From patchwork Fri Oct 26 15:12:18 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ahmed Soliman X-Patchwork-Id: 10657557 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 6F3F413A4 for ; Fri, 26 Oct 2018 15:15:30 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 62E212C9C7 for ; Fri, 26 Oct 2018 15:15:30 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 568452C9D3; Fri, 26 Oct 2018 15:15:30 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.3 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 80C082C9C7 for ; Fri, 26 Oct 2018 15:15:29 +0000 (UTC) Received: (qmail 1934 invoked by uid 550); 26 Oct 2018 15:15:28 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 1916 invoked from network); 26 Oct 2018 15:15:27 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:subject:date:message-id; bh=/gJpxsRyY5gIbCsJ2vAio9xx9GqlAyJh0govziFB65g=; b=Zqews/Nf3If0V6hE73++8a6YoSseiDQisNXtt3bnhKblrcjMvDW8BMa6HT+x1YBxB7 skRVPSCivhxX49/EpXa9C4vqmDjrfAvZGMeKAKOLW/K1oG9jjyj2c3Kyfi/g9YfnBr+c bntIdMhPj7KQnh8JJ8mRuUHt/2YAjAbhrTAxXHs8kB7bntRR34H10HayAgV2cIN8KzJO SwUF7B1uvp5KoT+waejAFZS/RE+gIIJMsugSXm1dUdiCoKCfuClDrFdRG1n0dPWuB2Ng VYEGpav1GodKN14CD9Ui/QXCD2f8cpIDNHieJB9smG4l2gYTow+SC72SqgHrHdtM/wXG OSjQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id; bh=/gJpxsRyY5gIbCsJ2vAio9xx9GqlAyJh0govziFB65g=; b=q6ovxYCGqn6FaAHAQhV2igdVOJP1H0M9vtMlatoJNy/XJam8VL44PbccffR35beT1x /l3AKwp5NDhObfJYCxxBf4I1hvwXo7ErlLfuWLns9fgRwlq/Z0jnMkK0+xnfO+Cbbjc5 2fKKUFOUN4/Wp5JoMYYp+r+tSrXP1oWKbHwSkPfuk2aXOyh1Ldt8LVwCf9LPXsekAHlE D/0GveCvamX3VHSHLTBzC4/wcw7rBBdiwKDIcG7yNdxiboG06UgmKRZc7Ow78EGoMwwW AchMmqmwWxfx+OHWQnaF6+Pq09jttO0HfS8EBecRseeWddM5W/kjZxNYxLvRS+847pQ1 /k1Q== X-Gm-Message-State: AGRZ1gLAWimNx7rS7OJegZLoRQh4nZQOtlGSb7aI3Enw4dROJ11CclBg i3XGaU4sdmVUbK/H105bRNw= X-Google-Smtp-Source: AJdET5dDodT0TeVnimL+oXSHEfXDGvubSG8lcl45KIGlQXOeCy9iDTytuKUZqiZ29EkVzgl6S1LHBg== X-Received: by 2002:a1c:4385:: with SMTP id q127-v6mr5799568wma.111.1540566915908; Fri, 26 Oct 2018 08:15:15 -0700 (PDT) From: Ahmed Abd El Mawgood To: Paolo Bonzini , rkrcmar@redhat.com, Jonathan Corbet , Thomas Gleixner , Ingo Molnar , Borislav Petkov , hpa@zytor.com, x86@kernel.org, kvm@vger.kernel.org, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, ahmedsoliman0x666@gmail.com, ovich00@gmail.com, kernel-hardening@lists.openwall.com, nigel.edwards@hpe.com, Boris Lukashev , Hossam Hassan <7ossam9063@gmail.com>, Ahmed Lotfy Subject: [PATCH V5 0/5] KVM: X86: Introducing ROE Protection Kernel Hardening Date: Fri, 26 Oct 2018 17:12:18 +0200 Message-Id: <20181026151223.16810-1-ahmedsoliman0x666@gmail.com> X-Mailer: git-send-email 2.18.1 X-Virus-Scanned: ClamAV using ClamSMTP This is the 5th version which is 4th version with minor fixes. ROE is a hypercall that enables host operating system to restrict guest's access to its own memory. This will provide a hardening mechanism that can be used to stop rootkits from manipulating kernel static data structures and code. Once a memory region is protected the guest kernel can't even request undoing the protection. Memory protected by ROE should be non-swapable because even if the ROE protected page got swapped out, It won't be possible to write anything in its place. ROE hypercall should be capable of either protecting a whole memory frame or parts of it. With these two, it should be possible for guest kernel to protect its memory and all the page table entries for that memory inside the page table. I am still not sure whether this should be part of ROE job or the guest's job. The reason why it would be better to implement this from inside kvm: instead of (host) user space is the need to access SPTEs to modify the permissions, while mprotect() from user space can work in theory. It will become a big performance hit to vmexit and switch to user space mode on each fault, on the other hand, having the permission handled by EPT should make some remarkable performance gain. Our model assumes that an attacker got full root access to a running guest and his goal is to manipulate kernel code/data (hook syscalls, overwrite IDT ..etc). There is future work in progress to also put some sort of protection on the page table register CR3 and other critical registers that can be intercepted by KVM. This way it won't be possible for an attacker to manipulate any part of the guests page table. V4->V5 change log: - Fixed summary (it was reverted summary) - Fixed an inaccurate documentation in patch [4/5] Summary: Documentation/virtual/kvm/hypercalls.txt | 40 +++++ arch/x86/include/asm/kvm_host.h | 11 +- arch/x86/kvm/Kconfig | 7 + arch/x86/kvm/mmu.c | 129 ++++++++++---- arch/x86/kvm/vmx.c | 2 +- arch/x86/kvm/x86.c | 281 ++++++++++++++++++++++++++++++- include/linux/kvm_host.h | 29 ++++ include/uapi/linux/kvm_para.h | 5 + virt/kvm/kvm_main.c | 119 +++++++++++-- 9 files changed, 572 insertions(+), 51 deletions(-) Signed-off-by: Ahmed Abd El Mawgood