How to change page permission from inside the kernel?
I have a memory page allocated with mmap() from user space, This address is passed to some kernel module (kvm_intel to be specific) and i want to know how can I change the page permission from inside there My goal is to achieve something like this mprotect(mem, PAGE_SIZE, PROT_READ) except for mprotect can't be called from the kernel, and I couldn't find the right way to do it.
On Fri, 06 Jul 2018 20:06:29 +0200, Ahmed Soliman said:
I have a memory page allocated with mmap() from user space, This address is passed to some kernel module (kvm_intel to be specific) and i want to know how can I change the page permission from inside there My goal is to achieve something like this mprotect(mem, PAGE_SIZE, PROT_READ) except for mprotect can't be called from the kernel, and I couldn't find the right way to do it.
You better have a *really* good reason for wanting to do that from inside the kernel, when userspace is perfectly able to do it for itself. So there's two questions here: 1) Why does the page's protection need to be changed? 2) And why from inside the kernel?
So there's two questions here:
from inside KVM lkm (/virt/kvm and arch/x86/kvm )
1) Why does the page's protection need to be changed?
Implementing some kernel protection against subset of rootkits that manipulates kernel static data (memory pages as well as their mappings) by having them enforced by hypervisor which is KVM in our case (it is one way enforcement only reset by reboot). For the sake of the question what is going here is guest virtual address -> guest frame number -> host virtual address and then something that behaves like mprotect but inside a loadable kernel module the protection request is done via hypercall, so KVM should handle that internally. The point is all memory used by KVM for virtualization is mmapped at userspace and then passed to KVM using an IOCTL and kvm assumed to be free to do whatever it wants with that memory area.
2) And why from inside the kernel? Because this needs to be done from inside KVM.
Note: I am aware that this won't be effective against rootkits that live in userspace, rootkits that target kernel dynamic data, files on disk, as well as VMM escapes, but I believe if the attack surface is reduced by just a little bit, it is not that bad, so please lets not discuss that :P. Thanks.
On Fri, 06 Jul 2018 21:29:40 +0200, you said:
Implementing some kernel protection against subset of rootkits that manipulates kernel static data (memory pages as well as their mappings) by having them enforced by hypervisor which is KVM in our
Can you give an actual example of a case where *all* of the following are true? 1) It's a page that's safe to make R/O out from under the code that uses that page. 2) It's a kernel static data that's R/W (Hint: stuff known to be R/O is already set to R/O at boot or module load time, so if it's R/W it probably *needs* to be that...) 3) the rootkit *is* able to screw with kernel pages, but somehow *is not* able to disable your protection (remember, all it takes is one NOP or BRANCH opcode in the right place).
On Fri, 2018-07-06 at 21:29 +0200, Ahmed Soliman wrote:
2) And why from inside the kernel?
Because this needs to be done from inside KVM.
Note: I am aware that this won't be effective against rootkits that live in userspace, rootkits that target kernel dynamic data, files on disk, as well as VMM escapes, but I believe if the attack surface is reduced by just a little bit, it is not that bad, so please lets not discuss that :P.
It sounds like the only permission you care about is the permission of the _guest_ writing to that memory, not the permission of the qemu-kvm userspace program writing to that memory. You may be looking at the wrong page mapping to manipulate. -- All Rights Reversed.
It sounds like the only permission you care about is the permission of the _guest_ writing to that memory, not the permission of the qemu-kvm userspace program writing to that memory. Yes that is perhaps what I meant.
You may be looking at the wrong page mapping to manipulate.
I think that it is still the same mapping because hva created by qemu-kvm is the one used by the guest (after another layer of paging ?). I will check TLB specs and verify valdis worries about problems with interfering data moving to TLB. But I think I moved away from the original question. So I will re-ask it again, How can i change set R/O protection to a page from inside a kernel module ? That was the current problem I was facing.
-- All Rights Reversed.
On 07/06/2018 02:06 PM, Ahmed Soliman wrote:
I have a memory page allocated with mmap() from user space, This address is passed to some kernel module (kvm_intel to be specific) and i want to know how can I change the page permission from inside there My goal is to achieve something like this mprotect(mem, PAGE_SIZE, PROT_READ) except for mprotect can't be called from the kernel, and I couldn't find the right way to do it.
_______________________________________________ Kernelnewbies mailing list Kernelnewbies@kernelnewbies.org https://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
sounds like a good way to make a virus -- So many immigrant groups have swept through our town that Brooklyn, like Atlantis, reaches mythological proportions in the mind of the world - RI Safir 1998 http://www.mrbrklyn.com DRM is THEFT - We are the STAKEHOLDERS - RI Safir 2002 http://www.nylxs.com - Leadership Development in Free Software http://www2.mrbrklyn.com/resources - Unpublished Archive http://www.coinhangout.com - coins! http://www.brooklyn-living.com Being so tracked is for FARM ANIMALS and and extermination camps, but incompatible with living as a free human being. -RI Safir 2013
participants (4)
-
Ahmed Soliman -
Rik van Riel -
Ruben Safir -
valdis.kletnieks＠vt.edu