linux-kernel - Re: [PATCH -v2] x86/msr: Filter MSR writes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 22 Jun 2020 17:19:51 +0200
From:   Borislav Petkov <bp@...en8.de>
To:     Gyan Gupta <gyan.gupta@...el.com>
Cc:     x86-ml <x86@...nel.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        lkml <linux-kernel@...r.kernel.org>,
        Sean Christopherson <sean.j.christopherson@...el.com>,
        Tony Luck <tony.luck@...el.com>
Subject: Re: [PATCH -v2] x86/msr: Filter MSR writes

On Mon, Jun 22, 2020 at 07:52:28PM +0530, Gyan Gupta wrote:
> I am also working on a similar functionality where we allow specific
> MSRs(whitelisted MSRs) to be allowed to read & write. Additionally,
> writes are subjected to checks where only certain bits can be allowed
> to be modified. This is to increase security & safety of system.
>
> For example, MCi_CTL can be used to enable/disable error reporting
> of hw unit. So in our use case once error reporting is enabled, it
> must not be disabled. Also we want to have restrictions on rdmsr for
> security purposes.

IInstead of defining whitelists, you should design proper interfaces
through sysfs or so which control the functionality you want.

If you want to do some internal testing, you don't need the whitelists
either - you simply enable writing to all MSRs like it is the case now.

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette