Re: [Xen-devel] [PATCH v3 2/7] xsm: flask: change the dummy xsm policy and flask hook for map_gmfn_foregin

["Jan Beulich" <JBeulich@xxxxxxxx>]

>>> On 22.10.17 at 13:21, <blackskygg@xxxxxxxxx> wrote:
> How about changing the policy to (c over d) && ((d over t) || (c over t))?
> Given that (c over d) is a must, which is always checked somewhere higher
> in the call stack as Daniel pointed out,  permitting (d over t) or (c
> over t) actually infers
> permitting the other.
> 
> - if you permit (d over t) but not (c over t):
>   Given (c over t),
>   (c) can first map the src page from (t) into its own memory space and then 
> map
>   this page from its own memory space to (d)'s memory space.

Would that work? The page, when in (c)'s space, is still owned by (t),
so I don't see how mapping into (d)'s space could become possible
just because it's mapped into (c)'s.

> - if you permit (c over t) but not (d over t):
>   Given (d over t),
>   (c) can first map (d)'s pages into its own memory space and modify (d)'s 
> code
>   to issues a hypercall that maps (t)'s memory pages into (d)'s memory space.

I can buy this one (after having thought about it a little only for
now), albeit (c) modifying code in (d) is certainly something I'd call
abuse rather than use of permissions.

Jan


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel