This functionality is still quite imperfect, but it will be useful in certain restricted use cases.
Signed-off-by: Ian Jackson <ian.jack...@eu.citrix.com> --- docs/man/xl.cfg.pod.5.in | 86 +++++++++++++++++++++++++++++++++++++++++++++ tools/libxl/libxl_create.c | 1 + tools/libxl/libxl_dm.c | 9 +++++ tools/libxl/libxl_types.idl | 1 + tools/xl/xl_parse.c | 3 ++ 5 files changed, 100 insertions(+) diff --git a/docs/man/xl.cfg.pod.5.in b/docs/man/xl.cfg.pod.5.in index 79cb2ea..e3a73bc 100644 --- a/docs/man/xl.cfg.pod.5.in +++ b/docs/man/xl.cfg.pod.5.in @@ -2045,6 +2045,92 @@ specified, enabling the use of XenServer PV drivers in the guest. This parameter only takes effect when device_model_version=qemu-xen. See B<xen-pci-device-reservations(7)> for more information. +=item B<dm_restrict=BOOLEAN> + +Restrict the HVM device model after startup, +to limit the consequencese of security vulnerabilities in qemu. + +With this feature enabled, +a compromise of the device model, +via such a vulnerability, +will not provide a privilege escalation attack on the whole system. + +This feature is a B<technology preview>. +There are some significant limitations: + +=over 4 + +=item + +You must have a new enough qemu. +In particular, +if your qemu does not have the commit +B<xen: restrict: use xentoolcore_restrict_all> +the restriction request will be silently ineffective! + +=item + +The mechanisms used are not effective against +denial of service problems. +A compromised qemu can probably still impair +or perhaps even prevent +the proper functioning of the whole system, +(at the very least, but not limited to, +through resource exhaustion). + +=item + +It is not known whether the protection is +effective when a domain is migrated. + +=item + +Some domain management functions do not work. +For example, cdrom insert will fail. + +=item + +You must create user(s) for qemu to run as. +Currently, you should either create +B<xen-qemuuser-domid$domid> +for every $domid from 1 to 32751 inclusive, +or +B<xen-qemuuser-shared> +(in which case different guests will not +be protected against each other). +And if you do not create the user, +the restriction request will be silently ineffective! + +=item + +There are no countermeasures taken against reuse +of the same unix user (uid) +for subsequent domains, +even if the B<xen-qemuuser-domid$domid> users are created. +So a past domain with the same domid may be able to +interferer with future domains. +Possibly, even after a reboot. + +=item + +A compromised qemu will be able to read world-readable +files in the dom0 operating system. + +=item + +Because of these limitations, this functionality, +while it may enhance your security, +should not be relied on. +Any further limitations discovered in the current version +will B<not> be handled via the Xen Project Security Process. + +=item + +In the future as we enhance this feature to improve the security, +we may break backward compatibility. + +=back + =back =head2 Device-Model Options diff --git a/tools/libxl/libxl_create.c b/tools/libxl/libxl_create.c index 9123585..c757651 100644 --- a/tools/libxl/libxl_create.c +++ b/tools/libxl/libxl_create.c @@ -322,6 +322,7 @@ int libxl__domain_build_info_setdefault(libxl__gc *gc, libxl_defbool_setdefault(&b_info->u.hvm.altp2m, false); libxl_defbool_setdefault(&b_info->u.hvm.usb, false); libxl_defbool_setdefault(&b_info->u.hvm.xen_platform_pci, true); + libxl_defbool_setdefault(&b_info->u.hvm.dm_restrict, false); libxl_defbool_setdefault(&b_info->u.hvm.spice.enable, false); if (!libxl_defbool_val(b_info->u.hvm.spice.enable) && diff --git a/tools/libxl/libxl_dm.c b/tools/libxl/libxl_dm.c index e0e6a99..472a42b 100644 --- a/tools/libxl/libxl_dm.c +++ b/tools/libxl/libxl_dm.c @@ -641,6 +641,12 @@ static int libxl__build_device_model_args_old(libxl__gc *gc, flexarray_append(dm_args, "-nographic"); } + if (libxl_defbool_val(b_info->u.hvm.dm_restrict)) { + LOGD(ERROR, domid, + "dm_restrict not supported by qemu-xen-traditional"); + return ERROR_INVAL; + } + if (state->saved_state) { flexarray_vappend(dm_args, "-loadvm", state->saved_state, NULL); } @@ -1396,6 +1402,9 @@ static int libxl__build_device_model_args_new(libxl__gc *gc, } } + if (libxl_defbool_val(b_info->u.hvm.dm_restrict)) + flexarray_append(dm_args, "-xen-domid-restrict"); + if (state->saved_state) { /* This file descriptor is meant to be used by QEMU */ *dm_state_fd = open(state->saved_state, O_RDONLY); diff --git a/tools/libxl/libxl_types.idl b/tools/libxl/libxl_types.idl index 173d70a..fc39b32 100644 --- a/tools/libxl/libxl_types.idl +++ b/tools/libxl/libxl_types.idl @@ -565,6 +565,7 @@ libxl_domain_build_info = Struct("domain_build_info",[ ("rdm", libxl_rdm_reserve), ("rdm_mem_boundary_memkb", MemKB), ("mca_caps", uint64), + ("dm_restrict", libxl_defbool), ])), ("pv", Struct(None, [("kernel", string), ("slack_memkb", MemKB), diff --git a/tools/xl/xl_parse.c b/tools/xl/xl_parse.c index 02ddd2e..2c86527 100644 --- a/tools/xl/xl_parse.c +++ b/tools/xl/xl_parse.c @@ -2085,6 +2085,9 @@ skip_usbdev: b_info->u.hvm.vendor_device = d; } + + xlu_cfg_get_defbool(config, "dm_restrict", + &b_info->u.hvm.dm_restrict, 0); } if (!xlu_cfg_get_string (config, "gic_version", &buf, 1)) { -- 2.1.4 _______________________________________________ Xen-devel mailing list Xen-devel@lists.xen.org https://lists.xen.org/xen-devel