Messages in this thread | | | From | Andy Lutomirski <> | Date | Sat, 27 Jul 2019 10:32:11 -0700 | Subject | Re: [RFC PATCH 21/21] KVM: x86: Add capability to grant VM access to privileged SGX attribute |
| |
On Fri, Jul 26, 2019 at 10:52 PM Sean Christopherson <sean.j.christopherson@intel.com> wrote: > > The SGX subsystem restricts access to a subset of enclave attributes to > provide additional security for an uncompromised kernel, e.g. to prevent > malware from using the PROVISIONKEY to ensure its nodes are running > inside a geniune SGX enclave and/or to obtain a stable fingerprint. > > To prevent userspace from circumventing such restrictions by running an > enclave in a VM, KVM restricts guest access to privileged attributes by > default. Add a capability, KVM_CAP_SGX_ATTRIBUTE, that can be used by > userspace to grant a VM access to a priveleged attribute, with args[0] > holding a file handle to a valid SGX attribute file corresponding to > an attribute that is restricted by KVM (currently only PROVISIONKEY).
Looks good to me. Thanks!
> +can use KVM_CAP_SGX_ATTRIBUTE to grant a VM access to a priveleged attribute.
Spelling.
| |