linux-kernel - Read Only Enforcement patches V4 [VMM based kernel hardening]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20181020222127.6368-1-ahmedsoliman0x666@gmail.com>
Date:   Sun, 21 Oct 2018 00:21:22 +0200
From:   Ahmed Abd El Mawgood <ahmedsoliman0x666@...il.com>
To:     Paolo Bonzini <pbonzini@...hat.com>, rkrcmar@...hat.com,
        Jonathan Corbet <corbet@....net>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
        hpa@...or.com, x86@...nel.org, kvm@...r.kernel.org,
        linux-doc@...r.kernel.org, linux-kernel@...r.kernel.org,
        ahmedsoliman0x666@...il.com, Ovich00@...il.com,
        kernel-hardening@...ts.openwall.com, nigel.edwards@....com,
        Boris Lukashev <blukashev@...pervictus.com>,
        Hossam Hassan <7ossam9063@...il.com>,
        Ahmed Lotfy <A7med.lotfey@...il.com>
Subject: Read Only Enforcement patches V4 [VMM based kernel hardening]

This is the 4th version and the most complete one. ROE is a hypercall
that enables host operating system to restrict guest's access to its own memory.
This will provide a hardening mechanism that can be used to stop rootkits from
manipulating kernel static data structures and code. Once a memory region is
protected the guest kernel can't even request undoing the protection.

Memory protected by ROE should be non-swapable because even if the ROE protected
page got swapped out, It won't be possible to write anything in its place.

ROE hypercall should be capable of either protecting a whole memory frame or
parts of it. With these two, it should be possible for guest kernel to protect
its memory and all the page table entries for that memory inside the page table.
I am still not sure whether this should be part of ROE job or the guest's job.

The reason why it would be better to implement this from inside kvm: instead of
(host) user space is the need to access SPTEs to modify the permissions, while
mprotect() from user space can work in theory. It will become a big performance
hit to vmexit and switch to user space mode on each fault, on the other hand,
having the permission handled by EPT should make some remarkable performance
gain.

Our model assumes that an attacker got full root access to a running guest and
his goal is to manipulate kernel code/data (hook syscalls, overwrite IDT ..etc).

There is future work in progress to also put some sort of protection on the page
table register CR3 and other critical registers that can be intercepted by KVM.
This way it won't be possible for an attacker to manipulate any part of the
guests page table.

Summary:

Documentation/virtual/kvm/hypercalls.txt | 40 -----
arch/x86/include/asm/kvm_host.h | 11 +-
arch/x86/kvm/Kconfig | 7 -
arch/x86/kvm/mmu.c | 129 ++++----------
arch/x86/kvm/x86.c | 281 +------------------------------
include/linux/kvm_host.h | 29 ----
include/uapi/linux/kvm_para.h | 5 -
virt/kvm/kvm_main.c | 119 ++-----------
8 files changed, 50 insertions(+), 571 deletions(-)