struct privcmd_data *priv,
+ void __user *udata)
+{
+ struct privcmd_restrict_domid prd;
+
+ if (copy_from_user(&prd, udata, sizeof(prd)))
+ return -EFAULT;
+
+ if (prd.domid >= DOMID_FIRST_RESERVED)
+ return -EINVAL;
+ if (priv->restrict_domid != UNRESTRICTED_DOMID)
+ return -EACCES;
+
+ priv->restrict_domid = prd.domid;
+
+ return 0;
+}
+
static long privcmd_ioctl(struct file *file,
unsigned int cmd, unsigned long data)
{
+ struct privcmd_data *priv = file->private_data;
int ret = -ENOSYS;
void __user *udata = (void __user *) data;
@@ -560,15 +598,19 @@ static long privcmd_ioctl(struct file *file,
break;
case IOCTL_PRIVCMD_MMAP:
- ret = privcmd_ioctl_mmap(udata);
+ ret = privcmd_ioctl_mmap(priv, udata);
break;
case IOCTL_PRIVCMD_MMAPBATCH:
- ret = privcmd_ioctl_mmap_batch(udata, 1);
+ ret = privcmd_ioctl_mmap_batch(priv, udata, 1);
break;
case IOCTL_PRIVCMD_MMAPBATCH_V2:
- ret = privcmd_ioctl_mmap_batch(udata, 2);
+ ret = privcmd_ioctl_mmap_batch(priv, udata, 2);
+ break;
+
+ case IOCTL_PRIVCMD_RESTRICT_DOMID:
+ ret = privcmd_ioctl_restrict_domid(priv, udata);
break;
default:
@@ -644,10 +686,33 @@ static int privcmd_vma_range_is_mapped(
is_mapped_fn, NULL) != 0;
}
+static int privcmd_open(struct inode *ino, struct file *filp)
+{
+ struct privcmd_data *priv;
+
+ priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+ if (!priv)
+ return -ENOMEM;
+
+ priv->restrict_domid = UNRESTRICTED_DOMID;
+
+ return 0;
+}
+
+static int privcmd_release(struct inode *inode, struct file *file)
+{
+ struct privcmd_data *priv = file->private_data;
+
+ kfree(priv);
+ return 0;
+}
+
const struct file_operations xen_privcmd_fops = {
.owner = THIS_MODULE,
.unlocked_ioctl = privcmd_ioctl,
.mmap = privcmd_mmap,
+ .open = privcmd_open,
+ .release = privcmd_release,
};
EXPORT_SYMBOL_GPL(xen_privcmd_fops);
diff --git a/include/uapi/xen/privcmd.h b/include/uapi/xen/privcmd.h
index 7ddeeda..e2cea4b 100644
--- a/include/uapi/xen/privcmd.h
+++ b/include/uapi/xen/privcmd.h
@@ -77,6 +77,10 @@ struct privcmd_mmapbatch_v2 {
int __user *err; /* array of error codes */
};
+struct privcmd_restrict_domid {
+ domid_t domid;
+};
+
/*
* @cmd: IOCTL_PRIVCMD_HYPERCALL
* @arg: &privcmd_hypercall_t
@@ -99,4 +103,26 @@ struct privcmd_mmapbatch_v2 {
#define IOCTL_PRIVCMD_MMAPBATCH_V2 \
_IOC(_IOC_NONE, 'P', 4, sizeof(struct privcmd_mmapbatch_v2))
+/*
+ * @cmd: IOCTL_PRIVCMD_RESTRICT_DOMID
+ * @arg: struct privcmd_restrict_domid *
+ * Return: 0 on success, or -1 (with errno set).
+ *
+ * This restricts the file descriptor to only being able map foreign
+ * memory belonging to a specific domain. Once a file descriptor has
+ * been restricted its restriction cannot be removed or changed.
+ *
+ * A device model (e.g., QEMU) or similar can make use of this before
+ * dropping privileges to prevent the file descriptor being used to
+ * escalate privleges if the process is compromised.
+ *
+ * FIXME: This is not good enough (yet) as it does not restrict what
+ * hypercalls may be performed.
+ *
+ * EINVAL - the specified domid isn't valid.
+ * EACCES - the file descriptor has already been restricted.
+ */
+#define IOCTL_PRIVCMD_RESTRICT_DOMID \
+ _IOC(_IOC_NONE, 'P', 5, sizeof(struct privcmd_restrict_domid))
+
#endif /* __LINUX_PUBLIC_PRIVCMD_H__ */
--
2.1.4
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [RFC PATCHv1] xen/privcmd: add IOCTL_PRIVCMD_RESTRICT_DOMID
2016-07-28 16:13 [RFC PATCHv1] xen/privcmd: add IOCTL_PRIVCMD_RESTRICT_DOMID David Vrabel
@ 2016-07-28 19:17 ` Boris Ostrovsky
0 siblings, 0 replies; 2+ messages in thread
From: Boris Ostrovsky @ 2016-07-28 19:17 UTC (permalink / raw)
To: David Vrabel, xen-devel; +Cc: Juergen Gross
On 07/28/2016 12:13 PM, David Vrabel wrote:
>
> diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
> index df2e6f7..513d1c5 100644
> --- a/drivers/xen/privcmd.c
> +++ b/drivers/xen/privcmd.c
> @@ -43,6 +43,18 @@ MODULE_LICENSE("GPL");
>
> #define PRIV_VMA_LOCKED ((void *)1)
>
> +#define UNRESTRICTED_DOMID ((domid_t)-1)
This can probably go into a header file since you've used the same macro
for event channel restricted domains.
> +
> +struct privcmd_data {
> + domid_t restrict_domid;
> +};
> +
> +static bool privcmd_is_allowed(struct privcmd_data *priv, domid_t domid)
> +{
> + return priv->restrict_domid == UNRESTRICTED_DOMID
> + || priv->restrict_domid == domid;
> +}
I also wonder whether this can be made useful to event channels (and
possibly other operations we might want to try restricting in the future).
-boris
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2016-07-28 19:16 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-07-28 16:13 [RFC PATCHv1] xen/privcmd: add IOCTL_PRIVCMD_RESTRICT_DOMID David Vrabel
2016-07-28 19:17 ` Boris Ostrovsky
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).