kernel enforcement of vbd policies via blkback driver
PATCH 1/1 kernel enforcement of vbd policies via blkback driver
This patch modifies the blkback driver to perform a security check (via an ACM get_decision hypercall) before connecting a vbd to a domain. While the security checks performed in the xm tools are convenient for the users, the check added here is intended to strengthen the security guarantees.
Note that the security check in blkback is only enabled when ACM_SECURITY=y in Config.mk.
--- Makefile | 4 + linux-2.6-xen-sparse/arch/i386/Makefile | 1 linux-2.6-xen-sparse/arch/ia64/Makefile | 1 linux-2.6-xen-sparse/arch/x86_64/Makefile | 1 linux-2.6-xen-sparse/drivers/xen/blkback/Makefile | 1 linux-2.6-xen-sparse/drivers/xen/blkback/acm.c | 83 ++++++++++++++++++++++ linux-2.6-xen-sparse/drivers/xen/blkback/acm.h | 59 +++++++++++++++ linux-2.6-xen-sparse/drivers/xen/blkback/common.h | 3 linux-2.6-xen-sparse/drivers/xen/blkback/vbd.c | 11 ++ linux-2.6-xen-sparse/drivers/xen/blkback/xenbus.c | 6 + 10 files changed, 167 insertions(+), 3 deletions(-)
Makefile +4 -0
@@ -25,6 +25,10 @@ ifeq ($(XEN_TARGET_X86_PAE),y) export pae=y endif +ifeq ($(ACM_SECURITY),y) +export ACM_SECURITY=y +endif + # build and install everything into the standard system directories .PHONY: install install: install-xen install-kernels install-tools install-docs
linux-2.6-xen-sparse/arch/i386/Makefile +1 -0
@@ -47,6 +47,7 @@ CFLAGS += $(cflags-y) cppflags-$(CONFIG_XEN) += \ -D__XEN_INTERFACE_VERSION__=$(CONFIG_XEN_INTERFACE_VERSION) +cppflags-$(ACM_SECURITY) += -DACM_SECURITY CPPFLAGS += $(cppflags-y)
linux-2.6-xen-sparse/arch/ia64/Makefile +1 -0
@@ -45,6 +45,7 @@ CFLAGS += $(cflags-y) cppflags-$(CONFIG_XEN) += \ -D__XEN_INTERFACE_VERSION__=$(CONFIG_XEN_INTERFACE_VERSION) +cppflags-$(ACM_SECURITY) += -DACM_SECURITY CPPFLAGS += $(cppflags-y)
linux-2.6-xen-sparse/arch/x86_64/Makefile +1 -0
@@ -33,6 +33,7 @@ CFLAGS += $(cflags-y) cppflags-$(CONFIG_XEN) += \ -D__XEN_INTERFACE_VERSION__=$(CONFIG_XEN_INTERFACE_VERSION) +cppflags-$(ACM_SECURITY) += -DACM_SECURITY CPPFLAGS += $(cppflags-y) CFLAGS += -m64
linux-2.6-xen-sparse/drivers/xen/blkback/Makefile +1 -0
@@ -1,3 +1,4 @@ obj-$(CONFIG_XEN_BLKDEV_BACKEND) := blkbk.o blkbk-y := blkback.o xenbus.o interface.o vbd.o +blkbk-$(ACM_SECURITY) += acm.o
linux-2.6-xen-sparse/drivers/xen/blkback/acm.c new file +83 -0
83 lines not on this page · raw message
linux-2.6-xen-sparse/drivers/xen/blkback/acm.h new file +59 -0
59 lines not on this page · raw message
linux-2.6-xen-sparse/drivers/xen/blkback/common.h +2 -1
@@ -40,6 +40,7 @@#include <asm/pgalloc.h> #include <xen/evtchn.h> #include <asm/hypervisor.h> +#include <xen/interface/acm.h> #include <xen/interface/io/blkif.h> #include <xen/interface/io/ring.h> #include <xen/gnttab.h>
@@ -108,7 +109,7 @@ int blkif_map(blkif_t *blkif, unsigned l/* Create a vbd. */ int vbd_create (blkif_t *blkif,blkif_vdev_t vdevice,unsigned major, -unsigned minor,int readonly); +unsigned minor,ssidref_t acm_ssidref,int readonly);void vbd_free (struct vbd *vbd);unsigned long vbd_size (struct vbd *vbd);
linux-2.6-xen-sparse/drivers/xen/blkback/vbd.c +10 -1
@@ -31,6 +31,7 @@*/ #include "common.h" +#include "acm.h" #include <xen/xenbus.h> #define vbd_sz (_v) ((_v)->bdev->bd_part ? \
@@ -52,10 +53,11 @@ unsigned long vbd_secsize(struct vbd *vb }int vbd_create (blkif_t *blkif,blkif_vdev_t handle,unsigned major, -unsigned minor,int readonly) +unsigned minor,ssidref_t acm_ssidref,int readonly) {struct vbd *vbd;struct block_device *bdev; +int allowed; vbd = &blkif->vbd; vbd->handle = handle;
