From patchwork Tue Apr 4 19:10:15 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Konrad Rzeszutek Wilk X-Patchwork-Id: 9662451 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id ED4F46032D for ; Tue, 4 Apr 2017 19:12:55 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E000A28546 for ; Tue, 4 Apr 2017 19:12:55 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id D414828555; Tue, 4 Apr 2017 19:12:55 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 5EB5C28546 for ; Tue, 4 Apr 2017 19:12:55 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cvTqe-0007kd-SN; Tue, 04 Apr 2017 19:10:36 +0000 Received: from mail6.bemta6.messagelabs.com ([193.109.254.103]) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cvTqd-0007k9-95 for xen-devel@lists.xenproject.org; Tue, 04 Apr 2017 19:10:35 +0000 Received: from [193.109.254.147] by server-2.bemta-6.messagelabs.com id B0/BE-19731-AAFE3E85; Tue, 04 Apr 2017 19:10:34 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrNLMWRWlGSWpSXmKPExsUyZ7p8oO6q948 jDNZ28Ft83zKZyYHR4/CHKywBjFGsmXlJ+RUJrBkd37+zFdxSqLj+4ABrA2O7dBcjF4eQwAQm iSVnmhkhnF+MEnePtbFBOBsYJR4vmQ2V6WOU6Gt7D5Th4GATMJF4s8qxi5GTQ0RASeLeqslMI DazQJLEn2/fWUBsYYEwidcLToDFWQRUJb486WMHsXkFrCW2PmhnBbElBOQkLm37wgwyklPARu L/kjKQsBBQyfape6BKDCU+b1zKPIGRbwEjwypGjeLUorLUIl1jY72kosz0jJLcxMwcXUMDM73 c1OLixPTUnMSkYr3k/NxNjMBAYQCCHYw71wceYpTkYFIS5WW8+ThCiC8pP6UyI7E4I76oNCe1 +BCjDAeHkgTv0XdAOcGi1PTUirTMHGDIwqQlOHiURHjng6R5iwsSc4sz0yFSpxgVpcR5T4EkB EASGaV5cG2wOLnEKCslzMsIdIgQT0FqUW5mCar8K0ZxDkYlYV5OkCk8mXklcNNfAS1mAlr85M 5DkMUliQgpqQZG3bvbdd8vPPhJx+TpreLGxQlFeY4XmpcKqmnlbPn3v+D0jrIv4V0LBWpVEoX ygtn/xe+YftPVKYNZSsSksGmDZ4yzf/aFKYl8Mz0lDSZc1D83o+J+2L+lSdxH62+k3Tj+ke/s Um2TO1tSJlvETORcdaLwQ1b9pcZe8Wy/9j2d+/n6/j1ymD1HiaU4I9FQi7moOBEA2nmim44CA AA= X-Env-Sender: konrad.wilk@oracle.com X-Msg-Ref: server-13.tower-27.messagelabs.com!1491333032!86151813!1 X-Originating-IP: [156.151.31.81] X-SpamReason: No, hits=0.0 required=7.0 tests=sa_preprocessor: VHJ1c3RlZCBJUDogMTU2LjE1MS4zMS44MSA9PiAyODgzMzk=\n X-StarScan-Received: X-StarScan-Version: 9.2.3; banners=-,-,- X-VirusChecked: Checked Received: (qmail 42443 invoked from network); 4 Apr 2017 19:10:33 -0000 Received: from userp1040.oracle.com (HELO userp1040.oracle.com) (156.151.31.81) by server-13.tower-27.messagelabs.com with DHE-RSA-AES256-GCM-SHA384 encrypted SMTP; 4 Apr 2017 19:10:33 -0000 Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v34JAUiP021284 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 4 Apr 2017 19:10:30 GMT Received: from userv0121.oracle.com (userv0121.oracle.com [156.151.31.72]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v34JAU7w001099 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 4 Apr 2017 19:10:30 GMT Received: from abhmp0016.oracle.com (abhmp0016.oracle.com [141.146.116.22]) by userv0121.oracle.com (8.14.4/8.13.8) with ESMTP id v34JATnk003839; Tue, 4 Apr 2017 19:10:29 GMT Received: from x230.dumpdata.com.com (/10.154.163.250) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Tue, 04 Apr 2017 12:10:29 -0700 From: Konrad Rzeszutek Wilk To: xen-devel@lists.xenproject.org Date: Tue, 4 Apr 2017 15:10:15 -0400 Message-Id: <20170404191017.19584-4-konrad.wilk@oracle.com> X-Mailer: git-send-email 2.9.3 In-Reply-To: <20170404191017.19584-1-konrad.wilk@oracle.com> References: <20170404191017.19584-1-konrad.wilk@oracle.com> X-Source-IP: userv0022.oracle.com [156.151.31.74] Cc: wei.liu2@citrix.com, jbeulich@suse.com, Konrad Rzeszutek Wilk Subject: [Xen-devel] [PATCH v2 3/5] tmem: By default to join an shared pool it must be authorized. X-BeenThere: xen-devel@lists.xen.