From patchwork Tue May 31 14:56:45 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: "Daniel P. Smith" X-Patchwork-Id: 12865790 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id F13C2C433EF for ; Tue, 31 May 2022 14:58:56 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.339716.564613 (Exim 4.92) (envelope-from ) id 1nw3KW-0007wY-Ok; Tue, 31 May 2022 14:58:44 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 339716.564613; Tue, 31 May 2022 14:58:44 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nw3KW-0007wR-Ko; Tue, 31 May 2022 14:58:44 +0000 Received: by outflank-mailman (input) for mailman id 339716; Tue, 31 May 2022 14:58:43 +0000 Received: from se1-gles-flk1-in.inumbo.com ([94.247.172.50] helo=se1-gles-flk1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nw3KV-0007f3-3N for xen-devel@lists.xenproject.org; Tue, 31 May 2022 14:58:43 +0000 Received: from sender4-of-o51.zoho.com (sender4-of-o51.zoho.com [136.143.188.51]) by se1-gles-flk1.inumbo.com (Halon) with ESMTPS id 286a185d-e0f2-11ec-837f-e5687231ffcc; Tue, 31 May 2022 16:58:42 +0200 (CEST) Received: from sisyou.hme. (static-72-81-132-2.bltmmd.fios.verizon.net [72.81.132.2]) by mx.zohomail.com with SMTPS id 1654009111682798.9130906503007; Tue, 31 May 2022 07:58:31 -0700 (PDT) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 286a185d-e0f2-11ec-837f-e5687231ffcc ARC-Seal: i=1; a=rsa-sha256; t=1654009113; cv=none; d=zohomail.com; s=zohoarc; b=YUq6ctigvBfOFQocfDkaVCXnaCsiLGi1NtAIc08oHwJZN5sSNK/nW2q6IgijaY47jP2wnfFdGVuKkzcouR3XsR1D/qOvDNJ134RRsb8AgeCJL9dl/0eGuZnlRzLbPO6K8Fv5FFI9ic9hxNjr0uXinnOW4ysvMdCIqMo7WK1PV/8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1654009113; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:MIME-Version:Message-ID:References:Subject:To; bh=Ks2c7JaIJxWCU/pu9Stk/4/VXT5nNoOMHKXZhTnoHIc=; b=g4sug2uJ6cswralN2qgQpUzHr9VauB/nfv77m+ZscOsg3n9ZL0x/GIAMxsRX4TLX4Ley6hmOdaU3dlILoVjGXdzUFgbwk9OvzpnLZbRmci17+AEMCMuHdVAam1P++tp6MBHPlH3SClkf/Dpi7UQo1nlC4CwU1iyRA4MuY4Ioc1I= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=apertussolutions.com; spf=pass smtp.mailfrom=dpsmith@apertussolutions.com; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1654009113; s=zoho; d=apertussolutions.com; i=dpsmith@apertussolutions.com; h=From:From:To:To:Cc:Cc:Subject:Subject:Date:Date:Message-Id:Message-Id:In-Reply-To:References:MIME-Version:Content-Type:Content-Transfer-Encoding:Reply-To; bh=Ks2c7JaIJxWCU/pu9Stk/4/VXT5nNoOMHKXZhTnoHIc=; b=orLya5kkb1Ph0mqzCb0XVuJbq6h8GBoIGkiJq4t2MSrqZzRGbgOtSJm4fCymaYDA 3/9+ScLKRyi6deScCHPdvQ5bMvRa6wbMRYdlEa8CpM1T0zyMlLROqOJhIgvR71d6vJr UFfHhPGow4KCuhh1/W8YXIUZtFDf8e2WqlczYJ8w= From: "Daniel P. Smith" To: xen-devel@lists.xenproject.org, Volodymyr Babchuk , Wei Liu , "Daniel P. Smith" Cc: scott.davis@starlab.io, christopher.clark@starlab.io, jandryuk@gmail.com, Luca Fancellu , Julien Grall , Stefano Stabellini , Julien Grall , Bertrand Marquis , Jan Beulich , Andrew Cooper , =?utf-8?q?Roger_Pau_Monn=C3=A9?= , George Dunlap , Dario Faggioli , Daniel De Graaf Subject: [PATCH v8 1/2] xsm: create idle domain privileged and demote after setup Date: Tue, 31 May 2022 10:56:45 -0400 Message-Id: <20220531145646.10062-2-dpsmith@apertussolutions.