Received: by 2002:a25:1506:0:0:0:0:0 with SMTP id 6csp3029654ybv; Sun, 9 Feb 2020 13:29:15 -0800 (PST) X-Google-Smtp-Source: APXvYqzTr7IlqH8fG8egPxKfQ/Nzth5JpPpcrSgZmDy1zJqRRW1k0IOPWvY4gACtd0Y0Qi4dbdta X-Received: by 2002:a9d:7b50:: with SMTP id f16mr8085118oto.18.1581283754961; Sun, 09 Feb 2020 13:29:14 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1581283754; cv=none; d=google.com; s=arc-20160816; b=BolkljWsQgRej7MsrrChlLR4IaX7EogocgW9I523yyXNHSKbsn2pNTrjcAJLtFu6f0 TcxoXLK2W2M1+7gb1XZXMRqifZ/5udKyX82o+5gnnsMIrd4+ySuc1WBRvRskolqjUVW3 pMT0u0tN5meJvnqMBrYBrVix9Zs9a9uzu9cJxaf/rOv2mXHlj3KoHduDFcmDX65S8xCt IXj1mupVVVkKTW8tpOBGytBR3H8ccWIBynKEQW0A2Vwbn1Y5uFMxR26Piz7GirCpDhcL tRqmK9HYKaHXHCLQU6quffjz7PXB1t/MZgttibdc+eQx7EXhH4LAaa0CMuAxQ5SAyxC2 4xHQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from; bh=SQ4YYl+SXG3IuT5KCVKrvuX/i8RTfz6YA4Pz5bnT6HA=; b=ns61ED9FA4yT0Jz29kLS028ocoO5eN/rx9S224jMPyECeRTObamwAxSBImgerYMvA3 un1ERFpWVpAGUAK5zxnrgfJp5o4NXRD/WOx1wp9lopx2OMgCJsd/I9/CK26TJ949m4fh mTmMpyy2A3ZHK9IrmMWMe24yZNjkKJmTPG5nVyHU/QbQwmfF6E+HrDolb+Iq2jMHqoR3 4Q7eeaNeXDfePKXfpQD0D8Ef8BCFIKwAJ4Q/yIPA5vehvti3fPE+OJY8VRAqOMK45gBF shvm0UC/rKdq6I+7X6scPEzCtJ3j2ornb+YsiTWVbTMGs+pzrtR27nMr5J+tlNB3UYZS 2ALg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=intel.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id 65si8039136oif.14.2020.02.09.13.29.03; Sun, 09 Feb 2020 13:29:14 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728108AbgBIV1h (ORCPT + 99 others); Sun, 9 Feb 2020 16:27:37 -0500 Received: from mga04.intel.com ([192.55.52.120]:34864 "EHLO mga04.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727892AbgBIV1h (ORCPT ); Sun, 9 Feb 2020 16:27:37 -0500 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga005.jf.intel.com ([10.7.209.41]) by fmsmga104.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 09 Feb 2020 13:27:36 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.70,422,1574150400"; d="scan'208";a="405398862" Received: from jradtke-mobl1.ger.corp.intel.com (HELO localhost) ([10.252.22.75]) by orsmga005.jf.intel.com with ESMTP; 09 Feb 2020 13:27:31 -0800 From: Jarkko Sakkinen To: linux-kernel@vger.kernel.org, x86@kernel.org, linux-sgx@vger.kernel.org Cc: akpm@linux-foundation.org, dave.hansen@intel.com, sean.j.christopherson@intel.com, nhorman@redhat.com, npmccallum@redhat.com, haitao.huang@intel.com, andriy.shevchenko@linux.intel.com, tglx@linutronix.de, kai.svahn@intel.com, bp@alien8.de, josh@joshtriplett.org, luto@kernel.org, kai.huang@intel.com, rientjes@google.com, cedric.xing@intel.com, puiterwijk@redhat.com, Jarkko Sakkinen , linux-security-module@vger.kernel.org Subject: [PATCH v26 13/22] x86/sgx: Add provisioning Date: Sun, 9 Feb 2020 23:26:00 +0200 Message-Id: <20200209212609.7928-14-jarkko.sakkinen@linux.intel.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200209212609.7928-1-jarkko.sakkinen@linux.intel.com> References: <20200209212609.7928-1-jarkko.sakkinen@linux.intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=a Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org In order to provide a mechanism for devilering provisoning rights: 1. Add a new device file /dev/sgx/provision that works as a token for allowing an enclave to have the provisioning privileges. 2. Add a new ioctl called SGX_IOC_ENCLAVE_SET_ATTRIBUTE that accepts the following data structure: struct sgx_enclave_set_attribute { __u64 addr; __u64 attribute_fd; }; A daemon could sit on top of /dev/sgx/provision and send a file descriptor of this file to a process that needs to be able to provision enclaves. The way this API is used is straight-forward. Lets assume that dev_fd is a handle to /dev/sgx/enclave and prov_fd is a handle to /dev/sgx/provision. You would allow SGX_IOC_ENCLAVE_CREATE to initialize an enclave with the PROVISIONKEY attribute by params.addr = ; params.token_fd = prov_fd; ioctl(dev_fd, SGX_IOC_ENCLAVE_SET_ATTRIBUTE, ¶ms); Cc: linux-security-module@vger.kernel.org Suggested-by: Andy Lutomirski Signed-off-by: Jarkko Sakkinen --- arch/x86/include/uapi/asm/sgx.h | 11 ++++++++ arch/x86/kernel/cpu/sgx/driver.c | 14 ++++++++++ arch/x86/kernel/cpu/sgx/driver.h | 2 ++ arch/x86/kernel/cpu/sgx/ioctl.c | 47 ++++++++++++++++++++++++++++++++ 