From patchwork Thu Jul 28 16:13:19 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Vrabel X-Patchwork-Id: 9251441 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 082076077C for ; Thu, 28 Jul 2016 16:15:41 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id EC2DE27D0E for ; Thu, 28 Jul 2016 16:15:40 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id E0ACC27D4D; Thu, 28 Jul 2016 16:15:40 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 49D5F27D0E for ; Thu, 28 Jul 2016 16:15:39 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1bSnwA-00043p-Cl; Thu, 28 Jul 2016 16:13:30 +0000 Received: from mail6.bemta14.messagelabs.com ([193.109.254.103]) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1bSnw8-00043f-Rb for xen-devel@lists.xenproject.org; Thu, 28 Jul 2016 16:13:28 +0000 Received: from [193.109.254.147] by server-2.bemta-14.messagelabs.com id 8A/84-30017-82F2A975; Thu, 28 Jul 2016 16:13:28 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrGLMWRWlGSWpSXmKPExsXitHRDpK66/qx wg/mflC2+b5nM5MDocfjDFZYAxijWzLyk/IoE1oxf06YyFXzQr3jxoqKBsVmji5GDQ0LAX+LL Ab4uRk4ONgEdicdLZrCDhEUEVCRu7zUACTMLVElcufSZFcQWFnCReDthFjOIzSKgKnFz1g9GE JtXwF3i4+ReMFtCQE7i/PGfYDVCQGM+rl3FClEjKHFy5hMWiJkSEgdfvGCGqOeWuH16KvMERp 5ZSMpmISlbwMi0ilGjOLWoLLVI18hML6koMz2jJDcxM0fX0NBELze1uDgxPTUnMalYLzk/dxM jMDzqGRgYdzD2X/Y7xCjJwaQkyhsWOjNciC8pP6UyI7E4I76oNCe1+BCjDAeHkgRvtu6scCHB otT01Iq0zBxgoMKkJTh4lER4N4OkeYsLEnOLM9MhUqcYFaXEeeeAJARAEhmleXBtsOi4xCgrJ czLyMDAIMRTkFqUm1mCKv+KUZyDUUmYdxfIFJ7MvBK46a+AFjMBLS6OnQGyuCQRISXVwJgz77 i1sPK0yl3mLF/v1P6ump8v1vtQQvxn5YHKk5fqTfboWs6x6N8zzbv61yvdaYutU5deZ/LfdNa Su1NW652sw7Tl3jVrTs276id/NE3Gw+oh58Gm7fdndXSYLpjCtD8xfPvK/09LbVWvKJy8fymw La7zjN77xPRfesH8Br5FLxdonhQIalJiKc5INNRiLipOBAAVJk5riQIAAA== X-Env-Sender: prvs=010c06206=david.vrabel@citrix.com X-Msg-Ref: server-5.tower-27.messagelabs.com!1469722405!56534212!1 X-Originating-IP: [66.165.176.89] X-SpamReason: No, hits=0.0 required=7.0 tests=sa_preprocessor: VHJ1c3RlZCBJUDogNjYuMTY1LjE3Ni44OSA9PiAyMDMwMDc=\n, received_headers: No Received headers X-StarScan-Received: X-StarScan-Version: 8.77; banners=-,-,- X-VirusChecked: Checked Received: (qmail 30003 invoked from network); 28 Jul 2016 16:13:27 -0000 Received: from smtp.citrix.com (HELO SMTP.CITRIX.COM) (66.165.176.89) by server-5.tower-27.messagelabs.com with RC4-SHA encrypted SMTP; 28 Jul 2016 16:13:27 -0000 X-IronPort-AV: E=Sophos;i="5.28,434,1464652800"; d="scan'208";a="369024917" From: David Vrabel To: Date: Thu, 28 Jul 2016 17:13:19 +0100 Message-ID: <1469722399-12080-1-git-send-email-david.vrabel@citrix.com> X-Mailer: git-send-email 2.1.4 MIME-Version: 1.0 X-DLP: MIA2 Cc: Juergen Gross , Boris Ostrovsky , David Vrabel Subject: [Xen-devel] [RFC PATCHv1] xen/privcmd: add IOCTL_PRIVCMD_RESTRICT_DOMID X-BeenThere: xen-devel@lists.xen.