Received: by 2002:a25:4158:0:0:0:0:0 with SMTP id o85csp2230691yba; Fri, 17 May 2019 12:58:26 -0700 (PDT) X-Google-Smtp-Source: APXvYqzvnqPeXZljfx39lJnT2BMlfNS4xrhq/rIEUwHBJqNAiMJXUd8AHa01w7lqrQ0gQGDfWIfE X-Received: by 2002:a65:4144:: with SMTP id x4mr227108pgp.282.1558123105921; Fri, 17 May 2019 12:58:25 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1558123105; cv=none; d=google.com; s=arc-20160816; b=04vo1eiwUvrvBqf6DBQ2JoHkGoBm9qXwXsD5ck8iE2YG/dfVK2HEay2tayDrIgIAVv 0O8yf57ahjCfQF4m0lHSLF51oUdaFREjkdHeynE+4HKBpjEcvjVhEOy07mVu2WIF4Qfc E0to3RVog8axczg13/UjeBgCS6zwQ+QVaaoPj2NBQFLOrWbiVWucWmAGt06MO242N+rF 1nPa2x5jCoqERV6pFA9bPF15i8Kv0iGTOta9I0jsbv//9cvSfM/re8kkDH9OGi0Gmy/z AaV1BakwkiUajDDmI8pPn8n2zs7JZl84F916nsgkF4T4iyayhPOtDGz81uTn6rKhg/bO HPdg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:user-agent:in-reply-to :content-disposition:mime-version:references:message-id:subject:cc :to:from:date; bh=/Au5C/IC6a76zp6MLWDgQfO8u/LOiIgmuECLWodpJD0=; b=CxB+jMP1I5o2MJX8FHCzp6AD0+maMcHnH0sFcVfqZhol6kKF3IZSpQGkPBK9t3+EPH 3vrpI8uUtjZkqwNss+/n2d907luul8eArPh5Nr/6AedHysyjWS43sAXCVaPcX5rvMTMZ BTPIZiw9PbTtXiGqRamkV0pjD6eM4xKSKKmD6InXs5KiYaSA3UliPDcyMfQAm8VWc1wd rQleh5oWYiisgk6I8VXJW/vjy2BpK6krwDM8TXMR8o4YhNdXUk6KfRTjLHXWY6aX7r0b 08GaStlrAE0vPlq7X6KPoScLH18ivSuvRsZlbWjSBdaaA0/r+2PtNRssVN2xD4rdASrt T9hg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=intel.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id s207si688356pfs.119.2019.05.17.12.58.11; Fri, 17 May 2019 12:58:25 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729235AbfEQSV0 (ORCPT + 99 others); Fri, 17 May 2019 14:21:26 -0400 Received: from mga14.intel.com ([192.55.52.115]:19131 "EHLO mga14.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726295AbfEQSV0 (ORCPT ); Fri, 17 May 2019 14:21:26 -0400 X-Amp-Result: UNKNOWN X-Amp-Original-Verdict: FILE UNKNOWN X-Amp-File-Uploaded: False Received: from orsmga005.jf.intel.com ([10.7.209.41]) by fmsmga103.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 17 May 2019 11:21:25 -0700 X-ExtLoop1: 1 Received: from sjchrist-coffee.jf.intel.com (HELO linux.intel.com) ([10.54.74.36]) by orsmga005.jf.intel.com with ESMTP; 17 May 2019 11:21:24 -0700 Date: Fri, 17 May 2019 11:21:24 -0700 From: Sean Christopherson To: Linus Torvalds Cc: Andy Lutomirski , Stephen Smalley , "Xing, Cedric" , Andy Lutomirski , James Morris , "Serge E. Hallyn" , LSM List , Paul Moore , Eric Paris , "selinux@vger.kernel.org" , Jarkko Sakkinen , Jethro Beekman , "Hansen, Dave" , Thomas Gleixner , "Dr. Greg" , LKML , X86 ML , "linux-sgx@vger.kernel.org" , Andrew Morton , "nhorman@redhat.com" , "npmccallum@redhat.com" , "Ayoun, Serge" , "Katz-zamir, Shay" , "Huang, Haitao" , Andy Shevchenko , "Svahn, Kai" , Borislav Petkov , Josh Triplett , "Huang, Kai" , David Rientjes Subject: Re: SGX vs LSM (Re: [PATCH v20 00/28] Intel SGX1 support) Message-ID: <20190517182124.GF15006@linux.intel.com> References: <960B34DE67B9E140824F1DCDEC400C0F654E3FB9@ORSMSX116.amr.corp.intel.com> <6a97c099-2f42-672e-a258-95bc09152363@tycho.nsa.gov> <20190517150948.GA15632@linux.intel.com> <80013cca-f1c2-f4d5-7558-8f4e752ada76@tycho.nsa.gov> <20190517172953.GC15006@linux.intel.com> <20190517175500.GE15006@linux.intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.24 (2015-08-30) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, May 17, 2019 at 11:04:22AM -0700, Linus Torvalds wrote: > On Fri, May 17, 2019 at 10:55 AM Sean Christopherson > wrote: > > > > In this snippet, IS_PRIVATE() is true for anon inodes, false for > > /dev/sgx/enclave. Because EPC memory is always shared, SELinux will never > > check PROCESS__EXECMEM for mprotect() on/dev/sgx/enclave. > > Why _does_ the memory have to be shared? Shared mmap() is > fundamentally less secure than private mmap, since by definition it > means "oh, somebody else has access to it too and might modify it > under us". > > Why does the SGX logic care about things like that? Normal executables > are just private mappings of an underlying file, I'm not sure why the > SGX interface has to have that shared thing, and why the interface has > to have a device node in the first place when you have system calls > for setup anyway. > > So why don't the system calls just work on perfectly normal anonymous > mmap's? Why a device node, and why must it be shared to begin with? I agree that conceptually EPC is private memory, but because EPC is managed as a separate memory pool, SGX tags it VM_PFNMAP and manually inserts PFNs, i.e. EPC effectively it gets classified as IO memory. And vmf_insert_pfn_prot() doesn't like writable private IO mappings: BUG_ON((vma->vm_flags & VM_PFNMAP) && is_cow_mapping(vma->vm_flags));