4 files changed, 74 insertions(+) diff --git a/arch/x86/include/uapi/asm/sgx.h b/arch/x86/include/uapi/asm/sgx.h index 5edb08ab8fd0..57d0d30c79b3 100644 --- a/arch/x86/include/uapi/asm/sgx.h +++ b/arch/x86/include/uapi/asm/sgx.h @@ -25,6 +25,8 @@ enum sgx_page_flags { _IOWR(SGX_MAGIC, 0x01, struct sgx_enclave_add_pages) #define SGX_IOC_ENCLAVE_INIT \ _IOW(SGX_MAGIC, 0x02, struct sgx_enclave_init) +#define SGX_IOC_ENCLAVE_SET_ATTRIBUTE \ + _IOW(SGX_MAGIC, 0x03, struct sgx_enclave_set_attribute) /** * struct sgx_enclave_create - parameter structure for the @@ -63,4 +65,13 @@ struct sgx_enclave_init { __u64 sigstruct; }; +/** + * struct sgx_enclave_set_attribute - parameter structure for the + * %SGX_IOC_ENCLAVE_SET_ATTRIBUTE ioctl + * @attribute_fd: file handle of the attribute file in the securityfs + */ +struct sgx_enclave_set_attribute { + __u64 attribute_fd; +}; + #endif /* _UAPI_ASM_X86_SGX_H */ diff --git a/arch/x86/kernel/cpu/sgx/driver.c b/arch/x86/kernel/cpu/sgx/driver.c index b4aa7b9f8376..d90114cec1c3 100644 --- a/arch/x86/kernel/cpu/sgx/driver.c +++ b/arch/x86/kernel/cpu/sgx/driver.c @@ -150,6 +150,13 @@ static struct miscdevice sgx_dev_enclave = { .fops = &sgx_encl_fops, }; +static struct miscdevice sgx_dev_provision = { + .minor = MISC_DYNAMIC_MINOR, + .name = "provision", + .nodename = "sgx/provision", + .fops = &sgx_provision_fops, +}; + int __init sgx_drv_init(void) { unsigned int eax, ebx, ecx, edx; @@ -190,5 +197,12 @@ int __init sgx_drv_init(void) return ret; } + ret = misc_register(&sgx_dev_provision); + if (ret) { + pr_err("Creating /dev/sgx/provision failed with %d.\n", ret); + misc_deregister(&sgx_dev_enclave); + return ret; + } + return 0; } diff --git a/arch/x86/kernel/cpu/sgx/driver.h b/arch/x86/kernel/cpu/sgx/driver.h index e4063923115b..72747d01c046 100644 --- a/arch/x86/kernel/cpu/sgx/driver.h +++ b/arch/x86/kernel/cpu/sgx/driver.h @@ -23,6 +23,8 @@ extern u64 sgx_attributes_reserved_mask; extern u64 sgx_xfrm_reserved_mask; extern u32 sgx_xsave_size_tbl[64]; +extern const struct file_operations sgx_provision_fops; + long sgx_ioctl(struct file *filep, unsigned int cmd, unsigned long arg); int sgx_drv_init(void); diff --git a/arch/x86/kernel/cpu/sgx/ioctl.c b/arch/x86/kernel/cpu/sgx/ioctl.c index 83513cdfd1c0..262001df3ae4 100644 --- a/arch/x86/kernel/cpu/sgx/ioctl.c +++ b/arch/x86/kernel/cpu/sgx/ioctl.c @@ -663,6 +663,50 @@ static long sgx_ioc_enclave_init(struct sgx_encl *encl, void __user *arg) return ret; } +/** + * sgx_ioc_enclave_set_attribute - handler for %SGX_IOC_ENCLAVE_SET_ATTRIBUTE + * @filep: open file to /dev/sgx + * @arg: userspace pointer to a struct sgx_enclave_set_attribute instance + * + * Mark the enclave as being allowed to access a restricted attribute bit. + * The requested attribute is specified via the attribute_fd field in the + * provided struct sgx_enclave_set_attribute. The attribute_fd must be a + * handle to an SGX attribute file, e.g. “/dev/sgx/provision". + * + * Failure to explicitly request access to a restricted attribute will cause + * sgx_ioc_enclave_init() to fail. Currently, the only restricted attribute + * is access to the PROVISION_KEY. + * + * Note, access to the EINITTOKEN_KEY is disallowed entirely. + * + * Return: 0 on success, -errno otherwise + */ +static long sgx_ioc_enclave_set_attribute(struct sgx_encl *encl, + void __user *arg) +{ + struct sgx_enclave_set_attribute params; + struct file *attribute_file; + int ret; + + if (copy_from_user(¶ms, arg, sizeof(params))) + return -EFAULT; + + attribute_file = fget(params.attribute_fd); + if (!attribute_file) + return -EINVAL; + + if (attribute_file->f_op != &sgx_provision_fops) { + ret = -EINVAL; + goto out; + } + + encl->allowed_attributes |= SGX_ATTR_PROVISIONKEY; + ret = 0; + +out: + fput(attribute_file); + return ret; +} long sgx_ioctl(struct file *filep, unsigned int cmd, unsigned long arg) { @@ -686,6 +730,9 @@ long sgx_ioctl(struct file *filep, unsigned int cmd, unsigned long arg) case SGX_IOC_ENCLAVE_INIT: ret = sgx_ioc_enclave_init(encl, (void __user *)arg); break; + case SGX_IOC_ENCLAVE_SET_ATTRIBUTE: + ret = sgx_ioc_enclave_set_attribute(encl, (void __user *)arg); + break; default: ret = -ENOIOCTLCMD; break; -- 2.20.1