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" X-Virus-Scanned: ClamAV using ClamSMTP This restricts the file descriptor to only being able map foreign memory belonging to a specific domain. Once a file descriptor has been restricted its restriction cannot be removed or changed. A device model (e.g., QEMU) or similar can make use of this before dropping privileges to prevent the file descriptor being used to escalate privleges if the process is compromised. FIXME: This is not good enough (yet) as it does not restrict what hypercalls may be performed. Fixing this requires a hypervisor ABI change. Signed-off-by: David Vrabel --- drivers/xen/privcmd.c | 75 ++++++++++++++++++++++++++++++++++++++++++---- include/uapi/xen/privcmd.h | 26 ++++++++++++++++ 2 files changed, 96 insertions(+), 5 deletions(-) diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c index df2e6f7..513d1c5 100644 --- a/drivers/xen/privcmd.c +++ b/drivers/xen/privcmd.c @@ -43,6 +43,18 @@ MODULE_LICENSE("GPL"); #define PRIV_VMA_LOCKED ((void *)1) +#define UNRESTRICTED_DOMID ((domid_t)-1) + +struct privcmd_data { + domid_t restrict_domid; +}; + +static bool privcmd_is_allowed(struct privcmd_data *priv, domid_t domid) +{ + return priv->restrict_domid == UNRESTRICTED_DOMID + || priv->restrict_domid == domid; +} + static int privcmd_vma_range_is_mapped( struct vm_area_struct *vma, unsigned long addr, @@ -229,7 +241,7 @@ static int mmap_gfn_range(void *data, void *state) return 0; } -static long privcmd_ioctl_mmap(void __user *udata) +static long privcmd_ioctl_mmap(struct privcmd_data *priv, void __user *udata) { struct privcmd_mmap mmapcmd; struct mm_struct *mm = current->mm; @@ -245,6 +257,9 @@ static long privcmd_ioctl_mmap(void __user *udata) if (copy_from_user(&mmapcmd, udata, sizeof(mmapcmd))) return -EFAULT; + if (!privcmd_is_allowed(priv, mmapcmd.dom)) + return -EACCES; + rc = gather_array(&pagelist, mmapcmd.num, sizeof(struct privcmd_mmap_entry), mmapcmd.entry); @@ -416,7 +431,8 @@ static int alloc_empty_pages(struct vm_area_struct *vma, int numpgs) static const struct vm_operations_struct privcmd_vm_ops; -static long privcmd_ioctl_mmap_batch(void __user *udata, int version) +static long privcmd_ioctl_mmap_batch(struct privcmd_data *priv, void __user *udata, + int version) { int ret; struct privcmd_mmapbatch_v2 m; @@ -446,6 +462,9 @@ static long privcmd_ioctl_mmap_batch(void __user *udata, int version) return -EINVAL; } + if (!privcmd_is_allowed(priv, m.dom)) + return -EACCES; + nr_pages = DIV_ROUND_UP(m.num, XEN_PFN_PER_PAGE); if ((m.num <= 0) || (nr_pages > (LONG_MAX >> PAGE_SHIFT))) return -EINVAL; @@ -548,9 +567,28 @@ out_unlock: goto out; } +static int privcmd_ioctl_restrict_domid(struct privcmd_data *priv, + void __user *udata) +{ + struct privcmd_restrict_domid prd; + + if (copy_from_user(&prd, udata, sizeof(prd))) + return -EFAULT; + + if (prd.domid >= DOMID_FIRST_RESERVED) + return -EINVAL; + if (priv->restrict_domid != UNRESTRICTED_DOMID) + return -EACCES; + + priv->restrict_domid = prd.domid; + + return 0; +} + static long privcmd_ioctl(struct file *file, unsigned int cmd, unsigned long data) { + struct privcmd_data *priv = file->private_data; int ret = -ENOSYS; void __user *udata = (void __user *) data; @@ -560,15 +598,19 @@ static long privcmd_ioctl(struct file *file, break; case IOCTL_PRIVCMD_MMAP: - ret = privcmd_ioctl_mmap(udata); + ret = privcmd_ioctl_mmap(priv, udata); break; case IOCTL_PRIVCMD_MMAPBATCH: - ret = privcmd_ioctl_mmap_batch(udata, 1); + ret = privcmd_ioctl_mmap_batch(priv, udata, 1); break; case IOCTL_PRIVCMD_MMAPBATCH_V2: - ret = privcmd_ioctl_mmap_batch(udata, 2); + ret = privcmd_ioctl_mmap_batch(priv, udata, 2); + break; + + case IOCTL_PRIVCMD_RESTRICT_DOMID: + ret = privcmd_ioctl_restrict_domid(priv, udata); break; default: @@ -644,10 +686,33 @@ static int privcmd_vma_range_is_mapped( is_mapped_fn, NULL) != 0; } +static int privcmd_open(struct inode *ino, struct file *filp) +{ + struct privcmd_data *priv; + + priv = kzalloc(sizeof(*priv), GFP_KERNEL); + if (!priv) + return -ENOMEM; + + priv->restrict_domid = UNRESTRICTED_DOMID; + + return 0; +} + +static int privcmd_release(struct inode *inode, struct file *file) +{ + struct privcmd_data *priv = file->private_data; + + kfree(priv); + return 0; +} + const struct file_operations xen_privcmd_fops = { .owner = THIS_MODULE, .unlocked_ioctl = privcmd_ioctl, .mmap = privcmd_mmap, + .open = privcmd_open, + .release = privcmd_release, }; EXPORT_SYMBOL_GPL(xen_privcmd_fops); diff --git a/include/uapi/xen/privcmd.h b/include/uapi/xen/privcmd.h index 7ddeeda..e2cea4b 100644 --- a/include/uapi/xen/privcmd.h +++ b/include/uapi/xen/privcmd.h @@ -77,6 +77,10 @@ struct privcmd_mmapbatch_v2 { int __user *err; /* array of error codes */ }; +struct privcmd_restrict_domid { + domid_t domid; +}; + /* * @cmd: IOCTL_PRIVCMD_HYPERCALL * @arg: &privcmd_hypercall_t @@ -99,4 +103,26 @@ struct privcmd_mmapbatch_v2 { #define IOCTL_PRIVCMD_MMAPBATCH_V2 \ _IOC(_IOC_NONE, 'P', 4, sizeof(struct privcmd_mmapbatch_v2)) +/* + * @cmd: IOCTL_PRIVCMD_RESTRICT_DOMID + * @arg: struct privcmd_restrict_domid * + * Return: 0 on success, or -1 (with errno set). + * + * This restricts the file descriptor to only being able map foreign + * memory belonging to a specific domain. Once a file descriptor has + * been restricted its restriction cannot be removed or changed. + * + * A device model (e.g., QEMU) or similar can make use of this before + * dropping privileges to prevent the file descriptor being used to + * escalate privleges if the process is compromised. + * + * FIXME: This is not good enough (yet) as it does not restrict what + * hypercalls may be performed. + * + * EINVAL - the specified domid isn't valid. + * EACCES - the file descriptor has already been restricted. + */ +#define IOCTL_PRIVCMD_RESTRICT_DOMID \ + _IOC(_IOC_NONE, 'P', 5, sizeof(struct privcmd_restrict_domid)) + #endif /* __LINUX_PUBLIC_PRIVCMD_H__ */