cryptospore / rpms / qemu-kvm

Forked from rpms/qemu-kvm 2 years ago
Clone

Blame SOURCES/kvm-vfio-nvlink-Remove-exec-permission-to-avoid-SELinux-.patch

ddf19c
From f01098bb86c12f485895f38f7a24170ec84b60b6 Mon Sep 17 00:00:00 2001
ddf19c
From: Greg Kurz <gkurz@redhat.com>
ddf19c
Date: Mon, 8 Jun 2020 16:25:21 -0400
ddf19c
Subject: [PATCH 42/42] vfio/nvlink: Remove exec permission to avoid SELinux
ddf19c
 AVCs
ddf19c
MIME-Version: 1.0
ddf19c
Content-Type: text/plain; charset=UTF-8
ddf19c
Content-Transfer-Encoding: 8bit
ddf19c
ddf19c
RH-Author: Greg Kurz <gkurz@redhat.com>
ddf19c
Message-id: <20200608162521.382858-2-gkurz@redhat.com>
ddf19c
Patchwork-id: 97459
ddf19c
O-Subject: [RHEL-8.3.0 qemu-kvm PATCH 1/1] vfio/nvlink: Remove exec permission to avoid SELinux AVCs
ddf19c
Bugzilla: 1823275
ddf19c
RH-Acked-by: David Gibson <dgibson@redhat.com>
ddf19c
RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
ddf19c
RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
ddf19c
ddf19c
From: Leonardo Bras <leobras.c@gmail.com>
ddf19c
ddf19c
If SELinux is setup without 'execmem' permission for qemu, all mmap
ddf19c
with (PROT_WRITE | PROT_EXEC) will fail and print a warning in
ddf19c
SELinux log.
ddf19c
ddf19c
If "nvlink2-mr" memory allocation fails (fist diff), it will cause
ddf19c
guest NUMA nodes to not be correctly configured (V100 memory will
ddf19c
not be visible for guest, nor its NUMA nodes).
ddf19c
ddf19c
Not having 'execmem' permission is intesting for virtual machines to
ddf19c
avoid buffer-overflow based attacks, and it's adopted in distros
ddf19c
like RHEL.
ddf19c
ddf19c
So, removing the PROT_EXEC flag seems the right thing to do.
ddf19c
ddf19c
Browsing some other code that mmaps memory for usage with
ddf19c
memory_region_init_ram_device_ptr, I could notice it's usual to
ddf19c
not have PROT_EXEC (only PROT_READ | PROT_WRITE), so it should be
ddf19c
no problem around this.
ddf19c
ddf19c
Signed-off-by: Leonardo Bras <leobras.c@gmail.com>
ddf19c
Message-Id: <20200501055448.286518-1-leobras.c@gmail.com>
ddf19c
Acked-by: Alex Williamson <alex.williamson@redhat.com>
ddf19c
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
ddf19c
(cherry picked from commit 9c7c0407028355ca83349b8a60fddfad46f2ebd8)
ddf19c
Signed-off-by: Greg Kurz <groug@kaod.org>
ddf19c
Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
ddf19c
---
ddf19c
 hw/vfio/pci-quirks.c | 4 ++--
ddf19c
 1 file changed, 2 insertions(+), 2 deletions(-)
ddf19c
ddf19c
diff --git a/hw/vfio/pci-quirks.c b/hw/vfio/pci-quirks.c
ddf19c
index 4505ffe48a..1c5fe014cf 100644
ddf19c
--- a/hw/vfio/pci-quirks.c
ddf19c
+++ b/hw/vfio/pci-quirks.c
ddf19c
@@ -2237,7 +2237,7 @@ int vfio_pci_nvidia_v100_ram_init(VFIOPCIDevice *vdev, Error **errp)
ddf19c
     }
ddf19c
     cap = (void *) hdr;
ddf19c
 
ddf19c
-    p = mmap(NULL, nv2reg->size, PROT_READ | PROT_WRITE | PROT_EXEC,
ddf19c
+    p = mmap(NULL, nv2reg->size, PROT_READ | PROT_WRITE,
ddf19c
              MAP_SHARED, vdev->vbasedev.fd, nv2reg->offset);
ddf19c
     if (p == MAP_FAILED) {
ddf19c
         ret = -errno;
ddf19c
@@ -2297,7 +2297,7 @@ int vfio_pci_nvlink2_init(VFIOPCIDevice *vdev, Error **errp)
ddf19c
 
ddf19c
     /* Some NVLink bridges may not have assigned ATSD */
ddf19c
     if (atsdreg->size) {
ddf19c
-        p = mmap(NULL, atsdreg->size, PROT_READ | PROT_WRITE | PROT_EXEC,
ddf19c
+        p = mmap(NULL, atsdreg->size, PROT_READ | PROT_WRITE,
ddf19c
                  MAP_SHARED, vdev->vbasedev.fd, atsdreg->offset);
ddf19c
         if (p == MAP_FAILED) {
ddf19c
             ret = -errno;
ddf19c
-- 
ddf19c
2.27.0
ddf19c