Re: [PATCH v12 00/18] Enable FSGSBASE instructions

From: Sasha Levin
Date: Tue May 26 2020 - 16:27:44 EST


On Tue, May 26, 2020 at 08:42:09AM -0400, Don Porter wrote:
On 5/22/20 8:45 PM, Thomas Gleixner wrote:
let me clarify, that despite your intentions:

- there is not a single word in any paper, slide deck, documentation
etc. which mentions that loading this module and enabling FSGSBASE
behind the kernels back is a fully unpriviledged root hole.

- the module lacks a big fat warning emitted to dmesg, that this
turns the host kernel into a complete security disaster.

- the module fails to set the TAINT_CRAP flag when initialized.

This shows a pretty obvious discrepancy between intention and action.

I think there is a significant misunderstanding here. This line of research assumes the kernel is already compromised and behaving adversarially toward a more trusted application. Thus, the attack surface under scrutiny in these projects is between the enclave and the rest of the system. Not that we want kernels to be rooted, or make this easier, but exploits happen in practice.

The threat model for Graphene, and most SGX papers, is quite explicit: we assume that Intelâs CPU package, the software in the enclave, and possibly Intelâs Attestation Service (IAS) are the only trusted components. Any other software should be assumed compromised, and one can even assume memory is physically tampered or that one has plugged in an adversarial device. It is not a question of the limitations of the kernel, the threat model assumes that the kernel is already rooted.

You really have to look beyond just what Graphene guarantees at this
point; it does not live on it's own island and it's success isn't
measured purely based on how well it handles it's threat model.

Yes, the threat model assumes the kernel was rooted, but you don't go
off and set the root password to '12345678' on those machines, right?
Attackers would be more than happy to run botnets, spam mailers, and
host child porn on your servers if you give them the opportunity, let's
not do that.

For the community these papers are typically written to, this assumption would be well understood. And thus it is common to see code artifacts that might emulate or even undermine security of untrusted components. Not appropriate for production use, but for the typical audience, this risk would be understood. And, initially, when people started using Graphene, I checked who they were - almost exclusively SGX researchers who would have this context. It has only been recently that the interest has grown to a level that these sorts of warnings need to be revised for a more general audience. But the point that we should revise our readme and warnings for a more general audience is well taken.

I'm really worried about the disconnect between how you view the current
state of Graphene (and the industry) vs Intel and the various cloud
providers.

You keep suggesting that its just past the academic research state,
while Intel and the big cloud providers are already pushing it to
external customers. Every one of those cloud providers has a preview/GA
secure enclave offering.

--
Thanks,
Sasha