Hide the following information that can help identify the running Xen binary version: XENVER_extraversion, XENVER_compile_info, XENVER_changeset. This makes harder for malicious guests to fingerprint Xen to identify exploitable systems.
Add explicit cases for XENVER_commandline and XENVER_build_id as well for better code readability. Signed-off-by: Sergey Dyasli <sergey.dya...@citrix.com> --- v2 --> v3: - Remove hvmloader filtering - Add ASSERT_UNREACHABLE v1 --> v2: - Added xsm_filter_denied() to hvmloader instead of modifying xen_deny() - Made behaviour the same for both Release and Debug builds - XENVER_capabilities is no longer hided CC: Andrew Cooper <andrew.coop...@citrix.com> CC: George Dunlap <george.dun...@eu.citrix.com> CC: Ian Jackson <ian.jack...@eu.citrix.com> CC: Jan Beulich <jbeul...@suse.com> CC: Julien Grall <jul...@xen.org> CC: Konrad Rzeszutek Wilk <konrad.w...@oracle.com> CC: Stefano Stabellini <sstabell...@kernel.org> CC: Wei Liu <w...@xen.org> CC: Daniel De Graaf <dgde...@tycho.nsa.gov> CC: Doug Goldstein <car...@cardoe.com> --- xen/include/xsm/dummy.h | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index b8e185e6fa..c00186d7b6 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -750,16 +750,23 @@ static XSM_INLINE int xsm_xen_version (XSM_DEFAULT_ARG uint32_t op) case XENVER_get_features: /* These sub-ops ignore the permission checks and return data. */ return 0; - case XENVER_extraversion: - case XENVER_compile_info: + case XENVER_capabilities: - case XENVER_changeset: case XENVER_pagesize: case XENVER_guest_handle: /* These MUST always be accessible to any guest by default. */ return xsm_default_action(XSM_HOOK, current->domain, NULL); - default: + + case XENVER_extraversion: + case XENVER_compile_info: + case XENVER_changeset: + case XENVER_commandline: + case XENVER_build_id: return xsm_default_action(XSM_PRIV, current->domain, NULL); + + default: + ASSERT_UNREACHABLE(); + return -EPERM; } } -- 2.17.1 _______________________________________________ Xen-devel mailing list Xen-devel@lists.xenproject.org https://lists.xenproject.org/mailman/listinfo/xen-devel