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" X-Virus-Scanned: ClamAV using ClamSMTP Having an off by default option allowing guests to join _any_ shared pool is not very secure. Lets eliminate tmem_shared_auth bootup option (which was disabled by default) and have the code force this by default. Signed-off-by: Konrad Rzeszutek Wilk --- docs/misc/tmem-internals.html | 6 ++---- docs/misc/xen-command-line.markdown | 3 --- xen/common/tmem.c | 4 ++-- xen/common/tmem_xen.c | 3 --- xen/include/xen/tmem_xen.h | 7 ------- 5 files changed, 4 insertions(+), 19 deletions(-) diff --git a/docs/misc/tmem-internals.html b/docs/misc/tmem-internals.html index 2d8635d..9b7e70e 100644 --- a/docs/misc/tmem-internals.html +++ b/docs/misc/tmem-internals.html @@ -715,11 +715,9 @@ Ocfs2 has only very limited security; it is assumed that anyone who can access the filesystem bits on the shared disk can mount the filesystem and use it. But in a virtualized data center, higher isolation requirements may apply. -As a result, a Xen boot option -- "tmem_shared_auth" -- was -added. The option defaults to disabled, -but when it is enabled, management tools must explicitly authenticate (or may +As a result, management tools must explicitly authenticate (or may explicitly deny) shared pool access to any client. -On Xen, this is done with the "xm +On Xen, this is done with the "xl tmem-shared-auth" command.

32-bit implementation. diff --git a/docs/misc/xen-command-line.markdown b/docs/misc/xen-command-line.markdown index 9eb85d6..9690512 100644 --- a/docs/misc/xen-command-line.markdown +++ b/docs/misc/xen-command-line.markdown @@ -1539,9 +1539,6 @@ pages) must also be specified via the tbuf\_size parameter. ### tmem\_compress > `= ` -### tmem\_shared\_auth -> `= ` - ### tsc > `= unstable | skewed | stable:socket` diff --git a/xen/common/tmem.c b/xen/common/tmem.c index 158d660..4f77a8c 100644 --- a/xen/common/tmem.c +++ b/xen/common/tmem.c @@ -846,7 +846,6 @@ struct client *client_create(domid_t cli_id) client->info.version = TMEM_SPEC_VERSION; client->info.maxpools = MAX_POOLS_PER_DOMAIN; client->info.flags.u.compress = tmem_compression_enabled(); - client->shared_auth_required = tmem_shared_auth(); for ( i = 0; i < MAX_GLOBAL_SHARED_POOLS; i++) client->shared_auth_uuid[i][0] = client->shared_auth_uuid[i][1] = -1L; @@ -1530,7 +1529,8 @@ int do_tmem_new_pool(domid_t this_cli_id, pool->shared = 0; goto out; } - if ( client->shared_auth_required && !tmem_global.shared_auth ) + /* By default only join domains that are authorized by admin. */ + if ( !tmem_global.shared_auth ) { for ( i = 0; i < MAX_GLOBAL_SHARED_POOLS; i++) if ( (client->shared_auth_uuid[i][0] == uuid_lo) && diff --git a/xen/common/tmem_xen.c b/xen/common/tmem_xen.c index 7d60b71..06ce3ef 100644 --- a/xen/common/tmem_xen.c +++ b/xen/common/tmem_xen.c @@ -20,9 +20,6 @@ boolean_param("tmem", opt_tmem); bool_t __read_mostly opt_tmem_compress = 0; boolean_param("tmem_compress", opt_tmem_compress); -bool_t __read_mostly opt_tmem_shared_auth = 0; -boolean_param("tmem_shared_auth", opt_tmem_shared_auth); - atomic_t freeable_page_count = ATOMIC_INIT(0); /* these are a concurrency bottleneck, could be percpu and dynamically diff --git a/xen/include/xen/tmem_xen.h b/xen/include/xen/tmem_xen.h index 70cc108..dc5888c 100644 --- a/xen/include/xen/tmem_xen.h +++ b/xen/include/xen/tmem_xen.h @@ -41,12 +41,6 @@ static inline bool_t tmem_compression_enabled(void) return opt_tmem_compress; } -extern bool_t opt_tmem_shared_auth; -static inline bool_t tmem_shared_auth(void) -{ - return opt_tmem_shared_auth; -} - #ifdef CONFIG_TMEM extern bool_t opt_tmem; static inline bool_t tmem_enabled(void) @@ -291,7 +285,6 @@ struct client { long eph_count, eph_count_max; domid_t cli_id; xen_tmem_client_t info; - bool_t shared_auth_required; /* For save/restore/migration. */ bool_t was_frozen; struct list_head persistent_invalidated_list;