Re: [Xen-devel] [PATCH V13 3/7] xen/arm: Allow hypervisor access to mem_access protected pages

[Tamas K Lengyel <tklengyel@xxxxxxxxxxxxx>]

On Thu, Mar 12, 2015 at 4:56 PM, Ian Campbell <ian.campbell@xxxxxxxxxx> wrote:

On Thu, 2015-03-12 at 16:44 +0100, Tamas K Lengyel wrote:
>
>
> On Thu, Mar 12, 2015 at 4:40 PM, Julien Grall
> <julien.grall@xxxxxxxxxx> wrote:
>Â Â Â Â ÂHi Ian,
>
>Â Â Â Â ÂOn 12/03/15 15:27, Ian Campbell wrote:
>Â Â Â Â Â>> Currently, check_type_get_page emulate only the check for
>Â Â Â Â Â2). So you may
>Â Â Â Â Â>> end up to allow Xen writing in read-only mapping (from the
>Â Â Â Â ÂStage 1 POV).
>Â Â Â Â Â>> This was XSA-98.
>Â Â Â Â Â>
>Â Â Â Â Â> XSA-98 was purely about stage-2 permissions (e.g. read-only
>Â Â Â Â Âgrants). The
>Â Â Â Â Â> fact that the resulting patch also checks stage-1
>Â Â Â Â Âpermissions is not a
>Â Â Â Â Â> security property AFAICT.
>
>Â Â Â Â ÂXSA-98 was for both... Without checking stage-1 permission a
>Â Â Â Â Âuserspace
>Â Â Â Â Âwhich can issue an hypercall may be able to write into
>Â Â Â Â Âread-only kernel
>Â Â Â Â Âspace. Whoops.
>
>
> Userspace is able to issue hypercall?

Via ioctls on /proc/xen/privcmd, yes. It's how the toolstack talks to
Xen...

Well, that is not the userspace issuing the hypercall, its a kernel module issuing the hypercall on behalf of a process ;)

Tamas

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel