Re: [PATCH] XSM/domctl: Fix permission checks on XEN_DOMCTL_createdomain

[Daniel Smith <dpsmith@xxxxxxxxxxxxxxxxxxxx>]

---- On Mon, 29 Jul 2024 12:26:51 -0400 Andrew Cooper  wrote ---

 > The XSM checks for XEN_DOMCTL_createdomain are problematic.  There's a split 
 > between xsm_domctl() called early, and flask_domain_create() called quite 
 > late 
 > during domain construction. 
 >  
 > All XSM implementations except Flask have a simple IS_PRIV check in 
 > xsm_domctl(), and operate as expected when an unprivileged domain tries to 
 > make a hypercall. 
 >  
 > Flask however foregoes any action in xsm_domctl() and defers everything, 
 > including the simple "is current permitted to create a a domain" check, to 
 > flask_domain_create(). 
 >  
 > As a conseqeuence, when XSM Flask is active, and irrespective of the policy 
 > loaded, all domains irrespective of privilege can: 
 >  
 >  * Mutate the global 'rover' variable, used to track the next free domid. 
 >  Therefore, all domains can cause a domid wraparound, and combined with a 
 >  volentary reboot, choose their own domid. 
 >  
 >  * Cause a reasonable amount of a domain to be constructed before ultimately 
 >  failing for permission reasons, including the use of settings outside of 
 >  supported limits. 
 >  
 > In order to remedate this, pass the ssidref into xsm_domctl() and at least 
 > check that the calling domain privileged enough to create domains. 
 >  
 > This issue has not been assigned an XSA, because Flask is experimental and 
 > not 
 > security supported. 
 >  
 > Reported-by: Ross Lagerwall ross.lagerwall@xxxxxxxxxx> 
 > Signed-off-by: Andrew Cooper andrew.cooper3@xxxxxxxxxx> 
 > --- 
 
Acked-by: Daniel P. Smith <dpsmith@xxxxxxxxxxxxxxxxxxxx>