@@ -64,6 +66,13 @@ int vbd_create(blkif_t *blkif, blkif_vde vbd->pdevice =MKDEV (major, minor); + allowed =acm_vbd_allowed (blkif->domid, acm_ssidref); +if (!allowed){ +DPRINTK ("vbd_create: ACM security denied for device %08x.\n" , + vbd->pdevice); +return -ENOENT ; + } + bdev =open_by_devnum (vbd->pdevice, vbd->readonly ?FMODE_READ :FMODE_WRITE );
linux-2.6-xen-sparse/drivers/xen/blkback/xenbus.c +5 -1
@@ -22,6 +22,7 @@#include <linux/kthread.h> #include <xen/xenbus.h> #include "common.h" +#include "acm.h" #undef DPRINTK #define DPRINTK(fmt, args...) \
@@ -225,6 +226,7 @@ static void backend_changed(struct xenbuint err;unsigned major;unsigned minor; +ssidref_t acm_ssidref;struct backend_info *be = container_of(watch, struct backend_info, backend_watch);struct xenbus_device *dev = be->dev;
@@ -261,6 +263,8 @@ static void backend_changed(struct xenbureturn ; } +acm_get_ssidref (dev, &acm_ssidref); +if (be->major ==0 && be->minor ==0 ) {/* Front end dir is a number, which is used as the handle. */
@@ -270,7 +274,7 @@ static void backend_changed(struct xenbu be->major = major; be->minor = minor; - err =vbd_create (be->blkif, handle, major, minor, + err =vbd_create (be->blkif, handle, major, minor, acm_ssidref, (NULL ==strchr (be->mode,'w' )));if (err) { be->major = be->minor =0 ;
_______________________________________________
Xen-devel mailing list
[email protected]
http://lists.xensource.com/xen-devel
Quoted 6 lines · Bryan D. Payne
This patch modifies the blkback driver to perform a security check (via an ACM
get_decisionhypercall) before connecting a vbd to a domain. While the security checks performed in the xm tools are convenient for the users, the check added here is intended to strengthen the security guarantees.Note that the security check in blkback is only enabled when ACM_SECURITY=y in Config.mk.
Signed-off-by Bryan D. Payne <[email protected]>Signed-off-by Reiner Sailer <[email protected]>
Wouldn't this be better checked in the tool stack, rather than the particular block device driver (which is as likely to be blktap as blkback in future -- control tools would provide a point of common infrastructure to make this check, regardless of choice of actual backend driver)?
-- Keir
Quoted 5 lines
Wouldn't this be better checked in the tool stack, rather than the particular block device driver (which is as likely to be blktap as blkback in future -- control tools would provide a point of common infrastructure to make this check, regardless of choice of actual backend driver)?
We decided to perform the check at this level based on the philosophy that enforcement is most secure when it occurs closest to the point of access. The code path from the xm tools to the point of access for a vbd is substantial. Most notably, data travels through the XenStore, where the backend driver obtains the information used to connect the vbd to a domain. If the only enforcement was in xm tools, then any other process could add data to the XenStore, effectively bypassing the security enforcement.
You probably noticed that our previous patch to xm tools also performs this security check. The motivation for performing the check at the xm tools level is to provide meaningful feedback to users. If we didn't perform the check at the xm tools level, the user would only notice that the vbd failed to connect and would have to look into /var/log/messages to discover the reason. This is because it is hard to pass an error condition (e.g., access denied) from the backend driver to the xm tools.
For these reasons, we feel that it is most appropriate to perform the check in xm tools *and* at the point of access. If you envision users using blktap to replace blkback, then I believe that we should add similar hooks to blktap.
-bryan