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20220531145646.10062-1-dpsmith@apertussolutions.com> References: <20220531145646.10062-1-dpsmith@apertussolutions.com> MIME-Version: 1.0 X-ZohoMailClient: External There are new capabilities, dom0less and hyperlaunch, that introduce internal hypervisor logic, which needs to make resource allocation calls that are protected by XSM access checks. The need for these resource allocations are necessary for dom0less and hyperlaunch when they are constructing the initial domain(s).  This creates an issue as a subset of the hypervisor code is executed under a system domain, the idle domain, that is represented by a per-CPU non-privileged struct domain. To enable these new capabilities to function correctly but in a controlled manner, this commit changes the idle system domain to be created as a privileged domain under the default policy and demoted before transitioning to running. A new XSM hook, xsm_set_system_active(), is introduced to allow each XSM policy type to demote the idle domain appropriately for that policy type. In the case of SILO, it inherits the default policy's hook for xsm_set_system_active(). For flask, a stub is added to ensure that flask policy system will function correctly with this patch until flask is extended with support for starting the idle domain privileged and properly demoting it on the call to xsm_set_system_active(). Signed-off-by: Daniel P. Smith Reviewed-by: Jason Andryuk Reviewed-by: Luca Fancellu Acked-by: Julien Grall # arm --- xen/arch/arm/setup.c | 3 +++ xen/arch/x86/setup.c | 4 ++++ xen/common/sched/core.c | 7 ++++++- xen/include/xsm/dummy.h | 17 +++++++++++++++++ xen/include/xsm/xsm.h | 6 ++++++ xen/xsm/dummy.c | 1 + xen/xsm/flask/hooks.c | 23 +++++++++++++++++++++++ 7 files changed, 60 insertions(+), 1 deletion(-) diff --git a/xen/arch/arm/setup.c b/xen/arch/arm/setup.c index d5d0792ed4..6b88320588 100644 --- a/xen/arch/arm/setup.c +++ b/xen/arch/arm/setup.c @@ -1048,6 +1048,9 @@ void __init start_xen(unsigned long boot_phys_offset, /* Hide UART from DOM0 if we're using it */ serial_endboot(); + if ( (rc = xsm_set_system_active()) != 0 ) + panic("xsm: unable to switch to SYSTEM_ACTIVE privilege: %d\n", rc); + system_state = SYS_STATE_active; for_each_domain( d ) diff --git a/xen/arch/x86/setup.c b/xen/arch/x86/setup.c index 6f20e17892..962da03f80 100644 --- a/xen/arch/x86/setup.c +++ b/xen/arch/x86/setup.c @@ -620,6 +620,10 @@ static void noreturn init_done(void) { void *va; unsigned long start, end; + int err; + + if ( (err = xsm_set_system_active()) != 0 ) + panic("xsm: unable to switch to SYSTEM_ACTIVE privilege: %d\n", err); system_state = SYS_STATE_active; diff --git a/xen/common/sched/core.c b/xen/common/sched/core.c index 19ab678181..7b1c03a0e1 100644 --- a/xen/common/sched/core.c +++ b/xen/common/sched/core.c @@ -3021,7 +3021,12 @@ void __init scheduler_init(void) sched_ratelimit_us = SCHED_DEFAULT_RATELIMIT_US; } - idle_domain = domain_create(DOMID_IDLE, NULL, 0); + /* + * The idle dom is created privileged to ensure unrestricted access during + * setup and will be demoted by xsm_set_system_active() when setup is + * complete. + */ + idle_domain = domain_create(DOMID_IDLE, NULL, CDF_privileged); BUG_ON(IS_ERR(idle_domain)); BUG_ON(nr_cpu_ids > ARRAY_SIZE(idle_vcpu)); idle_domain->vcpu = idle_vcpu; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 58afc1d589..77f27e7163 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -101,6 +101,23 @@ static always_inline int xsm_default_action( } } +static XSM_INLINE int cf_check xsm_set_system_active(void) +{ + struct domain *d = current->domain; + + ASSERT(d->is_privileged); + + if ( d->domain_id != DOMID_IDLE ) + { + printk("%s: should only be called by idle domain\n", __func__); + return -EPERM; + } + + d->is_privileged = false; + + return 0; +} + static XSM_INLINE void cf_check xsm_security_domaininfo( struct domain *d, struct xen_domctl_getdomaininfo *info) { diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 3e2b7fe3db..8dad03fd3d 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -52,6 +52,7 @@ typedef enum xsm_default xsm_default_t; * !!! WARNING !!! */ struct xsm_ops { + int (*set_system_active)(void); void (*security_domaininfo)(struct domain *d, struct xen_domctl_getdomaininfo *info); int (*domain_create)(struct domain *d, uint32_t ssidref); @@ -208,6 +209,11 @@ extern struct xsm_ops xsm_ops; #ifndef XSM_NO_WRAPPERS +static inline int xsm_set_system_active(void) +{ + return alternative_call(xsm_ops.set_system_active); +} + static inline void xsm_security_domaininfo( struct domain *d, struct xen_domctl_getdomaininfo *info) { diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 8c044ef615..e6ffa948f7 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -14,6 +14,7 @@ #include static const struct xsm_ops __initconst_cf_clobber dummy_ops = { + .set_system_active = xsm_set_system_active, .security_domaininfo = xsm_security_domaininfo, .domain_create = xsm_domain_create, .getdomaininfo = xsm_getdomaininfo, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 0bf63ffa84..06ca4e7a91 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -186,6 +186,28 @@ static int cf_check flask_domain_alloc_security(struct domain *d) return 0; } +static int cf_check flask_set_system_active(void) +{ + struct domain *d = current->domain; + + ASSERT(d->is_privileged); + + if ( d->domain_id != DOMID_IDLE ) + { + printk("%s: should only be called by idle domain\n", __func__); + return -EPERM; + } + + /* + * While is_privileged has no significant meaning under flask, set to false + * as is_privileged is not only used for a privilege check but also as a + * type of domain check, specifically if the domain is the control domain. + */ + d->is_privileged = false; + + return 0; +} + static void cf_check flask_domain_free_security(struct domain *d) { struct domain_security_struct *dsec = d->ssid; @@ -1766,6 +1788,7 @@ static int cf_check flask_argo_send( #endif static const struct xsm_ops __initconst_cf_clobber flask_ops = { + .set_system_active = flask_set_system_active, .security_domaininfo = flask_security_domaininfo, .domain_create = flask_domain_create, .getdomaininfo = flask_getdomaininfo, From patchwork Tue May 31 14:56:46 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Daniel P. Smith" X-Patchwork-Id: 12865791 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 75723C433F5 for ; Tue, 31 May 2022 14:59:16 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.339723.564624 (Exim 4.92) (envelope-from ) id 1nw3Kt-00006i-0K; Tue, 31 May 2022 14:59:07 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 339723.564624; Tue, 31 May 2022 14:59:06 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nw3Ks-00006Z-Tr; Tue, 31 May 2022 14:59:06 +0000 Received: by outflank-mailman (input) for mailman id 339723; Tue, 31 May 2022 14:59:05 +0000 Received: from se1-gles-flk1-in.inumbo.com ([94.247.172.50] helo=se1-gles-flk1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nw3Kr-0007f3-At for xen-devel@lists.xenproject.org; Tue, 31 May 2022 14:59:05 +0000 Received: from sender4-of-o51.zoho.com (sender4-of-o51.zoho.com [136.143.188.51]) by se1-gles-flk1.inumbo.com (Halon) with ESMTPS id 35b550b0-e0f2-11ec-837f-e5687231ffcc; Tue, 31 May 2022 16:59:04 +0200 (CEST) Received: from sisyou.hme. (static-72-81-132-2.bltmmd.fios.verizon.net [72.81.132.2]) by mx.zohomail.com with SMTPS id 1654009113158416.5010936264822; Tue, 31 May 2022 07:58:33 -0700 (PDT) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 35b550b0-e0f2-11ec-837f-e5687231ffcc ARC-Seal: i=1; a=rsa-sha256; t=1654009114; cv=none; d=zohomail.com; s=zohoarc; b=mAS/dafHYoecO+N1XrQOYS22XWhJqSAsRX7rL+rLqDabsYjIpckQnfnCIkriRAzCtgQ6eCelxREijZcmSuC9KT773v9P9ET7NKn8F2qbcVTtTYFE1PKoHyTQUYuAQLJTwzjEGvu8t9V+KkgNHAHPLc+JGsHF8CNz8Ca+AzSHqys= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1654009114; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:MIME-Version:Message-ID:References:Subject:To; bh=R5XvVKen+sbJH8JNhyfJKLsT/ygvKCBUq2nmnlxg3h8=; b=n1KHXO0csx2a27N+7iHX2OHAbRScHqlMcc+kw8qGUloanZz1pzHMfuj5CR2NELZoJqxp+XMIA8nvIBigej0yP6HywLwBxSSxmMQFVeYhzQVGHVsb2GTYEYR7x3EAYv1zl5qcNLuaYkuwVg9+L1Qc1Rrre266vlgwpoixgQ5p+4o= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=apertussolutions.com; spf=pass smtp.mailfrom=dpsmith@apertussolutions.com; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1654009114; s=zoho; d=apertussolutions.com; i=dpsmith@apertussolutions.com; h=From:From:To:To:Cc:Cc:Subject:Subject:Date:Date:Message-Id:Message-Id:In-Reply-To:References:MIME-Version:Content-Transfer-Encoding:Reply-To; bh=R5XvVKen+sbJH8JNhyfJKLsT/ygvKCBUq2nmnlxg3h8=; b=mBqxSaYo/QxaK5jUTM1FXO6K/0JxrnSf6sGRDY8TfFHNph+phC+qc1pfb8Iefpwp 5uxk4ecwRGL3Pbf0zQSc4n1bjijaxHkh5a19/2lZWXFhBjwrF/+8YrZOPgBG+UgEHq1 NkQmXHZfSh4k+MltIeqvUBKrKV4V8j5/a8JojhHU= From: "Daniel P. Smith" To: xen-devel@lists.xenproject.org, "Daniel P. Smith" Cc: scott.davis@starlab.io, christopher.clark@starlab.io, jandryuk@gmail.com, Luca Fancellu , Daniel De Graaf , Wei Liu , Anthony PERARD Subject: [PATCH v8 2/2] flask: implement xsm_set_system_active Date: Tue, 31 May 2022 10:56:46 -0400 Message-Id: <20220531145646.10062-3-dpsmith@apertussolutions.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20220531145646.10062-1-dpsmith@apertussolutions.com> References: <20220531145646.10062-1-dpsmith@apertussolutions.com> MIME-Version: 1.0 X-ZohoMailClient: External This commit implements full support for starting the idle domain privileged by introducing a new flask label xenboot_t which the idle domain is labeled with at creation. It then provides the implementation for the XSM hook xsm_set_system_active to relabel the idle domain to the existing xen_t flask label. In the reference flask policy a new macro, xen_build_domain(target), is introduced for creating policies for dom0less/hyperlaunch allowing the hypervisor to create and assign the necessary resources for domain construction. Signed-off-by: Daniel P. Smith Reviewed-by: Jason Andryuk Reviewed-by: Luca Fancellu Tested-by: Luca Fancellu --- tools/flask/policy/modules/xen.if | 6 ++++++ tools/flask/policy/modules/xen.te | 1 + tools/flask/policy/policy/initial_sids | 1 + xen/xsm/flask/hooks.c | 9 ++++++++- xen/xsm/flask/policy/initial_sids | 1 + 5 files changed, 17 insertions(+), 1 deletion(-) diff --git a/tools/flask/policy/modules/xen.if b/tools/flask/policy/modules/xen.if index 5e2aa472b6..4ec676fff1 100644 --- a/tools/flask/policy/modules/xen.if +++ b/tools/flask/policy/modules/xen.if @@ -62,6 +62,12 @@ define(`create_domain_common', ` setparam altp2mhvm altp2mhvm_op dm }; ') +# xen_build_domain(target) +# Allow a domain to be created at boot by the hypervisor +define(`xen_build_domain', ` + allow xenboot_t $1_channel:event create; +') + # create_domain(priv, target) # Allow a domain to be created directly define(`create_domain', ` diff --git a/tools/flask/policy/modules/xen.te b/tools/flask/policy/modules/xen.te index 3dbf93d2b8..de98206fdd 100644 --- a/tools/flask/policy/modules/xen.te +++ b/tools/flask/policy/modules/xen.te @@ -24,6 +24,7 @@ attribute mls_priv; ################################################################################ # The hypervisor itself +type xenboot_t, xen_type, mls_priv; type xen_t, xen_type, mls_priv; # Domain 0 diff --git a/tools/flask/policy/policy/initial_sids b/tools/flask/policy/policy/initial_sids index 6b7b7eff21..ec729d3ba3 100644 --- a/tools/flask/policy/policy/initial_sids +++ b/tools/flask/policy/policy/initial_sids @@ -2,6 +2,7 @@ # objects created before the policy is loaded or for objects that do not have a # label defined in some other manner. +sid xenboot gen_context(system_u:system_r:xenboot_t,s0) sid xen gen_context(system_u:system_r:xen_t,s0) sid dom0 gen_context(system_u:system_r:dom0_t,s0) sid domxen gen_context(system_u:system_r:domxen_t,s0) diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 06ca4e7a91..96f8167deb 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -168,7 +168,7 @@ static int cf_check flask_domain_alloc_security(struct domain *d) switch ( d->domain_id ) { case DOMID_IDLE: - dsec->sid = SECINITSID_XEN; + dsec->sid = SECINITSID_XENBOOT; break; case DOMID_XEN: dsec->sid = SECINITSID_DOMXEN; @@ -188,9 +188,14 @@ static int cf_check flask_domain_alloc_security(struct domain *d) static int cf_check flask_set_system_active(void) { + struct domain_security_struct *dsec; struct domain *d = current->domain; + dsec = d->ssid; + ASSERT(d->is_privileged); + ASSERT(dsec->sid == SECINITSID_XENBOOT); + ASSERT(dsec->self_sid == SECINITSID_XENBOOT); if ( d->domain_id != DOMID_IDLE ) { @@ -205,6 +210,8 @@ static int cf_check flask_set_system_active(void) */ d->is_privileged = false; + dsec->self_sid = dsec->sid = SECINITSID_XEN; + return 0; } diff --git a/xen/xsm/flask/policy/initial_sids b/xen/xsm/flask/policy/initial_sids index 7eca70d339..e8b55b8368 100644 --- a/xen/xsm/flask/policy/initial_sids +++ b/xen/xsm/flask/policy/initial_sids @@ -3,6 +3,7 @@ # # Define initial security identifiers # +sid xenboot sid xen sid dom0 sid domio